Privacy Policy

1. PURPOSE OF THE PRIVACY NOTICE

1.1. Borbély Law Firm (Borbély Ügyvédi Iroda, registered seat: 1093 Budapest, Boráros tér 3., 3rd floor, 9; registration number: 4723; e-mail: zoltan@drborbelyugyved.com, hereinafter referred to as the Data Controller or the Law Firm) aims to ensure the lawfulness of data processing with regard to the personal data processed by it. For this purpose, it intends to inform its clients and all data subjects concerned about the details of the processing of the personal data provided by them. The purpose of this Notice is to ensure that, prior to providing their personal data, Data Subjects receive adequate information on the conditions, safeguards, and duration under which Borbély Law Firm processes their personal data.

1.2. This Privacy Notice or Data Protection Notice applies exclusively to the personal data of natural person Data Subjects, as the data of legal persons and other organisations do not qualify as personal data.

  1. Relevant legislation:

Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation; hereinafter: GDPR)

Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (Infotv.)

Act LXXVIII of 2017 on Attorneys-at-Law (Üttv.)

Act LIII of 2017 on the Prevention and Combating of Money Laundering and Terrorist Financing (Pmt.)

1.4. The Data Controller does not make decisions based on automated data processing and does not carry out profiling. The Data Controller does not transfer personal data to countries outside the European Economic Area (EEA), except where such transfer is necessary due to the nature of the mandate. In such cases, data transfers are carried out subject to appropriate safeguards.

1.5. In several cases, the data processing carried out by the Data Controller is based on statutory obligations. In such cases, the Data Subject is required to provide their personal data. For example, the conclusion of an attorney-at-law mandate agreement is conditional upon the provision and retention by the attorney of certain personal data specified in the Üttv. and the Pmt. (see Section 2.1.6 below). In other cases, data provision is voluntary; however, it is always necessary for the performance of the mandate. If the Data Subject fails to provide the personal data deemed necessary by the Data Controller for the performance of the mandate, the Data Controller may be unable to perform the mandate and thus unable to provide legal services to the Data Subject.

1.6. Where data processing is based on consent, the Data Subject is entitled to withdraw their consent at any time. Such withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal of consent.

2. CHARACTERISTICS OF SPECIFIC DATA PROCESSING ACTIVITIES

2.1. DATA PROCESSING CARRIED OUT IN THE COURSE OF ATTORNEY-AT-LAW ACTIVITIES AND LEGAL ADVICE

2.1.1. DATA SUBJECTS:

Natural person clients for whom the Data Controller provides legal advice or other legal services; Other natural persons affected in connection with mandates given to the Data Controller (e.g. opposing parties in litigation or legal disputes involving the client, natural persons appearing in authority or court proceedings, witnesses);

Natural person representatives or contact persons of the Data Controller’s clients.

2.1.2. Purpose of data processing: In the course of providing attorney-at-law services, the Data Controller processes the personal data specified below and other personal data relevant to the case concerning the persons affected by the given mandate for the purpose of handling the matter, providing legal advice, performing attorney-at-law activities, countersigning instruments, legal representation before authorities and courts (depending on the nature of the case), as well as fulfilling statutory identification, record-keeping, and reporting obligations. The Data Controller also processes certain personal data for the purposes of communication during the mandate, internal case management, invoicing, and enforcement of its claims.

2.1.3. Legal basis of data processing: The legal basis varies and may include:

Performance of an attorney-at-law mandate agreement concluded between the Data Controller and the Data Subject;

Compliance with a legal obligation applicable to the Data Controller (see Section 2.1.6 below);

Legitimate interest of the Data Controller (e.g. document retention in cases not subject to statutory retention obligations; evidence of proper performance; unified case management; debt enforcement). Legitimate interests include unified case management, enforcement of attorney fees, and ensuring unhindered communication;

Legitimate interest of a third party (e.g. processing personal data of debtors for claim enforcement; data of opposing parties or witnesses in litigation). Legitimate interests include enforcement of claims and resolution of legal disputes.2.1.4. Duration of data processing: As a general rule, personal data are processed for 5 years following the completion or termination of the mandate. Special statutory cases are detailed in Section 2.1.6.

2.1.5. Recipients: Personal data are transferred to third parties only where necessary for the performance of the mandate or where required by law (e.g. reporting attorney deposits to the Budapest Bar Association, obligations under the Pmt.).

