Privacy Policy
Last updated August 29, 2026
Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “GDPR”).
This document provides information on how we process your personal data.
The controller of personal data is FALATH & PARTNERS s. r. o., a law firm with its registered office at Pribinova 28, 811 09 Bratislava – Staré Mesto, Identification No. 56 136 048, registered in the Commercial Register of the Municipal Court Bratislava III, Section: Sro, File No. 176826/B (the “Law Firm” or “us”).
If you have any questions regarding the processing or protection of personal data, you may contact us at any time by phone at +421 2 3200 6660, by e-mail at office@falathpartners.sk, or by post to the address of our registered office.
We process your personal data with your consent, and without your consent only in cases permitted by applicable legal regulations. The processing of your personal data is our contractual requirement, and in many cases it is also our legal requirement. If personal data are necessary for the conclusion or performance of a contract, under special legal regulations, or for the purposes of the legitimate interests pursued by us, they have to be provided to us; otherwise, we may be unable to fulfill our legal obligations or provide our services to you.
We process your personal data only as follows:
Purpose: Accounting agenda, accounting management, and fulfillment of duties based on accounting regulations.
Legal Basis: Article 6(1)(c) of the GDPR — fulfillment of our legal obligations arising from special legal regulations.
Retention Period: In accordance with periods established by relevant legislation.
Purpose: Fulfillment of rights and obligations arising from contractual relations.
Legal Basis: Article 6(1)(f) of the GDPR — processing is necessary for the pursuit of our legitimate interest, which is fulfillment of contractual and pre-contractual relations with suppliers and customers.
Retention Period: Until the termination of the contractual or pre-contractual relationship and until the expiry of applicable limitation, preclusive, complaint, storage, and other similar periods, until the expiry of the last of these periods.
Purpose: Records of received and sent correspondence, including electronic correspondence.
Legal Basis: Article 6(1)(c) of the GDPR — arising from specific legal regulations, in particular Act No. 586/2003 Coll. on Advocacy and on Amendments to Act No. 455/1991 Coll. on Small Business (Trade Licensing Act), as amended, and Act No. 395/2002 Coll. on Archives and Registries and on Amendments to Certain Acts, as amended.
Retention Period: In accordance with periods established by relevant legislation.
Purpose: Filling vacant positions in the Law Firm.
Legal Basis: Article 6(1)(b) of the GDPR — fulfillment of pre-contractual (especially labor-law) relations with job applicants.
Retention Period: Until the selection process is completed.
Purpose: Exercise of the data subject’s rights and fulfillment of our obligations under the GDPR.
Legal Basis: Article 6(1)(c) of the GDPR — fulfillment of legal obligations under the GDPR in conjunction with the exercise of legitimate interest under Article 6(1)(f) of the GDPR — processing is necessary for the pursuit of our legitimate interest, which is to respond to the data subject’s requests and fulfill other GDPR obligations, as well as the reasonable expectations of the data subject that their requests will be handled. Special categories of personal data are processed based on Article 9(2)(f) of the GDPR, as processing is necessary for the establishment, exercise, or defense of legal claims.
Retention Period: Five (5) years — period based on the authority of the Office for Personal Data Protection to carry out an inspection at the Law Firm.
Purpose: Ensuring our network and other security for the protection of personal data.
Legal Basis: Article 6(1)(f) of the GDPR — processing is necessary for the pursuit of our legitimate interest, which is ensuring our network security and implementing appropriate security measures.
Retention Period: One (1) year.
Purpose (1): Fulfillment of obligations under Act No. 297/2008 Coll. on protection against legalization of proceeds from criminal activity and protection against financing of terrorism and on amendments to certain acts, as amended (Section 20).
Legal Basis: Article 6(1)(c) of the GDPR — processing is necessary for the fulfillment of legal obligations of the Law Firm under a special regulation. Special categories of personal data are processed in conjunction with Article 9(2)(g) of the GDPR — reasons of substantial public interest based on EU law.
Retention Period: Statutory periods in accordance with the Act on Protection against Legalization of Proceeds from Crime and Protection against Financing of Terrorism and on Amendments to Certain Acts, as amended.
Purpose (2): Fulfillment of obligations under Act No. 297/2008 Coll. on protection against legalization of proceeds from criminal activity and protection against financing of terrorism and on amendments to certain acts, as amended (Section 20).
Legal Basis: Article 6(1)(c) of the GDPR — processing is necessary for the fulfillment of legal obligations of the Law Firm under a special regulation. Special categories of personal data are processed in conjunction with Article 9(2)(g) of the GDPR — reasons of substantial public interest based on EU law.
Retention Period: Statutory periods in accordance with the Act on Protection against Legalization of Proceeds from Crime and Protection against Financing of Terrorism and on Amendments to Certain Acts, as amended.
Purpose (3): Counterparty: Performance of business activity — practice of advocacy in accordance with § 1(2) of Act No. 586/2003 Coll. on Advocacy.
