Effective as of: September 14, 2026
I. GENERAL PROVISIONS
The purpose of this Privacy Notice is to provide data subjects with appropriate, transparent and comprehensible information regarding the processing of personal data carried out by Dr. Máté Petrovai, sole attorney-at-law, as the data controller (hereinafter: the “Controller”), in connection with the website operated by the Controller at https://petrovaimate.hu/ (hereinafter: the “Website”), as well as in the course of activities performed as part of the legal practice.
This Privacy Notice applies in particular to the personal data of visitors to the Website, persons initiating contact through the Website, and natural persons concerned in connection with an attorney-client engagement. The detailed provisions concerning cookies and similar technologies used on the Website are set out in the separate Cookie Notice.
This Privacy Notice does not form part of any attorney-client engagement agreement and does not replace any separate information to be provided in individual matters where such information is required by law or necessitated by the circumstances of the relevant processing activity.
The Controller attaches particular importance to ensuring that the protection of personal data is adequately safeguarded in the course of its activities and that processing is in all cases carried out in compliance with the applicable data protection legislation and the legislation governing the legal profession. In the course of processing personal data, the Controller seeks to ensure compliance with the requirements of transparency, fairness and accountability. Accordingly, this Privacy Notice sets out, among other things, the purposes and legal bases of the processing activities, the categories of personal data concerned, the retention periods applicable to such data, the categories of persons and service providers having access to the data, and the safeguards serving the security of the processing. The Controller respects the privacy of data subjects and their right to the protection of their personal data. The exercise of the right to the protection of personal data must, however, depending on the circumstances of the relevant processing activity, be reconciled with other fundamental rights, statutory obligations, and the legitimate interests of the Controller or third parties. The lawfulness of processing must therefore in each case be assessed on the basis of its purpose, legal basis, necessity and proportionality.
This Privacy Notice also covers processing activities relating to the operation and use of the Website, contact requests, the performance of attorney-client engagements, client identification, and the handling of attorney escrow.
The purpose of this Privacy Notice is also to ensure that data subjects, having been provided with adequate information, are able to make informed decisions regarding the provision of their personal data and, where necessary, exercise their rights in relation to the processing of their personal data.
Any further questions, comments or requests concerning the processing of personal data may be submitted using the contact details of the Controller set out in this Privacy Notice.
II. THE CONTROLLER
The Controller:
Name: Dr. Máté Petrovai, sole attorney-at-law
Registered office: 1067 Budapest, Teréz körút 23. II/10.
KASZ identification number: 36082610
Tax number: 92148910-1-42
Contact details pursuant to the Eüsztv.: 92148910
E-mail: mate@petrovaimate.hu
Telephone: +36 70 237 7039
Website: https://petrovaimate.hu/
The Controller is a member of the Budapest Bar Association.
In the course of practising as an attorney-at-law, the Controller is also required to comply with the rules governing attorney-client privilege. The obligation of professional secrecy and the practice of law are primarily governed by the provisions of the Act LXXVIII of 2017 on Attorneys-at-Law (Üttv.).
III. LEGISLATION GOVERNING THE PROCESSING OF PERSONAL DATA
The processing of personal data is governed, in particular, by the provisions of the following legislation:
- Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, GDPR);
- Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Infotv.);
- Act LXXVIII of 2017 on Attorneys-at-Law (Üttv.);
- Act LIII of 2017 on the Prevention and Combating of Money Laundering and Terrorist Financing (Pmt.);
- Act C of 2000 on Accounting, insofar as its provisions apply to the relevant processing activity;
- as well as other EU or Hungarian legislation applicable to the relevant processing activity.
For the purpose of fulfilling the information obligation under Articles 13–14 of the GDPR, the most important circumstances of the processing of personal data are set out below by processing purpose.
IV. PROCESSING OF PERSONAL DATA IN CONNECTION WITH THE USE OF THE WEBSITE
1. Viewing the Website
When the Website is viewed, certain data may be generated and recorded automatically for technical reasons, in particular:
- IP address;
- time of access;
- the page or URL visited;
- certain technical data relating to the browser and operating system;
- technical information relating to the device used;
- other technical data necessary for server communication.
The processing of such data primarily serves to ensure the secure and proper operation of the Website, to identify and remedy errors, and to prevent unauthorised or improper use.