2.1.6. STATUTORY DATA PROCESSING ACTIVITIES RELATED TO ATTORNEY-AT-LAW PRACTICE, AND THE SCOPE OF DATA PROCESSED

2.1.6.1. Act LXXVIII of 2017 on Attorneys-at-Law (ÜTTV.)

2.1.6.1.1. IDENTIFICATION (KYC)

Where the attorney does not know the natural person client or has doubts as to the client’s identity, the attorney shall identify such person by examining an identity document suitable for identification, or by using the electronic identification service mandatorily provided by the Government pursuant to Act CXXX of 2016 on Electronic Administration and Trust Services (Dáptv.), or – if the attorney has the necessary technical conditions – by verification pursuant to Article 24(1)(a), (b) or (d) of Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market (eIDAS Regulation).For the purpose of verifying the consistency of the natural person’s data with the registered data and the validity of the presented documents, the attorney may electronically request the following data from the personal data and address register, the driving licence register, the travel document register, and the central immigration register:

a) personal identification data and personal identification number,

b) citizenship, stateless status, refugee status, EEA citizen status, right of permanent residence,

c) residential address,

d) facial image,

e) signature,

f) data specified in Section 18(5) of Act LXVI of 1992 on the records of personal data and addresses of citizens,

g) data specified in Section 24(1)(f) of Act XII of 1998 on travelling abroad, and the validity period of the document,

h) data specified in Section 8(1)(b) points ba)–bb) of Act LXXXIV of 1999 on road traffic records,

i) data specified in Section 76(d), Section 80(1)(b) and (c) of Act I of 2007 on the entry and residence of persons enjoying the right of free movement and residence, as well as Sections 254(1)(g), 256(1)(f), and 261(1)(b) and (c) of Act XC of 2023 on the general rules for the entry and residence of third-country nationals. Where a proxy acts on behalf of the natural person client, the attorney may omit separate identification of the client if the power of attorney containing the client’s data has been:

 countersigned by an attorney,

 drawn up by a notary public,

signed by the principal and the signature authenticated by a notary public, or

authenticated or super-authenticated by the competent Hungarian diplomatic or consular authority at the place of signature or provided with an Apostille certificate.

Where the attorney provides legal representation in proceedings aimed at registration in a public authentic register or drafts a document serving as the basis for registration in such a register, the querying of the natural person’s data from the relevant register is mandatory.

2.1.6.1.2. REGISTER OF TRANSACTIONS REQUIRING MANDATORY LEGAL REPRESENTATION

The attorney is required to maintain a register of transactions requiring mandatory legal representation. The register maintained regarding identified natural persons shall contain the following data::

personal identification data,

• residential address,

• citizenship, stateless status, refugee status, immigrant or settled status, EEA citizen status, right of permanent residence,

• type and number of the identification document used,

• identifier of the response received during data querying from the register,

• case identifiers of matters in which identification of the natural person is mandatory,

• data specified in the Act on the Prevention and Combating of Money Laundering and Terrorist Financing.

2.1.6.1.3. CONVERSION OF PAPER-BASED DOCUMENTS INTO ELECTRONIC DOCUMENT FORMAT

In certain cases specified by law, the attorney may create an electronic document on the basis of a paper-based document. In such cases, the electronic document must be retained for 10 years, and the paper-based document for 5 years, unless the parties agree on a longer retention period.

2.1.6.1.4. DATA PROCESSING RELATED TO ATTORNEY DEPOSITS

The attorney shall record data relating to deposits exceeding twice the amount of the statutory minimum wage, as well as any changes thereto, in the electronic deposit register operated by the territorial bar association.

The following data shall be recorded in the electronic deposit register:

• name and bar registration number of the deposit-holding attorney,

• case identifier of the deposit agreement,

• type of deposit,

• subject matter of the deposit,

• sub-account number, if the deposit is placed in a sub-account,

• in the case of monetary deposits, the amount and currency of the deposited funds,

• date of conclusion, amendment or termination of the deposit agreement,

• date of recording the data in the deposit register or modifying the recorded data.

The attorney shall record the data and any changes thereto within one business day of the conclusion of the deposit agreement or the occurrence of the change by submitting an electronically signed and time-stamped declaration using a qualified electronic signature. The electronic register assigns a unique identifier to the deposit.

The electronic deposit register shall retain the data for 10 years following termination of the deposit agreement.

2.1.6.1.5. CASE REGISTER AND DOCUMENT MANAGEMENT

The attorney shall maintain a register of cases handled under a mandate – for the purposes of verifiability of compliance with regulations governing attorney-at-law practice and the protection of clients’ rights in the event of termination of the authorisation to practise law.

The case register shall contain the following data:

 case identifier generated by the attorney,

 client name,

 subject matter of the case,

 date of conclusion of the mandate agreement,

 registry number of related court proceedings or reference numbers of other proceedings.

The attorney shall process the data for 5 years following termination of the mandate; in the case of document countersigning, for 10 years following countersigning; and in matters affecting registration of rights relating to real estate in a public authentic register, for 10 years following registration of the right.

