UNIFORM DATA PROCESSING NOTICE WITH AMENDMENTS ON THE PROCESSING OF PERSONAL DATA CONDUCTED FROM MAY 25, 2018
On the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Regulation 95/46/EC (hereinafter: GDPR), the Data Controller provides the data subjects with the following information regarding the processing of personal data.
1. DATA CONTROLLER INFORMATION
Data Controller
Name: Dr. Nemes Law Office
Postal address: 4026 Debrecen, Péterfia utca 2. 1. emelet, 2.
E-mail: titkarsag@nemesugyved.hu
Phone: + 36 (52) 448-458
Website: www.nemesugyved.hu
Headquarters: 4026 Debrecen, Péterfia utca 2. 1. emelet, 2.
2. LEGISLATION SERVING AS THE BASIS FOR DATA PROCESSING
Legislation serving as the basis for data processing
- Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Regulation 95/46/EC (General Data Protection Regulation) (hereinafter referred to as GDPR),
- Act CXII of 2011 on the right to informational self-determination and freedom of information (hereinafter referred to as: Infotv.)
3. DEFINITIONS
According to GDPR, „personal data” means:
any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, a number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
The concept of „recipient”:
„recipient” means the natural or legal person, public authority, agency or any other body to which personal data are disclosed, whether or not a third party. Public authorities which may have access to personal data in the context of an individual investigation in accordance with Union or Member State law shall not be considered recipients; the processing of those data by such public authorities shall be in accordance with the applicable data protection rules, in accordance with the purposes of the processing.
4. DATA PROCESSING
Personal data
Purpose of treatment: in Appendix
data processing: in Appendix
Storage period: in Appendix
Listing or categories: in Appendix
Source: in Appendix
Provisions on automated decision-making or profiling
| Does the Data Controller use this? | Information on the logis used | What is the significance and consequences for the person concerned? |
| No. | Not applicable | Not applicable |
If there is a recipient of the data processing
Name of recipients: in Appendix
Purpose of communication: in Appendix
If the legal basis indicated in the Appendix is legitimate interest, a description of the legitimate interest can be found in the Appendix.
The provision of the personal data contained in the Appendix is, as a general rule, at the discretion of the data subject. If the provision of the personal data contained in the Appendix is based on a legal or contractual obligation or is a prerequisite for concluding a contract, the data subject is obliged to provide the personal data specified in the Appendix, failure to do so may result in the following legal consequences:
- data request for the purpose of fulfilling a legal obligation: making it impossible to fulfill the legal obligation
- request for data for the purpose of concluding a contract: failure to conclude a contract
- data request for the purpose of using a service: refusal to provide a service
- data request for security purposes: restriction or exclusion of access
5. ACCESSIBILITY OF PERSONAL DATA
As a general rule, the personal data of the data subject may be accessed by the Data Controller’s employees in order to perform their tasks (for example, the Data Controller’s staff dealing with filing for the purpose of case management or the HR staff in order to prepare the employment contract may access the personal data of the data subject).
The Data Controller only transfers the personal data of the data subject to other state bodies in exceptional cases (for example, if court proceedings are initiated in an ongoing legal dispute between the data subject and the Data Controller, and the court in question requires the transfer of documents containing the data subject’s personal data, the police contact the Data Controller and request the transmission of documents containing the data subject’s personal data for the investigation, in addition, for example, the lawyer representing the Data Controller will also become aware of the personal data if a legal dispute arises between the data subject and the Data Controller).
6. METHOD OF STORAGE OF PERSONAL DATA, SECURITY OF DATA PROCESSING
The Data Controller’s IT systems and other data storage locations are located at its headquarters, sites, data processors, and on the storage/server located at impressive.hu Informatics Service Limited Liability Company.
The Data Controller selects and operates the IT tools used to manage personal data during the provision of the service in such a way that the managed data:
a) should be accessible to those authorized (availability);
b) its authenticity and authentication are ensured (authentication of data processing);
c) its immutability can be verified (data integrity);
d) is protected against unauthorized access (data confidentiality).
The Data Controller protects the data with appropriate measures, in particular against unauthorized access, alteration, transmission, disclosure, deletion or destruction, as well as against accidental destruction, damage and inaccessibility resulting from changes in the technology used.
In order to protect the data files managed electronically in its various registers, the Data Controller ensures with appropriate technical solutions that the stored data cannot be directly linked and assigned to the data subject, unless permitted by law.
The Data Controller ensures the protection of data processing by means of technical, organizational and institutional measures that provide a level of protection appropriate to the risks associated with data processing.
