Privacy Policy

In all processing of your personal data for the above purposes, we adhere to the principle of data minimisation, meaning that we process personal data only to the extent necessary to achieve the specific purpose.

After the expiry of the processing period, your personal data will be anonymised and used for statistical and analytical purposes, whereby such data can no longer be linked to you.

I. Purpose of this Policy

This Policy informs you, as a data subject, about the processing of your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”), and Act No. 18/2018 Coll. on Personal Data Protection, as amended (the “Act”).

This Policy, together with the terms governing the use of this website and any other documents referred to herein, sets out the types of personal data we collect, how we collect and process such information, with whom we share it in connection with the provision of our services, and certain rights and options available to you in this regard.

We recommend that you familiarise yourself with the information contained in this document. Any changes related to the processing of your personal data will be implemented through updates to this document published on our website.

II. Controller

The controller is Škubla & Partneri s. r. o., with its registered office at Digital Park II, Einsteinova 25, 851 01 Bratislava, Company ID: 36 861 154, registered in the Commercial Register of the Municipal Court Bratislava III, Section: Sro, File No.: 55759/B (hereinafter also referred to as “Škubla & Partneri”).

The controller is the entity that determines the purposes and means of processing your personal data and is responsible for ensuring the protection of your personal data.

III. Who can I contact with questions and where can I exercise my rights?

If you have any questions regarding the processing of your personal data by Škubla & Partneri, or if you wish to exercise any of your rights as a data subject under applicable law, you may contact us at any time as follows:

- By phone: +421 (2) 577 88 800, 810
- By contacting Škubla & Partneri via email: office@skubla.sk
- By post: Škubla & Partneri s. r. o., Digital Park II, Einsteinova 25, 851 01 Bratislava

You also have the right to lodge a complaint with the Office for Personal Data Protection, with its registered office at Námestie 1. mája, 811 06 Bratislava, website: Office for Personal Data Protection of the Slovak Republic, or with the supervisory authority in your country of habitual residence or place of work. The supervisory authority will inform you about the progress and outcome of your complaint, including the possibility of seeking a judicial remedy.

IV. For what purposes and how do you process my personal data?

a) If I apply for a job

How we obtain your personal data

We obtain your personal data directly from you, namely by (i) completing an electronic form available on our website for applying for a specific job position or for inclusion in our database of potential candidates; (ii) submitting your CV or supporting documents via the career form or by sending such documents to the Škubla & Partneri email address.

We may also obtain your personal data indirectly when you visit our website, through cookies, subject to your consent.

Categories, purposes, legal basis and retention period of your personal data

Purpose of processing	Categories of data	Legal basis	Retention period
Recruitment process	First name, last name, specialisation, email address, telephone number, and other data contained in submitted documents, such as date of birth, address, photograph, information on education, qualifications, professional experience and employment history.	Legitimate interest in organising and managing the recruitment process, including the selection of suitable candidates for employment or a specific position.	For the duration of the recruitment process and subsequently for 30 days after its completion.
Maintaining a database of potential candidates	All personal data provided by the candidate as specified above.	Consent.	For the duration of the consent (12 months), and no longer than 30 days after its withdrawal.
Establishment, exercise or defence of legal claims in connection with recruitment or candidate records	All personal data processed in connection with the recruitment process or inclusion in the candidate database that are relevant for the establishment, exercise or defence of legal claims.	Legitimate interest in the establishment, exercise or defence of legal claims.	For the duration of the legal claim and subsequently for 60 days after its conclusion.
Handling and processing data subject rights under the Act and GDPR	Title, first name, last name, correspondence address, email, telephone number, data contained in the request, method and time of receipt and handling of the request, related communication, and all personal data to which the request relates.	Processing is necessary for compliance with legal obligations, in particular under the GDPR and applicable data protection legislation.	60 days from the date of a valid request by the data subject; subsequently 5 years for the purpose of demonstrating compliance with legal obligations.
Records management	Data forming part of records management documentation.	Compliance with legal obligations under archival and records management legislation.	Until the expiry of retention periods set by applicable legislation governing specific documents, or 10 years from their acquisition if no statutory retention period is specified. If proceedings are initiated by public authorities, the retention period is extended for the duration of such proceedings.

