Privacy Policy
on the use of the www.lawit.hu website
This Policy is effective from 5 October 2026.
As a law firm, we consider it particularly important that you can see exactly what happens to your personal data. In this policy (the "Policy") we summarize what personal data we process when you use the www.lawit.hu website (the "Website"), for what purposes and on what legal bases, for how long we retain such data, and what rights you have.
When processing data, we act in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the "GDPR"), as well as the applicable Hungarian legislation.
1. Name and contact details of the data controller
The processing carried out through the Website is the responsibility of Kerecsen Ügyvédi Iroda (the "Firm" or "Controller"). Its contact details are as follows:
- Name:
- Kerecsen Ügyvédi Iroda
- Represented by:
- dr. Éva Kinga Kerecsen, attorney-at-law
- Registered seat:
- 1062 Budapest, Andrássy út 113., Hungary
- Registering bar:
- Budapest Bar Association
- Tax number:
- 19140771-2-42
- Website:
- www.lawit.hu
- E-mail:
- info@lawit-legal.hu
You can reach us with any data protection questions at the e-mail address above.
2. Scope of data processed, purpose and legal basis of processing, retention period of the data
Below we present, by processing activity, what data we process. Providing the data is voluntary; however, if you do not provide the data requested on the forms, we will not be able to fulfil your request.
2.1. Contact form
If you write to us through the form, your message is received at our e-mail address info@lawit-legal.hu.
| Scope of data processed | Purpose of processing | Legal basis of processing | Retention period |
|---|---|---|---|
| Name, company name, e-mail address, the text of the message | Receiving and answering the inquiry, maintaining contact with the person inquiring or with the organization they represent or are employed by, and preparing a possible engagement. | The Firm's legitimate interest [GDPR Article 6(1)(f)], which relates to responding to inquiries, maintaining contact with potential clients and their representatives and contact persons, and preparing a possible engagement. | For 2 (two) years from the last substantive contact. If the data must be retained further for the purpose of asserting, exercising or defending legal claims, we keep it until the end of the applicable limitation period. |
| Name, company name, e-mail address, the text of the message, as well as the communication related to the matter | Asserting, exercising or defending legal claims, where this may become necessary based on the inquiry or the ensuing communication. | The Firm's legitimate interest [GDPR Article 6(1)(f)], which relates to asserting, exercising or defending its legal claims. | Until the legal claim can no longer be enforced, as a general rule until the end of the 5 (five) year general limitation period under Section 6:22(1) of Act V of 2013 on the Civil Code (the "Civil Code"). |
2.2. Completing legal risk assessment questionnaires
On the Website you will find various preliminary legal risk assessment questionnaires on professional legal topics, for example on organizational and product-level compliance related to the use of artificial intelligence, as well as on data protection. With the help of the questionnaires, the organization filling them in can quickly obtain a preliminary picture of the legal risks and compliance tasks it should consider.
After completion, we send you the evaluation of the questionnaire by e-mail. For this purpose, and for further correspondence, we request the data below. The questionnaires are typically completed by representatives or employees of companies, so the answers primarily relate to the organization rather than to the person filling them in.
When completing the questionnaire — particularly in the free-text fields — please do not provide personal data relating to a third party (for example an employee, client or user), special categories of personal data, passwords, or other confidential information that is not necessary for the evaluation of the questionnaire.
The evaluation prepared on the basis of the questionnaire is a preliminary, informational risk assessment, which does not in itself constitute legal advice and does not create an engagement between the Firm and the person completing the questionnaire or the organization they represent or are employed by. The evaluation does not involve automated decision-making, within the meaning of Article 22 of the GDPR, that produces legal effects concerning the data subject or similarly significantly affects them.
The following processing activities take place when the questionnaire is completed:
| Scope of data processed | Purpose of processing | Legal basis of processing | Retention period |
|---|---|---|---|
| Name, company name (workplace), e-mail address, phone number, the answers given in the questionnaire, including information about the organization represented or employing the person filling it in, its operations, products or services, as well as the evaluation sent | Evaluating the questionnaire, preparing and sending the evaluation, and the contact necessary for this. | The Firm's legitimate interest [GDPR Article 6(1)(f)], which relates to performing the service aimed at evaluating the questionnaire between the Firm and the organization represented or employing the person filling it in, and the contact necessary for this. | Until the evaluation is sent. Thereafter the data is retained for the documentation and legal claim enforcement purposes set out below. |
| Name, company name, e-mail address, the answers given in the questionnaire, and the evaluation sent | Documenting what information the respondent provided and what evaluation we sent based on it, as well as asserting, exercising or defending any legal claims. | The Firm's legitimate interest [GDPR Article 6(1)(f)], which relates to documenting the proper performance of the service provided, as well as asserting, exercising or defending any legal claims. | For 5 (five) years from the date the evaluation is sent, having regard to the general limitation period under Section 6:22(1) of the Civil Code. |
| Name, company name (workplace), e-mail address, phone number, and the information necessary for contact relating to the subject and result of the questionnaire | If you separately consent to this, contacting you or the organization you represent or are employed by, in order to present the Firm's legal services related to the subject and result of the questionnaire, and to prepare a possible engagement. | Your consent [GDPR Article 6(1)(a)]. Consent may be withdrawn at any time without justification. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. | Until the consent is withdrawn, but for no longer than 2 (two) years from the date consent was given or from the last substantive contact thereafter. |
Completing the questionnaire and using the evaluation does not depend on whether you consent to our Firm contacting you in connection with its legal services.
