From the day-to-day operation of a business to complex investment projects and dispute resolution.
Litigation and out-of-court representation
Civil and commercial disputes, and claims arising from breach of contract or defective performance.
Read more +
Developing legal and evidentiary strategies, preparing statements of claim and defence, representation at hearings and handling appeals. Alongside proceedings, we assess settlement opportunities and assist with out-of-court resolution.
Industrial and EPC projects
Contractual and legal support for projects encompassing engineering, procurement and construction.
Read more +
Preparing and negotiating main contractor and subcontractor agreements, and addressing performance conditions, deadlines, security and liability. We assist with contract amendments, additional works, handover and acceptance, statutory and contractual warranty claims, and disputes arising during projects.
Corporate law and M&A
Company formation, corporate changes, ownership transactions and acquisitions.
Read more +
Drafting constitutional documents, members’ and other corporate resolutions, share transfers and agreements required for company operations. We also provide legal support for transactions involving transformations, acquisitions and mergers.
Business and commercial law
Ongoing corporate legal support and business contracts in Hungarian and other languages.
Read more +
Preparing sale, supply, works, services and lease agreements, general terms and conditions, and statutory and contractual warranty documentation. We assist with assessing contractual risks, negotiations and the legal aspects of international business relationships.
Real estate law and development
Legal support for purchases, leases, land subdivision and development projects.
Read more +
Preparing real estate transactions and related documents, examining title and encumbrances, and representation in land registry proceedings. We also assist with land exchanges, agreements relating to land subdivision, development and construction contracts, and real estate disputes.
Debt recovery and insolvency
Resolving outstanding debts, payment orders, enforcement and creditor representation.
Read more +
Payment demands, settlements and instalment agreements, and pursuing claims in contentious and non-contentious proceedings. We represent creditors in initiating liquidation proceedings and lodging claims, as well as in legal matters relating to enforcement.
Employment law
Supporting employers and employees from the start of employment through to dispute resolution.
Read more +
Preparing employment contracts, internal policies and agreements, and advising on changes to and termination of employment. We assist with employment claims, compensation claims and labour disputes.
Data protection
Legal structuring of corporate data processing and data protection documentation.
Read more +
Preparing privacy notices, internal policies and data processing agreements. We also provide legal support for employee data processing, camera systems and data protection impact assessments, and review data processing practices.
Damages and insurance disputes
Contractual and non-contractual damage, and claims against insurers.
Read more +
Examining liability and evidentiary options, and legally assessing damage and related claims. We support clients in submitting claims, settlement negotiations and, where necessary, litigation.
Succession and probate
Inheritance matters, probate proceedings and representation of heirs.
Read more +
Advising on inheritance, preparing and reviewing testamentary dispositions, and representation in probate proceedings. We assist with inheritance settlements and the resolution of succession disputes.
Intellectual property
Creative works, commercially valuable intellectual assets and licensing arrangements.
Read more +
Legal support for intellectual property rights, usage and licence agreements, and confidentiality agreements. We assist clients in establishing contractual protection and handling related disputes.
Civil law and legal drafting
Contracts, agreements and property matters for businesses and individuals.
Read more +
Reviewing proposed transactions and drafting, amending and reviewing contracts and other legal documents. We aim to define clients’ rights and obligations clearly and prevent subsequent disputes.
OUR COLLEAGUES
Our team
Dr. Simányi Zsolt
Managing member, attorney-at-law
Corporate law · EPC projects Employment law · data protection
Biography +
He graduated in law from Pázmány Péter Catholic University in 2004, summa cum laude. He subsequently completed a programme at Fordham University’s Institute of American Language and Culture in New York. Before taking the Hungarian bar examination, he gained extensive experience in criminal and administrative law alongside civil law. In 2009, he founded Simányi és Társa Law Office and became a member of the Budapest Bar Association. He is a founding and managing member of Simányi és Névery Attorneys’ Association.
His practice currently focuses primarily on civil law. Previously, he acted as defence counsel in criminal matters, provided legal services in administrative matters and served on the supervisory boards of public foundations.
He primarily provides comprehensive legal support to foreign-owned businesses and companies with international business relationships. His main practice areas are corporate, business and commercial law, employment law, data protection and comprehensive legal support for EPC projects. The latter includes preparing and negotiating contracts for engineering, procurement and construction projects, handling legal issues during implementation and resolving related claims and disputes. He represents clients in litigation and out-of-court enforcement and also accepts instructions from individuals in civil matters.
He works in Hungarian and English, drafting documents and conducting negotiations in both languages.
Dr. Névery Péter
Founding member, attorney-at-law
Litigation · debt recovery EPC projects · business contracts
Biography +
He obtained his law degree from the Faculty of Law of Eötvös Loránd University in 2007. He has practised as a member of the Budapest Bar Association since 2012. He is a founding member of Simányi és Névery Attorneys’ Association.
His practice centres on civil and commercial disputes and pursuing claims in and out of court. He represents businesses and individuals in contractual, real estate, damages and employment matters. He regularly handles disputes arising from breach of contract, defective performance and statutory and contractual warranties, as well as payment order, enforcement and liquidation proceedings.
He also provides ongoing legal support to Hungarian and foreign-owned companies, prepares and negotiates business contracts and handles real estate transactions. Together with Dr. Simányi Zsolt, he supports industrial and EPC projects by assisting with engineering, procurement and construction contracts, legal issues arising during performance and the resolution of related claims. His particular focus in this work is on preventing disputes and representing clients in litigation.
He works in Hungarian, English and Slovak. He also supports clients with international business relationships in multilingual contractual settings.
Dr. Ruszthi Hunor
Cooperating partner, attorney-at-law
Real estate · corporate law and M&A Sports law · intellectual property
Biography +
He obtained his law degree from the Faculty of Law of Pázmány Péter Catholic University in 2004. He completed the coursework of the university’s doctoral school in 2006 and earned an LL.M. qualification in sports law at the Deák Ferenc Further Training Institute in 2026. For several years, he taught, led courses and examined students at Pázmány Péter Catholic University and colleges in Budapest. He has been a member of the Budapest Bar Association since 2008.
His main practice areas are real estate, corporate and commercial law, sports law and intellectual property. He provides ongoing legal representation to major companies in various industries and regularly supports real estate development projects. He represents clients in a substantial number and value of mergers and acquisitions across different sectors and provides comprehensive legal services in these areas to both long-standing and occasional clients.
He works in Hungarian and English.
Dr. Péntek Bálint
Member of the association, attorney-at-law
Corporate law · employment law Real estate · debt recovery
Biography +
He graduated in law from the Faculty of Law of Pázmány Péter Catholic University in 2013 and passed the Hungarian bar examination in 2019. He has worked with Simányi és Társa Law Office and attorneys Dr. Simányi Zsolt and Dr. Névery Péter since February 2015. He has practised as a member of the Budapest Bar Association since 2020 and is a member of Simányi és Névery Attorneys’ Association.
His practice primarily covers corporate, employment and real estate law and debt recovery. In these areas, he provides comprehensive legal advice and representation to Hungarian and foreign-owned small and medium-sized enterprises, individuals and non-profit organisations.
He works in Hungarian and English.
Dr. Tóth Márk
Trainee lawyer
Real estate · corporate law Debt recovery
Biography +
He obtained his law degree from the Faculty of Law of Eötvös Loránd University in 2023. He began his career at a Budapest law firm, where he primarily handled media law matters.
