PERSONAL DATA PRIVACY POLICY

BDO Legal s.r.o., with its seat at: Mostová 2, 811 02 Bratislava - mestská časť Staré Mesto, Slovak republic, Identification number: 51 803 330, registered within the Commercial Register of District Court Bratislava I, Section: Sro, File No.: 129300/B (hereinafter referred to as „BDO Legal“)

This Privacy Policy deals with the explanation of the processing of natural persons´ personal data by BDO Legal.

How the BDO Legal assesses the protection of personal data?

Processing of personal data by the BDO Legal is made pursuant to the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as “General Data Protection Regulation” or as “GDPR”), pursuant to provisions of the Act. 18/2018 Coll. on the protection of personal data (hereinafter referred to as “Personal Data Protection Act”), which are relevant for the BDO Legal, pursuant to Act. No. 586/2003 Coll. on advocacy (hereinafter referred to as “Advocacy Act”), as well as pursuant to other applicable legal acts.

The BDO Legal adheres to the Code of conduct for processing of personal data by attorneys issued by Slovak Bar Association and approved by the Office for Personal Data Protection of the Slovak Republic by decision no. 00676/2018-Os-9 of 4^th of December 2018, which entered into force on 10^th of December 2018 (hereinafter referred to as “Code”). In accordance with Article 24 (3) of the GDPR, compliance with the Code may be used as an element to demonstrate the compliance with obligations imposed on attorneys under the GDPR.

This Privacy Policy is also aimed to fulfil the information obligation of the BDO Legal stemming from the Articles 13 and 14 of the GDPR.

How the BDO Legal is provided with the personal data?

Mostly directly by a client. Non-provision of the personal data by a client might affect the ability of the BDO Legal to provide the legal services of high quality or might even lead to obligation of the BDO Legal to reject the provision of the legal services. The BDO Legal is entitled to obtain the personal data from public sources and registers, from state authorities or from other persons.  

Personal data related to other persons are usually obtained by the BDO Legal directly from the clients or from public registers or other public sources (e.g. by demands to state authorities, extracts from public registers such as Commercial Register of Slovak republic, Trade Register of Slovak republic, Cadastre, Register of Public Sector Partners etc., collecting of evidence to the benefit of the clients etc.). The latter represents the statutory right to process the personal data without informing the data subject or even against the will of the data subject stemming from the right and the obligation of the BDO Legal to provide the legal services pursuant to the Advocacy Act.

Which categories of personal data are processed by the BDO Legal?

BDO Legal processes mainly your basic personal data, such as name, surname, title, address, email address, telephone number. In situations where the BDO Legal practices as an authorised person pursuant to Act No. 315/2016 Coll. on Register of Public Sector Partners, also data regarding your financial status and property information may be processed. Special categories of personal data, such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data, data concerning sex life or sexual orientation may be processed only when it is necessary with relation to effective representation of our client in judicial proceedings or in other proceedings held before respective public authorities.

What are the purposes and legal grounds for processing of the personal data by the BDO Legal ?

