NEIZERÜgyvédi Iroda

Privacy Notice

NEIZER Law Office intends to ensure the lawfulness of data processing in respect of personal data it manages. In accordance with this, the Data Subject, with regard to the processing of their personal data, is hereby informed about the processing of personal data, in this Privacy Notice (hereinafter: "Notice"), in compliance with the protection of natural persons with regard to the processing of personal data and the free movement of such data, and repealing Regulation (EC) No 95/46 (General Data Protection Regulation) ("GDPR") adopted by the European Parliament and the Council (EU) 2016/679 Regulation of 27 April 2016.

 

1. CONTROLLER'S DATA

 

NEIZER Law Office Registered office: 1139 Budapest, Teve u. 24-28. A. building III/5.

Branch office: 1024 Budapest, Margit körút. 31-33. 1st floor 1.

Website: www.nzrugyved.hu

Email: iroda@nzrugyved.hu

Phone: +36 1 796 5228

Representative: Dr. Norbert Neizer, managing lawyer (hereinafter: "Controller")

 

2. PURPOSE, LEGAL BASIS, SCOPE OF PROCESSED DATA, TRANSFER OF DATA, PERIOD AND METHOD OF DATA PROCESSING

 

2.1. Data processing related to the fulfilment of mandates

 

If a legal representation agreement has been concluded between the Controller and the Data Subject, the Controller processes the following personal data for the purpose of fulfilling this agreement:

 

• personal data of the Data Subject, the client's representative, the opposing parties, witnesses, experts, and other natural persons concerning the specific mandate.

 

In the case of the above mentioned under point 2.1., the legal basis for data processing is Article 6 (1) (b) of the GDPR (fulfillment of a contract), Article 6 (1) (c) of the GDPR (compliance with a legal obligation), and Section 1 (1) of Act LXXVIII of 2017 on Advocacy (hereinafter: "Advocacy Act").

 

The designation of individuals (positions) who have access to the data: members, trainees, and invoicing staff of the Controller (law firm), depending on the nature of the mandate, access is limited to certain office members or employees.

 

IT processors providing data processing services to the Controller may have access to the data as required.

 

Data transfer takes place as required by the case (e.g., sending the data of an opposing party, witness, or expert to a client outside the EEA who is represented in court proceedings).

 

The period of data processing is 5 years or 10 years (Section 53 (3) and (5) of the Advocacy Act). Data related to the mandate not covered in this section shall be kept until the expiry of the limitation period.

 

2.2. Data processing related to customer identification

 

If the legal regulations require it, the Data Controller processes the following data related to customer identification:

 

• Data specified in Section 32 (3) and (7) and Section 33 (2) of the Public Procurement Act (hereinafter: "Üttv.")

 

In the case of the provisions set forth in Section 2.2, the legal basis for data processing is Article 6 (1) (c) of the GDPR (compliance with a legal obligation) and Sections 32-33 of the Üttv.

 

The following individuals (positions) have access to the data: members of the Data Controller (law firm), trainee lawyers, and billing staff.

 

In cases required by the Üttv., the data is transmitted to the financial information unit operating within the National Tax and Customs Administration (hereinafter: "NAV") (Sections 30-31 of the Public Procurement Act).

 

The data is not transmitted outside the European Economic Area (hereinafter: "EEA").

 

The Data Controller retains the data for the period specified in Section 112 (2) of the Üttv. for data specified in Section 32 (3) and for eight years from the completion of the mandate for data specified in Section 33 (2) of the Üttv. (Section 33 (7) of the Üttv., Section 56 (2) and Section 57 (2) of Act LIII of 2017 on the prevention and combating of money laundering and terrorist financing (hereinafter: "Pmt.")).

 

2.3 Data processing related to customer due diligence

 

If the legal regulations require it, the Data Controller processes the following data related to customer due diligence:

 

• Data specified in Section 7 (2) and (8) of the Pmt.

