This general notice on the processing of personal data (the "Notice") serves to inform data subjects, especially, but not exclusively, clients, business partners, and job applicants, about the reasons, methods, scope, and purposes of processing their personal data in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (the "GDPR").

1. DATA CONTROLLER

   1.1      The data controller for the scope of this Notice is KeyMove s.r.o., a law office, located at Perlová 371/5, Staré Město, 110 00 Prague 1, ID No. 215 32 231, registered in the Commercial Register maintained by the Municipal Court in Prague under Ref. No. C 403336 (the "Controller").

   1.2      The Controller is, within the scope of this Notice:

   (i) a provider of legal services within the meaning of Act No. 85/1996 Coll., the Advocacy Act, as amended (the "Advocacy Act") and a person obliged under Act No. 253/2008 Coll., on certain measures against money laundering and terrorist financing, as amended (the "AML");
   (the "Legal Services")

   (ii) an operator of the company's website available at https://keymove.cz/;
   (the "Website")

   (iii) a person responsible for disseminating commercial communications, newsletters, and other marketing activities including online or in-person meetings and social events and a person collecting contact information within the contact database for the purposes of business and marketing communication;
   (the "Marketing")

   (iv) a person responsible for the selection process of individual job applicants and lawyers applying for employment or similar forms of cooperation, for example in the form of permanent cooperation under § 15e of the Advocacy Act in the case of independent lawyers;
   (the "Applicant Selection")

   (v)       a business partner in connection with establishing business relationships outside the scope of the above activities.
   (the "Business Partnership")

   1.3     In the course of activities, there may be processing of personal data; thus, the Controller, in accordance with GDPR and applicable professional regulations of the Czech Bar Association, provides through this Notice to the data subjects the following information.

   1.4      In case of any questions related to the protection of your personal data and its processing, you can contact the responsible person of the Controller, who is Mgr. Jakub Karfilát, LL.M., phone: +420 724 274 489, e-mail: jakub.karfilat@keymove.cz.

   
   

2. PURPOSE OF PERSONAL DATA PROCESSING

   2.1       In case you are a client or a person with a similar status (e.g. a future partner of the established company, a party to a contract, or a person with a relevant relationship to the given case), your personal data is processed in connection with the provision of Legal Services.

   2.2       In connection with your entry to the Website, your personal data is processed by the Controller and also for the purpose of its proper functioning.

   2.3       The Controller further processes your personal data in connection with Marketing.

   2.4      The Controller further processes your personal data in connection with Applicant Selection, in the case where you have expressed interest in cooperation in the form of an employment or other similar relationship.

   2.5       The Controller further processes your personal data within Business Partnership, if you have initiated pre-contractual negotiations with the Controller, established a contractual relationship, or otherwise agreed on business cooperation. Your data is collected and processed solely for the purpose of providing legal services and legal advice. For this reason, we aim to limit the scope of their processing to the lowest possible amount that allows for proper provision of services.

   
   

3. SCOPE OF PROCESSED PERSONAL DATA

   3.1      In connection with fulfilling the purpose of processing personal data defined by the Controller in this Notice, there will be processing of personal data that you provide for the purpose of providing Legal Services, entering the Website, Marketing, in connection with Applicant Selection, and concluding and fulfilling Business Partnerships.

   3.2      In the case of providing Legal Services, it will primarily involve the processing of the following personal data:

   (i)         identification data (including name, surname, date of birth, residential address);
   (ii)        contact data (including phone number, email address, and data mailbox);
   (iii)       payment data (including billing and payment information, bank account details);
   (iv)       factually relevant data (scope depends on the specific case);
   (v)        AML data (including solvency, data from tax returns, copies of identity documents).

   3.3      In the case of entering the Website, it will primarily involve the processing of the following personal data:

   (i)         localization and time data (including IP address and time of visit to the Website);
   (ii)        technical data (including information about the device used, operating system);
   (iii)       Cookies data.

   3.4      In the case of Marketing, it will primarily involve the processing of the following personal data, according to the nature of the specific Marketing activity:

   (i)         identification data (including name, surname, date of birth, residential address for the purpose of your identification in the case of granting consent to process your personal data in connection with Marketing);
   (ii)        contact data (including phone number, email address, and data mailbox);
   (iii)       Cookies data.

   3.5       In the case of Applicant Selection, it will primarily involve the processing of the following personal data:

   (i)         identification data (including name, surname, date of birth, residential address);
   (ii)        contact data (including phone number, email address, and data mailbox);
   (iii)       reference data (including information about previous employment, health insurer).

