TARPAN Legal s.r.o., law firm

Effective from: 1 July 2026

1. Introductory Provisions and Copyright

The owner and operator of the website www.tarpanlegal.com is TARPAN Legal s.r.o., law firm, with its registered office at Václavské náměstí 773/4, Nové Město, 110 00 Prague 1, Company ID No. 056 56 729, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File No. 268473 (the “Company”). The Company owns all copyright in the content published by the Company on www.tarpanlegal.com (the “Website”).

The Website is also accessible as part of the TARPAN group presentation at www.tarpangroup.net. The Company is a regulated entity—a law firm registered in the register of lawyers maintained by the Czech Bar Association—and is therefore subject to specific statutory obligations in addition to the general legislation governing personal data protection.

2. Links to Other Websites

The Website contains links to websites over which the Company has no control. This policy therefore does not apply to links that redirect users from the Website to information and services provided by external entities. The Company accepts no responsibility for the statements or practices of the operators of such websites.

3. Information on the Processing of Personal Data

What is personal data?

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (the General Data Protection Regulation, the “Regulation”), personal data means any information relating to an identified or identifiable natural person (the “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data or online identifier, or to one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity.

Depending on the circumstances, personal data may include, among other things, an individual’s first name and surname, address, telephone number or email address. Information such as the number of users of a website does not constitute personal data.

Compliance with personal data protection legislation

In its capacity as a personal data controller, the Company processes certain personal data relating to its clients, Website users, job applicants and employees in the course of its activities. As the controller, the Company determines the purposes and means of processing personal data and establishes measures relating to such processing, particularly its security. The Company processes personal data in strict compliance with the applicable legislation, in particular the Regulation.

Data subjects and purposes of processing personal data

Website users:

On the basis of its legitimate interests, the Company processes the personal and other data of users described below.

Personal data processed when visiting the Website: When a user visits the Website, the Company stores a truncated version of the IP address of the user’s computer and information about the website from which the user accessed the Website. During the visit, information is stored concerning the date and time of access, the names of files accessed, the URL, HTTP response code, access status and the volume of data transferred during the connection. The Company uses this data exclusively for statistical purposes. The Company uses Google Analytics and Google Search Console, both provided by Google Ireland Limited, with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland, and Microsoft Clarity, provided by Microsoft Corporation, with its registered office at One Microsoft Way, Redmond, WA 98052, USA. These tools enable the Company, as the website owner, to obtain statistical data about users of its Website and to analyse how they interact with it.

Cookies: The Company uses cookies on the Website. Cookies are data files that enable each user’s browser to communicate with the Company’s server, thereby establishing an individual connection between the user’s computer and the Company’s computer. Cookies generally facilitate faster and more efficient browsing and adapt the display of content to the user’s individual interests and specific needs. Cookies are used to compile anonymous, aggregated statistics that help the Company understand how users use the Website and thereby optimise its structure and content, as well as to provide certain Website functions. Information obtained through cookies is collected solely for the purpose of providing and performing specific user functions. The Company uses both “session” cookies, which are temporary and remain stored on the user’s device only until the user leaves the Website or closes the web browser, after which they are deleted, and “persistent” cookies, which remain on the device for a specified period. Essential (technical) cookies required for the Website to function correctly and for the transmission of communications are used on the basis of the Company’s legitimate interests. The Company uses analytics, statistical and marketing cookies only with the user’s prior, freely given consent. As a general rule, web-browsing applications are configured by default to allow cookies to be stored on the user’s device. This setting may be changed either by blocking cookies completely in the web browser settings or by restricting them in part, in which case the user is notified whenever cookies are stored on the device. Further information on the available options and the management of cookies can be found in the application’s settings (web browser). If cookies are blocked completely, however, the Website’s content may not be displayed optimally, particularly when using online services. On the user’s first visit to the Website, a cookie banner informs the user that cookies are used and requests consent to their use and to the processing of personal data through the Website. Detailed information about the cookies used is provided in the separate Cookie Policy available at https://www.cookiehub.com/about-cookies.

Server log files: The Company automatically collects and stores information in server log files transmitted to the Company by the user’s web browser. This data includes the type and version of the web browser, operating system, referring URL, IP address, hostname of the accessing computer, time of the server request and similar information. The Company reserves the right to review this data retrospectively if it suspects unlawful conduct by a user.

SSL encryption: For security reasons and to protect sensitive information transmitted through the Website, the Website uses SSL encryption. An encrypted connection can be identified by the change in the Website address bar from “http://” to “https://” and by the closed padlock symbol. When SSL encryption is used, data provided to the Company cannot be read by third parties.