Purposes of processing	Legal ground for processing
Practice of profession (provision of legal services)	Compliance with legal obligation pursuant to Article 6 (1) (c) GDPR, performance of contract pursuant to Article 6 (1) (b) GDPR
Provision of non-legal services	Performance of contract pursuant to Article 6 (1) (b) GDPR, compliance with legal obligation pursuant to Article 6 (1) (c) GDPR
Practice of an authorised person pursuant to Act on Register of Public Sector Partners	Compliance with legal obligation pursuant to Article 6 (1) (c) GDPR, performance of contract pursuant to Article 6 (1) (b) GDPR
Compliance with laws and regulations of Slovak Bar Association	Compliance with legal obligation pursuant to Article 6 (1) (c) GDPR, legitimate interest of attorneys pursuant to Article 6 (1) (f) GDPR or public interest pursuant Article 6 (1) (e) GDPR.
Practice of the electronical communication with public authorities, practicing of the due conversion of written documents to an electronical form and vice versa, administration of the electronical mailbox within the Central Portal of the Public Administration of Slovak republic	Compliance with legal obligation pursuant to Article 6 (1) (c) GDPR, mainly Act No 305/2013 Coll. on the electronic form of the exercise of the powers of public authorities and amending certain acts (e-Government Act), as amended
Purposes concerning protection of legitimate interests	Legitimate interest of the BDO Legal or third parties pursuant to Article 6 (1) (f) GDPR
Defending of the claims of the BDO Legal (law and enforcement agenda)	Legitimate interest of the BDO Legal pursuant to Article 6 (1) (f) GDPR: defending of the claims of the BDO Legal
Publishing and adjusting of the content via social networks and website	Legitimate interest of the BDO Legal pursuant to Article 6 (1) (f) GDPR: enhancement of the acknowledgment of the BDO Legal online
Enhancement of the acknowledgment of the BDO Legal online	Legitimate interest of the BDO Legal pursuant to Article 6 (1) (f) GDPR or Consent of data subject pursuant to Article 6 (1) (a) GDPR
Marketing purposes	Consent of data subject pursuant to Article 6 (1) (a) GDPR or legitimate interest of the BDO Legal pursuant to Article 6 (1) (f) GDPR: direct marketing purposes
Personnel & Payroll	Compliance with legal obligation pursuant to Article 6 (1) (c) GDPR, performance of contract pursuant to Article 6 (1) (b) GDPR, alternatively legitimate interest pursuant to Article 6 (1) (f) GDPR
Accounting & Tax purposes	Compliance with legal obligation pursuant to Article 6 (1) (c) GDPR
Statistical purposes, archiving purposes in public interest and purposes of historical and scientific research	The legal ground that allowed collection of personal data for original purposes (compatible purposes) in the light of Article 89 GDPR.

 

If there is processing of the personal data under Article 6 (1) (a) GDPR, the data subject holds the right to withdraw their consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

What legitimate interests of the BDO Legal are there?

Legitimate interests	Explanation
Protection of assets, financial interests and market position	The BDO Legal uses the principles of the standardised minimal technical elements of the privacy policies.
Defending of the claims of the BDO Legal	These are situations where the BDO Legal enforces its claims.
Enhancement of the acknowledgment of the BDO Legal online	When publishing content on social networks (Google and LinkedIn) and on our website, there may be a processing of the personal data including profiling.
Direct marketing purposes	Direct marketing purposes may be considered a legitimate interest pursuant to recital 47 of the GDPR.

 

To whom are the personal data disclosed by the BDO Legal?

When processing the personal data, the BDO Legal abides the statutory obligation of personal data disclosure to an inevitable extent only. The personal data may be disclosed to the employees, persons authorised by the BDO Legal to specific legal act, cooperating or representing attorneys, our accountancy or tax advisors, server storage providers, accountancy software providers, Slovak Bar Association or software accessories providers or support providers of the BDO Legal, including employees of such persons. Furthermore, the BDO Legal is obliged to disclose the personal data in order to inhibit the commitment of the crimes or in order to fulfil its obligations related to the prevention of legalization of proceeds of criminal activity and terrorist financing, even though the BDO Legal is generally bound by the statutory obligation of the non-disclosure.

To which countries may the personal data be transferred?

The BDO Legal does not transfer your personal data to a third country subjects outside the European economic area (member states of the European Union, Island, Norway and Lichtenstein), unless it is necessary with relation to practice of profession of advocacy (e. g. handing over of your personal data to a cooperating or representing attorneys residing in third country on the basis of the request of the client) or with relation to fulfilment of the statutory obligations of the BDO Legal as the authorised person towards the public sector partners. Should such transfer be about to happen, the BDO Legal shall in advance make sure that the third county, to which your personal data might be transferred, provides the respective personal data protection pursuant to respective legal acts, e. g. such third country has been issued European Commission decision on the adequacy (EU-US Privacy Shield or Swiss-US Privacy Shield etc.) or such third country possesses other guarantees required by GDPR.