   3.6       In the case of Business Partnership, it will primarily involve the processing of the following personal data:

   (i)         identification data (including name, surname, date of birth, residential address);
   (ii)        contact data (including phone number, email address, and data mailbox);
   (iii)       payment data (including billing and payment information, bank account details);
   (iv)       data of cooperating persons (including information about employees and statutory representatives).

   3.7       More detailed information about the Cookies processed by the Controller can be found in the Cookie Processing Principles.
   
   

4. LEGAL BASIS FOR PROCESSING PERSONAL DATA

   4.1       The processing of your personal data will be carried out on the basis of:

   (i)         Art. 6, para. 1 (a) GDPR, i.e., based on your consent, which relates primarily to personal data processed for Marketing purposes as per para. 3.4 of this Notice, except for data processed for Marketing based on legitimate interest;
   (ii)        Art. 6, para. 1 (b) GDPR, i.e., in connection with the fulfillment of a contract, which relates primarily to personal data processed in connection with the provision of Legal Services in accordance with para. 3.2 of this Notice or the contract in the framework of Business Partnership as per para. 3.6 of this Notice;
   (iii)       Art. 6, para. 1 (c) GDPR, i.e., in connection with fulfilling a legal obligation applicable to the Controller, which relates primarily to personal data processed in connection with AML as per 3.2 of this Notice, including especially the identification and verification of the client under AML, fulfilling reporting and notification obligations to public authorities, etc.;
   (iv)       Art. 6, para. 1 (f) GDPR, i.e., based on the legitimate interest of the Controller, especially in cases where the Controller will exercise the protection of its rights and legitimate interests in the context of processing your personal data, especially in the enforcement and collection of claims, requests for damages in court or administrative proceedings, and further use of personal data for the purpose of further enhancement and optimization of the services provided, with this legal basis for processing also pertaining to the processing of your personal data in connection with Marketing when the processing occurs based on a business relationship.
   
   

5. RETENTION PERIOD FOR PERSONAL DATA PROCESSING

   5.1       The processing of your personal data defined in this Notice will last for the duration of the purpose and legal basis for processing as per this Notice, specifically:

   (i)     in the case of providing Legal Services for the duration of their provision and no longer than 10 years after the termination of their provision, unless otherwise provided by legal or professional regulations, in case the legal basis for processing is the performance of a contract;
   (ii)      in the case of your entry to the Website, for the duration of your visit to the Website and subsequently for the time necessary to achieve the respective purpose, usually no longer than 12 months after your last entry to the respective web interface;
   (iii)    in the case of your personal data processed based on your consent (e.g., for Marketing purposes), for the duration of the validity of your granted consent, unless such consent is subsequently revoked or unless any further processing of your personal data is based on another legal basis according to para. 4.1 of this Notice;
   (iv)    during the process of Applicant Selection, no longer than 4 years after the decision on the acceptance or rejection of the applicant in case the legal basis for processing is the performance of a contract or taking measures prior to its conclusion;
   (v)     for the duration of the business relationship, no longer than 10 years after its termination, in case the legal basis for processing is the performance of a contract or taking measures before its conclusion;
   (vi)       for the duration of the legal obligation that the Controller is obliged to fulfill and for which the processing of personal data is necessary;
   (vii)      for the duration of the legitimate interest, especially in situations where the original legal basis for processing no longer applies, but the Controller is still entitled to process personal data for the purposes of possible assertion of rights, individual claims, or protection of its interests in judicial or administrative proceedings or by other means.

   5.2       Even after the termination of processing personal data for the purposes specified in this Notice, the revocation of consent, or the termination of the duration of the contract, the Controller may still retain your personal data in cases where valid legal or professional regulations require or allow them to. In such cases, your personal data will be retained for the prescribed period and processed solely for the purposes defined by these legal or professional regulations.
   
   

6. SHARING PERSONAL DATA WITH THIRD PARTIES

   6.1       The Controller may use the services of third parties, who will process your personal data in a limited scope. Currently, such external service providers include:

   (i)         ECOMAIL.CZ, s.r.o. – marketing platform for disseminating commercial communications;
   (ii)        Facebook – marketing services of the company displaying ads while visiting the social network;
   (iii)       Google Analytics – analytical marketing tool;
   (iv)       Google Tag Manager – analytical marketing tool;
   (v)        LinkedIn – marketing services of the company displaying ads while visiting the social network;
   (vi)       Single Case, s.r.o. – tool for case management and administration while providing legal services;
   (vii)       ÚČETNÍ V SUKNI s.r.o. – accounting and tax consulting company.

