Welcome to the Mathison legal website.
We are a law firm specialising in technology law. We act as our clients' strategic legal partner: an in-house lawyer backed by a whole team, with the flexibility of an external provider.
We process personal data when providing legal services. This notice explains how and why.
If you have any questions about the processing of your personal data, or would like advice from our data protection and cybersecurity specialists, please contact us at any time.
1. Who is this notice for?
In providing legal services, we primarily process personal data relating to (i) our clients and (ii) people representing our clients. We also process personal data relating to (iii) our clients' contractual partners and (iv) opposing parties in disputes involving our clients, as well as people representing those parties.
We also process personal data relating to our business partners, particularly service providers, and the people who represent them.
If you attend one of our educational or promotional events, such as the Legal&Tech Forum conference or our regular Business Breakfast events, we also collect and process your personal data.
2. Who processes your personal data?
The controller, meaning the entity processing personal data in its own name, is our law firm:
MATHISON legal s. r. o.
EINPARK Offices, Einsteinova 33
851 01 Bratislava, Petržalka
Company registration number (IČO): 46 079 882
Registered in the Commercial Register of Bratislava III Municipal Court, Section Sro, File No. 71909/B
(referred to as “we”, “us” or the “Controller”)
Questions about personal data? Contact us at any time at office@mathison.sk, through our contact form or in writing at our registered office.
3. Why do we process personal data, and what data do we process?
The purpose of processing is the reason why we, as controller, process personal data. We only do so to the extent necessary, primarily for the following purposes:
3.1 Providing legal services
We primarily process personal data to provide legal services to our clients, both companies and individuals. This mainly includes data about people representing our clients, particularly members of management and supervisory bodies and employees authorised to communicate with us, as well as clients who are individuals.
Without processing this personal data, we cannot fulfil our statutory obligations as a law firm or our contractual obligations to our clients. Providing your personal data for this purpose is necessary to enter into and perform a contract with you as our client. If you represent a client, providing your personal data is neither a statutory nor a contractual requirement, but follows from our legitimate interest in entering into and performing contracts with our clients.
Legal basis: (i) for individual clients, taking steps at the data subject's request before entering into a contract and performing contractual obligations under Article 6(1)(b) GDPR; (ii) for clients that are legal entities, processing their representatives' personal data based on our legitimate interest in fulfilling our contractual obligations to that client under Article 6(1)(f) GDPR; and compliance with lawyers' statutory obligations when providing legal services under Article 6(1)(c) GDPR.
| Under Article 21 GDPR, you have the right to object, on grounds relating to your particular situation, to processing based on the Controller's legitimate interests. You can exercise this right by contacting us using our published contact details. For further information, see Section 8 of this notice (your rights). |
Processing period: during negotiations to establish the relevant contractual relationship and throughout that relationship; where processing fulfils lawyers' statutory obligations, for the period prescribed by or under the law.
Note: Where we obtain your personal data from our client to provide legal services, we are not required to provide you with the information under Article 14 GDPR about how we process it, because we are bound by professional confidentiality.
3.2 Other business relationships
In our activities, we use various suppliers and enter into business and other contractual arrangements, such as leases, software licences and cloud service agreements. In these cases, we process personal data relating to our contractual partner where they are an individual, or to the people representing a contractual partner that is a legal entity.
We also use appropriate communication channels to communicate with our contractual partners in connection with those relationships.
Legal basis: (i) for contractual partners who are individuals, taking steps at the data subject's request before entering into a contract and performing our contractual obligations under Article 6(1)(b) GDPR; (ii) for contractual partners that are legal entities, our legitimate interest in performing the contract with that partner under Article 6(1)(f) GDPR is the basis for processing their representatives' personal data.
| Under Article 21 GDPR, you have the right to object, on grounds relating to your particular situation, to processing based on the Controller's legitimate interests. You can exercise this right by contacting us using our published contact details. For further information, see Section 8 of this notice (your rights). |
Processing period: during negotiations to establish the contractual relationship and throughout the subsequent relationship with our contractual partner.
Providing your personal data for this purpose is necessary to enter into and perform a contract with you as our business or other contractual partner. If you represent such a partner, providing your data is neither a statutory nor a contractual requirement, but follows from our legitimate interest in entering into and performing contracts.
3.3 Online contact form and other pre-contractual communications
Our website provides an online contact form for your convenience. If you have questions about our services or your situation, please use it and we will get back to you. You can also email us directly or call our office.