He has been a trainee lawyer at Simányi és Névery Attorneys’ Association since 2025. He is currently preparing for the Hungarian bar examination.
He works in Hungarian and English.
Dr. Hegedűs Péter
Trainee lawyer
Civil law · corporate law Preparing litigation matters
Biography +
He obtained his law degree from the Faculty of Law of Pázmány Péter Catholic University. He began his career as an intern at a Budapest law firm, primarily working on real estate matters. He is currently a trainee lawyer at Simányi és Névery Attorneys’ Association.
He has gained experience primarily in civil and corporate law and debt recovery. His work includes assisting with the preparation of contentious and non-contentious proceedings and drafting contracts and other legal documents.
He works in Hungarian and English.
OUR PROFESSIONAL ARTICLES
Our articles on LinkedIn
Dr. Névery Péter · · English version
Functional food online - an opportunity for Slovak and Czech brands on the Hungarian market?
Online food sales are no longer just the domain of supermarkets. Functional food, healthy snacks, premium foods and longevity products are creating space for D2C brands that sell product, content and lifestyle at the same time.
Read the full article +
Online food sales are no longer just the domain of supermarkets. Functional food, healthy snacks, premium foods and longevity products are creating space for D2C brands that sell product, content and lifestyle at the same time.
With functional food, the main asset is not the catalog. It is the brand, repeat purchases, and the ability to explain to the customer why they should include the product in their daily routine.
Kifli shows the size of the online food segment
The CzechRohlik Group entered Hungary through Kifli.hu and built it into an online FMCG leader. In the PwC 2025 ranking, Kifli.hu was the second largest online retailer in the country and the first in FMCG.
This model is capital intensive - own fulfillment centers, refrigerated logistics and delivery time windows. However, for smaller food brands, there is no need to copy Rohlik. Their opportunity may be completely different: their own D2C brand, marketplace or distribution partnership.
Powerlogy: product, community and European ambition
According to E-commerce Slovakia, Slovak POWERLOGY achieves an annual turnover of over 4 million euros and operates mainly in Slovakia and the Czech Republic. The brand focuses on functional nutrition, superfoods, supplements and education around energy, performance and longevity.
Founder Dušan Plichta stated in an interview with MediaGuru that he wants to expand to 27 European countries and build a European e-shop around the longevity and biohacking community. In this plan, Hungary is a natural market on the map of Central Europe.
Why can D2C work with food?
The advantage of functional food is the high chance of repeat purchase. Coffee, granola, nut butter, protein, collagen or supplements are bought again after consumption. This changes the economics of the customer: the brand does not have to make money on the first order if it can build a long-term relationship.
The second factor is content. Recipes, podcasts, expert explanations, ambassadors, and community help a brand differentiate itself from an anonymous product on a marketplace. Powerlogy is a good example of how a product can be an entry point into a broader media and community ecosystem.
Marketplace can be a test, not the end goal
POWERLOGY is already using distribution channels and marketplaces to expand. GymBeam, on the other hand, lists marketplaces in its annual report as a growing channel that helps acquire customers and enter new markets.
For a brand that is unsure of Hungary's potential, selling through an existing marketplace or retail partner may be the first step. A localized e-shop may come after demand is verified.
Hungary is not just a cheap food market
The price sensitivity of the Hungarian consumer is high, but this does not exclude the premium segment. Budapest and larger cities create an audience for healthy lifestyle, fitness, biohacking and quality food. It is in such communities that a regional brand can start relatively concentrated.
For Czech or Slovak brands, the main question is not whether they can compete with the supermarket. The question is whether there is a large enough community of customers in Hungary who want exactly their type of product and story.
From niche brand to regional brand - Hungary as the next step
Barefoot, sneakers, eyewear and streetwear show that e-commerce does not have to grow only through mass assortment. Regional niche brands can create a strong community and then transfer the same identity to other markets.
Read the full article +
Barefoot, sneakers, eyewear and streetwear show that e-commerce does not have to grow only through mass assortment. Regional niche brands can create a strong community and then transfer the same identity to other markets.
The most interesting fashion e-shops often don’t enter a new market as “another shoe store.” They enter as a brand that the customer wants to follow and belong to.
Ježko Bežko: Hungary already in expansion plan
Slovak children's and barefoot footwear specialistJežko Bežko is one of the most interesting examples in this series. The company has grown to approximately €1.5 million in sales in eight years and publicly confirmed plans to expand into Poland and Hungary in 2026.
The brand is preparing a more neutral identity and new domains for this. This is exactly the moment when a successful local niche e-shop begins to become a regional brand.
Be Lenka: Slovak barefoot is already experiencing international growth
The barefoot segment has another strong representative in Slovakia - Be Lenka . The brand has grown to tens of millions of euros in annual sales and sells in multiple markets. It is proof that a product category that was relatively narrow a few years ago can create an internationally scalable brand.
For other companies, it is important to note that the barefoot customer is often not just looking for “shoes.” They are looking for a specific product philosophy, fit, expert content, and community. This reduces the advantage of purely price-based marketplace models.
Footshop: from a Prague sneaker shop to a regional e-commerce company
Czech Footshop achieved consolidated sales of CZK 1.887 billion in 2025, with 93% of revenues coming from e-commerce. More than three-quarters of sales come from abroad. The company also has brick-and-mortar stores, including in Budapest, and is expanding.
Footshop shows that a physical store doesn't have to be the opposite of a digital model. It can be a showroom, a community point, and a branding tool in a market where the majority of sales still come online.
Fashion is localized differently than a technical product
For clothing and footwear, the product catalog is just the beginning. Styling, photography, local social media lingo, influencers, community events, and how the brand handles sizing and exchanges are key.
Therefore, a brand with a smaller assortment that can build a clear identity in Hungary can be more successful than a large reseller without its own story. Niche players have the advantage that their story already exists - they just have to convey it correctly.
Hungary as another regional chapter
Ježko Bežko is already preparing Hungary specifically. Footshop showed a functioning omnichannel model here, and other Slovak brands such as Be Lenka or EYERIM prove that a regional e-commerce brand can be built from Bratislava, Žilina or Prague.
For smaller fashion brands, Hungary may not be a “big international expansion.” It can be the next chapter in Central European growth – especially if the product is sufficiently different and the brand can create a local community.
Is there room for regional beauty e-shops in Hungary?
Notino has proven that a Czech beauty brand can be a mainstream online player in Hungary. However, that doesn't mean the market is closed.
Read the full article +
Notino has proven that a Czech beauty brand can be a mainstream online player in Hungary. However, that doesn't mean the market is closed. Natural cosmetics, niche skincare, and brands with their own story can play a different game than large multibrand platforms.
Beauty is a category where the customer isn't just buying a product. They're buying trust, a routine, a brand story, and often a community. This is an environment where a smaller regional brand can grow alongside the big players.
Notino as a proof of market, not a barrier
According to PwC, Notino is one of the most well-known online retailers in Hungary. Its success is confirmed by two things: the Hungarian customer has no problem buying beauty online, and the brand's Czech origin is not a barrier if the customer experience is local.
For smaller brands, however, the goal is not to build "the next Notino." A clearly defined category may be more interesting - natural cosmetics, clean beauty, aromatherapy, zero-waste drugstore or professional skincare.
