The purpose of this notice is to ensure that visitors to the www.drandirko.hu website receive appropriate information about the processing of their personal data in accordance with REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (hereinafter: the Regulation or GDPR) and with Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (theInformation Act).

1. Details and contact information of the controller

2. Definitions

The definitions applicable for the purposes of this Notice are set out in Article 4 of the GDPR and Section 3 of the Information Act. The main concepts for the purposes of this Notice are:

“data subject”: a natural person identified or identifiable on the basis of any information.

“personal data”: any information relating to an identified or identifiable natural person (a “data subject”).

identifiable natural person”: a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

“processing”: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

“controller”: the natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

“processing on behalf of the controller”: the set of processing operations carried out by a processor acting on the instructions or under the authority of the controller.

“processor”: a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller.

 “recipient”: a natural or legal person, public authority, agency or any other body to which the personal data are disclosed, whether or not it is a third party.

“third party”: a natural or legal person, public authority, agency or any other body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or processor, are authorised to process personal data.

“data protection”: the set of principles, rules, procedures, processing tools and methods that ensure the lawful processing of personal data and the protection of the persons concerned.

“transfer of data”: making data accessible to a specified third person.

“restriction of processing”: the marking of stored personal data with the aim of limiting their processing in the future.

“erasure of data”: rendering data unrecognisable in such a way that it can no longer be restored.

“profiling”: any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

 “consent of the data subject”: any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.

“personal data breach”: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

3. Scope of the data processed

3.1. Contacting us through the website

3.2. Cookies

A cookie is a small data file placed by the website on the visitor’s computer, mobile device or other device providing internet access, and stored until the expiry date set in the cookie or until it is deleted manually. Its purpose is to record information about the visit and personal settings; these data, however, cannot be linked directly to the visitor’s person. Cookies help to create a user-friendly website and to enhance the user experience.

By default, most browsers allow the use of cookies. If you do not wish to allow cookies, or wish to delete cookies originating from the site, you can do so individually. Information on managing cookies can be found in your browser settings. These settings can be changed so that the browser blocks the automatic handling of cookies, or notifies the user whenever a cookie is sent to the device. It is important to know, however, that blocking or restricting the use of cookies may adversely affect the operation of certain functions of the website, and some content may not be available, or only in a limited form.

The above data relate exclusively to the device used for browsing and cannot be linked directly to the person browsing.

3.3. Facebook, Instagram and LinkedIn pages

The Controller maintains the Dr. Andirkó Law Firm page on Facebook, Instagram and LinkedIn.

The data subject may subscribe to the news feeds published on the page’s wall by clicking the “like” button on the page.

Scope of the data processed: the data subject’s public name and public photo. Purpose of the processing: providing information about the Controller’s services and news concerning the Controller, and publishing general, informative professional legal writings. Legal basis of the processing: the data subject’s voluntary consent (Article 6(1)(a) GDPR). Envisaged duration of the processing: the data subject may unsubscribe from following the Controller’s Facebook, Instagram or LinkedIn page by clicking the “dislike” button, or may delete or restrict unwanted posts appearing on the wall using the wall settings.

If the data subject contacts the Controller through the page, the data processed are the data subject’s public name, public photo and the content of the message sent. The purpose of the processing is to establish contact with the data subject and to reply to their message. Legal basis of the processing: the data subject’s voluntary consent (Article 6(1)(a) GDPR). Envisaged duration of the processing: depending on the content of the data subject’s message, until the message is answered, or until the data subject withdraws consent or requests erasure, for the period prescribed by law, or until the legitimate interests of the Controller or of a third person have been enforced.

In all other respects, the data protection and service terms of the Facebook, Instagram and LinkedIn social networking sites apply to visitors to the page.

4. Rights of data subjects in connection with the processing
5. a) Right to information and right of access

The data subject has the right to obtain confirmation from the Controller as to whether their personal data are being processed and, if so, to receive information about the personal data concerned, the purpose and legal basis of the processing, the recipients to whom the Controller discloses their data, the envisaged duration of the processing, the fact of profiling where applied, the rights available to the data subject in connection with the processing and the manner of exercising those rights, as well as about the circumstances, effects and measures taken in respect of any personal data breaches that have occurred in connection with the processing of their personal data.

The data subject is further entitled to be provided, upon request, with a copy of their personal data by the Controller.

1. b) Right to rectification

The data subject has the right to obtain from the Controller, without undue delay, the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed.

1. c) Right to erasure (“right to be forgotten”)

The data subject has the right to obtain from the Controller, upon request and without undue delay, the erasure of personal data concerning them where

1. the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
2. the processing is unlawful;
3. the data subject has withdrawn consent to the processing, or requests the erasure of their personal data, and there is no other legal basis for the processing;
4. the data subject objects to the processing and there is no overriding legitimate ground for it, or their data are processed for the purposes of direct marketing;
5. the erasure of the data has been ordered by law, by a legal act of the European Union, by a court or by another authority.

