Privacy policy

Effective from: 1 September 2026

1. Who processes your data

The controller of your personal data is Mgr. Klára Krbušek, an attorney registered in the list of attorneys kept by the Czech Bar Association under reg. no. 19610, with her registered office at Chelčického 584/13, Žižkov, 130 00 Praha 3, Czech Republic, ID No. (IČO) 09936343.

Contact for data protection matters: email: klara@krbusek.legal, phone: +420 606 440 546, Chelčického 584/13, Žižkov, 130 00 Praha 3.

2. What this policy covers

It explains how I handle the personal data of:

visitors to the website https://krbusek.legal/,
people who contact me through the contact form, by email or by phone,
newsletter subscribers,
clients and other persons whose data reaches me in connection with the provision of legal services.

I follow Regulation (EU) 2016/679 (GDPR), Act No. 110/2019 Coll., on the Processing of Personal Data, and Act No. 85/1996 Coll., on the Legal Profession.

To handle your enquiry and to agree on and provide legal services, I need the necessary personal data. Without it, I may be unable to handle your enquiry or provide you with legal services. Where the duty to identify and verify the client applies under Act No. 253/2008 Coll., on Certain Measures against the Legitimisation of Proceeds of Crime and Financing of Terrorism, providing the required data is a statutory requirement; without the necessary cooperation I cannot carry out the transaction or business relationship concerned. Subscribing to the newsletter is voluntary, and declining it has no effect on the provision of legal services.

3. What data I process, why and for how long

3.1 Enquiries via the contact form, email and phone

Data: first name, surname, email address, phone number, where applicable the name of the company on whose behalf you act, the content of the message and any attachments.
Purpose: handling your enquiry and the related communication.
Legal basis: my legitimate interest in handling the enquiry and communicating with you (Article 6(1)(f) GDPR); where the enquiry concerns ordering a legal service, steps taken prior to entering into a contract (Article 6(1)(b) GDPR).
Retention period: 6 months from handling the enquiry. If we start working together, the retention period follows section 3.3.

3.2 Newsletter

Data: first name, surname, email address, phone number, where applicable the name of the company on whose behalf you act.
Purpose: sending information about legal developments and the firm’s services.
Legal basis: your consent (Article 6(1)(a) GDPR). If you are my client, I may also send you similar communications on the basis of my legitimate interest in direct marketing (Article 6(1)(f) GDPR and Section 7(3) of Act No. 480/2004 Coll.); you can unsubscribe at any time in that case too.
Retention period: until you withdraw your consent or unsubscribe, but no longer than 3 years from giving consent; if you are my client, no longer than 3 years from the end of the provision of legal services. In both cases, before the period ends I will ask for your consent to further mailings and, without your confirmation, remove you from the database. I keep the record of your unsubscribing for 3 years so that I do not send you communications again (the legal basis here is my legitimate interest in demonstrating compliance with the duty not to send unsolicited communications – Article 6(1)(f) GDPR).
Unsubscribing: via the link in every message or using the contact details in section 1.

3.3 Provision of legal services

Data: first name, surname, date of birth, birth number (if the nature of the legal service requires it), address of residence or registered office, ID No. (IČO), tax ID (DIČ), email address, phone number, where applicable the name of the company on whose behalf you act, information about the matter, correspondence, documents and other materials.
Purpose: providing the legal service.
Legal basis: for the personal data of a client with whom I conclude a contract for legal services, performance of that contract (Article 6(1)(b) GDPR). For the personal data of the client’s representatives and other persons the legal service concerns, my legitimate interest and the client’s legitimate interest in the proper provision of legal services and the protection of the client’s rights (Article 6(1)(f) GDPR).
Retention period: 5 years from the day the provision of the legal service ended; longer only where another legal regulation requires it.

3.4 Client identification under anti-money laundering and counter-terrorist financing rules

These duties apply to me only for certain activities listed in Section 2(1)(g) of Act No. 253/2008 Coll., in particular when holding a client’s money or other assets in custody and when acting on a client’s behalf in property transfers, asset management or the formation of companies.

Data: data from an identity document including a copy of it, data on the beneficial owner, information on the purpose and intended nature of the transaction, data on the source of funds, and information on whether you are a politically exposed person or a person on a sanctions list.
Purpose: fulfilling the duties of client identification and due diligence.
Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR) under Act No. 253/2008 Coll.
Retention period: 10 years from the execution of the transaction or the end of the business relationship with the client. The start of this period is determined under Section 16(5) of Act No. 253/2008 Coll.

3.5 Accounting and taxes

Data: billing and payment data.
Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR) under accounting and tax regulations.
Retention period: 10 years from the end of the tax period to which the document relates.

