This notice explains how I, as an attorney, process the personal data of website visitors, prospective clients and clients. I comply with Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll., on the Processing of Personal Data.
1. Controller
- Attorney
- Mgr. Michel Suchý, LL.M.
- Registered office
- Pod Štandlem 2533, 738 01 Frýdek-Místek, Czech Republic
- Company ID (IČO)
- 10792201
- Czech Bar Association reg. no.
- 19804
- Data box (ISDS)
- ywfvw6i
- michel [at] suchy.legal
2. What data I process and why
Enquiries. When you write to me by e-mail or via the contact form, I process your name, contact details and the content of your message in order to reply and, where appropriate, prepare an offer. The legal basis is steps prior to entering into a contract (Art. 6(1)(b) GDPR) and my legitimate interest in answering your enquiry (Art. 6(1)(f) GDPR). If no engagement follows, I keep the data for no longer than 1 year.
Providing legal services. For clients, I process the data needed to perform the legal services agreement and to protect their rights – identification and contact details, data contained in the case file and billing details. The legal basis is performance of a contract (Art. 6(1)(b) GDPR) and compliance with an attorney’s legal obligations (Art. 6(1)(c) GDPR).
Website operation and security. With every visit, the hosting provider records technical data (IP address, time of access, page visited and browser details) in server logs. These are used to keep the website secure and running and are kept only as long as necessary. The legal basis is my legitimate interest (Art. 6(1)(f) GDPR).
Contact form protection. The form is protected by Cloudflare Turnstile, which verifies that the message is sent by a human rather than an automated program. This involves processing technical data about your device and browser, including your IP address. The legal basis is my legitimate interest in protecting the website against spam and abuse (Art. 6(1)(f) GDPR).
Analytics and advertising. Only with your consent (Art. 6(1)(a) GDPR) do I process data about your visit via Google Analytics and Google Ads – cookie identifiers, pages visited, traffic source, approximate location and device details. Without consent, these tools are not loaded at all. You can withdraw consent at any time in the cookie settings; withdrawal does not affect processing carried out before it.
Client identification (AML). As an obliged entity under Czech Act No. 253/2008 Coll., I must identify clients and keep identification data and copies of documents for 10 years after the business relationship ends (Section 16 of that Act). The legal basis is compliance with a legal obligation (Art. 6(1)(c) GDPR).
Accounting and tax. I process and keep billing data for the period required by accounting and tax regulations (Art. 6(1)(c) GDPR).
Third-party data. When providing legal services, I may also process data of opposing parties and other persons where necessary to protect the client’s rights. Such data are protected by attorney confidentiality.
3. Attorney confidentiality
I am bound to keep confidential all facts I learn in connection with providing legal services (Section 21 of Czech Act No. 85/1996 Coll., on the Legal Profession). In some cases, confidentiality may limit the extent to which I can comply with a request under the GDPR if it would affect the rights of another client.
4. Who I share data with
I do not sell personal data or share it for marketing. I may only disclose it to:
- service providers who run my website, e-mail, IT and accounting, under a contract and subject to confidentiality,
- Cloudflare, Inc. as provider of the form protection (Turnstile),
- Google Ireland Limited as provider of Google Analytics and Google Ads – only with your consent,
- courts, authorities and other public bodies where required by law or to protect a client’s rights,
- cooperating attorneys, especially abroad, where your matter requires it and you agree.
Cloudflare, Inc. and Google LLC may also process data in the USA. Both are certified under the EU–US Data Privacy Framework, so the transfer relies on the European Commission’s adequacy decision. Otherwise I do not transfer data outside the European Economic Area unless your matter expressly requires it.
5. How long I keep data
I keep data only as long as necessary for the purpose – enquiries for no longer than 1 year, client data for the duration of the engagement and then for the period required by law and professional rules (in particular 10 years for data obtained when identifying a client). After that, I delete or anonymise the data.
6. Your rights
You have the right to access your personal data, to have it rectified or erased, to restrict processing, to data portability and to object to processing based on legitimate interest. You can exercise your rights by e-mail or via data box.
If you believe I process your data unlawfully, you can lodge a complaint with the Czech Office for Personal Data Protection (uoou.gov.cz).
7. Automated decision-making
I do not use personal data for automated decision-making or profiling.
8. Cookies
Information on cookies and how to change your consent is available on the Cookies page.