The Data Controller retains the following during data processing:
a) confidentiality: it protects information so that only those who are authorized to access it can access it;
b) integrity: protects the accuracy and completeness of the information and the processing method;
c) availability: ensures that, when the authorized user needs it, he or she can actually access the desired information and that the related tools are available.
The IT system and network of the Data Controller and its partners are protected against computer-aided fraud, espionage, sabotage, vandalism, fire and flood, as well as computer viruses, computer intrusions and denial-of-service attacks. The operator ensures security with server-level and application-level protection procedures.
We inform users that electronic messages transmitted over the Internet, regardless of the protocol (e-mail, web, ftp, etc.), are vulnerable to network threats that lead to unfair activity, contract disputes, or the disclosure or modification of information. To protect against such threats, the data controller takes all generally expected precautions. It monitors the systems in order to record any security deviations and provide evidence in the event of any security incident. System monitoring also allows for the verification of the effectiveness of the precautions taken.
7. TRANSFER TO A THIRD COUNTRY OR TO AN INTERNATIONAL ORGANIZATION
| Name of third country or international organization | EU Commission conformity decision or, in the absence thereof, indication of guarantees | Binding Corporate Rule (if applicable) | Derogations for special situations (if applicable) |
| Not applicable | Not applicable | Not applicable | Not applicable |
8. RIGHTS OF THE DATA SUBJECT
Pursuant to Article 15 of the GDPR, the data subject may request access to personal data concerning him or her as follows:
(1) The data subject has the right to receive feedback from the Data Controller as to whether his or her personal data is being processed and, if such processing is taking place, he or she has the right to access the personal data and the following information:
a) the purposes of data processing;
(b) the categories of personal data concerned;
(c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, including in particular recipients in third countries or international organizations;
(d) where applicable, the planned period for which the personal data will be stored or, if this is not possible, the criteria for determining this period;
e) the right of the data subject to request from the Data Controller the rectification, erasure or restriction of processing of personal data concerning him or her, and to object to the processing of such personal data;
(f) the right to lodge a complaint with a supervisory authority;
g) if the data were not collected from the data subject, all available information on their source;
h) the fact of automated decision-making, including profiling, and at least in these cases, intelligible information on the logic involved and the significance and foreseeable consequences of such processing for the data subject.
(2) The Data Controller shall provide the data subject with a copy of the personal data which are the subject of the processing. For further copies requested by the data subject, the Data Controller may charge a reasonable fee based on administrative costs. If the data subject has submitted the request electronically, the information shall be provided in a widely used electronic format, unless the data subject requests otherwise. The right to request a copy shall not adversely affect the rights and freedoms of others.
Pursuant to Article 16 of the GDPR, the data subject has the right to request the Controller to correct the personal data concerning him or her.
Upon request from the data subject, the Data Controller shall rectify inaccurate personal data concerning him or her without undue delay. Taking into account the purpose of the data processing , the data subject shall have the right to request the completion of incomplete personal data, including by means of a supplementary statement.
Pursuant to Article 17 of the GDPR, the data subject has the right to request the Controller to erase personal data concerning him or her as follows:
(1) The data subject has the right to request the Data Controller to erase personal data concerning him or her, and the Data Controller is obliged to erase personal data concerning the data subject without undue delay if one of the following reasons applies:
a) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
b) the data subject withdraws his/her consent which forms the basis for the data processing and there is no other legal basis for the data processing;
c) the data subject objects to the processing of data in the public interest, in the exercise of official authority or in the legitimate interests of the data controller (third party), and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing of data for the purpose of direct marketing;
d) the personal data have been processed unlawfully;
e) the personal data must be deleted to comply with a legal obligation under EU or Member State law (Hungarian law) applicable to the Data Controller;
f) the personal data were collected in connection with the provision of information society services.
(2) Where the Controller has made the personal data public and is obliged to erase them pursuant to paragraph (1), the Controller, taking into account available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform the controllers processing the data that the data subject has requested the erasure of links to, or copies or replications of, the personal data concerned.
(3) The Data Subject’s right to erasure may only be restricted if the following exceptions set out in the GDPR apply, i.e., if the above reasons apply, the further retention of personal data may be considered lawful:
a) if the exercise of the right to freedom of expression and information, or
b) if compliance with a legal obligation, or
c) if the execution of a task carried out in the public interest, or
d) if due to the exercise of public authority vested in the data controller, or
e) if it is in the public interest in the field of public health,
f) if for archiving purposes in the public interest, or
g) if for scientific and historical research purposes or for statistical purposes, or
h) if necessary for the establishment, exercise or defense of legal claims.
