Privacy Policy
Last updated October 5, 2026
Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “GDPR”).
This document provides information on how we process your personal data.
The controller of personal data is FALATH & PARTNERS s. r. o., a law firm with its registered office at Pribinova 28, 811 09 Bratislava – Staré Mesto, Identification No. 56 136 048, registered in the Commercial Register of the Municipal Court Bratislava III, Section: Sro, File No. 176826/B (the “Law Firm” or “us”).
If you have any questions regarding the processing or protection of personal data, you may contact us at any time by phone at +421 2 3200 6660, by e-mail at office@falathpartners.sk, or by post to the address of our registered office.
We process your personal data with your consent, and without your consent only in cases permitted by applicable legal regulations. The processing of your personal data is our contractual requirement, and in many cases it is also our legal requirement. If personal data are necessary for the conclusion or performance of a contract, under special legal regulations, or for the purposes of the legitimate interests pursued by us, they have to be provided to us; otherwise, we may be unable to fulfill our legal obligations or provide our services to you.
We process your personal data only as follows:
Purpose: Accounting agenda, accounting management, and fulfillment of duties based on accounting regulations.
Legal Basis: Article 6(1)(c) of the GDPR — fulfillment of our legal obligations arising from special legal regulations.
Retention Period: In accordance with periods established by relevant legislation.
Purpose: Fulfillment of rights and obligations arising from contractual relations.
Legal Basis: Article 6(1)(f) of the GDPR — processing is necessary for the pursuit of our legitimate interest, which is fulfillment of contractual and pre-contractual relations with suppliers and customers.
Retention Period: Until the termination of the contractual or pre-contractual relationship and until the expiry of applicable limitation, preclusive, complaint, storage, and other similar periods, until the expiry of the last of these periods.
Purpose: Records of received and sent correspondence, including electronic correspondence.
Legal Basis: Article 6(1)(c) of the GDPR — arising from specific legal regulations, in particular Act No. 586/2003 Coll. on Advocacy and on Amendments to Act No. 455/1991 Coll. on Small Business (Trade Licensing Act), as amended, and Act No. 395/2002 Coll. on Archives and Registries and on Amendments to Certain Acts, as amended.
Retention Period: In accordance with periods established by relevant legislation.
Purpose: Filling vacant positions in the Law Firm.
Legal Basis: Article 6(1)(b) of the GDPR — fulfillment of pre-contractual (especially labor-law) relations with job applicants.
Retention Period: Until the selection process is completed.
Purpose: Exercise of the data subject’s rights and fulfillment of our obligations under the GDPR.
Legal Basis: Article 6(1)(c) of the GDPR — fulfillment of legal obligations under the GDPR in conjunction with the exercise of legitimate interest under Article 6(1)(f) of the GDPR — processing is necessary for the pursuit of our legitimate interest, which is to respond to the data subject’s requests and fulfill other GDPR obligations, as well as the reasonable expectations of the data subject that their requests will be handled. Special categories of personal data are processed based on Article 9(2)(f) of the GDPR, as processing is necessary for the establishment, exercise, or defense of legal claims.
Retention Period: Five (5) years — period based on the authority of the Office for Personal Data Protection to carry out an inspection at the Law Firm.
Purpose: Ensuring our network and other security for the protection of personal data.
Legal Basis: Article 6(1)(f) of the GDPR — processing is necessary for the pursuit of our legitimate interest, which is ensuring our network security and implementing appropriate security measures.
Retention Period: One (1) year.
Purpose (1): Fulfillment of obligations under Act No. 297/2008 Coll. on protection against legalization of proceeds from criminal activity and protection against financing of terrorism and on amendments to certain acts, as amended (Section 20).
Legal Basis: Article 6(1)(c) of the GDPR — processing is necessary for the fulfillment of legal obligations of the Law Firm under a special regulation. Special categories of personal data are processed in conjunction with Article 9(2)(g) of the GDPR — reasons of substantial public interest based on EU law.
Retention Period: Statutory periods in accordance with the Act on Protection against Legalization of Proceeds from Crime and Protection against Financing of Terrorism and on Amendments to Certain Acts, as amended.
Purpose (2): Fulfillment of obligations under Act No. 297/2008 Coll. on protection against legalization of proceeds from criminal activity and protection against financing of terrorism and on amendments to certain acts, as amended (Section 20).
Legal Basis: Article 6(1)(c) of the GDPR — processing is necessary for the fulfillment of legal obligations of the Law Firm under a special regulation. Special categories of personal data are processed in conjunction with Article 9(2)(g) of the GDPR — reasons of substantial public interest based on EU law.
Retention Period: Statutory periods in accordance with the Act on Protection against Legalization of Proceeds from Crime and Protection against Financing of Terrorism and on Amendments to Certain Acts, as amended.
Purpose (3): Counterparty: Performance of business activity — practice of advocacy in accordance with § 1(2) of Act No. 586/2003 Coll. on Advocacy.
