Privacy notice

This website does not use cookies. We use no analytics, tracking code or content loaded from third parties, so there is no cookie banner either.

Juhász Bálint Ügyvédi Iroda (registered office: 1051 Budapest, Vörösmarty tér 5, 2nd floor, Hungary; tax number: 19343376-2-41; hereinafter: the Controller) processes the personal data of data subjects in connection with its attorney engagement agreements and with the operation of the corporatecompliance.hu website in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (the Privacy Act), as set out below.

1. Controller

Name of the Controller	Juhász Bálint Ügyvédi Iroda
Registered office	1051 Budapest, Vörösmarty tér 5, 2nd floor, Hungary
Registered with	Budapest Bar Association
Bar registration number	5240
Tax number	19343376-2-41
Email	info [at] corporatecompliance.hu
Representative of the Controller	Dr. Bálint Juhász, managing attorney (1051 Budapest, Vörösmarty tér 5, 2nd floor; email: info [at] corporatecompliance.hu)

2. Processing activities

2.1. Client identification and related record-keeping obligations

Categories of personal data: for client identification and the related record-keeping obligations, the Controller processes the following personal data:

• natural personal identification data;
• citizenship, or status as a stateless person, refugee, immigrant, settled person or EEA national;
• address;
• facial image;
• signature;
• facts under Section 18(5) of Hungarian Act LXVI of 1992 on the Register of Personal Data and Addresses of Citizens;
• data under Section 24(1)(f) of Hungarian Act XII of 1998 on Travelling Abroad, and the validity period of the document;
• data under Section 8(1)(b)(ba)–(bb) of Hungarian Act LXXXIV of 1999 on the Road Traffic Register;
• data under Section 76(d) and Section 80(1)(b) and (c) of Hungarian Act I of 2007 on the Entry and Residence of Persons with the Right of Free Movement and Residence, and under Section 95(1)(g), Section 96(1)(g) and Section 100(1)(b) and (c) of Hungarian Act II of 2007 on the Entry and Residence of Third-Country Nationals;
• number of identity documents;
• number of documents certifying the address;
• personal identification number;
• tax identification number.

Data subjects: clients of the Controller who are natural persons and whom the Controller is required by law to identify.

Purpose: Hungarian Act LXXVIII of 2017 on the Activities of Attorneys and Hungarian Act LIII of 2017 on the Prevention and Combating of Money Laundering and Terrorist Financing require law firms to identify their clients. Compliance with this obligation is the purpose of the processing.

Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).

Retention: 10 years from the end of the business relationship or the completion of the engagement.

2.2. Data of contact persons of legal entity clients in engagement agreements and related documents

Categories of personal data: name; phone number; email address; name and address of employer.

Data subjects: contact persons of legal entity clients.

Purpose: establishing, maintaining and terminating the contractual relationship with legal entity clients.

Legal basis: the Controller's legitimate interest in keeping in contact with its legal entity clients in connection with the performance of the engagement, and in being able to evidence the content of the performance until the limitation period expires (Article 6(1)(f) GDPR).

Retention: 5 years from the end of the business relationship or the completion of the engagement.

2.3. Data of opposing parties or natural persons acting on their behalf

Categories of personal data: name; other data necessary for legal representation; name of the legal entity represented.

Data subjects: opposing parties and natural persons acting on their behalf.

Purpose: processing the personal data of the opposing party or its representative in connection with the legal representation of the Controller's clients.

Legal basis: performance of a task carried out in the public interest (Article 6(1)(e) GDPR), as the processing is based on Section 1 of Hungarian Act LXXVIII of 2017 on the Activities of Attorneys. Under that provision, the legal profession is an activity – carried out with legal expertise, by lawful means and methods, independently of public authorities – aimed at helping clients enforce their rights and legitimate interests and fulfil their obligations, and at settling disputes between opposing parties by agreement where possible, including participation in the administration of justice.

Retention: until the end of the mandatory retention period applicable to the engagement performed for the client.

2.4. Contact via the website (contact form)

Categories of personal data: name, company, email address and – if provided – phone number, position, company headcount, area and package of interest, content of the message, request for a call with the partner, and which button on the website the enquiry came from.

Data subjects: persons completing the contact form.

Purpose: responding to the enquiry, arranging the free call and preparing a possible engagement.

Legal basis: steps prior to entering into a contract at the data subject's request (Article 6(1)(b) GDPR) and the data subject's consent (Article 6(1)(a) GDPR).

Retention: 1 year from the enquiry; if an engagement follows, as set out in the engagement agreement.

2.5. Request for the detailed terms sheet

Categories of personal data: name, company, position, business email address and – if provided – company website and tax number.

Data subjects: persons requesting the terms sheet.

Purpose: verifying that the requester is a prospective client, and sending the terms sheet.

