DR. TIHANYI LAW OFFICE · DEBRECENCLIENT MEETINGS BY PRIOR APPOINTMENT|+36 70 234 6374
Dr. Péter Tihanyi, attorney · Debrecen

Privacy notice

Essential information about the operation of this website and contacting the office.

Document text dated: 8 October 2026.

A1 The data controller and contact details

The data controller is Dr. Tihanyi Ügyvédi Iroda (Dr. Tihanyi Law Office; referred to below as the Office), which operates as a single-member law office. The Office is responsible for processing carried out in the course of legal engagements; the head of the Office acts on its behalf.

  • Registered office and postal address: 4029 Debrecen, Busi utca 2.
  • Head of the Office and privacy contact: Dr. Péter Tihanyi, attorney.
  • The head of the Office’s Hungarian Bar identification number (KASZ): 36070191. This is the attorney’s personal Bar identification number.
  • Regional Bar association: Debrecen Bar Association.
  • Email: tihanyi@tihanyiugyved.hu.
  • Telephone: +36 70 234 6374.
  • Website: https://tihanyiugyved.hu/.

Questions and requests concerning data processing may be addressed to the Office at the postal or electronic contact details above. The privacy contact is not the same as a data protection officer under the GDPR.

A2 Purpose of this notice and applicable rules

This notice describes the processing of personal data connected with legal services, contact enquiries, invoicing and the operation of the website. It covers clients, prospective clients, representatives, contact persons, opposing parties, witnesses and other individuals appearing in case files, including children. Information about a legal entity is not in itself personal data, but information about its representative or contact person that relates to an identifiable individual is.

The Office primarily applies the following provisions:

  • Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), which repealed Directive 95/46/EC.
  • Act CXII of 2011 on informational self-determination and freedom of information (Infotv.).
  • Act LXXVIII of 2017 on legal practice (Üttv.).
  • Act LIII of 2017 on the prevention and combating of money laundering and terrorist financing (Pmt.).
  • Act V of 2013 on the Civil Code (Ptk.).
  • Act C of 2000 on accounting (Szt.).
  • For website technologies, Act C of 2003 on electronic communications, particularly Section 155(4).
  • The procedural, tax, registration and Bar rules applicable to the particular matter.

The Office processes only data necessary for specified purposes. It determines the legal basis separately for each purpose; acknowledging this notice does not constitute general consent to data processing. For processing necessary to perform an engagement or fulfil a legal obligation, the Office does not seek consent as a substitute for the applicable legal basis.

A3 Contact enquiries and appointments

Purpose: responding to enquiries, assessing whether the engagement can be accepted and checking conflicts of interest, arranging appointments and preparing an engagement.

Data: name, email address or telephone number, the content of the message, details of the enquiry and agreed appointment, and identifiers of the matter and parties needed to assess whether the engagement can be accepted. Where possible, the initial enquiry should not include more sensitive information than necessary or a complete case file.

Legal basis: Article 6(1)(b) GDPR where the data subject is preparing to enter into their own prospective contract. For other enquiries and information about a legal entity’s representative or contact person, Article 6(1)(f) applies: the legitimate interests of the Office and the person making the enquiry in establishing contact, providing a response and handling the matter appropriately. Data required for mandatory professional checks may be processed to the extent necessary on the basis of a legal obligation.

Retention: if no engagement is established, data relating to a closed enquiry may be retained for no more than one year after the last substantive contact, under the period specified by the Office in these rules. Earlier deletion is appropriate when the purpose ceases to apply. In the event of a specific legal dispute or a demonstrable conflict-of-interest risk, only the data necessary for that purpose may be retained longer, with a separately documented legal basis and review. When an engagement is established, correspondence necessary for the matter becomes part of the case file.

Providing data is voluntary, but without appropriate contact details and the information needed to identify the matter, the Office may be unable to respond or accept an engagement.

A4 Legal engagements and handling legal matters

Purpose: legal advice, drafting and countersigning documents, representation, asserting the client’s rights and legitimate interests, and communications and administration relating to the matter.

Data: depending on the matter, personal identification and contact information; authority to act as a representative; family, property, financial, contractual and asset information; statements by the client and other participants; evidence; official and court documents; correspondence and other documents necessary for professionally handling the matter. Tax identification, identity document or bank account information may be processed only for a justified administrative or statutory purpose.

Legal basis: Article 6(1)(b) GDPR for data necessary to perform an individual client’s own engagement; point (c) for mandatory professional duties. Information about a legal entity client’s representative or contact person, and about opposing parties, witnesses and other individuals, may generally be processed under point (f) where necessary to handle the matter. The legitimate interest is asserting the client’s rights and providing lawful legal services. The Office assesses necessity, proportionality and the data subject’s rights; the mere fact that a client provides data does not make all processing lawful.

