1. Controller and Data Protection Officer
Mihalics Law Firm (Mihalics Ügyvédi Iroda) processes personal data on the www.mihalics.hu website (the “Website”) and in connection with its related services in accordance with the EU General Data Protection Regulation (GDPR) and Hungarian law. This Privacy Policy explains what personal data we process, for what purposes, on what legal basis and for how long, who has access to it, and what rights you have.
| Controller details | |
|---|---|
| Name | Mihalics Ügyvédi Iroda (Mihalics Law Firm; the “Controller”, “we”) |
| Registered office | 1013 Budapest, Krisztina tér 3., Hungary |
| Postal address | 1277 Budapest, Pf. 59., Hungary |
| Tax number | 18131103-2-41 |
| info@mihalics.hu | |
| Phone | +36 30 902 9876 |
| Website | www.mihalics.hu |
Our Data Protection Officer is Dr. Krisztián Mihalics, who can be contacted at info@mihalics.hu or at 1277 Budapest, Pf. 59., Hungary. You may contact him directly with any questions or requests concerning data protection.
2. Legal background and definitions
In processing personal data, the Controller applies in particular the following legislation:
- Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (GDPR);
- Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.);
- Act V of 2013 on the Civil Code (Ptk.);
- Act C of 2003 on Electronic Communications (Eht.), in particular Section 155 on the use of cookies;
- Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities (Grt.);
- Act LXXVIII of 2017 on the Activities of Attorneys (Üttv.);
- Act LIII of 2017 on the Prevention and Combating of Money Laundering and Terrorist Financing (Pmt.);
- Act C of 2000 on Accounting (Sztv.) and Act CXXVII of 2007 on Value Added Tax (Áfa tv.).
The terms used in this Privacy Policy have the meaning given in Article 4 of the GDPR:
- Personal data: any information relating to an identified or identifiable natural person (data subject), such as name, e-mail address, phone number, online identifier or IP address.
- Processing: any operation performed on personal data, such as collection, recording, storage, use, disclosure and erasure.
- Controller: the person who determines the purposes and means of processing; for the purposes of this Privacy Policy, Mihalics Law Firm.
- Processor: a person who processes personal data on behalf of and on the instructions of the Controller.
- Consent: any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they signify agreement to the processing of their personal data.
- Profiling: automated processing of personal data to evaluate or predict certain personal aspects of a person (for example interests or behaviour).
- Cookie: a small data file that the Website or a third party stores on, or reads from, your device.
3. Contact, messaging and trademark application
You can contact us via the message form on the Contact page, the messaging tool available on our practice area pages, the trademark application form, and by e-mail or phone.
| Processing | Data processed | Purpose | Legal basis | Retention period |
|---|---|---|---|---|
| Contact (form, e-mail, phone) | name, e-mail address, phone number (optional), practice area, content of the message | responding to the enquiry, communication, preparing an offer | Article 6(1)(b) GDPR (steps taken prior to entering into a contract); for general enquiries Article 6(1)(f) GDPR (our legitimate interest in responding to the enquiry) | if no engagement follows: 1 year from the last contact |
| Trademark application form | type and sign of the trademark, uploaded file, goods and services, territory of protection, name, e-mail address, phone number, billing details (name, company name, address, tax number) | preparing the trademark application engagement, communication | Article 6(1)(b) GDPR | if no engagement follows: 1 year from submission |
| Performance of an engagement | data and documents necessary for the engagement, customer due diligence data | performing the legal engagement, complying with legal obligations | Article 6(1)(b) and (c) GDPR (Üttv., Pmt.) | 5 years from the termination of the engagement; where a law (in particular the Üttv. or the Pmt.) requires a longer period, for that period (8 years for customer due diligence data) |
Data submitted through the forms is stored on the Website’s hosting server and delivered as an e-mail notification to the Controller’s Google Workspace mailbox. The enquiry cannot be sent without completing the mandatory fields. The forms are protected against spam by Google reCAPTCHA (see Section 8).
