'/%3E%3C/svg%3E){kind=small}
We hereby wish to inform you how ABT Legal Law Firm Association and its member firms collect, use, share and otherwise process personal data in the course of their activities.
The controllers of personal data relating to visits to the www.abtlegal.hu website (the “Website”) are the member firms of ABT Legal Law Firm Association as joint controllers (see Section XI); the controller of all other personal data is the member firm of ABT Legal Law Firm Association with which you conclude a contract (the “Firm”).
The member firms of ABT Legal:
Lovrecz, Mangoff & Temesi Law Firm (Lovrecz, Mangoff és Temesi Ügyvédi Iroda)
Czifra & Neményi Law Firm (Czifra & Neményi Ügyvédi Iroda)
For the purposes of this Privacy Policy, personal data means any information on the basis of which you or any other person can be identified, directly or indirectly, either on its own or in combination with other data available to the Firm.
If you provide the Firm with personal data relating to third parties (in particular family members, colleagues or other data subjects), you are responsible for ensuring that such persons have been duly informed of the provisions of this Privacy Policy and that you are lawfully authorised to provide such data. You are also responsible for ensuring that the personal data provided are true, accurate and, where necessary, up to date.
I. Summary of key information
| Controller | ABT Legal Law Firm Association and its member firms | Section XI |
| Purposes of processing | Initial contact, making offers, client identification, conclusion of contracts, communication, performance of engagements (legal representation, drafting of documents, legal opinions, escrow), recruitment | Section III |
| Legal basis | In the course of legal practice, the circumstances of processing (in particular the legal basis or the scope of data processed) may vary from engagement to engagement. | Section III |
| Processors | Microsoft Ireland Operations Ltd., accounting service providers | Section IV |
| Place of processing, transfers to third countries | The controller primarily stores data within the European Union. Should any transfer to a third country occur in the course of a service provider’s operations, it may only take place subject to the appropriate safeguards set out in Chapter V GDPR. | Section V |
| Automated decision-making | No automated decision-making takes place. | |
| Data subject rights | Right to information, right to obtain a copy, rectification, withdrawal of consent, erasure, objection, complaint, legal remedies | Section VIII |
| Data security | Section VI |
II. Collection of personal data
The Firm processes personal data of the following persons:
- our clients and/or prospective clients and their contact persons;
- third parties connected with the performance of engagements received from our clients;
- contact persons of providers supplying goods and services to the Firm;
- visitors to the Website.
We collect the following categories of personal data about clients, prospective clients, suppliers and other third parties, and visitors to the Website:
Basic data: name, gender, position, organisation, job title, telephone number, postal address, e-mail address, contact details and information relating to family life (other than special categories of personal data), including information on family life, children, hobbies and interests.
Special categories of personal data: in limited circumstances, where you have provided us with information necessary for the specific service provided to you: religious or other beliefs, racial or ethnic origin, sexual orientation, health data and data concerning trade union membership.
Owing to the nature of legal practice, the controller may process special categories of personal data within the meaning of Article 9(1) GDPR.
Such data are processed primarily on the basis of Article 9(2)(f) GDPR, which permits the processing of special categories of personal data for the establishment, exercise or defence of legal claims.
The controller processes only such special categories of personal data as are necessary for handling the given matter, performing the engagement or establishing, exercising or defending a legal claim.
Special categories of personal data may only be accessed by persons involved in handling the matter who are bound by confidentiality obligations.
Data relating to services provided to clients: personal data received from clients about their employees, customers or other persons known to them, billing data and payment history, as well as client feedback.
Transaction data: personal data contained in documents, correspondence or other materials relating to transactions, proceedings or other legal matters in which we advise our clients.
Communication data: personal data arising from communication with us, such as contact details, e-mail metadata and other technical data.
Regulatory compliance data: identifiers, data from passports or other identity documents, dates of birth, beneficial ownership data and due diligence data.
Job application data: data provided by job applicants or others in connection with job opportunities.