Special categories of data: processing information such as health data requires both a legal basis under Article 6 GDPR and a condition under Article 9. Where processing is necessary for establishing, exercising or defending legal claims, the condition is typically Article 9(2)(f). The Office uses only the information necessary for the particular matter.

Criminal offence data: the Office processes such information in accordance with Article 10 GDPR, Section 5(7) of the Infotv. and the rules governing the particular proceedings. The applicable additional condition and connection with the legal claim must be established for each matter. Citing a contract or legitimate interest alone does not replace these requirements.

Sources: the data subject, the client or their representative, other participants in the matter, lawfully accessible public registers or other records, courts, authorities, notaries, experts and others involved in the matter. The Office provides information when collecting data directly from the data subject. For data obtained from other sources, it applies Article 14 GDPR; the exemption relating to professional secrecy is applied only to data and to the extent covered by its conditions, rather than automatically to all indirect collection.

Retention: the periods in Section A5 apply. Necessary files for matters not involving countersigning, which are not subject to another mandatory retention period, may be retained for five years after the engagement ends, on the basis of the legitimate interest in protecting the Office’s and the client’s legal claims. This is an internal retention rule, not a statutory period applicable to every case file. Where a dispute is ongoing, relevant documents may be retained for as long as necessary, with documented reasons and regular review.

Failure to provide information needed to handle the matter or verify identity may prevent the Office from accepting or performing the engagement. Where an applicable law requires the Office to carry out a check, it cannot be waived at the data subject’s request.

A5 Mandatory records and retention periods

Identification and client due diligence: these are carried out under Sections 32–33 of the Üttv. and the Pmt., to the extent applicable to the particular matter. The data may include personal identification information, address, nationality, identity document type and number, the reference number of a register check, information about representatives and beneficial owners, politically exposed person declarations, and justified information about the source of funds or wealth. Copies of identity documents may be made only on an appropriate statutory basis or where otherwise demonstrably necessary; they are not taken automatically for every enquiry.

Legal basis: Article 6(1)(c) GDPR. Section 33(7) of the Üttv. links the processing period for identification register data to the period specified in the Pmt. Data and documents under the Pmt. must generally be retained for eight years after the business relationship ends or the transaction mandate is completed; following a request specified in Section 58 of the Pmt., this may be extended to a maximum of ten years. Whether the Pmt. applies must be assessed for each matter; not all legal advice requires anti-money-laundering client due diligence.

A data subject’s contact details may be entered in the identification register under Section 33 of the Üttv. only with the consent required by that provision. This is separate from communications necessary to perform the engagement on a contractual or legitimate-interest basis.

Case register: under Section 53 of the Üttv., the case reference, client’s name, subject of the matter, date the engagement was established, and court or administrative case reference are recorded. Legal basis: Article 6(1)(c) GDPR. Retention:

  • Generally, five years after the engagement ends.
  • Where a document is countersigned, ten years after countersigning.
  • For a matter involving registration of a right relating to real property in a public register, ten years after registration of the right.

Countersigned documents and related records: under Section 53(5) of the Üttv., ten years after countersigning, unless legislation or an agreement between the parties requires longer retention. Any additional retention duty relating to conversion into electronic documentary form or specific procedures must be checked separately for the particular document.

Invoicing and accounting: name, billing address, tax number where necessary, and information about the service and payment. The purposes are issuing invoices, bookkeeping and fulfilling tax obligations; the legal basis is Article 6(1)(c) GDPR. Accounting records must be retained for at least eight years under Section 169 of the Szt.; other tax-law retention requirements must also be considered.

Retention periods apply to different categories of data and begin at different times. A complete case file cannot be kept indefinitely merely because a document within it is subject to a longer retention period. Concurrent lawful retention obligations must be coordinated for the data concerned.

A6 Access to data and disclosure

Within the Office, matters are handled by Dr. Péter Tihanyi, head of the Office. The Office currently has no employees. A substitute attorney, an appointed practice custodian or another contributor may access data only to the extent necessary to perform a lawful task.

When handling a matter or fulfilling mandatory duties, data may be received in particular by courts, authorities, notaries, other attorneys acting in the matter, experts, the opposing party or their representative, Bar bodies, accountants, invoicing providers or IT providers. Not every recipient is a processor: bodies and individuals acting for independent purposes and within their own statutory responsibilities may be independent controllers. Their status must be determined by their actual role.

Disclosure must itself be lawful and necessary. Not every disclosure requires consent; however, a legal basis under the GDPR does not in itself override professional secrecy. The Office also examines the basis and scope of official requests and the limits imposed by confidentiality.