Soaphoria: own brand and partnership model
Slovak Soaphoria combines its own e-shop, brick-and-mortar stores and a network of partner stores. In the Czech Republic, it has a wide list of partner stores and is also actively looking for B2B partners - e-shops, salons and brick-and-mortar concepts.
This model is interesting for expansion because a new market does not have to start with a large investment of its own. The brand can combine direct-to-consumer sales with local partners who help it build trust and physical contact with the customer.
Kvitok: community, experience and repeat purchase
KVITOK® has been on the market for more than ten years, has produced hundreds of thousands of products and fulfilled more than 160,000 orders. In addition to its own e-shop, it is building a partner network.
Repeat purchases are extremely important in cosmetics. If a customer finds a product that suits them, a one-time order can turn into a long-term relationship. Therefore, it is not only the cost of acquiring a customer that is crucial for expansion, but also the ability to retain them.
Local marketing is more important than literal translation
Beauty brands rely on content: tutorials, routines, before/after communication, ambassadors, reviews, social media and video. Therefore, when entering Hungary, it is not enough to simply translate product names. The brand must sound natural in the local online environment.
The advantage of Czech and Slovak players is that they already have experience with relatively small Central European markets. They know how to work with the community and may not need huge media budgets to create a meaningful customer base.
Where could the opportunity be?
Hungarian beauty e-commerce is competitive but also very broad. Alongside global perfumeries, there is room for brands that come up with their own formulations, a clear identity, and content that educates or inspires the customer.
Slovak natural beauty brands therefore do not need to look for an empty market. They just need to find a segment of customers for whom their specific position is relevant. In beauty, the brand that is memorable often wins, not the one with the most items in the catalog.
Select the privacy notice of the attorney you wish to contact.
The content and effective dates of the original supplied documents have been retained. The foreign-language versions are translations of those documents.
Simányi Ügyvédi Iroda Effective date of the notice: 1 April 2021
English translation of the supplied Hungarian notice. The content and effective date of the source document have been retained.
1. Introduction and definitions
Simányi Ügyvédi Iroda (bar registration number: 4993; registered office: 1016 Budapest, Szirtes út 11., ground floor, door 1.) (hereinafter: service provider/controller), as controller, acknowledges that the contents of this notice are binding upon it.
The controller undertakes to ensure that all processing connected with its activities meets the requirements of this policy, applicable national legislation and legal acts of the European Union.
The controller reserves the right to amend this notice at any time, provided that clients are notified of any changes in due time.
The controller is committed to protecting clients’ personal data and considers respect for their right to informational self-determination particularly important.
The controller treats personal data confidentially and takes all security, technical and organisational measures necessary to guarantee data security.
The following terms have the meanings set out below:
Personal data: any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, particularly by reference to an identifier such as a name, number, location data, online identifier, or one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity.
Data subject: a natural person identified or identifiable on the basis of personal data.
Controller: a person who, alone or jointly with others, determines the purposes and means of processing personal data, makes and implements decisions concerning processing, or instructs a processor to implement them; under this policy, Dr. Simányi Zsolt, practising as an individual attorney.
Client: a data subject who has entered into, or wishes to enter into, a legal relationship with the controller.
Business partner: a business in a contractual relationship with the controller.
Data transfer: making data available to a specified third party.
Processor: a natural or legal person, or an organisation without legal personality, processing personal data on behalf of or on instructions from the controller within the framework and conditions laid down by law or a binding legal act of the European Union.
International data transfer: a transfer to a controller or processor processing data in a non-EEA country.
Special categories of personal data: all data in the special categories, namely data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership; genetic data; biometric data for uniquely identifying a natural person; health data; and data concerning a natural person’s sex life or sexual orientation.
2. Personal data, purposes, legal bases, retention and other provisions
The principles of processing are consistent with applicable data protection legislation, particularly:
Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.);
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Regulation 95/46/EC (General Data Protection Regulation, GDPR);
Act LXXVIII of 2017 on Legal Practice (Üttv.);
Act V of 2013 on the Civil Code (Ptk.);
Act C of 2000 on Accounting (Accounting Act).
As detailed below, processing may rely on:
Compliance with a statutory obligation or processing authorised by law (“processing necessary for compliance with a legal obligation”), Article 6(1)(c) GDPR;
Performance of a legal-services engagement agreement (“processing necessary for performance of a contract”), Article 6(1)(b) GDPR;
Pursuit of the controller’s legitimate interests (“processing necessary for legitimate interests”), Article 6(1)(f) GDPR;
The client’s consent in a separate declaration following separate prior information (“processing based on consent”), Article 6(1)(a) GDPR.
The controller is not responsible for legal consequences arising from the provision of false or misleading data.
The controller processes data primarily on paper and secondarily by automated means; in both cases the physical processing location is its registered office.
The controller does not transfer data subjects’ personal data to a foreign third country or international organisation outside the European Union or EEA, except with the data subject’s express approval and on the terms recorded in a written declaration by the parties, with safeguards complying with the GDPR. This restriction does not cover Article 45 GDPR: if the destination country and/or international organisation is covered by a valid Commission adequacy decision, no separate authorisation is required. At the date of this document, adopted adequacy decisions are in force for Andorra, Argentina, the Faroe Islands, Guernsey, Israel, Jersey, Canada, the Isle of Man, Switzerland, Uruguay, the USA (Privacy Shield) and New Zealand; the adequacy procedures for Japan and South Korea are ongoing.
The controller informs data subjects that, having regard to the closing wording of recital 91 GDPR, no impact assessment has been carried out and no data protection officer has been appointed.
2.1. Legal services
The controller provides the services specified in the Legal Practice Act to clients approaching it (hereinafter: Client(s)); together these are referred to as legal services, provided under an engagement granted in accordance with Chapter V of that Act (hereinafter: engagement).
Purpose: performing the engagement, the Client’s instructions and all directly connected operations serving that purpose and the Client’s interests; informing the Client to ensure compliance with relevant legal requirements, including decisions of authorities, courts or other persons, organisations or public bodies authorised to issue binding normative acts; recording the Client’s declarations in documents; and enforcing and recovering claims arising in connection with the engagement. In providing legal services, the controller complies with statutory client-identification, client and case registration, document-handling and other reporting obligations applicable to attorneys. Where required by law, it may transfer the data subject’s personal data to competent authorities for those reporting purposes.
Legal bases: processing necessary for performance of a legal-services contract, pursuit of legitimate interests and compliance with legal obligations.
General personal data processed: the data may vary with the engagement, but primarily comprise personal data supplied by the Client in the engagement document (typically the engagement agreement and statement of facts) and annexes, and all further information provided during performance and/or learned by the attorney. This may include special-category data of the Client or another data subject within the limits laid down by law and the document relating to the engagement agreement.
Retention: for the duration of the engagement and thereafter, under sections 46 and 53 of the Legal Practice Act, the attorney must process and retain engagement-related data for five (5) years after termination, or ten (10) years for electronic documents; data and documents relating to countersigned instruments must be retained for ten (10) years after termination, consistently with Article 6(1)(c) GDPR and, for special-category data, Article 9(2)(g) GDPR.
Possible consequence of not providing data: the engagement cannot be entered into.
Processors: the controller uses the following processors to fulfil the purposes in this section.