Data relating to visits to the Website: technical data necessary for displaying the Website (IP address, browser type, time of visit), the visitor’s consent choices regarding cookies, and data provided when contacting us through the Website.
III. Use of personal data
Purposes and legal bases of the use of personal data:
In the course of legal practice, the circumstances of processing (in particular the legal basis or the scope of data processed) may vary from engagement to engagement. The most common processing activities are the following.
1. Processing related to the conclusion and performance of engagement contracts
Initial contact
| Purpose of processing | Establishing contact with a prospective client with a view to a possible engagement |
| Categories of data processed | Natural personal identification data (name, address) and contact data (e-mail address, telephone number). |
| Source of personal data | The controller typically receives the personal data from other clients or from public sources. |
| Legal basis | The legitimate interest of the controller under Article 6(1)(f) GDPR. The controller has a legitimate interest in receiving and responding to enquiries from prospective clients and in examining the possibility of establishing an engagement. Processing is limited to the data necessary for making contact and handling the enquiry. |
| Retention period | 30 days following the contact; if the contact is successful and an engagement is established, processing continues on another legal basis as set out below. |
Conclusion of the contract
| Purpose of processing | Preparation and conclusion of the engagement contract |
| Categories of data processed | Natural personal identification data (name, address) and such other personal data as are necessary for establishing the engagement. |
| Source of personal data | The controller typically receives the personal data from the client. |
| Legal basis | Processing is necessary for the conclusion or performance of the contract or in order to take steps at the request of the data subject prior to entering into the contract – Article 6(1)(b) GDPR. |
| Retention period | 8 years from the termination of the engagement contract, as this is the retention period required under accounting rules for invoices and supporting documentation. |
Client identification
| Purpose of processing | To promote the security of legal transactions and to prevent fraud, money laundering and other criminal offences, the controller is required to carry out client identification, including the identification of the beneficial owner and of politically exposed person status. |
| Categories of data processed | Name (name at birth), nationality, place and date of birth, mother’s name, address (or place of residence), type and number of identity document, copy of the document, specimen signature, facial image, the beneficial owner’s name, nationality, birth data, address and place of residence, politically exposed person status and the reason for it. |
| Legal basis | Compliance with a legal obligation to which the controller is subject [Article 6(1)(c) GDPR]. Processing is required by Section 32 of Act LXXVIII of 2017 on the Professional Activities of Attorneys (“Üttv.”) and Section 73(1) of Act LIII of 2017 on the Prevention and Combating of Money Laundering and Terrorist Financing (“Pmt.”). The making of copies of documents is based on Section 7(8) Pmt. The conditions of processing are set out primarily in Sections 32–33 Üttv. and Sections 6–7, 11, 56–58 and 73 Pmt. |
| Cases in which client due diligence is mandatory |
Under Sections 6(1) and 73(1) Pmt., client due diligence is mandatory in the following activities of attorneys:
|
| Identification |
The controller identifies the client, its proxy, the person authorised to dispose and the representative. To verify identity, the controller requires the presentation of the following documents:
During identification, the controller is required to record the data specified in Section 32(3) Üttv. and Sections 7–9 Pmt., and may verify them in state registers (for example the register of personal data and addresses or the register of driving licences). |
| Transfer of data | Data processed during client identification are or may be shared with the Firm’s processors; furthermore, in cases of high risk as defined by the Pmt., the transfer of data to the competent authorities or organisations is mandatory in the cases prescribed by law. |
| Retention period | The controller is required to retain the data for 8 years from the performance of the engagement or, in the case of a continuing engagement, from the termination of the business relationship; the retention period is based on the provisions of the Pmt. |
Communication
| Purpose of processing | Performance of the contract concluded with us; proper communication with the contracting partner or client |
| Categories of data processed | The client’s name, e-mail address, telephone number and, where applicable, any further personal data communicated by the client in connection with the contact or the matter. Where the client contacts us on behalf of a legal person, processing covers the client’s name, business contact details (telephone number, e-mail address) and the name of the company for which the client works. Where the client also discloses personal data of other data subjects (e.g. employees, former employees) in the matter presented, processing also covers such personal data. |