Erasure need not be carried out where the processing is necessary

• for exercising the right of freedom of expression or the right to information;
• for the establishment, exercise or defence of legal claims;
• for compliance with a legal obligation applicable to the Controller;
• for reasons of public interest in the area of public health;
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, where erasure would render impossible or seriously impair the achievement of the objectives of the processing.

1. d) Right to restriction of processing

The data subject has the right to obtain from the Controller, upon request, restriction of processing where one of the following applies:

1. the data subject contests the accuracy of their personal data, in which case the restriction applies for a period enabling the Controller to verify the accuracy of the personal data;
2. the processing is unlawful but the data subject opposes the erasure of the data and requests the restriction of their use instead;
3. the Controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; or
4. the data subject has objected to the processing; in that case the restriction applies for the period until it is established whether the Controller’s legitimate grounds override those of the data subject.
5. e) Right to data portability

Where the processing is based on the data subject’s consent or on a contract concluded with the data subject and is carried out by automated means, the data subject has the right to receive the personal data they have provided to the Controller in a structured, commonly used, machine-readable format, and the right to transmit those data to another controller.

1. f) Right to object

The data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of their personal data where the processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party. In that case the Controller may no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or which relate to the establishment, exercise or defence of legal claims.

Where the data subject objects to the processing of personal data for direct marketing purposes, the personal data may no longer be processed for such purposes.

1. g) Right to a remedy

The data subject may submit a complaint or request relating to the processing to the Controller’s current registered office address or electronic contact address.

The Controller informs the data subject of the decision taken in the matter and of the measures taken or planned by the Controller without undue delay, and at the latest within 1 (one) month of receipt of the complaint or request.

Where necessary, taking into account the number and complexity of the requests, the above deadline may be extended by a further 1 (one) month. The Controller informs the data subject of the extension, stating the reasons for the delay, within 1 (one) month of receipt of the request.

Where the data subject submitted the request or complaint by electronic means, the Controller provides the information by electronic means, unless the data subject expressly requests otherwise.

Where the data subject’s request or complaint is unfounded, the Controller informs the data subject, without delay and at the latest within 1 (one) month of receipt of the request or complaint, of the rejection of their request or complaint, of the reasons for it and of the remedies available to them, as follows:

If, in the data subject’s view, the processing of their personal data infringes the applicable legislation, they are entitled to lodge a complaint with the data protection supervisory authority or to bring the matter before a court. In Hungary the data protection supervisory authority is the Hungarian National Authority for Data Protection and Freedom of Information (address: 1125 Budapest, Szilágyi Erzsébet fasor 22/c., phone: +36 (1) 391 1410, e-mail: ugyfelszolgalat@naih.hu). Data protection actions fall within the competence of the regional court. At the data subject’s choice, the action may also be brought before the regional court of the data subject’s place of residence or place of stay.

5. The processor engaged by the Controller

In operating the website, the Controller uses the hosting service of the following company:

Company name: Tárhely.Eu Kft.
Registered office: 1144 Budapest, Ormánság u 4. 
Phone number: +36 1 789-2-789

In addition to the above, the following supplementary provisions also apply to the newsletter service of Dr. Andirkó Law Firm:

I. Controller

The Rocket Science Group, LLC (MailChimp newsletter provider)

Registered office: 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, Georgia 30308

II. Purpose of the processing 

The purpose of the processing is to send persons subscribing to the newsletter material relating to the operation and publications of Dr. Andirkó Law Firm and to legally relevant news and legislative changes, at varying intervals but no more than once a week.

If the controller wishes to use the personal data it processes for a purpose other than the purpose specified above, it will inform the data subjects of that different purpose and of all other relevant supplementary information, in the customary manner, before starting the processing for that different purpose.

III. Legal basis and duration of the processing, scope of the data processed 

The legal basis of the processing is the prior and voluntary consent of the data subject (the person subscribing to the newsletter). If the data are not provided or consent is not given, however, the newsletter cannot be sent.

The processing takes place from the time of subscription to the newsletter until the time of unsubscribing (withdrawal of consent) or until the purpose ceases, that is, until the newsletter activity is discontinued.

In connection with sending the newsletter, the Controller processes the following data:

• surname and first name
• e-mail address

The controller transfers the data subject’s data to a third person only on the basis of the data subject’s prior written consent or where required to fulfil an obligation laid down by law.

The Controller reserves the right to amend this Notice and to modify it appropriately should the relevant European Union and domestic legal provisions change. This Privacy Notice is in force from 1 July 2022 until it is withdrawn or amended.