Bán | S.Szabó

Privacy Notice

PRIVACY NOTICE

Bán, S. Szabó, Rausch & Partners Law Firm (registered office: 1051 Budapest, József nádor tér 5-6.; the ”Law Firm”) hereby provides information to its clients and business partners concerning the processing of their data.

The applicable legal regulation is Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (”GDPR”).

I. The controller

Name and contact details of the controller:

Bán, S. Szabó, Rausch & Partners Law Firm

1051 Budapest, József nádor tér 5-6.

telephone: + 36 1 266 3522

e-mail: office@bansszabo.hu

II. Processing performed by the Law Firm

Concerning specific processing procedures being performed by the Law Firm, below you will find the description of the following circumstances of processing:

the purpose and legal basis of processing,
the scope of the data being processed,
the period of processing,
the scope of persons/entities having access to the data; and
possible transmission of the data to third parties.

2.1 Processing related to performance of the mandates with clients

The scope of the data being processed:

the personal data of the client’s contact person, representative, of the party maintaining a contract / having a legal dispute with the client,
in the event of legal dispute in court, the personal data of witnesses and experts as well as other natural persons

The legal basis of processing:

point b) of paragraph (1) of Article 6 of the GDPR (performance of a contract),
point c) of paragraph (1) of Article 6 of the GDPR (compliance with a legal obligation); and
Subsection (1) of Section 1 of Act LXXVIII of 2017 on Legal Practice (the “Act on Legal Practice”), which stipulates that the profession of attorneys-at-law shall mean carrying out activities directed at assisting clients, through the application of the special knowledge of attorneys-at-law, by using the instruments of law and in the manner provided by law, and independently from public authority organs, to assert their rights and rightful interests or fulfil their obligations, and, wherever possible, to settle legal disputes between parties with opposing interests, also covering collaboration in the administration of justice.

Persons/entities having access to the data:

the members, associates, assistants of the Law Firm and the employees of the Law Firm who work in the financial (invoicing) field,
if necessary, the subcontractors of the Law Firm that provide information technology services, with respect to the maintenance of the information technology network.

Transmission of the data:

The data will not be transmitted to any third party.

The period of processing:

In general it shall be 5 years.
In accordance with Subsection (3) of Section 53 of the Act on Legal Practice, the attorney will process the data specified in the records kept on cases for five years following termination of the mandate, for ten years following countersigning documents in the event of countersigning documents, for ten years following registration of the right in cases concerning registration of rights applying to real property in certified public records.
In accordance with Subsection (5) of Section 53 of the Act on Legal Practice, in the event of countersigning documents, the attorney shall retain the document countersigned by him and other documents created in the matter entailed in countersigning the document – if law does not stipulate any longer period of safeguarding or the parties did not agree in safeguarding for any longer period – for ten years from countersigning.
Regarding other matters, the Law Firm shall retain the data concerning the mandate until the end of the limitation period.

2.2 Processing connected with the customer due diligence

If it is required from the Law Firm, the following data will be processed in connection with the customer due diligence.

The scope of the data being processed:

the data determined in Subsections (2) and (8) of Section 7 of Act LIII of 2017 on the Prevention and Combating of Money Laundering and Terrorist Financing (the “Money Laundering Act”), which are recorded by the Law Firm:

a) in the event of natural persons

aa) name and surname,

ab) name and surname at birth,

ac) citizenship,

ad) place and date of birth,

ae) mother’s name at birth,

af) home address, or habitual residence in the absence thereof,

ag) number and type of the identification document;

b) in the event of legal entities or unincorporated organisations

ba) name, abbreviated name,

bb) registered office, or the address of the Hungarian branch of foreign companies, if applicable,

bc) main activities,

bd) name and position of authorised representatives,

be) data referred to in Subparagraphs aa) and af) of Paragraph a) of the delivery agent, if available,

bf) the registered number of legal entities listed in the companies register, or the number of the resolution adopted on the foundation (registration, admission into register) of other legal entities, or their register number,

bg) tax number,

for the purposes of the prevention and combating of money laundering and terrorist financing, the appropriate compliance with the obligations determined in the Money Laundering Act, the full execution of customer due diligence obligations and the effective implementation of supervisory activities, the Law Firm shall, in order to ensure verification of the identity, make copies of the documents presented, which contain the data determined above, including all personal data stated in such documents, with the exception of the page of the official address card where the personal identification code is indicated.

The legal basis of processing:

point c) of paragraph (1) of Article 6 of the GDPR (compliance with a legal obligation); and
Sections 7-11 and, if appropriate, Sections 17-21 of the Money Laundering Act, i.e., the customer due diligence obligation.

Persons/entities having access to the data:

The members, associates, assistants of the Law Firm and the employees of the Law Firm who work in the financial (invoicing) field.
If necessary, the subcontractors of the Law Firm that provide information technology services, with respect to the maintenance of the information technology network.

