Privacy Policy
The purpose of this Privacy Notice is for the Dobolyi Law Firm, as the data controller (hereinafter: the Firm or Controller),to disclose the data processing measures it follows when individuals contact it, to fulfill its legal obligations regarding the processing of natural persons’ personal data, and to enforce the principles and rules set forth in these laws. The fundamental objective of the Dobolyi Law Firm is to respect the fundamental rights and freedoms of natural persons in all cases, particularly with regard to their right to the protection of their personal data.
- Controller),
Name: Dobolyi Law Firm
Registered seat (and mailing address): Alkotmány st. 16, ground floor, apt. 28., 1054 Budapest (Hungary)
Represented by: Mátyás Dr. Dobolyi, attorney-at-law (KASZ number: 36082687)
E-mail: iroda@dobolyi.hu
- Terms
Processing: any operation or set of operations performed on personal data or data files, whether by automated or non-automated means, including collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction
VAT Act: Act CXXVII of 2007 on Value-Added Tax
GDPR: REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
Accounting Act: Act C of 2000 on Accounting
Personal data: any information relating to an identified or identifiable natural person (“data subject”); “identifiable” means a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person
Üttv.: Act LXXVIII of 2017 on the Practice of Law
- Data Processing Operations
- Information on Requesters
The personal data of individuals who contact the Firm for the purpose of requesting a quote is processed as follows:
Data processed: name, email address, phone number, matter presented
Purpose of data processing: to submit a proposal for the conclusion of a service contract
Legal basis for data processing: Article 6(1)(b) of the GDPR – conclusion of a contract
Duration of data processing: the period during which the proposal is binding
- Data Processed in Connection with a Legal Retainer
In connection with the conclusion and performance of the attorney-client agreement, the Firm processes data as follows:
Data processed: name, address, email address, phone number, and other data necessary for the engagement
Purpose of data processing: conclusion and performance of the attorney-client agreement, maintaining contact, and billing
Legal basis for data processing: Article 6(1)(b) of the GDPR—conclusion and performance of a contract; Article 6(1)(c) of the GDPR—compliance with a legal obligation (Section 159(1) of the VAT Act)
Duration of data processing: 8 years following the issuance of the accounting document based on the contract (Section 169(1)–(2) of the Accounting Act), except for personal data not necessary for the fulfillment of accounting obligations, for which the general statute of limitations of 5 years applies (Civil Code, Section 6:22(1))
In connection with the fulfillment of orders, the Data Controller may, to the extent necessary, engage various data processors (e.g., Microsoft Teams, etc.), in the course of which it fully upholds the principle of data minimization and does not use personal data for either automated decision-making or profiling
- Case Register
Within the framework of the case register required by Section 53 of the Üttv., the Firm processes data as follows:
Data processed: data specified in Section 53(2) of the Üttv.
Purpose of data processing: compliance with the legal obligation to maintain the case register
Legal basis for data processing: Article 6(1)(c) of the GDPR—compliance with a legal obligation (Section 53(1) and (2) of the Üttv.)
Duration of data processing: 5 years following the termination of the mandate; in the case of the countersigning of a document, 10 years following the countersigning of the document; in cases involving the registration of a right pertaining to real property in an official registry, 10 years from the date of registration of the right (Section 53(3) of the Real Estate Transactions Act)
- Customer Due Diligence Pursuant to the Pmt.
In the cases specified by the Pmt., the Firm is required to conduct customer due diligence. In this context, the Firm processes data as follows.
Data processed: data specified in Section 7(2) of the Pmt.
Purpose of data processing: to conduct customer due diligence
Legal basis for data processing: Article 6(1)(c) of the GDPR—compliance with a legal obligation (Section 6(1) and Section 7(1) and (2) of the Pmt.)
Duration of data processing: 8 years from the termination of the business relationship or the fulfillment of the transaction order (Section 57(1) of the Pmt.)
- Contact Information for Business Partners
For the purpose of maintaining contact with corporate clients and business partners (e.g., suppliers), as well as facilitating the conclusion and performance of contracts with them, the Firm processes the pe
Data processed: name, email address, phone number
Purpose of data processing: to facilitate communication with corporate clients and business partners, to conclude and fulfill contracts, and to enforce claims and rights arising from the contract.
