Privacy Policy

The purpose of this Notice is to set out the data protection and data processing principles applied by dr. Zsuzsa Tormási, attorney-at-law, and to provide information on the processing of personal data collected on the Data Controller’s website (https://drtormasi.hu/) and provided by Users.

I. Definitions

1.1 Processing: Regardless of the procedure applied, any operation or set of operations performed on personal data, including in particular the collection, recording, organisation, structuring, storage, adaptation, alteration, use, retrieval, consultation, use, disclosure, transmission, dissemination or otherwise making available, publication, alignment, combination, restriction, erasure and destruction of personal data.

1.2 Data Controller The person who, alone or jointly with others, determines the purposes and means of processing. In respect of the services referred to in this Notice, the Data Controller is:

dr. Zsuzsa Tormási Attorney-at-law

Registered office: 1146 Budapest, Ajtósi Dürer sor 27/a.

Supervisory registration authority: Budapest Bar Association

Bar registration number: 36070312

Telephone: +36 30 969 7678

Email address: info@drtormasi.hu

1.3 Personal Data or Data Any data or information on the basis of which a natural person User may be identified, either directly or indirectly.

1.4 Data Processor A service provider that processes personal data on behalf of the Data Controller. In respect of the services referred to in this Notice, the following entities may act as Data Processors:

a) Rackhost Zrt. (6722 Szeged, Tisza Lajos körút 41.) – website operation

b) B and B Service Bt. (Tax number: 28724540-1-42) – accounting

c) Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) – statistics and Google Analytics

1.5 User A natural person who visits the Data Controller’s website and, in this context, provides the data specified in Section II below.

1.6 Notice This Privacy Notice of the Data Controller.

II. Categories of Personal Data Processed

2.1 Contact Form By submitting the contact form available on the Data Controller’s website, the User may request a quotation or other information regarding the legal services offered. To complete the form, the User must provide the following personal data: name; email address. No further personal data are required to complete the form. The Data Controller asks the User not to disclose any additional personal data until contacted by our staff.

2.2 Cookies For the purpose of providing personalised services, the Data Controller may, with the User’s prior consent, place a small data file, known as a cookie, on the User’s computer. The User may consent to the use of non-essential cookies by clicking the “Accept” button displayed in the cookie banner at the bottom of the website, or refuse their use by clicking the “Reject” button. Where the User authorises the use of cookies, the Data Controller’s system may also automatically record the User’s IP address in addition to the form and website settings. The purpose of cookies is to ensure the highest possible standard of website operation and to improve the user experience. The User may reject cookies when entering the website, delete previously accepted cookies from their computer, or configure their browser to block the use of cookies.

By disabling cookies, the User acknowledges that certain functions of the website may not operate fully or correctly.

The detailed list of cookies used on the website is set out below:

2.3 Google Analytics The website uses Google Analytics, a web analytics service provided by Google Ireland Limited (“Google”). Google Analytics also uses cookies, which are stored on the User’s computer and enable the analysis of the User’s use of the website.

Google uses this information for statistical purposes, including evaluating how the User uses the website, preparing reports for the website operator concerning website activity, and providing other services relating to website and internet usage.

The IP address transmitted by the User’s browser in connection with Google Analytics is anonymised by Google in accordance with the Data Controller’s settings through IP anonymisation. The IP address is not combined with other data held by Google.

When Google Analytics is used, personal data may also be transferred to the United States of America. The legal basis for the transfer is Commission Implementing Decision (EU) 2023/1795 concerning the EU–US Data Privacy Framework, provided that Google LLC is listed as a certified organisation covered by the Framework in respect of the relevant service. The certification may be checked at https://www.dataprivacyframework.gov/list. In the absence of such certification, the data transfer is carried out on the basis of the Standard Contractual Clauses under Article 46 of the GDPR.

III. Purpose and Legal Basis of Processing

3.1 Purposes of Processing The purposes of the processing carried out by the Data Controller are:

a) identifying the User and maintaining contact with the User;

b) managing and responding to User enquiries;

c) improving the user experience and carrying out statistical analyses concerning website traffic through the use of cookies.

Where the Data Controller intends to process personal data for a purpose other than those specified above, the User will be informed in advance.

3.2 Legal Basis for Contact Form Processing By submitting the contact form, the User voluntarily provides personal data to the Data Controller. Providing the data is not mandatory and serves solely to facilitate faster contact through the website. The primary legal basis for processing personal data submitted through the contact form is Article 6(1)(b) of the GDPR: taking steps at the request of the data subject prior to entering into a contract. Where the enquiry does not result in the establishment of a contractual relationship, the legal basis for processing is the User’s consent under Article 6(1)(a) of the GDPR.

3.3 Data Transfers Personal data may be transferred to the Data Processors identified in this Notice without the User’s separate consent. Personal data may be disclosed to other third parties only with the User’s prior and explicit consent, unless the processing is based on a legal obligation.

IV. Principles and Methods of Processing

4.1 The Data Controller processes personal data in accordance with the principles of purpose limitation, fair processing and data minimisation, as well as the applicable legislation and the provisions of this Notice.

4.2 The Data Controller uses personal data that are strictly necessary for the provision of the service exclusively for the purposes for which they were collected.