Legal basis: the legitimate interest pursuant to Article 6(1)(f) of the GDPR, and, where the processing of any data is required by law, Article 6(1)(c) of the GDPR.
The legitimate interest consists in particular in maintaining the information security of the Website, preventing misuse and ensuring the operability of the service.
V. CONTACT
1. Contact form
The data subject may provide the following data through the contact form available on the Website:
- name;
- e-mail address;
- telephone number;
- information provided in the message or description of the matter;
- any additional personal data voluntarily provided by the data subject.
The purpose of the processing is to receive and respond to enquiries, establish contact and, where this follows from the enquiry, prepare for an attorney-client engagement.
Legal basis: Article 6(1)(b) of the GDPR where the processing is necessary for taking steps at the request of the data subject prior to entering into a contract; otherwise, Article 6(1)(f) of the GDPR, or, where a legal obligation applicable to the Controller applies, Article 6(1)(c) of the GDPR.
The checkbox on the contact form confirming that the Privacy Notice has been read does not constitute separate consent to the processing of personal data, but serves as confirmation that the data subject has had the opportunity to become acquainted with the information provided. The data provided through the form are forwarded electronically by the Controller to the specified contact address.
2. Direct contact by e-mail
The Controller also accepts enquiries directly at the e-mail address published on the Website.
In such cases, the following may in particular be processed:
- the sender’s name;
- e-mail address;
- content of the e-mail;
- personal data contained in any attachments;
- other data voluntarily provided by the data subject.
The purpose of the processing is to respond to the enquiry, establish contact and, where applicable, prepare for or perform an attorney-client engagement.
Legal basis: Article 6(1)(b), (c) or (f) of the GDPR, depending on the specific purpose of the processing.
3. Contact by telephone
In the event of a telephone enquiry, the Controller may process the personal data communicated by the caller to the extent necessary for handling the matter.
Legal basis: Article 6(1)(b), (c) or (f) of the GDPR, depending on the purpose of the processing.
The Controller does not generally record telephone conversations.
VI. PROCESSING OF PERSONAL DATA IN CONNECTION WITH AN ATTORNEY-CLIENT ENGAGEMENT
Where an attorney-client relationship is established following initial contact, the scope of processing may be significantly broader than that required for the mere use of the Website.
In the course of providing legal services, the following may in particular be processed:
- the client’s identification and contact details;
- residential and temporary residence details;
- data contained in identity documents;
- tax identification number and other identification data, where their processing is necessary;
- data relating to the matter;
- personal data contained in documents provided by the client;
- contractual, asset-related, financial and other data relevant to the matter;
- data of other natural persons concerned in the matter;
- other personal data necessary for handling the matter.
The purpose of the processing is to establish, prepare and perform the attorney-client engagement, represent the client, provide legal advice, prepare and countersign documents, act in administrative and court proceedings, and fulfil statutory obligations relating to the practice of law.
Legal basis: depending on the relevant processing activity, in particular Article 6(1)(b), (c) and (f) of the GDPR.
The processing of personal data may in certain cases also be necessary for the establishment, exercise or defence of legal claims of the Controller or a third party.
VII. SPECIAL CATEGORIES OF PERSONAL DATA AND DATA RELATING TO CRIMINAL OFFENCES
In the course of practising law, the Controller may, by virtue of the nature of a matter, become aware of special categories of personal data within the meaning of Article 9 of the GDPR, as well as personal data relating to criminal offences and the determination of criminal liability as specified in Article 10 of the GDPR. Such data shall be processed only where and to the extent that this is necessary for handling the relevant matter and the processing complies with the requirements laid down by the GDPR and applicable Hungarian law. The exceptions provided for in Article 9 of the GDPR may be of particular relevance in cases involving the establishment, exercise or defence of legal claims. The processing of special categories of personal data, or personal data relating to criminal offences and criminal liability, does not mean that the Controller processes such data generally or beyond the purpose of the relevant matter.
The legal basis for the processing of special categories of personal data may, depending on the purpose and circumstances of the relevant processing activity, be in particular Article 9(2)(f) of the GDPR or another appropriate legal basis provided for by applicable EU or Hungarian law; in the case of processing data referred to in Article 10 of the GDPR, the conditions laid down in Article 10 of the GDPR must also be met.