Pursuant to Article 18 of the GDPR, the data subject has the right to request the Data Controller to restrict the processing of personal data concerning him or her as follows:
(1) The data subject has the right to request that the Data Controller restrict data processing if one of the following applies:
a) the data subject disputes the accuracy of the personal data, in which case the restriction shall apply for a period of time enabling the Data Controller to verify the accuracy of the personal data;
b) the processing is unlawful and the data subject opposes the erasure of the data and instead requests the restriction of their use;
c) the Data Controller no longer needs the personal data for the purposes of data processing, but the data subject requires them for the establishment, exercise or defense of legal claims; or
processing of data on grounds of public interest, in the exercise of official authority or in the legitimate interests of the controller (third party); in this case, the restriction shall apply for the period until it is determined whether the legitimate grounds of the Controller override those of the data subject.
(2) Where processing is subject to restrictions as set out above, such personal data may, with the exception of storage, only be processed with the consent of the data subject, or for the establishment, exercise or defense of legal claims, or for the protection of the rights of another natural or legal person, or for important reasons of public interest of the Union or of a Member State.
(3) The Data Controller shall inform the data subject, at whose request data processing has been restricted pursuant to paragraph (1), in advance of the lifting of the restriction on data processing.
Pursuant to Article 21 of the GDPR, the data subject has the right to object to the processing of personal data concerning him or her by the Data Controller as follows:
(1) The data subject shall have the right, on grounds relating to his or her particular situation, to object at any time to processing of personal data concerning him or her, including profiling based on the public interest, for reasons relating to his or her particular situation. In such a case, the controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.
(2) Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such purposes, including profiling, where it is related to direct marketing. If the data subject objects to the processing of personal data for direct marketing purposes, the personal data shall no longer be processed for such purposes.
(3) The right to object shall be expressly brought to the attention of the data subject at the latest during the first contact, and the information relating to this shall be displayed clearly and separately from all other information.
(4) In connection with the use of information society services and by way of derogation from Directive 2002/58/EC, the data subject may also exercise the right to object by automated means based on technical specifications.
(5) Where personal data are processed for scientific and historical research purposes or for statistical purposes, the data subject shall have the right to object, on grounds relating to his or her particular situation, to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
Pursuant to Article 20 of the GDPR, the data subject has the right to the portability of personal data concerning him or her as follows:
(1) The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and shall have the right to transmit those data to another controller without hindrance from the controller to whom the personal data have been provided, where:
a) if the legal basis for data processing is the consent of the Data Subject or the performance of a contract concluded with the Data Subject
b) and the data processing is carried out in an automated manner.
(2) When exercising the right to data portability, the data subject shall have the right to request the direct transmission of personal data between data controllers, where technically feasible.
(3) The exercise of the right to data portability shall not prejudice the right to erasure. The right to data portability shall not apply where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
(4) The right to data portability shall not adversely affect the rights and freedoms of others.
Pursuant to Article 7(3) of the GDPR, the data subject has the right to withdraw consent to the processing of his or her personal data at any time as follows:
The data subject has the right to withdraw his or her consent at any time. The withdrawal of consent does not affect the lawfulness of the processing based on consent before its withdrawal. The data subject has the right to withdraw consent in the same simple way as when it was given.
9. LEGAL REMEDIES
Without prejudice to other administrative or judicial remedies, each data subject shall have the right to lodge a complaint with a supervisory authority – in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement – if the data subject considers that the processing of personal data concerning him or her infringes the GDPR. A legal remedy, a complaint, may be lodged with the National Data Protection and Freedom of Information Authority:
Name: National Data Protection and Freedom of Information Authority (NAIH)
Headquarters: 1055 Budapest, Falk Miksa utca 9-11.
Mailing address: 1530 Budapest, P.O. Box 9
Phone: 06 1 391 1400
Fax: 06 1 391 1410
E-mail: ugyfelszolgalat@naih.hu
10. COURT ENFORCEMENT
Without prejudice to any available administrative or non-judicial remedies, including the right to lodge a complaint with a supervisory authority, each data subject shall have the right to an effective judicial remedy if he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of personal data concerning him or her not being in accordance with this Regulation.
Proceedings against a controller or processor shall be brought before the courts of the Member State in which the controller or processor is established. Such proceedings may also be brought before the courts of the Member State in which the data subject has his habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its official authority.