| Legal basis | Processing is necessary for the conclusion or performance of the contract or in order to take steps at the request of the data subject prior to entering into the contract – Article 6(1)(b) GDPR. In the case of legal persons, processing is based on the legitimate interest in enforcing the interests of the client legal person and in performing the engagement given by it and maintaining contact – Article 6(1)(f) GDPR. The controller’s legitimate interest is to ensure the professional and administrative communication necessary for performing the engagement, to maintain continuity of case handling and to manage contractual relationships. Processing affects the privacy of data subjects only to the necessary and proportionate extent. |
| Retention period | The controller is required to retain the data for 8 years from the performance of the engagement or, in the case of a continuing engagement, from the termination of the business relationship, as this is the retention period required under accounting rules for invoices and supporting documentation. |
2. Processing related to legal practice
Legal representation
| Purpose of processing | Enforcing the client’s rights, legitimate interests and legal claims, and to that end using personal data in drafting letters, submissions and documents, and transmitting them to third parties (e.g. other legal persons, authorities, courts). |
| Categories of data processed | Typically the natural personal identification data and addresses of the data subjects (client, opposing party, other participants in the proceedings) and such personal data as are necessary in contentious or non-contentious proceedings or for asserting or presenting a legal claim (e.g. personal data contained in contracts or legal declarations). |
| Source of personal data | The controller typically receives the personal data from the client or obtains them from third parties (e.g. by querying the company register, the land register or the vehicle register). These data are predominantly personal data necessary to prove or substantiate a fact or circumstance. |
| Legal basis | Where a law requires the transmission or use of certain personal data (e.g. mandatory content of a statement of claim), the legal basis is compliance with a legal obligation [Article 6(1)(c) GDPR]. This also includes cases where the court orders the taking of evidence ex officio and personal data are transmitted to comply with that order. Where the law does not require the transmission or use of personal data but the data are necessary for presenting or enforcing a legal claim, the legal basis is the legitimate interest in enforcing or defending legal claims [Article 6(1)(f) GDPR]. The controller has a legitimate interest in performing the processing operations necessary for enforcing its clients’ rights, presenting their legal claims or defending against claims. Processing is limited to data relevant to the given proceedings or legal matter. Beyond the above, in respect of data not falling within those cases which the Client shares in connection with the engagement, the legal basis is consent [Article 6(1)(a) GDPR]. |
| Retention period | 10 years from the termination of the engagement contract, as this is the mandatory document retention period. |
Drafting and countersigning of documents
| Purpose of processing | Preparation of a document requested by the client (e.g. contract, legal declaration, will) and the use of personal data in the course thereof. In the case of countersigning, the purpose is to produce a document of full probative value. |
| Categories of data processed | Typically the names, natural personal identification data and addresses of the data subjects and such personal data as are necessary for preparing the document. |
| Source of personal data | The controller typically receives the personal data from the client or obtains them from third parties (e.g. by querying the company register, the land register or the vehicle register). The controller uses these data predominantly to substantiate certain circumstances and to ensure that the document is capable of producing the legal effect intended by the client. |
| Legal basis | Where the law governing the document prescribes which personal data are required for its preparation, the legal basis is compliance with a legal obligation [Article 6(1)(c) GDPR]. Where the law does not specify the personal data required but the data are necessary for the protection or enforcement of a legal claim, the legal basis is the related legitimate interest [Article 6(1)(f) GDPR]. Where the engagement concerns the drafting of a document in which the natural person client provides only his or her own personal data and the law does not specify the personal data required, the legal basis is the performance of the contract [Article 6(1)(b) GDPR]. |
| Retention period | 10 years from the termination of the engagement contract, as this is the mandatory document retention period. |
Legal opinions and position statements
| Purpose of processing | Preparation of a legal opinion or position statement in a matter presented by the client which requires the use of personal data. |
