Data Processing Notice

Effective from 12 October 2026 · Version: 2026/2 · The previous version was effective from 20 September 2026.

1. The controller

Czudar DHH Ügyvédi Iroda (Czudar DHH Law Firm; hereinafter: the “Firm”)

Registered seat: 1054 Budapest, Szemere utca 23. I/1.
Branch office: 2660 Balassagyarmat, Rákóczi fejedelem út 13.
Bar registration: Budapesti Ügyvédi Kamara (Budapest Bar Association), 5160
Tax number: 19322016-2-41
E-mail: info@drczudar.hu
Telephone: +36 1 577 9191
Company Gate (Cégkapu): 19322016#cegkapu

Data protection officer. Under Article 37 of the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council; “GDPR”), the Firm is not required to designate a data protection officer and does not designate one. In data protection matters the Firm may be contacted using the contact details above.

2. Scope of the notice

This notice applies to the personal data processed by the Firm, in particular

(a) the data of visitors to the website and of persons contacting the Firm (enquiry, appointment booking);
(b) the data of the Firm’s clients and of their representatives and contact persons;
(c) the data of other persons that become known in the course of performing an engagement, in particular those of the opposing party, witnesses, contracting partners, beneficial owners and authorised representatives.

The provision of information to the data subjects referred to in points (a)–(b) is governed by Article 13 GDPR, and to those referred to in point (c) by Article 14 GDPR; the limits on the provision of information are set out in Section 9.

3. Legal professional privilege

Legal professional privilege (ügyvédi titok) covers every fact, item of information and data of which the Firm has become aware in the course of practising the activities of an attorney-at-law. The duty of confidentiality continues to apply without limitation in time after the activities of an attorney-at-law have ended and the engagement has terminated (Section 9(1), (2) and (4) of Act LXXVIII of 2017 on Attorneys-at-Law (Üttv.)).

4. The individual processing operations

4.1. Enquiries (e-mail, telephone)

Data processed: name, e-mail address, telephone number, content of the message.
Purpose: responding to the enquiry, preparing the engagement.
Legal basis: taking steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR).
Retention:
- if no engagement is established, for one year from the closing of the enquiry;
- if an engagement is established, in accordance with Section 4.5.

4.2. Online appointment booking

Data processed: name, contact details, date, time and subject of the booking.
Tool: the booking is made through the Google Calendar service; Google acts as a processor.
Legal basis: Article 6(1)(b) GDPR.
Retention: in accordance with Section 4.1.

4.3. Client identification

Identification before the engagement. Except in the case of an engagement for legal advice, the Firm identifies the client and the person acting on the client’s behalf before the engagement agreement is concluded. A natural person whom the Firm does not know, or as to whose identity a doubt arises, is identified by one of the following (Section 32(1)–(2) Üttv.):

by inspecting that person’s document suitable for personal identification; or
by electronic identification as specified by law.

Identification before countersignature. Before countersigning a document serving as the basis for an entry in an authentic public register, the Firm identifies every person or organisation making a legal declaration, and their representatives (Section 32(7) Üttv.).

Verification from the registers. In order to verify the validity of the documents and the conformity of the data, the Firm may request data by electronic means from the authentic public registers specified by law (Section 32(3) Üttv.). Such data may be:

natural person identification data;
nationality;
address;
facial image;
signature;
document data.

Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR; Section 32 Üttv.).

4.4. Client register and customer due diligence

Client register. In matters in which legal representation is mandatory, the Firm keeps a register of the natural persons, legal persons and other organisations identified (Section 33(1) Üttv.). The data in the register (Section 33(2) and (4) Üttv.):

in the case of a natural person:
- natural person identification data;
- address;
- nationality or legal status;
- type and number of the identification document;
- identifier of the electronic data request;
- the matter identifier;
in the case of an organisation:
- name and registered seat;
- company registration number or registration number;
- identification data of the representative;
- the matter identifier;
in both cases: the data specified in the act on the prevention of money laundering.

Customer due diligence. In matters falling within the scope of Act LIII of 2017 on the Prevention and Combating of Money Laundering and Terrorist Financing (Pmt.), the Firm carries out customer due diligence. This includes:

establishing the beneficial owner;
examining politically exposed person status;
checking the sanctions lists.