Legal Basis: Article 6(1)(f) of the GDPR — processing is necessary for the pursuit of our legitimate interest, which is processing personal data of the data subject, their counterparties and their authorized representatives/contact persons for the performance of our activity.
Retention Period: Until the termination of the contractual relationship and until the termination of the rights and obligations arising from contractual and pre-contractual relationships, the provision of services, and until the expiry of applicable limitation periods, preclusive periods, complaint periods, retention periods, and other similar periods, namely until the expiry of the last of these periods.
Purpose (4): Permanent record of the matter — the matter reference number, the names of the persons involved, and the index of submissions received — retained after the content of the matter has been deleted, for the purposes of conflict-of-interest checks and of identifying repeated contact.
Legal Basis: Article 6(1)(f) of the GDPR — processing is necessary for the pursuit of our legitimate interest, which is to ascertain whether we have previously advised or been contacted by a party or a counterparty before accepting a new matter; in conjunction with Article 6(1)(c) of the GDPR — Act No. 586/2003 Coll. on Advocacy, as amended, and Act No. 395/2002 Coll. on Archives and Registries, as amended.
Retention Period: Without a time limit. The content of the matter — submissions, documents, and the family background questionnaire — is deleted upon the expiry of the period stated above; what remains thereafter is limited to the matter reference number, the names of the persons involved, and the dates and types of submissions received.
Purpose (1): Ensuring functionality and performance of our website.
Legal Basis: Article 6(1)(f) of the GDPR — processing is necessary for the pursuit of our legitimate interest, which is ensuring functionality and effective performance of the website, which the data subject can reasonably expect.
Retention Period: Automatic deletion after leaving our website.
Purpose (2): Ensuring the connection between the website and contact with the Law Firm via the contact form.
Legal Basis: Article 6(1)(b) of the GDPR — processing is necessary for pre-contractual relations (if the potential client is a natural person). Article 6(1)(f) of the GDPR — processing is necessary for the pursuit of our legitimate interest, which is ensuring that clients are able to contact us (if the potential client is a legal entity).
Retention Period: Until the completion of the pre-contractual relationship, or until the potential client becomes a client.
Purpose (3): Identifying which advertisement, link, or page brought an enquiry to us, so that we can measure and manage our advertising. Where the address you arrive at carries advertising or campaign parameters — for example a Google Ads click identifier or UTM parameters — those parameters, together with the address of the page on which you opened the form, are attached to the enquiry when you send it.
Legal Basis: Article 6(1)(f) of the GDPR — processing is necessary for the pursuit of our legitimate interest, which is to know which of our advertisements and publications actually bring enquiries, so that we can direct our advertising accordingly. No profile of the enquirer is built, and this data is never used to contact you or to target you with advertising.
Retention Period: Together with the enquiry, and no longer than the enquiry itself.
Purpose: User profiles of the Law Firm on social networks.
Legal Basis: Article 6(1)(f) of the GDPR — processing is necessary for the pursuit of our legitimate interest, which is raising awareness of our activities.
Retention Period: Until consent is withdrawn.
Purpose: Publishing references from our clients on the Law Firm’s website.
Legal Basis: Article 6(1)(a) of the GDPR — consent of the data subject.
Retention Period: Until consent is withdrawn.
We process your personal data for the periods stated above. When the period for which we have a valid purpose for processing your personal data expires, your personal data will be deleted. If the legal basis of your personal data processing is your consent, we process your personal data only for the duration of its validity, or until its withdrawal.
Personal data are generally collected directly from you within contractual relations or originate directly from public registers, publicly available sources, and other sources (e.g., courts, police, and administrative bodies) that we access within the practice of advocacy.
We primarily process ordinary personal data about you that you provide to us or that we obtain from other sources, electronically via e-mail, by post, or by other means.
We process special categories of personal data (so-called sensitive personal data) about you only within the scope of fulfilling our advocacy duties in the context of contractual relations, which we base on a relevant legal basis in conjunction with a relevant exception from the prohibition of processing sensitive data under Article 9(2) of the GDPR.
We provide your personal data only in justified cases and only to the necessary extent to our contractual partners whom we need for our normal operation and realization of contractual relations — these partners are:
- our employees and attorneys cooperating with us;
- our document management and cloud services administrators;
- our tax, accounting, and payroll services administrators;
- social media on which our Law Firm is registered; and
- communication applications that our Law Firm uses for its internal and external communication.
We also provide your personal data to other entities in cases where the law establishes a right or obligation to provide your personal data to them, or if it is necessary for the protection of our legitimate interests (e.g., courts, police).
Your personal data are not and will not be used for automated individual decision-making or profiling.
Your personal data may, in certain cases, be transferred to third countries outside the European Union. When Google tools are used on this website — Google Analytics and Google Ads measurement, and the Google map on the contact page — personal data may be transferred to the United States of America (USA). How Google handles personal data is described in its privacy policy available on its website.
