GDPR Policy

• Contract (Art. 6(1)(b)) — to provide the investigative services you engage us to perform and to manage the client relationship.
• Legal obligation (Art. 6(1)(c)) — to comply with Czech and EU laws, including tax, accounting, AML and licensing requirements.
• Legitimate interests (Art. 6(1)(f)) — to conduct lawful investigations on behalf of clients with a demonstrable legitimate interest (e.g. legal proceedings, fraud prevention, protection of rights), subject to a documented balancing test.
• Consent (Art. 6(1)(a)) — for optional communications such as enquiry follow-ups submitted through our contact form.

We process identification and contact data, correspondence, billing data, and — when strictly necessary for an instructed investigation — observational data relating to subjects of inquiry. Processing is limited to what is necessary, proportionate, and lawful for the agreed purpose.

Personal data may be shared with our vetted processors (IT, hosting, accounting, legal counsel) under written data-processing agreements, and with competent authorities or courts where required by law. We do not transfer personal data outside the EEA unless an adequacy decision or appropriate safeguards under Chapter V of the GDPR apply.

Personal data is retained only for as long as necessary for the purpose for which it was collected and to meet legal retention obligations (typically up to 10 years for accounting records and the duration of any applicable limitation period for engagement files).

• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object (Art. 21)
• Right to withdraw consent at any time, without affecting prior lawful processing

To exercise any of your rights, write to contact@praguedetectives.cz. We will respond within one month. You also have the right to lodge a complaint with the Czech supervisory authority, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), at www.uoou.cz.

We apply technical and organisational measures appropriate to the risk, including access controls, encryption in transit, restricted storage, staff confidentiality undertakings, and incident-response procedures aligned with Articles 32–34 of the GDPR.

This policy will be reviewed at least annually and whenever EU or Czech data-protection law materially changes.