Legal basis for data processing: Article 6(1)(f) of the GDPR—the legitimate interests of the Firm and the corporate client or business partner
Duration of data processing: if the data is included in a contract, for 5 years from the termination of the contract until the expiration of the general statute of limitations (Civil Code § 6:22(1)); in other cases, for 30 days from the termination of the contact relationship.
- Information on Resumé Submitters
The personal data of resume submitters is processed as follows.
Data processed: name, photo, address, email address, phone number, educational and professional background
Purpose of data processing: to evaluate applications submitted to the Data Controller for job opportunities and to conduct job interviews
Legal basis for data processing: Article 6(1)(a) of the GDPR—consent of the data subject
Duration of data processing: until an employment offer is made; in the absence of such an offer, for a maximum of 5 (five) business days following the conclusion of the job interview, unless the data subject consents to the processing of previously collected data for an additional 6 months so that, should a vacancy arise, the Data Controller may review the resume again and, if the vacancy is of interest to you, contact you
- Recipients (Data Transfer)
The recipients of personal data are the natural or legal persons to whom the personal data is disclosed. The processing of personal data is primarily carried out directly by the Firm as the data controller, during which the Firm strives to ensure that personal data is disclosed only to those individuals for whom access is strictly necessary.
In order to carry out the activities underlying certain data processing operations, the Firm engages external partners, to whom certain personal data of the data subject may be transferred. The specific recipients may vary, but the scope of their involvement is defined as follows:
Partner used for billing (currently: Billingo Technologies Inc. – registered office: Árbóc st. 6; Budapest/Hungary, 1133 company registration number: 01-10-140802)
Partner used for remote identification or remote countersignature (currently: Microsoft Corp. – registered office: One Microsoft Way, Redmond, Washington, USA)
- Rights of the Data Subject
- Right to Information
The data subject has the right to receive transparent information regarding the processing of their personal data, as well as regarding the options available for exercising their rights. The Firm fulfills this obligation through this privacy notice.
- Right of Access
The data subject has the right to receive confirmation from the data controller as to whether their personal data is being processed, and if such processing is taking place, they have the right to access their personal data and information regarding its processing.
- Right to rectification:
If the data subject’s information changes or has been recorded incorrectly, the data subject has the right to request that the Firm rectify any inaccurate personal data concerning him or her without undue delay.
- Right to Erasure (’right to be forgotten’)
In cases specified by law (Article 17 of the GDPR), the data subject may request that the data processed by the Firm be erased.
- Right to Restriction of Processing
In cases specified by law (Article 18 of the GDPR), the data subject may request that the Firm restrict the processing of their personal data.
- Right to Object
In cases where processing is based on a legitimate interest, the data subject may object to the processing of their data. In such cases, the Firm may no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing that override the data subject’s interests, rights, and freedoms, or that are related to the establishment, exercise, or defense of legal claims. If personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning him or her for such purposes. If the data subject objects to the processing of personal data for direct marketing purposes, the personal data may no longer be processed for such purposes.
- Right to data portability:
The data subject has the right to have the Firm transfer his or her personal data processed by automated means—in connection with data processing activities based on consent or the performance of a contract—to the data subject or to another data controller designated by the data subject.
- Enforcement of Rights
The data subject may enforce their right to the protection of their personal data before a civil court, or may turn to the Bureau of the Commissioner for Fundamental Rights or the National Data Protection and Information Authority.
Anyone may file a complaint with the National Authority for Data Protection and Freedom of Information (address: 1055 Budapest, 9–11 Falk Miksa Street, mailing address: 1363 Budapest, P.O. Box 9), anyone may initiate an investigation on the grounds that a violation of rights has occurred or is imminently likely to occur in connection with the processing of personal data or the exercise of rights related to access to data of public interest or data made public in the public interest.
The data subject may appeal to the competent court in the event of:
a refusal to provide information
a rejection of a request for rectification, erasure, or blocking
in the event of a violation of your rights, and
if you disagree with the decision made regarding your objection, or if the Office fails to meet the deadline for adjudicating the objection, within 30 days from the date of notification of the decision or from the last day of the deadline.
The court with jurisdiction over the lawsuit is the court where the Office, as the defendant, has its registered office (Budapest Metropolitan Court). The lawsuit may also be filed—at the data subject’s discretion—before the court of the data subject’s place of residence or place of stay.
Please note that in the event of any complaint or objection regarding the Firm’s data processing, you should contact the Firm via email or by mail for consultation prior to initiating the above procedures.
Effective: July 13, 2026
Doboly Law Firm