Transmission of the data:

The data will be transmitted in the cases required by the Money Laundering Act:

In accordance with Subsection (1) of Section 74 of the Money Laundering Act, attorneys, corporate lawyers and notaries public shall file their report with the regional bar association or regional branch, respectively. The employees of attorneys and notaries public (including assistant attorneys) shall file the report with the attorney or notary public who exercises employer’s rights. The attorney or notary public who exercises employer’s rights shall forward that report forthwith to the regional bar association. Employees of law firms shall report to the person designated by the members’ meeting, who shall forward the report forthwith to the bar association with which the law firm is registered.
In accordance with Subsection (1) of Section 75 of the Money Laundering Act, to the extent required for the performance of its tasks in carrying out the analysis and assessment function, the financial intelligence unit shall have access to, and shall have the right to process data from attorneys, registered legal counsels and notaries public, including privileged information held by the attorney or notary public.
The data will not be transmitted outside the EEA.

The period of processing:

The Law Firm shall retain the data for 8 years after the date of performance of the mandate.
Legal regulations requiring data retention:

In accordance with Subsection (2) of Section 56 of the Money Laundering Act, service providers shall be authorised to process personal data obtained in carrying out their obligations delegated in this Act and in other legislation adopted by authorisation of this Act for a period of eight years after the end of the business relationship or after the date of carrying out the transaction order.
In accordance with Subsection (2) of Section 57 of the Money Laundering Act, service providers are required to keep in their records and registers documents they have obtained in the process of discharging their obligations delegated in this Act and in other legislation adopted by authorisation of this Act, including copies of such documents, and data obtained during electronic identification, documents evidencing compliance with reporting and data disclosure requirements under Section 42 and the suspension of transactions according to Sections 34 and 35, including copies of such documents, and all other data and information related to business relationships, and their copies, for a period of eight years after the end of the business relationship or after the date of carrying out the transaction order.

2.3 Processing connected with client identification

In the cases prescribed by legal regulation, the Law Firm shall process the following data in connection with client identification:

The scope of the data being processed:

data in accordance with Subsection (3) of Section 32 of the Act on Legal Practice: in order to check correspondence of the natural person’s data with the registered data and the validity of the documents presented by him, the attorney may request the following data electronically from the register of personal data and addresses, the register of driving licences, the register of travel documents and the central aliens administration register:

a) natural personal identification data,

b) citizenship, statelessness, refugee, immigrated, established and EEA citizen legal status,

c) home address,

d) facial image,

e) signature,

f) the facts as delineated in Section 18(5) of Act LXVI of 1992 on Keeping Records on the Personal Data and Address of Citizens,

g) the data and the date of validity of the document as specified in Section 24(1) f) of Act XII of 1998 on Travelling Abroad,

h) the data as set out in Section 8(1) b) ba)-bb) of Act LXXXIV of 1999 on Registration of Public Road Transport,

i) the data as set out in Section 76 d), Section 80(1) b) and c) of Act I of 2007 on the Entry and Residence of Persons with the Right of Free Movement and Residence, and Section 95(1) g), Section 96(1) g) and Section 100(1) b) and c) of Act II of 2007 on Entry and Residence of Third Country Nationals.

data in accordance with Subsection (7) of Section 32 of the Act on Legal Practice: before countersigning a document serving as basis for registration in certified public records, the attorney shall, in order to verify identity and the validity of the document, identify the persons, organisations making the legal statement and the persons acting on behalf of them,
data in accordance with Subsection (2) of Section 33 of the Act on Legal Practice: the records kept of identified natural persons shall contain the following data:

a) natural personal identification data,

b) home address,

c) citizenship, statelessness, refugee, immigrated, established and EEA citizen legal status,

d) the type and number of the identity document used for identification,

e) the identifier of the response received during the data request determined in Section 32 Subsection (3),

f) the case identifier of cases where identification of natural persons is compulsory,

g) the data specified in the Act on the Prevention of and Combating Money Laundering and Terrorist Financing.

The legal basis of processing:

point c) of paragraph (1) of Article 6 of the GDPR (compliance with a legal obligation),
Sections 32-33 of the Act on Legal Practice:

except for assignment for providing legal counsel, the attorney will carry out identification of the client, the bar association legal counsel will carry out the identification of the person contracting with his employer and the person who acts on behalf of them,
in matters where legal representation is compulsory, the attorney will keep records of natural persons identified at least through inspection of a document suitable for verifying identity, legal entities and other organisations in order to facilitate security of legal transactions and enforcing the limits of legal practice.

Persons/entities having access to the data:

The members, associates, assistants of the Law Firm and the employees of the Law Firm who work in the financial (invoicing) field.

