Legal Q&A · 07

IT, Software & E-commerce — questions and answers.

22 answered questions on a subject we handle every day. Find related services in the catalogue: IT, Software & E-commerce.

Answered by , Czech and Slovak attorney, admitted to the Slovak and Czech Bars (SAK 300422 · ČAK 19654).

Search questions in this area

Search covers questions, short answers and topics. To search the whole Q&A, visit the Q&A homepage.

Questions about IT, Software & E-commerce

  1. Who owns the copyright in software created for me by a supplier? An author's economic rights are non-transferable. A program commissioned directly from its author generally falls under the employee-work regime, and the customer exercises the rights unless the parties agree otherwise. Where a company supplies the software, however, the customer does not automatically obtain every entitlement: rights from its employees and subcontractors must be checked, and an appropriate licence or an assignment of the right to exercise economic rights must be agreed. The contract should also address source code, modifications and further licensing.
  2. How long does a customer have to return goods bought online? A consumer may withdraw from a distance contract with an online shop within 14 days without giving a reason. For goods, the period starts on receipt. Statutory exceptions include custom-made goods and unsealed goods protected for hygiene reasons. If the seller fails to provide proper withdrawal information, the period extends by up to 12 months.
  3. When does the AI Act apply, and who does it cover? The AI Act applies progressively: the first general provisions and prohibitions from 2 February 2025, rules for general-purpose AI models from 2 August 2025, with 2 August 2026 remaining the general application date. Regulation (EU) 2026/1744, however, postponed Chapter III, Sections 1 to 3, except Article 6(5): until 2 December 2027 for high-risk systems under Annex III and until 2 August 2028 for systems linked to regulated products under Annex I. It covers providers and businesses deploying AI; their specific duties depend on their role and the system.
  4. What duties apply when I process customers' personal data under the GDPR? You may process customer personal data only with a valid legal basis, most commonly contract performance, a legal obligation, legitimate interests or consent. Core duties include informing individuals, enabling them to exercise their rights, securing the data appropriately and notifying the supervisory authority of serious breaches without undue delay. The scope depends on what you process and why.
  5. Do I need a non-disclosure agreement, and what should it contain? Trade secrets are protected directly by law, and their violation constitutes unfair competition even without an agreement. An NDA still makes sense: it precisely defines confidentiality, duration and sanctions, making proof and enforcement considerably easier. A clear definition of confidential information, the confidentiality period and a written contractual penalty are central.
  6. Someone registered a domain using my name or brand. What can I do? Domain registration alone does not permanently defeat your earlier rights. If the domain infringes your trademark or business name, you can rely on trademark rights or unfair competition protection and seek an end to its use, compensation and potentially transfer of the domain. The approach depends on whether you have a registered mark and how the domain is actually used.
  7. What information must an online shop provide, and how is an order placed? As an information society service provider, an online shop must keep seller identification permanently accessible: business name, registered office, contact details, register information and supervisory authority. Before submission, customers must be able to check and correct errors; after receipt, the order must be confirmed electronically without delay. Further information duties apply to consumers.
  8. Can the Slovak Trade Inspection fine our online shop from screenshots alone, without an on-site inspection? Yes. Act No. 108/2024 Coll. expressly permits remote supervision, including checks of online interfaces. Inspectors take screenshots and can conduct the entire inspection without visiting your premises. They serve commencement notices and records through your slovensko.sk electronic mailbox, so you learn of the inspection only if someone monitors it. Fines concern what actually appears online, most commonly unfair terms and missing consumer information.
  9. How should we display discounts, and what is the lowest price in the previous 30 days? Every goods price reduction announcement must state the previous price, meaning the lowest price at which you sold the goods in the 30 days before the reduction (Section 7 of Act No. 108/2024 Coll.). The discount must also be calculated from that price, not the regular pre-promotion price. The Slovak Trade Inspection actively checks shops and websites, comparing price records with displayed prices. A struck-through price inconsistent with the history can lead to a fine.
  10. We sell online courses. Can our terms say course fees are non-refundable? Not in that form. A consumer buying remotely has a 14-day withdrawal right that cannot be waived in advance, so the clause is invalid and may attract a fine. The law offers digital content sellers a lawful route: the right ends when supply begins if the customer expressly consented, acknowledged being informed of the loss of that right and received confirmation. This is addressed through checkout, rather than a sentence in the terms.
  11. Do we have to verify reviews on our online shop? You do not have to verify reviews: the duty is to provide information. If you display reviews, explain whether and how you ensure they come from real customers. If you do not verify them, say so. Truthfulness is the boundary: labelling reviews as verified without real checks, or publishing commissioned fake reviews, is an unfair commercial practice. The same principle applies in Slovakia and Czechia.
  12. How many days do we have to resolve a defect complaint, and what if we miss the deadline? For goods, the seller must repair or replace the item within a reasonable period not exceeding 30 days after the defect is reported. A longer period is permitted only for an objective reason beyond the seller's control. The same cap applies to the period stated in the defect acknowledgement and to remedying a service defect. If the deadline expires without a remedy, the buyer may seek a proportionate price reduction or withdraw from the contract. The supervisory authority may penalise handling failures regardless of whether the defect actually existed.
