Privacy policy

The controller of personal data is:

• JUDr. Simona Ondrejkovičová, advokát (attorney at law)
• place of business: Majerská 44, 821 07 Bratislava, Slovak Republic
• Company ID (IČO): 52 299 864
• Tax ID (DIČ): 1124513797
• e-mail: office@oslegal.sk

In the rest of this policy I refer to myself in the first person; where legal precision requires it, I use the term “controller”.

I have not appointed a data protection officer. You can contact me directly about any data protection matter: JUDr. Simona Ondrejkovičová, e-mail office@oslegal.sk.

For the purposes of this policy, the following terms have the meanings set out below:

I collect and process personal data only for specified, explicit and legitimate purposes and do not further process them in a manner incompatible with those purposes. Each processing operation has a legal basis under Article 6 GDPR and Section 13 of the Data Protection Act and follows the principles set out in Article 5 GDPR. I process personal data both on paper and electronically.

Retention periods for each purpose are summarised under Retention periods.

Providing legal services and practising law

I process personal data necessary to enter into and perform a contract for the provision of legal services or an order, to practise law and to provide other related services (for example, authorised document conversion, authorisation of contracts or acting as an authorised person under Act No. 315/2016 Coll. on the Register of Public Sector Partners and on Amendments to Certain Acts, as amended).

• Data subjects: clients, clients’ opposing parties and other data subjects whose personal data must be processed in providing legal services and other related services.
• Legal basis: Article 6(1)(b) GDPR and Section 13(1)(b) of the Data Protection Act – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the data subject’s request prior to entering into a contract; and/or Article 6(1)(c) GDPR and Section 13(1)(c) of the Data Protection Act – processing is necessary for compliance with my legal obligations, in particular under Act No. 586/2003 Coll. on the Legal Profession, as amended, the Rules of the Legal Profession (Advokátsky poriadok), Act No. 315/2016 Coll. on the Register of Public Sector Partners, Act No. 305/2013 Coll. on e-Government and other related legislation.
• Categories of data: in particular name and surname, business name, residential address, place of business, registered office, date of birth, Company ID, Tax ID, VAT number and contact details (e-mail, telephone number).

Regulatory compliance and anti-money laundering

I also process personal data in activities carried out under the Act on the Legal Profession and, additionally, under a contract for the provision of legal services or an order – for example, internal administration, recording time, work performed and advice given, and keeping case files. This ensures compliance with the law and with the rules of the Slovak Bar Association.

Under Act No. 297/2008 Coll. on Protection against Money Laundering and Terrorist Financing and on Amendments to Certain Acts, as amended, I am in some cases required to process personal data from publicly available sources or to ask you for personal data, identity documents, other documents or sources of information to verify the identity of you, your representatives and beneficial owners, the nature of the transaction or business relationship, whether you are a politically exposed or sanctioned person, the source of funds or assets, and similar matters.

• Data subjects: clients and other data subjects whose personal data must be processed for these purposes.
• Legal basis: Article 6(1)(c) GDPR and Section 13(1)(c) of the Data Protection Act – compliance with a legal obligation, in particular under Act No. 586/2003 Coll. on the Legal Profession, Act No. 297/2008 Coll. on Protection against Money Laundering and Terrorist Financing, Act No. 583/2008 Coll. on the Prevention of Crime and Other Anti-Social Activities and other related legislation.
• Categories of data: personal data to the extent strictly necessary to meet obligations under the applicable legislation.

Accounting and invoicing

I process personal data for invoicing and bookkeeping, in particular when issuing tax documents and sending invoices.

• Data subjects: clients and, where applicable, other data subjects whose personal data must be processed for these purposes.
• Legal basis: Article 6(1)(c) GDPR and Section 13(1)(c) of the Data Protection Act – compliance with a legal obligation, in particular under Act No. 431/2002 Coll. on Accounting, Act No. 595/2003 Coll. on Income Tax and Act No. 222/2004 Coll. on Value Added Tax, as amended, and other related legislation.
• Categories of data: personal data contained in accounting and tax documents to the extent required by those acts; for invoicing, in particular name and surname, business name, residential address, place of business, registered office, date of birth, Company ID, Tax ID and VAT number.

Handling data subjects’ claims

I process personal data necessary to handle claims and similar proceedings, complaints, suggestions and requests, including the exercise of rights under the GDPR and the Data Protection Act, and to keep records of them.

• Data subjects: clients and, where applicable, other data subjects whose personal data must be processed for these purposes.
• Legal basis: Article 6(1)(c) GDPR and Section 13(1)(c) of the Data Protection Act – compliance with a legal obligation, in particular under Act No. 9/2010 Coll. on Complaints, Act No. 250/2007 Coll. on Consumer Protection, as amended, the GDPR, the Data Protection Act and other related legislation.
• Categories of data: in particular name and surname, business name, contact details (e-mail, telephone number) and, where applicable, other identification data needed to handle the matter.