2.3. Appointment booking (Calendly)
The appointment-booking link on the Website redirects you to the booking interface operated by Calendly, LLC, where you can book a consultation with us. The booking therefore takes place not on the Website, but on the Calendly interface. The booking data is processed by Calendly, LLC as a processor, in accordance with our instructions, and is not used by Calendly for its own marketing purposes. You can read more about Calendly's own data processing at https://calendly.com/legal/privacy-notice.
| Scope of data processed | Purpose of processing | Legal basis of processing | Retention period |
|---|---|---|---|
| Name, e-mail address, the booked appointment time, and the information provided at the time of booking that is necessary to prepare the consultation | Booking and confirming the appointment, organizing and preparing the consultation, and preparing a possible engagement. | The Firm's legitimate interest [GDPR Article 6(1)(f)], which relates to maintaining contact with persons inquiring or representatives and contact persons of potential clients, organizing the consultation, and preparing a possible engagement. | Until the consultation takes place, or, if the appointment is cancelled, until it is cancelled. |
| Name, e-mail address | Maintaining contact following the consultation with the person inquiring or the organization they represent or are employed by, and preparing a possible later engagement. | The Firm's legitimate interest [GDPR Article 6(1)(f)], which relates to maintaining contact with persons who attended the consultation or representatives and contact persons of potential clients, and preparing a possible engagement. | For 2 (two) years following the consultation. |
| The e-mail address of additional participants (guests) provided at the time of booking | Notifying additional participants about the appointment and sending the invitation, organizing the consultation. | The Firm's legitimate interest [GDPR Article 6(1)(f)], which relates to organizing the consultation and notifying the participants. | Until the consultation takes place, or, if the appointment is cancelled, until it is cancelled. |
If you provide other persons' e-mail addresses during the booking, please inform them in advance of this and of this Policy.
2.4. Visiting the Website
When you visit the Website, the system serving the Website automatically records certain data for technical reasons.
You can read more about the cookies used on the Website in our separate cookie policy.
Meta Pixel and Conversions API: only if you consent to advertising (marketing) cookies in the cookie banner, the Website shares page views and contact form submissions with Meta Platforms Ireland Ltd., together with your SHA-256 hashed e-mail address and name, IP address, browser details and Meta cookie identifiers (_fbp, _fbc), to measure and optimise our ads. You can withdraw consent at any time in the cookie settings; afterwards neither the browser nor our server sends further events to Meta.
2.5. Establishment of an engagement
If, following the initial contact, the completion of the questionnaire or the consultation, you instruct our Firm, the data processed in connection with the matter is governed by our privacy policy addressed to clients, as well as by the provisions of Act LXXVIII of 2017 on the Activities of Attorneys (the "Attorneys Act").
3. Data security
We ensure, through appropriate IT, technical and organizational measures, that unauthorized persons cannot access the data, and that no one may unlawfully alter, transfer, disclose, erase or destroy it. Within our Firm, only those employees who need it for their work have access to the data.
4. Recipients of personal data, data processors
We do not transfer the data to third parties, except where required to do so by law. To operate the Website and carry out the processing activities, we use the assistance of the following service providers, who act as processors (GDPR Article 28), exclusively in accordance with our instructions: Microsoft 365 (e-mail and document management), Calendly, LLC (appointment booking), as well as the Website's hosting provider.
5. Transfer of data to third countries
Microsoft stores the data primarily within the European Union. However, in the course of operating Microsoft 365 and Calendly, data may be transferred to the United States of America. In such cases, the basis for the data transfer is the European Commission's adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework (GDPR Article 45), to which Microsoft Corporation and Calendly, LLC have both adhered. This means that these companies provide a level of protection essentially equivalent to that within the EU.