 

In the case of the provisions set forth in Section 2.3, the legal basis for data processing is Article 6 (1) (c) of the GDPR (compliance with a legal obligation) and Sections 7-11, and, where applicable, Sections 17-21 of the Pmt.

 

The following individuals (positions) have access to the data: members of the Data Controller (law firm), trainee lawyers, and billing staff.

 

In cases required by the Pmt., the data is transmitted to the territorial chamber on the basis of Section 74 (1) of the Pmt. and to the financial information unit operating within the National Tax and Customs Administration on the basis of Section 75 (1) of the Pmt.

 

The data is not transmitted outside the EEA.

 

The Data Controller retains the data for eight years from the completion of the mandate (Section 56 (2) and Section 57 (2) of the Pmt.).

 

2.4. Data processing related to registry keeping

 

If required by law, the Data Controller processes the following data related to customer identification:

 

• Data specified in Section 53 (2) of the Act C of 2003 on Electronic Communications (ECA).

 

The legal basis for processing data recorded in this section 2.4 is Article 6(1)(c) of the GDPR (compliance with a legal obligation) and Section 53(1) of the ECA.

 

The job titles of those who have access to the data are: members of the Data Controller (law firm), trainee lawyers, and invoicing staff.

 

The data may be forwarded in cases required by the ECA (Section 53(4)), but the data will not be forwarded outside the EEA.

 

The Data Controller retains the data for 5 or 10 years (Sections 53(3) and (5) of the ECA).

 

2.5. Data processing related to business partners

 

If a contract has been concluded between the Data Controller and your employer, the Data Controller processes the following personal data of you as a contact person (provided to the Data Controller by your employer) for the performance of the contract:

 

your last name, first name, position, phone number, and email address.

 

The legal basis for processing data recorded in this section 2.5 is Article 6(1)(f) of the GDPR (legitimate interests of the Data Controller or your employer).

 

The job titles of those who have access to the data are: members of the Data Controller (law firm), trainee lawyers, and invoicing staff.

 

The data will not be forwarded.

 

The Data Controller retains the data for up to 1 year from the date of the change of the contact person.

 

2.6. Applicants for job advertisements

 

If you consent, the Data Controller processes your following data related to job applications:

 

• Data sent in your resume, such as surname, first name, phone number, address, email address, photograph, description of professional experience, spoken language(s).

 

The legal basis for data processing in this section 2.6. is your consent under Article 6(1)(a) of the GDPR.

 

The Data Controller can only consider your application if you give your consent to the processing of your personal data contained in your resume for job advertisement purposes by the Data Controller.

 

The job titles of those who have access to the data: Members of the Data Controller (law firm), recruitment staff responsible for the recruitment process.

 

The data will not be transmitted to third parties.

 

If you are not the successful candidate for the advertised position, the Data Controller will immediately delete your personal data after the decision to fill the position has been made, unless you consent to the further processing of your personal data for a period of 6 months after being informed of the decision.

 

2.7. Contact

 

The Data Controller informs you that, in the course of scheduling and coordinating a personal consultation with the Data Controller, the following data will be processed:

 

• Personal data provided during contact (surname, first name, phone number, email address).

 

The legal basis for data processing in this section 2.7. is your consent (Article 6(1)(a) of the GDPR).

 

The job titles of those who have access to the data: Members of the Data Controller (law firm), trainee lawyers, secretarial staff of the Data Controller.

 

The Data Controller will not use or be able to use your personal data for purposes other than those defined in this section 2.7.

 

No data transmission will take place.

 

The Data Controller will process the data until the purpose of the contact is achieved or until a contract is concluded with the contacting party.

 

2.8. Data processing on the website and social media (Facebook, LinkedIn) maintained by the Data Controller.

 

Disclosure of personal data of any natural person on the website (hereinafter: "Website") and social media platforms maintained by the Data Controller is possible without revealing the identity of the individual concerned.