| Categories of data processed | Typically the names, natural personal identification data and addresses of the data subjects and such personal data as are necessary for preparing the legal opinion or position statement. |
| Source of personal data | The controller typically receives the personal data from the client. |
| Legal basis | Where the engagement concerns a legal opinion or position statement in which the natural person client provides only his or her own personal data, the legal basis is the performance of the contract [Article 6(1)(b) GDPR]. In other cases, where the matter relates to the protection or enforcement of the client’s legal claim, the legal basis is the related legitimate interest [Article 6(1)(f) GDPR]. |
| Retention period | 10 years from the termination of the engagement contract, as this is the mandatory document retention period. |
3. Contracts with third parties providing services to the Firm
Communication
| Purpose of processing | Performance of the contract concluded with us; proper communication with the contracting partner |
| Categories of data processed | The name, e-mail address and telephone number of the service provider and, where applicable, further personal data communicated by the service provider. Processing also covers the service provider’s name, business contact details (telephone number, e-mail address) and the name of the company for which the service provider works. |
| Legal basis | Processing is necessary for the conclusion or performance of the contract or in order to take steps at the request of the data subject prior to entering into the contract – Article 6(1)(b) GDPR; in the case of legal persons, the legal basis is the legitimate interest in enforcing the interests of the contracting legal person [Article 6(1)(f) GDPR]. |
| Retention period | The controller is required to retain the data for 8 years from the termination of the contract, as this is the retention period required under accounting rules for invoices and supporting documentation. |
The above list is not exhaustive and covers only the most common processing activities; accordingly, this part of the Privacy Policy does not constitute comprehensive information on processing related to legal practice.
During verbal consultations, clients may receive further information on processing, and the engagement contract may set out the specific circumstances of processing in more detail. In this context, we wish to inform you that we use basic data and data relating to services provided to clients in order to provide legal advice and respond to enquiries. In general, we need to process your data in this way in order to fulfil our obligations under our contracts with our clients. For this purpose, we use basic data, in certain cases special categories of personal data, and data relating to services provided to clients in order to carry out our activities and manage our client relationships. This processing is necessary for us to fulfil our obligations under our contracts with our clients (e.g. issuing and processing invoices) and suppliers (e.g. managing goods and services provided to the Firm).
To ensure the security of the Website and our IT systems and to prevent abuse (e.g. automated spam), we use the Google reCAPTCHA service on the Website’s forms. The legal basis for this processing is the legitimate interest of the controller [Article 6(1)(f) GDPR].
Data of job applicants are processed for the purpose of assessing applications and conducting the selection process. Where processing is necessary in order to take steps at the request of the data subject prior to entering into an employment contract, the legal basis is Article 6(1)(b) GDPR and the data are retained for 6 months following the conclusion of the selection process. Where processing is required by law, the legal basis is Article 6(1)(c) GDPR. For processing operations not falling under either of the above legal bases, the applicable legal basis shall be determined on the basis of the purpose and circumstances of the processing concerned.
IV. Use of processors
For recording electronic documents and backing up copies of paper documents, the Firm uses a cloud service provider as processor. Microsoft Ireland Operations Ltd. (registered office: 70 Sir John Rogerson’s Quay, Dublin 2, D02 R296, Ireland) acts as cloud service provider; furthermore, legal persons providing accounting services to the controller also act as processors.
The Firm occasionally uses the services of substitute attorneys as processors, in which case substitute attorneys not named in the engagement are processors of the personal data. In such cases, the controller informs the data subject separately.
In connection with the operation of the Website, Microsoft Ireland Operations Limited acts as processor in its capacity as the Website’s hosting provider (Microsoft Azure; registered office: 70 Sir John Rogerson’s Quay, Dublin 2, D02 R296, Ireland), as does CookieYes Limited (registered office: 3 Warren Yard, Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom), which manages and logs cookie consents. The legal basis for the processing related to logging cookie consents is the legitimate interest of the controller [Article 6(1)(f) GDPR] in being able to demonstrate that consent has been given.
