Privacy Policy

The law firm Strategy Attorneys s. r. o., with its registered office at Biskupická 25637/60C, 821 06 Bratislava - Podunajské Biskupice, Slovak Republic, Company ID (IČO): 57117497, Tax ID (DIČ): 2122569999, registered in the Commercial Register of the Bratislava III Municipal Court, Section: Sro, Insert No. 190210/B (the “Controller”), provides legal services and operates the platform www.advokatkanuch.sk, www.peterkanuch.com, www.peterkanuch.sk and www.strategyattorneys.com (together the “Platform”). The terms of use of the Platform and of the provision of the Service are governed by the general terms and conditions of the Platform (the “GTC”).

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “GDPR”), and with Act No. 18/2018 Coll. on the protection of personal data and on amendments to certain acts (the “Personal Data Protection Act”), the Controller issues the following information on the principles of protection and processing of personal data for Data Subjects (the “Policy”) when they access and use the Platform, create an Account on the Platform, order the Service and when legal services are provided.

The Controller's contact details:

1. 1.3.1

   email address: info@strategyattorneys.com

2. 1.3.2

   website: www.advokatkanuch.sk, www.peterkanuch.com www.peterkanuch.sk, www.strategyattorneys.com

3. 1.3.3

   telephone number: +421 944 768 582

The Controller has not appointed a data protection officer, as it is not required to do so under Article 37 GDPR. In matters of Personal Data protection, the Controller can be contacted using the contact details in Art. 1.3 of this Policy.

For the purposes of this Policy:

1. 1.5.1

   Personal Data means data relating to an identified or identifiable natural person who can be identified, directly or indirectly, in particular by reference to a generally applicable identifier or another identifier such as a name, surname, identification number, location data or an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person;

2. 1.5.2

   Data Subject means any natural person whose Personal Data are processed;

3. 1.5.3

   Client means a natural or legal person who creates an Account on the Platform or concludes a Contract with the Controller; for the purposes of this Policy, Data Subject means a Client who is a natural person, as well as a natural person acting on behalf of a Client that is a legal person;

4. 1.5.4

   Service means the provision of legal services;

5. 1.5.5

   Contract means a contract concluded between the Controller and the Client, in particular a contract for the provision of the Service or a contract for the provision of legal services;

6. 1.5.6

   Account means a user account created by the Client on the Platform;

7. 1.5.7

   Password means the login password to an Account created on the Platform.

In operating the Platform and processing Clients' data, the Controller acts as a controller within the meaning of Article 4(7) GDPR.

If a Client decides to create an Account on the Platform, the Client provides their Personal Data to the Controller through the registration form.

In connection with registration, ordering the Service and invoicing, the Controller processes the following data of the Client:

1. 2.3.1

   first name and surname;

2. 2.3.2

   country/region;

3. 2.3.3

   address, including street, postcode and town;

4. 2.3.4

   email address;

5. 2.3.5

   telephone number, if the Client provides it;

6. 2.3.6

   billing details, if they differ from the details above (in particular business name, Company ID (IČO), Tax ID (DIČ), VAT ID (IČ DPH));

7. 2.3.7

   data on orders and payments (in particular order history, payment method and payment status); the Controller does not process payment card data – these are processed by the payment gateway provider.

In connection with keeping and managing the Account, the Controller also processes:

1. 2.4.1

   the login email address, if it differs from the email address under Art. 2.3.4;

2. 2.4.2

   the Password, solely in a secured (hashed) form;

3. 2.4.3

   the username, if the Client creates one;

4. 2.4.4

   data on the Services the Client has purchased and on the scope of the Client's right to access them.

If the Client is a legal person, the Controller processes the Personal Data of natural persons acting on behalf of the Client (in particular its statutory body and contact person) to the extent of first name, surname, position or job title, email address and telephone number. The Controller obtains these data from the Client or from publicly available registers (e.g. the commercial register).