 

Part of the links on the Website and social media platforms may direct to websites maintained and/or operated by other data controllers, for which the Data Controller assumes no responsibility for the content and any damage arising from the use of such information.

 

Furthermore, the Data Controller informs that visitors of the Website and social media platforms may contact the Data Controller electronically (by providing their name and e-mail address).

 

The Data Controller uses the following social media platforms:

 

• Facebook/Instagram:

 

The Data Controller informs you that it maintains a Facebook and Instagram page at www.facebook.com/nzrugyved and www.instagram.com/nzrugyved. The Data Controller primarily publishes its own intellectual property (articles, opinions, statements) on its Facebook page, while it displays images, videos, and short professional content on its Instagram page, and anyone can comment on such posts regardless of whether the Facebook and Instagram pages are liked. The Data Controller further informs that visitors to the Facebook and Instagram pages may also contact the Data Controller directly via Messenger and Instagram messages.

 

Regarding the Facebook and Instagram pages, the Data Controller informs you that it is considered a joint data controller with Facebook (1601 S. California Ave, Palo Alto, CA 94304, USA) as the operator. The Data Controller informs that Meta Platforms Ireland Limited (4 Grand Canal Square, Dublin, Ireland) is responsible for the operation of Facebook and Instagram in Europe. The Data Controller's Facebook and Instagram pages operate within the data protection regulations of Facebook and Instagram, which can be accessed at the following link: https://www.facebook.com/policy.php and https://privacycenter.instagram.com/policy/?entry_point=ig_help_center_data_policy_redirect.

 

• LinkedIn:

 

The Data Controller informs you that it maintains a LinkedIn profile at https://www.linkedin.com/company/37002599/admin/.

 

The Data Controller primarily publishes posts and articles on its LinkedIn profile, to which anyone can comment regardless of whether they like the LinkedIn page or not. The Data Controller can be contacted via messaging on the LinkedIn page.

 

Regarding the LinkedIn page, the Data Controller hereby informs you that it qualifies as a joint data controller with LinkedIn (2029 Stierlin Court Mountain View, CA 94043, USA) as the operator. The Data Controller informs that the operator of LinkedIn in Europe is LinkedIn Ireland (Privacy Policy Issues, Wilton Plaza, Wilton Place, Dublin 2, Ireland) responsible for the operation of LinkedIn. The Data Controller's LinkedIn page operates within the framework of LinkedIn's privacy policy. The Data Controller's LinkedIn page operates in accordance with LinkedIn's data management policy, which can be found at the following link: https://www.linkedin.com/legal/privacy-policy.

 

3. DATA PROCESSING

 

The Data Controller uses the data processors indicated in this Information in connection with its activities.

 

• Microsoft USA / Microsoft Hungary Ltd. (Headquarters: Redmond, Washington State, USA / Graphisoft Park 3, 1031 Budapest, Hungary). In electronic communication with you, the Data Controller uses the Teams and Skype software programs marketed by Microsoft. The Data Controller informs you that the data processing during the use of Teams and Skype software programs is subject to the privacy statement available at the following link: https://privacy.microsoft.com/hu-hu/privacystatement

 

• Toggl Inc. (Headquarters: Tallinn, Estonia) As a result of the efficiency of the work, the Data Controller uses the Toggl Track software program distributed by Toggl Inc. to measure working hours. The Data Controller informs you that the data processing during the use of the Toggl software program is subject to the privacy statement available at the following link: https://toggl.com/legal/

 

• Zoom Video Communications, Inc. (Headquarters: 55 Almaden Blvd, 600, San Jose, CA 95113) In electronic communication with you, the Data Controller uses the Zoom Video software program marketed by Zoom Video Communications, Inc. The Data Controller informs you that data processing during the use of the Zoom Video software program is subject to the privacy statement available at the following link: https://explore.zoom.us/privacy

 

4. DATA TRANSMISSION

 

In connection with its activities, the Data Controller uses data processors or makes the personal data it needs to manage available or transferred to the data processor it uses.