The declarations made by the client in the course of the due diligence are recorded by the Firm on a separate data sheet.

Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR; Section 33 Üttv.; Pmt.).

Retention:

eight years from the termination of the business relationship or from the execution of the transaction order (Sections 56(2) and 57(2) Pmt.; Section 33(7) Üttv.);
at the request of the bodies entitled to make such a request, for a maximum of ten years (Section 58(1) Pmt.).

Upon expiry of the retention period, the Firm erases the data and destroys the documents without delay (Section 57(4) Pmt.).

4.5. Register of matters, performance of the engagement and retention of documents

Register of matters

The Firm keeps a register of the matters handled on the basis of an engagement (Section 53(1) Üttv.). The data in the register:

the matter identifier;
the name of the client;
the subject of the matter;
the date on which the engagement agreement was concluded;
the case number or file reference number of the related proceedings.

The Firm processes the data in the register for the following periods (Section 53(3) Üttv.):

for five years following the termination of the engagement;
where a document has been countersigned, for ten years following the countersignature;
in a matter concerning the entry of a right relating to real estate in an authentic public register, for ten years from the entry of the right.

The register may be inspected by the person or body carrying out the regulatory inspection by the bar association, by the substitute attorney and by the practice custodian (irodagondnok).

Performance of the engagement

This includes the handling of matters, representation, the drafting of documents and the provision of advice.

Data processed: identification and contact data, and all data necessary for the performance of the engagement which the client hands over or which appear in the documents of the matter.
Legal basis:
- in the case of a natural person client, performance of the contract (Article 6(1)(b) GDPR);
- in the case of the representatives and contact persons of a client that is a legal person or other organisation, the legitimate interest of the Firm and of the client in the communication necessary for the performance of the engagement (Article 6(1)(f) GDPR);
- in respect of the document management and record-keeping prescribed by law, compliance with a legal obligation (Article 6(1)(c) GDPR).
Special categories of personal data (for example, health data): the Firm processes these to the extent necessary for the establishment, exercise or defence of legal claims (Article 9(2)(f) GDPR).
Personal data relating to criminal convictions and offences: the Firm processes these exclusively within the scope of its activities as defence counsel or legal representative. The processing is carried out under the authorisation of Act XC of 2017 on Criminal Procedure and of the Üttv., subject to the safeguards of the attorney’s duty of confidentiality (Article 10 GDPR).

Retention of documents

The Firm retains the countersigned document, and the other documents created in the matter involving the countersignature of the document, for ten years from the countersignature (Section 53(5) Üttv.).

In other respects, the Firm retains the documents of the matter – in line with the document management rules of the Magyar Ügyvédi Kamara (Hungarian Bar Association) – in accordance with the disposal schedule laid down in the engagement agreement:

where a document serving as the basis for an entry in an authentic public register was countersigned in the matter: until 31 March of the 11th year from the termination of the engagement;
in the case of representation in litigation: until 31 March of the 6th year from the termination of the engagement;
in other matters, in particular in the case of advice or the giving of a legal opinion: until 31 March of the 2nd year from the termination of the engagement;
in the case of a testamentary disposition: until 31 March of the 6th year following the date on which the order transferring the estate becomes final.

Upon expiry of the retention period, the Firm erases or destroys the documents and the personal data. An exception applies where further processing is justified by law, by the keeping of a register prescribed by law, or by the exercise or defence of a legal claim.

4.6. Data of third persons that become known in the course of the engagement

Data subjects: the opposing party, witnesses, contracting partners, beneficial owners, authorised representatives, and other persons appearing in the documents of the matter.
Source of the data:
- the client;
- documents of authorities and courts;
- the authentic public registers.
Legal basis:
- the legitimate interest of the client and of the Firm in the exercise and protection of the client’s rights (Article 6(1)(f) GDPR);
- in the case of a statutory obligation, Article 6(1)(c) GDPR;
- in the case of special categories of personal data, Article 9(2)(f) GDPR.
Retention: in accordance with Section 4.5.
Provision of information: the Firm does not inform these persons individually, as their data are confidential on the basis of the attorney’s duty of confidentiality (Article 14(5)(d) GDPR).