Access to the register and data requests shall be limited to personnel or bodies performing bar authority supervision, and – for the protection of clients’ rights – the substitute attorney and the appointed Office Custodian.

The attorney shall retain countersigned documents and other documents generated in matters involving countersigning for 10 years from the date of countersigning, unless legislation prescribes a longer period or the parties agree otherwise.

In the event of termination or cessation of bar membership or deletion from the bar register, the attorney shall ensure that non-disposable documents are handed over to the client or to another attorney authorised to practise law in the given matter, and shall ensure retention of the registers pursuant to the Attorneys-at-Law Act.

2.1.6.2. ACT LIII OF 2017 ON THE PREVENTION AND COMBATING OF MONEY LAUNDERING AND TERRORIST FINANCING (Pmt.)

2.1.6.2.1. CUSTOMER DUE DILIGENCE

Pursuant to the Pmt., attorneys-at-law are required to perform customer due diligence in the following cases:

 where they perform the handling of deposits of money or valuables;

 where, pursuant to the Üttv., they perform attorney-at-law activities in connection with the preparation and execution of the following transactions:

– transfer of ownership of a participation (interest) in a business association or other economic organisation;

– transfer of ownership of real estate;

– establishment, operation or termination of a business association or other economic organisation;

– entering into a fiduciary asset management agreement or making a unilateral legal declaration aimed at establishing fiduciary asset management;

– transfer without consideration of movable assets, in particular funds or financial instruments. Identity verification measures. In the case of natural persons, the Data Controller shall record the following data of the natural person:

 first name and last name,

 birth first name and last name,

 citizenship,

 place and date of birth,

 mother’s birth name,

 residential address, or in the absence thereof, place of stay,

 type and number of the identification document.

In the case of legal persons or organisations without legal personality, the Data Controller shall record the following personal data (other data required to be recorded in this case relate to the organisation):

 name and position of persons authorised to represent the organisation,

 personal data suitable for identifying the delivery agent. Documents required for identity verification

For the purpose of identity verification, the attorney shall require the presentation of the following documents:

In the case of natural persons:

 for Hungarian citizens: an official identity document suitable for identification and an official document certifying the residential address;

 for foreign citizens: a travel document or identity card permitting lawful stay in Hungary, and a document certifying the right of residence or stay.

In the case of persons acting on behalf of legal persons or organisations without legal personality:

 for Hungarian citizens: an official identity document suitable for identification and an official document certifying the residential address;

 for foreign citizens: a travel document or identity card permitting lawful stay in Hungary, and a document certifying the right of residence or stay.

Rules on the verification of the (ultimate) beneficial owner.

The natural person client shall be required, by means of personal appearance or in writing, or via a pre-audited electronic communication device in the manner determined by the supervisory authority, to declare whether acting on behalf of or in the interest of a beneficial owner.

The attorney shall record the following data of the beneficial owner in such declaration:

• first name and last name,

• birth first name and last name,

• citizenship,

• place and date of birth,

• residential address, or in the absence thereof, place of stay.

The attorney shall also request information from the client as to whether the beneficial owner qualifies as a politically exposed person (PEP).

Where the client is a legal person or an organisation without legal personality, the representative of the client shall be required, by means of personal appearance or in writing, or via a pre-audited electronic communication device in the manner determined by the supervisory authority, to declare whether acting on behalf of or in the interest of a beneficial owner.

In such declaration, the attorney shall record the following data of the beneficial owner:

 first name and last name,

 birth first name and last name,

 citizenship,

 place and date of birth,

 residential address, or in the absence thereof, place of stay,

 the nature and extent of the ownership interest. The attorney shall also request information from the client as to whether the beneficial owner qualifies as a politically exposed person (PEP). Cases where verification of the beneficial owner may be omitted

Verification of the beneficial owner may be omitted where, based on a risk-based approach, the attorney records the data on the basis of the documents presented or where the data are confirmed by registers accessible to the attorney. In such cases, the fact of the omission shall also be recorded.

In certain cases, the attorney is entitled to request proof of the source of wealth or funds.

2.1.6.2.2. MEASURES RELATING TO DATA CONCERNING THE BUSINESS RELATIONSHIP AND THE TRANSACTION

With regard to the business relationship and the transaction, the attorney shall record the following data:

• in the case of a business relationship: the type, subject matter and duration of the contract;

• in the case of a transaction: the subject matter and amount of the mandate;

• the circumstances of performance (place, time, manner).Based on a risk-based approach, the attorney may request the provision of information concerning the source of wealth or funds, and for the purpose of verifying such information may request the presentation of documents relating to the source of funds. The attorney shall ensure that the available data and documents relating to the client and the business relationship are kept up to date. The attorney shall verify the validity and accuracy of the data at least every five years. If doubts arise concerning the up-to-datedness of the data, customer due diligence measures shall be performed again.

