Privacy Notice
Simányi Ügyvédi Iroda
Effective date of the notice: 1 April 2021
English translation of the supplied Hungarian notice. The content and effective date of the source document have been retained.
1. Introduction and definitions
Simányi Ügyvédi Iroda (bar registration number: 4993; registered office: 1016 Budapest, Szirtes út 11., ground floor, door 1.) (hereinafter: service provider/controller), as controller, acknowledges that the contents of this notice are binding upon it.
The controller undertakes to ensure that all processing connected with its activities meets the requirements of this policy, applicable national legislation and legal acts of the European Union.
The controller reserves the right to amend this notice at any time, provided that clients are notified of any changes in due time.
The controller is committed to protecting clients’ personal data and considers respect for their right to informational self-determination particularly important.
The controller treats personal data confidentially and takes all security, technical and organisational measures necessary to guarantee data security.
The following terms have the meanings set out below:
- Personal data: any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, particularly by reference to an identifier such as a name, number, location data, online identifier, or one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity.
- Data subject: a natural person identified or identifiable on the basis of personal data.
- Controller: a person who, alone or jointly with others, determines the purposes and means of processing personal data, makes and implements decisions concerning processing, or instructs a processor to implement them; under this policy, Dr. Simányi Zsolt, practising as an individual attorney.
- Client: a data subject who has entered into, or wishes to enter into, a legal relationship with the controller.
- Business partner: a business in a contractual relationship with the controller.
- Data transfer: making data available to a specified third party.
- Processor: a natural or legal person, or an organisation without legal personality, processing personal data on behalf of or on instructions from the controller within the framework and conditions laid down by law or a binding legal act of the European Union.
- International data transfer: a transfer to a controller or processor processing data in a non-EEA country.
- Special categories of personal data: all data in the special categories, namely data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership; genetic data; biometric data for uniquely identifying a natural person; health data; and data concerning a natural person’s sex life or sexual orientation.
2. Personal data, purposes, legal bases, retention and other provisions
The principles of processing are consistent with applicable data protection legislation, particularly:
- Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.);
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Regulation 95/46/EC (General Data Protection Regulation, GDPR);
- Act LXXVIII of 2017 on Legal Practice (Üttv.);
- Act V of 2013 on the Civil Code (Ptk.);
- Act C of 2000 on Accounting (Accounting Act).
As detailed below, processing may rely on:
- Compliance with a statutory obligation or processing authorised by law (“processing necessary for compliance with a legal obligation”), Article 6(1)(c) GDPR;
- Performance of a legal-services engagement agreement (“processing necessary for performance of a contract”), Article 6(1)(b) GDPR;
- Pursuit of the controller’s legitimate interests (“processing necessary for legitimate interests”), Article 6(1)(f) GDPR;
- The client’s consent in a separate declaration following separate prior information (“processing based on consent”), Article 6(1)(a) GDPR.
The controller is not responsible for legal consequences arising from the provision of false or misleading data.
The controller processes data primarily on paper and secondarily by automated means; in both cases the physical processing location is its registered office.
The controller does not transfer data subjects’ personal data to a foreign third country or international organisation outside the European Union or EEA, except with the data subject’s express approval and on the terms recorded in a written declaration by the parties, with safeguards complying with the GDPR. This restriction does not cover Article 45 GDPR: if the destination country and/or international organisation is covered by a valid Commission adequacy decision, no separate authorisation is required. At the date of this document, adopted adequacy decisions are in force for Andorra, Argentina, the Faroe Islands, Guernsey, Israel, Jersey, Canada, the Isle of Man, Switzerland, Uruguay, the USA (Privacy Shield) and New Zealand; the adequacy procedures for Japan and South Korea are ongoing.
The controller informs data subjects that, having regard to the closing wording of recital 91 GDPR, no impact assessment has been carried out and no data protection officer has been appointed.
2.1. Legal services
The controller provides the services specified in the Legal Practice Act to clients approaching it (hereinafter: Client(s)); together these are referred to as legal services, provided under an engagement granted in accordance with Chapter V of that Act (hereinafter: engagement).