Pre-contractual relations and first contact

I also process personal data when you contact me as a prospective client or other data subject (through a form on the website, by e-mail or by other appropriate means), so that I can reply to your message and prepare an offer of legal services. Details of the forms are set out under Website forms.

• Data subjects: prospective clients and other data subjects whose personal data must be processed for these purposes.
• Legal basis: Article 6(1)(b) GDPR and Section 13(1)(b) of the Data Protection Act – steps taken at the data subject’s request prior to entering into a contract; for general messages not aimed at obtaining legal services, Article 6(1)(f) GDPR and Section 13(1)(f) of the Data Protection Act – my legitimate interest in replying to messages I receive.
• Categories of data: in particular name and surname, e-mail address, telephone number where provided, and any information you include in your message.

Website operation and security

When you visit the website, the hosting provider Vercel Inc. keeps technical server logs. They are technically necessary to deliver the page, keep it secure and resolve faults.

• Data subjects: website visitors.
• Legal basis: Article 6(1)(f) GDPR and Section 13(1)(f) of the Data Protection Act – my legitimate interest in the secure and reliable operation of the website.
• Categories of data: IP address, time of the request and the URL requested.

Visitor statistics – only with your consent

If you consent in the cookie settings, I use Google Analytics 4, provided by Google Ireland Limited, to understand which parts of the website visitors find useful. Without your consent, no analytics cookies are stored. Details are on the Cookies page.

• Data subjects: website visitors who have consented to visitor statistics.
• Legal basis: Article 6(1)(a) GDPR and Section 13(1)(a) of the Data Protection Act – the data subject’s consent, in conjunction with Section 109(8) of Act No. 452/2021 Coll. on Electronic Communications.
• Categories of data: online identifiers stored in cookies and data on how the website is used (for example, pages visited, device type and browser).

The website has two forms: a contact form and an online legal enquiry form. Messages from both are sent by e-mail to office@oslegal.sk through the provider Resend (Resend, Inc., USA). The website does not store them in any database.

Contact form

• name
• e-mail address
• telephone number (optional)
• message
• consent checkbox

Online legal enquiry form

• name
• e-mail address
• telephone number (optional)
• area of law
• description of your question
• attachments in PDF, DOC, DOCX, JPG or PNG format, up to 10 MB in total
• consent checkbox

The description of your question and any attachments may also contain personal data of third parties, such as an opposing party or other people involved in the matter. Please include only the information needed to assess your question. Please send special categories of personal data (such as health data) only where this is essential to assess the matter.

Purpose and legal basis

I process the data from the forms to answer your question and send you a price offer, that is, to take steps at your request prior to entering into a contract under Article 6(1)(b) GDPR and Section 13(1)(b) of the Data Protection Act. For general messages not aimed at obtaining legal services, the legal basis is my legitimate interest in replying to messages I receive under Article 6(1)(f) GDPR and Section 13(1)(f) of the Data Protection Act.

I process personal data of third parties included in your question or attachments only to assess the matter you have brought to me and to prepare a reply, on the basis of my legitimate interest under Article 6(1)(f) GDPR and Section 13(1)(f) of the Data Protection Act.

Providing the data is voluntary. However, I cannot reply without your name, e-mail address and message or description of your question.

Retention

I keep data from the forms for as long as needed to deal with your enquiry. If no contract for the provision of legal services follows, I delete it without undue delay and at the latest within [period – to be confirmed by the client]. If we do enter into a contract, the data become part of the case file and are kept for the period stated for providing legal services.

Messages are delivered by Resend, Inc. acting as my processor. The transfer of data to the USA is described under Transfers to third countries.

Personal data may be accessed by persons I authorise to process them, solely for the purposes and to the extent set out in this policy and the law – for example, persons I instruct to carry out individual steps in legal services, substitute or cooperating attorneys, interpreters and translators.

Personal data may also be accessed by processors acting on my behalf under a data processing agreement. I only use processors who provide sufficient guarantees of appropriate technical and organisational measures, so that the processing meets the requirements of applicable law and protects your rights.

For the website, these are:

• Vercel Inc., USA – website hosting and technical server logs;
• Resend, Inc., USA – delivery of form messages to office@oslegal.sk;
• Google Ireland Limited, Ireland – Google Analytics 4 visitor statistics, only with your consent.

If you click “Show map” on the Contact page, a Google map is loaded. Google Ireland Limited then receives data about your device, in particular your IP address, and may set its own cookies. Google processes these data under its own privacy policy.