Recipient
Registered office
Data disclosed
Purpose
Processor’s task
Google Llc.1
1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Data recorded during the legal engagement
Storage of electronic documents relating to the engagement and its performance (Google Drive)
Data storage and archiving
Microsec Zrt.
1031 Budapest, Záhony utca 7., Building D
Data recorded during the legal engagement
Storage of electronic case files relating to the engagement and its performance
Qualified archival storage
Disclosure:
The controller may share personal and special-category data learned during legal services with its employees, lawful substitutes acting in its place (typically attorneys authorised under the Legal Practice Act and engagement agreement), and/or persons authorised by the client (typically the client’s representative), to the extent necessary to perform the engagement.
If the legal services involve representation in proceedings for entry into an authentic public register or drafting a document forming the basis of such entry, the controller must electronically consult the competent official register to verify the client’s identity, address and validity of the supporting identity documents. For other legal services, this requires separate client consent in the engagement agreement. Verification may cover the data listed in section 32(3) of the Legal Practice Act.2 If verification shows that a document has been reported lost, stolen or destroyed and its recovery has not been recorded, the attorney must, to prevent unauthorised use, immediately report the facts in writing to the police department competent at the place of use and simultaneously make an expedited notification.
Possible consequence of not providing data: legal services cannot be provided.
Possible consequence of not providing data: legal services cannot be provided to the data subject. The data subject may object as described in section 5.
1 The international transfer complies with the GDPR and the Information Act, particularly because the processor operates under an agreement approved by the EU–US Privacy Shield.
2 a) Natural-person identification data; b) nationality, statelessness, refugee, immigrant, settled or EEA-citizen status; c) address; d) facial image; e) signature; f) facts under section 18(5) of Act LXVI of 1992 on the Register of Citizens’ Personal Data and Addresses; g) data under section 24(1)(f) of Act XII of 1998 on Travel Abroad and the document’s validity period; h) data under section 8(1)(b)(ba)–(bb) of Act LXXXIV of 1999 on the Road Traffic Register; i) data under section 76(d) and section 80(1)(b)–(c) of Act I of 2007 on the Entry and Residence of Persons with the Right of Free Movement and Residence, and section 95(1)(g), section 96(1)(g) and section 100(1)(b)–(c) of Act II of 2007 on the Entry and Residence of Third-Country Nationals.
2.2. Statistical analysis of engagements, communication and monitoring services used
Purpose: statistical analysis concerning legal services, communication with clients using the services and monitoring the services used.
Legal basis: processing necessary for legitimate interests.
Data: surname, first name, email address, telephone number, subject of the matter and meeting date.
Retention: five years after termination of the engagement.
Processor: the controller uses the following processor to fulfil this section’s purposes.
Recipient
Registered office
Data disclosed
Purpose
Task
Google Llc.3
1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Surname, first name, email address, meeting date
Contacting and communicating with the Client and making offers for legal services
Email services: recording, storage, deletion, etc.
Possible consequence of not providing data: legal services cannot be provided to the data subject. The data subject may object as described in section 5.
3 The international transfer complies with the GDPR and the Information Act, particularly because the processor operates under an agreement approved by the EU–US Privacy Shield.
2.3. Collecting visitor data on www.simanyi.hu and www.snlegal.hu
www.simanyi.hu and www.snlegal.hu do not use cookies and therefore do not install data files on the visitor’s computer for data collection.
The website(s) use the user access log of Web-server Kft. (company registration number: 09-09-011599; tax number: 13498454-2-09; registered office: 4025 Debrecen, Pásti utca 2., first floor, door 5) to collect traffic data, recorded using AWStat (https://awstats.sourceforge.io). the data collected when visiting the website do not allow identification of a natural person and therefore are not personal data and the processing is not personal-data processing.
Purpose: collecting and analysing visitor data for www.simanyi.hu and www.snlegal.hu for marketing purposes.
Legal basis: legitimate interests.
Data: visit date and time, IP address, referrer, browser version, operating-system type and visited subpages.
Retention: no more than two years after the visit.
Processor: the controller uses the following processor.
Recipient
Registered office
Data disclosed
Purpose
Task
Web-server Kft.
4025 Debrecen, Pásti utca 2., first floor, door 5
Visit date and time, IP address, referrer, browser version, operating-system type
Collecting website traffic data
Recording, storage, organisation, deletion, etc.
Possible consequence of not providing data: inability to visit the website or use of reduced functionality. The data subject may object under section 5.
2.4. Requests for legal services through www.simanyi.hu and www.snlegal.hu, email or telephone
The controller processes certain personal data of persons requesting offers through the interface on www.simanyi.hu and www.snlegal.hu, email or telephone as follows. This section also applies to applications submitted through those website(s).
Purpose: making offers for legal services meeting the Client’s needs, and initiating and maintaining contact before the engagement.
Legal bases for processing, disclosure and processor operations: performance of a contract and legitimate interests.
Data: surname, first name, email address, telephone number and any other personal data provided by the Client in the message or by telephone.
Retention: deletion immediately if the request for legal services is rejected, and in any event no later than two years after recording. If an engagement is entered into, section 2.1 governs processing and deletion.
Processor: the controller uses the following processor.
Name
Registered office
Data
Purpose
Task
Google Llc.4
1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Name, email address and any other personal data supplied by the Client in the message
Contact and communication with the Client and offers for legal services
Organisation and storage of data
Possible consequence of not providing data: legal services cannot be provided. The data subject may object under section 5.
4 The international transfer complies with the GDPR and the Information Act, particularly because the processor operates under an agreement approved by the EU–US Privacy Shield.
2.5. Processing relating to the controller’s business partners
The controller processes the data of contact persons at business partners with whom it has a contractual relationship as follows.
Purpose: communication with business partners to provide or receive contractual services.
Legal basis for processing, disclosure and processor operations: performance of a contract.
Possible consequence of not providing data: the business relationship cannot be established or may end.
5 The international transfer complies with the GDPR and the Information Act, particularly because the processor operates under an agreement approved by the EU–US Privacy Shield.
2.6. Invoicing
The processor uses and stores the data of individual clients and individual/sole-trader business partners to issue invoices and keep accounting records.
Purpose: processing necessary for invoicing and accounting to fulfil obligations under the Accounting Act and tax legislation.
Legal bases: compliance with a legal obligation and performance of a contract.
General personal data: surname, first name, billing address and sole trader’s tax number.
Retention: eight years plus two years after termination of the contract (the current tax year and the tax year following the statutory deadline), having regard to section 169(2) of the Accounting Act.
Processors: the following processors are used.
Name
Registered office
Data disclosed
Purpose
Task
KBOSS.hu Kft.
1031 Budapest, Záhony utca 7.
Surname, first name, billing address, sole trader’s tax number
Compliance with the Accounting Act
Issuing invoices under accounting and tax legislation
Ecocreative Zrt.
1116 Budapest, Fegyvernek utca 8., 7. em. 77.
Surname, first name, billing address, sole trader’s tax number
Compliance with the Accounting Act
Accounting under accounting and tax legislation
Possible consequence of not providing data: a contract with the controller cannot be entered into.
3. Storage of personal data and security of processing
The controller’s IT systems and data-storage locations are at its registered office and those of its processors.
