Privacy notice

Effective date: 31 August 2025

This Privacy Notice explains how I collect and use personal data on the English-language immigration landing page of drsanta.hu.

1) Who is the controller?

Szabolcs Miklós Sánta, attorney-at-law
Member of the Budapest Bar Association
Email: drsanta@drsanta.hu | Phone: +36 70 547 3505
Office: Budapest, Hungary

No data protection officer has been appointed.

2) What data do I collect?

• Contact/Case data you provide: name, email, nationality, current status in Hungary, target permit, deadline/urgency, free-text description, and any files you upload (e.g., passports, decisions, contracts).
• Technical data: IP address, device/browser info, and basic analytics/cookie data (see Section 7).

3) Where do the data come from?

Primarily from you (contact form, email, booking). In some cases, from publicly available sources or other parties with your knowledge (e.g., employers for employment permits) where this is necessary.

4) For what purposes and on what legal bases do I use your data?

• Assessing and responding to your inquiry; pre-contract steps (GDPR Art. 6(1)(b)).
• Providing legal services and client administration once engaged (GDPR Art. 6(1)(b)).
• Legal obligations (e.g., accounting, anti-money-laundering/know-your-client rules) (GDPR Art. 6(1)(c); Hungarian law).
• Legitimate interests (communication, practice management, defending legal claims, IT security) (GDPR Art. 6(1)(f)).
• Consent, where required (e.g., optional marketing or non-essential cookies) (GDPR Art. 6(1)(a)). You can withdraw consent at any time.

5) Special categories of data

The documents you upload may contain special category data (e.g., health data, biometric or ethnicity information visible on documents).

• If representation is underway or contemplated (including case evaluation), I may process such data for the establishment, exercise or defence of legal claims (GDPR Art. 9(2)(f)).

6) Appeals and litigation data

For administrative appeals and court actions (including EUPR/NPR cases), I process the data necessary to bring or defend claims (GDPR Art. 6(1)(b)/(f); Art. 9(2)(f) for special categories).

7) Cookies and analytics

The site uses essential cookies for basic functionality and may use analytics (e.g., GA4) and embedded tools (e.g., scheduling widgets) that set cookies.

• Non-essential cookies run only with your consent via the cookie banner.
• You can change or withdraw cookie consent at any time in the banner settings.

8) Who receives your data?

I share data only as necessary and with appropriate safeguards:

• IT/service providers (website hosting, WordPress form provider, email/calendar, document storage, analytics).
• Professional partners (e.g., substitute counsel) only with necessity and confidentiality.
• Authorities and courts, if required by law or in the course of your matter.
  All vendors act as processors or independent controllers depending on their role.

9) International transfers

Where services operate outside the EEA (or use non-EEA infrastructure), transfers are protected by adequacy decisions or Standard Contractual Clauses plus supplementary measures as needed.

10) How long do I keep your data?

• Initial inquiries (no engagement): typically 12 months from last contact.
• Client files: for the period required by professional and legal rules (generally 5–10 years after closure);
• Accounting/AML records: as required by Hungarian law (often 8 years).
  I delete or anonymise data after the applicable retention period.

11) Security

I apply administrative, technical, and physical safeguards appropriate for legal practice, including access controls, encryption, and secure storage. Access is restricted to those who need it to perform their tasks.

12) Your rights

Subject to legal limitations, you have the right to access, rectification, erasure, restriction, portability, and objection, and to withdraw consent where processing is based on consent. To exercise rights, contact drsanta@drsanta.hu.

13) Complaints

You can lodge a complaint with the Hungarian data protection authority (NAIH). You also have the right to seek a judicial remedy.

14) Children

This site and my services are intended for adults. I do not knowingly collect children’s data via the landing page.

15) Do you have to provide data?

You do not have to provide personal data, but without certain information I may be unable to assess your case or provide services.

16) Changes to this notice

I may update this notice from time to time. The “Effective date” shows when it was last revised.