In connection with the provision of legal services, the Controller processes the Personal Data of Clients and of other persons concerned by the legal matter (in particular opposing parties, their representatives, witnesses and other participants in proceedings) to the extent necessary to provide the legal service, in particular identification and contact data (including date of birth, birth number and identity document data), data needed to identify the Client and verify the Client's identification under Act No. 297/2008 Coll. on the prevention of money laundering and terrorist financing and on amendments to certain acts, as amended (the “AML Act”), and other data contained in materials and documents relating to the legal matter.

Under Section 18(7) of Act No. 586/2003 Coll. on the legal profession and amending Act No. 455/1991 Coll. on trade licensing (the Trade Licensing Act), as amended (the “Legal Profession Act”), the Controller is entitled to obtain and process personal data necessary for the practice of law by copying, scanning or otherwise recording official documents on a data carrier without the consent of the data subject.

The Controller obtains the Personal Data under Art. 2.6 and 2.7 from the Client, from materials the Client hands over, from publicly available registers and sources, or from public authorities and other persons in connection with the legal matter. The Controller does not inform individually the Data Subjects whose Personal Data it did not obtain from them directly, to the extent that doing so would breach the attorney's duty of confidentiality (Article 14(5)(d) GDPR).

The Controller also processes data contained in its communication with the Client by email, by telephone or through the contact form on the Platform.

In connection with the technical operation and security of the Platform and the protection of the content of the Service, the Controller processes technical data, in particular IP addresses, device and browser data, and operational and security records (logs) of access to the Platform.

On its Platform, the Controller allows Clients, as well as visitors to the Platform without an Account, to subscribe to a newsletter (the “Newsletter”), whose purpose is to inform about news on the Platform and about the Services on offer. For persons without an Account, the Controller processes only their email address. The Controller processes Personal Data for sending the Newsletter solely on the basis of the Data Subject's consent. The Newsletter can be unsubscribed from at any time through the unsubscribe link in every Newsletter or by email sent to the Controller's address.

Special categories of personal data within the meaning of Article 9 GDPR are data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning health or data concerning a natural person's sex life or sexual orientation. The Controller does not process special categories of personal data when operating the Platform. When providing legal services, the Controller processes them only where necessary for the establishment, exercise or defence of the Client's legal claims, on the basis of Article 9(2)(f) GDPR. The Controller processes personal data relating to criminal convictions and offences only to the extent necessary to provide the legal service, in accordance with Article 10 GDPR and the Legal Profession Act.

The Controller does not require Clients to provide data belonging to special categories of personal data and asks Clients not to provide such data on the Platform, in the contact form or in other communication, unless it is necessary for the purpose of providing legal services.

The Controller has adopted appropriate technical and organisational measures under Article 32 GDPR to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, in particular encrypted data transfer (HTTPS protocol), storing Passwords solely in hashed form and restricting access to Personal Data to authorised persons only.

The Controller processes Personal Data for the following purposes and on the following legal bases:

1. 3.1.1

   creating and keeping the Account, concluding and performing the Contract and providing the Service, including communication with the Client and user support – on the basis of Article 6(1)(b) GDPR (performance of a contract and taking steps prior to entering into a contract at the request of the Data Subject);

2. 3.1.2

   providing legal services (practice of law) – on the basis of Article 6(1)(b) GDPR and, where obligations are imposed by the Legal Profession Act and the regulations of the Slovak Bar Association, on the basis of Article 6(1)(c) GDPR; special categories of personal data on the basis of Article 9(2)(f) GDPR;

3. 3.1.3

   fulfilling the Controller's legal obligations, in particular accounting and tax obligations and obligations under the AML Act, the Legal Profession Act and the regulations of the Slovak Bar Association – on the basis of Article 6(1)(c) GDPR;

4. 3.1.4

   ensuring the technical operation and security of the Platform, including keeping operational and security records (logs) and using essential cookies – on the basis of legitimate interest under Article 6(1)(f) GDPR;

5. 3.1.5

   establishing, exercising and defending the Controller's legal claims – on the basis of legitimate interest under Article 6(1)(f) GDPR;