  13. What must we do to make shop and workplace CCTV lawful? CCTV is lawful when its legal basis is documented in advance, generally legitimate interests under Article 6(1)(f) GDPR, and everyone entering the monitored area receives the required information. A balancing test comparing your interests with the privacy intrusion must exist before cameras start operating. At work, Section 13(4) of the Labour Code additionally requires prior consultation with employee representatives on the monitoring mechanism and notification to employees.
  14. Someone has applied for a trademark similar to ours. How and by when can we oppose it? Opposition is filed with the Slovak Industrial Property Office within three months of publication of the application in its bulletin. The deadline is strict: later additions, expanded grounds and evidence are disregarded, so the filing must be complete from the outset. Monitoring competitors' applications continuously is worthwhile. After registration, the longer route of an invalidity application remains.
  15. We have a registered trademark but do not use it. Can we lose it? Yes. If a mark has not been genuinely used in Slovakia for an uninterrupted period of at least five years, the Office revokes it on a third party's application. The law presumes non-use, which the owner must rebut. The same rule applies to EU marks under Article 58(1)(a) of Regulation (EU) 2017/1001. An unused mark also weakens as an enforcement tool: in opposition proceedings, the other party can demand proof of genuine use.
  16. Is an accept-or-leave cookie banner lawful? No. Cookie consent must satisfy the GDPR and be freely given; accept or leave is not a real choice. The European Data Protection Board's consent guidelines expressly state that access to content must not depend on cookie consent. A banner therefore needs an equally prominent reject button on its first layer, and the website must work after rejection. The paid alternative, pay or consent, remains disputed.
  17. Nobody enters a name or email on our website. Do we need to address the GDPR at all? Generally yes, for three reasons. Under EU case law, a visitor's IP address is personal data if you can identify them with help from others, as is usually the case with ordinary server logs. The GDPR expressly treats pseudonymous identifiers, such as analytics cookies, as personal data: anonymity must be achieved rather than assumed. Embedded third-party scripts may create joint controllership where you jointly determine the purposes and means of specific operations. Depending on the setup, the third party may instead be a processor or an independent controller. The first question is therefore technical: what does your website load in the background?
  18. A client refuses to pay for standby because no intervention was needed. Are they right? Generally not. Under service contracts, standby fees pay for reserved capacity and readiness to respond within the agreed time, which has value even in a month without incidents. Entitlement depends on agreed and actually maintained availability rather than intervention numbers. In a dispute, the provider must prove availability, making duty schedules, availability records and responses to requests decisive.
  19. We are planning a purchase-linked consumer competition. Do we need a licence, and who pays tax on prizes? No licence is needed. A purchase-linked competition is a promotional competition expressly excluded by gambling law, provided it promotes sales, is not a separate business and requires no stake; payment for goods is not a stake. The rules are a consumer contract with corresponding requirements. For tax, the organiser withholds tax on cash prizes; winners declare non-cash prizes, while prizes within the statutory limit are exempt. Czech promotional competitions without a stake likewise require no licence.
  20. Can we send newsletters to existing customers without their express consent? Yes, for existing customers, subject to the statutory exception. The Electronic Communications Act requires prior demonstrable consent for email marketing. Consent is unnecessary when promoting your own similar goods or services to people whose address you obtained during a sale, provided they can refuse easily and free of charge both when you collect it and in every message. Bought or borrowed databases do not qualify. You also need a GDPR legal basis, usually legitimate interests, with a right to object at any time.
  21. Must an influencer label our post as advertising, and who is liable if they do not? Yes. A paid or otherwise rewarded post is advertising and a trader's commercial practice. If its promotional nature is unclear, the Consumer Protection Act treats it as an always-prohibited unfair commercial practice. The trader whose product is promoted bears primary responsibility, but the law expressly also covers anyone acting in its name or on its behalf, including the influencer. Labels must be understandable and visible without expanding the post. The contract should expressly regulate labelling, content approval and sanctions.
  22. What must appear on a company website even if we do not sell through it? Generally, these duties apply. A company website is an information society service even without sales if it promotes the business. The Electronic Commerce Act requires the business name and registered office, email and phone, register and entry number, tax identification number if VAT-registered, and the supervisory authority's name and address. The Commercial Code adds the company identification number and legal form. Details must be easily and permanently accessible, not supplied only on request. GDPR transparency and cookie rules also apply.

Cannot find your question? Ask us — we will reply by email. Answers in this Q&A are general information and do not constitute legal services.

Other Q&A topics

Need help in this area?

Tell us about your situation. We will reply within 24 hours.

A Q&A answer explains the rule; a consultation addresses your situation. For each topic, we can explain what needs to be done and by when.

Book an initial consultation Ask your own question
Contact a lawyer