The controller selects and operates the IT equipment used for its services so that the data are: a) accessible to authorised persons (availability); b) authentic and capable of authentication (authenticity); c) capable of being verified as unchanged (integrity); and d) protected against unauthorised access (confidentiality).
The controller protects data through appropriate measures against unauthorised access, alteration, transfer, disclosure, deletion or destruction, accidental loss or damage, and inaccessibility resulting from changes in technology.
To protect electronically processed files in its registers, appropriate technical solutions ensure that stored data cannot be directly linked or attributed to a data subject unless permitted by law.
Taking account of technological development, the controller uses technical and organisational measures providing protection appropriate to processing risks, particularly:
Computer authentication with passwords of at least eight characters, accessible only to responsible persons;
Antivirus and anti-vulnerability software protecting electronic devices and data against unlawful processing and unauthorised access;
Backups and recovery of access to data and systems to prevent damage and loss;
Instructions to responsible persons to preserve the confidentiality of information and processing, avoid leaving credentials unattended and avoid leaving workstations accessible during processing sessions;
Measures ensuring systems’ reliability, integrity, availability and resilience and the availability and accessibility of data during physical or technical incidents;
Appropriate staff training.
During processing the controller preserves: a) confidentiality, so only authorised persons may access information; b) integrity, protecting the accuracy and completeness of information and processing methods; c) availability, so authorised users can access information and related facilities when needed.
The controller’s and its partners’ IT systems and networks are protected against computer-assisted fraud, espionage, sabotage, vandalism, fire, flooding, computer viruses, intrusion and denial-of-service attacks. The operator ensures security through server-level and application-level protection.
Users are informed that electronic messages transmitted over the internet, regardless of protocol (email, web, FTP, etc.), are vulnerable to network threats leading to dishonest activity, contractual disputes, disclosure or alteration of information. The controller takes all reasonably expected precautions against these threats. It monitors systems to record security deviations and provide evidence of security incidents. Monitoring also permits assessment of the effectiveness of precautions.
The controller ensures that responsible persons process data in accordance with the GDPR, applicable national data protection law and/or the controller’s good practices and/or valid internal procedures, particularly that they: a) process data lawfully and appropriately only for their duties and related purposes; b) access data only to fulfil their duties and avoid access and processing where not strictly necessary; c) do not share or disclose data without the controller’s prior authorisation; d) ensure the greatest possible confidentiality; e) continuously check data for currency, completeness and relevance.
4. Controller’s details and contact information
Name: Simányi Ügyvédi Iroda Address: 1016 Budapest, Szirtes út 11., ground floor, door 1. Bar registration number: 4993 Phone: +36 30 201 9730 Email: zsolt.simanyi@snlegal.hu
Person responsible for data protection: Dr. Simányi Zsolt, managing attorney Phone: +36 30 201 9730 Email: zsolt.simanyi@snlegal.hu
5. Data subjects’ rights and remedies
Data subjects may request information about processing, rectification of their personal data, and—except for mandatory processing—erasure and withdrawal. They may exercise portability and objection rights as indicated when data were collected or through the controller’s contact details above.
Right to information under the GDPR
The controller takes appropriate measures to provide all information under Articles 13 and 14 and communications under Articles 15–22 and 34 GDPR concerning personal-data processing in a concise, transparent, intelligible and easily accessible form, using clear and plain language.
This right may be exercised in writing through the contacts in sections 1 and 4. On request and following verification of identity, information may also be provided orally.
Right of access
Data subjects are entitled to confirmation of whether their personal data are being processed and, if so, access to the data and information on: purposes; categories of data; recipients or categories of recipients to whom data have been or will be disclosed, particularly third-country recipients and international organisations; intended retention period; rights to rectification, erasure, restriction and objection; the right to complain to a supervisory authority; sources of data; existence of automated decision-making, including profiling; meaningful information about the logic involved and its significance and expected consequences. Where data are transferred to a third country or international organisation, data subjects may request information on appropriate safeguards.
The controller provides a copy of the personal data processed. For additional copies requested, it may charge a reasonable fee based on administrative costs. Information is provided electronically on request.
Information is provided no later than one month after submission of the request.
Right to rectification
Data subjects may request correction of inaccurate personal data and completion of incomplete data.
Right to erasure
Data subjects may request erasure without undue delay where: the data are no longer necessary for the purposes of collection or other processing; consent is withdrawn and no other legal basis exists; an objection is made and there are no overriding legitimate grounds; data were processed unlawfully; erasure is required by Union or Member State law applicable to the controller; or data were collected in connection with the offer of information-society services.
Erasure cannot be requested where processing is necessary for freedom of expression and information; compliance with an applicable Union or Member State obligation requiring processing, or a task in the public interest or exercise of official authority; public-interest grounds in public health, archiving, scientific or historical research or statistics; or establishment, exercise or defence of legal claims.
Right to restriction
The controller restricts processing on request if: the accuracy of personal data is contested, for the period needed to verify it; processing is unlawful and the data subject opposes erasure and requests restricted use instead; the controller no longer needs the data but the data subject requires them for legal claims; or the data subject has objected, pending verification of whether the controller’s legitimate grounds override those of the data subject.
Restricted data, apart from storage, may be processed only with consent, for legal claims, to protect another natural or legal person’s rights or for important Union or Member State public interests.
The controller informs the data subject before lifting a restriction.
Right to data portability
Data subjects may receive personal data concerning them that they supplied to the controller in a structured, commonly used, machine-readable format and transmit them to another controller.
Right to withdraw consent
Consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of consent-based processing before withdrawal.
Procedural rules
The controller informs the data subject of action taken on a request under Articles 15–22 GDPR without undue delay and no later than one month after receipt. Where necessary, considering the complexity and number of requests, this may be extended by two further months.
The controller informs the data subject of an extension and the reasons for delay within one month of receipt. For electronic requests, information is provided electronically unless otherwise requested.
If no action is taken, the controller informs the data subject without delay and within one month of the reasons, and of the right to complain to a supervisory authority and seek a judicial remedy.
Information and communications are free of charge. For manifestly unfounded or excessive requests, particularly repetitive ones, the controller may charge a reasonable fee taking account of administrative costs or refuse to act.
The controller communicates rectification, erasure or restriction to each recipient to whom personal data were disclosed, unless impossible or requiring disproportionate effort, and informs the data subject of these recipients on request.
The controller provides a copy of personal data processed. A reasonable administrative-cost-based fee may be charged for further copies. For electronic requests, information is provided electronically unless otherwise requested.
Compensation for material and non-material damage
Any person suffering material or non-material damage because of a GDPR infringement is entitled to compensation from the controller or processor. A processor is liable only where it failed to comply with obligations specifically imposed on processors or acted outside or contrary to the controller’s lawful instructions.
Where several controllers or processors, or both, are involved in the same processing and are responsible for resulting damage, each is jointly and severally liable for the entire damage.
A controller or processor is exempt from liability if it proves that it is in no way responsible for the event giving rise to the damage.
Complaint to the person responsible for data protection
If you have concerns about processing, please contact:
Name: Simányi Ügyvédi Iroda Address: 1016 Budapest, Szirtes út 11., ground floor, door 1. Phone: +36 30 201 9730 Email: zsolt.simanyi@snlegal.hu
Right to bring court proceedings
If data subjects’ rights are infringed, they may bring proceedings against the controller. The court deals with the case as a priority.