Legal basis: taking steps at your request before entering into a contract with a client or other contractual partner (including responding to enquiries about a potential engagement, the terms of our services or requests for legal advice), and related communications under Article 6(1)(b) GDPR. For representatives of prospective clients or other contractual partners, the legal basis is our legitimate interest in entering into the relevant contractual relationships under Article 6(1)(f) GDPR.
| Under Article 21 GDPR, you have the right to object, on grounds relating to your particular situation, to processing based on the Controller's legitimate interests. You can exercise this right by contacting us using our published contact details. For further information, see Section 8 of this notice (your rights). |
Processing period: while handling a prospective client's enquiry about legal services or a prospective business partner's enquiry about a business or other contractual relationship, and, where no contract is concluded, for no more than six months after the enquiry is resolved in case the prospective client wishes to resume communication.
Providing your personal data for this purpose is necessary to negotiate, enter into and subsequently perform our contract.
3.4 Newsletter
Would you like to receive technology law news and updates by email?
Subscribe to our newsletter to keep up with the expanding regulatory landscape. You can subscribe on our website or through an option included in another email from us, for example when we send a conference presentation, lecture materials or an event satisfaction survey.
If you are our client or attend an event we organise or co-organise, you receive our newsletter automatically unless you opt out at the start of our relationship, when entering into the contract, or at any later time.
Legal basis: your consent to receiving the newsletter by email under Article 6(1)(a) GDPR; or our legitimate interest under Article 6(1)(f) GDPR, in conjunction with Section 116(15) of Act No. 452/2021 Coll. on Electronic Communications, in maintaining relationships and communication with our clients, including sharing technology law updates, unless you opt out initially or unsubscribe later.
| Under Article 21 GDPR, you have the right to object, on grounds relating to your particular situation, to processing based on the Controller's legitimate interests. You can exercise this right by clicking the unsubscribe link in any newsletter email or by contacting us. We will unsubscribe you immediately. For further information, see Section 8 of this notice (your rights). |
Processing period: for as long as your consent remains valid, until you withdraw it. Where we rely on a legitimate interest, we process data for as long as that interest continues. We review it regularly and stop processing when it no longer applies or when you unsubscribe.
Providing personal data for a consent-based newsletter subscription is voluntary. Refusing or withdrawing consent cannot and will not have any adverse consequences for you. Where we rely on a legitimate interest, processing is neither a statutory nor a contractual requirement, but is necessary to pursue the legitimate interest described above.
3.5 Compliance with legal obligations
In addition to the duties arising from legislation governing legal services, we must fulfil other statutory obligations as a business. These arise primarily from the Commercial Code and rules on accounting, tax administration, mandatory document retention, anti-money laundering, data protection, including handling data subject requests, and numerous other laws.
Legal basis: compliance with obligations arising from applicable binding legislation, or imposed under it, under Article 6(1)(c) GDPR.
Processing period: for the period prescribed by or under the relevant legislation.
Processing personal data for this purpose is a legal requirement. Without it, we would be unable to fulfil our statutory obligations.
3.6 Establishing, exercising and defending rights and claims
We make every effort to ensure our clients and other contractual partners are satisfied with our work together. Occasionally, misunderstandings or disputes may arise. We seek to resolve them amicably to both parties' satisfaction.
In such cases, we may need to demonstrate compliance with our obligations or exercise or defend our rights and claims against clients or service providers. We may also need to prepare evidence of legal compliance for public authorities, the Bar Association, or out-of-court and conciliation proceedings.
Legal basis: our legitimate interest in exercising or defending rights and claims under Article 6(1)(f) GDPR.
| Under Article 21 GDPR, you have the right to object, on grounds relating to your particular situation, to processing based on the Controller's legitimate interests. You can exercise this right by contacting us using our published contact details. For further information, see Section 8 of this notice (your rights). |
Processing period: for the applicable statutory limitation or forfeiture period, or for as long as we may be required to demonstrate compliance with legal obligations or be subject to proceedings and a possible penalty, for example for five years after resolving a data subject request.
Processing your personal data for this purpose is neither a statutory nor a contractual requirement, but is necessary to pursue our legitimate interest described above.
3.7 Organising educational conferences and other events, and satisfaction surveys
Our law firm's ambition is to provide high-quality legal services and to educate clients and the wider public on technology law and business in this field, sharing our experience and expertise.
To this end, we organise or co-organise numerous educational and other events. To register you and enable you to attend, we process the identification and contact details necessary for your participation.
After an event, we may use your contact details to send you the presentation and other supporting or supplementary materials that may interest you as an attendee.