 

To ensure the necessary IT background for its operations, the Data Controller uses the data processing services of MEDIAPORTAL Kft. (Headquarters: Székely Bertalan Street 22, Szekszárd 7100, Hungary, Company registration number: 17-09-007742).

 

To comply with Act C of 2000 on Accounting (hereinafter: "Accounting Act"), the Data Controller provides data required by the Accounting Act to the accountant responsible for the Data Controller's accounting activities. The Data Controller's accounting tasks are currently being carried out by Taxcorp Hungary Kft (Headquarters: Bécsi út 126-128. I. em. A-107, 1034 Budapest, Hungary, Company registration number: 01 09 389208).

 

The Data Controller, in connection with its electronic invoicing, uses the Billingo invoicing program operated by Octonull Ltd. (registered office: Árbóc street 6., Budapest 1133, company registration number: 01-09-198177) as a data processor.

 

The Data Controller, in connection with its activities, uses an online storage service provider for email correspondence. The online storage service is provided by Incore Team Ltd. (registered office: Akácos street 4., Csomád 2161) as a data processor.

 

The Data Controller performs certain types of tasks jointly with other law firms or individual lawyers or other experts as data processors, who are informed about their involvement in the engagement agreement or in other written form provided to the clients.

 

The data processor(s) may only process the personal data provided by the Data Controller, exclusively in accordance with the instructions of the Data Controller and solely for the purpose specified above, based on a written agreement with the Data Controller.

 

The Data Controller only uses data processor(s) who provide appropriate guarantees for compliance with GDPR requirements and for implementing adequate technical and organizational measures to ensure the protection of personal data.

 

5. DATA SECURITY

 

The Data Controller takes all reasonable technical precautions to ensure the secure and inaccessible storage of stored data by third parties.

 

Your personal data is stored by the Data Controller at its registered office (1st floor, Margit boulevard 31-33., Budapest 1024). The storage of your personal data is protected due to the main technical and organizational measures taken for data security.

 

The Data Controller takes all necessary protective and technical measures to ensure that the collected, stored, and processed data is protected, and does everything in its power to prevent its destruction, unauthorized use, and unauthorized modification.

 

The Data Controller provides adequate protection for the personal data it processes, both in paper-based and electronic data storage.

 

6. RIGHTS OF THE DATA SUBJECTS RELATED TO DATA PROCESSING

 

Regarding the processing of personal data, the following rights apply to the data subjects:

 