Proceedings before the data protection authority
Complaints may be lodged with the Hungarian National Authority for Data Protection and Freedom of Information:
Name: Nemzeti Adatvédelmi és Információszabadság Hatóság Registered office: 1055 Budapest, Falk Miksa utca 9–11. Postal address: 1363 Budapest, Pf. 9. Telephone: 06-1-391-1400 Fax: 06-1-391-1410 Email: ugyfelszolgalat@naih.hu Website: http://www.naih.hu
Dr. Névery Péter Effective date of the notice: 25 May 2018
English translation of the supplied Hungarian notice. The content and effective date of the source document have been retained.
1. Introduction and definitions
Dr. Névery Péter, practising as an individual attorney (tax number: 50233126-2-41; statistical identification number: 50233126 6910 232 01; KASZ: 36066302; register number: 19459; registered office: 1016 Budapest, Szirtes út 11., ground floor, door 1.) (hereinafter: service provider/controller), as controller, acknowledges that the contents of this notice are binding upon it.
The controller undertakes to ensure that all processing connected with its activities meets the requirements of this policy, applicable national legislation and legal acts of the European Union.
The controller reserves the right to amend this notice at any time, provided that clients are notified of any changes in due time.
The controller is committed to protecting clients’ personal data and considers respect for their right to informational self-determination particularly important.
The controller treats personal data confidentially and takes all security, technical and organisational measures necessary to guarantee data security.
The following terms have the meanings set out below:
Personal data: any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, particularly by reference to an identifier such as a name, number, location data, online identifier, or one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity.
Data subject: a natural person identified or identifiable on the basis of personal data.
Controller: a person who, alone or jointly with others, determines the purposes and means of processing personal data, makes and implements decisions concerning processing, or instructs a processor to implement them; under this policy, Dr. Névery Péter, practising as an individual attorney.
Client: a data subject who has entered into, or wishes to enter into, a legal relationship with the controller.
Business partner: a business in a contractual relationship with the controller.
Data transfer: making data available to a specified third party.
Processor: a natural or legal person, or an organisation without legal personality, processing personal data on behalf of or on instructions from the controller within the framework and conditions laid down by law or a binding legal act of the European Union.
International data transfer: a transfer to a controller or processor processing data in a non-EEA country.
Special categories of personal data: all data in the special categories, namely data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership; genetic data; biometric data for uniquely identifying a natural person; health data; and data concerning a natural person’s sex life or sexual orientation.
2. Personal data, purposes, legal bases, retention and other provisions
The principles of processing are consistent with applicable data protection legislation, particularly:
Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.);
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Regulation 95/46/EC (General Data Protection Regulation, GDPR);
Act LXXVIII of 2017 on Legal Practice (Üttv.);
Act V of 2013 on the Civil Code (Ptk.);
Act C of 2000 on Accounting (Accounting Act).
As detailed below, processing may rely on:
Compliance with a statutory obligation or processing authorised by law (“processing necessary for compliance with a legal obligation”), Article 6(1)(c) GDPR;
Performance of a legal-services engagement agreement (“processing necessary for performance of a contract”), Article 6(1)(b) GDPR;
Pursuit of the controller’s legitimate interests (“processing necessary for legitimate interests”), Article 6(1)(f) GDPR;
The client’s consent in a separate declaration following separate prior information (“processing based on consent”), Article 6(1)(a) GDPR.
The controller is not responsible for legal consequences arising from the provision of false or misleading data.
The controller processes data primarily on paper and secondarily by automated means; in both cases the physical processing location is its registered office.
The controller does not transfer data subjects’ personal data to a foreign third country or international organisation outside the European Union or EEA, except with the data subject’s express approval and on the terms recorded in a written declaration by the parties, with safeguards complying with the GDPR. This restriction does not cover Article 45 GDPR: if the destination country and/or international organisation is covered by a valid Commission adequacy decision, no separate authorisation is required. At the date of this document, adopted adequacy decisions are in force for Andorra, Argentina, the Faroe Islands, Guernsey, Israel, Jersey, Canada, the Isle of Man, Switzerland, Uruguay, the USA (Privacy Shield) and New Zealand; the adequacy procedures for Japan and South Korea are ongoing.
The controller informs data subjects that, having regard to the closing wording of recital 91 GDPR, no impact assessment has been carried out and no data protection officer has been appointed.
2.1. Legal services
The controller provides the services specified in the Legal Practice Act to clients approaching it (hereinafter: Client(s)); together these are referred to as legal services, provided under an engagement granted in accordance with Chapter V of that Act (hereinafter: engagement).
Purpose: performing the engagement, the Client’s instructions and all directly connected operations serving that purpose and the Client’s interests; informing the Client to ensure compliance with relevant legal requirements, including decisions of authorities, courts or other persons, organisations or public bodies authorised to issue binding normative acts; recording the Client’s declarations in documents; and enforcing and recovering claims arising in connection with the engagement. In providing legal services, the controller complies with statutory client-identification, client and case registration, document-handling and other reporting obligations applicable to attorneys. Where required by law, it may transfer the data subject’s personal data to competent authorities for those reporting purposes.
Legal bases: processing necessary for performance of a legal-services contract, pursuit of legitimate interests and compliance with legal obligations.
General personal data processed: the data may vary with the engagement, but primarily comprise personal data supplied by the Client in the engagement document (typically the engagement agreement and statement of facts) and annexes, and all further information provided during performance and/or learned by the attorney. This may include special-category data of the Client or another data subject within the limits laid down by law and the document relating to the engagement agreement.
Retention: for the duration of the engagement and thereafter, under sections 46 and 53 of the Legal Practice Act, the attorney must process and retain engagement-related data for five (5) years after termination, or ten (10) years for electronic documents; data and documents relating to countersigned instruments must be retained for ten (10) years after termination, consistently with Article 6(1)(c) GDPR and, for special-category data, Article 9(2)(g) GDPR.
Possible consequence of not providing data: the engagement cannot be entered into.
Processors: the controller uses the following processors to fulfil the purposes in this section.
Recipient
Registered office
Data disclosed
Purpose
Processor’s task
Google Llc.1
1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Data recorded during the legal engagement
Storage of electronic documents relating to the engagement and its performance (Google Drive)
Data storage and archiving
Microsec Zrt.
1031 Budapest, Záhony utca 7., Building D
Data recorded during the legal engagement
Storage of electronic case files relating to the engagement and its performance
Qualified archival storage
Disclosure:
The controller may share personal and special-category data learned during legal services with its employees, lawful substitutes acting in its place (typically attorneys authorised under the Legal Practice Act and engagement agreement), and/or persons authorised by the client (typically the client’s representative), to the extent necessary to perform the engagement.
If the legal services involve representation in proceedings for entry into an authentic public register or drafting a document forming the basis of such entry, the controller must electronically consult the competent official register to verify the client’s identity, address and validity of the supporting identity documents. For other legal services, this requires separate client consent in the engagement agreement. Verification may cover the data listed in section 32(3) of the Legal Practice Act.2 If verification shows that a document has been reported lost, stolen or destroyed and its recovery has not been recorded, the attorney must, to prevent unauthorised use, immediately report the facts in writing to the police department competent at the place of use and simultaneously make an expedited notification.
Possible consequence of not providing data: legal services cannot be provided.