6. Processing of special categories of data, automated decision-making
We do not request special categories of personal data (for example health data) through the Website, and the collection of such data is not a purpose of our processing. Please do not provide such data, or personal data relating to a third party that is not necessary for the purpose of the relevant inquiry or questionnaire, in your message, in the questionnaire, or in the description of the appointment booking. If, despite this, you provide such data, we will process it only to the extent necessary to handle the inquiry or evaluate the questionnaire, and we will erase it if its further processing is not necessary and has no other legal basis.
We do not apply automated decision-making, including profiling, in our processing activities.
7. Data subject rights with respect to this processing
7.1. The right of access
Under Article 15 of the GDPR, you are entitled at any time to request information as to whether and how the Controller processes your personal data, including the purposes of processing, the recipients with whom your data has been shared, or the source from which the Controller obtained the data, the retention period, any of your rights relating to the processing, and, in the case of a transfer to a third country or an international organization, information about the related safeguards. In exercising the right of access, you are also entitled to request a copy of the data. If the exercise of your right of access adversely affects the rights and freedoms of others, in particular others' trade secrets or intellectual property, the Controller is entitled to refuse to comply with your request to the necessary and proportionate extent.
7.2. The right to rectification
Under Article 16 of the GDPR, the Controller shall rectify or complete personal data relating to you at your request. If doubts arise regarding the rectified data, the Controller may ask you to substantiate the corrected data in an appropriate manner, primarily by means of a document.
7.3. The right to erasure ("the right to be forgotten")
Under Article 17 of the GDPR, if you request the erasure of your personal data, the Controller shall erase it without undue delay:
- if it is no longer necessary for the purpose for which it was originally stored, or the processing is unlawful,
- if you withdraw your consent and there is no other legal basis for the processing.
Personal data cannot be erased where the processing is necessary:
- for exercising the right of freedom of expression and information,
- for compliance with a legal obligation under Union or Member State law applicable to the Controller requiring processing of the personal data,
- for the establishment, exercise or defense of legal claims.
7.4. The right to object
Under Article 21 of the GDPR, if the legal basis for the processing of your data is the legitimate interest of the Controller or of a third party, you are entitled to object to the processing. The Controller is not required to comply with the objection if it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing relates to the establishment, exercise or defense of the Controller's legal claims.
7.5. The right to restriction of processing
Under Article 18 of the GDPR, you may request the restriction of the processing of your personal data in the following cases:
- the processing is unlawful but you oppose the erasure of the data and request the restriction of its use instead,
- the Controller no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defense of legal claims.
7.6. The right to data portability
Under Article 20 of the GDPR, you are entitled to receive the personal data concerning you that you have provided to the Controller, and also to have that data transmitted directly by the Controller to another controller, provided that the legal basis of the processing is your consent.
7.7. The right to withdraw consent
Where the legal basis of the processing is your consent, you may withdraw your consent at any time, without justification, using the contact details indicated in Section 1 of this Policy. The withdrawal of consent does not affect the lawfulness of the processing carried out before the withdrawal.
7.8. The right to lodge a complaint, the right to a remedy
If you consider that the Controller's processing of your personal data infringes the data protection legislation in force at any given time, in particular the provisions of the GDPR, you have the right to lodge a complaint with the competent data protection supervisory authority. In Hungary, a complaint may be submitted to the National Authority for Data Protection and Freedom of Information ("NAIH"). NAIH's contact details are as follows:
- Website:
- https://naih.hu
- Postal address:
- 1363 Budapest, Pf.: 9., Hungary
- Address:
- 1055 Budapest, Falk Miksa utca 9-11., Hungary
- Phone:
- +36 (1) 391-1400
- E-mail:
- ugyfelszolgalat@naih.hu
In addition, under the rules of the GDPR and the Hungarian Information Act, you may turn to a court. Your detailed rights and remedies are set out in Chapters III and VIII of the GDPR and in Sections 14–23 of the Information Act.
7.9. Time limit for responding to a data subject request
The Controller shall ensure that if you exercise any of your rights in connection with this processing and contact the Controller in this regard, the Controller shall respond to such requests without undue delay, and in any event within 1 (one) month of receipt of the request. Where necessary, taking into account the complexity and number of requests, this period may be extended by a further 2 (two) months, of which the Controller shall inform you, stating the reasons for the delay, within 1 (one) month of receipt of the request.
If you wish to exercise any of your rights, or have any questions or comments, please contact us using the contact details indicated in Section 1 of this Policy!
8. Amendment of the Policy
We may update the Policy from time to time, for example in the event of a change in legislation, a change in regulatory practice, or the introduction of a new service. You will find the version in force at any given time on the Website.