PETERKA & PARTNERS Law firm Ltd., with its registered seat at Vlaška ulica 81, Zagreb, Croatia, PIN: 61481916494, MBS: 081482808 (hereinafter referred to as “PETERKA & PARTNERS” and/or “we” and/or „us“) in accordance with the provisions of Art. 13 and Art. 14 of the REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation or GDPR) with this Policy informs data subjects about the circumstances of the processing of personal data performed by PETERKA & PARTNERS.

When controlling and processing personal data (“personal data”) we apply the GDPR. We also apply applicable national legislation as well as professional and ethical rules related to our activity.

We include the personal data in our database and we use them pro purposes specified below.

Please find below brief information about:

• what personal data we collect;
• the purposes for  which personal data are used and the legal basis for it;
• persons having access to personal data;
• the rights and guarantees the GDPR provides to data subjects.

Types of processed personal data

PETERKA & PARTNERS collects the following data of data subjects:

• name and surname;
• title;
• job position;
• phone number(s);
• e-mail address(es);
• other data that may be necessary in certain cases or relevant to provision or offering of legal services (e.g., address, date of birth, information necessary for compliance with anti-money laundering obligations (nationality, ID card and/or passport numbers, residency card number, etc.), other data necessary for fulfilling of legal relationships with the subjects of data or required by the law (such as bank account details necessary for payment of our fees or data required by the AML legislation) or other data the data subjects choose to share with us.

We process special categories of personal data when the processing of those data is necessary for the establishment, exercise or defense of legal claims (ours or those of our clients). We usually do not process personal data relating to criminal convictions and offenses; such processing, however, could be necessary in relation to the nature of the legal services provided by us. Such processing would be justified under the laws on the performing of the legal profession of the country in which we operate.

Purposes of processing personal data

The personal data are used for:

• provision of our legal services;
• fulfillment of legal obligations based on agreements or other arrangements and laws;
• managing and coordinating our relationship with our clients, potential clients and business partners;
• replying to the questions or requests of data subjects;
• requiring feedback on our offers, and other information or communication, including on the legal services we provide;
• providing with legal alerts, brochures, publications by PETERKA & PARTNERS, invitations to our events, as well as presenting special offers of our services; and;
• for other legitimate business purposes including developing our business activities, relations with our clients, potential clients, business partners and cooperating persons and entities, providing the clients with information about our services, protecting the interests of our offices, protecting the interests of our clients, fulfilling the obligations imposed on us by the applicable legislation or authorities, if it is justified under the laws on the performing of the legal profession of the country in which we operate.

If a data subject refuses to provide us with some or all of the personal data necessary for the respective purpose stated above, we may not be able to provide the respective service (e.g., to give legal advice) or to fulfill our respective statutory requirements (e.g., to enable the data subject to exercise his/her rights under the GDPR).

Legal grounds for processing personal data

We process personal data based on legitimate interests pursued by PETERKA & PARTNERS for:

• the performing of our business activity;
• the performance of an agreement to which the data subject is a party;
• in order to take steps at the request of the data subject prior to entering into an agreement; and/or
• compliance with legal obligations (e.g., fulfillment of anti-money laundering obligations, providing information to supervisory authorities, etc.).

Although PETERKA & PARTNERS usually does not process data on the basis of a data subject’s consent, this legal ground for data processing could be applied in certain cases, as well.

Source of personal data that we process

We obtain personal data directly from the data subjects or, from other persons, including our (current or former) clients, potential clients, business partners, cooperating entities and individuals, employees as well as their representatives or other persons acting on their behalf. We also obtain personal data from publicly accessible sources or public authorities when providing legal services to our clients and protecting their interests.

Storage period of the personal data

PETERKA & PARTNERS stores the data no longer than is absolutely necessary to fulfill the purpose for which it was collected. For example, personal data collected within the scope of the provision of our legal services and legal representation services are required to be kept for ten years from the final conclusion of the procedure. However, if there is an ongoing enforcement procedure based on a final and enforceable judgment, a procedure based on extraordinary legal remedies, a procedure before the Constitutional Court of the Republic of Croatia and/or the European Court of Human Rights, etc., then we keep personal data for an additional period of ten years, counting from the day when all legal means have been exhausted. If mandatory legal regulations require a longer or shorter storage period, then personal data will be deleted after the expiration of additional legal periods. When the processing is based on a data subject’s consent, the data will be stored for as long as there is valid consent for the processing.