Legal Basis: Article 6(1)(f) of the GDPR — processing is necessary for the pursuit of our legitimate interest, which is processing personal data of the data subject, their counterparties and their authorized representatives/contact persons for the performance of our activity.
Retention Period: Until the termination of the contractual relationship and until the termination of the rights and obligations arising from contractual and pre-contractual relationships, the provision of services, and until the expiry of applicable limitation periods, preclusive periods, complaint periods, retention periods, and other similar periods, namely until the expiry of the last of these periods.
Purpose (4): Permanent record of the matter — the matter reference number, the names of the persons involved, and the index of submissions received — retained after the content of the matter has been deleted, for the purposes of conflict-of-interest checks and of identifying repeated contact.
Legal Basis: Article 6(1)(f) of the GDPR — processing is necessary for the pursuit of our legitimate interest, which is to ascertain whether we have previously advised or been contacted by a party or a counterparty before accepting a new matter; in conjunction with Article 6(1)(c) of the GDPR — Act No. 586/2003 Coll. on Advocacy, as amended, and Act No. 395/2002 Coll. on Archives and Registries, as amended.
Retention Period: Without a time limit. The content of the matter — submissions, documents, and the family background questionnaire — is deleted upon the expiry of the period stated above; what remains thereafter is limited to the matter reference number, the names of the persons involved, and the dates and types of submissions received.
Purpose (1): Ensuring functionality and performance of our website.
Legal Basis: Article 6(1)(f) of the GDPR — processing is necessary for the pursuit of our legitimate interest, which is ensuring functionality and effective performance of the website, which the data subject can reasonably expect.
Retention Period: Automatic deletion after leaving our website.
Purpose (2): Ensuring the connection between the website and contact with the Law Firm via the contact form.
Legal Basis: Article 6(1)(b) of the GDPR — processing is necessary for pre-contractual relations (if the potential client is a natural person). Article 6(1)(f) of the GDPR — processing is necessary for the pursuit of our legitimate interest, which is ensuring that clients are able to contact us (if the potential client is a legal entity).
Retention Period: Until the completion of the pre-contractual relationship, or until the potential client becomes a client.
Purpose: User profiles of the Law Firm on social networks.
Legal Basis: Article 6(1)(f) of the GDPR — processing is necessary for the pursuit of our legitimate interest, which is raising awareness of our activities.
Retention Period: Until consent is withdrawn.
Purpose: Publishing references from our clients on the Law Firm’s website.
Legal Basis: Article 6(1)(a) of the GDPR — consent of the data subject.
Retention Period: Until consent is withdrawn.
We process your personal data for the periods stated above. When the period for which we have a valid purpose for processing your personal data expires, your personal data will be deleted. If the legal basis of your personal data processing is your consent, we process your personal data only for the duration of its validity, or until its withdrawal.
Personal data are generally collected directly from you within contractual relations or originate directly from public registers, publicly available sources, and other sources (e.g., courts, police, and administrative bodies) that we access within the practice of advocacy.
We primarily process ordinary personal data about you that you provide to us or that we obtain from other sources, electronically via e-mail, by post, or by other means.
We process special categories of personal data (so-called sensitive personal data) about you only within the scope of fulfilling our advocacy duties in the context of contractual relations, which we base on a relevant legal basis in conjunction with a relevant exception from the prohibition of processing sensitive data under Article 9(2) of the GDPR.
We provide your personal data only in justified cases and only to the necessary extent to our contractual partners whom we need for our normal operation and realization of contractual relations — these partners are:
- our employees and attorneys cooperating with us;
- our document management and cloud services administrators;
- our tax, accounting, and payroll services administrators;
- social media on which our Law Firm is registered; and
- communication applications that our Law Firm uses for its internal and external communication.
We also provide your personal data to other entities in cases where the law establishes a right or obligation to provide your personal data to them, or if it is necessary for the protection of our legitimate interests (e.g., courts, police).
Your personal data are not and will not be used for automated individual decision-making or profiling.
Your personal data may, in certain cases, be transferred to third countries outside the European Union. When tools from Facebook and Google are used, personal data may be transferred to the United States of America (USA). The manner in which these companies handle personal data is stated in their privacy policies available on their websites.
Transfer of personal data to the USA is carried out in accordance with Article 6(1)(a) of the GDPR (lawfulness of processing based on consent of the data subject) and Article 49(1)(a) of the GDPR, as it concerns a transfer to a third country for which adequate guarantees of personal data protection comparable to EU standards do not exist. Such transfer of personal data to the USA is therefore associated with risk and may only take place based on the explicit consent of the data subject.
According to the decision-making practice of the Court of Justice of the European Union (CJEU), appropriate safeguards, enforceable rights, and effective legal remedies must ensure that the level of protection of the rights of data subjects when transferring personal data to a third country is essentially equivalent to the level of protection guaranteed within the European Union (CJEU judgment in case C-311/18 of July 16, 2020, point 5). The assessment of the level of protection must take into account the contractual terms between the controller in the EU and the recipient in the third country, as well as relevant aspects of the recipient’s legal system, including public authorities’ access to the transferred data.