6. 3.1.6

   sending the Newsletter – on the basis of the Data Subject's consent under Article 6(1)(a) GDPR;

7. 3.1.7

   evaluating traffic and use of the Platform through analytics cookies – on the basis of the Data Subject's consent under Article 6(1)(a) GDPR and Section 109(8) of Act No. 452/2021 Coll. on electronic communications, as amended;

8. 3.1.8

   handling questions and requests sent by email, by telephone or through the contact form – on the basis of Article 6(1)(b) GDPR if the question is aimed at concluding a Contract, otherwise on the basis of the Controller's legitimate interest in answering questions received under Article 6(1)(f) GDPR.

The legal obligations under Art. 3.1.3 arise in particular from the Legal Profession Act, Act No. 431/2002 Coll. on accounting, as amended, Act No. 222/2004 Coll. on value added tax, as amended, the AML Act, Act No. 395/2002 Coll. on archives and registries and on amendments to certain acts, as amended, Act No. 305/2013 Coll. on the electronic exercise of the powers of public authorities and on amendments to certain acts (the e-Government Act), as amended, Act No. 108/2024 Coll. on consumer protection and on amendments to certain acts, as amended, procedural regulations (in particular Act No. 160/2015 Coll., the Civil Contentious Procedure Code, Act No. 161/2015 Coll., the Civil Non-Contentious Procedure Code, and Act No. 301/2005 Coll., the Code of Criminal Procedure, as amended) and related regulations.

The Controller's legitimate interest under Art. 3.1.4, 3.1.5 and 3.1.8 is ensuring the technical operation and security of the Platform, defending the Controller against legal claims made against it, exercising the Controller's legal claims and handling questions received. The Controller has assessed that its legitimate interests are not overridden by the interests or fundamental rights and freedoms of Data Subjects; the Controller will provide information about this assessment to a Data Subject on request.

Giving consent under Art. 3.1.6 and 3.1.7 is voluntary and the Data Subject may withdraw it at any time. Withdrawing consent does not affect the lawfulness of the processing of Personal Data carried out before its withdrawal. Not giving or withdrawing consent does not affect the conclusion of the Contract or the provision of the Service.

Providing Personal Data under Art. 2.3 and 2.4 is a contractual requirement; without them it is not possible to create an Account, conclude a Contract or provide the Service. Providing the Personal Data needed to identify the Client when legal services are provided is a statutory requirement under the AML Act and the Legal Profession Act; if the Client does not provide them, the Controller cannot provide the legal service.

If the Controller intends to further process Personal Data for a purpose other than that for which they were obtained, it will provide the Data Subject, prior to such processing, with information on that other purpose and other relevant information under Article 13(3) GDPR.

The Controller retains Clients' Personal Data for the period necessary to fulfil the purpose of their processing under this Policy. The provisions of this article also apply, mutatis mutandis, to the Personal Data of Data Subjects who are not Clients.

The Controller retains the Personal Data of Clients with an Account processed for the purpose of keeping the Account until the Account is closed. If a Client does not use the Account for 3 years, the Controller will close it after a prior notice sent to the Client's email address and erase the Personal Data, unless it is obliged or entitled to retain them under Art. 4.6, 4.8 or 4.9.

The Client may at any time and without giving a reason ask the Controller to close their Account completely and to erase their Personal Data from the Controller's database. The Client sends the request to the Controller's email address, stating their first name, surname and registration (login) email address and expressly requesting that the Account be closed.

The Controller must close the Account and erase the Client's Personal Data without undue delay, no later than one month from the day the request is received, and inform the Client of the erasure of the Account within the same period, except for data the Controller is obliged or entitled to retain under Art. 4.6, 4.8 and 4.9.

The conditions under which the Controller closes an Account are governed by the GTC.