• Right of access (Article 15 of GDPR): You have the right to obtain from the data controller confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and certain information specified in this Policy.
• The data controller shall provide a copy of the personal data undergoing processing upon request. For any further copies requested by you, the data controller may charge a reasonable fee based on administrative costs. Where you make the request by electronic means, the information shall be provided in a widely used electronic form unless you request otherwise.
• Right to rectification (Article 16 of GDPR): You have the right to obtain from the data controller without undue delay the rectification of inaccurate personal data concerning you. You also have the right to have incomplete personal data completed.
• Right to erasure (Article 17 of GDPR): You have the right to obtain from the data controller the erasure of personal data concerning you without undue delay where one of the following grounds applies:
  • the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  • you withdraw your consent and there is no other legal ground for the processing;
  • the personal data have been unlawfully processed;
  • the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the data controller is subject.
  • Right to restriction of processing (Article 18 of GDPR): You have the right to obtain from the data controller restriction of processing where one of the following applies:
  • you contest the accuracy of the personal data, for a period enabling the data controller to verify the accuracy of the personal data;
  • the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
  • the data controller no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims.
  • The Controller no longer needs the personal data for the purpose of data processing, but you require them for submitting, enforcing, or defending legal claims.
• The right to information in connection with the above rights (Article 12 of the GDPR): The Controller shall inform you without undue delay and in any event within one month of receipt of the request referred to in points (a) to (d) above about the circumstances of the data processing briefly, transparently, in an easily understandable and clear manner. If necessary, considering the complexity of the request and the number of requests, this deadline may be extended by a further two months. The Controller shall inform you of any such extension within one month of receipt of the request, indicating the reasons for the delay. The information shall be provided free of charge. If your request is manifestly unfounded or excessive, in particular because of its repetitive character, the Controller may either charge a reasonable fee considering the administrative costs of providing the information or communication or taking the requested action, or refuse to act on the request. The burden of proving the manifestly unfounded or excessive character of the request shall be on the Controller.
• The right to lodge a complaint (Article 77 of the GDPR): You have the right to lodge a complaint with the supervisory authority - in particular in the Member State of your habitual residence, place of work or place of the alleged infringement - if you consider that the processing of personal data relating to you infringes the GDPR. The complaint may be lodged with the National Authority for Data Protection and Freedom of Information (address: H-1055 Budapest, Falk Miksa utca 9-11.; phone: +36 1 391 1400; fax: +36 1 391 1410; www.naih.hu; ugyfelszolgalat@naih.hu).
• The right to an effective judicial remedy (Article 79 of the GDPR): You have the right to an effective judicial remedy if you consider that the processing of your personal data that infringes the GDPR has infringed your rights under the GDPR. Proceedings against the Controller shall be brought before the courts of the Member State where the Controller has an establishment.
• The right to data portability (Article 20 of the GDPR): If the processing is based on your consent or on a contract between you and the Controller, you have the right to receive the personal data concerning you, which you have provided to the Controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the Controller. You also have the right to request the Office to directly transmit your personal data to another controller, where technically feasible.

 

7. REMEDY

 

The Data Controller takes all necessary steps to ensure that the processing of personal data is lawful and carried out in the highest possible security. If you consider the Data Controller's data processing to be in breach of regulations, it is advisable to contact the Data Controller directly using the contact information provided in section 1 of this Notice before resorting to any other legal remedy.

 

If you still find the data processing to be in breach of regulations even after being informed by the Data Controller, you can file a complaint with the National Data Protection and Freedom of Information Authority or bring legal action before the competent court. You may initiate legal proceedings against our decision regarding the protest within 30 days from the communication of the decision or the last day of the deadline.

 

8. GLOSSARY

 

• "personal data": any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
• "data processing": any operation or set of operations which is performed upon personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
• "restriction of data processing": marking of stored personal data with the aim of limiting their processing in the future;
• "data controller": the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

• "Data processor": a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the data controller;
• "Third party": a natural or legal person, public authority, agency or any other body other than the data subject, the data controller, the data processor and the persons who, under the direct authority of the data controller or data processor, are authorized to process personal data;
• "Consent of the data subject": any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
• "Personal data breach": a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed;

 

9. FINAL PROVISIONS

 

The Data Controller undertakes to ensure that all data processing related to its activities complies with the provisions of this Information and the expectations set forth in the applicable laws.

 

The Data Controller reserves the right to unilaterally and at any time amend this Information. The processing of personal data in the course of the Data Controller's activities is based on the following legislation:

 

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ("GDPR");
• Act CXII of 2011 on the right to information self-determination and freedom of information ("Info tv.");
• Act LXXVIII of 2017 on Advocacy ("Üttv.");
• Act LIII of 2017 on the Prevention and Combating of Money Laundering and Terrorist Financing ("Pmt.");
• Act C of 2000 on Accounting ("Számviteli tv.");
• Act CL of 2017 on Taxation (Art.);
• Act CXXVII of 2007 on Value Added Tax ("Áfa tv.");
• Act LXXXI of 1996 on Corporate Income Tax and Dividend Tax ("Tao tv.").

 

Budapest, 15 May 2023.

 

 

 

NEIZER Law Firm

Dr. Norbert Neizer

Managing Partner