Effective as of: 1 January 2026
This Privacy Notice contains all relevant data processing information in connection with the services available on the website of Dr. Klesics and Dr. Tuller Law Firm (https://tullerlaw.hu/) (hereinafter: the Website), contact requests, and the performance of attorney mandates. When preparing this Notice, the Data Controller acted in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: the “GDPR”) and Act CXII of 2011 on Informational Self-Determination and Freedom of Information (hereinafter: the “Info Act”).
The Data Controller is committed to the protection of personal data, handles personal data confidentially, and takes all necessary security, technical and organisational measures to guarantee the protection and security of personal data.
The Data Controller reserves the right to amend this Privacy Notice unilaterally at any time, provided that the data subjects are notified of any changes in due time.
I. Details and contact information of the Data Controller
Name: Dr. Klesics and Dr. Tuller Law Firm
Registered office: 2000 Szentendre, Egres köz 3.
Postal address: 1055 Budapest, Balassi Bálint utca 25. Ground floor 5.
Tax number: 12347427-2-13
Name of registering authority: Pest County Bar Association
Representative: Dr. Gábor Richárd Tuller
Telephone number: +36 1 311 3135
E-mail address: info@tullerlaw.hu
Website: https://tullerlaw.hu/
II. Details of the hosting provider (Processor)
Company name: Rackhost Zrt.
Registered office: 6722 Szeged, Tisza Lajos körút 41.
Website: https://www.rackhost.hu/
E-mail address: info@rackhost.hu
III. Information on the use of cookies
What is a cookie?
During visits to the Website, the Data Controller uses so-called cookies. A cookie is an information package consisting of letters and numbers that our website sends to your browser in order to save certain settings, facilitate the use of our website, and help us collect certain relevant statistical information about our visitors.
Some cookies do not contain personal information and are not suitable for identifying individual users; however, some cookies contain a unique identifier — a secret, randomly generated number sequence — which is stored on your device and thereby also enables your identification.
Legal basis for use: In the case of cookies necessary for the operation of the Website, the legal basis for data processing is the legitimate interest of the Data Controller [Article 6(1)(f) of the GDPR]. In the case of cookies used for statistical and marketing purposes, the legal basis for data processing is the consent of the data subject [Article 6(1)(a) of the GDPR].
IV. Responding to client enquiries
Purpose of data processing: Handling and responding to legal or other enquiries and requests for quotations submitted through the Website or via the provided contact details.
Scope of personal data processed: Information included in or related to the enquiry that qualifies as personal data, such as name, e-mail address, telephone number, and description of the matter.
Legal basis for data processing: Depending on the content of the enquiry, the legal basis for processing personal data submitted through the Website or via the contact details is taking steps at the request of the data subject prior to entering into a contract [Article 6(1)(b) of the GDPR], or — if the enquiry is not of such preparatory nature — the legitimate interest of the Data Controller in handling and responding to the contact request [Article 6(1)(f) of the GDPR].
Persons authorised to access the data: Authorised employees of the Data Controller involved in processing the enquiry, to the extent strictly necessary for the performance of their tasks.
Recipients of the personal data: The Processor, which stores the personal data under a contract concluded with the Data Controller but is not entitled to access the personal data.
Duration of data processing: Personal data processed in connection with an enquiry is retained for 5 years from the closure of the enquiry, or, if a legal dispute or legal claim arises in the given matter, until the final conclusion of the legal dispute.
V. Data processing for the purpose of performing attorney mandates
Purpose of data processing: Performance of attorney mandate agreements concluded with clients, provision of legal representation, and ensuring related communication.
Scope of personal data processed: Identification data and contact details provided by the client, such as name, residential address, telephone number and e-mail address, as well as data required for the performance of the specific legal matter and forming part of the details of the mandate.
Legal basis for data processing: Performance of the contract concluded between the parties [Article 6(1)(b) of the GDPR].
Persons authorised to access the data: Authorised employees of the Data Controller involved in case management, to the extent strictly necessary for the performance of their tasks.
Recipients of the personal data: The Processor, which provides the IT background and stores the data under a contract concluded with the Data Controller.
