Privacy policy

DATA PRIVACY POLICY

Szárkiszján Law Firm as a data controller (hereinafter referred as: “Law Firm” or “Data Controller”) hereby informs her clients, partners and other data subjects regarding the personal data processing in compliance with the regulations of Regulation No. 2016/679/EU of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”) and Act CXII. of 2011 on Informational Self-determination and Freedom of Information (hereinafter referred to as: „Information Act”).

The present Data Privacy Policy may be downloaded in pdf format from here.

I. DATA OF THE DATA CONTROLLER

Name of the Data Controller:	Szárkiszján Law Firm
Representative of the Data Controller:	dr. Ovszána SZÁRKISZJÁN attorney at law
Registered seat:	H-1025 Budapest, Szépvölgyi út 52.
Email:	ovszana@szarkiszjanlegal.hu
Website:	www.szarkiszjanlegal.hu
Telephone:	+36-30-589-1823

II. APPLICABLE LEGISLATION AND DEFINITIONS

1. Applicable legislation

The main legislation which is applicable to the Data Controller’s personal data processing are the following:

GDPR;
Information Act;
Act LXXVIII of 2017 on the professional activities of attorneys-at-law (“Attorneys Act”)
Act LIII of 2017 on the Prevention and Combating of Money Laundering and Terrorist Financing (“AML”);
Act C of 2000 on Accounting (“Accounting Act”).

2. Definitions

The definitions used in this Data Privacy Policy and defined in GDPR has the same meaning as in GDPR.

III. PURPOSE OF THE DATA PROCESSING, LEGAL BASIS, THE PROCESSED DATA, THE DURATION AND THE SOURCE OF THE PROCESSED DATA

Purpose of the data processing	Date subject(s)	Processed data	Duration of the data processing	Legal basis of the data processing	Source of data
1.Submitting an offer	the offeree	name, address, email address, telephone number, further data provided regarding the case	For 5 years from the receipt of the offer.	performance of a contract in accordance with Article 6 (1) (b) of the GDPR	the offeree
2. Communication with the prospective clients	the prospective clients and the enquiring person	name, address, email address, telephone number	Until the time the consent is withdrawn.	consent of the data subject contract in accordance with Article 6 (1) (a) of the GDPR	the prospective clients; the enquiring person
3. Communication with the clients	the clients and the contact person designated by the client	name, address, email address, telephone number	Until the existence of the contractual relationship.	performance of a contract in accordance with Article 6 (1) (b) of the GDPR	the client
4. Performance of the contract, providing legal services	the client the respondent the representative’s respondent other participants of the procedure (etc.: witnesses, experts translators)	name, mother’s name; address; email address; telephone number, further data provided regarding the case or procedure; name, mother’s name; address; email address; telephone number, further data provided regarding the case or procedure; name, mother’s name; address; email address; telephone number, further data provided regarding the case or procedure; name, mother’s name; address; email address; telephone number, further data provided regarding the case or procedure;	Until the existence of the contractual relationship.	performance of the contract in accordance with Article 6 (1) (b) of the GDPR	1. the client, in case of section 2-4. the data subject
5. Identification check of the Client and in case of countersigning JÜB identification	the client, the representative of the client, other participants	personal identification data, nationality, stateless status, immigrant or permanent resident status, or EEA national status; address of domicile; facial image; signature; the facts set out in section 18 (5) of Act LXVI of 1992 on the personal data and address register of citizens; the particulars set out in section 24 (1) f) of Act XII of 1998 on travelling abroad, and the period of validity of the document; the particulars set out in Sections 8 (1) b) ba) to bb) of Act LXXXIV of 1999 on the records related to road traffic; the particulars set out in section 76 d) and section 80 (1) b) and c) of Act I of 2007 on the entry and stay of persons entitled to free movement and stay, and in sections 95 (1) g), 96 (1) g) and 100 (1) b) and c) of Act II of 2007 on the entry and stay of third country nationals.	For 8 years following the termination or performance of the service assignment.	Compliance with legal obligations in accordance with Article 6 (1) (c) of the GDPR Legislative reference on which the legal obligation of the personal data processing is based: Section 32 (3) of the Attorneys Act	the client and the representative of the client, public registers
6. Due diligence of the client	the client, the representative of the client, other participants	in case of natural person: surname and forename, surname and forename by birth, nationality, date and place of birth, mother’s birth name, home address, or habitual residence in the absence thereof, number and type of identification document; in case of legal person: name and position of authorized representatives, if available the surname and forename and home address, or habitual residence in the absence thereof of the agent for service of process	For 8 years following the termination or performance of the service assignment.	Compliance with legal obligations in accordance with Article 6 (1) (c) of the GDPR Legislative reference on which the legal obligation of the personal data processing is based: Section 7 (1)-(2), Section 56 (2), Section 57 (2) and Section 73 (1) of the AML	the client and the representative of the client, public registers
7. Case-recording and record management	the client	the case number given by the attorney, the client’s name, the subject matter of the case, the date of concluding the agency contract, and registration numbers of the court proceedings related to the case, or the filing numbers of other proceedings	For 5 years following the termination of the service assignment, for 10 years in case of electronic documents – for 10 years in case of data and documents requiring countersigning.	Compliance with legal obligations in accordance with Article 6 (1) (c) of the GDPR Legislative reference on which the legal obligation of the personal data processing is based: Section 46 (5) and Section 53 of the Attorneys Act	the data subject, court or other authority
8. Document preservation	the client the respondent the representative’s respondent other participants of the procedure (etc.: witnesses, experts translators)	name, mother’s name; address; email address; telephone number, further data provided regarding the case or procedure; name, mother’s name; address; email address; telephone number, further data provided regarding the case or procedure; name, mother’s name; address; email address; telephone number, further data provided regarding the case or procedure; name, mother’s name; address; email address; telephone number, further data provided regarding the case or procedure;	For 5 years following the termination of the service assignment, for 10 years in case of electronic documents – for 10 years in case of data and documents requiring countersigning.	Compliance with legal obligations in accordance with Article 6 (1) (c) of the GDPR Legislative reference on which the legal obligation of the personal data processing is based: Section 46 (5) and Section 53 (5) of the Attorneys Act	the data subject, court or other authority
9. Escrow management	the client and other participants of the procedure	personal data in case of a natural person, the case identifier of the deposit contract, the type of the deposit, the subject matter of the deposit, the number of the subsidiary account if the custodian attorney-at-law places the deposit in a subsidiary account, in the event of a cash deposit, the amount and currency of the money effectively deposited, the date of signature, amendment or termination of the deposit contract, the date of recording the data into the register of deposits, or the date of modification of any data recorded	For 8 years following the termination of the service assignment, but for at least 10 years following the termination of the escrow agreement.	Compliance with legal obligations in accordance with Article 6 (1) (c) of the GDPR Legislative reference on which the legal obligation of the personal data processing is based: Section 51 (1) of the Attorneys Act	the data subject
10. Fee and cost accounting, billing	the client	name, address, email address, billing data	For 8 years from drawing up the account, the annual report of the current financial year.	Compliance with legal obligations in accordance with Article 6 (1) (c) of the GDPR Legislative reference on which the legal obligation of the personal data processing is based: Section 169 (1) of the Accounting Act	data subject
11. Debt Collection	the client	name, address, mother’s name, place and date of birth, email address, in case of legal entity: the name of the representative	For the general limitation period (5 years).	legitimate interest in accordance with Article 6 (1) (f) of the GDPR	data subject