When is the verification of the identity of the client and the beneficial owner required to be carried out?

As a general rule, the verification of the identity of the client and the beneficial owner shall be carried out prior to the establishment of the business relationship or the performance of the transaction. By way of exception, such verification may also be carried out during the establishment of the business relationship, provided that this is necessary in order to avoid the interruption of the ordinary course of business, and that the likelihood of money laundering or terrorist financing is low. In such case, the verification of identity shall be completed by the time the first transaction is performed.

Customer due diligence measures shall not be required to be repeated where:

the attorney has already carried out customer due diligence measures in respect of the client, the authorised representative, the person entitled to dispose, and the representative in connection with another business relationship or transaction,

and, in connection with the present business relationship or transaction, the identity of the client, the authorised representative, the person entitled to dispose, and the representative has been established, and no change has occurred in the data.

Purpose limitation, registers and statistics

Personal data obtained during customer due diligence may be accessed and processed – exclusively for the purposes of performing tasks related to the prevention and combating of money laundering and terrorist financing, and only to the extent necessary for such tasks – by:

 the head of the law firm;

 assisting family members;

 employees.

Retention period under the Pmt. The attorney shall process the data required by law for eight years following the termination of the business relationship or the performance of the transaction. This applies to personal data, non-personal data, documents and copies thereof alike.

The attorney shall also record transactions performed in cash (in Hungarian forints or foreign currency) reaching or exceeding HUF 3,600,000, which information shall be retained for eight years. Upon request by the supervisory authority, the financial intelligence unit, investigative authorities, the prosecution service or the courts, the data shall be retained for the period specified in the request, but no longer than ten years from the termination of the business relationship or the performance of the transaction.

Extension of the retention period based on such a request is permitted exclusively where the data or documents are required for the conduct of an ongoing or future proceeding. Upon expiry of such period, the data shall be deleted or destroyed without delay.

2.2. CONTACT, COMPLAINT, REQUEST FOR QUOTATION

2.2.1. Data Subjects: Natural persons contacting the Law Firm, requesting a quotation, making enquiries or submitting complaints, as well as natural person contact persons of such business entities.

2.2.2. Purpose of data processing: Depending on the purpose of the contact initiated by the Data Subject, including responding to enquiries submitted via contact forms, preparing quotations, responding to incoming emails, handling complaints substantively and informing the Data Subject of measures taken.

2.2.3. Scope of data processed: Name (mandatory when using the contact form on the website), e-mail address (mandatory when using the contact form), telephone number, residential address (depending on the data provided by the Data Subject or the communication channel), where applicable the name and position at a business entity, and other data communicated in the enquiry.

2.2.4. Legal basis of data processing: Legitimate interest, and in the case of requests for quotation, data processing necessary for taking steps prior to entering into a contract. Description of legitimate interests: subsequent verifiability of communications with clients, complaint handling and quality assurance.

2.2.5. Duration of data processing: Depending on the nature of the communication or complaint, but in all cases for at least five years following the handling of the complain

2.3. EMPLOYEE RECRUITMENT

2.3.1. Data Subjects: Natural persons applying for a position with the Data Controller or selected in connection with a specific job advertisement.

2.3.2. Purpose of data processing: The purpose of data processing carried out until the evaluation of the application is to assess the professional suitability of the applicant in relation to the advertised position. Where the collection of specific personal data serves a different purpose, this is expressly indicated below.

The purpose of data processing following the evaluation of the application is:

(i) retention of documents necessary to substantiate the Data Controller’s position in the event of any claims asserted by the applicant (legal basis: legitimate interest; see the “Legal basis of data processing” section below), and

(ii) where the applicant has given separate consent thereto, contacting the applicant directly for the purpose of making further job offers.2.3.3. Scope of data processed:

 Name, permanent address, place and date of birth (purpose of processing: identification of the applicant);

 Telephone number, e-mail address (purpose of processing: communication);

 Data relating to the applied-for position;

 Educational background;

 Professional experience;

 Language skills;

 Skills and abilities;

 Where necessary: curriculum vitae (CV) and the data contained therein, such as – facial image, hobbies, if included in the CV;

 Personal identification data (name, gender, place and date of birth, citizenship);

 Language skills, educational and other qualifications, professional experience, preferred position, areas of interest;

 Where applicable, type of driving licence, as well as any other data contained in the CV;

 Where necessary: motivation letter and its content.:

2.3.4. Legal basis of data processing:

Consent of the applicant. Please note that the applicant is not obliged to provide consent. However, if consent to the processing of personal data for recruitment purposes is not given, the Data Controller will not be able to evaluate the application. Where consent has been given, it may be withdrawn at any time without justification; such withdrawal shall not affect the lawfulness of processing carried out prior to the withdrawal.2.3.5. Duration of data processing

If the applicant has given separate consent, the Data Controller shall retain and use the data for an additional period of 1 year for the purpose of contacting the applicant with further job opportunities.