The recruitment process includes the collection of data from the Candidate, assessment of suitability, internal communication, organisation of interviews, provision of feedback, and related activities.

Maintaining a database of Candidates includes inclusion in the records, storage of data, updating of data, contacting candidates with suitable job opportunities, and management of consent.

The processing of personal data for the purpose of protecting rights and legitimate interests in connection with the establishment, exercise or defence of legal claims is based on the legitimate interest of Škubla & Partneri, namely the ability to defend itself in legal proceedings or to assert its own claims in the event of disputes with the Candidate. Given the limited scope of the data processed, their retention only for the necessary period, and the fact that the data subject may reasonably expect such processing, we do not consider this processing to constitute a disproportionate interference with their rights and freedoms.

After the expiry of the processing period, your personal data will be anonymised and used for statistical and analytical purposes, whereby such data can no longer be linked to you.

b) If I subscribe to the newsletter

How we obtain your personal data

We obtain your personal data directly from you, namely by completing an electronic form available on our website for subscribing to the newsletter.

We may also obtain your personal data indirectly when you visit our website, through cookies, subject to your consent to their use.

Categories, purposes, legal basis and retention period of your personal data

Purpose of processing	Categories of data	Legal basis	Retention period
Sending updates and legal information (newsletter)	First name, last name, email address, information on the time consent was given.	Consent of the data subject.	For the duration of the consent, and no longer than 30 days after its withdrawal.
Handling and processing data subject rights under the Act and GDPR	Title, first name, last name, correspondence address, email, telephone number, data contained in the request, method and time of receipt and handling of the request, related communication, and all personal data to which the request relates.	Processing is necessary for compliance with legal obligations, in particular under the GDPR and applicable data protection legislation.	60 days from the date of a valid request by the data subject; subsequently 5 years for the purpose of demonstrating compliance with legal obligations.
Records management	Data forming part of records management documentation.	Compliance with legal obligations under archival and records management legislation.	Until the expiry of retention periods set by applicable legislation governing specific documents, or 10 years from their acquisition if no statutory retention period is specified. If proceedings are initiated by public authorities, the retention period is extended for the duration of such proceedings.

After the expiry of the processing period, your personal data will be anonymised and used for statistical and analytical purposes, whereby such data can no longer be linked to you.

c) If you contact us via the contact form

How we obtain your personal data

We obtain your personal data directly from you by completing an electronic form available on our website for contacting our company for the purpose of providing legal services, legal advice and consultations, or in connection with potential cooperation.

We may also obtain your personal data indirectly when you visit our website, through cookies, subject to your consent to their use.

Categories, purposes, legal basis and retention period of your personal data

Purpose of processing	Categories of data	Legal basis	Retention period
Provision of legal services (legal advice and consultations)	First name, last name, email address, telephone number, and any other personal data provided by the data subject via the text field in the electronic form.	Compliance with legal obligations under Act No. 586/2003 Coll. on Advocacy and on Amendments to Act No. 455/1991 Coll. on Trade Licensing (Trade Licensing Act), as amended. Performance of contractual obligations under a legal services agreement.	For the period required by applicable legal regulations. For the duration of the contractual relationship and subsequently for 10 years after its termination.
Handling enquiries, requests for legal advice and communication with potential clients	First name, last name, email address, telephone number, and any other personal data provided by the data subject via the text field in the electronic form.	Legitimate interest in responding to enquiries, requests for legal services, or acquiring new clients.	For the period necessary to provide a response.
Establishment, exercise or defence of legal claims in connection with legal services or pre-contractual negotiations	All personal data processed in connection with the provision of legal services or pre-contractual negotiations that are relevant for the establishment, exercise or defence of legal claims.	Legitimate interest in the establishment, exercise or defence of legal claims.	For the duration of the legal claim and subsequently for 60 days after its conclusion.
Handling and processing data subject rights under the Act and GDPR	Title, first name, last name, correspondence address, email, telephone number, data contained in the request, method and time of receipt and handling of the request, related communication, and all personal data to which the request relates.	Processing is necessary for compliance with legal obligations, in particular under the GDPR and applicable data protection legislation.	60 days from the date of a valid request by the data subject; subsequently 5 years for the purpose of demonstrating compliance with legal obligations.
Records management	Data forming part of records management documentation.	Compliance with legal obligations under archival and records management legislation.	Until the expiry of retention periods set by applicable legislation governing specific documents, or 10 years from their acquisition if no statutory retention period is specified. If proceedings are initiated by public authorities, the retention period is extended for the duration of such proceedings.

