Data Processing Policy
- Data controller and its activity
The personal data of data subjects is processed by HÍD Adószakértő és Pénzügyi Tanácsadó Zrt. [HÍD Tax Advisory and Financial Consulting Co. Ltd.] (registered office: 1138 Budapest, Népfürdő Street 22. B/10; business registration number: 01-10-047364; e-mail: firstname.lastname@example.org; phone number: 06-1-700-1470; hereinafter: ‘HÍD Tax Advisory’).
HÍD Tax Advisory processes data of its customers and is, therefore, not required to report to the data protection register.
HÍD Tax Advisory provides consulting and representation services related to taxation to its customers under contract.
This policy covers processing data of natural persons.
- The purpose of data processing
HÍD Tax Advisory processes personal data for the purpose of performing its activities. Data processing under this policy may fulfil the following purposes:
– Identification of data subject, initiating and maintaining contact with data subject;
– Exploring circumstances of data subject relevant to the service;
– Provision of service, fulfilment of contract;
– Exercising rights arising from legal relationship, fulfilment of obligations;
– Fulfilment of obligations imposed by legislation.
HÍD Tax Advisory processes and uses personal data only for the purpose of providing its services.
- Legal basis of data processing
2.1. Consent of data subject
The legal basis of data processing is primarily data subject’s consent. Data subject shall give his consent by contacting HÍD Tax Advisory and initiating the procedure of HÍD Tax Advisory (Act CXIII of 2011 on the Right of Informational Self-Determination and on Freedom of Information, hereinafter: ‘Infotv.’, § 6 (6)). If data subject shall enter into contract with HÍD Tax Advisory, he gives his consent to the processing of the personal data, defined in the contract and required for the fulfilment of the contract, in accordance with Infotv. § 6 (4).
In case data subject shall not give his consent to the processing of data requested by HÍD Tax Advisory or laid down in the contract, data subject has the right to deny his consent. In the event of this, HÍD Tax Advisory may refuse to enter into contract if the lack of data renders entering into and fulfilling the contract, and providing service for data subject unfeasible.
The consent of data subject covers the processing of data disclosed by the subject, data in the documents made available, and data in the documents to which HÍD Tax Advisory gains access with the authorization of data subject.
2.2. Legislative provisions
In some cases, the legal basis of data processing is governed by provisions of law. The main provisions are the provisions laid down in section 3, Act LIII of 2017 on the Prevention and Combating of Money Laundering and Terrorist Financing (concerning data for identification, notification and registration required by the Act, hereinafter: ’Pmt.’), and § 169 of Act C of 2000 on Accounting (with regard to retaining accounting documents).
- Scope of data and procedure of data processing:
HÍD Tax Advisory shall in all cases obtain data directly from the data subject, and otherwise may also obtain personal data from public sources. If data subject shall authorize HÍD Tax Advisory to represent him before other legal entities (with special regard to authorities), during the course of the representation HÍD Tax Advisory may gain access to documents, receive copies of documents and process them.
HÍD Tax Advisory shall use the data during the course of and for the purpose of providing the services assumed.
Data processed by HÍD Tax Advisory:
– Data for the purpose of identifying and maintaining contact with the data subject. The data processed: name, place of birth, date of birth, mother’s name, place of residence, postal address, registration number of the document used for identification, e-mail address and phone number. The purpose of data processing is identifying and maintaining contact with data subject.
– Registration numbers. In case it is necessary for the provision of services, HÍD Tax Advisory shall process the tax registration number (tax number), TAJ number [social security number] and personal identity number of data subject.
– Data pertaining to the case represented. HÍD Tax Advisory shall process all data disclosed by data subject, data found in the documents made available, and data obtained by HÍD Tax Advisory with the authorization of data subject, which data pertain to the case undertaken by HÍD Tax Advisory on behalf of data subject and according to his notice.
- Definition of data processing under law
Processing of certain data is rendered mandatory by law. HÍD Tax Advisory and the client shall not enter into contract without the registration of these data.
According to Pmt. § 1 (1) subsection h) the scope of the Act covers service providers offering accounting, taxation, certified taxation expert and tax consulting services under service contract or entrepreneurial legal relationship, thus covering HÍD Tax Advisory. Consequently, HÍD Tax Advisory is obligated under Pmt. to identify the client, register the surname and first name of the natural person client, birth surname and first name, citizenship, place and date of birth, mother’s maiden name, domicile, or if not available, place of residence, number and type of identification document. The purpose of data processing is to comply with the obligation of identification and registration as specified in Pmt. The legal basis of the data processing are the provisions of Pmt. concerning data monitoring, registration and recording.
Under Act C of 2000 on Accounting 169. § (1) HÍD Tax Advisory shall retain accounting documents related to records covered by the Act (contracts, documents related to payments) for eight years.