IV. YOUR RIGHTS IN CONNECTION WITH THE DATA PROCESSING

Right of access

You have the right to obtain information on the origin, categories, storage duration, recipients, and purpose of the data relating to you processed by the Law Firm, as well as information on the nature of the processing, your rights as data subjects, the right to file a complaint, and automated decision-making and profiling (if applicable).

The Law Firm shall provide a copy of the personal data undergoing processing. For any further copies requested by you, the Law Firm may charge a reasonable fee based on administrative costs. Where you make the request by electronic means, and unless otherwise requested by you, the information shall be provided in a commonly used electronic form.

Right to rectification

In connection with your processed personal data, you have the right to request the rectification of your inaccurate personal data from the Law Firm, who is obliged to do it without undue delay. You also have the right to have incomplete personal data completed (including by means of providing a supplementary statement).

Right to erasure

You have the right to obtain from the Law Firm the erasure of personal data concerning you without undue delay and the Law Firm shall have the obligation to erase personal data without undue delay where one of the following grounds applies: the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

the data subject withdraws consent on which the processing is based, and there is no other legal ground for the processing;
the data subject objects to the processing and there are no overriding legitimate grounds for the processing, or the processing is used for direct marketing purposes;
the personal data have been unlawfully processed;
the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
the personal data have been collected in relation to the offer of information society services.

Right to restriction of processing

You have the right to obtain from the Law Firm restriction of processing where one of the following applies:

the accuracy of the personal data is contested by you, in this case the restriction is for a period that enables you to verify the accuracy of the personal data;
the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
the Law Firm no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims;
you have objected to the Law Firm's processing pursuant to public interest or compelling legitimate grounds, in this case the duration of the restriction is for the time period needed for the verifying whether the legitimate grounds of the controller override those of the data subject.