Clients and business partners: The Company processes the personal data of clients and their representatives, and where applicable business partners and their representatives, to the extent necessary to negotiate and perform contracts entered into with such persons for the purpose of providing its services or procuring products and services. The Company processes any additional personal data of clients beyond that required for the performance of a contract only on the basis of valid consent. The Company obtains the personal data it processes directly from the relevant data subjects or, where applicable, from public sources. In connection with providing and receiving services, the Company processes personal data to the extent arising from the relevant contract and applicable legislation, particularly the following: first name and surname, date of birth, residential address, telephone number and email address. The Company processes such personal data in accordance with the contract concluded.

Processing of personal data in connection with AML obligations: As a law firm, the Company is an obliged entity under Act No. 253/2008 Coll., on Certain Measures against the Legalisation of Proceeds from Crime and Terrorist Financing, as amended (the “AML Act”). Under this Act, the Company is required to identify and conduct due diligence on clients and, for this purpose, to collect and retain clients’ personal data, including copies of identity documents. Personal data processed for AML purposes is retained for ten years following the completion of a transaction outside a business relationship or the termination of a business relationship. The supervisory authorities are the Financial Analytical Office and the Czech Bar Association. The contact person responsible for compliance with obligations under the AML Act is Mgr. Luděk Skoupil (email: skoupil@tarpanlegal.com). Further details are set out in the separate Notice on the Processing of Personal Data in Connection with AML (AMLZ), available at www.tarpanlegal.com.

Job applicants: The Company processes the personal data of job applicants for the purpose of organising and evaluating recruitment procedures. The Company obtains this personal data directly from the relevant data subjects. The legal basis for processing is the recruitment procedure (or, more specifically, taking steps prior to entering into an employment contract at the applicant’s request following an application to participate in the recruitment procedure). Beyond the specific recruitment procedure, an applicant’s personal data is processed only with their consent. Personal data of unsuccessful applicants is retained only for the duration of the recruitment procedure unless the applicant has consented to its longer retention.

Employees: The Company processes employees’ personal data to the extent necessary to comply with its legal obligations and administer payroll and personnel matters, such as the obligation to deduct or remit taxes and to maintain records for health insurance and social security purposes. Employees are required to provide this data to the Company; failure to do so would result in a breach of legislation by the employee and/or the Company and could lead to sanctions being imposed by the competent public authorities. Beyond compliance with its legal obligations, the Company processes employees’ personal data for the purposes of pursuing its legitimate interests or performing a contract between the Company and the employee, particularly to maintain the Company’s employee database, prepare promotional materials, provide information about corporate events, protect the Company’s property and manage access by authorised persons to the Company’s premises. In other cases, the Company processes personal data only with employees’ consent. Employees may decide freely whether to grant such consent and may withdraw it at any time. The Company will not penalise employees if they decline to give consent.

4. Recipients of Personal Data

The Company provides the personal data it processes only to partners that have implemented appropriate technical and organisational measures to protect the data and comply with their other obligations under the Regulation. The Company’s partners have access to personal data only to the extent necessary to perform their tasks. Subject to compliance with all applicable legislation and contractual obligations, the Company provides personal data to the following recipients:

• Public authorities, such as courts, administrative authorities, the Financial Analytical Office and the Czech Bar Association;
• Providers of information systems and related maintenance services;
• Providers of analytics tools (Google LLC and Microsoft Corporation), on the basis of concluded data processing agreements;
• The Company’s advisers, particularly tax and accounting advisers;
• Companies within the TARPAN Group;
• Other recipients as required, instructed or authorised by the Company’s client.

The Company does not under any circumstances provide personal data to other persons for consideration.

5. Transfers of Personal Data Abroad

On the basis of the free movement of personal data, the Company may transfer personal data to other countries within the European Union, particularly where the servers on which personal data is stored are located outside the Czech Republic. The use of Google Analytics, Google Search Console and Microsoft Clarity may involve the transfer of data to the United States. Such transfers are made on the basis of standard contractual clauses approved by the European Commission or another appropriate safeguard under Article 46 of the Regulation. The Company does not otherwise transfer personal data outside the European Union or beyond the scope of the Regulation. Transfers of personal data to other EU countries therefore do not affect the legal position of data subjects.