VIII. CLIENT IDENTIFICATION AND ANTI-MONEY LAUNDERING OBLIGATIONS
In the course of practising law, the identification of the client and, in certain cases, other persons, as well as the recording of related data, may be mandatory by law.
The processing may serve, in particular, the performance of customer due diligence and other obligations under the Pmt.
Legal basis: Article 6(1)(c) of the GDPR, i.e. compliance with a legal obligation to which the Controller is subject.
The retention of data processed pursuant to the Pmt. may be subject to the specific retention rules set out in the Pmt. In certain cases, the Pmt. may also contain specific or restrictive provisions concerning the exercise of data subject rights. Such provisions shall apply only where the statutory conditions are met.
IX. ATTORNEY ESCROW
The Controller may also handle attorney escrow in the course of practising law.
In connection with the handling of attorney escrow, the following may, among other things, be processed:
- the personal data of the depositor;
- the personal data of the beneficiary;
- data of other persons concerned in the matter;
- data relating to the escrow agreement and the subject matter of the escrow;
- financial and transaction data;
- data necessary for maintaining the escrow register;
- other data required to be recorded by law.
The purpose of the processing is the lawful handling, registration and performance of attorney escrow, as well as compliance with statutory obligations relating to the practice of law and the prevention of money laundering.
Attorney escrow forms part of the practice of law within the meaning of the Üttv., and the processing of personal data in connection with such activities is governed by the Üttv. and, where the relevant conditions apply, the provisions of the Pmt.
In the case of processing activities falling within the scope of the Pmt., the statutory retention period is generally eight years, and in the event of a specified request from an authority, the retention period may be extended for up to ten years.
X. LEGAL CLAIMS, DISPUTES AND EVIDENCE
The Controller may process personal data that are necessary for the establishment, exercise or defence of legal claims.
Legal basis: as a general rule, Article 6(1)(f) of the GDPR.
The duration of the processing depends on the relevant legal relationship, legal claim and the applicable limitation period or other statutory period. The retention of data relating to legal claims may be justified until the claim can no longer be enforced or any related dispute has been finally resolved.
XI. ACCOUNTING AND TAX OBLIGATIONS
The Controller may process personal data for the purpose of complying with its accounting, tax and other statutory obligations. The legal basis for such processing is Article 6(1)(c) of the GDPR, i.e. compliance with a legal obligation to which the Controller is subject. The retention period is determined by the legislation applicable to the relevant document and data, in particular Act C of 2000 on Accounting and tax legislation. Therefore, the retention period may differ depending on the type of document.
XII. WEBSITE HOSTING AND E-MAIL SERVICES
The hosting service provider of the Website is:
Rackhost Zrt.
6722 Szeged, Tisza Lajos körút 41.
E-mail: info@rackhost.hu
Website: https://www.rackhost.hu/
In the course of providing hosting services, technical data, server logs and, depending on the information technology solutions used, other data relating to the operation of the Website may be processed.
The data of contact forms submitted through the Website may be forwarded to the electronic mail system used by the Controller. The purpose of the processing is to operate the Website and electronic communications and to maintain information security.
XIII. CLOUDFLARE TURNSTILE
For the protection of the contact form, the Website uses the Cloudflare Turnstile service. The purpose of the service is to determine whether the form is being used by a human or an automated system and to prevent spam, misuse and automated attacks. In the course of operating the service, technical information and information relating to the browser, device and client may be processed. The use of the service serves to ensure the security of the Website and does not constitute statistical or marketing tracking.
The detailed technical operation and data processing of Turnstile are governed by Cloudflare’s applicable terms and privacy documentation.
XIV. WORDPRESS AND WORDFENCE
The Website uses the WordPress content management system. For the security of the Website, a Wordfence security solution is also applied, which serves, among other things, to detect and prevent unauthorised access attempts, attacks and other security events. It performs the Website’s security, firewall and intrusion protection functions. In this context, technical identifiers, IP addresses, access attempts and data relating to security events may in particular be processed.
Legal basis: the legitimate interest pursuant to Article 6(1)(f) of the GDPR, relating to maintaining the security of information technology systems and the Website.
XV. WEBSITE SECURITY AND LOGGING
Security and technical logging may take place in the course of operating the Website and the information technology infrastructure.