4.7. Security documents

The Firm keeps the register prescribed by law of the security documents used for the countersignature of documents.

Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).
Retention: for the period specified by law.

4.8. Attorney escrow deposit

Where the Firm manages an attorney escrow deposit (ügyvédi letét), it processes the deposit agreement, the identification data of the depositor and of the beneficiary, and the data relating to the deposit in accordance with the following:

in the register prescribed by the Üttv. and by the deposit management regulations of the Magyar Ügyvédi Kamara;
by complying with the notification obligation prescribed by law.

The management of deposits is inspected by the regional bar association, which may, in that context, inspect the data of the deposit account (Section 187(2) Üttv.).

Legal basis: compliance with a legal obligation and performance of the deposit agreement (Article 6(1)(b) and (c) GDPR).
Retention:
- the deposit agreement, for ten years from the termination of the agreement;
- a document taken into deposit, until the termination of the deposit.

4.9. Invoicing and bookkeeping

Data processed: invoicing name and address, tax number, data relating to the fee.
Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR; Act C of 2000 on Accounting; Act CXXVII of 2007 on Value Added Tax).
Retention: for at least eight years (Section 169(2) of the Act on Accounting).

4.10. Operation of the website

Hosting and server logs. The website is served by GitHub, Inc. (USA) by means of the GitHub Pages service and its content delivery network. The usual server logs are processed by GitHub in accordance with its own privacy statement; the Firm has no access to them. The data in the logs:

IP address;
time;
the page requested;
browser data.

Legal basis: legitimate interest in the secure operation of the website (Article 6(1)(f) GDPR).

Embedded map. Google Maps loads only after the visitor has given consent (Article 6(1)(a) GDPR). Consent may be withdrawn at any time.

Cookies. The Firm does not place any cookies of its own; it only stores the visitor’s cookie choice in the browser. The choice may be changed under “Cookie settings” in the footer.

Social media sites. In the case of links to social media sites, the data processing rules of the provider concerned apply.

5. Tools based on artificial intelligence

In the course of handling engagements, the Firm uses software tools based on artificial intelligence to prepare and support its work.

These tools do not make any decision based solely on automated processing which produces legal effects concerning the data subject or similarly significantly affects the data subject (Article 22 GDPR).
Every substantive decision and every attorney work product is approved by an attorney.
Professional and legal liability, and the obligation to preserve legal professional privilege, rest exclusively with the Firm.

Areas of use:

organising and recording documents and matter data;
preparing deadlines (these are confirmed by two attorneys);
preparing internal summaries and draft texts.

Safeguards:

the Firm makes data covered by legal professional privilege accessible only to a provider with which it has concluded a data processing agreement and whose contractual terms restrict the use of the data to the provision of the service and exclude their use for model training;
the providers may engage a further processor only under conditions laid down in a contract and under the Firm’s control;
the Firm does not use public artificial intelligence services that learn from the data entered for data covered by legal professional privilege;
no client name, content of correspondence, personal data or amount is entered in the logs of the Firm’s systems.

The Firm is not bound by the duty of confidentiality vis-à-vis a contributor engaged as a processor, to the extent necessary for the provision of the service provided by that contributor (Section 10(4)(a) Üttv.).

Audio recording. An audio recording of a conversation with a client, or a machine transcript of such a recording, is made only if the data subject has been informed in advance and expressly, and has given documented consent to it (Article 6(1)(a) GDPR). In the absence of consent, no recording is made.

Dispensing with AI. The client may request in writing (info@drczudar.hu) that the Firm does not use any tool based on artificial intelligence in the client’s matter.