After the expiry of the processing period, your personal data will be anonymised and used for statistical and analytical purposes, whereby such data can no longer be linked to you.

Recipients of your personal data

In processing your personal data for the purposes set out in this Policy, Škubla & Partneri may use the services of contractual partners who participate in the technical and organisational provision of these activities. For the purposes of personal data protection, such contractual partners act as processors who process personal data solely on the basis of a data processing agreement, on behalf of and for Škubla & Partneri, and are bound by confidentiality obligations and required to comply with security measures in accordance with applicable legal regulations.

Processors may be divided into the following categories:

Providers of software solutions for maintaining records of data subjects, including systems for document access, communication, and content creation, storage and distribution.
Providers of technical solutions for the website and online forms used to collect data from data subjects.
Providers of cloud-based and office software services through which electronic documents, emails and other internal communications are stored and managed.
Providers of IT support and infrastructure management necessary for the proper functioning of systems related to the website and the controller’s activities.
Providers of specialised communication tools used for communication with data subjects.
Entities providing archiving or destruction (disposal) of documentation relating to data subjects.

The list of specific processors may change depending on the technologies and services currently used. An up-to-date list is available upon request via email at: office@skubla.sk.

In addition to the above processors, your personal data may also be disclosed to other recipients acting as independent controllers, where required by law or where necessary for the establishment, exercise or defence of legal claims. Such recipients may include, in particular, public authorities (e.g. courts, law enforcement authorities, the Office for Personal Data Protection of the Slovak Republic) or professional advisers.

International transfers of personal data

In the processing of your personal data for the purposes set out in this Policy, personal data may be transferred outside the European Union and the European Economic Area, particularly where Škubla & Partneri uses cloud services or IT tools provided by entities established outside the EU.

Such transfers may in particular take place to the United States of America (USA) where data is stored or processed through cloud solutions provided by companies certified under the EU–US Data Privacy Framework.

In such cases, the transfer of personal data is carried out in accordance with applicable data protection legislation, in particular on the basis of the European Commission Implementing Decision (EU) 2023/1795 of 10 July 2023, and only to entities holding a valid certification under this framework.

Where it is necessary to transfer personal data to another third country or international organisation that does not ensure an adequate level of data protection, you will be specifically informed of such transfer. In such cases, the transfer will be carried out only on the basis of lawful mechanisms permitted under the GDPR (e.g. standard contractual clauses) and, where required, only after obtaining your explicit consent.

Automated decision-making and profiling

No automated decision-making or profiling takes place in the processing of your personal data.

d) If you contact us via WhatsApp

How we obtain your personal data

By clicking on the WhatsApp icon, a new tab will open and you will be redirected to the WhatsApp application or web interface, through which you can contact us and start a conversation. We obtain your personal data directly from you through such communication. In accordance with the terms of use of WhatsApp, in addition to the information you provide in the communication itself, we also have access to your telephone number and username.

We may also obtain your personal data indirectly when you visit our website or use WhatsApp, through cookies, subject to your consent to their use.