Please only provide the data necessary for your enquiry. Only share special categories of data (for example health data) if essential to your matter. The content of messages is handled in accordance with attorney–client confidentiality.
If your enquiry leads to an engagement, we will also inform you about the related processing in the engagement agreement or in a separate notice.
4. Appointment booking, online payment, invoicing and online consultation
On the Website you can book an in-person or online consultation. The booking becomes final once the consultation fee has been paid online by card.
| Processing | Data processed | Purpose | Legal basis | Retention period |
|---|---|---|---|---|
| Appointment booking | name, e-mail address, phone number, type of consultation (in person or online), date and time, practice area, short description of the matter | organising the consultation, sending confirmation and reminders, handling cancellations | Article 6(1)(b) GDPR | 5 years from the consultation (the general limitation period under the Ptk.); in case of an engagement, as set out in Section 3 |
| Online payment | name, e-mail address, billing address, amount paid, transaction ID and result | payment of the consultation fee, refunds | Article 6(1)(b) GDPR | 8 years, together with the invoice |
| Invoicing | name or company name, address, tax number (for companies), e-mail address, the service and its amount | issuing and retaining the invoice | Article 6(1)(c) GDPR (Áfa tv., Section 169 Sztv.) | 8 years |
| Online consultation | name, e-mail address, technical data of the video call | conducting the consultation via Google Meet | Article 6(1)(b) GDPR | the consultation is not recorded; the invitation is kept with the calendar entry for 5 years |
Payment: card payments are processed by Stripe’s secure payment system. Card details are handled directly by Stripe; the Controller does not receive or store them. The Controller only receives the transaction ID, amount and result from Stripe. Stripe also processes payment and fraud prevention data as an independent controller under its own privacy policy: https://stripe.com/privacy
Invoicing: after successful payment, the invoice is issued and sent by e-mail through the Billingo invoicing system.
Calendar and online consultation: the booked appointment is added to the Controller’s Google Calendar. For online consultations, the Google Meet video call link is sent by e-mail. No audio or video recording is made of the consultation.
The conditions for cancelling a booking are set out on the Appointment Cancellation Terms page.
5. Newsletter
On the Website you can subscribe to our newsletter, in which we send legal news, articles and information about our services.
| Data processed | Purpose | Legal basis | Retention period |
|---|---|---|---|
| e-mail address, name provided at subscription, time of subscription, data on newsletter opens and link clicks | sending newsletters, measuring their effectiveness | your consent (Article 6(1)(a) GDPR, Section 6 Grt.) | until consent is withdrawn (unsubscription) |
Subscribing is voluntary and is not a condition of using any of our services. You can unsubscribe at any time, free of charge, using the unsubscribe link at the bottom of each newsletter or by e-mail to info@mihalics.hu. After unsubscribing, your data will no longer be used for the newsletter.
We use Mailchimp as a processor to send newsletters. Mailchimp uses pixels and trackable links in the newsletters to measure whether a newsletter has been opened and which links were clicked.
6. Cookies and similar technologies
The Website uses cookies and similar technologies. Apart from strictly necessary cookies, cookies are only placed with your prior consent.
Cookie categories and legal basis:
- Necessary cookies: essential for the Website to function (for example storing your consent choice and language setting, processing bookings and payments, protection against spam). Legal basis: the exemption under Section 155 of the Eht. and our legitimate interest (Article 6(1)(f) GDPR). These work without consent.
- Statistics cookies: used to measure visits to and use of the Website (Google Analytics). Legal basis: your consent (Article 6(1)(a) GDPR, Section 155 Eht.).
- Marketing cookies: used for ads personalisation, measuring ad effectiveness and remarketing (Google Ads), and required to load embedded content (YouTube, Google Maps). Legal basis: your consent (Article 6(1)(a) GDPR, Section 155 Eht.).
Giving and withdrawing consent: when you first visit the Website, the cookie banner lets you decide on each category. The “Accept” and “Deny” buttons are equally prominent, and “Settings” lets you choose by category. You can change or withdraw your choice at any time via the “Cookie settings” link at the bottom of every page, as easily as you gave it. Withdrawal does not affect the lawfulness of processing before withdrawal. Your choice is stored for 12 months, after which we ask again.