Purpose: performing the engagement, the Client’s instructions and all directly connected operations serving that purpose and the Client’s interests; informing the Client to ensure compliance with relevant legal requirements, including decisions of authorities, courts or other persons, organisations or public bodies authorised to issue binding normative acts; recording the Client’s declarations in documents; and enforcing and recovering claims arising in connection with the engagement. In providing legal services, the controller complies with statutory client-identification, client and case registration, document-handling and other reporting obligations applicable to attorneys. Where required by law, it may transfer the data subject’s personal data to competent authorities for those reporting purposes.
Legal bases: processing necessary for performance of a legal-services contract, pursuit of legitimate interests and compliance with legal obligations.
General personal data processed: the data may vary with the engagement, but primarily comprise personal data supplied by the Client in the engagement document (typically the engagement agreement and statement of facts) and annexes, and all further information provided during performance and/or learned by the attorney. This may include special-category data of the Client or another data subject within the limits laid down by law and the document relating to the engagement agreement.
Retention: for the duration of the engagement and thereafter, under sections 46 and 53 of the Legal Practice Act, the attorney must process and retain engagement-related data for five (5) years after termination, or ten (10) years for electronic documents; data and documents relating to countersigned instruments must be retained for ten (10) years after termination, consistently with Article 6(1)(c) GDPR and, for special-category data, Article 9(2)(g) GDPR.
Possible consequence of not providing data: the engagement cannot be entered into.
Processors: the controller uses the following processors to fulfil the purposes in this section.
| Recipient | Registered office | Data disclosed | Purpose | Processor’s task |
|---|---|---|---|---|
| Google Llc.1 | 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA | Data recorded during the legal engagement | Storage of electronic documents relating to the engagement and its performance (Google Drive) | Data storage and archiving |
| Microsec Zrt. | 1031 Budapest, Záhony utca 7., Building D | Data recorded during the legal engagement | Storage of electronic case files relating to the engagement and its performance | Qualified archival storage |
Disclosure:
- The controller may share personal and special-category data learned during legal services with its employees, lawful substitutes acting in its place (typically attorneys authorised under the Legal Practice Act and engagement agreement), and/or persons authorised by the client (typically the client’s representative), to the extent necessary to perform the engagement.
- If the legal services involve representation in proceedings for entry into an authentic public register or drafting a document forming the basis of such entry, the controller must electronically consult the competent official register to verify the client’s identity, address and validity of the supporting identity documents. For other legal services, this requires separate client consent in the engagement agreement. Verification may cover the data listed in section 32(3) of the Legal Practice Act.2 If verification shows that a document has been reported lost, stolen or destroyed and its recovery has not been recorded, the attorney must, to prevent unauthorised use, immediately report the facts in writing to the police department competent at the place of use and simultaneously make an expedited notification.
Possible consequence of not providing data: legal services cannot be provided.
Possible consequence of not providing data: legal services cannot be provided to the data subject. The data subject may object as described in section 5.
1 The international transfer complies with the GDPR and the Information Act, particularly because the processor operates under an agreement approved by the EU–US Privacy Shield.
2 a) Natural-person identification data; b) nationality, statelessness, refugee, immigrant, settled or EEA-citizen status; c) address; d) facial image; e) signature; f) facts under section 18(5) of Act LXVI of 1992 on the Register of Citizens’ Personal Data and Addresses; g) data under section 24(1)(f) of Act XII of 1998 on Travel Abroad and the document’s validity period; h) data under section 8(1)(b)(ba)–(bb) of Act LXXXIV of 1999 on the Road Traffic Register; i) data under section 76(d) and section 80(1)(b)–(c) of Act I of 2007 on the Entry and Residence of Persons with the Right of Free Movement and Residence, and section 95(1)(g), section 96(1)(g) and section 100(1)(b)–(c) of Act II of 2007 on the Entry and Residence of Third-Country Nationals.
2.2. Statistical analysis of engagements, communication and monitoring services used
Purpose: statistical analysis concerning legal services, communication with clients using the services and monitoring the services used.
Legal basis: processing necessary for legitimate interests.
Data: surname, first name, email address, telephone number, subject of the matter and meeting date.
Retention: five years after termination of the engagement.
Processor: the controller uses the following processor to fulfil this section’s purposes.
| Recipient | Registered office | Data disclosed | Purpose | Task |
|---|---|---|---|---|
| Google Llc.3 | 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA | Surname, first name, email address, meeting date | Contacting and communicating with the Client and making offers for legal services | Email services: recording, storage, deletion, etc. |
Possible consequence of not providing data: legal services cannot be provided to the data subject. The data subject may object as described in section 5.