Participant feedback is an essential part of organising our educational events. We may therefore email you after an event to request feedback on its content and overall value through a satisfaction survey. Completing the survey is voluntary. Your feedback helps us improve future events so they offer an increasingly valuable experience, both professionally and more broadly.
Legal basis:
a) Registration, attendance and delivery of supporting materials: entering into and performing the contract for the data subject's participation in an educational event under Article 6(1)(b) GDPR. Where a company, particularly the attendee's employer, registers and concludes the participation contract on their behalf, we rely on our legitimate interest in fulfilling our contractual obligations to that company under Article 6(1)(f) GDPR.
b) Satisfaction surveys: our legitimate interest under Article 6(1)(f) GDPR in conducting market research into attendees' satisfaction with the organisation, content and outcomes of events we organise or co-organise, or with our presentation at another organiser's event, and in using survey responses to improve future events.
| Under Article 21 GDPR, you have the right to object, on grounds relating to your particular situation, to processing based on the Controller's legitimate interests. You can exercise this right by contacting us using our published contact details. For further information, see Section 8 of this notice (your rights). |
Processing period: while performing the contract or for as long as our legitimate interest continues. We monitor that interest carefully and regularly and stop processing when it no longer applies or when you object to processing based on it.
If the participation contract is concluded directly with you as the attendee, processing your personal data is necessary to enter into and perform that contract. If the contract is with the company you represent, providing and processing your personal data is neither a statutory nor a contractual requirement, but follows from our legitimate interest in fulfilling our contractual obligation to that company to enable your registration and attendance.
Sending satisfaction surveys is not necessary to fulfil contractual or statutory obligations, but is necessary to pursue our legitimate interest in assessing satisfaction with our events and improving them.
3.8 Promoting our activities
Like any business, our law firm wants potential clients, business partners and the wider public to know about our activities and services. We therefore maintain a presence on selected social networks. If you comment on posts on our profiles, we process the personal data you share there, primarily to communicate with you.
Legal basis: our legitimate interest in promoting our activities and building relationships with the public and prospective clients under Article 6(1)(f) GDPR.
| Under Article 21 GDPR, you have the right to object, on grounds relating to your particular situation, to processing based on the Controller's legitimate interests. You can exercise this right by contacting us using our published contact details. For further information, see Section 8 of this notice (your rights). |
Processing period: for as long as our legitimate interest continues, which we review regularly, up to five years from the end of the calendar year in which your data was processed, unless you or the social network operator delete the comments or other interactions on our profile earlier.
Processing your personal data for this purpose is neither a statutory nor a contractual requirement, but is necessary to pursue our legitimate interest.
3.9 Cookies
When your device interacts with our website, technical or strictly necessary cookies are stored to enable the website and its features to function properly. We may store these cookies automatically on your device or browser without obtaining consent under Section 109(8) of Act No. 452/2021 Coll. on Electronic Communications.
Our website can also create and store other types of cookies, for which we require your consent. Consent is voluntary, and declining it has no adverse effect on your legal position or rights. You can withdraw consent at any time by changing your cookie preferences on our website. Withdrawal does not affect the lawfulness of processing carried out before it.
Legal basis: consent to cookies under Article 6(1)(a) GDPR, given through the cookie banner on our website.
Processing period: (i) strictly necessary cookies are retained for 24 hours after being stored on the visitor's device; (ii) functional cookies are retained for 13 months after being stored on the visitor's device; (iii) marketing (advertising) cookies are retained for 13 months after being stored on the visitor's device.
For more information about cookie types and their purposes, see our cookies page.
4. Where do we obtain your personal data?
We obtain personal data directly from you as the data subject, meaning the person whose data we process, or from the people or organisations you represent when communicating or working with us. These may include your employer or our clients if you are their business partner or opposing party in a dispute. We may obtain some personal data from public sources, such as the Commercial Register, Trade Register or a data subject's LinkedIn profile, or by other appropriate lawful means, including public authority records or gathering evidence for a client.
If you attend an event at which we speak, we may obtain your identification and contact details from the organiser to send you supporting or supplementary materials for our presentation and related electronic communications.
Some data is generated by your device when it interacts with our website; other data is generated by the website itself, such as cookies.
Depending on what is required, particularly the nature of the legal services, we may process any category of personal data, including ordinary personal data, special categories of data, and data relating to criminal convictions and administrative offences, where necessary for the proper provision of legal services. For other purposes, we primarily process ordinary personal data.
