Skip to content

Privacy Policy of ARROWS Law Firm s.r.o.

This Privacy Policy (hereinafter referred to as the "Policy") informs you about how ARROWS, a law firm, s.r.o., with its registered office at U Trezorky 921/2, 158 00 Prague 5, Company ID No. 067 17 586, registered in the Commercial Register maintained by the Municipal Court in Prague under file No. C 287750 (hereinafter referred to as "ARROWS" or the "Company"), collects, retains, and further processes your personal data in connection with your client or other relationship with the Company.

1. General Provisions

The purpose of these Personal Data Processing Principles in accordance with Regulation (EU) No. 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter referred to as "GDPR") is to provide information on what personal data the Company, as the data controller, processes about individuals when providing its services, for what purposes and for how long the Company processes these personal data in compliance with applicable legal regulations, to whom and for what reasons it may transfer them, and also to inform about the rights individuals have in connection with the processing of their personal data and how they can exercise them.

These Policies pertain to the processing of data of our clients, that is, you, if you are an individual, and/or your employees or members of bodies if you are a legal entity, or visitors to the ARROWS website, always to the extent of personal data corresponding to your relationship with ARROWS. All services we provide are intended for you as our Client, who acts within the scope of their business or other entrepreneurial activities and/or in the performance of their profession for their employer, who is our client (hereinafter referred to as the "Client" or "You").

These Policies are effective as of May 25, 2018, and are issued in accordance with the GDPR to ensure the Company's information obligation as a controller pursuant to Article 13 of the GDPR.

2. Data Controller

The controller of your personal data is the Company, with current contact details available at https://www.arws.cz/kontakt

3. Data Protection Officer

The company is not obligated to appoint a Data Protection Officer. A Data Protection Officer has not been appointed within the company.

You can contact ARROWS as the data controller directly: ARROWS Law Firm s.r.o., U Trezorky 921/2, 158 00 Prague 5, tel.: +420 245 007 740, e-mail: konzultace@arws.cz

4. Categories of Personal Data Processed by ARROWS

A personal data is any information relating to a natural person, that is, you, which the Company is capable of identifying you by. In connection with the provision of services, the Company may process the following categories of personal data.

4.1 Basic Personal Identification Data

These are the types of data that are or may be necessary in certain cases for entering into a contract with you, and they primarily include the following personal data:

  • academic degree;
  • first name and last name;
  • date of birth;
  • residential / registered address;
  • Your job position (in case you are ordering our services/goods as a representative of a company);
  • Your position as a corporate body of the company, which is our client;
  • Company Identification Number, Tax Identification Number;
  • payment details.

4.2 Contact Information

The personal data in question includes:

  • first name and surname;
  • email;
  • telephone number;
  • delivery address.

4.3 Payment Details Related to the Provided Service

The personal data in question are as follows:

  • bank account number details;
  • data on executed payments;
  • Tax documents.

4.4 Personal Data Processed in Connection with the Provision of Legal Services

These are the types of data necessary for the provision of legal services, which may encompass a wide range of personal data that you provide to us for the purpose of protecting your legal interests, including, but not limited to, the following personal data:

  • first name and last name;
  • personal data relating to customer identification documents (passport, identity card, driver's license and similar), where the number of such identification document, the issuing authority, and its validity are processed;
  • date of birth;
  • birth identification number;
  • birth surname;
  • health data;
  • income data;
  • family circumstances data;
  • Your position as a body of the company, which is our client.

4.5 Record of Email and Written Communication

These are primarily personal data contained in email and written communication with the Client.

4.6 Personal Data Processed in Connection with the Sending of the Newsletter

This concerns your email address and name in the case of personalization of the sent newsletter.

5. Purpose, Duration, and Legal Basis for Processing Personal Data

5.1 Processing for the Purpose of Fulfilling Contracts, Legal Obligations, and Legitimate Interests

5.1.1 Processing of Personal Data in the Fulfillment of Contractual Obligations

In order for the Company to provide its services, it needs to know your personal data, which must then also be processed. We process your personal data primarily for the purpose of concluding and fulfilling the contract for the provision of legal services, which is concluded between the Client and the Company, where the legal basis for processing is thus the performance of the contract. For these purposes, personal data is processed to the extent of Basic Personal Identification Data, as defined in Article 4.1 of these Principles.

We obtain the personal data processed in this manner directly from you at the time of entering into the service agreement, as well as prior to the conclusion of this agreement during the negotiation of its terms, and additionally during the provision of legal services.

These personal data are processed by the Company only for the duration of the contractual relationship between the Client and the Company, and further for a period of five years after the termination of the provision of legal services between you and the Company, or for the period required by legal regulations.

5.1.2 Processing of Personal Data in Compliance with a Legal Obligation

In providing services, the Company is obligated to fulfill duties arising from the following legal regulations: Act No. 563/1991 Coll., on Accounting; Act No. 586/1992 Coll., on Income Taxes; Act No. 235/2004 Coll., on Value Added Tax; and Act No. 253/2008 Coll., on Certain Measures Against the Legalization of Proceeds from Criminal Activities (AML).

Certain personal data may be included on accounting documents (such as invoices or other records). The aforementioned laws require the Company to retain these documents for up to 10 years. Therefore, if the Company is legally obligated to archive these documents, your personal data included on the relevant document will be stored along with them.

5.1.3 Processing of Personal Data Based on Legitimate Interest

In the event that you are late with a payment, fail to fulfill your obligation, or we do not receive payment from you at all, or if any other damage or harm arises on our part due to your actions, we may also process personal data based on the legitimate interest of enforcing our claims and/or determining, protecting, and exercising the legal claims of the Company. We may retain your personal data for this purpose for the duration of the statute of limitations according to Act No. 89/2012 Coll., the Civil Code.