3 The international transfer complies with the GDPR and the Information Act, particularly because the processor operates under an agreement approved by the EU–US Privacy Shield.
2.3. Collecting visitor data on www.simanyi.hu and www.snlegal.hu
www.simanyi.hu and www.snlegal.hu do not use cookies and therefore do not install data files on the visitor’s computer for data collection.
The website(s) use the user access log of Web-server Kft. (company registration number: 09-09-011599; tax number: 13498454-2-09; registered office: 4025 Debrecen, Pásti utca 2., first floor, door 5) to collect traffic data, recorded using AWStat (https://awstats.sourceforge.io). the data collected when visiting the website do not allow identification of a natural person and therefore are not personal data and the processing is not personal-data processing.
Purpose: collecting and analysing visitor data for www.simanyi.hu and www.snlegal.hu for marketing purposes.
Legal basis: legitimate interests.
Data: visit date and time, IP address, referrer, browser version, operating-system type and visited subpages.
Retention: no more than two years after the visit.
Processor: the controller uses the following processor.
| Recipient | Registered office | Data disclosed | Purpose | Task |
|---|---|---|---|---|
| Web-server Kft. | 4025 Debrecen, Pásti utca 2., first floor, door 5 | Visit date and time, IP address, referrer, browser version, operating-system type | Collecting website traffic data | Recording, storage, organisation, deletion, etc. |
Possible consequence of not providing data: inability to visit the website or use of reduced functionality. The data subject may object under section 5.
2.4. Requests for legal services through www.simanyi.hu and www.snlegal.hu, email or telephone
The controller processes certain personal data of persons requesting offers through the interface on www.simanyi.hu and www.snlegal.hu, email or telephone as follows. This section also applies to applications submitted through those website(s).
Purpose: making offers for legal services meeting the Client’s needs, and initiating and maintaining contact before the engagement.
Legal bases for processing, disclosure and processor operations: performance of a contract and legitimate interests.
Data: surname, first name, email address, telephone number and any other personal data provided by the Client in the message or by telephone.
Retention: deletion immediately if the request for legal services is rejected, and in any event no later than two years after recording. If an engagement is entered into, section 2.1 governs processing and deletion.
Processor: the controller uses the following processor.
| Name | Registered office | Data | Purpose | Task |
|---|---|---|---|---|
| Google Llc.4 | 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA | Name, email address and any other personal data supplied by the Client in the message | Contact and communication with the Client and offers for legal services | Organisation and storage of data |
Possible consequence of not providing data: legal services cannot be provided. The data subject may object under section 5.
4 The international transfer complies with the GDPR and the Information Act, particularly because the processor operates under an agreement approved by the EU–US Privacy Shield.
2.5. Processing relating to the controller’s business partners
The controller processes the data of contact persons at business partners with whom it has a contractual relationship as follows.
Purpose: communication with business partners to provide or receive contractual services.
Legal basis for processing, disclosure and processor operations: performance of a contract.
Data: name, email address, telephone number, job title/position.
Retention: five years after the business relationship ends.
Processor: the controller uses the following processor.
| Name | Registered office | Data | Purpose | Task |
|---|---|---|---|---|
| Google Llc.5 | 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA | Name, email address, telephone number, job title/position | Initiating and maintaining contact | Organisation and storage of data |
Possible consequence of not providing data: the business relationship cannot be established or may end.
5 The international transfer complies with the GDPR and the Information Act, particularly because the processor operates under an agreement approved by the EU–US Privacy Shield.
2.6. Invoicing
The processor uses and stores the data of individual clients and individual/sole-trader business partners to issue invoices and keep accounting records.
Purpose: processing necessary for invoicing and accounting to fulfil obligations under the Accounting Act and tax legislation.
Legal bases: compliance with a legal obligation and performance of a contract.
General personal data: surname, first name, billing address and sole trader’s tax number.
Retention: eight years plus two years after termination of the contract (the current tax year and the tax year following the statutory deadline), having regard to section 169(2) of the Accounting Act.
