HW Legal1. Basic Provisions
This document governs the way in which JUDr. Kateřina Hájková, LL.M., attorney, with registered office at Dřevařská 12, 602 00 Brno, company ID (IČO): 21467293, Czech Bar Association (ČAK) registration number: 21262, email:
The Provider places emphasis on the protection of personal data and strives to inform Individuals transparently about:
- the purpose and legal basis for processing their personal data,
- the types of personal data that are processed,
- the way they are processed,
- the possible recipients of the personal data,
- the Individual's rights in connection with the processing of their personal data.
These personal data protection rules apply to:
- the processing of personal data in connection with the use of the Provider's website,
- the processing of personal data when communicating with the Individual by email, telephone, or other means of communication,
- the processing of personal data during the Provider's business relationship with the Individual and its suppliers,
- the processing of personal data necessary to protect the Provider's legitimate interests.
If you have any questions or need further explanation, you can contact the Provider by email at
2. Purpose of Processing Personal Data and Legal Basis for Processing
The protection of Individuals' personal data is provided in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "GDPR"), Act No. 110/2019 Coll., on the processing of personal data, and other relevant legislation.
The scope of the personal data processed varies according to the purpose of the processing. The Provider processes personal data for the following purposes:
A. Providing legal services and performing the contract
Personal data are processed for the purpose of providing legal services, including legal advice, drafting contracts, legal representation, and related services. The data are necessary for the proper keeping of the legal file and for performing the contract with the client.
Legal basis: Performance of a contract under Article 6(1)(b) of the GDPR.
B. Compliance with legal obligations
Personal data are processed in accordance with obligations arising from accounting, tax, and archiving regulations, the legislation on the legal profession, and other relevant laws.
Legal basis: Compliance with a legal obligation under Article 6(1)(c) of the GDPR.
C. Sending legal news and marketing communications
Personal data may be processed for the purpose of sending information about legal news, changes in legislation, and the Provider's range of services, on the basis of the Individual's consent. Consent can be withdrawn at any time in writing to the Provider's registered office or by email.
Legal basis: Consent of the data subject under Article 6(1)(a) of the GDPR.
D. Protecting the Provider's legitimate interests
The Provider may process personal data in order to protect its legitimate interests, for example in resolving legal disputes or recovering debts. Personal data may also be processed in order to identify the Individual in accordance with the legislation on the legal profession.
Legal basis: Legitimate interest under Article 6(1)(f) of the GDPR.
E. References and promotion of services
Personal data may be processed in order to give a reference about the services provided, where the Individual voluntarily publishes their review on review portals or other publicly accessible platforms. Consent to the processing can be withdrawn at any time.
Legal basis: Consent of the data subject under Article 6(1)(a) of the GDPR.
F. Recruitment and selection procedures
The personal data of those interested in employment or cooperation are processed in order to evaluate candidates and conduct recruitment processes.
Legal basis: Consent of the data subject under Article 6(1)(a) of the GDPR.
3. Scope of Processing of Personal Data
A. Providing legal services, performing the contract, and protecting legitimate interests
For the purpose of providing legal services (Purpose A), complying with legal obligations (Purpose B), and protecting the Provider's legitimate interests (Purpose D), the following personal data of the Individual may be processed:
- name and surname,
- address,
- date of birth or birth number (rodné číslo),
- telephone number,
- email address,
- bank account number and other payment details,
- business name, company ID (IČO), tax ID (DIČ),
- URL addresses of social media profiles and publicly available information on those profiles,
- information about the Individual's device and their visit to the Provider's web interface,
- other data related to the provision of legal services (for example data about business partners, employees, persons involved in legal acts or disputes, case reference numbers, and information and documents related to the Individual's legal case).
If the Individual fills in and submits a web form, the Provider also processes, in order to fulfil its record-keeping obligation, the date and time the form was submitted and the IP address of the device from which it was submitted.
B. Marketing and commercial communications
For the purpose of sending legal news, marketing offers, and commercial communications (Purpose C), the following personal data of the Individual may be processed:
- name and surname,
- address,
- telephone number,
- email address,
- business name, company ID (IČO), tax ID (DIČ),
- URL addresses of social media profiles and publicly available information on those profiles,
- information about the Individual's device and their visit to the Provider's web interface,
- the Individual's interests and preferences (for personalising content and services).
If a web form is filled in or the Individual signs up to receive marketing communications, the Provider also processes the date and time the form was submitted and the IP address of the device from which it was submitted.
C. References and promotion of services
For the purpose of promoting the Provider's services through references (Purpose E), the following personal data of the Individual may be processed:
- name and surname,
- business name,
- profile photograph,
- products or services purchased by the Individual,
- the Individual's rating of the Provider.