The purposes include, in particular:
- detecting unauthorised access;
- preventing information technology attacks;
- investigating misuse;
- identifying technical errors;
- maintaining the security and operability of the system.
The Controller processes logged data only for as long as necessary and to the extent necessary to achieve the relevant purpose.
XVI. GOOGLE ANALYTICS 4
The Website may use Google Analytics 4 for statistical purposes. Google Analytics is activated only if the visitor gives consent to this during the cookie settings process.
In the course of statistical processing, the following may in particular be processed:
- visit and session data;
- page views;
- technical data relating to the browser and device;
- approximate geographical information;
- certain interactions carried out on the Website.
Legal basis: consent pursuant to Article 6(1)(a) of the GDPR.
If consent is refused or withdrawn, Google Analytics statistical data collection shall not take place in a manner requiring consent.
The typical default lifetime of the _ga and ga* cookies associated with Google Analytics is not the same as the retention period of data stored in Google Analytics; the latter is determined by the service settings and the applicable Google rules.
XVII. GOOGLE MAPS
The Website may use the Google Maps service on the contact page to illustrate the location and address of the Controller’s office. Under the Website’s current settings, Google Maps content is loaded only after the visitor has given consent. In the absence of consent, substitute content is displayed instead of the external map content.
When the service is used, Google may process technical data, including IP address, browser and device information, and data relating to the use of the map service.
Legal basis: consent pursuant to Article 6(1)(a) of the GDPR.
The Controller does not use Google Maps for advertising or remarketing purposes.
XVIII. COOKIES AND SIMILAR TECHNOLOGIES
The Website may use cookies and similar technologies for the purpose of ensuring the operation of the Website, remembering settings, managing consent, statistical measurement, and displaying external content authorised by the visitor. The detailed description, purpose, provider and lifetime of cookies are set out in the separate Cookie Notice.
Cookies relating to statistical measurement and external content are activated only on the basis of the consent required for the relevant purpose. Necessary technical cookies are required for the proper operation of the Website.
XIX. COMPLIANZ AND WP CONSENT API
The Website uses Complianz to manage visitors’ cookie and data processing settings, and WP Consent API to technically transmit consent statuses.
These may process, for example:
- the selected consent categories;
- the status of consent;
- technical data relating to the withdrawal or modification of consent;
- technical information necessary to demonstrate consent.
The legal basis for documenting consent decisions may be compliance with applicable legal obligations or the legitimate interest of the Controller.
XX. POLYLANG
The Website is available in both Hungarian and English. Polylang may process technical data and language settings in order to remember the selected language and display the Website in the appropriate language. Such processing is based on the legitimate interest relating to the proper operation of the Website.
XXI. UPDRAFTPLUS AND BACKUPS
For the security of the Website’s operation and the prevention of potential data loss, a backup solution, in particular UpdraftPlus, may be used. Backups may contain the contents of the Website’s database and files and, consequently, personal data processed on the Website may also be included in the backups. The processing of backups is based on the Controller’s legitimate interest in ensuring continuity of operation, data security and the prevention of data loss. The retention period of backups is aligned with the applicable backup schedule and technical settings. Where backups are transferred to an external hosting service, the data processing conditions of the relevant service and the technical configuration applied shall govern.
XXII. GOOGLE DRIVE – POTENTIAL BACKUP
Where backups are stored on remote storage, such as the Google Drive service, the personal data contained in the backups may technically also enter the systems of the storage service provider. This possibility is relevant only if Google Drive is actually configured as the destination for backups.
In the case of such processing, the purpose of the backup, restrictions on access to the backup and the retention period are aligned with the Controller’s current technical settings.
XXIII. DATA PROCESSORS, SERVICE PROVIDERS AND RECIPIENTS
The Controller may use certain service providers for the performance of its tasks.
These may include, in particular:
- Rackhost Zrt. – hosting and related technical services;
- Cloudflare – Turnstile security service;
- Google – Google Analytics and Google Maps services;
- other providers of the information technology and security solutions used.
The data protection role of the individual service providers is not the same in every case. A service provider may process personal data as a data processor or, in other cases, as an independent controller or as a controller acting in another specific capacity.