Records of consent: to demonstrate consent (Article 7(1) GDPR), we record the time of your choice, the categories selected and the version of the banner text shown, linked to a random identifier. Legal basis: our legal obligation (Article 6(1)(c) GDPR). Retention: 5 years from the expiry of the consent.
Main cookies used on the Website:
| Cookie | Provider | Purpose | Category | Expiry |
|---|---|---|---|---|
| cmplz_* | Controller (Complianz) | storing your cookie choice | Necessary | 365 days |
| pll_language | Controller | storing the selected language | Necessary | 1 year |
| wp_woocommerce_session_*, woocommerce_cart_hash, woocommerce_items_in_cart | Controller (WooCommerce) | processing bookings and payments | Necessary | session, or 2 days |
| __stripe_mid, __stripe_sid | Stripe | secure payment, fraud prevention | Necessary | 1 year, or 30 minutes |
| _GRECAPTCHA | Google (reCAPTCHA) | protection against spam | Necessary | 6 months |
| _ga, ga* | Google (Analytics) | statistical measurement of visits | Statistics | 2 years |
| _gcl_au, _gcl_aw | Google (Ads) | ad measurement (conversion tracking), personalisation | Marketing | 90 days |
| YSC, VISITOR_INFO1_LIVE | Google (YouTube) | playing embedded videos | Marketing | session, or 6 months |
| NID | Google (Maps) | displaying embedded maps | Marketing | 6 months |
The full and up-to-date list of cookies is available in the Cookie Policy linked in the Website footer. You can also delete or block cookies in your browser settings; if you block necessary cookies, some features of the Website (for example appointment booking) will not work properly.
7. Ads personalisation and measurement (Google)
The Website uses the Google Ads, Google Analytics and Google Tag Manager services of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”). These services only place cookies and use identifiers with your consent.
Personalisation of ads: with your consent, we and Google use cookies, mobile advertising identifiers and your IP address for personalised and non-personalised ads, to measure ad effectiveness (conversion tracking), for remarketing, and for statistical analysis of Website traffic. Ads are personalised based on your browsing habits and interests. Non-personalised ads also use cookies, for example for frequency capping, aggregated reporting and to combat fraud and abuse.
| Data processed | Purpose | Legal basis | Retention period |
|---|---|---|---|
| cookie and advertising identifiers, mobile advertising identifiers, IP address, browser and device data, pages viewed, ad click identifier, actions on the Website (form submission, clicks on phone number or e-mail address, appointment booking) | ads personalisation and delivery, conversion measurement, remarketing, statistics | your consent (Article 6(1)(a) GDPR, Section 155 Eht.) | Google Ads cookies: 90 days; Google Analytics cookies: 2 years; Google Analytics data: 14 months |
| e-mail address and phone number provided on the Website, in encrypted (hashed) form | more accurate conversion measurement (enhanced conversions) | your consent (Article 6(1)(a) GDPR) | according to Google’s data practices |
If you do not consent: the Website uses Google Consent Mode. If you deny statistics or marketing cookies, Google tags do not set cookies or read identifiers. In that case they only send limited, cookieless technical signals (for example the type and time of the event, browser type and consent status), which Google uses for aggregated, modelled measurement and which are not used to build a profile of you.
Google’s processing: Google carries out processing for advertising purposes partly as an independent controller, under its own privacy policy. You can learn how Google uses personal data on the following pages:
- Google’s Business Data Responsibility site: https://business.safety.google/privacy/
- How Google uses information from sites or apps that use its services: https://policies.google.com/technologies/partner-sites
- Google Privacy Policy: https://policies.google.com/privacy
Opting out of personalised ads: in addition to the cookie banner, you can turn off personalised ads in Google’s My Ad Center (https://myadcenter.google.com/), and block Google Analytics measurement with the Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout).
Google’s data may also be transferred to the United States (see Section 9).