APPENDIX
Information on the processing of personal data of persons affected by inquiries received through the website www.nemesugyved.hu operated by Dr. Nemes Law Office, grouped according to the scope of data subjects
I. Data processing concerning data processed during contact with non-contracting parties:
Purpose of data processing:
Dr. Nemes Law Office maintains contact with its clients electronically, by mail or by telephone. Data subjects may contact Dr. Nemes Law Office by e-mail, by telephone or by mail addressed to the registered office of Dr. Nemes Law Office. Personal data processed during communication in connection with various inquiries will be processed by Dr. Nemes Law Office until the purpose of the inquiry is achieved.
Legal basis for data processing:
The Data Controller’s data processing is based on its legitimate interest pursuant to Article 6(1)(f) of the GDPR.
The data processing of the Data Controller is based on the consent of the data subject pursuant to Article 6(1)(a) of the GDPR. The data subject gives his consent by voluntarily providing the data in question when contacting us on the website.
Scope of data processed:
The name, address, e-mail address, telephone number of the data subject, as well as the personal data provided by him or her to Dr. Nemes Law Office, which is necessary for handling his or her case.
Data source:
People who contact Dr. Nemes Law Office
Name and address of the data processor:
Data Controller, 4026 Debrecen, Péterfia utca 2, 1. emelet, 2. ajtó
Data storage period:
The personal data provided during the communication will be processed by Dr. Nemes Law Office exclusively for the period necessary to achieve the purpose. During the communication, Dr. Nemes Law Office will process the personal data brought to its attention in connection with the given request until the purpose related to the request is achieved, but no later than until the expiration of the limitation period. If no order is created between Dr. Nemes Law Office and the data subject following the request, the message(s) and the data subject’s personal data will be deleted by Dr. Nemes Law Office after the communication is closed.
II. Data processing regarding inquiries received through the website www.nemesugyved.hu:
Purpose of data processing:
Fulfilling requests received by the Dr. Nemes Law Office via the website www.nemesugyved.hu.
Legal basis for data processing:
The processing of data by the Data Controller is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract, pursuant to Article 6(1)( b) of the GDPR.
Scope of data processed:
Mandatory data provided by the data subject during contact: name, e-mail address.
Data source:
Data subject
Name and address of the data processor:
Data Controller, 4026 Debrecen, Péterfia utca 2, 1. emelet, 2. ajtó
Data storage period:
Data processing by Dr. Nemes Law Office in connection with the failure of the conclusion of the contract is the period until which a claim can be asserted in connection with it, but at least 5 years after the failure of the conclusion of the contract or, if a legal dispute arose in connection with it, its conclusion, and after the termination of the contract, the period until which a claim can be asserted in connection with it, but at least 5 years after the termination of the contract or, if a legal dispute arose in connection with it, its conclusion.
INFORMATION ABOUT COOKIES
This section of the policy applies to the website www.nemesugyved.hu managed by the Data Controller.
1.1. The Data Controller informs its audience that external Data Controllers place and read back a small data package, a so-called cookie, on the user’s computer in order to provide customized service. If the browser sends back a previously saved cookie, the Data Controller managing it has the opportunity to connect the user’s current visit with previous ones, but only with regard to its own content.
1.2. The Data Controller collects anonymous data using an IT solution (cookie) on the computers of customers visiting the websites named in point 1, where this is permitted, at the same time as downloading the information from the site. The Data Controller processes the data generated in this way as personal data.
1.3. Some of the cookies we use are essential for the proper functioning of the site (session cookies), while others are used to facilitate the use of the website. This is done by recording the visitor’s settings and usage habits, helping navigation on the site and thus facilitating the use of the website.
1.4. The Data Controller does not connect the data obtained during the analysis of log files with other information and does not seek to identify the user.
We can distinguish several types of cookies based on their validity period and origin:
1.5. Temporary or session cookies
Session cookies are limited to the user’s current session and are used to prevent data loss (for example, when filling out a long form). These cookies are automatically deleted from the visitor’s computer when the session ends or the browser is closed.
1.6. Persistent or saved cookies
The validity period of persistent cookies is defined in days, weeks, months or years. During the validity period, the saved cookies are stored on the user’s computer’s hard drive, but the user can delete them before the expiry of the predefined deadlines.
1.7. Internal and external cookies
If the web server of the visited websites installs the cookies on the user’s computer, we call them internal cookies, while if the source of the cookie is code inserted into the relevant websites by an external Data Controller, we call them external cookies.