Professional secrecy continues after the engagement ends. When using external providers, the Office ensures the protection of both personal data and professional secrecy, and sets out the necessary data processing and confidentiality terms in writing.

A7 External providers and international processing

Before transferring data outside the EEA or allowing access from outside the EEA, the Office checks the conditions under Chapter V GDPR. It cannot generally be stated that all data remains exclusively in Hungary unless the email, hosting and provider access arrangements support that statement.

A8 Website cookies and external content

When the website loads, the hosting system may process an IP address, access time, requested page and technical browser information. A legitimate interest of the office may apply to logging necessary for operation and IT security, subject to an appropriate balancing assessment.

For cookies and similar technologies, storage on or access to the visitor’s device must be assessed separately from the associated personal data processing. Conditions for the consent exemption for technologies strictly necessary to provide the requested service must be checked individually. Non-essential analytics, advertising and tracking technologies generally require prior, voluntary consent based on adequate information.

If the website uses such tools, visitors must be able to refuse consent and withdraw it later; deleting cookies afterwards in the browser does not replace prior consent. Merely browsing or acknowledging the notice does not constitute valid consent to tracking.

A9 Children’s data

In family law and other matters, children’s personal data may be processed to the extent necessary to handle the legal matter, on the bases and subject to the additional conditions in Sections A4–A5. The Office considers the child’s interests, age, representation and any conflict of interests.

The age threshold of 16 in Article 8 GDPR applies to specified cases of consent-based information society services offered directly to children. It is not a general prohibition on processing data about children under 16 or on their contacting an attorney. When a minor makes an enquiry, the Office assesses the need for legal representation in light of the matter and the nature of the legal declaration; it does not shift its own data protection obligations onto the enquirer.

A10 Data subject rights and requests

Subject to the statutory conditions, a data subject may request access to and a copy of their data, rectification, erasure or restriction of processing. They may object to legitimate-interest processing on grounds relating to their particular situation. For automated processing based on consent or a contract, they may have a right to portability of data they provided. Consent may be withdrawn at any time; this does not affect previous lawful processing or obligations based on another legal basis.

Erasure cannot be required where statutory retention or legal claims justify continued processing. Rectification does not automatically require a litigation assertion or evidence to be rewritten: for disputed data, it may be appropriate to record the dispute and the rectification request.

Professional secrecy, the rights of others and applicable statutory limitations must be considered. The Office does not reject every request by relying generally on confidentiality; it considers partial fulfilment, redaction and providing a separate copy of personal data. The prohibition on providing information concerning reports under the Pmt. applies within the scope specified by that Act.

The Office responds without undue delay and no later than one month after receiving a request. For complex or numerous requests, the period may be extended by a further two months, but the Office informs the person of the extension and reasons within the first month. If refusing a request, it explains the reason and the available remedies. It requests only the additional information necessary to verify identity.

Exercising rights is generally free of charge. For manifestly unfounded or excessive requests, the Office may refuse to act or charge a reasonable administrative fee in accordance with the GDPR; the Office must demonstrate that the conditions apply. Fees for additional copies may be charged as permitted by law.

A11 Data security

The Office applies technical and organisational measures appropriate to the risks of processing, particularly to restrict access, store documents securely, protect electronic devices, maintain backups, transfer data and delete data securely. These measures must also protect professional secrecy. The Office investigates and documents personal data breaches and makes the required notifications and communications where statutory conditions apply.

A12 Complaints and judicial remedies

Data subjects may contact the Office directly. This is not a prerequisite for an administrative or judicial remedy.

Hungarian National Authority for Data Protection and Freedom of Information (NAIH):

  • Address: 1055 Budapest, Falk Miksa utca 9–11.
  • Postal address: 1363 Budapest, P.O. Box 9.
  • Website: https://www.naih.hu/.
  • Telephone: +36 1 391 1400.
  • Information email: ugyfelszolgalat@naih.hu.
  • Electronic submissions: as described on the NAIH website, including via https://epapir.gov.hu/.

According to the NAIH’s current information, an ordinary email is not suitable for initiating proceedings; submissions must be sent by post or through an official electronic channel specified by the authority.

Data subjects may also bring court proceedings. The matter falls within the jurisdiction of a regional court; subject to the Infotv., the data subject may also choose the regional court for their place of residence or temporary residence. Compensation and non-pecuniary damages may be claimed subject to the relevant statutory conditions.

A13 Availability of this information

The Office makes this notice available on its website and during client communications. When collecting data directly, it ensures that the data subject actually receives the relevant information; publication on the website alone is not sufficient for every processing activity. In the event of a new purpose or material change, the data subject receives the necessary supplementary information in advance.