Legal basis: steps prior to entering into a contract at the data subject's request (Article 6(1)(b) GDPR); for the verification, the Controller's legitimate interest (Article 6(1)(f) GDPR).

Retention: 1 year from the request; if an engagement follows, as set out in the engagement agreement.

2.6. Newsletter

Categories of personal data: email address and – if provided – name and company, plus the time of subscription and confirmation, and the IP address used for confirmation.

Data subjects: newsletter subscribers.

Purpose: sending a professional newsletter.

Legal basis: the data subject's explicit prior consent (Article 6(1)(a) GDPR; Section 6 of Hungarian Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising). The subscription becomes valid only after double opt-in: the link sent by email opens a page where you confirm by clicking a button.

Retention: until consent is withdrawn (unsubscribing); proof of consent is kept for as long as legal claims may arise. You can unsubscribe at any time, free of charge, via the link at the bottom of each newsletter or by email.

2.7. Compliance quick check

The compliance quick check on the website runs only in the data subject's browser. Answers are neither stored nor transmitted, so no processing of personal data takes place in this respect. If the data subject then uses the contact form, section 2.4 applies.

3. Recipients, data transfers, processors

The Controller transfers personal data to the following recipients and uses the following processors:

• Invoices are forwarded to the processor providing accounting services to the Controller. The Controller has entered into a prior agreement with the accounting provider drawing its attention to attorney confidentiality.
• The Controller uses an IT company for software and hardware support of its IT system; in doing so, the IT support provider may access data stored by the Controller. The IT support provider qualifies as a processor; the Controller has entered into a prior agreement with it drawing its attention to attorney confidentiality.
• Website hosting: Clever Cloud SAS (4 rue Voltaire, 44000 Nantes, France; RCS Nantes B 524 172 699) as processor. The website runs in the Paris data centre. The server does not store data submitted via the forms; it forwards it to the Controller by email. To prevent misuse (mass or automated submissions), the server briefly stores technical data: a non-reversible code derived from the IP address or email address and the time of submission for up to 24 hours, and the code of confirmation links already used for up to 7 days. The legal basis for this technical processing is the Controller's legitimate interest (Article 6(1)(f) GDPR).
• Sending emails from the website: Servergarden Kft. (registered office: 1027 Budapest, Ganz utca 12–14, Hungary; company reg. no.: 01-09-350297; tax no.: 27116328-2-41) as processor; data centre: Budapest.
• Email service: the Microsoft 365 email service used by the Controller (provider: Microsoft Ireland Operations Limited, Ireland) as processor.
• Third parties involved in performing the engagement, as independent controllers (opposing parties, authorities, courts, experts, legal or other service providers engaged by the client or by the Controller, notaries).
• The supervisory authority and other authorities, regulators and bodies, as independent controllers.
• Law firms and attorneys that have concluded an association agreement with the Controller, as processors: for the performance of engagements accepted within the association, the Controller grants them access to the personal data of data subjects related to clients. The Controller has entered into prior agreements with these firms drawing their attention to attorney confidentiality.

4. Technical and organisational security measures

The Controller and its processors treat the personal data of data subjects confidentially and comply with the applicable data protection laws.

To ensure lawful processing, the Controller ensures that no unauthorised person can access the data subject's data. To protect personal data in particular against unauthorised access, alteration, transfer, disclosure, erasure or destruction, accidental destruction or damage, and loss of access due to changes in the technology used, the Controller applies reasonable physical, electronic and administrative procedures, paying particular attention to preventing any unlawful or unauthorised processing.

The Controller keeps documents in a physically lockable place. The server used by the Controller is kept by ACE Telekom Kft. in its guarded server park equipped with an alarm system. ACE Telekom Kft. has no access to the data stored on the server, but provides it with a high level of physical protection, uninterruptible power supply, air conditioning, network services, on-site or remote access and permanent operator supervision, which helps prevent damage resulting from outages and data loss. Personal data provided digitally by the data subject are stored digitally and kept securely at the Controller's registered office or on IT equipment owned by the Controller. Documents can be accessed only by authorised persons. Data stored online are password-protected and accessible only to authorised persons. To protect digitally stored data against external attacks, the Controller uses a Kerio Control NG110 hardware firewall and the integrated Kerio antivirus software.

Where the Controller shares the data subject's personal data with a carefully selected third party, it always complies with data protection law and, where necessary, ensures by contract that the third party

• (a) does not use the data subject's personal data for purposes other than those specified by the Controller or set out in this notice, and
• (b) takes appropriate security measures to protect the data subject's personal data in particular against unauthorised access, alteration, transfer, disclosure, erasure or destruction, accidental destruction or damage, and loss of access due to changes in the technology used.