Categories, purposes, legal basis and retention period of your personal data

Purpose of processing	Categories of data	Legal basis	Retention period
Provision of legal services (legal advice and consultations)	First name, last name, email address, telephone number, and any other personal data provided by the data subject within the communication.	Compliance with legal obligations under Act No. 586/2003 Coll. on Advocacy and on Amendments to Act No. 455/1991 Coll. on Trade Licensing (Trade Licensing Act), as amended. Performance of contractual obligations under a legal services agreement.	For the period required by applicable legal regulations. For the duration of the contractual relationship and subsequently for 10 years after its termination.
Handling enquiries, requests for legal advice and communication with potential clients	First name, last name, email address, telephone number, and any other personal data provided by the data subject within the communication.	Legitimate interest in responding to enquiries, requests for legal services, or acquiring new clients.	For the period necessary to provide a response.
Establishment, exercise or defence of legal claims in connection with legal services or pre-contractual negotiations	All personal data processed in connection with the provision of legal services or pre-contractual negotiations that are relevant for the establishment, exercise or defence of legal claims.	Legitimate interest in the establishment, exercise or defence of legal claims.	For the duration of the legal claim and subsequently for 60 days after its conclusion.
Handling and processing data subject rights under the Act and GDPR	Title, first name, last name, correspondence address, email, telephone number, data contained in the request, method and time of receipt and handling of the request, related communication, and all personal data to which the request relates.	Processing is necessary for compliance with legal obligations, in particular under the GDPR and applicable data protection legislation.	60 days from the date of a valid request by the data subject; subsequently 3 years for the purpose of demonstrating compliance with legal obligations.
Records management	Data forming part of records management documentation.	Compliance with legal obligations under archival and records management legislation.	Until the expiry of retention periods set by applicable legislation governing specific documents, or 10 years from their acquisition if no statutory retention period is specified. If proceedings are initiated by public authorities, the retention period is extended for the duration of such proceedings.

After the expiry of the processing period, your personal data will be anonymised and used for statistical and analytical purposes, whereby such data can no longer be linked to you.

Recipients of your personal data

The use of the WhatsApp application is governed exclusively by the agreements you have entered into with the operator of the WhatsApp application. Communication is secured by end-to-end encryption (peer-to-peer), which prevents the operator of WhatsApp or any third parties from accessing the content of the communication. However, WhatsApp may have access to metadata generated during the communication process (e.g. sender, recipient and time).

Processors may be divided into the following categories:

Providers of software solutions for the creation, management and processing of enquiries and requests;
Providers of technical solutions for the website and online forms used to collect data from data subjects;
Providers of cloud-based and office software services through which electronic documents, emails and internal communications are stored and managed;
Providers of IT support and infrastructure management necessary for the proper functioning of systems related to electronic forms;
Providers of specialised communication tools used for communication with data subjects;
Entities providing archiving or destruction (disposal) of documentation relating to data subjects.

The list of specific processors may change depending on the technologies and services currently used. An up-to-date list is available upon request via email at: office@skubla.sk.

International transfers of personal data

International transfers of personal data in connection with the use of WhatsApp are governed by the policies of the application operator, namely WhatsApp Ireland Limited, together with WhatsApp LLC and its parent company Meta Platforms, Inc.

Automated decision-making and profiling

No automated decision-making or profiling takes place in the processing of your personal data.

V. Your rights

In connection with the processing of your personal data described above, you have the following rights:

Right of access under Article 15 GDPR – you have the right to obtain confirmation as to whether your personal data are being processed and, if so, to access such data;
Right to rectification under Article 16 GDPR – if your personal data are inaccurate or incomplete, you have the right to have them corrected or completed;
Right to erasure (“right to be forgotten”) under Article 17 GDPR – in certain circumstances, you have the right to request the deletion of your personal data;
Right to restriction of processing under Article 18 GDPR – you have the right to request restriction of processing where one of the conditions set out in the GDPR is met;
Right to data portability under Article 20 GDPR – you have the right to receive your personal data in a structured, commonly used format where the processing is based on consent or a contract;
Right to object under Articles 21 and 22 GDPR – you may object to the processing of your personal data where it is based on legitimate interest or for direct marketing purposes, and you may also object to automated individual decision-making;
Right to withdraw consent – where processing is based on your consent, you have the right to withdraw such consent at any time without affecting the lawfulness of processing prior to its withdrawal;
Right to lodge a complaint with a supervisory authority – if you believe that your personal data have been processed in violation of applicable legal regulations. More information can be found in Section III of this Policy.

This Privacy Policy is valid and effective as of [website launch date] 2026.