Possible consequence of not providing data: legal services cannot be provided to the data subject. The data subject may object as described in section 5.
1 The international transfer complies with the GDPR and the Information Act, particularly because the processor operates under an agreement approved by the EU–US Privacy Shield.
2 a) Natural-person identification data; b) nationality, statelessness, refugee, immigrant, settled or EEA-citizen status; c) address; d) facial image; e) signature; f) facts under section 18(5) of Act LXVI of 1992 on the Register of Citizens’ Personal Data and Addresses; g) data under section 24(1)(f) of Act XII of 1998 on Travel Abroad and the document’s validity period; h) data under section 8(1)(b)(ba)–(bb) of Act LXXXIV of 1999 on the Road Traffic Register; i) data under section 76(d) and section 80(1)(b)–(c) of Act I of 2007 on the Entry and Residence of Persons with the Right of Free Movement and Residence, and section 95(1)(g), section 96(1)(g) and section 100(1)(b)–(c) of Act II of 2007 on the Entry and Residence of Third-Country Nationals.
2.2. Statistical analysis of engagements, communication and monitoring services used
Purpose: statistical analysis concerning legal services, communication with clients using the services and monitoring the services used.
Legal basis: processing necessary for legitimate interests.
Data: surname, first name, email address, telephone number, subject of the matter and meeting date.
Retention: five years after termination of the engagement.
Processor: the controller uses the following processor to fulfil this section’s purposes.
Recipient
Registered office
Data disclosed
Purpose
Task
Google Llc.3
1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Surname, first name, email address, meeting date
Contacting and communicating with the Client and making offers for legal services
Email services: recording, storage, deletion, etc.
Possible consequence of not providing data: legal services cannot be provided to the data subject. The data subject may object as described in section 5.
3 The international transfer complies with the GDPR and the Information Act, particularly because the processor operates under an agreement approved by the EU–US Privacy Shield.
2.3. Collecting visitor data on www.snlegal.hu
www.snlegal.hu does not use cookies and therefore do not install data files on the visitor’s computer for data collection.
The website(s) use the user access log of Web-server Kft. (company registration number: 09-09-011599; tax number: 13498454-2-09; registered office: 4025 Debrecen, Pásti utca 2., first floor, door 5) to collect traffic data, recorded using AWStat (https://awstats.sourceforge.io). In our view, the data collected when visiting the website do not allow identification of a natural person and therefore are not personal data and the processing is not personal-data processing.
Purpose: collecting and analysing visitor data for www.snlegal.hu for marketing purposes.
Legal basis: legitimate interests.
Data: visit date and time, IP address, referrer, browser version, operating-system type and visited subpages.
Retention: no more than two years after the visit.
Processor: the controller uses the following processor.
Recipient
Registered office
Data disclosed
Purpose
Task
Web-server Kft.
4025 Debrecen, Pásti utca 2., first floor, door 5
Visit date and time, IP address, referrer, browser version, operating-system type
Collecting website traffic data
Recording, storage, organisation, deletion, etc.
Possible consequence of not providing data: inability to visit the website or use of reduced functionality. The data subject may object under section 5.
2.4. Requests for legal services through www.snlegal.hu, email or telephone
The controller processes certain personal data of persons requesting offers through the interface on www.snlegal.hu, email or telephone as follows. This section also applies to applications submitted through those website(s).
Purpose: making offers for legal services meeting the Client’s needs, and initiating and maintaining contact before the engagement.
Legal bases for processing, disclosure and processor operations: performance of a contract and legitimate interests.
Data: surname, first name, email address, telephone number and any other personal data provided by the Client in the message or by telephone.
Retention: deletion immediately if the request for legal services is rejected, and in any event no later than two years after recording. If an engagement is entered into, section 2.1 governs processing and deletion.
Processor: the controller uses the following processor.
Name
Registered office
Data
Purpose
Task
Google Llc.4
1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Name, email address and any other personal data supplied by the Client in the message
Contact and communication with the Client and offers for legal services
Organisation and storage of data
Possible consequence of not providing data: legal services cannot be provided. The data subject may object under section 5.
4 The international transfer complies with the GDPR and the Information Act, particularly because the processor operates under an agreement approved by the EU–US Privacy Shield.
2.5. Processing relating to the controller’s business partners
The controller processes the data of contact persons at business partners with whom it has a contractual relationship as follows.
Purpose: communication with business partners to provide or receive contractual services.
Legal basis for processing, disclosure and processor operations: performance of a contract.
Possible consequence of not providing data: the business relationship cannot be established or may end.
5 The international transfer complies with the GDPR and the Information Act, particularly because the processor operates under an agreement approved by the EU–US Privacy Shield.
2.6. Invoicing
The processor uses and stores the data of individual clients and individual/sole-trader business partners to issue invoices and keep accounting records.
Purpose: processing necessary for invoicing and accounting to fulfil obligations under the Accounting Act and tax legislation.
Legal bases: compliance with a legal obligation and performance of a contract.
General personal data: surname, first name, billing address and sole trader’s tax number.
Retention: eight years plus two years after termination of the contract (the current tax year and the tax year following the statutory deadline), having regard to section 169(2) of the Accounting Act.
Processors: the following processors are used.
Name
Registered office
Data disclosed
Purpose
Task
Kulcs-Szoft Nyrt.
1016 Budapest, Mészáros utca 13.
Surname, first name, billing address, sole trader’s tax number
Compliance with the Accounting Act
Issuing invoices under accounting and tax legislation
Szokol és Társa Kft.
1046 Budapest, Kőrösbánya utca 26–28., I./1.
Surname, first name, billing address, sole trader’s tax number
Compliance with the Accounting Act
Accounting under accounting and tax legislation
Possible consequence of not providing data: a contract with the controller cannot be entered into.
3. Storage of personal data and security of processing
The controller’s IT systems and data-storage locations are at its registered office and those of its processors.
The controller selects and operates the IT equipment used for its services so that the data are: a) accessible to authorised persons (availability); b) authentic and capable of authentication (authenticity); c) capable of being verified as unchanged (integrity); and d) protected against unauthorised access (confidentiality).
The controller protects data through appropriate measures against unauthorised access, alteration, transfer, disclosure, deletion or destruction, accidental loss or damage, and inaccessibility resulting from changes in technology.
To protect electronically processed files in its registers, appropriate technical solutions ensure that stored data cannot be directly linked or attributed to a data subject unless permitted by law.
Taking account of technological development, the controller uses technical and organisational measures providing protection appropriate to processing risks, particularly:
Computer authentication with passwords of at least eight characters, accessible only to responsible persons;
Antivirus and anti-vulnerability software protecting electronic devices and data against unlawful processing and unauthorised access;
Backups and recovery of access to data and systems to prevent damage and loss;
Instructions to responsible persons to preserve the confidentiality of information and processing, avoid leaving credentials unattended and avoid leaving workstations accessible during processing sessions;
Measures ensuring systems’ reliability, integrity, availability and resilience and the availability and accessibility of data during physical or technical incidents;
Appropriate staff training.
During processing the controller preserves: a) confidentiality, so only authorised persons may access information; b) integrity, protecting the accuracy and completeness of information and processing methods; c) availability, so authorised users can access information and related facilities when needed.
The controller’s and its partners’ IT systems and networks are protected against computer-assisted fraud, espionage, sabotage, vandalism, fire, flooding, computer viruses, intrusion and denial-of-service attacks. The operator ensures security through server-level and application-level protection.
Users are informed that electronic messages transmitted over the internet, regardless of protocol (email, web, FTP, etc.), are vulnerable to network threats leading to dishonest activity, contractual disputes, disclosure or alteration of information. The controller takes all reasonably expected precautions against these threats. It monitors systems to record security deviations and provide evidence of security incidents. Monitoring also permits assessment of the effectiveness of precautions.
The controller ensures that responsible persons process data in accordance with the GDPR, applicable national data protection law and/or the controller’s good practices and/or valid internal procedures, particularly that they: a) process data lawfully and appropriately only for their duties and related purposes; b) access data only to fulfil their duties and avoid access and processing where not strictly necessary; c) do not share or disclose data without the controller’s prior authorisation; d) ensure the greatest possible confidentiality; e) continuously check data for currency, completeness and relevance.
4. Controller’s details and contact information
Name: Dr. Névery Péter Address: 1016 Budapest, Szirtes út 11., ground floor, door 1. tax number: 50233126-2-41; statistical identification number: 50233126 6910 232 01; KASZ: 36066302; register number: 19459 Phone: +36 20 580 8850 Email: peter.nevery@snlegal.hu
Person responsible for data protection: Dr. Névery Péter Phone: +36 20 580 8850 Email: peter.nevery@snlegal.hu
5. Data subjects’ rights and remedies
Data subjects may request information about processing, rectification of their personal data, and—except for mandatory processing—erasure and withdrawal. They may exercise portability and objection rights as indicated when data were collected or through the controller’s contact details above.
Right to information under the GDPR
The controller takes appropriate measures to provide all information under Articles 13 and 14 and communications under Articles 15–22 and 34 GDPR concerning personal-data processing in a concise, transparent, intelligible and easily accessible form, using clear and plain language.
This right may be exercised in writing through the contacts in sections 1 and 4. On request and following verification of identity, information may also be provided orally.
Right of access
Data subjects are entitled to confirmation of whether their personal data are being processed and, if so, access to the data and information on: purposes; categories of data; recipients or categories of recipients to whom data have been or will be disclosed, particularly third-country recipients and international organisations; intended retention period; rights to rectification, erasure, restriction and objection; the right to complain to a supervisory authority; sources of data; existence of automated decision-making, including profiling; meaningful information about the logic involved and its significance and expected consequences. Where data are transferred to a third country or international organisation, data subjects may request information on appropriate safeguards.
The controller provides a copy of the personal data processed. For additional copies requested, it may charge a reasonable fee based on administrative costs. Information is provided electronically on request.
Information is provided no later than one month after submission of the request.
Right to rectification
Data subjects may request correction of inaccurate personal data and completion of incomplete data.
Right to erasure
Data subjects may request erasure without undue delay where: the data are no longer necessary for the purposes of collection or other processing; consent is withdrawn and no other legal basis exists; an objection is made and there are no overriding legitimate grounds; data were processed unlawfully; erasure is required by Union or Member State law applicable to the controller; or data were collected in connection with the offer of information-society services.
Erasure cannot be requested where processing is necessary for freedom of expression and information; compliance with an applicable Union or Member State obligation requiring processing, or a task in the public interest or exercise of official authority; public-interest grounds in public health, archiving, scientific or historical research or statistics; or establishment, exercise or defence of legal claims.
Right to restriction
The controller restricts processing on request if: the accuracy of personal data is contested, for the period needed to verify it; processing is unlawful and the data subject opposes erasure and requests restricted use instead; the controller no longer needs the data but the data subject requires them for legal claims; or the data subject has objected, pending verification of whether the controller’s legitimate grounds override those of the data subject.
Restricted data, apart from storage, may be processed only with consent, for legal claims, to protect another natural or legal person’s rights or for important Union or Member State public interests.
The controller informs the data subject before lifting a restriction.
Right to data portability
Data subjects may receive personal data concerning them that they supplied to the controller in a structured, commonly used, machine-readable format and transmit them to another controller.
Right to withdraw consent
Consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of consent-based processing before withdrawal.
Procedural rules
The controller informs the data subject of action taken on a request under Articles 15–22 GDPR without undue delay and no later than one month after receipt. Where necessary, considering the complexity and number of requests, this may be extended by two further months.
The controller informs the data subject of an extension and the reasons for delay within one month of receipt. For electronic requests, information is provided electronically unless otherwise requested.
If no action is taken, the controller informs the data subject without delay and within one month of the reasons, and of the right to complain to a supervisory authority and seek a judicial remedy.
Information and communications are free of charge. For manifestly unfounded or excessive requests, particularly repetitive ones, the controller may charge a reasonable fee taking account of administrative costs or refuse to act.
The controller communicates rectification, erasure or restriction to each recipient to whom personal data were disclosed, unless impossible or requiring disproportionate effort, and informs the data subject of these recipients on request.
The controller provides a copy of personal data processed. A reasonable administrative-cost-based fee may be charged for further copies. For electronic requests, information is provided electronically unless otherwise requested.
Compensation for material and non-material damage
Any person suffering material or non-material damage because of a GDPR infringement is entitled to compensation from the controller or processor. A processor is liable only where it failed to comply with obligations specifically imposed on processors or acted outside or contrary to the controller’s lawful instructions.
Where several controllers or processors, or both, are involved in the same processing and are responsible for resulting damage, each is jointly and severally liable for the entire damage.
A controller or processor is exempt from liability if it proves that it is in no way responsible for the event giving rise to the damage.
Complaint to the person responsible for data protection
If you have concerns about processing, please contact:
Name: Dr. Névery Péter Address: 1016 Budapest, Szirtes út 11. Phone: +36 20 580 8850 Email: peter.nevery@snlegal.hu
Right to bring court proceedings
If data subjects’ rights are infringed, they may bring proceedings against the controller. The court deals with the case as a priority.
Proceedings before the data protection authority
Complaints may be lodged with the Hungarian National Authority for Data Protection and Freedom of Information:
Name: Nemzeti Adatvédelmi és Információszabadság Hatóság Registered office: 1125 Budapest, Szilágyi Erzsébet fasor 22/C. Postal address: 1530 Budapest, Pf. 5. Telephone: 06-1-391-1400 Fax: 06-1-391-1410 Email: ugyfelszolgalat@naih.hu Website: http://www.naih.hu
Legal notice
Dr. Simányi Zsolt, attorney-at-law, as the managing member, and Dr. Névery Péter and Dr. Péntek Bálint, attorneys-at-law, as members, practise within Simányi és Névery Ügyvédi Társulás (the “Association”), established and registered in accordance with Regulation No. 2/2006 (III.20.) of the Hungarian Bar Association.
This website is maintained by the Association registered with the Budapest Bar Association, in accordance with the legislation and internal regulations applicable to attorneys. These, together with information on clients’ rights, are available at www.magyarugyvedikamara.hu.
Accordingly, neither the www.snlegal.hu website operated by the Association nor its content constitutes an offer to provide legal advice or any other legal service that may be provided by the Association or its members, an invitation to make an offer, a fee quotation, or an invitation or offer to enter into a legal services agreement. In any specific matter, the Association provides legal advice or services solely through a personal consultation and after accepting an engagement to provide legal services.