Transfers of personal data to the USA are based on the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework [Commission Implementing Decision (EU) 2023/1795 of July 10, 2023; the “Framework”] under Article 45 of the GDPR. The Framework covers recipients in the USA that have self-certified under it; Google LLC is a certified participant.
The Framework replaced the EU-U.S. Privacy Shield, which the Court of Justice of the European Union (CJEU) declared invalid in case C-311/18 (Schrems II) of July 16, 2020. On September 3, 2025, the General Court of the European Union dismissed an action for annulment of the Framework (case T-553/23, Latombe v Commission).
Should the Framework cease to apply, transfers to the USA will take place only on another basis permitted by Chapter V of the GDPR — in particular standard contractual clauses (Article 46 of the GDPR) or, where applicable, your explicit consent [Article 49(1)(a) of the GDPR].
In addition, your personal data may be transferred to other third countries outside the EU, for example when you live in such a country and we correspond with you. Such a transfer will take place only if:
- you express explicit consent to the transfer after being informed of the risks resulting from the absence of an adequacy decision and appropriate safeguards in the third country; or
- the transfer is necessary for the performance or conclusion of a contract between you and us, or for the implementation of pre-contractual measures taken at your request; or
- the transfer is necessary for the establishment, exercise, or defense of legal claims; or
- appropriate safeguards exist, mainly through standard contractual clauses on data protection concluded with the contractual partner in the third country.
A few, and most of them exist only because you asked for something.
To make the site work. When you use the client portal or the family background form, we store a little on your device: what keeps you signed in, a device you confirmed, and the form you are working on so it is still there when you come back. These cannot be switched off — without them those pages cannot work. They last from one hour to a year, depending on what they do; the sign-in itself lasts 30 days from your last visit.
To measure. Google Analytics tells us which pages people find useful. It starts when you allow it; before you choose, Google is told that a page was opened — no cookies, nothing stored on your device. We never use any of it to contact you or to target you with advertising. You can change your mind at any time under Cookie settings at the bottom of any page.
To measure our advertising. Google Ads tells us which advertisement brought someone to us. If you allow cookies and then send the form, the email address you entered is turned into a code before it leaves your browser, and that code is shared with Google so it can confirm the enquiry came from an ad it served. Google never receives the address itself. We never use any of it to contact you or to target you with advertising.
The map on our contact page is embedded from Google, and Google may set its own cookies when it loads.
If we process your personal data based on the exercise of legitimate interest under Article 6(1)(f) of the GDPR, you have a right to object to their processing at any time.
If we process your personal data based on granted consent under Article 6(1)(a) of the GDPR, you have a right to withdraw consent for the processing of your personal data for the purpose for which consent was granted at any time.
In addition to the rights listed above, you also have the following:
You may request access to personal data that we process about you at any time. We will also provide you with a copy of the processed personal data.
You may request the correction of inaccurate or incomplete personal data that we process about you at any time.
You may request the deletion of your personal data at any time if one of the following situations occurs:
- the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; or
- you have withdrawn the consent you gave us for their processing; or
- the personal data were processed unlawfully; or
- you object to the data processing, and there are no overriding legitimate grounds for the processing; or
- the personal data must be deleted to comply with a legal obligation established by EU law or the law of a Member State applicable to us.
You may request us to restrict the processing of your personal data at any time if one of the following situations occurs:
- you contested the accuracy of the personal data, for a period enabling us to verify the accuracy of the personal data;
- the processing of your personal data is unlawful, but we refused to delete this data, and instead, you request restriction of their use;
- we no longer need your personal data for the purposes of processing, but you need it to establish, exercise, or defend legal claims; or
- you objected to the processing of your personal data pursuant to Article 21(1) of the GDPR, pending verification whether our legitimate grounds override yours.
If we process your personal data based on your consent or because it is necessary for the performance of a contract to which you are a party, and at the same time the processing is carried out by automated means, then you have a right to receive the personal data concerning you and which you provided to us, in a structured, commonly used, and machine-readable format, provided that this right must not adversely affect the rights and freedoms of others.
You have a right to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic, with its registered office at Galvaniho Business Centrum II, Galvaniho 7/B, 821 04 Bratislava, Slovak Republic.
You may exercise your rights orally, in writing, or electronically via the contact details provided above. We will provide information on the action taken on your request without undue delay and in any event no later than one (1) month from receipt of the request.
We may request additional information necessary to confirm your identity if we have reasonable doubts concerning the identity of the natural person submitting the data subject rights request, as we are obliged to prevent disclosure of personal data to unauthorized persons. If this period needs to be extended in justified cases, we will inform you in due time.
Where your request is manifestly unfounded or excessive, in particular due to its repetitive character, we reserve the right to refuse to act on the request or to charge a reasonable fee, taking into account the administrative costs of providing the information or taking the requested action.