Access to the personal data

We may share personal data with the following categories of recipients, i.e. other data controllers or data processors:

• public authorities, e.g., courts and other judicial bodies, administrative authorities, agencies, inspection authorities, etc. (Based on the applicable legislation or requests of public authorities);
• our data processors who process personal data as instructed by and on behalf of PETERKA&PARTNERS in its capacity as the data controller, such as bookkeeping services providers, providers of IT, etc.;
• our business partners who process personal data in their capacity as data controllers within the scope of services provided to us by them or services which we provide to them, or with whom we otherwise do business, such as banks, law firms, auditors, tax consultants, etc.;
• affiliated entities of PETERKA & PARTNERS, their management, employees and contractual partners¹⁾ which need them for fulfilling legal obligations, providing their services and/or performing their business activities. 

Some of the above-listed recipients of personal data may be located in “third-countries”, i.e. countries outside the European Economic Area, which are not considered to be countries ensuring adequate level of personal data protection. In such cases, the transfer shall be subject to appropriate safeguards (e.g., standard contractual clauses). 

Data subjects rights

By contacting PETERKA & PARTNERS via e-mail at personalprivacy@peterkapartners.com, data subjects may exercise the following rights provided by the GDPR, i.e.:

• request access to their personal data, which means the data subjects are entitled to ask information about whether we process their personal data and receive copies of the set of personal data. However, there are certain exemptions, meaning that data subjects may not always receive all of the information we process;
• request rectification of their personal data if the data subjects consider the personal data to be inaccurate or incomplete;
• request erasure of their personal data from our database in certain circumstances (e.g., when the personal data are no longer necessary for the stated purposes, the personal data have been unlawfully processed, etc.). We cannot erase personal data which we are legally obliged to keep;
• cancel (withdraw) their consent to the processing of the personal data. This will not affect the lawfulness of processing based on consent before its withdrawal;
• request a restriction on the processing of their personal data, which means the data subjects can limit the way we use their personal data if the personal data subject is concerned about the accuracy of the personal data or how the personal data are being used. We can still use restricted data in certain circumstances (e.g., personal data needed for legal claims or to protect another data subject’s rights);
• request a transfer of their personal data to another controller, when the personal data have been provided by the data subject and the personal data are held electronically;
• object to the processing of their personal data, in which case we will cease using the personal data for the particular purpose unless we have overriding legitimate grounds to do so. The data subjects are always entitled to object to the processing of their personal data for direct marketing purposes.

If we, upon the request of a data subject, erase his/her personal data from our database, we will keep only the information that may be necessary for protecting our legitimate interests as defined above or for public authorities.

If we required to transfer data to another controller, rectify data or provide access to personal data, we may first require further information in order to verify the identity of the data subject.

We keep the data and information provided confidential, in particular in accordance with the laws governing the legal profession and contractual arrangements. We do not trade the data, nor we do make it commercially available to any other third party.

We have implemented organizational, administrative, technical and physical measures to protect data from being disclosed to third parties, such as using usernames and passwords to protect personal data stored in an electronic form and preventing unauthorized access to data carriers by depositing data in locked cabinets which may only be accessed by authorized persons.

If a data subject is of the opinion that his/her rights related to the protection of his/her personal data were breached, he/she may submit a complaint to the supervisory authority for the protection of personal data. A list of the data protection authorities competent within the EU is available through the following link. Data subjects may also opt for the judicial route and enforce their data protection-related rights through a lawsuit.

By contacting us at the e-mail personalprivacy@peterkapartners.com, you may ask us any questions that you wish related to our Privacy Policy. 

¹⁾ The term “contractual partners” means providers that, based on commercial arrangements with PETERKA & PARTNERS, participate in the provision of legal services to PETERKA & PARTNERS clients. The term also means providers of services in favour of PETERKA & PARTNERS in order to fulfil contractual and legal obligations (such as tax advisors, accountants, IT service providers, notaries, auditors, state or municipal authorities if required by laws, servicing organizations and all other entities from the PETERKA & PARTNERS group).