Effective from 13 October 2026
Scope of this notice. This notice applies only to the “Book a consultation” contact form and the other contact forms on machlegal.eu. It does not apply to newsletter subscriptions, which are governed by a separate notice, or to the processing of our clients’ data. We do not add data from the form to our newsletter mailing list.
1. Controller
The controller of your personal data is MACH LEGAL, advokátní kancelář s.r.o., company ID (IČO) 24241474, with its registered office at Viktora Huga 377/4, 150 00 Prague 5 – Smíchov, Czech Republic, registered in the Commercial Register kept by the Municipal Court in Prague, file no. C 196512 (the “firm” or “we”).
Contact for questions about the processing of personal data: praha@machlegal.eu, tel. +420 245 008 552. No data protection officer has been appointed.
This notice applies only to data you send us through the contact forms on this website. The processing of client data in the course of providing legal services is governed separately.
2. What data we process
- Form data: name, e-mail address, telephone number (optional), subject and the text you enter in your message (for the “Book a consultation” form also the type of meeting you choose and the area of law). We do not process data you do not provide.
- Technical data: when you submit the form, your IP address and browser information (type, version, time of access) are processed in connection with protecting the form against abuse.
- Special categories: please do not include health data or other special categories of personal data in your message. If you do so anyway, we will use that data only to the extent necessary to deal with your enquiry.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Handling your enquiry, arranging a consultation and communicating with you | Art. 6(1)(b) GDPR – steps taken at your request prior to entering into a contract |
| Conflict-of-interest check before legal services are provided (Section 19 of the Czech Act on the Legal Profession) | Art. 6(1)(f) GDPR – the firm’s legitimate interest in complying with its duty to decline services in case of a conflict of interest |
| Protecting the form and the website against spam and abuse | Art. 6(1)(f) GDPR – legitimate interest in the security of the website |
| Evidence of receipt and handling of the enquiry and protection of the firm’s legal claims during the retention period | Art. 6(1)(f) GDPR – legitimate interest |
We carry out processing under point (f) only where your interests or fundamental rights and freedoms do not override it. Providing your data is voluntary; however, without your name and e-mail address we cannot reply to your enquiry. We do not use automated decision-making or profiling. We do not use data from the form to send commercial communications or the newsletter. The newsletter is a separate service with its own notice.
4. Who receives your data
- Lawyers and employees of the firm who handle your enquiry and are bound by a duty of confidentiality.
- The firm’s own server in Prague (Czech Republic), which hosts the website and e-mail; no third-party hosting provider is involved.
- Google (reCAPTCHA) to protect the form against automated attacks.
- Automattic (Akismet) for spam filtering.
- Cloudflare (Turnstile) to protect the form against automated attacks.
Data from the form is not stored in HubSpot or any other external contact-management tool. We do not sell personal data.
5. Transfers outside the European Economic Area
Some of the providers listed in section 4 (Google, Automattic and Cloudflare) are based in, or process data in, the United States. Data is transferred only to the extent needed for spam protection (technical data and the content of the form). The transfer relies on the European Commission’s adequacy decision for the EU–US Data Privacy Framework where the provider is certified under it (according to the providers’ own statements, Google and Cloudflare), and otherwise on standard contractual clauses approved by the European Commission (as stated by Automattic). We will provide a copy of the relevant safeguards on request.
6. How long we keep your data
We keep form data for no longer than one year after the last communication concerning your enquiry. If the enquiry leads to an attorney–client relationship, further retention is governed by the rules on documentation of legal services (Section 25 of the Czech Act on the Legal Profession) and by the engagement agreement.
7. Lawyer’s duty of confidentiality
A lawyer is bound to maintain confidentiality about all information learned in connection with the provision of legal services (Section 21 of the Czech Act on the Legal Profession). We handle the data you send us with corresponding care; however, the form is not a secure channel for confidential information about a matter, and submitting the form does not create an attorney–client relationship.
8. Your rights
You have the right to request access to your personal data (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You also have the right to object to processing based on legitimate interests (Art. 21); after you object, we will stop the processing unless we demonstrate compelling legitimate grounds that override your interests. You can exercise your rights by e-mail to praha@machlegal.eu. We will respond without undue delay and at the latest within one month.
9. Complaints and changes
If you believe that the processing of your data infringes the GDPR, you may lodge a complaint with a supervisory authority. In the Czech Republic this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7 (www.uoou.gov.cz); you may also complain to the supervisory authority of the EU Member State where you habitually reside or work.
This notice applies from 13 October 2026. We will publish any changes on this page, stating the date.