Processors: the following processors are used.
| Name | Registered office | Data disclosed | Purpose | Task |
|---|---|---|---|---|
| KBOSS.hu Kft. | 1031 Budapest, Záhony utca 7. | Surname, first name, billing address, sole trader’s tax number | Compliance with the Accounting Act | Issuing invoices under accounting and tax legislation |
| Ecocreative Zrt. | 1116 Budapest, Fegyvernek utca 8., 7. em. 77. | Surname, first name, billing address, sole trader’s tax number | Compliance with the Accounting Act | Accounting under accounting and tax legislation |
Possible consequence of not providing data: a contract with the controller cannot be entered into.
3. Storage of personal data and security of processing
The controller’s IT systems and data-storage locations are at its registered office and those of its processors.
The controller selects and operates the IT equipment used for its services so that the data are: a) accessible to authorised persons (availability); b) authentic and capable of authentication (authenticity); c) capable of being verified as unchanged (integrity); and d) protected against unauthorised access (confidentiality).
The controller protects data through appropriate measures against unauthorised access, alteration, transfer, disclosure, deletion or destruction, accidental loss or damage, and inaccessibility resulting from changes in technology.
To protect electronically processed files in its registers, appropriate technical solutions ensure that stored data cannot be directly linked or attributed to a data subject unless permitted by law.
Taking account of technological development, the controller uses technical and organisational measures providing protection appropriate to processing risks, particularly:
- Computer authentication with passwords of at least eight characters, accessible only to responsible persons;
- Antivirus and anti-vulnerability software protecting electronic devices and data against unlawful processing and unauthorised access;
- Backups and recovery of access to data and systems to prevent damage and loss;
- Instructions to responsible persons to preserve the confidentiality of information and processing, avoid leaving credentials unattended and avoid leaving workstations accessible during processing sessions;
- Measures ensuring systems’ reliability, integrity, availability and resilience and the availability and accessibility of data during physical or technical incidents;
- Appropriate staff training.
During processing the controller preserves: a) confidentiality, so only authorised persons may access information; b) integrity, protecting the accuracy and completeness of information and processing methods; c) availability, so authorised users can access information and related facilities when needed.
The controller’s and its partners’ IT systems and networks are protected against computer-assisted fraud, espionage, sabotage, vandalism, fire, flooding, computer viruses, intrusion and denial-of-service attacks. The operator ensures security through server-level and application-level protection.
Users are informed that electronic messages transmitted over the internet, regardless of protocol (email, web, FTP, etc.), are vulnerable to network threats leading to dishonest activity, contractual disputes, disclosure or alteration of information. The controller takes all reasonably expected precautions against these threats. It monitors systems to record security deviations and provide evidence of security incidents. Monitoring also permits assessment of the effectiveness of precautions.
The controller ensures that responsible persons process data in accordance with the GDPR, applicable national data protection law and/or the controller’s good practices and/or valid internal procedures, particularly that they: a) process data lawfully and appropriately only for their duties and related purposes; b) access data only to fulfil their duties and avoid access and processing where not strictly necessary; c) do not share or disclose data without the controller’s prior authorisation; d) ensure the greatest possible confidentiality; e) continuously check data for currency, completeness and relevance.
4. Controller’s details and contact information
Name: Simányi Ügyvédi Iroda
Address: 1016 Budapest, Szirtes út 11., ground floor, door 1.
Bar registration number: 4993
Phone: +36 30 201 9730
Email: zsolt.simanyi@snlegal.hu
Person responsible for data protection: Dr. Simányi Zsolt, managing attorney
Phone: +36 30 201 9730
Email: zsolt.simanyi@snlegal.hu
5. Data subjects’ rights and remedies
Data subjects may request information about processing, rectification of their personal data, and—except for mandatory processing—erasure and withdrawal. They may exercise portability and objection rights as indicated when data were collected or through the controller’s contact details above.
Right to information under the GDPR
The controller takes appropriate measures to provide all information under Articles 13 and 14 and communications under Articles 15–22 and 34 GDPR concerning personal-data processing in a concise, transparent, intelligible and easily accessible form, using clear and plain language.
This right may be exercised in writing through the contacts in sections 1 and 4. On request and following verification of identity, information may also be provided orally.
