Effective as of 26 August 2026

1. Introduction and Information on the Data Controller

SWK Law Firm (hereinafter referred to as the “Data Controller” or the “Firm”) places particular emphasis on the protection of personal data processed by the Firm, respect for the information self-determination rights of data subjects, and the secure and lawful processing of personal data.

The purpose of this Privacy and Data Processing Notice is to provide transparent information to the Firm’s clients, prospective clients, business partners, contact persons, and visitors to the Firm’s website regarding the processing of their personal data.

Data Controller:

Name: SWK Law Firm
Registered office: 1112 Budapest, Cseresznye utca 37.
E-mail: office@advocate.hu
Telephone: +36 30 322 3839
Website: www.advocate.hu
Tax number: 19369387-2-43
Bar registration number: 5384

The processing of personal data is governed, in particular, by the following legislation:

• Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR);
• Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Infotv.);
• Act LXXVIII of 2017 on Attorneys-at-Law (Üttv.);
• Act LIII of 2017 on the Prevention and Combating of Money Laundering and Terrorist Financing (Pmt.);
• Act V of 2013 on the Civil Code (Ptk.);
• Act C of 2000 on Accounting;
• Act CVIII of 2001 on Certain Issues Relating to Electronic Commerce and Information Society Services.

In processing personal data, the Firm acts in accordance with the principles set out in the GDPR, in particular lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.

2. Definitions

For the purposes of this Notice:

personal data: any information relating to an identified or identifiable natural person;

data subject: an identified or identifiable natural person to whom the personal data relates;

processing: any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, storage, alteration, retrieval, use, transmission, restriction, erasure or destruction;

data controller: the natural or legal person which, alone or jointly with others, determines the purposes and means of the processing of personal data;

data processor: a natural or legal person which processes personal data on behalf of the data controller;

third party: a natural or legal person, public authority, agency or body other than the data subject, the data controller and the data processor;

consent: any freely given, specific, informed and unambiguous indication of the data subject’s wishes;

personal data breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

3. Contacting the Firm via the Website

Visitors to the website may contact the Firm directly by using the contact form available on the website.

Personal data processed: name, company name – where its provision is necessary or voluntary –, e-mail address, telephone number, subject and content of the message, as well as any other personal data voluntarily provided by the data subject.

Purpose of processing: to enable contact with the Firm, respond to enquiries, and, where necessary, facilitate discussions prior to entering into an attorney-client engagement.

Legal basis for processing: depending on the nature of the enquiry, consent pursuant to Article 6(1)(a) of the GDPR, or, where the contact is made at the data subject’s request in order to take steps prior to entering into a contract, Article 6(1)(b) of the GDPR.

Retention period: where an attorney-client engagement does not arise from the enquiry, the Firm retains the personal data only for as long as necessary for the purposes of the processing, the handling of potential legal claims, or compliance with a legal obligation. If an attorney-client engagement is established, the further processing of the data is governed by the rules applicable to the processing of personal data in connection with the attorney-client engagement.

4. Processing of Personal Data in Connection with Attorney-Client Engagements, Contracting and the Performance of the Engagement

In the course of its legal practice, the Firm processes personal data necessary for establishing, performing and terminating attorney-client engagements.

Personal data processed: in particular, the name, residential address, registered office, date and place of birth, contact details and other relevant personal data of the client and, where necessary, the client’s representative, authorised representative or contact person, as well as any further personal data required for handling the particular matter.

Purpose of processing: establishing and performing the attorney-client engagement, communicating with the client, providing legal advice and representation, preparing legal documents, and performing other tasks related to the Firm’s legal practice.

Legal basis for processing: in particular, performance of a contract pursuant to Article 6(1)(b) of the GDPR and compliance with a legal obligation pursuant to Article 6(1)(c) of the GDPR.

Where the Firm processes personal data not of the client but of the client’s employee, representative or other contact person, the legal basis for processing may also be, depending on the circumstances, the legitimate interest of the Firm or its client pursuant to Article 6(1)(f) of the GDPR.

Retention period: the retention period prescribed by the Üttv. and other applicable legislation, or the period necessary for the establishment, exercise or defence of potential legal claims.

5. Client Identification

Pursuant to the Üttv., prior to accepting an attorney-client engagement, the Firm is required to identify the client in the cases and manner prescribed by law.

Under the applicable provisions of the Üttv., the detailed rules governing client identification by attorneys-at-law are set out in Sections 32–33.

Purpose of processing: compliance with the client identification obligations prescribed by the Üttv.

Legal basis for processing: Article 6(1)(c) of the GDPR – compliance with a legal obligation to which the Firm is subject.

Personal data processed: personal data required under the Üttv. to identify the client or the person acting on behalf of the client and, where required by law, data necessary to verify such information.

Retention period: in accordance with the provisions of the Üttv. in force from time to time.