In the event of a successful application, the Data Controller shall continue to process, from among the data provided during the application, those personal data necessary for the establishment and maintenance of the employment relationship, in accordance with the separate data protection notice applicable to employees.

2.4. INTERNSHIP PROGRAMME

2.4.1. Data Subjects: Law students participating in their mandatory university internship at the Law Firm.

2.4.2. Purpose of data processing: Providing internship opportunities, identification of the intern, assigning appropriate tasks to the intern, maintaining contact, and issuing certificates relating to the completion of the internship.

2.4.3. Scope of data processed

 Name, place and date of birth, citizenship, permanent address, place of stay (purpose of processing: identification of the applicant);

 Telephone number, e-mail address (purpose of processing: communication);

 Data concerning language skills (in the case of interns assigned to intellectual work);

 Skills and abilities;

 Where necessary: curriculum vitae (CV) and the data contained therein, such as

– facial image, if included in the CV;

 Personal identification data (name, gender, place and date of birth, citizenship);

 Language skills, educational and other qualifications, professional experience, preferred position, areas of interest;

 Where applicable, type of driving licence, and other data included in the CV;

 Where necessary: motivation letter and its content.

2.4.4. Legal basis of data processing: Consent of the Data Subject.

2.4.5. Duration of data processing: Five years following the termination of the internship, unless the Data Subject’s data (e.g. name) appear on a data carrier that the Data Controller is legally obliged to retain for a longer period.

2.5. DATA PROCESSING FOR ACCOUNTING AND TAX COMPLIANCE PURPOSES

2.5.1. Data Subjects: Natural persons entering into a business relationship with the Law Firm as customers, suppliers or employees, in respect of the personal data defined by law.

2.5.2. Purpose of data processing: For the purpose of complying with statutory obligations applicable to the Law Firm, including the performance of tax, accounting and contribution payment obligations prescribed by law (accounting, taxation).2.5.3. Scope of data processed: Pursuant to Sections 169 and 202 of Act CXXVII of 2017 on Value Added Tax, in particular: tax number, name, address, tax status; pursuant to Section 167 of Act C of 2000 on Accounting: name, address, identification of the person or organisation ordering the economic transaction, the person authorising the transaction and the person verifying its execution, and depending on the organisation, the signature of the controller; on inventory movement documents and cash handling documents: signature of the recipient; on counter-receipts: signature of the payer; pursuant to Act CXVII of 1995 on Personal Income Tax: entrepreneurial licence number, agricultural producer licence number, tax identification number

2.5.4. Legal basis of data processing: Compliance with a legal obligation.

2.5.5. Duration of data processing: Eight years following the termination of the legal relationship giving rise to the legal basis for data processing.

3. DATA PROCESSING

3.1. A Data Processor shall mean any natural or legal person or any other body that processes personal data on behalf of the Data Controller. The Data Processor may not make any substantive decisions concerning data processing, may process personal data obtained solely in accordance with the instructions of the Data Controller, may not carry out data processing for its own purposes, and shall store and retain personal data in accordance with the instructions of the Data Controller.

3.2. For the operation of the Data Controller, contributors may be engaged (e.g. accountant, IT specialist), and in certain cases translators, experts, attorney sub-contractors, tax advisors or financial advisors may be involved in the performance of mandates. Such persons qualify as Data Processors in respect of the processing of personal data. Information on the specific data processors may be requested via the contact details of the Data Controller.

4. DATA SECURITY

4.1. he Data Controller ensures the security of data in accordance with the applicable regulations. Within the framework of data security measures, the Data Controller in particular implements those technical and organisational measures and establishes procedural rules which ensure that the processed data are protected against unauthorised access, alteration, transfer, disclosure, erasure, destruction, accidental destruction or damage, and against becoming inaccessible as a result of changes in the applied technology.

4.2. When determining and applying data security measures, the Data Controller takes into account the state of the art. From among several possible data processing solutions, the Data Controller shall choose the one that ensures a higher level of protection of personal data, unless this would impose a disproportionate burden on the Law Firm. The Data Controller enforces these requirements vis-à-vis its data processors as well.

4.3. Within the software systems used, the Data Controller provides different levels of access rights in accordance with the user hierarchy. In order to prevent data loss, backup copies are made of the contents of computers and servers. Only system administrators are authorised to enter server rooms at the premises of the Data Controller. The IT systems are protected by appropriate firewalls. The Data Controller ensures adequate virus protection of its IT systems. The Data Controller provides appropriate training to its employees regarding data security requirements. The Data Controller maintains strict rules with respect to the activities of the data processors engaged by it.