Right to object

You have the right to object, on grounds relating to your particular situation, at any time to the Law Firm's processing of personal data concerning you where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Law Firm, the processing is necessary for the purposes of the legitimate interests pursued by the Law Firm or by a third party, including profiling based on those provisions. In this case, the Law Firm shall no longer process the personal data unless the Law Firm demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of you or for the establishment, exercise or defence of legal claims.

Right to data portability

You have the right to receive personal data in respect of you which you have provided to the Law Firm, in a structured, commonly used and machine-readable format and have the right to transmit those data to another data controller without hindrance from the Law Firm. Furthermore, you have the right to have the personal data transmitted directly from the Law Firm to another data controller, where technically feasible.

Right to withdraw your consent

You have the right to withdraw your consent at any time at any of the contact details in this Data Privacy Policy, in which case the Law Firm will no longer process your persona data for that purpose. The withdrawal of consent does not affect the lawfulness of processing based on consent before withdrawal.

Right to information

The Law Firm shall provide information on action taken on a request to you without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests, from such extension the Law Firm shall inform you within one month of the receipt of the request, together with the reasons for the delay.

The information is free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the Law Firm may either charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request.

Right to file complaints and seek legal redress

You have the right to file a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of your personal data infringes the GDPR. The complaint can be filed with the National Data Protection and Freedom of Information Authority (NAIH) (address: 1125 Budapest, Szilágyi Erzsébet fasor 22/C.; telephone: +36 1 391 1400; fax: +36 1 391 1410; www.naih.hu; ugyfelszolgalat@naih.hu).

You have the right to judicial remedy where you consider that your rights under the GDPR have been infringed as a result of the processing of your personal data in non-compliance with the GDPR. The court acts in the case as a matter of urgency. The Regional Courts have jurisdiction over data infringement cases. Legal proceedings may also be brought before the court where you have domicile or residence.

V. AUTOMATED DECISION-MAKING, PROFILING

The Law Firm shall not make a decision regarding you based on solely automated decision making. Furthermore, the Law Firm shall not make a profile about you.

VI. DATA PROCESSOR

In connection with its activity the Law Firm uses in particular the following Data Processors:

Octonull Kft. (H-1133 Budapest, Árbóc utca 6.) – operating the billing program “Billingo” used by Law Firm,
Microsoft Ireland Operations Ltd. (One Microsoft Place, South County Business Park Leopardstown Dublin 18, D18 P521 Ireland) – Online hosting provider (operating the email system).

In addition to the above, in order to perform the assignments, the Law Firm occasionally engages translators, legal experts, or attorneys as subcontractors, tax and financial advisers, who are also considered Data Processor. You may request further information regarding the specific Data Processors from the Law Firm on the contact details indicated above.

VII. TRANSFER OF PERSONAL DATA

The Law Firm shall not transfer the personal data to a non-EEA member state or to an international organisation, unless the nature of assignment makes such transfer of personal data necessary and justified. In this case, the transfer of the personal data shall be completed in compliance with the applicable legislation and adequate security measures.

VIII. WHO CAN ACCESS THE PERSONAL DATA

The Law Firm may only disclose data subject’s personal data to state agencies in exceptional cases. Thus, for example if a court proceeding is initiated in a legal dispute between the Law Firm and the data subject and it is required to hand over to the court documents containing the data subject’s personal data, the Law Firm is requested by the police authority to disclose personal data of the data subject for the purposes of an investigation.

The following persons shall be entitled to inspect the records kept about the cases and to request data from those records:

the person or entity performing the regulatory inspection on behalf of the bar association, for the purpose of verifying compliance with rules applicable to pursuing the professional activities of an attorney-at-law, and to the extent required for the inspection;
the substitute attorney-at-law and the appointed caretaker attorney, with a view to protecting the rights of clients, to the extent required to fulfil their duties arising from the Attorney Act.

IX. DATA SECURITY MEASURES

The Law Firm stores the personal data at its registered office. The Law Firm takes the necessary information security measures to protect the data subject’s data among others from unauthorized access or from unauthorized alteration. The Law Firm takes adequate organizational measures to prevent disclosing personal data to an unauthorised person. In order to ensure the security of the personal data and to prevent unauthorised access to it, the Law Firm takes the following measures: the access to the server and the computers is password-protected.

X. OTHER PROVISIONS

The Law Firm reserves the right to amend and update this Data Privacy Policy - with the effect from the date of publication of amendment, update - unilaterally, without prior notice. In order to monitoring the amendments and updates, please visit regularly www.szarkiszjanlegal.hu website on which the amended and updated Data Privacy Policy will be published, thus it is available for the data subjects. The Law Firm publishes the Data Privacy Policy on the website referred former, therefore the Data Privacy Policy is available for the data subjects.

By concluding the engagement letter and by accepting the rendered legal services, the client acknowledges and accepts the present Data Privacy Policy without any further statements.