Privacy Policy

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “GDPR”).

This document provides information on how we process your personal data.

1. LAW FIRM AS THE CONTROLLER OF PERSONAL DATA

The controller of personal data is FALATH & PARTNERS s. r. o., a law firm with its registered office at Pribinova 28, 811 09 Bratislava – Staré Mesto, Identification No. 56 136 048, registered in the Commercial Register of the Municipal Court Bratislava III, Section: Sro, File No. 176826/B (the “Law Firm” or “us”).

2. HANDLING INQUIRIES ABOUT PERSONAL DATA PROCESSING

If you have any questions regarding the processing or protection of personal data, you may contact us at any time by phone at +421 2 3200 6660 or by e-mail at office@falathpartners.sk, or by post to the address of our registered office.

Contact details

Phone: +421 2 3200 6660

E-mail: office@falathpartners.sk

3. PROCESSING OF PERSONAL DATA

We process your personal data with your consent, and without your consent only in cases permitted by applicable legal regulations. The processing of your personal data is our contractual requirement, and in many cases it is also our legal requirement. If personal data are necessary for the conclusion or performance of a contract, special legal regulations, or the purposes of the legitimate interests pursued by us, they have to be provided to us; otherwise, we may be unable to fulfill our legal obligations or provide our services to you.

We process your personal data only as follows:

3.1 PERSONAL DATA ABOUT SUPPLIER, CUSTOMER, OR PERSON AUTHORIZED BY SUPPLIER OR CUSTOMER

Purpose: Accounting agenda, accounting management, and fulfillment of duties based on accounting regulations.

Legal Basis: Art. 6(1)(c) of GDPR – fulfillment of our legal obligations arising from special legal regulations.

Retention Period: In accordance with deadlines established by relevant legislation.

3.2 PERSONAL DATA RELEVANT FOR FULFILLING CONTRACTUAL RELATIONS BETWEEN SUPPLIERS AND CUSTOMERS

Purpose: Fulfillment of rights and obligations arising from contractual relations.

Legal Basis: Art. 6(1)(f) of GDPR – processing is necessary for the performance of our legitimate interest, which is fulfillment of contractual and pre-contractual relations with suppliers and customers.

Retention Period: Until the termination of the contractual or pre-contractual relationship and until the expiration of applicable limitation, preclusive, complaint, storage, and other similar periods, until the expiration of the last of these periods.

3.3 PERSONAL DATA ABOUT ADDRESSEES AND RECIPIENTS OF OUR CORRESPONDENCE

Purpose: Records of received and sent correspondence, including electronic correspondence.

Legal Basis: Art. 6(1)(c) of GDPR – arising from specific legal regulations, in particular Act No. 586/2003 Coll. on Advocacy and on Amendments to Act No. 455/1991 Coll. on Small Business (Trade Licensing Act), as amended, and Act No. 395/2002 Coll. on Archives and Registries and on Amendments to Certain Acts, as amended.

Retention Period: In accordance with deadlines established by relevant legislation.

3.4 PERSONAL DATA ABOUT JOB APPLICANTS

Purpose: Filling vacant positions in the Law Firm.

Legal Basis: Art. 6(1)(b) of GDPR – fulfillment of pre-contractual (especially labor-law) relations with job applicants.

Retention Period: Until the selection process is completed.

3.5 PERSONAL DATA ACCORDING TO GDPR

Purpose: Exercise of the data subject’s rights and fulfillment of our obligations under GDPR.

Legal Basis: Art. 6(1)(c) of GDPR – fulfillment of legal obligations under GDPR in conjunction with the exercise of legitimate interest under Art. 6(1)(f) of GDPR – processing is necessary for the performance of our legitimate interest, which is to respond to the data subject’s requests and fulfill other GDPR obligations, as well as the reasonable expectations of the data subject that their requests will be handled. Special categories of personal data are processed based on Art. 9(2)(f) of GDPR, as processing is necessary for the establishment, exercise, or defense of legal claims.

Retention Period: Five (5) years – period based on the authority of the Office for Personal Data Protection to carry out an inspection in the Law Firm.

3.6 PERSONAL DATA RELEVANT FOR ENSURING NETWORK SECURITY

Purpose: Ensuring our network and other security for the protection of personal data.

Legal Basis: Art. 6(1)(f) of GDPR – processing is necessary for the performance of our legitimate interest, which is ensuring our network security and implementing appropriate security measures.

Retention Period: One (1) year.

3.7 PERSONAL DATA ABOUT CLIENTS, POTENTIAL CLIENTS, AND COUNTERPARTIES

Purpose (1): Fulfillment of obligations under Act No. 297/2008 Coll. on protection against legalization of proceeds from criminal activity and protection against financing of terrorism and on amendments to certain acts, as amended (Section 20).

Legal Basis: Art. 6(1)(c) of GDPR – processing is necessary for the fulfillment of legal obligations of the Law Firm under a special regulation. Special categories of personal data are processed in conjunction with Art. 9(2)(g) of GDPR – reasons of substantial public interest based on EU law.