The Controller retains Personal Data stated on invoices and other accounting documents for 10 years following the year to which they relate (Section 35 of Act No. 431/2002 Coll. on accounting, as amended, and Section 76 of Act No. 222/2004 Coll. on value added tax, as amended). Closing the Account and erasing the Client's other Personal Data does not affect the fulfilment of this legal obligation.

Where Personal Data are processed on the basis of consent, the Controller processes them until consent is withdrawn. The Data Subject may withdraw their consent at any time by sending an email to the Controller's address, in the case of the Newsletter also through the unsubscribe link in every Newsletter, and in the case of analytics cookies by changing the cookie settings on the Platform. The Data Subject may give consent again.

Where Personal Data are processed on the basis of the Controller's legitimate interests, they are retained for the period necessary for those interests, namely:

1. 4.8.1

   operational and security records (logs) – 6 months from their creation, unless they are needed to investigate a security incident;

2. 4.8.2

   Personal Data needed to establish, exercise or defend legal claims – until the limitation period expires (as a rule 3 years under the Civil Code or 4 years under the Commercial Code) and, if court or other proceedings are initiated, for their duration until they are finally concluded;

3. 4.8.3

   communication, including questions sent through the contact form, that did not lead to the conclusion of a Contract – 1 year from the last message received or sent.

The Controller retains Personal Data obtained in connection with the provision of legal services in accordance with the Legal Profession Act and the regulations of the Slovak Bar Association, in particular as follows:

1. 4.9.1

   Once full, the Controller keeps the incoming mail book and the outgoing mail book for ten years from the date of receipt or dispatch of the last item recorded in them.

2. 4.9.2

   The Controller archives the inventory list for ten years from the date it was drawn up.

3. 4.9.3

   A client file may be shredded only after the shredding period has expired. The shredding period for a client file is 10 years and runs from the day on which all conditions for placing the file in the archive are met.

4. 4.9.4

   A client file containing original documents handed over to the Controller by the Client may not be shredded.

5. 4.9.5

   The registers of client files and the name indexes of client files may not be shredded.

6. 4.9.6

   A client file or a part of it that the Controller is obliged to hand over to the state archive may not be shredded.

7. 4.9.7

   A client file may not be shredded while any proceedings are pending before a court, a state administration body, law enforcement authorities or the Slovak Bar Association that relate to the content of the client file or concern an act or omission of the Controller in providing legal services to the Client.

Within the Controller, Personal Data are made available only to authorised persons (in particular attorneys, trainee attorneys and employees of the Controller), to the extent necessary for the performance of their employment or contractual duties and subject to their duty of confidentiality.

The Controller may disclose Personal Data to the following categories of recipients:

1. 5.2.1

   the provider of hosting and technical operation of the Platform;

2. 5.2.2

   the payment gateway provider;

3. 5.2.3

   the provider of the tool used to send the Newsletter;

4. 5.2.4

   the provider of analytics tools under Art. 6.3;

5. 5.2.5

   providers of email, cloud and software services and IT support;

6. 5.2.6

   external accountants, tax advisers and auditors;

7. 5.2.7

   courts, public authorities, law enforcement authorities and the Slovak Bar Association, where required or permitted by law.

Recipients under Art. 5.2.1 to 5.2.6 that process Personal Data on behalf of the Controller act as processors and process Personal Data solely on the basis of a contract under Article 28 GDPR and on the Controller's instructions.

When legal services are provided, Personal Data are disclosed only to the extent necessary and in accordance with the duty of confidentiality of the attorney and of the person to whom the data are disclosed. The Controller discloses Personal Data to persons it entrusts with carrying out individual steps of the legal service (e.g. employees), to attorneys acting as substitutes, to accountants, to providers of the firm's software and their employees, and to courts, public authorities and the Slovak Bar Association, subject to the applicable conditions of confidentiality.

The duty of confidentiality concerning the Client's Personal Data does not apply where there is a statutory duty to prevent the commission of a criminal offence or where the AML Act so provides.