Transmission of the data:

The data will be transmitted in the cases determined in Sections 30-31 of the Money Laundering Act: the attorney shall file a report to financial intelligence unit being operated within the National Tax and Customs Authority (NAV) in the event of any information, fact or circumstances giving rise to a suspicion of money laundering, terrorist financing or that specific property is derived from criminal activity.
The data will not be transmitted outside the EEA.

The period of processing:

In accordance with Subsection (7) of Section 33 of the Act on Legal Practice, the attorney will process the data for the period stipulated in the Act on the Prevention of and Combating Money Laundering and Terrorist Financing.
In accordance with Subsection (2) of Section 56 of the Money Laundering Act, service providers shall be authorised to process personal data obtained in carrying out their obligations delegated in this Act and in other legislation adopted by authorisation of this Act for a period of eight years after the end of the business relationship or after the date of carrying out the transaction order.
In accordance with Subsection (2) of Section 57 of the Money Laundering Act, service providers are required to keep in their records and registers documents they have obtained in the process of discharging their obligations delegated in this Act and in other legislation adopted by authorisation of this Act, including copies of such documents, and data obtained during electronic identification, documents evidencing compliance with reporting and data disclosure requirements under Section 42 and the suspension of transactions according to Sections 34 and 35, including copies of such documents, and all other data and information related to business relationships, and their copies, for a period of eight years after the end of the business relationship or after the date of carrying out the transaction order.

2.4 Processing connected with keeping records of cases

The Law Firm shall process the following data in connection with client identification:

The scope of the data being processed:

data determined in Subsection (2) of Section 53 of the Act on Legal Practice, which stipulates that the records kept of cases shall contain the following data:

a) the case identifier created by the attorney,

b) the client’s name,

c) the subject of the case,

d) the date of making the mandate, and

e) the register number of court proceedings related to the case and the reference number of other proceedings.

The legal basis of processing:

point c) of paragraph (1) of Article 6 of the GDPR (compliance with a legal obligation); and
Subsection (1) of Section 53 of the Act on Legal Practice, which stipulates that attorneys shall keep records of the cases performed on the basis of the mandate – to ensure checking adherence to the rules applying to legal practice and protect the clients’ rights in case of termination of the right to practice the legal profession.

Persons/entities having access to the data:

The members, associates, assistants of the Law Firm and the employees of the Law Firm who work in the financial (invoicing) field.

Transmission of the data:

The data may be transmitted in the case determined in Subsection (4) of Section 53 of the Act on Legal Practice, which stipulates that the following may have access to and request data from the records kept of cases

a) in the course of bar association authority revision, the person or body conducting the bar association authority revision in order to check adherence to rules applying to legal practice to the extent necessary for this purpose,

b) the substitute attorney and the designated administrator for a law firm in order to protect the clients’ rights, to the extent necessary for fulfilling their tasks arising from this Act.

The data will not be transmitted outside the EEA.

The period of processing:

In accordance with Subsection (3) of Section 53 of the Act on Legal Practice, the attorney will process the data specified in the records kept on cases for five years following termination of the mandate, for ten years following countersigning documents in the event of countersigning documents, for ten years following registration of the right in cases concerning registration of rights applying to real property in certified public records.
In accordance with Subsection (5) of Section 53 of the Act on Legal Practice, in the event of countersigning documents, the attorney shall retain the document countersigned by him and other documents created in the matter entailed in countersigning the document – if law does not stipulate any longer period of safeguarding or the parties did not agree in safeguarding for any longer period – for ten years from countersigning.

2.5 Processing of partners’ personal data

The Law Firm shall process the following personal data of the contact persons of its business partners.

The scope of the data being processed:

name, position, telephone number, email address

The legal basis of processing:

point f) of paragraph (1) of Article 6 of the GDPR (for the purposes of the legitimate interests of the Law Firm and the business partner).

Persons/entities having access to the data:

The members, associates, assistants of the Law Firm and the employees of the Law Firm who work in the financial (invoicing) field.

Transmission of the data:

Data will not be transmitted.

The period of processing:

The term of the contract with the business partner and for five years following the termination thereof (general limitation period).

2.5 Contacting the Law Firm

The Law Firm shall process the following data of persons who initiate contact on the website https://www.bansszabo.hu, via email, in person, by phone, by post or in other manner.

The scope of the data being processed:

the data provided when contacting us, in particular name, telephone number, email address, the text of the message.

The legal basis of processing:

pursuant to point a) of paragraph (1) of Article 6 of the GDPR the consent of the data subject. In the event of contacting us, it may be presumed that the data subject has given consent to the processing; on the other hand, subject to the form of contacting us, the Law Firm will also specifically request that the consent is to delivered to it.

Persons/entities having access to the data:

The members, associates, assistants of the Law Firm.