Retention Period: Statutory periods in accordance with the Act on Protection against Legalization of Proceeds from Crime and Protection against Financing of Terrorism and on Amendments to Certain Acts, as amended.

Purpose (2): Fulfillment of obligations under Act No. 297/2008 Coll. on protection against legalization of proceeds from criminal activity and protection against financing of terrorism and on amendments to certain acts, as amended (Section 20).

Purpose (3): Counterparty: Performance of business activity – practice of advocacy in accordance with § 1(2) of Act No. 586/2003 Coll. on Advocacy.

Legal Basis: Art. 6(1)(f) of GDPR – processing is necessary for the performance of our legitimate interest, which is processing personal data of the data subject, their counterparties and their authorized representatives/contact persons for the performance of its activity.

Retention Period: Until the termination of the contractual relationship and until the termination of the rights and obligations arising from contractual and pre-contractual relationships, the provision of services, and until the expiry of applicable limitation periods, preclusive periods, complaint periods, retention periods, and other similar periods, namely until the expiry of the last of these periods.

3.8 PERSONAL DATA ABOUT WEBSITE VISITS

Purpose (1): Ensuring functionality and performance of our website.

Legal Basis: Art. 6(1)(f) of GDPR – processing is necessary for the performance of our legitimate interest, which is ensuring functionality and effective performance of the website, which the data subject can reasonably expect.

Retention Period: Automatic deletion after leaving our website.

Purpose (2): Ensuring connection between website and contact with Law Firm via contact form.

Legal Basis: Art. 6(1)(b) of GDPR – processing is necessary for pre-contractual relations (if the potential client is a natural person). Art. 6(1)(f) of GDPR – processing is necessary for the performance of our legitimate interest, which is ensuring that clients are able to contact us (if the potential client is a legal entity).

Retention Period: Until the completion of the pre-contractual relationship, or until the potential client becomes a client.

3.9 PERSONAL DATA ABOUT VISITORS OF LAW FIRM’S SOCIAL NETWORKS

Purpose: User profiles of the Law Firm on social networks.

Legal Basis: Art. 6(1)(f) of GDPR – processing is necessary for the performance of our legitimate interest, which is raising awareness of our activities.

Retention Period: Until consent is withdrawn.

3.10 PERSONAL DATA FOR THE PURPOSE OF REFERENCES TO THE LAW FIRM

Purpose: Publishing references from our clients on the Law Firm’s website.

Legal Basis: Art. 6(1)(a) of GDPR – consent of the data subject.

Retention Period: Until consent is withdrawn.

4. PERSONAL DATA PROCESSING PERIOD

We process your personal data for the periods stated above. When the period for which we have a valid purpose for processing your personal data expires, your personal data will be deleted. If the legal basis of your personal data processing is your consent, we process your personal data only for the duration of its validity, or until its withdrawal.

5. COLLECTION OF PERSONAL DATA

Personal data is generally collected directly from you within contractual relations or originates directly from public registers, publicly available sources, and other sources (e.g., courts, police, and administrative bodies) that we accessed within the practice of advocacy.

6. SCOPE OF PROCESSED PERSONAL DATA

We primarily process ordinary personal data about you that you provide to us or that we obtain from other sources, electronically via e-mail, by post, or by other means.

We process special categories of personal data (so-called sensitive personal data) about you only within the scope of fulfilling our advocacy duties in the context of contractual relations, which we base on a relevant legal basis in conjunction with a relevant exception from the prohibition of processing sensitive data under Art. 9(2) of GDPR.

7. RECIPIENTS OF PERSONAL DATA

We provide your personal data only in justified cases and only to the necessary extent to our contractual partners whom we need for our normal operation and realization of contractual relations – these partners are: (i) our employees and attorneys cooperating with us; (ii) our document management and cloud services administrators; (iii) our tax, accounting, and payroll services administrators; (iv) social media, where our Law Firm has been registered; and (v) communication applications, which our Law Firm uses for its internal and external communication.

We provide your personal data also to other entities in cases where the law imposes a right or obligation to provide your personal data to them, or if it is necessary for the protection of our legitimate interests (e.g., courts, police, etc.).

8. AUTOMATED DECISION-MAKING AND PROFILING

Your personal data is not and will not be used for automated individual decision-making or profiling.

9. TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES

Your personal data may, in certain cases, be transferred to third countries outside the European Union. When using tools from Facebook and Google, personal data may be transferred to the United States of America (USA). The manner in which these companies handle personal data is stated in their privacy policies available on their websites.

Transfer of personal data to the USA is carried out in accordance with Art. 6(1)(a) of GDPR (lawfulness of processing based on consent of the data subject) and Art. 49(1)(a) of GDPR, as it concerns a transfer to a third country for which adequate guarantees of personal data protection comparable to EU standards do not exist. Such transfer of personal data to the USA is therefore associated with risk and may only take place based on the explicit consent of the data subject.