4.3 The Data Controller processes personal data only for the purposes specified in this Notice and in the applicable legislation. The scope of the personal data processed must be proportionate to the purpose of processing and may not exceed what is necessary for that purpose. Where the Data Controller intends to use personal data for a purpose other than the original purpose for which they were collected, the Data Controller will inform the User and, where required by the applicable legal basis, obtain the User’s prior and explicit consent. The User will also be given the opportunity to object to such use.

4.4 The Data Controller ensures the security of personal data and implements the technical and organisational measures and procedural rules necessary to protect the data collected, stored and processed. These measures are intended to prevent the accidental loss or unlawful destruction of personal data, as well as unauthorised access, use, alteration or dissemination. The Data Controller requires all third parties to whom personal data are transferred to comply with these obligations.

V. Duration of Processing

5.1 The personal data submitted by the User through the contact form, together with the User’s IP address, are stored in the Data Controller’s system for 30 days and are deleted thereafter.

5.2 Where an attorney-client engagement relationship is established between the User and the Data Controller following the contact request, the Data Controller may process the personal data required for the performance of the agreement for longer than 30 days. Such data will be processed for the duration of the engagement relationship and for the retention period required under Act LXXVIII of 2017 on Attorneys-at-Law and Act LIII of 2017 on the Prevention and Combating of Money Laundering and Terrorist Financing. The usual retention period for client due diligence documentation is eight years from the termination of the legal relationship. The User will receive separate information concerning this processing when the engagement relationship is established.

VI. Rights of the User and Methods of Exercising Them

6.1 Right of Access – Article 15 GDPR The User may request confirmation from the Data Controller as to whether their personal data are being processed and, where that is the case, may request access to the personal data processed. The User may request information concerning the processing of personal data at any time in writing: by sending a letter to the Data Controller’s address; by email; or by completing the message field of the contact form. A request submitted by post will be regarded as authentic where the User can be clearly identified on the basis of the request. A request submitted by email or through the contact form will be regarded as authentic only where it is sent from an email address previously provided by the User. This does not prevent the Data Controller from verifying the User’s identity by other means before providing the requested information. The request may cover: the personal data processed by the Data Controller; the source of the data; the purpose, legal basis and duration of processing; the names and addresses of any Data Processors; the activities carried out in connection with the processing; and where personal data have been transferred, the recipients of the data and the purposes of the transfer.

6.2 Right to Rectification – Article 16 GDPR The User may request the rectification or amendment of personal data processed by the Data Controller. Taking into account the purpose of processing, the User may also request that incomplete personal data be completed.

6.3 Right to Erasure – Article 17 GDPR The User may request the erasure of personal data processed by the Data Controller.

A request for erasure may be refused:

a) for the purpose of exercising the right to freedom of expression and information;

b) where the processing of personal data is authorised or required by law; or

c) for the establishment, exercise or defence of legal claims.

The Data Controller will always inform the User where an erasure request is refused and will specify the reason for the refusal. Once a request for the erasure of personal data has been fulfilled, the previously stored and deleted data cannot be restored.

6.4 Right to Restriction of Processing – Article 18 GDPR The User may request that the Data Controller restrict the processing of their personal data where the User disputes the accuracy of the personal data processed. In this case, processing will be restricted for the period necessary for the Data Controller to verify the accuracy of the personal data. The Data Controller will mark the personal data concerned where the User disputes their correctness or accuracy but the inaccuracy cannot be clearly established.

The User may also request restriction of processing where: the processing is unlawful, but the User opposes the erasure of the personal data and requests the restriction of their use instead; or the purpose of processing has been fulfilled, but the User requires the Data Controller to retain the data for the establishment, exercise or defence of legal claims.

6.5 Right to Data Portability – Article 20 GDPR The User may request that the personal data they have provided to the Data Controller and which are processed by automated means be provided to them in a structured, commonly used and machine-readable format. The User may also request that these data be transmitted to another data controller. This right applies only to processing carried out by automated means on the basis of consent or a contract.

VII. Data Processing

7.1 For the performance of its activities, the Data Controller uses the Data Processors identified above in this Notice.

7.2 The Data Processors do not make independent decisions. They may act only within the limits of their legal relationship with the Data Controller and in accordance with the instructions received from the Data Controller. The Data Processors record, process and otherwise handle the personal data transferred to them in accordance with the provisions of the GDPR and provide the Data Controller with a declaration confirming such compliance.

7.3 The Data Controller supervises the activities of the Data Processors.

7.4 The Data Processors may engage further data processors only with the consent of the Data Controller.

VIII. Legal Remedies

8.1 Users may contact the Data Controller’s staff with any questions or comments concerning data processing at: info@drtormasi.hu

8.2 The User may submit a complaint concerning the processing of personal data directly to the Hungarian National Authority for Data Protection and Freedom of Information: Address: 1055 Budapest, Falk Miksa utca 9–11. Telephone: +36 (1) 391-1400 Email: ugyfelszolgalat@naih.hu Website: www.naih.hu

8.3 Where the User’s rights have been infringed, the User may bring legal proceedings before a court. The proceedings fall within the jurisdiction of the competent regional court. At the User’s discretion, proceedings may also be initiated before the regional court having jurisdiction over the User’s place of residence or temporary residence.

Budapest, 1 August 2026

dr. Zsuzsa Tormási Attorney-at-law