Privacy Policy

How I handle personal data on advokatni.net and in the provision of legal services, in accordance with Regulation (EU) 2016/679 (GDPR).

1. Data controller

JUDr. Tomáš Elbert, Attorney-at-Law, with registered office at Školská 694/32, 110 00 Prague 1, Czech Republic, Company ID (IČO) 03658554, registered with the Czech Bar Association under reg. no. 16037. Contact: tomas.elbert@advokatni.net, tel. +420 739 661 038.

2. What data I process and why

• If you contact me on your own initiative (by e-mail or phone): I process the data you provide (name, contact details, content of your enquiry) in order to handle your request and possibly provide legal services. The legal basis is taking steps prior to entering into a contract and my legitimate interest (Art. 6(1)(b) and (f) GDPR).
• Provision of legal services (if you become a client): processing is governed by the legal services contract and by special legislation. Such data is subject to the attorney's duty of confidentiality under Section 21 of Act No. 85/1996 Coll., on the Legal Profession.
• Website operation: the website runs on Cloudflare infrastructure (hosting and protection provider), which briefly processes technical data including IP addresses for operation and security. The website currently uses no analytics or advertising cookies.

3. Retention period

I process data only for as long as necessary for the given purpose, and thereafter for the periods required by law:

• Enquiries that do not lead to an engagement: I keep the data only for as long as needed to handle the enquiry and any follow-up communication.
• Client files and records of legal services: 5 years from the end of the engagement (Art. 3 of Resolution No. 9/1999 of the Board of the Czech Bar Association).
• Client identification and due-diligence data under anti-money-laundering legislation: 10 years from the end of the business relationship (Section 16 of Act No. 253/2008 Coll.). This applies only to selected services, typically escrow arrangements or real-estate transfers.
• Accounting and tax records: 10 years from the end of the tax period in which the supply took place (Section 35 of the Czech VAT Act).
• Data needed to establish or defend legal claims: for the duration of the limitation periods, generally 3 years, up to 10 years for damage claims (Sections 629 and 636 of the Civil Code).

Once these periods expire, I erase the data and destroy paper files.

4. Recipients and processors

I work with the data myself. To run the office I use the services of providers that process data under data processing agreements pursuant to Art. 28 GDPR:

• Google (Google Workspace): e-mail, calendar, documents and cloud storage. Google does not use Workspace customer data for advertising or for training AI models.
• Anthropic (the Claude AI assistant): a support tool for document preparation and research.
• Cloudflare: website hosting and protection.
• An accounting firm: accounting and tax records.

I disclose data to public authorities only where the law requires it. Everything I learn in connection with providing legal services is subject to the attorney's duty of confidentiality (legal professional privilege) under Section 21 of the Legal Profession Act. That duty is not limited in time, continues after the engagement ends, and only the client can release me from it. The providers listed above process data solely for the needs of my office, are bound by confidentiality and may not use it for their own purposes.

5. Transfers outside the EU

Google, Anthropic and Cloudflare are US-based companies, so part of the processing may take place outside the European Union, in particular in the USA. Every such transfer is covered by safeguards under Chapter V of the GDPR:

• Google: my contracting party is an Irish Google group company. Transfers to the USA rely on the European Commission's adequacy decision (the EU-U.S. Data Privacy Framework, in which Google LLC is a certified participant) and, alongside it, on the Standard Contractual Clauses incorporated in the data processing agreement.
• Anthropic: transfers rely on the European Commission's Standard Contractual Clauses, which form part of the Data Processing Addendum. Anthropic is also contractually prohibited from training its AI models on the data and, as a rule, deletes it within 30 days.
• Cloudflare: transfers rely on the European Commission's Standard Contractual Clauses.

6. Your rights

You have the right of access to your data, to rectification, erasure, restriction of processing, to object, and to data portability. You also have the right to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz. You may exercise your rights at the e-mail address above.

Last updated: 16 July 2026.

Back to home