D. Selection procedures and recruitment
As part of selection procedures for job positions (Purpose F), the following personal data of the Individual may be processed:
- name and surname,
- address,
- telephone number,
- email address,
- photograph,
- information about education,
- date and place of birth,
- bank account number and health insurance company,
- other data given in the CV or provided during communication with the Provider.
E. Processing of sensitive personal data
If the Individual exceptionally provides the Provider with personal data classified under the GDPR as sensitive (for example data about health, religious belief, or ethnic origin), the Provider is obliged to process them only in accordance with the applicable legislation.
4. The Way Personal Data Are Processed
The Provider approaches the processing of personal data with the utmost care and consistently ensures their protection. To secure personal data it uses, for example:
- encryption technologies,
- electronic security of its premises,
- SSL certificates to protect data entered through web forms,
- password-protected access systems and other security measures.
Personal data are processed solely for the purposes set out above, in both paper and electronic form, and both manually and automatically.
The processing of personal data does not involve any automated decision-making that would have legal or similarly significant effects for the Individual.
The Individual is obliged to provide their personal data correctly and truthfully and to inform the Provider without delay of any change to them. The Individual further confirms that the data provided are accurate and that they have been advised that the provision of personal data is voluntary.
5. Period of Processing and Retention of Personal Data
The Provider processes personal data only for as long as strictly necessary and always in accordance with the relevant legislation, taking into account both its legal obligations and the quality of the products and services provided.
Retention periods by purpose of processing:
Purpose A (performance of the contract)
Personal data are processed for the duration of the Contract. After the Contract ends, they are retained for a maximum of 3 years in order to perform contractual obligations, and then for 5 years in line with legal obligations (in particular tax, archiving, and record-keeping obligations and obligations under the legislation on the legal profession).
If no Contract is concluded and no service is provided, the data are retained for 1 year and then in accordance with the legislation.
Purpose B (compliance with legal obligations)
Personal data are retained for the period laid down by the relevant legislation.
Purpose C (marketing and commercial communications based on consent)
Personal data are processed for as long as the Individual's consent lasts, until it is withdrawn. Consent can be withdrawn at any time in writing to the Provider, and the Individual can ask for the data to be deleted or updated.
Purpose D (the Provider's legitimate interest)
Personal data are retained for a maximum of 3 years from the start of their processing, unless the legislation provides otherwise or there is a justified need to retain them for longer.
Purpose E (references in marketing materials based on consent)
Personal data are retained for as long as consent lasts, until it is withdrawn. Consent can be withdrawn at any time in writing to the Provider's registered office or by email.
Purpose F (selection procedure and employment)
Personal data are retained for the duration of the selection procedure. If the Individual concludes an employment contract with the Provider, the data are retained for the duration of that contract, unless the legislation provides otherwise. If no contract is concluded, the Provider may, with the Individual's consent, retain the data for a longer period, for the purpose of possible future cooperation.
6. Disclosure and Sharing of Personal Data
We do not sell or otherwise disclose your personal data to any other commercial entities.
We may share your personal data with third parties if:
- (a) you have consented to such disclosure;
- (b) we are under a legal or professional obligation to do so (for example under anti-money laundering legislation);
- (c) it is necessary for the purpose of legal proceedings or in relation thereto, or to exercise or protect our rights;
- (d) we are required to disclose your personal data to new entities or third parties due to organisational changes within the Provider, or in connection with the transfer of our business or any part of it;
- (e) it is necessary to disclose your personal data to our clients, your employer, your professional advisors, and our collaborating parties (for example those involved in jointly organised events);
- (f) we disclose anonymous statistical data about our website users' browsing actions, and related user information, to reliable third parties, including browser providers and analysts.
We may share your personal data with some reliable third parties in accordance with contracts entered into with them. They include, in particular:
- our professional advisors and auditors;
- suppliers to whom we outsource certain ancillary services, such as word processing, translation, photocopying and review of documents, notary services, registry administration, and archiving services;
- IT technology providers;
- third parties involved in the hosting or organising of events or seminars.
Your personal data may be disclosed to public authorities, courts, and law-enforcement agencies solely for the reasons set out in this document, and only where the disclosure complies with our confidentiality obligations. Unless prohibited by applicable laws and regulations, we will use all reasonable endeavours to notify you in advance of any such disclosure.
7. International Data Transfers
Your personal data may be transferred to countries located outside the European Economic Area ("EEA"). These countries may not offer the same level of protection as countries located within the EEA.
To protect your privacy, we transfer your personal data outside the EEA only:
- (i) to countries that have been granted an adequacy decision by the European Commission recognising that they offer an adequate level of personal data protection; or
- (ii) to business partners that are contractually committed to putting in place appropriate safeguards in respect of the transfer, for example by entering into standard contractual clauses adopted by the European Commission.