Duration of data processing: The data is retained for the mandatory retention period prescribed by the laws governing attorney activities, but at least for the civil law limitation period, i.e. for 5 years from the termination of the mandate.
VI. Data processing for the purpose of issuing invoices
Purpose of data processing: The data processing is carried out for the purpose of issuing invoices in accordance with the law and fulfilling the obligation to retain accounting records. Pursuant to Section 169(1)–(2) of Act C of 2000 on Accounting (hereinafter: the Accounting Act), business entities are required to retain accounting documents directly and indirectly supporting bookkeeping records.
Scope of personal data processed: Name, address, and other billing information contained in the invoice.
Legal basis for data processing: Pursuant to Section 159(1) of Act CXXVII of 2007 on Value Added Tax, issuing an invoice is mandatory, and pursuant to Section 169(2) of the Accounting Act, invoices must be retained for 8 years [data processing under Article 6(1)(c) of the GDPR].
Persons authorised to access the data: Authorised employees of the Data Controller, to the extent necessary for the performance of their tasks.
Recipients of the personal data: The personal data may be transferred to the tax authority and to the accountant of the Data Controller.
Duration of data processing: Issued invoices must be retained for 8 years from the date of issue pursuant to Section 169(2) of the Accounting Act.
VII. Data processing for debt collection purposes
Scope of personal data processed: Name, address, e-mail address, telephone number, and data necessary to identify the claim.
Legal basis for data processing: The legal basis for processing personal data related to debt collection is the legitimate interest of the Data Controller in enforcing and managing the claim [Article 6(1)(f) of the GDPR].
Persons authorised to access the data: Authorised employees of the Data Controller involved in debt collection.
Recipients of the personal data: If necessary, the data may be transferred to the legal representative of the Data Controller or to an external debt collection partner.
Duration of data processing: Personal data processed during debt collection is retained until the debt is settled, or, in the event of a legal dispute, until the final conclusion of the legal dispute, but no longer than the expiry of the applicable civil law limitation period.
VIII. Rights of the data subject during data processing
Pursuant to the provisions of Chapter III of the GDPR (“Rights of the data subject”), you, as the data subject, have the following rights:
- Right to transparent information — you may request information about the processing of your personal data at any time;
Upon your request, we will take appropriate measures to provide you with all information referred to in Articles 13 and 14 of the GDPR concerning the processing of your personal data, as well as all communications under Articles 15–22 and 34, in a concise, transparent, intelligible and easily accessible form, using clear and plain language.
We will inform you without undue delay, and in any event within one month of receipt of the request, of the action taken on your request under Articles 15–22. Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months.
The information under Articles 13 and 14 and the communications and actions under Articles 15–22 and 34 are provided free of charge. If your request is manifestly unfounded or excessive, in particular because of its repetitive nature, we may charge a reasonable fee taking into account the administrative costs of providing the requested information or communication or taking the requested action, or we may refuse to act on the request.
- Right of access to your personal data — you may access the personal data processed by us and the details of processing at any time;
This right essentially means that you may obtain information on what data we process about you, why and how. You have the right to obtain confirmation from us as to whether your personal data is being processed, and where such processing is taking place, you have the right to access the personal data itself and essential information concerning its processing. Such information includes, among others, the purposes of processing, the categories of data concerned, the planned period for which the personal data will be stored, and your rights.
Where personal data is transferred to a third country or an international organisation, the data subject has the right to be informed of the appropriate safeguards relating to the transfer.
You are also entitled to receive a copy of the personal data undergoing processing. The first copy is provided free of charge; for further copies, we may charge a reasonable fee based on our administrative costs if justified by the scope of the data request. If you have submitted the request electronically, you have the right to receive the information in a commonly used electronic format, such as PDF or Word document.
The right to information may primarily be exercised in writing, including electronically, through the contact details of the Data Controller indicated above, and will be fulfilled after credible proof and verification of the identity of the data subject.
- Right to rectification of your personal data — if we process your personal data inaccurately, please notify us and we will correct it;
You have the right to request that we rectify inaccurate personal data concerning you without undue delay. Where necessary, you may also request the completion of incomplete personal data.
- Right to withdraw consent
If the data processing in question is based on your consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of data processing based on consent before its withdrawal.