The Controller therefore does not automatically classify all external service providers as data processors; the role of the relevant service provider must be determined on the basis of the actual operation of the relevant service, its contractual terms and its technical settings.
In the course of practising law, personal data may also be disclosed, to the extent necessary for handling the matter, to other recipients – in particular courts, authorities, notaries, opposing parties, experts, accountants or other persons assisting in the matter – where there is a legal basis for such disclosure.
XXIV. TRANSFER OF DATA TO THIRD COUNTRIES
When certain external services are used, personal data may be transferred to a country outside the European Economic Area or may be accessible to an organisation operating in such a country. In such cases, the transfer of data may take place only in accordance with the conditions laid down in Chapter V of the GDPR.
Depending on the service used and the technical configuration, appropriate safeguards for the transfer may be based, in particular, on an adequacy decision, standard data protection clauses or other safeguards permitted by the GDPR.
XXV. SECURITY OF PROCESSING
The Controller implements appropriate technical and organisational measures to ensure that the protection of personal data is maintained at a level proportionate to the risk.
The measures applied may in particular include:
- protection against unauthorised access;
- restriction of access rights;
- password protection;
- security updates of information technology systems;
- backups;
- protection against viruses and attacks;
- security logging;
- limitation of the necessity of access to personal data;
- detection and handling of data security incidents.
The Controller aligns the measures with the nature, scope and risks of the processing. Article 32 of the GDPR expressly requires the application of technical and organisational measures proportionate to the risks.
XXVI. PERSONAL DATA BREACH
In the event of a personal data breach, the Controller shall act in accordance with the GDPR and the applicable rules of Hungarian law. Where a personal data breach is likely to result in a risk to the rights and freedoms of natural persons, the Controller shall take the measures required by the GDPR, including, where necessary, notifying the supervisory authority and informing the data subjects.
Pursuant to Article 33 of the GDPR, where there is an obligation to notify the supervisory authority, the notification must, as a general rule, be made within 72 hours after the Controller becomes aware of the breach.
XXVII. AUTOMATED DECISION-MAKING AND PROFILING
In the course of using the Website, contacting the Controller and practising law, the Controller does not use decision-making based solely on automated processing that would produce legal effects concerning the data subject or similarly significantly affect the data subject.
The Controller does not carry out profiling in relation to clients that would result in such significant decisions being made concerning the data subjects.
Article 22 of the GDPR establishes specific rules concerning decision-making based solely on automated processing.
XXVIII. DATA PROTECTION OFFICER
No data protection officer has currently been appointed by the Controller.
Based on the current circumstances of the processing activities, the conditions for the appointment of a data protection officer specified in Article 37 of the GDPR and the relevant provisions of the Infotv. are not met.
Should the circumstances of the processing change in the future in such a way that the appointment of a data protection officer becomes necessary, the Controller shall amend this Privacy Notice accordingly.
XXIX. RIGHTS OF DATA SUBJECTS
Under the GDPR and applicable Hungarian law, data subjects are entitled, in particular, to the following rights.
1. Right to information
The data subject is entitled to receive appropriate information concerning the circumstances of the processing.
2. Right of access
The data subject is entitled to obtain confirmation as to whether or not personal data concerning them are being processed and, subject to the statutory conditions, is entitled to access the personal data processed and information relating to the processing.
3. Right to rectification
The data subject may request the rectification of inaccurate personal data or the completion of incomplete data.
4. Right to erasure
The data subject may, subject to specified conditions, request the erasure of their personal data.
The right to erasure does not, however, necessarily apply where the processing is required by law or where further processing of the data is necessary for the establishment, exercise or defence of a legal claim.
5. Right to restriction of processing
The data subject may, in specified cases, request the restriction of the processing of their personal data.
6. Right to data portability
Where the statutory conditions are met, the data subject may be entitled to receive the personal data concerning them which they have provided to the Controller in a structured, commonly used and machine-readable format and to transmit those data to another controller.
7. Right to object
The data subject may object, on grounds relating to their particular situation, to processing based on Article 6(1)(e) or (f) of the GDPR. In the event of an objection, the Controller shall proceed in accordance with the conditions laid down in the GDPR.
8. Withdrawal of consent
Where the legal basis for processing is the consent of the data subject, the data subject may withdraw their consent at any time. Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Consent relating to cookies may be modified or withdrawn through the cookie settings available on the Website.