The Controller takes all necessary precautions to ensure that its employees, staff, contractual partners and processors who may access information relating to the data subject handle it in accordance with this notice and data protection law. In its contracts with employees, staff and contractual partners, it ensures that they undertake confidentiality obligations regarding the data made available to them.

5. Cookies

This website does not use cookies and does not store or read any information on the visitor's device. We use no analytics, tracking code (pixels) or content loaded from third parties, so there is no cookie banner. The website's fonts are also served from our own hosting. The LinkedIn link opens LinkedIn only when clicked.

6. Data subject rights

6.1. Right to information and access

Using the Controller's contact details above, the data subject may request in writing or by email information on whether the Controller processes their personal data. If so, the data subject is entitled to be informed which personal data the Controller processes, on what legal basis, for what purpose, from what source and for how long, and to whom, when and under which law the Controller has granted access to or transferred their personal data, including in particular recipients in third countries and international organisations.

The Controller responds to the request within 30 days at the latest, by letter or email sent to the contact details provided by the data subject.

The data subject is entitled to access their personal data; to this end, the Controller sends the personal data to the data subject in writing or by email.

6.2. Right to rectification

Using the Controller's contact details above, the data subject may request in writing or by email that the Controller rectify any of their personal data without delay, or complete incomplete personal data.

The Controller responds within 30 days at the latest, by letter or email sent to the contact details provided by the data subject.

6.3. Right to erasure (right to be forgotten)

Using the Controller's contact details above, the data subject may request in writing or by email that the Controller erase their personal data without delay where one of the following grounds applies:

• (a) the personal data are no longer necessary for the purpose for which the Controller processed them;
• (b) the data subject withdraws the consent on which the processing is based, and there is no other legal ground for the processing;
• (c) the data subject objects to the processing and there are no overriding legitimate grounds for the processing;
• (d) the Controller processed the personal data unlawfully;
• (e) the personal data must be erased to comply with a legal obligation to which the Controller is subject;
• (f) the personal data were collected in relation to the offer of information society services to children.

The Controller fulfils the request within 30 days at the latest and notifies the data subject by letter sent to the contact details they provided.

If the Controller has transferred the data subject's personal data to third-party recipients under this notice (for example processors), it informs them within 30 days that the data subject has requested erasure of their personal data.

6.4. Right to restriction of processing

Using the Controller's contact details above, the data subject may request in writing or by email that processing be restricted where one of the following applies:

• (a) the data subject contests the accuracy of the personal data, for a period enabling the Controller to verify their accuracy;
• (b) the processing is unlawful and the data subject opposes erasure and requests restriction of use instead;
• (c) the Controller no longer needs the personal data for the purposes of processing, but the data subject requires them for the establishment, exercise or defence of legal claims; or
• (d) the data subject has objected to processing, pending verification of whether the Controller's legitimate grounds override those of the data subject.

Where processing is restricted, such personal data may, with the exception of storage, only be processed with the data subject's consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest. The restriction lasts as long as the reason indicated by the data subject requires the data to be stored.

6.5. Right to data portability

Using the Controller's contact details above, the data subject may request in writing or by email to receive the personal data concerning them, which they provided to the Controller, in a structured, commonly used and machine-readable format, and has the right to transmit those data to another controller, where the processing is based on consent or a contract and is carried out by automated means. Where technically feasible, the data subject may request that the personal data be transmitted directly from one controller to another. The Controller fulfils the request within 30 days at the latest and notifies the data subject by letter sent to the contact details they provided.

6.6. Right to object

Using the Controller's contact details above, the data subject may at any time object in writing or by email to the processing of their personal data based on the legitimate interests of the Controller or a third party. In that case the Controller may no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or which relate to the establishment, exercise or defence of legal claims.

6.7. Right to withdraw consent

Where processing is based on consent (for example for the newsletter), the data subject may withdraw their consent at any time, free of charge. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

6.8. Remedies

If the data subject experiences unlawful processing, it is advisable, before initiating legal proceedings, to first send the complaint to the Controller in writing using the contact details above, so that the Controller has the opportunity to restore lawful processing itself.

The data subject may lodge a complaint with the supervisory authority, claiming that their rights have been infringed in connection with the processing of their personal data, or that there is an imminent risk of such infringement:

Supervisory authority	Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Registered office	1055 Budapest, Falk Miksa utca 9–11, Hungary
Postal address	1363 Budapest, Pf. 9, Hungary
Email	ugyfelszolgalat@naih.hu
Phone	+36 (1) 391-1400
Fax	+36 (1) 391-1410
Website	www.naih.hu

In the event of unlawful processing, the data subject may also bring civil proceedings before a court. Such proceedings fall within the jurisdiction of the regional courts (törvényszék); at the data subject's choice, the proceedings may also be brought before the regional court of their place of residence. List and contact details of the regional courts: birosag.hu/torvenyszekek.