By decision in case C-311/18 (so-called Schrems II), the CJEU declared invalid Commission Implementing Decision (EU) 2016/1250 on the adequacy of the protection provided by the EU-U.S. Privacy Shield. This abolished the possibility of transferring personal data to the USA based on an adequacy decision under Article 45 of the GDPR.
This was followed by the Austrian Data Protection Authority, which in the NOYB case stated that Google is a provider of electronic communication services under the US legal system (§§ 1881(b)(4) and 1881a of the FISA Act), and therefore, processed personal data may be provided to US intelligence services. The Austrian authority concluded that such access by US authorities is not in accordance with Article 44 of the GDPR (the general principle for transfers).
As noted above, on July 10, 2023, the EU-U.S. Data Privacy Framework (the “Framework”) was adopted by Commission Decision No. 2023/1795. A complaint against the Framework was filed with the CJEU on September 3, 2025, and its decision is expected in the coming months.
In addition, your personal data may be transferred to third countries outside the EU (e.g., Turkey or Israel) to facilitate mutual contacts. Such a transfer will take place only if:
- you express explicit consent to the transfer after being informed of the risks resulting from the absence of an adequacy decision and appropriate safeguards in the third country; or
- the transfer is necessary for the performance or conclusion of a contract between you and us, or for the implementation of pre-contractual measures taken at your request; or
- the transfer is necessary for the establishment, exercise, or defense of legal claims; or
- appropriate safeguards exist, mainly through standard contractual clauses on data protection concluded with the contractual partner in the third country.
A few, and most of them exist only because you asked for something.
To make the site work. When you use the client portal or the family background form, we store a little on your device: what keeps you signed in, a device you confirmed, and the form you are working on so it is still there when you come back. These cannot be switched off — without them those pages cannot work. They last from one hour to a year, depending on what they do; the sign-in itself lasts 30 days from your last visit.
To measure. Google Analytics tells us which pages people find useful. It starts when you allow it; before you choose, Google is told that a page was opened — no cookies, nothing stored on your device. We never use any of it to contact you or to target you with advertising. You can change your mind at any time under Cookie settings at the bottom of any page.
The map on our contact page is embedded from Google, and Google may set its own cookies when it loads.
If we process your personal data based on the exercise of legitimate interest under Article 6(1)(f) of the GDPR, you have a right to object to their processing at any time.
If we process your personal data based on granted consent under Article 6(1)(a) of the GDPR, you have a right to withdraw consent for the processing of your personal data for the purpose for which consent was granted at any time.
In addition to the rights listed above, you also have the following:
You may request access to personal data that we process about you at any time. We will also provide you with a copy of the processed personal data.
You may request the correction of inaccurate or incomplete personal data that we process about you at any time.
You may request the deletion of your personal data at any time if one of the following situations occurs:
- the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; or
- you have withdrawn the consent you gave us for their processing; or
- the personal data were processed unlawfully; or
- you object to the data processing, and there are no overriding legitimate grounds for the processing; or
- the personal data must be deleted to comply with a legal obligation established by EU law or the law of a Member State applicable to us.
You may request us to restrict the processing of your personal data at any time if one of the following situations occurs:
- you contested the accuracy of the personal data, for a period enabling us to verify the accuracy of the personal data;
- the processing of your personal data is unlawful, but we refused to delete this data, and instead, you request restriction of their use;
- we no longer need your personal data for the purposes of processing, but you need it to establish, exercise, or defend legal claims; or
- you objected to the processing of your personal data pursuant to Article 21(1) of the GDPR, pending verification whether our legitimate grounds override yours.
If we process your personal data based on your consent or because it is necessary for the performance of a contract to which you are a party, and at the same time the processing is carried out by automated means, then you have a right to receive the personal data concerning you and which you provided to us, in a structured, commonly used, and machine-readable format, provided that this right must not adversely affect the rights and freedoms of others.
You have a right to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic, with its registered office at Galvaniho Business Centrum II, Galvaniho 7/B, 821 04 Bratislava, Slovak Republic.
You may exercise your rights orally, in writing, or electronically via the contact details provided above. We will provide information on the action taken on your request without undue delay and in any event no later than one (1) month from receipt of the request.
We may request additional information necessary to confirm your identity if we have reasonable doubts concerning the identity of the natural person submitting the data subject rights request, as we are obliged to prevent disclosure of personal data to unauthorized persons. If this period needs to be extended in justified cases, we will inform you in due time.
Where your request is manifestly unfounded or excessive, in particular due to its repetitive character, we reserve the right to refuse to act on the request or to charge a reasonable fee, taking into account the administrative costs of providing the information or taking the requested action.