8. Embedded content, spam protection and security logs
Embedded videos and maps: some pages of the Website display videos from Google’s YouTube service and Google Maps. This content only loads after you consent; until then a placeholder image is shown. When it loads, Google receives your IP address and browser data and may set cookies. Legal basis: your consent (Article 6(1)(a) GDPR, Section 155 Eht.).
Spam protection (Google reCAPTCHA): the Website’s forms are protected against spam and automated abuse by Google reCAPTCHA. For this purpose, reCAPTCHA sends your IP address, browser and device data, and data about your use of the form to Google. Legal basis: our legitimate interest in protecting the Website and our mailbox against abuse (Article 6(1)(f) GDPR). Google processes reCAPTCHA data under its own privacy policy: https://policies.google.com/privacy
Security logs: the hosting server and the Website’s security plugin automatically log visits.
| Data processed | Purpose | Legal basis | Retention period |
|---|---|---|---|
| IP address, time of visit, URL of the page viewed, browser and operating system type, failed login attempts | secure operation of the Website, detecting and preventing attacks and abuse, troubleshooting | our legitimate interest (Article 6(1)(f) GDPR) | up to 30 days; in case of a security incident, until the investigation is closed |
We have carried out a legitimate interest assessment for processing based on legitimate interest and will provide information on its outcome on request. You may object to such processing at any time (see Section 11).
9. Processors, recipients and transfers to third countries
We do not sell personal data, and we only make it available to third parties in the cases below. Processors handle personal data solely on our instructions, under a data processing agreement.
| Provider | Registered office | Activity | Role |
|---|---|---|---|
| Data Center Solutions Kft. (tax number: 25728617-2-10) | 3300 Eger, Kodály Zoltán utca 6., Hungary | hosting, storage of the Website and form data | processor |
| Kolibri Webdesign Bt. | 8000 Székesfehérvár, Malomhegyi u. 2/A, Hungary | Website maintenance and updates, management of advertising accounts | processor |
| Google Ireland Limited | Gordon House, Barrow Street, Dublin 4, Ireland | e-mail, calendar and video calls (Google Workspace, Google Meet), Google Tag Manager, reCAPTCHA | processor |
| Google Ireland Limited | Gordon House, Barrow Street, Dublin 4, Ireland | Google Ads, Google Analytics, YouTube, Google Maps (Sections 7 and 8) | processor; independent controller for advertising purposes |
| Stripe Payments Europe, Limited | 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland | online card payments, fraud prevention | independent controller |
| Billingo Technologies Zrt. (company reg. no. 01-10-140802) | 1133 Budapest, Árbóc utca 6., Hungary | issuing and delivering invoices | processor |
| The Rocket Science Group LLC (Mailchimp) | Atlanta, Georgia, United States | sending newsletters | processor |
Authorities: we disclose personal data to courts, authorities or other competent bodies where required by law or a final official decision, in compliance with the rules on attorney–client confidentiality.
Transfers to third countries: when using the services of Google, Stripe and Mailchimp, personal data may also be transferred to the United States (Google LLC, Stripe, LLC, The Rocket Science Group LLC). These companies are certified under the EU–U.S. Data Privacy Framework, so transfers are based on the European Commission’s adequacy decision of 10 July 2023 and, additionally, on the standard contractual clauses adopted by the European Commission (Article 46 GDPR). We do not transfer personal data to any other third country or international organisation.
10. Profiling, data security and personal data breaches
Profiling and automated decision-making: we do not carry out profiling ourselves, and we do not make decisions based solely on automated processing that produce legal effects concerning you. With your consent, Google’s advertising services may carry out profiling to personalise ads (Section 7). You can withdraw this consent at any time.
Data security: we protect personal data with technical and organisational measures appropriate to the risks, against unauthorised access, alteration, transmission, disclosure, erasure, destruction and damage. These include:
- the Website is accessible only via an encrypted (HTTPS) connection;
- only authorised staff and processors can access personal data, using individual, password-protected access;
- the Website’s software is updated regularly and protected by a security plugin;
- data is backed up regularly;
- staff and processors are bound by confidentiality, and we are also bound by attorney–client confidentiality.