4.4. The Data Controller undertakes to draw the attention of all third parties to whom data may be transferred or disclosed to compliance with the above undertakings. In the event of lawful data transfer by the Data Controller, however, the Data Controller shall not assume liability for damages caused by the recipient.

4.5. All employees and collaborators of the Data Controller, on the basis of their employment or other legal relationship, are obliged to comply with the above principles relating to data processing and data security.

5. Cookies

What are cookies?

  • Cookies are small data files that function as unique identifiers. Each cookie is individually associated with the user’s browser. Cookies contain anonymous information and are sent to the user’s computer or mobile device by the server of the website currently being visited. The system stores the data files on the device, and a given cookie can only be retrieved later by the server from which it originates. During browsing, the transmitted cookies may be sent back to the website servers with updated data.
  • Cookies may be placed by the visited website (so-called “first-party cookies”), or by an organisation other than the owner of the visited website (“third-party cookies”). Such third-party cookies may be placed, for example, by another website whose content is displayed on the visited site, or by an external analytics company. Embedded content from other websites may also appear on the visited website, and those websites may likewise place their own cookies. Websites may also use external advertising service providers to display targeted advertisements. Cookies may be capable of tracking the user’s browsing habits across different websites.
  1. How does our Law Firm use cookies??
  • Our website available at https://drborbelyugyved.com uses cookies. The owner and operator of the website is Borbély Law Firm (registered seat: 1093 Budapest, Boráros tér 3., 3rd floor, 9; registration number: 4723; registering bar association: Budapest Bar Association; hereinafter: the Service Provider). The Service Provider enables access to certain content and facilitates contact through the website. These cookies are placed by the Service Provider. Hereinafter, the plural form refers to the Service Provider.
  • Cookies are used to enhance the user experience by allowing the website to recognise the user. They may operate for the duration of the visit (session cookies) or for repeated visits (persistent cookies). The cookies used by us may serve the following purposes:
  • development of the website;
  • may be essential for navigation on the website or for the provision of certain basic functions;
  • may extend the functionality of the website, for example by storing user settings;
  • distinguish between browser users;
  • placement of targeted advertisements on other websites;

improvement of website performance to enhance the user experience.;

  • They facilitate the improvement of the website’s performance in order to enhance the user experience. The information contained in such cookie files is anonymous, and by using them we are able to more easily assess how visitors use our websites – thereby enabling us to present the content of the pages to users more effectively. These services are typically provided by independent companies specialising in data measurement and research; therefore, the cookies concerned may qualify as third‑party cookies.
  • Types of cookies:
  1. Essential cookies: Essential cookies are required for the proper functioning of the website, facilitate its use and collect information about its use without identifying visitors. Without the use of these cookies, we are unable to ensure the proper and convenient operation of our website.;
  2. Statistical cookies: With the aim of developing our website and improving the user experience, we also use cookies that allow us to collect information on how the website is used. Statistical cookies do not personally identify users; they collect information such as the visited page, details of clicks, number of pages visited, duration of sessions.;
  3. Marketing cookies: Marketing cookies are intended to ensure that advertisements displayed on the website are more closely aligned with the user’s interests or are more relevant to the user. Without the user’s consent, marketing cookies are not capable of personally identifying the user; they collect information such as the pages opened by the visitor, click areas within the website, and the number of pages visited, all for the purpose of gaining insight into content that may be of interest to the user. Where the user has consented to the use of marketing cookies, information collected during the monitoring of website usage may be used jointly with the user’s personal data in order to further tailor our marketing communications to the user’s needs..
  • The cookies used by the Service Provider’s website:
  • Essential cookies
Legal basis of processingPurpose of processingRetention periodScope of data processed
Legitimate interestEnsuring the proper functioning of the website.1 dayData stored for cache functionality
Legitimate interestEnsuring the proper functioning of the website.1 dayRandom identifier ensuring the unique identification of the user; storage of information such as “last viewed product” or login status.
Legitimate interestEnsuring the proper functioning of the websiteUntil the end of the browsing sessionStores the user’s status
Legitimate interestEnsuring the proper functioning of the websiteUntil the end of the browsing sessionLanguage – the language selected by the user
  • Statistical cookies
Legal basis of processingPurpose of processingRetention periodScope of data processed
Consent of the userControl of Google Analytics script tag1 dayLoading of the Google Analytics script
Consent of the userUnderstanding how visitors use the website2 yearsUnique identifier
Consent of the userRate limiting of requests1 dayCookie used by Google Analytics
Consent of the userUnderstanding how visitors use the website1 yearUnique identifier
Consent of the userUnderstanding how visitors use the websiteUntil the end of the sessionData sent to Google Analytics regarding the visitor’s device and usage habits
Consent of the userMouseflow: session identificationUntil the end of the sessionCookie used solely for session identification; does not contain information enabling personal identification; automatically deleted when leaving the website.
Consent of the userMouseflow: identification of returning / new visitors90 daysI ndicates whether the visitor is new or returning; binary data (yes/no), does not enable identification.
  • Marketing cookies
Legal basis of processingPurpose of processingRetention periodScope of data processed
Not processedNot processedNot processedNot processed
  • Third-party advertising and targeting cookies used on the website:
  1. Google Analytics: The website uses the Google Analytics service operated by Google Inc. (“Google”) for the purpose of analysing website traffic. Google Analytics uses so-called “cookies”, simple small text files stored on the user’s device, which allow analysis of website usage. Data generated by cookies relating to website usage (including the IP address and time of visit) are transmitted to and stored on Google’s servers located in the USA. Google uses these data to evaluate website usage, compile reports and provide other services related to website use. The installation of cookies may be prevented by adjusting browser settings; however, in such cases some website functions may not operate properly. By using the website, the user expressly consents to the processing of data by Google in the manner described above.;
  2. Facebook: Our website integrates plug-ins of Facebook (1601 South California Avenue, Palo Alto, CA 94304, USA). When visiting our website, a direct connection is established between the browser and the Facebook server. Facebook thereby receives information that the website was visited using the user’s IP address. If the user clicks the “Like” button while logged into Facebook, the content of our website may be linked to the user’s Facebook profile. For further information: http://developers.facebook.com/docs/plugins. We do not receive information on the content of transmitted data or Facebook’s use thereof. Further information is available in Facebook’s Privacy Policy: http://developers.facebook.com/docs/plugins. Users may prevent this by logging out of Facebook prior to visiting the website
  3. YouTube:  Our website contains plug-ins from YouTube, operated by Google. When visiting a page containing a YouTube plug-in, a connection to YouTube’s servers is established, and information is transmitted regarding the visited pages. If the user is logged into YouTube, browsing behaviour may be associated with the personal profile. This may be prevented by logging out of YouTube. Further information is available in here: http://www.google.de/intl/en/policies/privacy.