What automated individual decision-making is made by the BDO Legal?

There is no automated individual decision-making made by our law firm.

How long are the personal data stored by the BDO Legal?

Pursuant to GDPR, the BDO Legal stores the personal data for a period necessary for a purpose of the processing. When storing the personal data, the BDO Legal abides the recommended storing periods as stipulated in the Decision of the Slovak Bar Association No. 29/11/2011, i.e.: 

• delivered and sent correspondence books shall be stored by the attorney for a period of ten (10) years from the date of the deliverance or sending, 

• inventory list shall be archived by the attorney for a period of ten (10) years from the date of its creation,

• should the attorney hold the name-list of the clients and client file in an electronic form, the printed form of such documents shall be made at the end of each calendar year and stored without time limitation,

• shredding period of the client file shall be ten (10) years and shall commence from the day when all the conditions of the archiving of the file are fulfilled. 

There are specific provisions of the Slovak Bar Association applicable to the BDO Legal, which stipulate certain obligations of the BDO Legal, pursuant to Advocacy Act, under which the storage periods may be prolonged (or under which the BDO Legal is not entitled to shred the documents):

• client file containing the original documents provided to the BDO Legal by the client shall not be shredded, 

• name-list of the client files and client file protocols shall not be shredded,

• client file or its part which is to be provided by the BDO Legal to a state archive shall not be shredded,

• should there be any proceeding before court, state authority, criminal proceeding, proceeding before Slovak Bar Association, which are connected to the content of the client file or which are related to the provision of legal services of the BDO Legal towards the client, documents related to it shall not be shredded.

Additionally, the BDO Legal is entitled to store the personal data related to accounting documents for a period of ten (10) years pursuant to Act No. 431/2002 Coll.

What are the rights of the data subject?

You are, as the data subject, entitled to request the BDO Legal to:

• issue a confirmation, whether your personal data are processed by the BDO Legal including your access to your personal data, as well as to other information which relate to you,

• rectify the incorrect, inaccurate or incomplete personal data which relate to you,

• erase (right to be forgotten) the personal data which relate to you, provided that there is a reason under Article 17 of the GDPR, e.g.:
  • the BDO Legal does not need the personal data anymore, or
  • the BDO Legal processes the personal data unlawfully.

• limit the processing of the personal data which relate to you provided that there is a reason under Article 18 of the GDPR,

• transfer the personal data to another controller in a structured, commonly used and machine-readable format, if technically possible, provided that the processing has the following grounds:
  • consent, express consent or contract,
  • processing is made by automated means.

• stop processing of the personal data based on an objection, e.g. if personal data are processed for a direct marketing purpose,

• to be excluded from the decision based exclusively on the automated processing including profiling and which is effective towards you or affects you in other way,

• you are also entitled to request the BDO Legal to examine the issued decision by a method using other means than those used in automated processing; you are also entitled to provide your point of view and even challenge such decision,

• you are also entitled, at any time, to file a complaint to the Office for Personal Data Protection or to the Slovak Bar Association,

• you are also entitled to claim your rights at a respective court.

Cookies processing:

Website of the BDO Legal does not process the cookies. Should there be the cookies processing present on our website in the future, we would only process cookies in order to determine whether the website visitor viewed our website inside or outside the area of Slovak republic, so that we can adjust the website and view it either in Slovak language, or in English language. We would like to assure you that in such case we would ask your consent to processing of the cookies by a pop-up window on our website. Pursuant to Article 55 (5) of the Act on electronical communications, the setting of the browser (e.g. non-blocking of the cookies) of the visitor may be considered a consent to processing of the cookies.

More information about the cookies and its processing may be found at https://wikis.ec.europa.eu/display/WEBGUIDE/04.+Cookies.

Change of the privacy policy:

The BDO Legal shall at any time have the exclusive right to a change of this Privacy Policy.

Rules of this Privacy Policy have been implemented since 25^th of May 2018.