Right of access
Data subjects are entitled to confirmation of whether their personal data are being processed and, if so, access to the data and information on: purposes; categories of data; recipients or categories of recipients to whom data have been or will be disclosed, particularly third-country recipients and international organisations; intended retention period; rights to rectification, erasure, restriction and objection; the right to complain to a supervisory authority; sources of data; existence of automated decision-making, including profiling; meaningful information about the logic involved and its significance and expected consequences. Where data are transferred to a third country or international organisation, data subjects may request information on appropriate safeguards.
The controller provides a copy of the personal data processed. For additional copies requested, it may charge a reasonable fee based on administrative costs. Information is provided electronically on request.
Information is provided no later than one month after submission of the request.
Right to rectification
Data subjects may request correction of inaccurate personal data and completion of incomplete data.
Right to erasure
Data subjects may request erasure without undue delay where: the data are no longer necessary for the purposes of collection or other processing; consent is withdrawn and no other legal basis exists; an objection is made and there are no overriding legitimate grounds; data were processed unlawfully; erasure is required by Union or Member State law applicable to the controller; or data were collected in connection with the offer of information-society services.
Erasure cannot be requested where processing is necessary for freedom of expression and information; compliance with an applicable Union or Member State obligation requiring processing, or a task in the public interest or exercise of official authority; public-interest grounds in public health, archiving, scientific or historical research or statistics; or establishment, exercise or defence of legal claims.
Right to restriction
The controller restricts processing on request if: the accuracy of personal data is contested, for the period needed to verify it; processing is unlawful and the data subject opposes erasure and requests restricted use instead; the controller no longer needs the data but the data subject requires them for legal claims; or the data subject has objected, pending verification of whether the controller’s legitimate grounds override those of the data subject.
Restricted data, apart from storage, may be processed only with consent, for legal claims, to protect another natural or legal person’s rights or for important Union or Member State public interests.
The controller informs the data subject before lifting a restriction.
Right to data portability
Data subjects may receive personal data concerning them that they supplied to the controller in a structured, commonly used, machine-readable format and transmit them to another controller.
Right to withdraw consent
Consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of consent-based processing before withdrawal.
Procedural rules
The controller informs the data subject of action taken on a request under Articles 15–22 GDPR without undue delay and no later than one month after receipt. Where necessary, considering the complexity and number of requests, this may be extended by two further months.
The controller informs the data subject of an extension and the reasons for delay within one month of receipt. For electronic requests, information is provided electronically unless otherwise requested.
If no action is taken, the controller informs the data subject without delay and within one month of the reasons, and of the right to complain to a supervisory authority and seek a judicial remedy.
Information and communications are free of charge. For manifestly unfounded or excessive requests, particularly repetitive ones, the controller may charge a reasonable fee taking account of administrative costs or refuse to act.
The controller communicates rectification, erasure or restriction to each recipient to whom personal data were disclosed, unless impossible or requiring disproportionate effort, and informs the data subject of these recipients on request.
The controller provides a copy of personal data processed. A reasonable administrative-cost-based fee may be charged for further copies. For electronic requests, information is provided electronically unless otherwise requested.
Compensation for material and non-material damage
Any person suffering material or non-material damage because of a GDPR infringement is entitled to compensation from the controller or processor. A processor is liable only where it failed to comply with obligations specifically imposed on processors or acted outside or contrary to the controller’s lawful instructions.
Where several controllers or processors, or both, are involved in the same processing and are responsible for resulting damage, each is jointly and severally liable for the entire damage.
A controller or processor is exempt from liability if it proves that it is in no way responsible for the event giving rise to the damage.
Complaint to the person responsible for data protection
If you have concerns about processing, please contact:
Name: Simányi Ügyvédi Iroda
Address: 1016 Budapest, Szirtes út 11., ground floor, door 1.
Phone: +36 30 201 9730
Email: zsolt.simanyi@snlegal.hu
Right to bring court proceedings
If data subjects’ rights are infringed, they may bring proceedings against the controller. The court deals with the case as a priority.
Proceedings before the data protection authority
Complaints may be lodged with the Hungarian National Authority for Data Protection and Freedom of Information:
Name: Nemzeti Adatvédelmi és Információszabadság Hatóság
Registered office: 1055 Budapest, Falk Miksa utca 9–11.
Postal address: 1363 Budapest, Pf. 9.
Telephone: 06-1-391-1400
Fax: 06-1-391-1410
Email: ugyfelszolgalat@naih.hu
Website: http://www.naih.hu