According to the decision-making practice of the Court of Justice of the European Union (CJEU), appropriate safeguards, enforceable rights, and effective legal remedies must ensure that the level of protection of the rights of data subjects when transferring personal data to a third country is essentially equivalent to the level of protection guaranteed within the European Union (CJEU judgment in case C-311/18 of July 16, 2020, point 5). The assessment of the level of protection must take into account the contractual terms between the controller in the EU and the recipient in the third country, as well as relevant aspects of the recipient’s legal system, including public authorities’ access to the transferred data.

By decision in case C-311/18 (so-called Schrems II), the CJEU declared invalid Commission Implementing Decision (EU) 2016/1250 on the adequacy of the protection provided by the EU-U.S. Privacy Shield. This abolished the possibility of transferring personal data to the USA based on an adequacy decision under Art. 45 of GDPR.

This was followed by the Austrian Data Protection Authority, which in the NOYB case stated that Google is a provider of electronic communication services under the US legal system (§§ 1881(b)(4) and 1881a of the FISA Act), and therefore, processed personal data may be provided to US intelligence services. The Austrian authority concluded that such access by US authorities is not in accordance with Art. 44 of GDPR (the general principle for transfers).

As noted above, on July 10, 2023, the EU-U.S. Data Privacy Framework (the “Framework”) was adopted by Commission Decision No. 2023/1795. A complaint against the Framework was filed with the CJEU on September 3, 2025, and its decision is expected in the coming months.

In addition, your personal data may be transferred to third countries outside the EU (e.g., Turkey or Israel) to facilitate mutual contacts. Such a transfer will take place only if:

you express explicit consent to the transfer after being informed of the risks resulting from the absence of an adequacy decision and appropriate safeguards in the third country; or
the transfer is necessary for the performance or conclusion of a contract between you and us, or for the implementation of pre-contractual measures taken at your request; or
the transfer is necessary for the establishment, exercise, or defense of legal claims; or
appropriate safeguards exist, mainly through standard contractual clauses on data protection, concluded with the contractual partner in the third country.

10. RIGHTS OF THE DATA SUBJECT REGARDING PERSONAL DATA PROCESSING

If we process your personal data based on the exercise of legitimate interest under Art. 6(1)(f) of GDPR, you have a right to object to their processing at any time.

If we process your personal data based on granted consent under Art. 6(1)(a) of GDPR, you have a right to withdraw consent for the processing of your personal data for the purpose for which consent was granted at any time.

In addition to the rights listed above, you also have the following:

1. right of access – you may request access to personal data that we process about you at any time. We will also provide you with a copy of the processed personal data.

2. right to rectification – you may request the correction of inaccurate or incomplete personal data that we process about you at any time.

3. right to erasure – you may request the deletion of your personal data at any time if one of the following situations occurs:

3.1 the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; or

3.2 you withdrew the consent you have given to us for their processing; or

3.3 the personal data were processed unlawfully; or

3.4 you object to the data processing, and there are no overriding legitimate grounds for the processing of them; or

3.5 the personal data must be deleted to comply with a legal obligation established by EU law or the law of a Member State applicable to us.

4. right to restriction of processing – you may request us to restrict the processing of your personal data at any time if one of the following situations occurs:

4.1 you contested the accuracy of the personal data, for a period enabling us to verify the accuracy of the personal data;

4.2 the processing of your personal data is unlawful, but we refused to delete this data, and instead, you request restriction of their use;

4.3 we no longer need your personal data for the purposes of processing, but you need it to establish, exercise, or defend legal claims; or

4.4 you objected to the processing of your personal data pursuant to Art. 21(1) of GDPR, pending verification whether our legitimate grounds override yours.

5. right to data portability – if we process your personal data based on your consent or because it is necessary for the performance of a contract to which you are a party, and at the same time the processing is carried out by automated means, then you have a right to receive the personal data concerning you and which you provided to us, in a structured, commonly used, and machine-readable format, provided that this right must not adversely affect the rights and freedoms of others.

6. right to lodge a complaint – you have a right to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic, with its registered office at Galvaniho Business Centrum II, Galvaniho 7/B, 821 04 Bratislava, Slovak Republic, website: https://dataprotection.gov.sk/sk/.

11. EXERCISING THE RIGHTS OF THE DATA SUBJECT

You may exercise your rights orally, in writing, or electronically via the contact details provided above. We will provide information on the action taken on your request without undue delay and in any event no later than one (1) month from receipt of the request.

We may request additional information necessary to confirm your identity if we have reasonable doubts concerning the identity of the natural person submitting the data subject rights request, as we are obliged to prevent disclosure of personal data to unauthorized persons. If this period needs to be extended in justified cases, we will inform the data subject in due time.

Where your request is manifestly unfounded or excessive, in particular due to its repetitive character, we reserve the right to refuse to act on the request or to charge a reasonable fee, taking into account the administrative costs of providing the information or taking the requested action.