- Data transmission, data processing
HÍD Tax Advisory shall transmit personal data to a third party only upon the clear consent of data subject, where data subject is aware of the scope and recipient of the data transmission, or if it is otherwise allowed by law.
HÍD Tax Advisory is entitled to use a data processor for the purpose of performing its activities. Data processors shall not make independent decisions; they shall proceed in accordance with the contract entered into with HÍD Tax Advisory and the instructions received. HÍD Tax Advisory shall monitor the work of data processors. Data processors shall employ further data processors only with the consent of HÍD Tax Advisory.
HÍD Tax Advisory shall disclose the list of data processors in this Policy.
- Processing of technical data and cookies
The website of HÍD Tax Advisory automatically records the IP address of the user’s computer, the start date of the visit, and in some cases depending on computer settings the browser and operating system type. The data thus recorded shall not be connected with other personal data. Data processing shall serve strictly statistical purposes.
Cookies allow the website to recognise previous visitors. Cookies assist HÍD Tax Advisory as website operator to optimise the website, namely to shape website services in alignment with user habits. Cookies are also capable of
– remembering settings so that users do not have to re-adjust them when visiting a new page,
– remembering previously entered data, so that users do not have to enter them again,
– analysing the use of the website so that the information thus acquired can be used to implement developments which ensure that the website works according to user expectations to the greatest extent, and that the user finds the required information easily, and
– monitors the effectiveness of advertisements.
In case HÍD Tax Advisory shall display various content with the employment of external web services, this may result in storing cookies which are not monitored by HÍD Tax Advisory, and as such HÍD Tax Advisory does not have influence over the type of data these websites and external domains collect. The policies of the web services provide information on these cookies.
User may set his browser so that it accepts all cookies, denies all cookies, or sends notification to user when cookies access his computer. Setting options can normally be found under ‘Options’ or ‘Settings’ in the browser.
The detailed policy on www.aboutcookies.org in English also helps with settings implemented in various browsers.
- Data security
HÍD Tax Advisory shall ensure data security, implement appropriate technical and organizational measures, and adequate procedural rules to enforce the governing provisions of the law and regulations concerning confidentiality and security of data processing.
HÍD Tax Advisory shall protect data by means of suitable measures against unauthorized access, alteration, transmission, public disclosure, deletion or destruction, as well as damage and accidental loss, and ensure that stored data cannot be rendered inaccessible due to any changes in the applied technique.
HÍD Tax Advisory shall record the processed data in accordance with the governing provisions of the law, ensuring that the data is accessible only by employees and other persons acting in the interest of HÍD Tax Advisory who need the data to allow them to perform their jobs and tasks.
In determining and implementing the measures to ensure security of processing, HÍD Tax Advisory shall proceed taking into account the latest technological developments. Where alternate data processing solutions are available, HÍD Tax Advisory shall select the one ensuring the highest level of protection of personal data, except if this would entail unreasonable hardship.
7.1. Protection of electronic records
Within the scope of its tasks related to the security of electronic records, HÍD Tax Advisory shall in particular:
– implement measures preventing unauthorized access, including the protection of software and hardware tools, and physical protection (access control, network protection);
– carry out measures that ensure the possibility of the recovery of data records, including regular backup, and the separate and safe processing of copies (mirroring, backup copy);
– ensure the protection of data records against viruses (virus protection);
– ensure the physical protection of data records and data carriers containing the data records, including protection against fire and water damage, lightning, other natural forces, and ensure the possibility of restoring damages caused by such events (archiving, fire safety).
7.2. Protection of paper-based records
In order to ensure the protection of paper-based records, HÍD Tax Advisory shall implement the appropriate measures, in particular, concerning physical and fire safety.
Employees, and other persons acting in the interest of HÍD Tax Advisory shall securely maintain and protect data carriers in their use or possession which record personal information, regardless of the means of data recording, against unauthorized access, alteration, transmission, public disclosure, deletion or destruction, as well as damage and accidental loss.
- The duration of data processing
HÍD Tax Advisory shall erase personal data, if
- a) processed unlawfully;
If data is processed unlawfully, HÍD Tax Advisory shall erase data in all cases, without any specific request.
- b) requested by data subject (save where processing is based on authorization conferred by law);
If data subject shall request the erasure of data, it shall be examined whether processing of data is based on authorization conferred by law. Where authorization is conferred by law, HÍD Tax Advisory may refuse to erase data (in case processing is rendered mandatory, shall refuse). Where authorization is not conferred by law, HÍD Tax Advisory shall erase data, and inform data subject thereof. In case the request for erasure is refused, HÍD Tax Advisory shall in all cases inform data subject thereof, indicating the legal basis for the refusal of the request for erasure and the remedies available.