3.6 Operation and security of the website

Data: IP address, date and time of access, browser and operating system type, and error records (server logs).
Purpose: keeping the website running and secure, protecting it against attacks and misuse of the contact form.
Legal basis: my legitimate interest in the secure operation of the website (Article 6(1)(f) GDPR).
Retention period: no longer than 6 months.

3.7 Cookies and traffic measurement

Details are in the separate cookie policy.

3.8 Protecting the firm’s legal claims

After the periods stated above have ended, I may keep data from the processing described above, to the extent necessary, for the duration of the relevant limitation periods, where this is needed for the establishment, exercise or defence of my legal claims (Article 6(1)(f) GDPR).

4. Where I obtain data

Mainly directly from you. When providing legal services, I also obtain data from opposing parties and their representatives, from courts and other public authorities, and from public registers and records (e.g. the Commercial Register, the Land Register, the Insolvency Register).

5. Who I share data with

Only to the extent necessary, namely with:

the hosting provider and the person managing the website,
providers of email and cloud services,
the provider of the newsletter mailing tool,
providers of analytics tools (only with your consent to cookies – see the cookie policy),
my accountant and tax adviser,
cooperating attorneys, trainee attorneys, experts, interpreters and other persons where necessary for providing the legal service; all of them are bound by confidentiality,
courts, public authorities and other persons where the law requires it, and the Czech Bar Association in cases laid down by law.

If you ask, I will tell you the specific recipients to whom your data has been disclosed – unless they cannot be identified at the time or the request is manifestly unfounded or excessive.

6. Transfers outside the EU

I generally process data within the European Union. Where one of the tools I use processes data in a third country, the transfer is based either on a European Commission adequacy decision (for the USA, the EU-U.S. Data Privacy Framework) or on appropriate safeguards, such as standard contractual clauses approved by the European Commission or binding corporate rules.

7. Automated decision-making and profiling

Neither takes place. I make no decisions based solely on automated processing of your data and I do not carry out profiling.

8. Your rights

You have the rights listed below in relation to the data I process about you. You can exercise them at the following email address: klara@krbusek.legal.

a) Right of access. You can ask me whether I process any data about you and, if so, request a copy of it together with information on the purposes, categories of data, recipients and storage period. If you ask, I will also tell you the specific recipients to whom your data has been disclosed.

b) Right to rectification. If you find that I hold inaccurate data about you, I will correct it; I will complete incomplete data at your request.

c) Right to erasure (right to be forgotten). I will erase data if the purpose for which I processed it no longer applies, if you withdraw your consent and there is no other legal ground for the processing, if you raise a justified objection, or if the processing was unlawful.

d) Right to restriction of processing. You can ask me to restrict processing in four cases: 1) if you contest the accuracy of the data, for the time needed to verify it; 2) if the processing is unlawful and you request restriction of the use of the data instead of erasure; 3) if I no longer need the data for my purposes but you require it for the establishment, exercise or defence of your legal claims; and 4) if you have objected to processing based on my legitimate interest.

While processing is restricted, apart from storing the data I may process it only with your consent, or for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest.

e) Right to data portability. Data you have provided to me on the basis of consent or a contract and which I process by automated means will be provided to you in a machine-readable format or, at your request, transmitted directly to another controller where technically feasible.

f) Right to object. You can object at any time to processing based on my legitimate interest. I may then continue the processing only if I demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or if the processing is necessary for the establishment, exercise or defence of legal claims. You can object to receiving commercial communications and to other processing for direct marketing purposes at any time and without giving reasons; I will then stop processing for that purpose without further ado.

g) Right to withdraw consent. Where I process data on the basis of your consent, you can withdraw it at any time, as easily as you gave it. Withdrawal takes effect for the future; the lawfulness of processing carried out until then is not affected.

h) Right not to be subject to automated decision-making. I make no decisions based solely on automated processing, including profiling.

i) Right to lodge a complaint with the supervisory authority and to go to court. If you believe that the processing of your personal data infringes the Regulation, you can lodge a complaint with the Office for Personal Data Protection (www.uoou.gov.cz). This does not affect your right to a judicial remedy, which you can exercise independently of a complaint, nor your right to compensation for material or non-material damage the processing has caused you.

How I handle requests. I will reply no later than one month after receiving the request. If the request is complex or I receive a number of them, I may extend this period by a further two months; I will inform you of the extension and the reasons for it within the original period. Handling a request is free of charge; for manifestly unfounded or excessive requests, in particular repetitive ones, I may charge a reasonable fee or refuse the request.

9. Security

I have adopted technical and organisational measures appropriate to the nature of the data processed and the related risks, in particular to protect the data against unauthorised access, loss and misuse.