   6.2       The Controller is authorized to provide personal data to suppliers of external consulting services (e.g., tax, accounting, or legal services).

   6.3       The processing of your personal data will primarily take place within the European Union (EU). However, since your personal data is also processed within the Application by external service providers based in or operating in countries outside the EU, there may in some cases be processing of personal data outside the EU. In such cases, the processing of personal data will be subject to appropriate data transfer mechanisms, including prior assessments and corresponding safeguards. Common mechanisms include, for example, the so-called Data Privacy Framework between the EU and the USA, which is applied when transferring personal data to the USA, or standard contractual clauses issued by the European Commission for the transfer of personal data to third countries. We will be happy to provide you with more information upon request.

   
   

7. INFORMATION ON RIGHTS IN CONNECTION WITH PERSONAL DATA PROCESSING

   7.1       The Controller is entitled to process your personal data for purposes, in the scope, by the means, and for the duration specified in this Notice.

   7.2       As a data subject, you have the following rights:

   (i)         the right to withdraw consent

   ●        you have the right to withdraw your consent to the processing of personal data. If you wish to withdraw your consent, please contact the Controller's contact person or use another automated way to withdraw consent provided by the Controller, for example, in connection with sending commercial communications through the Ecomail platform.

   (ii)        the right to access processed personal data

   ●        you have the right to request copies of your personal data that the Controller processes about you. With this copy, you will be able to understand which of your personal data the Controller has and processes. The right to access also applies if the record contains information that can identify another natural person and that information pertains to them. This means that in the records accessible to you, personal data about other individuals may be redacted to protect their right to privacy. Your personal data will also be redacted if someone else requests access to records containing your personal data. Legislation stipulates other exceptions that may apply, such as records subject to legal confidentiality or where there is an obligation to maintain confidentiality under certain circumstances. Each invoked exception will have an appropriate legal basis and will be explained to you by the Controller if necessary;

   (iii)       the right to information

   ●        you have the right to be informed about how the Controller processes your personal data. If you have any questions regarding how the Controller processes your personal data, you can contact the Controller's contact person;

   (iv)       the right to rectify

   ●        you have the right to request the Controller to rectify information that it processes and which you consider inaccurate. You also have the right to request the completion of information you consider incomplete. This right applies in connection with one of the principles of data protection. Any request for rectification of your personal data will be forwarded and processed by any processor with whom your personal data has been shared by the Controller. This process is managed by the Controller and will not require any additional steps on your part for your right to be fully asserted. If you wish to exercise your right to rectification, please contact the Controller's contact person;

   (v)        the right to erasure

   ●        you have the right to request the Controller to erase your personal data processed by the Controller if they are no longer necessary for the fulfillment of the purpose of their processing or storage. Any request for erasure will also be processed by any processor who processes your personal data for the Controller. If you wish to exercise your right to erasure, please contact the Controller's contact person;

   (vi)       the right to restrict processing

   ●        you have the right to request the Controller to restrict the processing of your data that the Controller processes under certain circumstances. If you wish to exercise your right to restrict processing, please contact the Controller's contact person;

   (vii)      the right to data portability

   ●        you have the right to request the Controller to provide the information it processes to be transferred to another organization or to you, except for personal data subject to an obligation not to disclose such information to third parties. This enables you to transfer it in a machine-readable format to another recipient. The right to data portability applies only to personal data processed based on your consent and provided to the Controller by you. If you wish to exercise your right to data portability, please contact the Controller's contact person.

   7.3       If you wish to exercise any of your rights defined in para. 7.2 of this Notice, please contact the contact person specified in para. 1.4 of this Notice.

   7.4       General information about your rights can also be found on the website of the Office for Personal Data Protection at https://uoou.gov.cz/verejnost/zakladni-prirucka-k-ochrane-udaju.

   7.5       If necessary, you have the option to exercise the right to file a complaint with the supervisory authority for personal data protection and the right to effective judicial protection through the court. The relevant authority for personal data protection and supervisory authority is the Office for Personal Data Protection, located at Pplk. Sochora 27, 170 00 Prague 7, and can be contacted using the details below:

   phone number: +420 234 665 800
   email: posta@uoou.gov.cz
   other contacts: Contact | Office for Personal Data Protection (gov.cz).

   This Notice is effective from August 26, 2025, with the Controller reserving the right to update or otherwise change the Notice at any time at its discretion.