6. Processors

Processor	Activity	Place of processing, transfer	Safeguard
Google Ireland Ltd.	e-mail, document storage, calendar, appointment booking, map (Google Workspace)	EU; transfer to a third country is possible	data processing addendum (Cloud Data Processing Addendum); standard data protection clauses, EU–US Data Privacy Framework
Formagrid, Inc. (Airtable)	register of matters and deadlines	USA	signed data processing agreement; standard data protection clauses
GitHub, Inc.	hosting of the website, running of automated processes	USA	data processing agreement; EU–US Data Privacy Framework, standard data protection clauses
Anthropic Ireland, Limited	artificial intelligence service (API)	USA	data processing addendum; standard data protection clauses
OpenAI Ireland Ltd.	artificial intelligence service (API)	USA	signed data processing agreement; standard data protection clauses
Celonis, Inc. (Make)	workflow automation	EU (Ireland); the contracting party is based in the USA	data processing agreement; EU–US Data Privacy Framework, standard data protection clauses
Profixco Kft.	bookkeeping	Hungary	data processing agreement

7. Recipients and data transfers

Authorities and other bodies. To the extent necessary for the performance of the engagement, the Firm may transfer data to the following:

courts and authorities;
notaries;
bodies keeping authentic public registers;
the legal representative of the opposing party;
other bodies specified by law;
the bar association, in the context of a regulatory inspection by the bar association.

DHH network. The Firm does not transfer data collected through the website to the DHH network. In a specific engagement, a transfer within the network may take place only if two conditions are both met:

the express authorisation of the client; and
a confidentiality declaration by the receiving party.

Transfers to third countries. A transfer of data to a country outside the European Economic Area (such as the United States of America or China) is based on one of the following:

an adequacy decision under Article 45 GDPR (in the case of the United States of America, the EU–US Data Privacy Framework);
an appropriate safeguard under Article 46 GDPR, in particular the standard data protection clauses adopted by the European Commission;
in the absence of these, a derogation under Article 49 GDPR, in particular the explicit consent of the data subject or the establishment, exercise or defence of legal claims.

8. Rights of data subjects

The data subject is entitled:

to request information and to access his or her personal data (Article 15 GDPR);
to request the rectification of his or her data (Article 16);
to request the erasure of his or her data (Article 17);
to request the restriction of processing (Article 18);
to data portability, in the case of processing based on a contract or on consent (Article 20);
to object to processing based on legitimate interest (Article 21);
to withdraw his or her consent at any time; the withdrawal does not affect the lawfulness of the earlier processing.

The Firm responds to the request without undue delay and at the latest within one month (Article 12(3) GDPR). If it refuses the request, it also provides information on the reasons for the refusal.

9. Limits on the rights

Legal professional privilege. The right to information, the right of access and the right to erasure may be restricted in order to protect legal professional privilege (Article 14(5)(d), Article 17(3) and Article 23(1) GDPR; Section 9 Üttv.). The Firm decides on the restriction individually in the case of each request.
Mandatory retention. During the mandatory retention period indicated in Section 4, the data may not be erased.
Prevention of money laundering. Owing to a statutory prohibition, the Firm may not provide information on certain processing operations connected with the obligations under the Pmt.

10. Data security and personal data breaches

The Firm processes personal data in systems with restricted access. Its security measures:

access rights management;
two-step authentication;
encrypted data transmission.

The Firm’s staff are bound by a duty of confidentiality.

The Firm records personal data breaches in a register. If the breach involves a risk, the Firm notifies it without undue delay, and at the latest within 72 hours, to the Nemzeti Adatvédelmi és Információszabadság Hatóság (the Hungarian National Authority for Data Protection and Freedom of Information) (Article 33 GDPR). If the breach involves a high risk, the Firm also notifies the data subjects (Article 34 GDPR).

11. Remedies

The data subject may lodge a complaint with the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH):

address: 1055 Budapest, Falk Miksa utca 9–11.;
postal address: 1363 Budapest, Pf. 9.;
e-mail: ugyfelszolgalat@naih.hu;
website: www.naih.hu.

The data subject may also bring the matter before a court (Articles 77 and 79 GDPR). The data subject may – at his or her choice – also bring the action before the regional court (törvényszék) of his or her place of residence or place of stay.

It is recommended that, in the event of a complaint, the data subject first contact the Firm.

12. Amendment of the notice

The Firm amends this notice in line with changes in the law and in its data processing practice. The version in force is always available on this page; the Firm retains the previous versions. In the case of ongoing engagements, the Firm informs the clients of any material change.