V. Place of storage of personal data
Personal data are recorded partly on paper and partly electronically. Data recorded in paper documents are kept at the Firm’s registered office.
Electronic documents and documents recorded and saved electronically are in all cases stored within the European Union.
VI. Basic data security measures
The controller implements a number of data security measures to protect personal data, for example:
- the Firm uses only licensed software and antivirus programs and regularly installs the updates issued by the software manufacturers;
- the Firm applies appropriate network security systems, such as detailed access rights management; access restrictions; encryption where applicable; logging; periodic backups; virus and malware protection; physical protection; incident management; and data protection and information security training for staff.
VII. Sharing of personal data
We may share personal data with the following categories of recipients:
- processors;
- providers of third-party services used on the Website, as recipients: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC (United States of America) as providers of the YouTube, Google reCAPTCHA, Google Maps and Google Fonts services. When these services are used, technical data (such as the IP address) may also be transferred to the United States; such transfers are based on the European Commission’s adequacy decision on the EU–US Data Privacy Framework;
- mandatory disclosure and legal claims: the Firm may share personal data in order to comply with its tax reporting obligations, any subpoena, court order or other legal process, any request from an authority, or any other legally enforceable claim or obligation. We also share personal data to establish or protect our own rights, property or safety, or those of others, or to defend against legal claims.
VIII. Rights of data subjects and rules on exercising them
Right to information
The data subject may request information about the personal data processed by the Firm. In this case, the Firm informs the data subject of which personal data it processes and for what purpose, of the duration of processing, of the rights related to processing and of the right to lodge a complaint with the NAIH.
Right to obtain a copy
The data subject may request a copy of the personal data processed by the Firm. In this case, the Firm sends a copy of the personal data processed about the data subject to the contact address indicated by the data subject (e-mail address or postal address).
Right to rectification
At the data subject’s request, the Firm amends or corrects the personal data or stores the new personal data provided by the data subject.
Withdrawal of consent
Where processing is based on the data subject’s consent, the data subject has the right to withdraw consent at any time. Withdrawal does not, however, affect the lawfulness of processing based on consent before its withdrawal.
Right to erasure
The data subject may request the erasure of his or her personal data by letter sent to the Firm’s contact address. The controller erases the personal data where:
- they are no longer necessary for the purpose for which they were collected or processed;
- processing is based on the data subject’s consent, the data subject has withdrawn consent and there is no other legal ground for processing;
- the data subject has successfully objected to the processing;
- the personal data have been processed unlawfully;
- erasure is required by law.
The controller cannot comply with a request for erasure where processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims, or where the controller is subject to a retention obligation under law.
Owing to the nature of legal practice, the controller may be required to retain personal data after the termination of the engagement, in particular under the laws on legal practice, accounting, the prevention of money laundering and the enforcement of legal claims. In such cases, the data may only be erased after the mandatory retention period has expired.
Right to be forgotten
Where the Firm has made the data subject’s personal data public and is required to erase them, the Firm takes all reasonable steps to inform controllers which have received the published data that the data subject has requested the erasure of the personal data from the Firm.
Right to restriction
The data subject may request the restriction of processing of personal data where:
- processing is unlawful and the data subject opposes erasure and requests restriction of use instead;
- the data subject contests the accuracy of the personal data and the controller still needs to verify them;
- the data subject has objected to processing and verification is pending as to whether the controller’s legitimate grounds override;
- the Firm no longer needs the personal data but the data subject requests restriction for the establishment, exercise or defence of legal claims.
When exercising the right to restriction, the data subject must indicate the ground on which restriction is requested. The Firm complies with a request for restriction by storing the personal data separately from all other personal data.