5.1.4 Processing of Personal Data Based on Your Consent

The Company processes your personal data primarily in cases where required by law, where data processing is necessary for the performance of a contract, or where it is based on the Company's legitimate interest. We only process personal data based on your consent in exceptional cases, in accordance with the purpose and for the duration specified in this consent.

5.1.5 Newsletter

The company may send you newsletters offering similar services related to those already provided to you, based on the company's legitimate interest or your given consent. We will send you newsletters for as long as you remain a client of the company or until you withdraw your consent. You can unsubscribe from the newsletter at any time by simply opting out at the end of each email or by sending an email to konzultace@arws.cz.

The company may send newsletters to third parties based on their provided consent.

6. To which third parties do we disclose personal data

In fulfilling its contractual obligations and duties, the Company utilizes the expert and specialized services of other entities. If these suppliers process personal data provided by the Company, they hold the status of data processors and process personal data only within the instructions from the Company and are not permitted to use it otherwise.

These include, in particular:

We have entered into data processing agreements with the personal data processors mentioned in the previous paragraph, which ensure at least the same level of protection for your personal data as these Privacy Policy terms.

In fulfilling its legal obligations, the company transfers your personal data to administrative bodies and authorities as stipulated by applicable legislation.

  • collaborating attorneys;
  • external providers of accounting and tax services;
  • external providers of IT system management services, computer networks, and hardware;
  • cookies — for more information on which cookies we process and how, please visit the Cookies section on our website.

7. Protection of Personal Data

The company has implemented and maintains necessary and appropriate technical and organizational measures, internal controls, and information security processes in accordance with the best care for users and with regard to their rights, corresponding to the potential risk to data subjects. It also considers the state of technological development to protect personal data from accidental loss, destruction, alteration, unauthorized disclosure, or access. These measures may include, among other things, taking appropriate steps to ensure the accountability of employees who have access to sensitive data and documents, employee training, regular backups, data recovery and incident management procedures, software protection of devices where personal data is stored, and more.

Employees of the Company are bound by a duty of confidentiality regarding all matters concerning you, even after the termination of their employment. A signed confidentiality agreement is part of the employment contract of the Company's employee.

8. Your Rights Regarding Personal Data

If you exercise any of your rights under this Article 8 or applicable legal regulations, we will inform each recipient to whom these data were provided under Article 6 of these Policies about the adopted measure, deletion of your personal data, or restriction of processing in accordance with your request, provided such communication is possible and/or does not require disproportionate effort.

If you wish to exercise these rights and/or obtain the relevant information, you may contact us via email at info@arws.cz or in writing at the Company's registered office address.

If you choose to exercise your rights, we may request certain identification information from you that you have provided to us. The provision of such data is necessary to verify that the relevant request was indeed sent by you. We will respond to you within one month of receiving your request, but we reserve the right to extend this period by two months.

8.1 Right of Access to Personal Data

According to Article 15 of the GDPR, you have the right to access your personal data, which includes the right to obtain from the Company:

  • confirmation as to whether their personal data is being processed;
  • information on the purposes of processing, categories of personal data concerned, recipients, planned processing period, the existence of the right to request correction or deletion of personal data or restriction of their processing or to object to processing, the right to lodge a complaint with a supervisory authority, all available information about the source of personal data, the fact that automated decision-making, including profiling, is taking place, and appropriate safeguards for data transfer outside the EU.

8.2 Right to Rectification of Inaccurate Data

According to Article 16 of the GDPR, you have the right to rectify inaccurate personal data that the Company processes about you. You also have the obligation to report changes to your personal data and provide evidence that such a change has occurred. We will carry out the rectification without undue delay, always considering the given technical possibilities.

8.3 Right to Erasure of Personal Data

According to Article 17 of the GDPR, you have the right to the erasure of personal data concerning you if the Company cannot demonstrate legitimate grounds for processing such personal data. The Company has mechanisms in place to ensure the automatic anonymization or deletion of personal data when they are no longer needed for the purpose for which they were processed.

8.4 Right to Restriction of Processing

According to Article 18 of the GDPR, the data subject shall have the right to restriction of processing until the issue is resolved, if they contest the accuracy of the personal data, the reasons for their processing, or if they object to their processing.

8.5 Right to Data Portability

According to Article 20 of the GDPR, you have the right to data portability concerning the data you have provided to us, as the controller, in a structured, commonly used, and machine-readable format. You also have the right to request that we transfer this data to another controller.

If the exercise of this right could adversely affect the rights and freedoms of third parties, your request cannot be granted.

8.6 Right to Object to the Processing of Personal Data

According to Article 21 of the GDPR, you have the right to object to the processing of your personal data by the Company.

In the event that the Company fails to demonstrate that there is a compelling legitimate reason for processing that outweighs the interests or rights and freedoms of the data subject, the Company shall terminate the processing based on the objection without undue delay.

8.7 Right to Withdraw Consent to Personal Data Processing

If you grant the Company consent to process personal data, it can be withdrawn at any time. The withdrawal must be made by an explicit, clear, and specific expression of will, either in writing to the Company's registered office address or via the email address consultation@arws.cz.

8.8 Right to contact the Office for Personal Data Protection

You have the right to file a complaint regarding our processing of your personal data with the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7. The office's website: www.uoou.cz.

9. Update of the Privacy Policy

We hereby inform you that we may amend or update this Privacy Policy. Any changes to this Policy will become effective upon their publication on the Company's website.