Personal data breach: a personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. We keep a record of breaches and, where a breach poses a risk, notify the Hungarian National Authority for Data Protection and Freedom of Information within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to the rights and freedoms of data subjects, we also inform them without undue delay, unless this is not required under Article 34(3) GDPR.
11. Your rights
Under the GDPR you have the following rights:
- Access (Article 15): you may ask whether we process personal data about you and, if so, which data, for what purpose, for how long and to whom it has been disclosed; you may request a copy of your data.
- Rectification (Article 16): you may request the correction of inaccurate data and the completion of incomplete data.
- Erasure (Article 17): you may request the erasure of your data if the purpose of processing has ceased, you have withdrawn your consent, you have successfully objected, or the processing is unlawful. Erasure cannot be carried out where processing is required by law (for example accounting or attorney record-keeping rules) or is necessary for legal claims.
- Restriction of processing (Article 18): you may request that we only store your data and do not otherwise use it, for example while you contest its accuracy.
- Data portability (Article 20): you may receive the data processed by automated means on the basis of consent or contract in a machine-readable format, or request that it be transmitted to another controller.
- Objection (Article 21): you may object at any time to processing based on legitimate interest. If you object to direct marketing (for example the newsletter) and related profiling, we will no longer process your data for that purpose.
- Withdrawal of consent (Article 7(3)): you may withdraw your consent to consent-based processing at any time: for cookies via the “Cookie settings” link at the bottom of every page, and for the newsletter via the unsubscribe link. Withdrawal does not affect the lawfulness of processing before withdrawal.
- Automated decision-making (Article 22): you have the right not to be subject to a decision based solely on automated processing; we do not make such decisions.
Handling requests: you may submit your request by e-mail to info@mihalics.hu, by post to 1277 Budapest, Pf. 59., Hungary, or to our Data Protection Officer. We will respond without undue delay and in any event within 1 month of receipt. This period may be extended by a further 2 months where necessary, in which case we will inform you of the reasons within 1 month. Information and action are free of charge. We may request additional information to confirm your identity. The exercise of certain rights may be limited by law, in particular by attorney–client confidentiality; in such cases we will inform you of the reasons.
Minors: for consent-based processing (cookies, newsletter), consent from the holder of parental responsibility is required for data subjects under 16 (Article 8 GDPR). A person under 18 may engage us in accordance with the rules of the Ptk. on legal capacity, where necessary through their legal representative. If we become aware that a minor has provided personal data without authorisation, we will delete it.
12. Remedies, changes and effective date
Contact: please contact us first with any questions or complaints about data processing: Mihalics Ügyvédi Iroda, 1277 Budapest, Pf. 59., Hungary, info@mihalics.hu; Data Protection Officer: Dr. Krisztián Mihalics.
Complaint to the supervisory authority: if you believe that the processing of your personal data infringes the law, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information:
| Hungarian National Authority for Data Protection and Freedom of Information (NAIH) | |
|---|---|
| Address | 1055 Budapest, Falk Miksa utca 9-11., Hungary |
| Postal address | 1363 Budapest, Pf. 9., Hungary |
| Phone | +36 1 391 1400 |
| ugyfelszolgalat@naih.hu | |
| Website | www.naih.hu |
If you live or work in another EU member state, you may also lodge a complaint with the supervisory authority of that member state.
Judicial remedy: you may also take legal action if your rights are infringed. Such cases fall within the jurisdiction of the regional court (törvényszék); at your choice, proceedings may also be brought before the regional court competent for your place of residence or stay.
Changes to this Privacy Policy: we amend this Privacy Policy when our processing or the law changes. The current version is always available on the Website. If a change materially affects consent-based processing, we will ask for your consent again.
Effective date: this Privacy Policy is effective from 12 October 2026. In case of any discrepancy between the Hungarian and English versions, the Hungarian version prevails.