5. Who may we share personal data with?
For the purposes described above, we share personal data to the extent necessary, primarily with our processors: contractual partners who process it on our behalf and solely on our instructions. These processors include providers of IT solutions, cloud storage and website administration, marketing and promotional services, analytics software, external accounting services and similar providers.
Personal data may also be shared with external partners acting as third parties who provide services to us and process the necessary data in their own name and under their own responsibility. Examples include couriers and other delivery providers, collaborating lawyers, auditors, tax advisers, banks, insurers and the Slovak Bar Association, for example in disciplinary proceedings.
Personal data may also be provided to state authorities, other institutions or public bodies where required by law or necessary to exercise or defend rights and claims.
When selecting these entities, particularly our processors, we ensure that they provide appropriate safeguards for secure and lawful personal data processing.
6. How long do we process your personal data?
We process personal data only for as long as necessary to fulfil the specified purpose.
This period varies according to the purpose. We regularly reassess each purpose and, if processing is no longer necessary and is not required by law, erase the data before the originally specified period expires.
The specific processing periods are listed in Section 3 alongside the relevant legal bases.
7. What else should you know?
To comply with the data minimisation principle, we request or process only the personal data necessary for the relevant purpose. As controller, we have implemented appropriate personnel, organisational and technical measures to protect your data.
The personal data we process is stored on servers and other technical equipment within the European Union, protected by advanced safeguards against unauthorised access and other security risks.
We do not use personal data processed for the above purposes for automated decision-making or profiling, nor do we transfer it to countries outside the European Union/European Economic Area or to international organisations. Exceptionally, a service provider may make such a transfer, for example the operator of a social network where you have an account used to interact with our profile; however, we do not accept responsibility for that transfer.
8. What are your rights under the GDPR?
As a data subject, meaning a person whose personal data is processed, you have the following rights under the GDPR:
A) Right to withdraw consent at any time
You may withdraw your consent to personal data processing at any time. Withdrawal does not affect the lawfulness of processing based on consent before it was withdrawn.
B) Right of access (Article 15 GDPR)
You have the right to obtain confirmation from us as controller as to whether we process your personal data, access to that data and the further information specified in Article 15 GDPR.
C) Right to rectification (Article 16 GDPR)
You have the right to have inaccurate or incomplete personal data relating to you corrected or completed without undue delay.
D) Right to data portability (Article 20 GDPR)
You have the right to receive personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, including the right to transmit it to another controller where technically feasible, if (a) processing is based on consent or a contract and (b) it is carried out by automated means. This right must not adversely affect the rights and freedoms of others.
E) Right to erasure (Article 17 GDPR)
You may request erasure of personal data concerning you without undue delay where a ground under the GDPR applies, in particular where (a) the data is no longer necessary for the purposes for which it was collected or otherwise processed; (c) you object to processing based on the controller's legitimate interest and there are no overriding legitimate grounds; (d) the data has been processed unlawfully; or (e) erasure is required to comply with the law, a specific regulation or an international treaty binding on the Slovak Republic, unless a GDPR exception applies.
The Controller will erase personal data on request without undue delay after determining that the data subject's request is justified.
F) Right to restriction of processing (Article 18 GDPR)
You have the right to require the controller to restrict processing of your personal data in one or more of the circumstances specified by the GDPR.
If processing has been restricted, we will inform you before the restriction is lifted.
G) Right to object to processing based on legitimate interests (Article 21 GDPR)
You may object at any time on grounds relating to your particular situation. The controller must then stop processing on the basis of legitimate interests unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or grounds for establishing, exercising or defending legal claims.
If you object to processing for direct marketing, including sending newsletters, we will stop that processing immediately.
H) Right to lodge a complaint or request proceedings
If you believe your rights have been infringed in connection with the processing of your personal data, you may lodge a complaint with:
The Office for Personal Data Protection of the Slovak Republic, Park One Building, Námestie 1. mája 18, 811 06 Bratislava, Slovak Republic.
Further information is available on the Authority's website.
You may also lodge a complaint with the data protection authority in the EU Member State of your habitual residence, place of work or the place of the alleged infringement of your rights or the GDPR.
9. How can you exercise your rights?
If you have any questions about personal data processing or wish to exercise your GDPR rights, contact us at any time:
a) By email: office@mathison.sk
b) By post to our law firm's registered office address stated above.
The Controller reserves the right to update this notice when necessary.
The current version will always be available on our website, www.mathisonlegal.sk, and at our law firm's offices.
Last updated: 8 August 2025