Control, customisation and disabling of cookies  Please note that as cookies facilitate or enable the usability and processes of our website, preventing or deleting cookies may result in limited functionality or deviation from intended website operation. Users may review and modify their cookie settings at: https://www.aboutads.info/choices/ Further information for browsers:

  1. Internet Explorer: https://support.microsoft.com/hu-hu/help/17442/windows-internet-explorer-delete-manage-cookies;
  2. Mozilla Firefox: http://support.mozilla.org/hu-hu/kb/enable-and-disable-cookies-website-preferences;
  3. Chrome: https://support.google.com/chromeos/answer/95647?hl=hu;
  4. Opera: http://www.opera.com/help/tutorials/security/privacy/;
  5. Safari: https://support.apple.com/kb/PH21411?locale=hu_HU.
  • It is important to emphasise that if essential, functionality‑enhancing or performance‑improving cookie files are disabled or deleted on our website, the website will no longer be usable in accordance with its intended purpose. You may view the types of cookie files used on the Service Provider’s website, modify the relevant settings, and/or completely disable the cookies used on the Service Provider’s website.
  • Transfer of data to third countries During cookie-related data processing, certain service providers may transfer personal data to third countries outside the European Economic Area. In such cases, appropriate safeguards are applied in accordance with applicable data protection laws. Further information is available in the respective service providers’ privacy policies.

6. RIGHTS OF DATA SUBJECTS IN CONNECTION WITH THE PROCESSING OF THEIR PERSONAL DATA

6.1. The Data Subject may at any time request information regarding the processing of their personal data, request rectification, erasure or restriction of processing of their data, and object to such processing. The Data Subject is furthermore entitled to the right to data portability.

6.2. The Data Controller shall inform the Data Subject without undue delay, but in any event within one month of receipt of the request, of the measures taken in response to the request. Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months. The Data Controller shall inform the Data Subject of any such extension, stating the reasons for the delay, within one month of receipt of the request.

6.3. Requests shall be fulfilled free of charge. However, where a request is manifestly unfounded or excessive – in particular due to its repetitive character – the Data Controller may charge a reasonable fee based on administrative costs or refuse to act on the request.

6.4. Where reasonable doubt arises as to the identity of the Data Subject submitting the request, the Data Controller may request additional information necessary to confirm identity.

6.5. Upon request, the Data Controller shall provide information as to whether the processing of the Data Subject’s personal data is ongoing and, if so, grant access to the personal data processed, information on the purposes of processing, categories of data concerned, recipients or categories of recipients, planned storage period or criteria thereof, and the source of the data.

