Skip to main content

Privacy Policy

Data Controller

The data controller is JUDr. Barbara Kapounková, Attorney at Law, Breitfeldova 704/1, 186 00 Prague 8 – Karlín, email: barbara@kapounkovalegal.cz, tel.: +420 731 748 255.

Data We Process

We process only the data you provide via the contact form or by email: name, email address, phone number (if provided), subject, and message content. Via the intake assessment form we additionally process a description of your legal situation.

Purpose and Legal Basis

Your data is processed for the purpose of responding to your enquiry and any related legal communication. The legal basis is your consent (Art. 6(1)(a) GDPR). For the contact and intake forms, consent is given by ticking the checkbox before submission — consent is voluntary and may be withdrawn at any time.

Retention Periods

Contact form data is retained in our email inbox for 2 years from the last correspondence, then deleted. Intake assessment data is stored in a secure database and deleted after 90 days if no mandate is established. Client and billing records are retained for the duration of the mandate and subsequently for the period required by law for archiving legal files.

Third Parties and Sub-Processors

We do not share your personal data with third parties, except as required by law or necessary for the performance of a legal mandate. For the technical operation of the website and provision of services, we use the following processors:

  • Vercel Inc. (San Francisco, USA) — website hosting and anonymised visitor analytics (Vercel Analytics). Data transfers to the USA are based on Standard Contractual Clauses (Art. 46 GDPR).
  • Anthropic PBC (San Francisco, USA) — AI technology for preliminary case assessment via the intake form, and for the matter-status assistant in the client portal. Data transfers to the USA are based on Standard Contractual Clauses.
  • Resend Inc. (USA) — email delivery. Data transfers to the USA are based on Standard Contractual Clauses.
  • Upstash Inc. (USA) — database for storing form submissions and operational data. Data transfers to the USA are based on Standard Contractual Clauses.

Preliminary Case Assessment (AI Intake)

Through the intake assessment form, you may describe your legal situation. Your data (area of law, situation description, answers to follow-up questions) is analysed using AI technology (Anthropic Claude, USA) for the purpose of a preliminary assessment of whether your matter falls within our practice areas. The legal basis is your explicit consent (Art. 6(1)(a) GDPR). The AI does not make binding legal decisions — all outputs serve only as indicative guidance. Data is deleted after 90 days if no mandate is established.

AI Assistant in the Client Portal

Clients with client-portal access may ask an AI assistant a question about the status of their own matter. Only the matter data already shown to you in the portal is processed — matter status, deadlines and milestones, document requests, invoices, and the dates and subjects of data-box correspondence. The contents of documents and the text of your messages with your attorney are not processed. The data is processed using AI technology (Anthropic Claude, USA) on the basis of Standard Contractual Clauses. The legal basis is your explicit consent (Art. 6(1)(a) GDPR), which you give directly in the portal and may withdraw there at any time. The assistant does not provide legal advice and makes no automated decisions within the meaning of Art. 22 GDPR; a question that cannot be answered from that data is passed to your attorney. No conversation history is stored — neither your question nor the answer is retained anywhere.

Newsletter

When you subscribe to the newsletter, we process your email address for the purpose of sending legal updates. The legal basis is your consent (Art. 6(1)(a) GDPR). You may unsubscribe at any time by clicking the link in any newsletter email. Your email address is processed via Resend Inc. (USA).

Case Management and Billing

In the course of providing legal services, we process client data, matter details, time records, and billing information. The legal basis is performance of a contract (Art. 6(1)(b) GDPR) and compliance with a legal obligation (Art. 6(1)(c) GDPR).

Website Analytics and Cookies

The website uses Vercel Analytics to collect anonymised visitor statistics (page views, visit duration). Analytics is active only with your consent and uses no cookies. For a full list of cookies and consent management options, see our Cookie Policy.

Your Rights

You have the right to access, rectify, erase, restrict processing, port your data, and to object (Arts. 15–21 GDPR). You also have the right to withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise your rights, contact us at barbara@kapounkovalegal.cz with the subject "Data Subject Rights Request". We will respond within 30 days of receiving your request (Art. 12(3) GDPR).

You also have the right to lodge a complaint with the supervisory authority — the Czech Data Protection Authority (uoou.cz).