In exceptional cases, my contractual partners and service providers, such as an IT service provider or server administrator, may also have access to personal data. I also disclose personal data to other recipients or third parties where the law requires me to do so – for example, to law enforcement authorities when reporting a suspected crime or preparation of a crime.

Everyone who comes into contact with your personal data has been properly trained in data protection and security, may handle the data only on my express instructions and is bound by confidentiality, including after the end of the contractual relationship.

Further details of processors and recipients are available on request at office@oslegal.sk.

My processors Vercel Inc. and Resend, Inc. are based in the United States, so personal data are transferred to the USA when the website is operated and when forms are sent. Transfers take place on the basis of the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework, where the recipient is certified under that framework, or on the basis of standard contractual clauses approved by the European Commission under Article 46(2)(c) GDPR.

Google Ireland Limited may also transfer data from Google Analytics and Google Maps to the USA, under the conditions set out in its privacy policy.

I do not otherwise transfer personal data to a third country or an international organisation. Should such a transfer become necessary, it will take place only if I have put adequate safeguards in place or with your explicit consent to the proposed transfer.

I keep personal data only for as long as necessary to achieve the purpose for which they were collected, or for the period required by applicable law.

I have adopted appropriate technical and organisational measures to ensure a level of security appropriate to the risk and to protect personal data against unauthorised disclosure, unauthorised or unlawful processing, and intentional, accidental or negligent erasure, loss, damage, destruction, alteration or loss of integrity. The measures take into account the nature, scope and purposes of processing and the risks to the rights and freedoms of data subjects, and I review them regularly.

Authorised persons and contractual partners with access to personal data are bound by confidentiality, which continues after the end of the contractual relationship. I regularly monitor compliance with security measures and confidentiality obligations.

I do not use automated decision-making or profiling when processing personal data.

If you provide me with personal data, you are required to provide accurate and up-to-date data and to inform me of any changes without undue delay. Your rights are summarised below; they are set out in full in the GDPR and the Data Protection Act.

How to exercise your rights

You can send a request in writing to JUDr. Simona Ondrejkovičová, Majerská 44, 821 07 Bratislava, Slovak Republic, or by e-mail to office@oslegal.sk.

To verify that the request really comes from you, I may ask for some identification details you have previously provided, only to the extent strictly necessary. I will deal with your request without undue delay and at the latest within one month of receiving it; in more complex cases I may extend this period by a further two months and will let you know. I will also inform every recipient to whom the personal data have been disclosed of the action taken, unless this proves impossible or involves disproportionate effort.

Right of access

You have the right to know whether I process personal data about you and to what extent, and to ask me for access to those data together with further information under applicable law.

Right to rectification

If your personal data are inaccurate, incomplete or have changed, you have the right to have them corrected or completed.

Right to erasure

You can ask me at any time to erase your personal data. I will erase them without undue delay if I no longer need them to meet contractual or legal obligations or to protect my legitimate interests (establishing or defending legal claims). I will also erase them if you withdraw the consent on which the processing is based, or where the law requires it.

Right to restriction of processing

If, for example, you contest the accuracy or lawfulness of the processing, you can ask for it to be restricted. I will then only store the data, or process them only to establish, exercise or defend legal claims, to protect the rights of another person or for other reasons laid down by law. I will inform you before the restriction is lifted.

Right to data portability

At your request, I can send personal data that I process under a contract for the provision of legal services, an order or your consent directly to another controller, provided this does not adversely affect the rights and legitimate interests of others and is technically and legally feasible.

Right to object

You can object at any time, on grounds relating to your particular situation, to processing based on my legitimate interest. Unless I demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or that the data are needed to establish, exercise or defend legal claims, I will stop processing the data and erase them without undue delay.

Right to withdraw consent

You can withdraw any consent you have given at any time – consent to analytics cookies simply through the “Cookie settings” link in the website footer, any other consent by e-mail or in writing. Withdrawal does not affect the lawfulness of processing before the withdrawal.

Right to lodge a complaint

If you believe that my processing of personal data breaches the law, you have the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, Slovak Republic.

The website uses necessary cookies, without which it cannot work properly, and Google Analytics 4 analytics cookies, which I switch on only with your consent. The Google map on the Contact page loads only after you click “Show map”. The list of cookies and how to change your choice are on the Cookies page.

I may update this policy from time to time in line with applicable law and changes in the scope and manner of processing. The current version, together with the date of the last update, is always published on this page. This policy replaces the previous privacy policy published on oslegal.sk as a PDF.

If you have any questions about the processing of personal data, you can contact me at any time at office@oslegal.sk.