1.8. Cookie settings
The user can disable or enable the installation of cookies on their computer in their own internet browser; however, it is important to know that, although rejecting all cookies may help protect our personal data, it may limit the usability of some websites. Nevertheless, it should be noted that the use or enabling of cookies is not necessary for simple browsing . The user can delete the cookies from their own computer or disable the use of cookies in their browser. The user can usually enable or disable cookies in the Tools/Settings menu of internet browsers under the Privacy settings, in the cookie menu items.
1.9. The user can delete the cookie from his/her own computer or disable the use of cookies in his/her browser. Cookies can usually be managed in the Tools/Settings menu of browsers under the Privacy settings, under the name cookie.
1.10. Cookies previously installed on the visitor’s hard drive may be deleted before their validity period expires. This can usually be done in the Tools/Settings menu of the internet browser, under the Delete menu item in the History area. It is important to note that deleting all cookies placed on the hard drive of the computer may cause some web pages to function incorrectly.
Cookie management of the website www.nemesugyved.hu
| Cookie name | Cookie type | Scope of processed data | Cookie function | Duration of data processing |
| cookie_notice_accepted | Ensuring basic functionality (required) | Acceptance of cookies | The cookie policy acceptance bar if it has already been accepted previously | 1 month |
| _ga | For statistical purposes | – Click path
– Date and time of visit
– Device information
– Location information
– IP address
– Pages visited
– Referrer URL
– Browser information
– Hostname
– Browser language
– Browser type
– Screen resolution
– Device operating system
– Interaction data
– User behavior
– Visited URL | This cookie is used to distinguish unique users by assigning a randomly generated number as a client identifier. It is included in every page request of the website and is used to calculate visitor, session and campaign data for website analytics reports. | 2 years |
| _gid | For statistical purposes | – Click path
– Date and time of visit
– Device information
– Location information
– IP address
– Pages visited
– Referrer URL
– Browser information
– Hostname
– Browser language
– Browser type
– Screen resolution
– Device operating system
– Interaction data
– User behavior
– Visited URL | Each page visited stores and updates a unique value and is used to count and track page views. | 1 day |
| _gat | For statistical purposes | – Click path
– Date and time of visit
– Device information
– Location information
– IP address
– Pages visited
– Referrer URL
– Browser information
– Hostname
– Browser language
– Browser type
– Screen resolution
– Device operating system
– Interaction data
– User behavior
– Visited URL | It is used to reduce request rates, limiting data collection on high-traffic websites. | 1 minute |
1.13. The purpose of data processing is: to identify users, to distinguish them from each other, to identify the current work session of users, to store the data provided during it, and to prevent data loss.
1.14. Potential data controllers authorized to access the data: Personal data may be processed by the data controller’s employees, respecting the above principles.
1.15. Description of the rights of the data subjects regarding data processing: The data subject has the option to delete cookies in the Tools/Settings menu of the browsers, usually under the settings of the Privacy menu item.
1.16. Legal basis for data processing in the case of session cookies: The consent of the data subject is not required if the sole purpose of using cookies is to transmit a piece of communication via an electronic communications network or if the Data Controller absolutely needs them to provide an information society service specifically requested by the subscriber or user. The legal basis for data processing is Article 5(3) of Directive 2002/58/EC. The data controller’s data processing is carried out on the basis of Article 6(1)(f) of the GDPR and is based on the legitimate interest of the Data Controller, given that the use of these cookies is necessary for the operation of the website managed by the Data Controller.
1.17. Legal basis for data processing in the case of cookies for statistical purposes: The legal basis for the data controller’s data processing is data processing based on consent (Article 6(1)(a) of the GDPR), according to which data processing is based on the explicit consent of the Data Subject given in knowledge of this information. After reading and interpreting the data processing information, the Data Subject accepts the contents of this policy by clicking on the „I accept the proposed cookie settings” button at his or her own discretion. By accepting the information and visiting and using the website, s/he accepts the use of cookies. The withdrawal of consent has no consequences for the visitor. However, the withdrawal of consent does not affect the lawfulness of the data processing carried out before the withdrawal based on the consent.
1.18. Legal basis for data processing in the case of cookies necessary for the operation of the website: The Data Controller’s data processing is based on Article 6(1)(c) of the GDPR, given that the data processing is necessary for the fulfillment of a legal obligation to which the Data Controller is subject, as follows. Based on the conditions of consent set out in Article 7 of the GDPR, the data subject’s consent to data processing is verified as lawful, and the Data Controller complies with the information obligation set out in Articles 12, 13 and 14.
Dated in Debrecen, on September 9, 2024.
Dr. Zsolt Imre Nemes, attorney at law
Dr. Nemes Law Office