6.6. Upon request, the Data Controller shall provide a copy of the personal data undergoing processing. For additional copies requested, a reasonable fee based on administrative costs may be charged. Where the request is submitted electronically, the information shall be provided in a commonly used electronic format, unless otherwise requested

6.7. The Data Subject may request rectification of inaccurate personal data and has the right to request the completion of incomplete dat.

6.8. The Data Subject may request erasure of personal data if the data are no longer necessary for the purpose for which they were collected; if consent is withdrawn and no other legal ground applies; if the Data Subject objected to processing and the conditions are met; if processing is unlawful; or if erasure is required to comply with a legal obligation.

6.9. Upon such request, the Data Controller shall erase the data unless continued processing is necessary for exercising freedom of expression and information, compliance with a legal obligation, or for the establishment, exercise or defence of legal claims.

6.10. Upon request of the Data Subject, the Data Controller shall restrict the processing of personal data where:

a) the Data Subject contests the accuracy of the personal data, in which case the restriction shall apply for a period enabling the verification of the accuracy of the personal data;

b) the processing is unlawful, but the Data Subject opposes the erasure of the data and requests restriction instead;

c) the Law Firm no longer needs the personal data for the purposes of processing, but the Data Subject requires them for the establishment, exercise or defence of legal claims; or

d) the Data Subject has objected to the processing, in which case the restriction shall apply for the period pending the verification of whether the legitimate grounds of the Data Controller override those of the Data Subject. 6.11. Personal data subject to restriction shall be processed only with the consent of the Data Subject or for the purposes of the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest.

6.12. The Data Controller shall inform the Data Subject, and all recipients to whom the personal data have previously been disclosed, of any rectification, erasure or restriction of processing, unless this proves impossible or involves a disproportionate effort. Where the Data Controller has made the personal data public and is obliged to erase them, it shall, taking account of available technology and the cost of implementation, take reasonable steps – including technical measures – to inform other data controllers processing the personal data that the Data Subject has requested the erasure of any links to, or copies or replications of, those personal data.

6.13. The Data Subject shall have the right to object to the processing of their personal data:

a) where the processing is based on legitimate interest; in such case, the processing may not be continued unless the Data Controller demonstrates compelling legitimate grounds overriding the interests, rights and freedoms of the Data Subject, or grounds relating to the establishment, exercise or defence of legal claims;

b) where the processing is carried out for direct marketing purposes or is related thereto; in such case, the personal data shall no longer be processed for such purposes.

6.14. Under the right to data portability, the Data Subject may request, on the one hand, to receive the personal data concerning them, where technically feasible, from the Law Firm in a structured, commonly used and machine-readable format and to transmit those data to another data controller, and on the other hand, may request the direct transmission of those data by the Law Firm.

6.15. Where the Data Controller does not comply with the request of the Data Subject as set out above, it shall inform the Data Subject of the reasons therefor no later than one month following receipt of the request.

6.16. Where, in the view of the Data Subject, their rights relating to the processing of their personal data have been infringed, they are requested to submit their complaint to the Data Controller using one of the contact details specified below.

6.17. Irrespective of any notification given to the Data Controller, the Data Subject may also turn to the supervisory authority. If the Data Subject chooses to do so, a complaint may be lodged with the authority using the following contact details:

National Authority for Data Protection and Freedom of Information (NAIH)

Address: 1055 Budapest, Falk Miksa u. 9–11.

Postal address: 1530 Budapest, P.O. Box 5

Telephone: +36 1 391 1400

E-Mail: ugyfelszolgalat@naih.hu

6.18. The Data Subject may initiate civil proceedings before a competent court. Proceedings may also be initiated before the court having jurisdiction based on the Data Subject’s place of residence (for a list and contact details of courts, see: birosag.hu/torvenyszekek).

 6.19. Amendments to the data protection notice shall be published on the Data Controller’s website. The version of the data protection notice in force at the time of the provision of personal data shall apply to the processing of personal data, even if, at the time of registration or the provision of personal data by other means, an earlier version of the data protection notice was in force.

7. STORAGE SERVICE PROVIDER

Company name: Websupport Magyarország Kft.

Tax number: 25138205-2-41

Company registration number: 01-09-381419

Community tax number: HU25138205

8. CONTACT

If you have any questions, comments or requests in connection with this data protection notice, wish to submit a complaint, or wish to exercise your rights detailed above, please contact us using the following contact details:

Name: Borbély Law Firm

Registered seat: 1093 Budapest, Boráros tér 3., 3rd floor, 9

E-mail: zoltan@drborbelyugyved.com

Telephone: +36 30 868 2966

Bar registration number: 4723

Tax number: 19164900-2-43