The Controller transfers Personal Data to third countries outside the European Economic Area only where this is required by the use of services of recipients under Art. 5.2. In such a case, the transfer takes place on the basis of an adequacy decision of the European Commission under Article 45 GDPR (for recipients in the USA certified under the EU-US Data Privacy Framework), otherwise on the basis of standard contractual clauses adopted by the European Commission under Article 46(2)(c) GDPR. The Controller will provide the Data Subject with information on the relevant safeguards on request.

The Platform uses cookies – small text files that are stored on the Data Subject's device when they visit the Platform.

Cookies that are necessary for the operation of the Platform, for keeping the Account and for ensuring the security of the Platform are used without the Data Subject's consent; the related Personal Data are processed on the basis of the Controller's legitimate interest under Article 6(1)(f) GDPR.

For analytics and statistical purposes, the Controller uses on the Platform the Google Analytics 4 service provided by Google Ireland Ltd, Google Building Gordon House, Barrow Street, Dublin 4, Ireland, in cooperation with Google LLC (USA), which collects data on traffic and on how the Platform is used (e.g. information about the device, IP address, etc.) through cookies. Analytics cookies are used solely on the basis of the Data Subject's consent. The data may also be processed in a third country; the transfer takes place under the conditions in Art. 5.6.

Consent to the use of analytics cookies can be withdrawn or changed at any time through the cookie settings on the Platform.

The rights under this article belong to every Data Subject, including Data Subjects who are not Clients, in particular Newsletter subscribers without an Account.

The Data Subject has the right to:

1. 7.2.1

   withdraw their consent to the processing of Personal Data at any time; withdrawing consent does not affect the lawfulness of the processing carried out before its withdrawal;

2. 7.2.2

   request access to their Personal Data from the Controller;

3. 7.2.3

   receive the Personal Data concerning them which they have provided to the Controller in a structured, commonly used and machine-readable format, and transmit those Personal Data to another controller, where the processing is based on consent or on the Contract and is carried out by automated means;

4. 7.2.4

   rectification of their Personal Data;

5. 7.2.5

   erasure of their Personal Data;

6. 7.2.6

   restriction of the processing of their Personal Data;

7. 7.2.7

   object to the processing of their Personal Data;

8. 7.2.8

   file a petition to initiate personal data protection proceedings under Section 100 of the Personal Data Protection Act, or a complaint under Article 77 GDPR, with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27.

The Data Subject has the right to object at any time, on grounds relating to their particular situation, to the processing of Personal Data concerning them which is based on Article 6(1)(f) GDPR, including profiling based on that provision. The Controller may no longer process the Personal Data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject, or grounds for the establishment, exercise or defence of legal claims.

Where Personal Data are processed for direct marketing purposes (including sending the Newsletter), the Data Subject has the right to object to such processing at any time. Once an objection has been raised, the Controller no longer processes the Personal Data for those purposes.

These rights may be restricted in accordance with the GDPR depending on the specific situation, in particular where the processing of Personal Data by the Controller arises from a special regulation or where exercising them would breach the attorney's duty of confidentiality under the Legal Profession Act.

The Controller does not carry out automated individual decision-making, including profiling.

The Data Subject may exercise their rights with the Controller in person, by email, by telephone or by post at the Controller's registered office.

The Controller will provide the Data Subject with information on action taken on their request under this article of the Policy without undue delay and no later than one month from receipt of the request; taking into account the complexity and number of requests, it may extend this period by a further two months, of which it will inform the Data Subject. Exercising the rights is free of charge, except for manifestly unfounded or excessive requests under Article 12(5) GDPR. If the Controller has reasonable doubts about the identity of the person making the request, it may ask for additional information necessary to confirm their identity.

By creating an Account or concluding a Contract, the Client confirms that they have read and understood this Policy and take note of it.

The Controller reserves the right to amend the Policy. The Controller will inform Clients with an Account of any material change to the Policy by email at least 15 days before the change takes effect. A change to the Policy does not affect the validity of consents already given; if the changes require new consent, the Controller will request it separately.

This Policy takes effect on the day of its publication.