Right to data portability
The data subject has the right to receive his or her personal data in a structured, commonly used and machine-readable format and to transmit them to another controller. The data subject may request that the Firm transmit the personal data directly to another controller.
Right to object
The data subject has the right to object at any time, on grounds relating to his or her particular situation, to processing of personal data based on legitimate interest [Article 6(1)(f) GDPR].
In such a case, the Firm examines the arguments put forward by the data subject and may, as a rule, continue processing only if the processing relates to the establishment, exercise or defence of legal claims.
Where processing is based on legitimate interest, the data subject has the right to object, on grounds relating to his or her particular situation, to the processing of his or her personal data. In this case, the controller may no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or which relate to the establishment, exercise or defence of legal claims.
Where processing is based on the controller’s legitimate interest, the controller has in all cases carried out a balancing test weighing the rights and freedoms of data subjects against the purpose of processing. As a result of the balancing test, the controller has concluded that the processing operations are necessary to achieve the given purpose and, subject to appropriate safeguards, do not result in a disproportionate restriction of data subjects’ rights.
In the above cases, the controller examines the request received and complies with it within one month, which may be extended by up to two further months. If the request is refused, the Firm informs the data subject within one month of receipt of the request of the reasons for the refusal and of the possibility of lodging a complaint with the Authority and seeking a judicial remedy.
Where the Firm has reasonable doubts concerning the identity of the person making the request, it may request the provision of additional information necessary to confirm the identity of the data subject. This applies in particular where the data subject exercises the right to obtain a copy, in which case it is justified for the controller to ascertain that the request originates from the entitled person.
IX. Legal remedies
If the data subject considers that the processing carried out by the Firm or the handling of a data subject request does not comply with legal requirements, he or she may initiate proceedings before the Hungarian National Authority for Data Protection and Freedom of Information (NAIH; postal address: H-1363 Budapest, Pf. 9; e-mail: ) or turn to the courts.
X. Cookies used on the Website
The Website uses cookies necessary for its operation and – only with your prior consent – functional and advertising cookies related to the YouTube video embedded on the home page. We do not use analytics, targeted advertising or social media cookies. The Website also uses third-party services (Google reCAPTCHA, Google Maps, Google Fonts), in the course of which technical data (such as the IP address) may be transferred to Google. A detailed list of cookies, their purposes, duration and legal basis is set out in our Cookie Policy.
You can give your consent when you first visit the Website and change or withdraw it at any time by clicking the cookie icon in the bottom left corner of the Website. Withdrawal of consent does not affect the lawfulness of processing before its withdrawal.
XI. Contact us
If you have any questions or comments regarding this Privacy Policy or our data protection practices, please contact us:
Controller details:
With regard to the Website, the member firms of ABT Legal Law Firm Association, Lovrecz, Mangoff & Temesi Law Firm and Czifra & Neményi Law Firm (H-1037 Budapest, Montevideo utca 3/A; tel.: +36 1 7999 111; e-mail: ; contact person: dr. Zoltán Temesi, attorney-at-law) are joint controllers. The joint controllers have set out their respective responsibilities in an arrangement under Article 26 GDPR. The essence of the arrangement is that requests relating to the exercise of data subject rights and communication with data subjects are handled by Lovrecz, Mangoff & Temesi Law Firm. Data subjects may nevertheless exercise their rights – pursuant to Article 26(3) GDPR – against either of the joint controllers.
For clients represented by, and processing carried out by, Lovrecz, Mangoff & Temesi Law Firm: H-1037 Budapest, Montevideo utca 3/A; tel.: +36 1 7999 111; e-mail: ; contact person: dr. Zoltán Temesi, attorney-at-law.
For clients represented by, and processing carried out by, Czifra & Neményi Law Firm: H-1037 Budapest, Montevideo utca 3/A; tel.: +36 1 7999 111; e-mail: ; contact person: dr. Péter Czifra, attorney-at-law.
This English version is a translation; in case of any discrepancy, the Hungarian version shall prevail.