6. Retention of Personal Data

The Company retains personal data only for as long as necessary to fulfil the purpose for which it is processed, in accordance with the following rules:

• Personal data of clients and business partners, and where applicable personal data provided by the Company’s clients and business partners in connection with services provided or received by the Company, is retained throughout the contractual relationship with the Company and, to the extent necessary, following its termination until the expiry of the applicable limitation periods in case any claims arising from that contractual relationship are asserted;
• Personal data processed for AML purposes is retained for ten years following the completion of a transaction outside a business relationship or the termination of a business relationship;
• Personal data of Website users is retained only for the duration of their use of the Website and for the preparation of Website usage statistics;
• Personal data of unsuccessful job applicants is retained only for the duration of the relevant recruitment procedure, unless the applicant has consented to its longer retention;
• Employees’ personal data is retained throughout the employment relationship and subsequently, to the relevant extent, for the statutory retention periods or until the expiry of the applicable limitation or preclusion periods in case any claims arising from the employment relationship are asserted.

7. Withdrawal of Consent to the Processing of Personal Data

Where the Company processes personal data on the basis of a data subject’s consent, the data subject has the right to withdraw that consent at any time. This may be done by sending a notice to the address of the Company’s registered office or any of its business premises, by email or by any other appropriate means.

If consent to the processing of personal data is withdrawn, the personal data provided will be erased unless the applicable legislation permits its continued processing without the relevant person’s consent. Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

8. Other Rights of Data Subjects

Depending on the circumstances, every data subject (including clients, business partners and their representatives, Website users, job applicants and employees of the Company) may have further rights under the Regulation, particularly:

The right of access to personal data, namely the right to obtain confirmation from the Company as to whether personal data concerning the data subject is being processed and, where that is the case, access to that personal data and information concerning:

• The purposes of processing;
• The categories of personal data concerned;
• The recipients or categories of recipients to whom the personal data has been or will be disclosed;
• The envisaged period for which the personal data will be stored, or the criteria used to determine that period;
• The existence of the right to request that the Company rectify or erase personal data or restrict its processing and/or the right to object to the processing of personal data;
• The right to lodge a complaint with a supervisory authority;
• The source of the personal data, where it was not obtained from the applicant;
• The existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the applicant;
• The transfer of personal data to countries outside the European Union (third countries) or to an international organisation, and the appropriate safeguards relating to the processing of personal data provided in connection with that transfer.

The data subject also has the right to obtain a copy of the personal data being processed. This right must not adversely affect the rights and freedoms of others.

The right to rectification and completion of personal data where the data subject’s personal data is inaccurate;

The right to erasure of personal data (the “right to be forgotten”) where one of the following grounds applies:

• The personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
• Consent to the processing of personal data is withdrawn and there is no other legal ground for the processing;
• A valid objection to the processing of personal data has been raised;
• The personal data has been unlawfully processed;
• The personal data must be erased to comply with a legal obligation binding on the Company;
• The personal data was collected in connection with an offer of information society services to a child.

The right to erasure cannot be exercised where the processing of personal data remains necessary for the Company to comply with a legal obligation, such as obligations under the AML Act or legislation governing the legal profession, or for the establishment, exercise or defence of legal claims.

The right to restriction of processing in the following circumstances:

• The accuracy of the personal data is contested, for a period enabling the Company to verify its accuracy;
• The processing of personal data is unlawful, but restriction of its use is requested instead of erasure;
• The Company no longer requires the personal data for the purposes of processing, but the applicant requires it for the establishment, exercise or defence of legal claims;
• An objection has been raised to processing based on the Company’s legitimate interests, pending verification of whether the Company’s legitimate grounds override those of the person raising the objection.

The right to data portability, namely the right to receive personal data concerning the data subject in a structured, commonly used and machine-readable format and the right to transmit that data to another controller (or to request that the Company transmit the data directly to another controller), where the processing is based on consent or a contract and is carried out by automated means;

The right to object, namely the right to object to the processing of personal data for the purposes of the Company’s legitimate interests; and

The right to lodge a complaint with the Czech Office for Personal Data Protection or, where applicable, the competent supervisory authority of another Member State of the European Union.

Every data subject may exercise their rights by contacting the Company using the contact details below.

9. Alternative Dispute Resolution for Consumer Disputes

The Czech Bar Association has been authorised by the Ministry of Industry and Trade of the Czech Republic to provide alternative dispute resolution for consumer disputes arising from contracts for the provision of legal services between a lawyer and a consumer (authorisation pursuant to Act No. 634/1992 Coll., on Consumer Protection, as amended). The website of the authorised entity is www.cak.cz.

10. How to Contact Us

If you have any questions or comments, you may contact the Company at the address stated above, by telephone on +420 277 007 055 or by email at office@tarpanlegal.com.