- c) data is incomplete or inaccurate, and cannot be lawfully rectified, provided that erasure is not disallowed by statutory provision of an act;
If it is established that the data is incomplete or inaccurate, and cannot be lawfully rectified, it shall be examined whether erasure is disallowed by statutory provision of an act. If this is not the case, data shall be erased without any specific request.
- d) the purpose of processing no longer exists or the legal time limit for storage has expired;
The legal time limit for storage of data processed by HÍD Tax Advisory is specified in provisions of law:
– Data specified in Pmt. shall be erased by HÍD Tax Advisory after eight years as laid down in Pmt. § 56;
– Under Act C of 2000 on Accounting, all documents and data classified as accounting documents shall be erased by HÍD Tax Advisory after eight years.
HÍD Tax Advisory’s data processing is continuous, therefore, in case HÍD Tax Advisory and data subject entered into service contract, data shall not be erased for the reason that the data and documents may be used in later proceedings, possibly over the limitation period. Even if this applies, data shall be erased in cases specified in subsections a)-c) and e) of this section.
Erasure specified in this section shall in all cases be examined to determine if processing is rendered mandatory by an act. If this is the case, data shall not be erased.
- e) so ordered by court or by the Hungarian National Authority for Data Protection and Freedom of Information
If erasure was ordered by court or by the Authority, and the decision is final, and HÍD Tax Advisory shall erase the data.
HÍD Tax Advisory shall block personal data instead of erasing it and shall inform data subject thereof, if so requested by data subject, or if based on the information available there are reasonable grounds to believe that erasure could affect the legitimate interests of data subject. Blocked data recorded shall be processed only for the purpose which prevented erasure. If the accuracy of an item of personal data is contested by the data subject and its inaccuracy cannot be ascertained beyond doubt, HÍD Tax Advisory shall mark that personal data for the purpose of referencing.
Erasure of data where processing is rendered mandatory by an act shall be governed by the provisions of the act.
Upon erasure HÍD Tax Advisory shall make data anonymous. Where law stipulates, HÍD Tax Advisory shall destroy data carrier recording the personal data.
- Rights of data subjects; enforcement
Upon initiating contact with data subject, HÍD Tax Advisory shall provide data subject with information concerning data processing. Besides this, data subject is entitled to request information on data processing at any time.
Upon data subject’s request, HÍD Tax Advisory shall provide information concerning data relating to him, including those processed by it and those processed by a data processor on its behalf and according to his notice; the sources from where data was obtained; the purpose, grounds and duration of processing, the name and address of data processor, and on its activities relating to data processing; and if the personal data of data subject is transmitted, the legal basis for transmission and the recipient. HÍD Tax Advisory must comply with requests for information without delay, and provide the information requested in an intelligible form and in writing at data subject’s request, within not more than twenty-five days. The information shall be provided upon data subject’s request free of charge for any category of data once a year. Additional information concerning the same category of data may be subject to charge. If data was processed unlawfully, or the request for information led to rectification, any charges already paid shall be refunded.
Data subject may request from HÍD Tax Advisory the rectification of his persona data. In case the data which is subject to rectification has been transmitted, HÍD Tax Advisory shall inform the recipient of the transmission about the rectification if necessary, as well as inform data subject that he shall also request rectification from the other data controller.
Data subject may request the erasure of his personal data, save where processing is rendered mandatory by law. HÍD Tax Advisory shall inform data subject of the erasure.
Data subject has the right to object to the processing of his personal data as laid down in Infotv.
Data subject may request information, rectification and erasure in writing by means of a letter addressed to the registered office or place of business of HÍD Tax Advisory.
If HÍD Tax Advisory refuses to comply with data subject’s request for rectification, blocking or erasure, the reason on which the decision for refusing the request for rectification, blocking or erasure is based shall be communicated in writing within twenty-five days of the receipt of the request. Where rectification, blocking or erasure is refused, HÍD Tax Advisory shall inform data subject of the possibilities for seeking judicial remedy or lodging a complaint with the Hungarian National Authority for Data Protection and Freedom of Information.
Data subject may make the above declaration related to exercising his rights at HÍD Tax Advisory’s official contacts set out in section 1.
Data subject may also lodge a complaint directly with the Hungarian National Authority for Data Protection and Freedom of Information (address: 1125 Budapest, Szilágyi Erzsébet fasor 22/c.; phone number: +36-1-391-1400; e-mail: email@example.com; website: www.naih.hu). In the event of any infringement of his rights, data subject may turn to court action in accordance with Infotv. § 22 (1). The court has jurisdiction to decide the case. If so requested by data subject, the action may be brought before the tribunal in whose jurisdiction the data subject’s domicile or place of residence is located. Upon request HÍD Tax Advisory shall inform data subject in detail of the possibilities for and the means of judicial remedy.