6. Customer Due Diligence for Anti-Money Laundering Purposes

In carrying out legal activities specified in the Pmt., the Firm is subject to obligations relating to customer due diligence, data verification and data retention. The Pmt. also contains specific provisions applicable to attorneys-at-law.

Personal data processed: personal identification data required under the Pmt., nationality, residential or habitual address, identification document details, and, where necessary, information relating to the beneficial owner, politically exposed person status and the transaction.

Purpose of processing: compliance with statutory obligations relating to the prevention and combating of money laundering and terrorist financing.

Legal basis for processing: Article 6(1)(c) of the GDPR and the Pmt.

Retention period: the period specified in the applicable data retention provisions of the Pmt.

7. Processing of Personal Data in Connection with Invoicing and Accounting Obligations

The Firm may process personal data for the purpose of settling and invoicing fees for services provided by the Firm and fulfilling statutory accounting obligations.

Personal data processed: name, address, tax identification number/tax number – where applicable –, and other information appearing on invoices and related accounting documents.

Purpose: issuing invoices and fulfilling bookkeeping and accounting obligations.

Legal basis: Article 6(1)(c) of the GDPR.

Retention period: the period prescribed by applicable accounting and tax legislation.

8. Cookies and Technical Data Processing on the Website

The website may use cookies and other similar technologies to ensure its proper operation.

The use of strictly necessary cookies required for the operation of the website does not require separate consent. Statistical, analytical, marketing or other cookies that are not strictly necessary for the operation of the website may only be used on the basis of the data subject’s appropriate prior consent.

The data subject may withdraw or modify their consent to non-essential cookies at any time.

9. Data Processors and Other Recipients

The Firm may engage data processors and other service providers in connection with its activities. Such parties may have access to personal data to the extent necessary for the performance of their respective services.

Such service providers may include, in particular:

providers of cloud-based or document management services used by the Firm.

the hosting provider;

the IT service provider;

the e-mail service provider;

the accounting service provider;

the service provider responsible for website maintenance;

10. Transfer of Personal Data

The Firm transfers personal data to third parties only where an appropriate legal basis exists.

Personal data may be transferred in particular for the purpose of complying with a legal obligation, performing an attorney-client engagement, fulfilling a request from the data subject, or establishing, exercising or defending legal claims.

Where personal data is transferred to a third country outside the European Economic Area, the Firm ensures that appropriate safeguards for such transfers, as specified in Chapter V of the GDPR, are in place.

11. Data Security

The Firm takes appropriate technical and organisational measures to ensure an appropriate level of security for the personal data it processes.

In particular, the Firm’s measures are designed to protect personal data against unauthorised access, alteration, disclosure, transmission, erasure, loss, destruction or damage.

In the event of a personal data breach, the Firm will investigate the circumstances of the breach and document it in accordance with the GDPR and, where the statutory conditions are met, notify the supervisory authority and inform the affected data subjects.

12. Attorney-Client Confidentiality

The Firm and persons practising as attorneys-at-law are subject to professional secrecy obligations under the Üttv.

Pursuant to Section 9 of the Üttv., attorney-client privilege covers any fact, information or data of which a person practising as an attorney-at-law becomes aware in the course of carrying out such professional activities. The detailed provisions concerning professional secrecy are set out in Sections 9–12 of the Üttv.

The Firm organises the processing of personal data and the engagement of data processors with due regard to the requirements applicable to the protection of attorney-client confidentiality.

13. Rights of Data Subjects

Subject to the conditions set out in the GDPR, data subjects have the right to:

• request information about the processing of their personal data and access to the personal data being processed;
• request the rectification of inaccurate personal data;
• request the erasure of their personal data;
• request restriction of processing;
• where the applicable conditions are met, exercise their right to data portability;
• where processing is based on legitimate interests or a public interest legal basis, object to the processing of their personal data;
• where processing is based on consent, withdraw their consent at any time, without affecting the lawfulness of processing carried out prior to the withdrawal;
• lodge a complaint with the supervisory authority;
• seek judicial remedy.

The rights of data subjects are not absolute. For example, the right to erasure does not apply to personal data where processing is necessary for compliance with a legal obligation to which the Firm is subject or for the establishment, exercise or defence of legal claims.

The Firm shall respond to a data subject’s request without undue delay and, in principle, within one month of receipt of the request.

14. Remedies

If a data subject considers that the processing of their personal data infringes applicable data protection legislation, they have the right to lodge a complaint with the supervisory authority:

National Authority for Data Protection and Freedom of Information (NAIH)

Website: www.naih.hu

The data subject is also entitled to bring proceedings before a court in accordance with the GDPR, the Infotv. and the applicable procedural rules.

15. Amendments to this Notice

The Firm reserves the right to amend this Privacy and Data Processing Notice, in particular in response to changes in its data processing activities, the technologies used, or the applicable legal framework.

The current version of this Privacy and Data Processing Notice is always available on the Firm’s website.