Personal Data Processing Notice
In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), here is how we process your personal data.
Effective as of: July 1, 2026
1. Identity and contact details of the controller
The controller of personal data is Ing. Mgr. Tomáš Beneš, attorney, Czech Bar Association reg. no. 20354, Company ID (IČO): 17237769, with registered office at Václavské náměstí 846/1, 110 00 Praha 1.
Controller’s contact details: correspondence address: Václavské náměstí 846/1, 110 00 Praha; e-mail: tomas.benes@advokatbenes.cz; phone: +420 776 155 259.
The controller has not appointed a data protection officer.
2. Personal data processed
I obtain personal data mostly directly from you, whether through in-person, phone, electronic, or other forms of communication, or occasionally from your relatives or from publicly available sources (public lists, registers, or records). The types of personal data processed typically include: first and last name, date of birth, birth number (rodné číslo), address, contact details (e-mail, phone, correspondence address), Company ID (IČO), Tax ID (DIČ), banking details, and information about health status (where relevant to the case).
3. Legal basis and purpose of processing
The legal basis for processing your personal data is the performance of a contract for the provision of legal services, compliance with the controller’s legal obligations, and the controller’s legitimate interest.
The purpose of processing your personal data is the provision of legal services, entering into a contract for the provision of legal services, mutual communication, and compliance with the controller’s legal obligations.
The controller does not carry out any automated individual decision-making within the meaning of Art. 22 of the Regulation.
| Purpose of processing | Data processed | Legal basis | Retention period |
|---|---|---|---|
| Contact form and initial inquiry | Name, e-mail, phone, description of the case | Legitimate interest (Art. 6(1)(f) GDPR) | 6 months from the last contact, unless a contract is concluded |
| Provision of legal services | Personal and contact data, case details, and special categories of data where applicable | Performance of a contract (Art. 6(1)(b) GDPR) | 5 years after the end of representation; for certain obligations up to 10 years (Act No. 85/1996 Coll.) |
| Compliance with legal obligations | Identification and billing data | Compliance with a legal obligation (Art. 6(1)(c) GDPR) | As required by applicable law (accounting records 5 years, tax documents 10 years) |
| Website traffic analysis | IP address, cookies, on-site behavior | Consent (Art. 6(1)(a) GDPR) | 26 months |
4. Retention period of personal data
The period for which your personal data will be retained by the controller is generally 5 years from the date on which the provision of legal services ends. However, certain personal data may be retained for up to 10 years, or longer, where required to comply with legal obligations (in particular the obligation to archive accounting and tax records) or to fulfill contractual commitments, enforce the controller’s legitimate claims, and resolve disputes.
Personal data obtained through the contact form or through our communication will be retained for no longer than 6 months from the last contact, unless a contract for the provision of legal services is concluded (in which case the rules above apply).
5. Cookies and consent categories
| Cookie category | Purpose | Consent | Duration |
|---|---|---|---|
| Necessary | Website functionality, security, cookie consent | Not required | Until the browser is closed, or 1 year |
| Analytics | Anonymous traffic statistics (Google Analytics) | Required | 26 months |
| Marketing | Targeted advertising (Google Ads), remarketing | Required | Until consent is withdrawn |
6. Other recipients of personal data
Other recipients of your personal data may include, in particular, public authorities (e.g. courts, administrative bodies, the Police of the Czech Republic), other persons as instructed or needed by you (e.g. translators or court experts), and persons who provide services to the controller (e.g. accountants or tax advisors).
Some of the controller’s processors (Resend and Vercel) are based in the United States, so your personal data may be transferred to a third country outside the EU. This transfer takes place on the basis of standard contractual clauses approved by the European Commission under Art. 46 GDPR, which ensure an adequate level of personal data protection.
The controller uses the following data processors:
- Resend: processing e-mails from the contact form (USA, standard contractual clauses under Art. 46 GDPR)
- Google Analytics / Google Ads: analytics and advertising (based on user consent)
- Vercel: website hosting (USA, DPA in place)
7. Rights of the data subject
Under the conditions set out in the Regulation, you have the right to request access to your personal data from the controller, the right to have your personal data corrected or deleted, or its processing restricted, the right to object to the processing of your personal data, and the right to data portability (Art. 13 to 21 of the Regulation).
You can exercise these rights using the contact details listed above.
If you believe that the processing of your personal data violates the Regulation, you also have the right to file a complaint with the supervisory authority: the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), address: Pplk. Sochora 727/27, 170 00 Praha 7 – Holešovice, e-mail: posta@uoou.cz.
To exercise your rights, please contact: tomas.benes@advokatbenes.cz