Transmission of the data:

Data will not be transmitted.

The period of processing:

If after contacting us, business partner relationship is developed, the term of the contract with the business partner and for five years following the termination thereof (general limitation period).
If such legal relationship is not established, the Law Firm may process the personal data for 1 year after the date of recording them or, in the event of a legal dispute, until the settlement of such dispute.

2.6 Processing of the data of persons who apply to the Law Firm for taking on a job

The Law Firm will process the following data of persons who file job applications whether the applications are filed through the website https://www.bansszabo.hu or in any other manner.

The scope of the data being processed:

the data provided on the application surface and in the job application and curriculum vitae; in particular name, telephone number, home address, email address, photo, CV, qualification, degree, professional experience, foreign language skills, the position being applied for and the related experience and expertise.

The legal basis of processing:

pursuant to point a) of paragraph (1) of Article 6 of the GDPR the consent of the data subject.

Persons/entities having access to the data:

the head of office and/or the employee or member of the office assigned to assess the job application and assistants of the office.

Transmission of the data:

Data will not be transmitted.

The period of processing:

If after the job application an employment relationship is established between the candidate and the Law Firm, it will process the personal data in order to fulfil the rights and obligations arising from the employment relationship during the term of the employment relationship and after that, for the period of limitation and for the period prescribed in legal regulation for determining the pension.
If an employment relationship is not established upon his job application, the candidate’s data will be erased after the decision made of taking on the job but not later than within 3 months following the application, except when he gives his consent to the processing of his personal data for another one year in order to take on jobs through future job applications.

III. The technical and organisational measures taken for the purposes of the security of the data

The personal data will be stored at the registered office of the Law Firm (1051 Budapest, József nádor tér 5-6.).

The Law Firm will take all technical precautions that may be reasonably expected to ensure secure storage of the stored data that allows no access to third parties.

Providing the information security of the storage the personal data: The information system of the Law Firm is protected by appropriate firewall, antivirus and anti-spam devices. All PC’s located at the Law Firm may only be accessed by individual passwords.

IV. The rights of data subjects concerning processing of data (data subject’s rights)

Concerning the processing of their personal data, data subjects shall have the following rights:

4.1 Right of access (Article 15 of the GDPR)

The data subject shall have the right to obtain from the Law Firm information as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the information that appear in this Notice.

The Law Firm shall provide a copy of the personal data undergoing processing, upon request, at the disposal of the data subject. For any further copies requested, the Law Firm may charge costs.

4.2 Right to rectification (Article 16 of the GDPR)

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data and to have incomplete personal data completed.

4.3 Right to erasure (Article 17 of the GDPR)

The data subject shall have the right to obtain from the controller the erasure of personal data concerning the data subject without undue delay where one of the following grounds applies:

the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
the data subject withdraws consent;
the personal data have been unlawfully processed; or
the personal data have to be erased for compliance with a legal obligation in Union or Member State law.

4.4 Right to restriction of processing (Article 18 of the GDPR)

The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:

the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; or
the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of the legal claims.

4.5 Right to information (Article 12 of the GDPR)

The controller shall without delay inform the data subject of the circumstances connected with the processing.

The information shall be free of charge.

If the requests are unfounded or excessive, in particular because of their repetitive character, the office may charge a reasonable fee or refuse the request.

4.6 Right to lodge a complaint (Article 77 of the GDPR)

The data subject shall have the right to lodge a complaint with the supervisory authority, if he or she considers that the processing of personal data infringes the GDPR and other data protection rules. The complaint may be lodged with the following supervisory authority:

Hungarian National Authority for Data Protection and Freedom of Information

address: 1055 Budapest, Falk Miksa utca 9-11.

telephone: +36 1 391 1400

fax: +36 1 391 1410

email:ugyfelszolgalat@naih.hu

www.naih.hu

4.7 Right to file a petition to court (Article 79 of the GDPR)

The data subject shall have the right to judicial remedy where he or she considers that his or her rights to data protection have been infringed as a result of the processing of his or her personal data in non-compliance with the GDPR. Proceedings against the controller shall be brought before the court of the registered office of the Law Firm.

4.8 Right to data portability (Article 20 of the GDPR)

If the processing is based on the data subject’s consent or the contract between the data subject and the controller, the data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to the controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller. The data subject shall furthermore have the right to obtain from the controller transmission of the personal data directly to another controller, where technically feasible.

V. Requesting information concerning the processing of personal data

Further information concerning the processing of your personal data may be requested from the Law Firm at the following contact details:

Bán, S. Szabó, Rausch & Partners Law Firm

by post: 1051 Budapest, József nádor tér 5-6.

via email: office@bansszabo.hu

31 January 2022

Bán, S. Szabó, Rausch & Partners Law Firm