XXX. HANDLING OF DATA SUBJECT REQUESTS
A request concerning the exercise of data subject rights may be submitted using the following contact details:
E-mail: mate@petrovaimate.hu
The Controller shall provide the necessary information and take action in relation to the data subject’s request without undue delay and, as a general rule, within one month of receiving the request.
That period may be extended by a further two months, taking into account the complexity and number of the requests; the Controller shall inform the data subject of any such extension within one month of receipt of the request. Where the Controller has reasonable doubts concerning the identity of the person making the request, it may request additional information necessary to confirm the identity of that person. These rules of the GDPR are set out in detail in Article 12.
XXXI. LODGING A COMPLAINT WITH THE SUPERVISORY AUTHORITY
Where the data subject considers that the processing of their personal data infringes the provisions of the GDPR or applicable data protection legislation, they are entitled to lodge a complaint with the supervisory authority.
In Hungary, the supervisory authority is:
National Authority for Data Protection and Freedom of Information (NAIH)
1055 Budapest, Falk Miksa utca 9–11.
Postal address: 1363 Budapest, P.O. Box 9.
Website: https://naih.hu/
The data subject may also bring proceedings before a court in accordance with the conditions laid down by law.
XXXII. RETENTION PERIOD – SUMMARY
The Controller does not retain personal data indefinitely. The duration of each processing activity depends on the purpose and legal basis of the relevant processing.
In particular:
- data processed in the course of contact are processed by the Controller for as long as necessary to handle the enquiry and any further handling arising from it;
- in the case of an attorney-client engagement, data relating to the matter may need to be retained for the period determined by obligations arising from the practice of law, legal claims and statutory retention obligations;
- data processed pursuant to the Pmt. are subject to the specific retention periods set out in the Pmt.;
- data processed for accounting and tax purposes are subject to the statutory deadline applicable to the relevant document;
- data serving as evidence of consent are processed by the Controller for as long as necessary to demonstrate such consent;
- security logs and backups are retained by the Controller for as long as necessary to achieve the relevant security purpose.
Where personal data are processed for several different purposes, the retention period of the data must be determined on the basis of the lawful retention periods applicable to each processing purpose and the continued existence of the purpose of the processing.
XXXIII. AMENDMENT OF THE PRIVACY NOTICE
The Controller reserves the right to amend and update this Privacy Notice, in particular in the following cases:
- changes in the applicable legislation or in its interpretation;
- changes in regulatory or judicial practice;
- introduction of a new processing purpose or processing activity;
- engagement of a new data processor, recipient or service provider;
- changes in the operation, functions or technical environment of the Website;
- application of a new information technology or data security solution;
- changes in the existing data processing practices or in the circumstances of processing.
The amended Privacy Notice shall enter into force upon publication on the Website, unless the amended Privacy Notice specifies a different effective date.
The Controller shall inform data subjects of material changes to the Privacy Notice in an appropriate manner where required by applicable legislation.
The Privacy Notice in force at any given time is available on the Website. The Controller recommends that data subjects periodically review the version of the Privacy Notice currently in force on the Website.
XXXIV. CONTACT
Questions, requests and comments concerning the processing of personal data may be submitted using the following contact details:
Dr. Máté Petrovai, sole attorney-at-law
1067 Budapest, Teréz körút 23. II/10.
E-mail: mate@petrovaimate.hu
Telephone: +36 70 237 7039
XXXV. FINAL PROVISIONS
This Privacy Notice shall be interpreted together with the other legal notices available on the Website, in particular the Impressum and Legal Notices and the Cookie Notice.
The Cookie Notice regulates in detail the processing of personal data relating to cookies and other similar technologies used on the Website, whereas this Privacy Notice contains the material circumstances relating to the processing of personal data other than such processing and the rights of data subjects.
In matters not regulated by this Privacy Notice, the provisions of the applicable Hungarian and European Union legislation, as well as the professional and bar association rules applicable to the practice of law, shall apply.
This Privacy Notice shall be interpreted having regard to the processing activities determined by the Controller, their circumstances as existing from time to time, and the technologies applied on the Website.
Dr. Máté Petrovai, sole attorney-at-law
Effective as of: September 14, 2026