- Right to erasure of personal data (“right to be forgotten”)
You have the right to request that we erase personal data concerning you without undue delay where one of the following grounds applies:
- the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
- you withdraw the consent on which the processing is based and there is no other legal basis for the processing;
- you object to the processing and there are no overriding legitimate grounds for the processing;
- the personal data has been unlawfully processed;
- the personal data must be erased for compliance with a legal obligation under Union or Member State law applicable to the Data Controller;
- the personal data was collected in relation to the offer of information society services.
The above rules on erasure do not apply if processing is necessary:
- for exercising the right of freedom of expression and information;
- for compliance with a legal obligation requiring the processing of personal data under Union or Member State law applicable to the Data Controller, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller;
- for reasons of public interest in the area of public health, or for archiving purposes, scientific or historical research purposes or statistical purposes based on public interest; or
- for the establishment, exercise or defence of legal claims.
- Right to restriction of processing
You have the right to request that we restrict data processing. This means that restricted data may only be stored, and may otherwise be processed only with your consent or in certain cases specified by law. Upon your request, we will restrict processing if one of the following conditions is met:
- you contest the accuracy of the personal data, in which case the restriction applies for a period enabling verification of the accuracy of the personal data;
- the processing is unlawful and you oppose the erasure of the data and request the restriction of its use instead;
- we no longer need the personal data for the purposes of processing, but you require it for the establishment, exercise or defence of legal claims; or
- you have objected to the processing, in which case the restriction applies for the period until it is established whether the legitimate grounds of the Data Controller override those of the data subject.
Where processing has been restricted, such personal data may, except for storage, be processed only with the consent of the data subject, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.
The Data Controller will inform the data subject in advance of lifting the restriction of processing.
- Right to data portability, only with respect to data processed on the basis of consent or contract and in the case of automated processing
If the data processing in question is based on your consent or is related to the performance of a contract concluded or to be concluded with you, and the processing is carried out by automated means, you have the right to receive the data from us in a structured, commonly used and machine-readable format, such as PDF or Word, and to transmit those data to another controller. You also have the right to request, where technically feasible, the direct transmission of personal data between controllers. Exercising this right must not adversely affect the right to be forgotten. This right must not adversely affect the rights and freedoms of others.
- Right to object
The data subject has the right to object, on grounds relating to his or her particular situation, at any time to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller, or for the purposes of the legitimate interests pursued by the Data Controller or by a third party, including profiling based on those provisions. In the event of an objection, the Data Controller may no longer process the personal data unless processing is justified by compelling legitimate grounds which override the interests, rights and freedoms of the data subject, or which are related to the establishment, exercise or defence of legal claims.
Where personal data is processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning him or her for such purposes, including profiling to the extent that it is related to such direct marketing. If the data subject objects to processing for direct marketing purposes, the personal data may no longer be processed for such purposes.
- Automated individual decision-making, including profiling
You have the right not to be subject to a decision based solely on automated processing — including profiling — which would produce legal effects concerning you or similarly significantly affect you.
The above right does not apply if the processing:
- is necessary for entering into or performing a contract between you and the Data Controller;
- is authorised by Union or Member State law applicable to the Data Controller, which also lays down suitable measures to safeguard the rights and freedoms and legitimate interests of the data subject; or
- is based on your explicit consent.
- Right to legal remedy
If you believe that the processing of personal data violates the GDPR or other data protection legislation, we recommend that you first contact us so that we can respond to your position as quickly and effectively as possible.
If you do not wish to contact us, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information in the event of a violation. The contact details of the Authority are:
Registered office: HU-1055 Budapest, Falk Miksa utca 9-11.
Website: www.naih.hu
Telephone number: +36 1 391 1400
E-mail: ugyfelszolgalat@naih.hu
Right to turn to court:
In the event of a violation of your rights, you may also bring proceedings against the Data Controller before a court, at your choice, either before the court competent according to the registered office of the defendant or according to your place of residence. Proceedings concerning the protection of personal data are exempt from court fees. The competent regional court will act out of turn in the matter. According to the registered office of the Data Controller, the Budapest-Capital Regional Court has jurisdiction over the proceedings.