Data Protection Notice (GDPR)

This document explains how Lexomat processes personal data of advocates within the profile surface — who is the controller, what data we process and on what basis, how long we retain it, and what your rights are.

Data controller

FinAI s. r. o.
The controller of your personal data is FinAI s. r. o., Company ID 56085010, with its registered office at Tiešňavská ulica 52/3, 038 54 Krpeľany, Slovak Republic.

What data we process

Within the advocate profile and use of the portal we process the following categories of data:

• Registration and contact details (name, email, authentication tokens).
• Search queries and session history stored under your account.
• Uploaded documents and their analyses (only if you submit them voluntarily).
• Billing data — payment cards are processed exclusively by Stripe under PCI-DSS.

Legal basis

Our processing relies on the following GDPR legal bases:

• Consent (Art. 6(1)(a)) — analytics cookies, newsletter.
• Contract performance (Art. 6(1)(b)) — provision of portal services, billing.
• Legitimate interest (Art. 6(1)(f)) — security, internal anonymised statistics, professional status verification, and contacting advocates listed in the public SAK register (details below).

Retention period

Accounting and payment records are kept for 10 years (Slovak tax and accounting regulations). Profile data is kept for the duration of the active account and for 30 days after cancellation. Data published from open sources is deleted within 30 days of an erasure request.

Contacting advocates listed in the public SAK register

This section applies to advocates we have contacted, or whose profile we created from the public register — that is, cases where we did not obtain the personal data from you directly. The information below is provided under Art. 14 GDPR.

Where the data comes from

From the publicly available register of advocates maintained and published by the Slovak Bar Association (sak.sk) under Act No. 586/2003 Coll. on advocacy and the SAK professional regulations. It is a publicly accessible source; we did not obtain the data from you. We use no other source for this purpose.

What data we process

Name and surname, advocate registration number, form of practice, office address and professional email — always only to the extent the register actually publishes them. We use a contact email only where it is published against your entry in the register.

For what purpose and on what legal basis

To pass on enquiries from clients seeking legal help, and to inform you about the Lexomat service. The legal basis is legitimate interest under Art. 6(1)(f) GDPR; for contact by email we additionally rely on § 116(15) of Act No. 452/2021 Coll. on electronic communications, which does not require prior consent for direct marketing addressed to a business’s published contact details.

Who we disclose the data to

To the email infrastructure provider that delivers messages for us as a processor. We do not sell your data or pass it to third parties for their own marketing.

How long we keep it

For as long as your contact remains published in the public register. Once the register stops listing you, the next synchronization marks you as removed and we stop contacting you; your contact details (email, phone, address) are then erased within 30 days. We retain a record of your objection so that we can demonstrate we are honouring it.

Your rights under GDPR

With respect to our processing of your personal data, you have the following rights:

1. Right of access — Obtain confirmation of whether we process data about you and a copy of that data.
2. Right to rectification — Request correction of inaccurate or incomplete data.
3. Right to erasure — Request deletion of data where there is no longer a legal basis for processing.
4. Right to restriction — Request temporary restriction of processing in legally defined cases.
5. Right to data portability — Receive your data in a structured, machine-readable format.
6. Right to object — Object to processing based on legitimate interest, including direct marketing.

How to exercise your rights

You can exercise your rights by emailing our data protection contact. We will respond within 30 days of receiving your request.

[email protected]

Right to lodge a complaint

If you believe our processing of your data is in breach of GDPR, you have the right to lodge a complaint with the supervisory authority: