From the day-to-day operation of a business to complex investment projects and dispute resolution.
Litigation and out-of-court representation
Civil and commercial disputes, and claims arising from breach of contract or defective performance.
Read more +
Developing legal and evidentiary strategies, preparing statements of claim and defence, representation at hearings and handling appeals. Alongside proceedings, we assess settlement opportunities and assist with out-of-court resolution.
Industrial and EPC projects
Contractual and legal support for projects encompassing engineering, procurement and construction.
Read more +
Preparing and negotiating main contractor and subcontractor agreements, and addressing performance conditions, deadlines, security and liability. We assist with contract amendments, additional works, handover and acceptance, statutory and contractual warranty claims, and disputes arising during projects.
Corporate law and M&A
Company formation, corporate changes, ownership transactions and acquisitions.
Read more +
Drafting constitutional documents, members’ and other corporate resolutions, share transfers and agreements required for company operations. We also provide legal support for transactions involving transformations, acquisitions and mergers.
Business and commercial law
Ongoing corporate legal support and business contracts in Hungarian and other languages.
Read more +
Preparing sale, supply, works, services and lease agreements, general terms and conditions, and statutory and contractual warranty documentation. We assist with assessing contractual risks, negotiations and the legal aspects of international business relationships.
Real estate law and development
Legal support for purchases, leases, land subdivision and development projects.
Read more +
Preparing real estate transactions and related documents, examining title and encumbrances, and representation in land registry proceedings. We also assist with land exchanges, agreements relating to land subdivision, development and construction contracts, and real estate disputes.
Debt recovery and insolvency
Resolving outstanding debts, payment orders, enforcement and creditor representation.
Read more +
Payment demands, settlements and instalment agreements, and pursuing claims in contentious and non-contentious proceedings. We represent creditors in initiating liquidation proceedings and lodging claims, as well as in legal matters relating to enforcement.
Employment law
Supporting employers and employees from the start of employment through to dispute resolution.
Read more +
Preparing employment contracts, internal policies and agreements, and advising on changes to and termination of employment. We assist with employment claims, compensation claims and labour disputes.
Data protection
Legal structuring of corporate data processing and data protection documentation.
Read more +
Preparing privacy notices, internal policies and data processing agreements. We also provide legal support for employee data processing, camera systems and data protection impact assessments, and review data processing practices.
Damages and insurance disputes
Contractual and non-contractual damage, and claims against insurers.
Read more +
Examining liability and evidentiary options, and legally assessing damage and related claims. We support clients in submitting claims, settlement negotiations and, where necessary, litigation.
Succession and probate
Inheritance matters, probate proceedings and representation of heirs.
Read more +
Advising on inheritance, preparing and reviewing testamentary dispositions, and representation in probate proceedings. We assist with inheritance settlements and the resolution of succession disputes.
Intellectual property
Creative works, commercially valuable intellectual assets and licensing arrangements.
Read more +
Legal support for intellectual property rights, usage and licence agreements, and confidentiality agreements. We assist clients in establishing contractual protection and handling related disputes.
Civil law and legal drafting
Contracts, agreements and property matters for businesses and individuals.
Read more +
Reviewing proposed transactions and drafting, amending and reviewing contracts and other legal documents. We aim to define clients’ rights and obligations clearly and prevent subsequent disputes.
OUR COLLEAGUES
Our team
Dr. Simányi Zsolt
Managing member, attorney-at-law
Corporate law · EPC projects Employment law · data protection
Biography +
He graduated in law from Pázmány Péter Catholic University in 2004, summa cum laude. He subsequently completed a programme at Fordham University’s Institute of American Language and Culture in New York. Before taking the Hungarian bar examination, he gained extensive experience in criminal and administrative law alongside civil law. In 2009, he founded Simányi és Társa Law Office and became a member of the Budapest Bar Association. He is a founding and managing member of Simányi és Névery Attorneys’ Association.
His practice currently focuses primarily on civil law. Previously, he acted as defence counsel in criminal matters, provided legal services in administrative matters and served on the supervisory boards of public foundations.
He primarily provides comprehensive legal support to foreign-owned businesses and companies with international business relationships. His main practice areas are corporate, business and commercial law, employment law, data protection and comprehensive legal support for EPC projects. The latter includes preparing and negotiating contracts for engineering, procurement and construction projects, handling legal issues during implementation and resolving related claims and disputes. He represents clients in litigation and out-of-court enforcement and also accepts instructions from individuals in civil matters.
He works in Hungarian and English, drafting documents and conducting negotiations in both languages.
Dr. Névery Péter
Founding member, attorney-at-law
Litigation · debt recovery EPC projects · business contracts
Biography +
He obtained his law degree from the Faculty of Law of Eötvös Loránd University in 2007. He has practised as a member of the Budapest Bar Association since 2012. He is a founding member of Simányi és Névery Attorneys’ Association.
His practice centres on civil and commercial disputes and pursuing claims in and out of court. He represents businesses and individuals in contractual, real estate, damages and employment matters. He regularly handles disputes arising from breach of contract, defective performance and statutory and contractual warranties, as well as payment order, enforcement and liquidation proceedings.
He also provides ongoing legal support to Hungarian and foreign-owned companies, prepares and negotiates business contracts and handles real estate transactions. Together with Dr. Simányi Zsolt, he supports industrial and EPC projects by assisting with engineering, procurement and construction contracts, legal issues arising during performance and the resolution of related claims. His particular focus in this work is on preventing disputes and representing clients in litigation.
He works in Hungarian, English and Slovak. He also supports clients with international business relationships in multilingual contractual settings.
Dr. Ruszthi Hunor
Cooperating partner, attorney-at-law
Real estate · corporate law and M&A Sports law · intellectual property
Biography +
He obtained his law degree from the Faculty of Law of Pázmány Péter Catholic University in 2004. He completed the coursework of the university’s doctoral school in 2006 and earned an LL.M. qualification in sports law at the Deák Ferenc Further Training Institute in 2026. For several years, he taught, led courses and examined students at Pázmány Péter Catholic University and colleges in Budapest. He has been a member of the Budapest Bar Association since 2008.
His main practice areas are real estate, corporate and commercial law, sports law and intellectual property. He provides ongoing legal representation to major companies in various industries and regularly supports real estate development projects. He represents clients in a substantial number and value of mergers and acquisitions across different sectors and provides comprehensive legal services in these areas to both long-standing and occasional clients.
He works in Hungarian and English.
Dr. Péntek Bálint
Member of the association, attorney-at-law
Corporate law · employment law Real estate · debt recovery
Biography +
He graduated in law from the Faculty of Law of Pázmány Péter Catholic University in 2013 and passed the Hungarian bar examination in 2019. He has worked with Simányi és Társa Law Office and attorneys Dr. Simányi Zsolt and Dr. Névery Péter since February 2015. He has practised as a member of the Budapest Bar Association since 2020 and is a member of Simányi és Névery Attorneys’ Association.
His practice primarily covers corporate, employment and real estate law and debt recovery. In these areas, he provides comprehensive legal advice and representation to Hungarian and foreign-owned small and medium-sized enterprises, individuals and non-profit organisations.
He works in Hungarian and English.
Dr. Tóth Márk
Trainee lawyer
Real estate · corporate law Debt recovery
Biography +
He obtained his law degree from the Faculty of Law of Eötvös Loránd University in 2023. He began his career at a Budapest law firm, where he primarily handled media law matters.
He has been a trainee lawyer at Simányi és Névery Attorneys’ Association since 2025. He is currently preparing for the Hungarian bar examination.
He works in Hungarian and English.
Dr. Hegedűs Péter
Trainee lawyer
Civil law · corporate law Preparing litigation matters
Biography +
He obtained his law degree from the Faculty of Law of Pázmány Péter Catholic University. He began his career as an intern at a Budapest law firm, primarily working on real estate matters. He is currently a trainee lawyer at Simányi és Névery Attorneys’ Association.
He has gained experience primarily in civil and corporate law and debt recovery. His work includes assisting with the preparation of contentious and non-contentious proceedings and drafting contracts and other legal documents.
He works in Hungarian and English.
OUR PROFESSIONAL ARTICLES
Our articles on LinkedIn
Dr. Névery Péter · · English translation
Technical online shops entering Hungary – is there still room for regional players?
Opportunities for specialist technical online shops to expand into Hungary, from spare parts and lubricants to office equipment. The role of expertise, inventory and logistics in regional competition.
Read the full article +
English translation of the Slovak LinkedIn article.
Electronics is one of the most competitive segments of online retail. Technical e-commerce, however, is not just about laptops and televisions. Online shops specialising in car parts, filters, oils or office equipment may follow a very different growth logic.
A technical online shop may have an advantage precisely because it does not offer everything. Expertise, stock availability and timely delivery of the right part are values that online marketplaces cannot always replace.
Alza’s example: the Czech model can scale in Hungary too
The Hungarian operations of Czech-owned Alza.hu Kft. are among the strongest examples of a regional e-commerce business becoming a local market leader. Based on 2025 online turnover, PwC once again ranked it first in Hungary.
For smaller businesses, however, the point is not to copy Alza. The more interesting question is whether there are technical niches in which customers seek the right product, expert advice and reliable delivery rather than the market’s broadest catalogue.
Car parts are a typical example of specialisation
Slovak company AUBIRI specialises in spare parts for vans and commercial vehicles. According to E-commerce Slovakia, its annual turnover exceeds EUR 3.7 million; it operates in five countries and stocks more than 30,000 products in its own warehouse. Its advantage lies in detailed knowledge of individual vehicles and the rapid availability of parts, rather than a general assortment.
Similarly, Filtreaoleje, operated by Slovak company ERING, has annual turnover of approximately EUR 8.7 million. It offers oils, filters and operating fluids for cars, motorcycles, machinery and industrial use. These products have natural cross-border potential: demand is similar on both sides of the border, and customers often search by precise technical specifications.
Less romance, more data and logistics
Technical e-commerce depends on different factors from fashion or beauty retail. Search quality, accurate compatibility, stock availability, dispatch speed, the number of product codes and the ability to answer technical questions directly affect conversion rates.
Hungary is geographically attractive for Slovak online shops. A central warehouse in western or central Slovakia can serve part of Hungary almost as quickly as its domestic market. Products bought repeatedly, such as oils, filters, consumables and spare parts, can also help establish a stable customer base quickly.
TonerPartner: from a narrow category to regional e-commerce
TonerPartner is an interesting Czech example. Founded in Ostrava in 2014, it has operated in Hungary since 2018 and is now present in nine countries. It processes more than 4,700 shipments a day. It gradually expanded its initially narrow toner range to printers, scanners, 3D printing, office, household and workshop products.
This story illustrates one possible expansion model: first succeed in a specific category, establish a logistics and marketing model, and only then broaden the range.
Where might there still be room today?
Entering Hungary need not mean competing for the entire electronics market. Spare parts for particular brands, professional tools, operating fluids, specialist electronics, industrial accessories and technical hobby products may be more promising.
For businesses such as AUBIRI or Filtreaoleje, the more relevant question is therefore whether they can translate their existing expertise and stock advantage into Hungarian-language sales and distribution, rather than whether they can beat the largest players on price.
This may be precisely where the next wave of regional technical online shops can find an opportunity.
Hungary as the next e-commerce market – where is there room for Czech and Slovak online shops?
Growth in Hungary’s online market, the success of regional brands and promising product categories. How can localisation, reliable logistics and a good customer experience support market entry?
Read the full article +
English translation of the Slovak LinkedIn article.
Hungary’s online market has long ceased to be a closed domestic arena. It is growing, imports account for a substantial share of turnover, and Czech and Slovak brands are already demonstrating that regional expansion can work.
Hungary need not be viewed as a distant “new country”. For a successful Czech or Slovak online shop, it may be a natural next step within Central Europe.
Hungary’s online market is larger than it first appears
According to PwC’s latest research, Hungary’s e-commerce market continues to expand in 2026. In the first quarter it grew by 14.2% year on year, while the number of online shoppers approached 4.4 million. In the second quarter, Hungarian shoppers completed 25.8 million online transactions, and total online retail spending including imports approached HUF 535 billion.
One figure is particularly significant: imports now account for almost one fifth of the online market. Hungarian consumers are therefore accustomed to buying from foreign retailers. A regional online shop is not entering a market in which customers first need to learn cross-border shopping; the habit already exists.
Czech and Slovak businesses are already among the leaders
The clearest evidence is the ranking of Hungary’s largest online retailers. Alza.hu Kft. again took first place in 2025, followed by Kifli.hu of the Rohlik Group. Notino is also among the best-known online brands. These are not isolated successes, but brands that have become major players in Hungarian e-commerce.
There are similar examples beyond the biggest players: GymBeam has built a substantial Hungarian market in sports nutrition; Bonami and Kondela in home furnishings; Footshop in streetwear; and MTBIKER and 4camping in sports and outdoor products.
Which segments are most interesting?
Several categories in Czech and Slovak e-commerce regularly show potential for cross-border expansion: technical products and car parts, furniture and home accessories, sports and outdoor equipment, cosmetics, fashion and footwear, functional foods and healthy living, and pet products.
Each segment has its own logic. In car parts, stock range and accurate vehicle-model searches may be decisive. In home furnishings, visual presentation and bulky-goods logistics matter. In beauty or fashion, brand, community and content are important. The common denominator is that a regional player need not be the biggest if it can offer a more compelling proposition in one category than a general-purpose online marketplace.
Service matters increasingly alongside price
PwC’s latest data indicate that competition in Hungary is moving beyond simple price comparisons towards the overall customer experience. Payment, product availability, delivery speed, easy returns and quality communication are now decisive alongside price.
This is good news for regional online shops. They need not win a price war against global platforms. They can succeed through greater expertise, reliability and flexibility. In 2026, almost half of Hungary’s online shoppers already prefer parcel lockers, and the network has exceeded 10,000 lockers. The logistical obstacles to regional expansion are therefore gradually diminishing.
Hungary as a natural part of a regional strategy
Slovak businesses benefit from immediate geographical proximity. For Czech online shops, Hungary is often a logical continuation of a Czech–Slovak–Polish–Romanian or Czech–Slovak–Austrian–Polish model. Services already exist for localisation, Hungarian customer service, local return addresses and market research, without having to build everything in-house.
CzechTrade also confirms the relevance of this topic: on 30 September 2026 it is organising a free seminar entitled “Marketplaces pro export”, with a separate session on Poland and Hungary, customer behaviour and market-entry opportunities through online marketplaces.
This series will therefore not argue that every online shop should enter Hungary. Instead, it will examine individual segments and businesses for which the question “Should Hungary be our next market?” may make genuine business sense.
Industrial investment in a weaker construction market – where are the opportunities for Slovak suppliers?
Industrial projects and plant expansions can create targeted opportunities for specialist suppliers. The article examines technical work packages, operating requirements in Hungary and key subcontracting issues.
Read the full article +
English translation of the Slovak LinkedIn article.
Viewed as a whole in autumn 2026, Hungarian construction does not present an unambiguously optimistic picture. In July, construction output fell by 12.2% year on year, while building construction fell by 10.7%.
In the same month, however, Hungarian industrial output rose by 4.7% year on year and was 2.7% higher over the first seven months than in the same period of 2025.
This difference may be of interest to Slovak businesses too.
Hungary’s construction industry is not experiencing a general boom. Nevertheless, industrial investment continues to create concentrated markets with demand for specialist construction and technological expertise.
The pipeline of planned investment has not stopped either. In July, the Hungarian Investment Promotion Agency (HIPA) announced the resumption of investment-incentive decisions and continued negotiations on several new and expansion projects.
It is not just car factories being built
Industrial investment in Hungary is often associated mainly with automotive and battery manufacturing. Current projects, however, present a much broader picture.
In Jászárokszállás, Italian company Weger is investing EUR 24.6 million, including a new production hall of approximately 10,000 m². The plant will also use automated manufacturing technologies, a solar power system and energy storage.
In Vésztő, Electraplan E-SOLAR and Niedax Group are building a joint industrial complex worth EUR 72.5 million. The project covers more than 23,000 m² and includes a production hall, warehouse, direct rail connection, solar power and energy storage.
In Szigetszentmiklós, Danish company Xellia Pharmaceuticals is preparing an automated pharmaceutical manufacturing plant for EUR 70.85 million. It includes production space, warehouse capacity, technical infrastructure and modern support systems.
In Orosháza, Turkish company Doğuş Çay’s EUR 109.6 million investment includes comprehensive refurbishment of existing buildings, new production capacity and energy upgrades.
This therefore concerns more than one industry. Pharmaceuticals, food production, engineering, electronics and energy technology each create their own demand for construction and technological suppliers.
Expanding operating plants is a market in its own right
A current example is the expansion of Flex’s Zalaegerszeg plant. In September, construction of the new warehouse and office building of approximately 8,000 m² reached the structural stage.
An important feature of the project is that it is being carried out while the existing manufacturing plant remains in continuous operation.
Such projects place different demands on suppliers from traditional greenfield investment. Valuable capabilities include experience in active manufacturing environments, coordinating shutdowns, complying with safety procedures, connecting new systems to existing technologies and minimising disruption to production.
Many Slovak companies have strong references from overseas projects precisely in these areas.
Where is a realistic entry point for a Slovak company?
For a Slovak small or medium-sized business, becoming the main contractor on an investment worth tens or hundreds of millions of euros is generally not a realistic objective.
A clearly defined specialist work package may be much more interesting.
Examples include:
steel structure fabrication and installation;
prefabrication;
industrial electrical installation;
heating, ventilation and air conditioning (HVAC);
sprinkler and fire-protection systems;
process piping;
water and wastewater treatment;
building management systems (BMS) and automation;
industrial flooring;
roofing and façade systems;
cleanroom technologies;
industrial insulation;
crane operations and installation work;
non-destructive testing (NDT);
commissioning;
design and engineering services.
Strong references and expertise focused on a narrow field may therefore be more important to a Slovak company than the ability to deliver an entire plant.
Crossing the border also changes the legal environment
The European single market facilitates cross-border services, but it does not mean that a Slovak construction business can start work in Hungary without further administrative steps.
Under Hungarian rules, a business from another EEA member state intending to perform construction work in Hungary as a cross-border service must notify its activity to the construction contractors’ register maintained by the Hungarian Chamber of Commerce and Industry.
Since 2025, mandatory construction contractor liability insurance has also been an important entry condition, including for cross-border service providers.
Depending on the project, further matters may need to be addressed, such as:
a responsible technical manager or another appropriately qualified professional;
the electronic construction diary;
posting Slovak employees to Hungary;
occupational health and safety rules;
VAT and taxation;
the possible creation of a permanent establishment for tax purposes.
These questions should be checked before submitting a bid and signing a subcontract.
The subcontract is at least as important as the price
On large industrial projects, foreign subcontractors usually do not enter using their own contractual documentation.
They must adapt to the main contractor’s or EPC partner’s contractual system.
Particular attention should therefore be paid to defining the scope of work, change and variation-order mechanisms, additional works, contractual penalties, performance security, advance-payment guarantees, retentions, warranties, liability caps, insurance, and acceptance and certification procedures.
Hungarian construction legislation also prescribes mandatory content for construction and subcontracting agreements and makes performance of the activity subject to registration and professional requirements.
From Bratislava to Budapest: networking opportunities also exist
The timing is also interesting in terms of professional events.
The CONECO RACIOENERGIA trade fair takes place in Bratislava on 1–3 October 2026, bringing together construction, building services, energy efficiency and modern construction technologies.
In Hungary, the National Federation of Hungarian Building Contractors (ÉVOSZ) is organising a national construction conference on 29 October, covering building construction, technical trades, utility networks and building-materials manufacturing, among other topics.
CONSTRUMA and HUNGAROTHERM in Budapest on 8–11 April 2027 offer a further opportunity. For Slovak businesses in HVAC, heating, air conditioning, sanitary technology, building materials or technological solutions, these events may be useful entry points to Hungary.
On the Slovak side, the Association of the Construction Industry of Slovakia (ZSPS) is also a natural professional partner. It represents a substantial part of Slovak construction and addresses technological development, digitalisation and shortages of skilled labour.
There is no need to find the whole market – the right project is enough
Current data do not support the claim that Hungarian construction as a whole is experiencing a substantial boom.
Industrial investment, however, follows a different logic.
A pharmaceutical plant needs specialist HVAC and process systems. Food production needs hygienic piping, cooling and processing technology. An automated manufacturing plant needs quality electrical and control systems. Expanding an existing plant requires suppliers able to work while production continues.
For a Slovak construction or technology business, the general state of Hungarian construction is therefore not necessarily the most important question.
It is more important to know where an industrial project is being developed that requires precisely the expertise the business already has.
Select the privacy notice of the attorney you wish to contact.
The content and effective dates of the original supplied documents have been retained. The foreign-language versions are translations of those documents.
Simányi Ügyvédi Iroda Effective date of the notice: 1 April 2021
English translation of the supplied Hungarian notice. The content and effective date of the source document have been retained.
1. Introduction and definitions
Simányi Ügyvédi Iroda (bar registration number: 4993; registered office: 1016 Budapest, Szirtes út 11., ground floor, door 1.) (hereinafter: service provider/controller), as controller, acknowledges that the contents of this notice are binding upon it.
The controller undertakes to ensure that all processing connected with its activities meets the requirements of this policy, applicable national legislation and legal acts of the European Union.
The controller reserves the right to amend this notice at any time, provided that clients are notified of any changes in due time.
The controller is committed to protecting clients’ personal data and considers respect for their right to informational self-determination particularly important.
The controller treats personal data confidentially and takes all security, technical and organisational measures necessary to guarantee data security.
The following terms have the meanings set out below:
Personal data: any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, particularly by reference to an identifier such as a name, number, location data, online identifier, or one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity.
Data subject: a natural person identified or identifiable on the basis of personal data.
Controller: a person who, alone or jointly with others, determines the purposes and means of processing personal data, makes and implements decisions concerning processing, or instructs a processor to implement them; under this policy, Dr. Simányi Zsolt, practising as an individual attorney.
Client: a data subject who has entered into, or wishes to enter into, a legal relationship with the controller.
Business partner: a business in a contractual relationship with the controller.
Data transfer: making data available to a specified third party.
Processor: a natural or legal person, or an organisation without legal personality, processing personal data on behalf of or on instructions from the controller within the framework and conditions laid down by law or a binding legal act of the European Union.
International data transfer: a transfer to a controller or processor processing data in a non-EEA country.
Special categories of personal data: all data in the special categories, namely data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership; genetic data; biometric data for uniquely identifying a natural person; health data; and data concerning a natural person’s sex life or sexual orientation.
2. Personal data, purposes, legal bases, retention and other provisions
The principles of processing are consistent with applicable data protection legislation, particularly:
Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.);
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Regulation 95/46/EC (General Data Protection Regulation, GDPR);
Act LXXVIII of 2017 on Legal Practice (Üttv.);
Act V of 2013 on the Civil Code (Ptk.);
Act C of 2000 on Accounting (Accounting Act).
As detailed below, processing may rely on:
Compliance with a statutory obligation or processing authorised by law (“processing necessary for compliance with a legal obligation”), Article 6(1)(c) GDPR;
Performance of a legal-services engagement agreement (“processing necessary for performance of a contract”), Article 6(1)(b) GDPR;
Pursuit of the controller’s legitimate interests (“processing necessary for legitimate interests”), Article 6(1)(f) GDPR;
The client’s consent in a separate declaration following separate prior information (“processing based on consent”), Article 6(1)(a) GDPR.
The controller is not responsible for legal consequences arising from the provision of false or misleading data.
The controller processes data primarily on paper and secondarily by automated means; in both cases the physical processing location is its registered office.
The controller does not transfer data subjects’ personal data to a foreign third country or international organisation outside the European Union or EEA, except with the data subject’s express approval and on the terms recorded in a written declaration by the parties, with safeguards complying with the GDPR. This restriction does not cover Article 45 GDPR: if the destination country and/or international organisation is covered by a valid Commission adequacy decision, no separate authorisation is required. At the date of this document, adopted adequacy decisions are in force for Andorra, Argentina, the Faroe Islands, Guernsey, Israel, Jersey, Canada, the Isle of Man, Switzerland, Uruguay, the USA (Privacy Shield) and New Zealand; the adequacy procedures for Japan and South Korea are ongoing.
The controller informs data subjects that, having regard to the closing wording of recital 91 GDPR, no impact assessment has been carried out and no data protection officer has been appointed.
2.1. Legal services
The controller provides the services specified in the Legal Practice Act to clients approaching it (hereinafter: Client(s)); together these are referred to as legal services, provided under an engagement granted in accordance with Chapter V of that Act (hereinafter: engagement).
Purpose: performing the engagement, the Client’s instructions and all directly connected operations serving that purpose and the Client’s interests; informing the Client to ensure compliance with relevant legal requirements, including decisions of authorities, courts or other persons, organisations or public bodies authorised to issue binding normative acts; recording the Client’s declarations in documents; and enforcing and recovering claims arising in connection with the engagement. In providing legal services, the controller complies with statutory client-identification, client and case registration, document-handling and other reporting obligations applicable to attorneys. Where required by law, it may transfer the data subject’s personal data to competent authorities for those reporting purposes.
Legal bases: processing necessary for performance of a legal-services contract, pursuit of legitimate interests and compliance with legal obligations.
General personal data processed: the data may vary with the engagement, but primarily comprise personal data supplied by the Client in the engagement document (typically the engagement agreement and statement of facts) and annexes, and all further information provided during performance and/or learned by the attorney. This may include special-category data of the Client or another data subject within the limits laid down by law and the document relating to the engagement agreement.
Retention: for the duration of the engagement and thereafter, under sections 46 and 53 of the Legal Practice Act, the attorney must process and retain engagement-related data for five (5) years after termination, or ten (10) years for electronic documents; data and documents relating to countersigned instruments must be retained for ten (10) years after termination, consistently with Article 6(1)(c) GDPR and, for special-category data, Article 9(2)(g) GDPR.
Possible consequence of not providing data: the engagement cannot be entered into.
Processors: the controller uses the following processors to fulfil the purposes in this section.
Recipient
Registered office
Data disclosed
Purpose
Processor’s task
Google Llc.1
1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Data recorded during the legal engagement
Storage of electronic documents relating to the engagement and its performance (Google Drive)
Data storage and archiving
Microsec Zrt.
1031 Budapest, Záhony utca 7., Building D
Data recorded during the legal engagement
Storage of electronic case files relating to the engagement and its performance
Qualified archival storage
Disclosure:
The controller may share personal and special-category data learned during legal services with its employees, lawful substitutes acting in its place (typically attorneys authorised under the Legal Practice Act and engagement agreement), and/or persons authorised by the client (typically the client’s representative), to the extent necessary to perform the engagement.
If the legal services involve representation in proceedings for entry into an authentic public register or drafting a document forming the basis of such entry, the controller must electronically consult the competent official register to verify the client’s identity, address and validity of the supporting identity documents. For other legal services, this requires separate client consent in the engagement agreement. Verification may cover the data listed in section 32(3) of the Legal Practice Act.2 If verification shows that a document has been reported lost, stolen or destroyed and its recovery has not been recorded, the attorney must, to prevent unauthorised use, immediately report the facts in writing to the police department competent at the place of use and simultaneously make an expedited notification.
Possible consequence of not providing data: legal services cannot be provided.
Possible consequence of not providing data: legal services cannot be provided to the data subject. The data subject may object as described in section 5.
1 The international transfer complies with the GDPR and the Information Act, particularly because the processor operates under an agreement approved by the EU–US Privacy Shield.
2 a) Natural-person identification data; b) nationality, statelessness, refugee, immigrant, settled or EEA-citizen status; c) address; d) facial image; e) signature; f) facts under section 18(5) of Act LXVI of 1992 on the Register of Citizens’ Personal Data and Addresses; g) data under section 24(1)(f) of Act XII of 1998 on Travel Abroad and the document’s validity period; h) data under section 8(1)(b)(ba)–(bb) of Act LXXXIV of 1999 on the Road Traffic Register; i) data under section 76(d) and section 80(1)(b)–(c) of Act I of 2007 on the Entry and Residence of Persons with the Right of Free Movement and Residence, and section 95(1)(g), section 96(1)(g) and section 100(1)(b)–(c) of Act II of 2007 on the Entry and Residence of Third-Country Nationals.
2.2. Statistical analysis of engagements, communication and monitoring services used
Purpose: statistical analysis concerning legal services, communication with clients using the services and monitoring the services used.
Legal basis: processing necessary for legitimate interests.
Data: surname, first name, email address, telephone number, subject of the matter and meeting date.
Retention: five years after termination of the engagement.
Processor: the controller uses the following processor to fulfil this section’s purposes.
Recipient
Registered office
Data disclosed
Purpose
Task
Google Llc.3
1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Surname, first name, email address, meeting date
Contacting and communicating with the Client and making offers for legal services
Email services: recording, storage, deletion, etc.
Possible consequence of not providing data: legal services cannot be provided to the data subject. The data subject may object as described in section 5.
3 The international transfer complies with the GDPR and the Information Act, particularly because the processor operates under an agreement approved by the EU–US Privacy Shield.
2.3. Collecting visitor data on www.simanyi.hu and www.snlegal.hu
www.simanyi.hu and www.snlegal.hu do not use cookies and therefore do not install data files on the visitor’s computer for data collection.
The website(s) use the user access log of Web-server Kft. (company registration number: 09-09-011599; tax number: 13498454-2-09; registered office: 4025 Debrecen, Pásti utca 2., first floor, door 5) to collect traffic data, recorded using AWStat (https://awstats.sourceforge.io). the data collected when visiting the website do not allow identification of a natural person and therefore are not personal data and the processing is not personal-data processing.
Purpose: collecting and analysing visitor data for www.simanyi.hu and www.snlegal.hu for marketing purposes.
Legal basis: legitimate interests.
Data: visit date and time, IP address, referrer, browser version, operating-system type and visited subpages.
Retention: no more than two years after the visit.
Processor: the controller uses the following processor.
Recipient
Registered office
Data disclosed
Purpose
Task
Web-server Kft.
4025 Debrecen, Pásti utca 2., first floor, door 5
Visit date and time, IP address, referrer, browser version, operating-system type
Collecting website traffic data
Recording, storage, organisation, deletion, etc.
Possible consequence of not providing data: inability to visit the website or use of reduced functionality. The data subject may object under section 5.
2.4. Requests for legal services through www.simanyi.hu and www.snlegal.hu, email or telephone
The controller processes certain personal data of persons requesting offers through the interface on www.simanyi.hu and www.snlegal.hu, email or telephone as follows. This section also applies to applications submitted through those website(s).
Purpose: making offers for legal services meeting the Client’s needs, and initiating and maintaining contact before the engagement.
Legal bases for processing, disclosure and processor operations: performance of a contract and legitimate interests.
Data: surname, first name, email address, telephone number and any other personal data provided by the Client in the message or by telephone.
Retention: deletion immediately if the request for legal services is rejected, and in any event no later than two years after recording. If an engagement is entered into, section 2.1 governs processing and deletion.
Processor: the controller uses the following processor.
Name
Registered office
Data
Purpose
Task
Google Llc.4
1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Name, email address and any other personal data supplied by the Client in the message
Contact and communication with the Client and offers for legal services
Organisation and storage of data
Possible consequence of not providing data: legal services cannot be provided. The data subject may object under section 5.
4 The international transfer complies with the GDPR and the Information Act, particularly because the processor operates under an agreement approved by the EU–US Privacy Shield.
2.5. Processing relating to the controller’s business partners
The controller processes the data of contact persons at business partners with whom it has a contractual relationship as follows.
Purpose: communication with business partners to provide or receive contractual services.
Legal basis for processing, disclosure and processor operations: performance of a contract.
Possible consequence of not providing data: the business relationship cannot be established or may end.
5 The international transfer complies with the GDPR and the Information Act, particularly because the processor operates under an agreement approved by the EU–US Privacy Shield.
2.6. Invoicing
The processor uses and stores the data of individual clients and individual/sole-trader business partners to issue invoices and keep accounting records.
Purpose: processing necessary for invoicing and accounting to fulfil obligations under the Accounting Act and tax legislation.
Legal bases: compliance with a legal obligation and performance of a contract.
General personal data: surname, first name, billing address and sole trader’s tax number.
Retention: eight years plus two years after termination of the contract (the current tax year and the tax year following the statutory deadline), having regard to section 169(2) of the Accounting Act.
Processors: the following processors are used.
Name
Registered office
Data disclosed
Purpose
Task
KBOSS.hu Kft.
1031 Budapest, Záhony utca 7.
Surname, first name, billing address, sole trader’s tax number
Compliance with the Accounting Act
Issuing invoices under accounting and tax legislation
Ecocreative Zrt.
1116 Budapest, Fegyvernek utca 8., 7. em. 77.
Surname, first name, billing address, sole trader’s tax number
Compliance with the Accounting Act
Accounting under accounting and tax legislation
Possible consequence of not providing data: a contract with the controller cannot be entered into.
3. Storage of personal data and security of processing
The controller’s IT systems and data-storage locations are at its registered office and those of its processors.
The controller selects and operates the IT equipment used for its services so that the data are: a) accessible to authorised persons (availability); b) authentic and capable of authentication (authenticity); c) capable of being verified as unchanged (integrity); and d) protected against unauthorised access (confidentiality).
The controller protects data through appropriate measures against unauthorised access, alteration, transfer, disclosure, deletion or destruction, accidental loss or damage, and inaccessibility resulting from changes in technology.
To protect electronically processed files in its registers, appropriate technical solutions ensure that stored data cannot be directly linked or attributed to a data subject unless permitted by law.
Taking account of technological development, the controller uses technical and organisational measures providing protection appropriate to processing risks, particularly:
Computer authentication with passwords of at least eight characters, accessible only to responsible persons;
Antivirus and anti-vulnerability software protecting electronic devices and data against unlawful processing and unauthorised access;
Backups and recovery of access to data and systems to prevent damage and loss;
Instructions to responsible persons to preserve the confidentiality of information and processing, avoid leaving credentials unattended and avoid leaving workstations accessible during processing sessions;
Measures ensuring systems’ reliability, integrity, availability and resilience and the availability and accessibility of data during physical or technical incidents;
Appropriate staff training.
During processing the controller preserves: a) confidentiality, so only authorised persons may access information; b) integrity, protecting the accuracy and completeness of information and processing methods; c) availability, so authorised users can access information and related facilities when needed.
The controller’s and its partners’ IT systems and networks are protected against computer-assisted fraud, espionage, sabotage, vandalism, fire, flooding, computer viruses, intrusion and denial-of-service attacks. The operator ensures security through server-level and application-level protection.
Users are informed that electronic messages transmitted over the internet, regardless of protocol (email, web, FTP, etc.), are vulnerable to network threats leading to dishonest activity, contractual disputes, disclosure or alteration of information. The controller takes all reasonably expected precautions against these threats. It monitors systems to record security deviations and provide evidence of security incidents. Monitoring also permits assessment of the effectiveness of precautions.
The controller ensures that responsible persons process data in accordance with the GDPR, applicable national data protection law and/or the controller’s good practices and/or valid internal procedures, particularly that they: a) process data lawfully and appropriately only for their duties and related purposes; b) access data only to fulfil their duties and avoid access and processing where not strictly necessary; c) do not share or disclose data without the controller’s prior authorisation; d) ensure the greatest possible confidentiality; e) continuously check data for currency, completeness and relevance.
4. Controller’s details and contact information
Name: Simányi Ügyvédi Iroda Address: 1016 Budapest, Szirtes út 11., ground floor, door 1. Bar registration number: 4993 Phone: +36 30 201 9730 Email: zsolt.simanyi@snlegal.hu
Person responsible for data protection: Dr. Simányi Zsolt, managing attorney Phone: +36 30 201 9730 Email: zsolt.simanyi@snlegal.hu
5. Data subjects’ rights and remedies
Data subjects may request information about processing, rectification of their personal data, and—except for mandatory processing—erasure and withdrawal. They may exercise portability and objection rights as indicated when data were collected or through the controller’s contact details above.
Right to information under the GDPR
The controller takes appropriate measures to provide all information under Articles 13 and 14 and communications under Articles 15–22 and 34 GDPR concerning personal-data processing in a concise, transparent, intelligible and easily accessible form, using clear and plain language.
This right may be exercised in writing through the contacts in sections 1 and 4. On request and following verification of identity, information may also be provided orally.
Right of access
Data subjects are entitled to confirmation of whether their personal data are being processed and, if so, access to the data and information on: purposes; categories of data; recipients or categories of recipients to whom data have been or will be disclosed, particularly third-country recipients and international organisations; intended retention period; rights to rectification, erasure, restriction and objection; the right to complain to a supervisory authority; sources of data; existence of automated decision-making, including profiling; meaningful information about the logic involved and its significance and expected consequences. Where data are transferred to a third country or international organisation, data subjects may request information on appropriate safeguards.
The controller provides a copy of the personal data processed. For additional copies requested, it may charge a reasonable fee based on administrative costs. Information is provided electronically on request.
Information is provided no later than one month after submission of the request.
Right to rectification
Data subjects may request correction of inaccurate personal data and completion of incomplete data.
Right to erasure
Data subjects may request erasure without undue delay where: the data are no longer necessary for the purposes of collection or other processing; consent is withdrawn and no other legal basis exists; an objection is made and there are no overriding legitimate grounds; data were processed unlawfully; erasure is required by Union or Member State law applicable to the controller; or data were collected in connection with the offer of information-society services.
Erasure cannot be requested where processing is necessary for freedom of expression and information; compliance with an applicable Union or Member State obligation requiring processing, or a task in the public interest or exercise of official authority; public-interest grounds in public health, archiving, scientific or historical research or statistics; or establishment, exercise or defence of legal claims.
Right to restriction
The controller restricts processing on request if: the accuracy of personal data is contested, for the period needed to verify it; processing is unlawful and the data subject opposes erasure and requests restricted use instead; the controller no longer needs the data but the data subject requires them for legal claims; or the data subject has objected, pending verification of whether the controller’s legitimate grounds override those of the data subject.
Restricted data, apart from storage, may be processed only with consent, for legal claims, to protect another natural or legal person’s rights or for important Union or Member State public interests.
The controller informs the data subject before lifting a restriction.
Right to data portability
Data subjects may receive personal data concerning them that they supplied to the controller in a structured, commonly used, machine-readable format and transmit them to another controller.
Right to withdraw consent
Consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of consent-based processing before withdrawal.
Procedural rules
The controller informs the data subject of action taken on a request under Articles 15–22 GDPR without undue delay and no later than one month after receipt. Where necessary, considering the complexity and number of requests, this may be extended by two further months.
The controller informs the data subject of an extension and the reasons for delay within one month of receipt. For electronic requests, information is provided electronically unless otherwise requested.
If no action is taken, the controller informs the data subject without delay and within one month of the reasons, and of the right to complain to a supervisory authority and seek a judicial remedy.
Information and communications are free of charge. For manifestly unfounded or excessive requests, particularly repetitive ones, the controller may charge a reasonable fee taking account of administrative costs or refuse to act.
The controller communicates rectification, erasure or restriction to each recipient to whom personal data were disclosed, unless impossible or requiring disproportionate effort, and informs the data subject of these recipients on request.
The controller provides a copy of personal data processed. A reasonable administrative-cost-based fee may be charged for further copies. For electronic requests, information is provided electronically unless otherwise requested.
Compensation for material and non-material damage
Any person suffering material or non-material damage because of a GDPR infringement is entitled to compensation from the controller or processor. A processor is liable only where it failed to comply with obligations specifically imposed on processors or acted outside or contrary to the controller’s lawful instructions.
Where several controllers or processors, or both, are involved in the same processing and are responsible for resulting damage, each is jointly and severally liable for the entire damage.
A controller or processor is exempt from liability if it proves that it is in no way responsible for the event giving rise to the damage.
Complaint to the person responsible for data protection
If you have concerns about processing, please contact:
Name: Simányi Ügyvédi Iroda Address: 1016 Budapest, Szirtes út 11., ground floor, door 1. Phone: +36 30 201 9730 Email: zsolt.simanyi@snlegal.hu
Right to bring court proceedings
If data subjects’ rights are infringed, they may bring proceedings against the controller. The court deals with the case as a priority.
Proceedings before the data protection authority
Complaints may be lodged with the Hungarian National Authority for Data Protection and Freedom of Information:
Name: Nemzeti Adatvédelmi és Információszabadság Hatóság Registered office: 1055 Budapest, Falk Miksa utca 9–11. Postal address: 1363 Budapest, Pf. 9. Telephone: 06-1-391-1400 Fax: 06-1-391-1410 Email: ugyfelszolgalat@naih.hu Website: http://www.naih.hu
Dr. Névery Péter Effective date of the notice: 25 May 2018
English translation of the supplied Hungarian notice. The content and effective date of the source document have been retained.
1. Introduction and definitions
Dr. Névery Péter, practising as an individual attorney (tax number: 50233126-2-41; statistical identification number: 50233126 6910 232 01; KASZ: 36066302; register number: 19459; registered office: 1016 Budapest, Szirtes út 11., ground floor, door 1.) (hereinafter: service provider/controller), as controller, acknowledges that the contents of this notice are binding upon it.
The controller undertakes to ensure that all processing connected with its activities meets the requirements of this policy, applicable national legislation and legal acts of the European Union.
The controller reserves the right to amend this notice at any time, provided that clients are notified of any changes in due time.
The controller is committed to protecting clients’ personal data and considers respect for their right to informational self-determination particularly important.
The controller treats personal data confidentially and takes all security, technical and organisational measures necessary to guarantee data security.
The following terms have the meanings set out below:
Personal data: any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, particularly by reference to an identifier such as a name, number, location data, online identifier, or one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity.
Data subject: a natural person identified or identifiable on the basis of personal data.
Controller: a person who, alone or jointly with others, determines the purposes and means of processing personal data, makes and implements decisions concerning processing, or instructs a processor to implement them; under this policy, Dr. Névery Péter, practising as an individual attorney.
Client: a data subject who has entered into, or wishes to enter into, a legal relationship with the controller.
Business partner: a business in a contractual relationship with the controller.
Data transfer: making data available to a specified third party.
Processor: a natural or legal person, or an organisation without legal personality, processing personal data on behalf of or on instructions from the controller within the framework and conditions laid down by law or a binding legal act of the European Union.
International data transfer: a transfer to a controller or processor processing data in a non-EEA country.
Special categories of personal data: all data in the special categories, namely data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership; genetic data; biometric data for uniquely identifying a natural person; health data; and data concerning a natural person’s sex life or sexual orientation.
2. Personal data, purposes, legal bases, retention and other provisions
The principles of processing are consistent with applicable data protection legislation, particularly:
Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.);
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Regulation 95/46/EC (General Data Protection Regulation, GDPR);
Act LXXVIII of 2017 on Legal Practice (Üttv.);
Act V of 2013 on the Civil Code (Ptk.);
Act C of 2000 on Accounting (Accounting Act).
As detailed below, processing may rely on:
Compliance with a statutory obligation or processing authorised by law (“processing necessary for compliance with a legal obligation”), Article 6(1)(c) GDPR;
Performance of a legal-services engagement agreement (“processing necessary for performance of a contract”), Article 6(1)(b) GDPR;
Pursuit of the controller’s legitimate interests (“processing necessary for legitimate interests”), Article 6(1)(f) GDPR;
The client’s consent in a separate declaration following separate prior information (“processing based on consent”), Article 6(1)(a) GDPR.
The controller is not responsible for legal consequences arising from the provision of false or misleading data.
The controller processes data primarily on paper and secondarily by automated means; in both cases the physical processing location is its registered office.
The controller does not transfer data subjects’ personal data to a foreign third country or international organisation outside the European Union or EEA, except with the data subject’s express approval and on the terms recorded in a written declaration by the parties, with safeguards complying with the GDPR. This restriction does not cover Article 45 GDPR: if the destination country and/or international organisation is covered by a valid Commission adequacy decision, no separate authorisation is required. At the date of this document, adopted adequacy decisions are in force for Andorra, Argentina, the Faroe Islands, Guernsey, Israel, Jersey, Canada, the Isle of Man, Switzerland, Uruguay, the USA (Privacy Shield) and New Zealand; the adequacy procedures for Japan and South Korea are ongoing.
The controller informs data subjects that, having regard to the closing wording of recital 91 GDPR, no impact assessment has been carried out and no data protection officer has been appointed.
2.1. Legal services
The controller provides the services specified in the Legal Practice Act to clients approaching it (hereinafter: Client(s)); together these are referred to as legal services, provided under an engagement granted in accordance with Chapter V of that Act (hereinafter: engagement).
Purpose: performing the engagement, the Client’s instructions and all directly connected operations serving that purpose and the Client’s interests; informing the Client to ensure compliance with relevant legal requirements, including decisions of authorities, courts or other persons, organisations or public bodies authorised to issue binding normative acts; recording the Client’s declarations in documents; and enforcing and recovering claims arising in connection with the engagement. In providing legal services, the controller complies with statutory client-identification, client and case registration, document-handling and other reporting obligations applicable to attorneys. Where required by law, it may transfer the data subject’s personal data to competent authorities for those reporting purposes.
Legal bases: processing necessary for performance of a legal-services contract, pursuit of legitimate interests and compliance with legal obligations.
General personal data processed: the data may vary with the engagement, but primarily comprise personal data supplied by the Client in the engagement document (typically the engagement agreement and statement of facts) and annexes, and all further information provided during performance and/or learned by the attorney. This may include special-category data of the Client or another data subject within the limits laid down by law and the document relating to the engagement agreement.
Retention: for the duration of the engagement and thereafter, under sections 46 and 53 of the Legal Practice Act, the attorney must process and retain engagement-related data for five (5) years after termination, or ten (10) years for electronic documents; data and documents relating to countersigned instruments must be retained for ten (10) years after termination, consistently with Article 6(1)(c) GDPR and, for special-category data, Article 9(2)(g) GDPR.
Possible consequence of not providing data: the engagement cannot be entered into.
Processors: the controller uses the following processors to fulfil the purposes in this section.
Recipient
Registered office
Data disclosed
Purpose
Processor’s task
Google Llc.1
1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Data recorded during the legal engagement
Storage of electronic documents relating to the engagement and its performance (Google Drive)
Data storage and archiving
Microsec Zrt.
1031 Budapest, Záhony utca 7., Building D
Data recorded during the legal engagement
Storage of electronic case files relating to the engagement and its performance
Qualified archival storage
Disclosure:
The controller may share personal and special-category data learned during legal services with its employees, lawful substitutes acting in its place (typically attorneys authorised under the Legal Practice Act and engagement agreement), and/or persons authorised by the client (typically the client’s representative), to the extent necessary to perform the engagement.
If the legal services involve representation in proceedings for entry into an authentic public register or drafting a document forming the basis of such entry, the controller must electronically consult the competent official register to verify the client’s identity, address and validity of the supporting identity documents. For other legal services, this requires separate client consent in the engagement agreement. Verification may cover the data listed in section 32(3) of the Legal Practice Act.2 If verification shows that a document has been reported lost, stolen or destroyed and its recovery has not been recorded, the attorney must, to prevent unauthorised use, immediately report the facts in writing to the police department competent at the place of use and simultaneously make an expedited notification.
Possible consequence of not providing data: legal services cannot be provided.
Possible consequence of not providing data: legal services cannot be provided to the data subject. The data subject may object as described in section 5.
1 The international transfer complies with the GDPR and the Information Act, particularly because the processor operates under an agreement approved by the EU–US Privacy Shield.
2 a) Natural-person identification data; b) nationality, statelessness, refugee, immigrant, settled or EEA-citizen status; c) address; d) facial image; e) signature; f) facts under section 18(5) of Act LXVI of 1992 on the Register of Citizens’ Personal Data and Addresses; g) data under section 24(1)(f) of Act XII of 1998 on Travel Abroad and the document’s validity period; h) data under section 8(1)(b)(ba)–(bb) of Act LXXXIV of 1999 on the Road Traffic Register; i) data under section 76(d) and section 80(1)(b)–(c) of Act I of 2007 on the Entry and Residence of Persons with the Right of Free Movement and Residence, and section 95(1)(g), section 96(1)(g) and section 100(1)(b)–(c) of Act II of 2007 on the Entry and Residence of Third-Country Nationals.
2.2. Statistical analysis of engagements, communication and monitoring services used
Purpose: statistical analysis concerning legal services, communication with clients using the services and monitoring the services used.
Legal basis: processing necessary for legitimate interests.
Data: surname, first name, email address, telephone number, subject of the matter and meeting date.
Retention: five years after termination of the engagement.
Processor: the controller uses the following processor to fulfil this section’s purposes.
Recipient
Registered office
Data disclosed
Purpose
Task
Google Llc.3
1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Surname, first name, email address, meeting date
Contacting and communicating with the Client and making offers for legal services
Email services: recording, storage, deletion, etc.
Possible consequence of not providing data: legal services cannot be provided to the data subject. The data subject may object as described in section 5.
3 The international transfer complies with the GDPR and the Information Act, particularly because the processor operates under an agreement approved by the EU–US Privacy Shield.
2.3. Collecting visitor data on www.snlegal.hu
www.snlegal.hu does not use cookies and therefore do not install data files on the visitor’s computer for data collection.
The website(s) use the user access log of Web-server Kft. (company registration number: 09-09-011599; tax number: 13498454-2-09; registered office: 4025 Debrecen, Pásti utca 2., first floor, door 5) to collect traffic data, recorded using AWStat (https://awstats.sourceforge.io). In our view, the data collected when visiting the website do not allow identification of a natural person and therefore are not personal data and the processing is not personal-data processing.
Purpose: collecting and analysing visitor data for www.snlegal.hu for marketing purposes.
Legal basis: legitimate interests.
Data: visit date and time, IP address, referrer, browser version, operating-system type and visited subpages.
Retention: no more than two years after the visit.
Processor: the controller uses the following processor.
Recipient
Registered office
Data disclosed
Purpose
Task
Web-server Kft.
4025 Debrecen, Pásti utca 2., first floor, door 5
Visit date and time, IP address, referrer, browser version, operating-system type
Collecting website traffic data
Recording, storage, organisation, deletion, etc.
Possible consequence of not providing data: inability to visit the website or use of reduced functionality. The data subject may object under section 5.
2.4. Requests for legal services through www.snlegal.hu, email or telephone
The controller processes certain personal data of persons requesting offers through the interface on www.snlegal.hu, email or telephone as follows. This section also applies to applications submitted through those website(s).
Purpose: making offers for legal services meeting the Client’s needs, and initiating and maintaining contact before the engagement.
Legal bases for processing, disclosure and processor operations: performance of a contract and legitimate interests.
Data: surname, first name, email address, telephone number and any other personal data provided by the Client in the message or by telephone.
Retention: deletion immediately if the request for legal services is rejected, and in any event no later than two years after recording. If an engagement is entered into, section 2.1 governs processing and deletion.
Processor: the controller uses the following processor.
Name
Registered office
Data
Purpose
Task
Google Llc.4
1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Name, email address and any other personal data supplied by the Client in the message
Contact and communication with the Client and offers for legal services
Organisation and storage of data
Possible consequence of not providing data: legal services cannot be provided. The data subject may object under section 5.
4 The international transfer complies with the GDPR and the Information Act, particularly because the processor operates under an agreement approved by the EU–US Privacy Shield.
2.5. Processing relating to the controller’s business partners
The controller processes the data of contact persons at business partners with whom it has a contractual relationship as follows.
Purpose: communication with business partners to provide or receive contractual services.
Legal basis for processing, disclosure and processor operations: performance of a contract.
Possible consequence of not providing data: the business relationship cannot be established or may end.
5 The international transfer complies with the GDPR and the Information Act, particularly because the processor operates under an agreement approved by the EU–US Privacy Shield.
2.6. Invoicing
The processor uses and stores the data of individual clients and individual/sole-trader business partners to issue invoices and keep accounting records.
Purpose: processing necessary for invoicing and accounting to fulfil obligations under the Accounting Act and tax legislation.
Legal bases: compliance with a legal obligation and performance of a contract.
General personal data: surname, first name, billing address and sole trader’s tax number.
Retention: eight years plus two years after termination of the contract (the current tax year and the tax year following the statutory deadline), having regard to section 169(2) of the Accounting Act.
Processors: the following processors are used.
Name
Registered office
Data disclosed
Purpose
Task
Kulcs-Szoft Nyrt.
1016 Budapest, Mészáros utca 13.
Surname, first name, billing address, sole trader’s tax number
Compliance with the Accounting Act
Issuing invoices under accounting and tax legislation
Szokol és Társa Kft.
1046 Budapest, Kőrösbánya utca 26–28., I./1.
Surname, first name, billing address, sole trader’s tax number
Compliance with the Accounting Act
Accounting under accounting and tax legislation
Possible consequence of not providing data: a contract with the controller cannot be entered into.
3. Storage of personal data and security of processing
The controller’s IT systems and data-storage locations are at its registered office and those of its processors.
The controller selects and operates the IT equipment used for its services so that the data are: a) accessible to authorised persons (availability); b) authentic and capable of authentication (authenticity); c) capable of being verified as unchanged (integrity); and d) protected against unauthorised access (confidentiality).
The controller protects data through appropriate measures against unauthorised access, alteration, transfer, disclosure, deletion or destruction, accidental loss or damage, and inaccessibility resulting from changes in technology.
To protect electronically processed files in its registers, appropriate technical solutions ensure that stored data cannot be directly linked or attributed to a data subject unless permitted by law.
Taking account of technological development, the controller uses technical and organisational measures providing protection appropriate to processing risks, particularly:
Computer authentication with passwords of at least eight characters, accessible only to responsible persons;
Antivirus and anti-vulnerability software protecting electronic devices and data against unlawful processing and unauthorised access;
Backups and recovery of access to data and systems to prevent damage and loss;
Instructions to responsible persons to preserve the confidentiality of information and processing, avoid leaving credentials unattended and avoid leaving workstations accessible during processing sessions;
Measures ensuring systems’ reliability, integrity, availability and resilience and the availability and accessibility of data during physical or technical incidents;
Appropriate staff training.
During processing the controller preserves: a) confidentiality, so only authorised persons may access information; b) integrity, protecting the accuracy and completeness of information and processing methods; c) availability, so authorised users can access information and related facilities when needed.
The controller’s and its partners’ IT systems and networks are protected against computer-assisted fraud, espionage, sabotage, vandalism, fire, flooding, computer viruses, intrusion and denial-of-service attacks. The operator ensures security through server-level and application-level protection.
Users are informed that electronic messages transmitted over the internet, regardless of protocol (email, web, FTP, etc.), are vulnerable to network threats leading to dishonest activity, contractual disputes, disclosure or alteration of information. The controller takes all reasonably expected precautions against these threats. It monitors systems to record security deviations and provide evidence of security incidents. Monitoring also permits assessment of the effectiveness of precautions.
The controller ensures that responsible persons process data in accordance with the GDPR, applicable national data protection law and/or the controller’s good practices and/or valid internal procedures, particularly that they: a) process data lawfully and appropriately only for their duties and related purposes; b) access data only to fulfil their duties and avoid access and processing where not strictly necessary; c) do not share or disclose data without the controller’s prior authorisation; d) ensure the greatest possible confidentiality; e) continuously check data for currency, completeness and relevance.
4. Controller’s details and contact information
Name: Dr. Névery Péter Address: 1016 Budapest, Szirtes út 11., ground floor, door 1. tax number: 50233126-2-41; statistical identification number: 50233126 6910 232 01; KASZ: 36066302; register number: 19459 Phone: +36 20 580 8850 Email: peter.nevery@snlegal.hu
Person responsible for data protection: Dr. Névery Péter Phone: +36 20 580 8850 Email: peter.nevery@snlegal.hu
5. Data subjects’ rights and remedies
Data subjects may request information about processing, rectification of their personal data, and—except for mandatory processing—erasure and withdrawal. They may exercise portability and objection rights as indicated when data were collected or through the controller’s contact details above.
Right to information under the GDPR
The controller takes appropriate measures to provide all information under Articles 13 and 14 and communications under Articles 15–22 and 34 GDPR concerning personal-data processing in a concise, transparent, intelligible and easily accessible form, using clear and plain language.
This right may be exercised in writing through the contacts in sections 1 and 4. On request and following verification of identity, information may also be provided orally.
Right of access
Data subjects are entitled to confirmation of whether their personal data are being processed and, if so, access to the data and information on: purposes; categories of data; recipients or categories of recipients to whom data have been or will be disclosed, particularly third-country recipients and international organisations; intended retention period; rights to rectification, erasure, restriction and objection; the right to complain to a supervisory authority; sources of data; existence of automated decision-making, including profiling; meaningful information about the logic involved and its significance and expected consequences. Where data are transferred to a third country or international organisation, data subjects may request information on appropriate safeguards.
The controller provides a copy of the personal data processed. For additional copies requested, it may charge a reasonable fee based on administrative costs. Information is provided electronically on request.
Information is provided no later than one month after submission of the request.
Right to rectification
Data subjects may request correction of inaccurate personal data and completion of incomplete data.
Right to erasure
Data subjects may request erasure without undue delay where: the data are no longer necessary for the purposes of collection or other processing; consent is withdrawn and no other legal basis exists; an objection is made and there are no overriding legitimate grounds; data were processed unlawfully; erasure is required by Union or Member State law applicable to the controller; or data were collected in connection with the offer of information-society services.
Erasure cannot be requested where processing is necessary for freedom of expression and information; compliance with an applicable Union or Member State obligation requiring processing, or a task in the public interest or exercise of official authority; public-interest grounds in public health, archiving, scientific or historical research or statistics; or establishment, exercise or defence of legal claims.
Right to restriction
The controller restricts processing on request if: the accuracy of personal data is contested, for the period needed to verify it; processing is unlawful and the data subject opposes erasure and requests restricted use instead; the controller no longer needs the data but the data subject requires them for legal claims; or the data subject has objected, pending verification of whether the controller’s legitimate grounds override those of the data subject.
Restricted data, apart from storage, may be processed only with consent, for legal claims, to protect another natural or legal person’s rights or for important Union or Member State public interests.
The controller informs the data subject before lifting a restriction.
Right to data portability
Data subjects may receive personal data concerning them that they supplied to the controller in a structured, commonly used, machine-readable format and transmit them to another controller.
Right to withdraw consent
Consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of consent-based processing before withdrawal.
Procedural rules
The controller informs the data subject of action taken on a request under Articles 15–22 GDPR without undue delay and no later than one month after receipt. Where necessary, considering the complexity and number of requests, this may be extended by two further months.
The controller informs the data subject of an extension and the reasons for delay within one month of receipt. For electronic requests, information is provided electronically unless otherwise requested.
If no action is taken, the controller informs the data subject without delay and within one month of the reasons, and of the right to complain to a supervisory authority and seek a judicial remedy.
Information and communications are free of charge. For manifestly unfounded or excessive requests, particularly repetitive ones, the controller may charge a reasonable fee taking account of administrative costs or refuse to act.
The controller communicates rectification, erasure or restriction to each recipient to whom personal data were disclosed, unless impossible or requiring disproportionate effort, and informs the data subject of these recipients on request.
The controller provides a copy of personal data processed. A reasonable administrative-cost-based fee may be charged for further copies. For electronic requests, information is provided electronically unless otherwise requested.
Compensation for material and non-material damage
Any person suffering material or non-material damage because of a GDPR infringement is entitled to compensation from the controller or processor. A processor is liable only where it failed to comply with obligations specifically imposed on processors or acted outside or contrary to the controller’s lawful instructions.
Where several controllers or processors, or both, are involved in the same processing and are responsible for resulting damage, each is jointly and severally liable for the entire damage.
A controller or processor is exempt from liability if it proves that it is in no way responsible for the event giving rise to the damage.
Complaint to the person responsible for data protection
If you have concerns about processing, please contact:
Name: Dr. Névery Péter Address: 1016 Budapest, Szirtes út 11. Phone: +36 20 580 8850 Email: peter.nevery@snlegal.hu
Right to bring court proceedings
If data subjects’ rights are infringed, they may bring proceedings against the controller. The court deals with the case as a priority.
Proceedings before the data protection authority
Complaints may be lodged with the Hungarian National Authority for Data Protection and Freedom of Information:
Name: Nemzeti Adatvédelmi és Információszabadság Hatóság Registered office: 1125 Budapest, Szilágyi Erzsébet fasor 22/C. Postal address: 1530 Budapest, Pf. 5. Telephone: 06-1-391-1400 Fax: 06-1-391-1410 Email: ugyfelszolgalat@naih.hu Website: http://www.naih.hu
Legal notice
Dr. Simányi Zsolt, attorney-at-law, as the managing member, and Dr. Névery Péter and Dr. Péntek Bálint, attorneys-at-law, as members, practise within Simányi és Névery Ügyvédi Társulás (the “Association”), established and registered in accordance with Regulation No. 2/2006 (III.20.) of the Hungarian Bar Association.
This website is maintained by the Association registered with the Budapest Bar Association, in accordance with the legislation and internal regulations applicable to attorneys. These, together with information on clients’ rights, are available at www.magyarugyvedikamara.hu.
Accordingly, neither the www.snlegal.hu website operated by the Association nor its content constitutes an offer to provide legal advice or any other legal service that may be provided by the Association or its members, an invitation to make an offer, a fee quotation, or an invitation or offer to enter into a legal services agreement. In any specific matter, the Association provides legal advice or services solely through a personal consultation and after accepting an engagement to provide legal services.