8. Processing of Third Parties' Personal Data
In some cases the Provider may process the personal data of third parties, that is natural persons cooperating with the Individual, where that cooperation relates to the Provider's field of activity and where processing those data is necessary to fulfil the individual purposes. All processing takes place in accordance with the applicable personal data protection legislation.
What personal data may be processed?
The Provider may process, for example, the personal data of:
- The Individual's employees, clients, or suppliers, which the Individual provides in connection with fulfilling the individual purposes.
The processing of third parties' personal data is subject to the same conditions as the processing of the Individual's personal data.
The Individual's responsibility for third parties' consent
The Individual hereby expressly declares that they have obtained and hold valid consent from third parties to the processing of their personal data, including any sensitive data. The Individual is further obliged to inform the Provider that a third party's consent has ceased to be valid no later than 7 days after that occurs.
9. The Individual's Rights Arising From the Processing of Personal Data
In connection with the processing of personal data, the Individual, as a data subject, has the following rights:
1. The right of access to personal data
The Individual has the right to ask the Provider at any time for information about whether their personal data are being processed. If so, the Individual can ask for information about the purpose, scope, and manner of the processing, and for a copy of those data.
2. The right to rectification and completion of data
The Individual can ask the Provider to correct inaccurate personal data or to complete incomplete data. The Provider will make the correction without undue delay, having regard to its technical possibilities.
3. The right to erasure ("the right to be forgotten")
The Individual can ask for personal data to be erased if:
- they are no longer needed for the purposes for which they were collected,
- their processing is unlawful,
- the Individual objects to the processing and there are no overriding legitimate grounds for further processing,
- the legal obligation to retain them has ceased,
- the Individual withdraws their consent and there is no other legal ground for processing them.
4. The right to restriction of processing
The Individual can ask for the processing of their personal data to be restricted. In that case the Provider temporarily suspends their processing, for example by storing them or temporarily removing them.
5. The right to data portability
Where personal data are processed automatically on the basis of consent or a contract, the Individual can ask for them to be transferred to another controller. If the transfer would adversely affect the rights of others, the request need not be granted.
6. The right to object
The Individual can object to the processing of data on the basis of the Provider's legitimate interest or for marketing purposes. In the case of an objection to marketing processing, the Provider will no longer process the personal data. If the objection is raised against processing on the ground of a legitimate interest, the Provider will assess it and inform the Individual of the outcome.
7. The right to lodge a complaint
If the Individual is not satisfied with how their request was handled, they can lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů;
8. The right to withdraw consent
Consent to the processing of personal data can be withdrawn at any time in writing to the Provider, by telephone on 724 076 527 or 774 165 147, or by email at
Important notice
The Provider is bound by legislation that imposes certain obligations on it. For this reason, the exercise of some of the Individual's rights may be restricted or refused.
If the Individual's requests are manifestly unfounded, excessive, or repetitive, the Provider may charge a reasonable administrative fee or refuse the request.
10. Use and Processing of Cookies
The Provider uses various network identifiers, known as cookies, pixels, or other technologies (together the "cookies"), to keep records of Visitors and Users and to adapt and personalise the content of the web interface.
Cookies are small data files that the Provider's web interface stores on the device (for example a computer, phone, or tablet) of a Visitor or User. Cookies help to provide and improve the Provider's services and to make the web interface easier to use.
When you visit and use the web interface for information purposes only, we collect only the data necessary for the web interface to function and for its security. Within the Provider's web interface, cookies are divided into the following groups:
- Functional cookies. Strictly necessary; they enable the basic functions of the web interface and are not conditional on consent.
- Statistical cookies ("Statistics"). They serve to measure traffic and to analyse how Visitors and Users use the web interface (for example which pages they visit, how long they stay, and where they came from). The data are usually aggregated and help the Provider improve the website. These cookies can be processed only with consent.
- Marketing cookies ("Marketing"). They are used to display, for example, personalised advertising based on the user's preferences, to track the user across websites, to send advertising, and for similar marketing purposes.
The Provider uses third-party tools for marketing and analytics purposes, such as Google Analytics, Google Ads, Meta Platforms (Facebook, Instagram), Seznam.cz, and others.
A Visitor or User can set cookies individually through the cookie bar or in the settings of their web browser.
In connection with the use of cookies, a Visitor or User has the following rights:
- to request information about the processing of personal data,
- to request an explanation regarding the processing of personal data,
- to request access to their data and the correction of it,
- to request its erasure, where this is not contrary to the legislation,
- to turn to the Provider or to the Office for Personal Data Protection (www.uoou.cz, tel.: 234 665 111).
Personal data obtained in this way are processed in accordance with the legislation and in compliance with strict internal privacy protection rules.
In the course of providing legal services, the Provider may use artificial intelligence tools, with verification of the outputs. Personal data and client data are not entered into these tools.
For any questions or to exercise your rights, you can contact the Provider by email at