1. The controller
| Controller | Dr. János Kopasz, attorney-at-law (egyéni ügyvéd) |
|---|---|
| Office | 1051 Budapest, Dorottya utca 1., Hungary |
| Bar membership | Budapest Bar Association (Budapesti Ügyvédi Kamara), bar registration number (KASZ): 36063531 |
| E-mail (also for privacy requests) | janos.kopasz@drkj.hu |
| Website | drkj.hu |
| Data protection officer | not required under Article 37 GDPR and none appointed; for any privacy question I am reachable directly at the e-mail address above |
2. Who and what this notice covers
This notice applies to visitors of drkj.hu, to anyone who writes to janos.kopasz@drkj.hu, and to anyone who books a thirty-minute AI coffee through the Google Calendar appointment page linked from this site ("Legal insights over coffee") and holds the meeting in person or over a Microsoft Teams call.
drkj.hu is the personal professional site of a practising attorney. Reading the site, an e-mail or the AI coffee does not create an attorney-client relationship. If a conversation turns into a mandate, the engagement and the related processing are governed by Act LXXVIII of 2017 on Attorney Activity (Üttv.) and by the privacy notice of the law firm handling the mandate, not by this document.
The notice concerns the data of natural persons. If a person booking or writing provides another person's data (a colleague, a client), section 6 applies.
3. What this site does not do
drkj.hu sets no cookies, runs no analytics or tracking, embeds no third-party fonts, scripts or social widgets, and has no newsletter or contact form. Photographs and graphics are served from the site's own host. That is why there is no cookie banner: there is nothing to consent to.
The AI coffee is not booked on drkj.hu but on Google's own page (calendar.google.com). Google's privacy policy and cookie practices apply to that page; section 4.3 explains what happens to the data you enter there.
4. The processing operations
The table below shows, purpose by purpose, which data I process, on which legal basis and for how long. The notes under the table cover the data that must be provided and the providers' own processing.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| 4.1 Serving the website and keeping it secure | Technical log data: IP address, requested page, timestamp, browser identifier (user agent). | Article 6(1)(f) GDPR: legitimate interest (delivering the site, defending it against abuse and attacks). | Short, in line with the hosting provider's (Vercel) standard log retention. |
| 4.2 E-mail contact | The sender's e-mail address, name (if given), the content and attachments of the message, the dates of the exchange. | Article 6(1)(f) GDPR: legitimate interest (replying to people who write to me, keeping the correspondence traceable). | At most twelve months after the last exchange; where a legal claim has to be established, exercised or defended, until it is closed. |
| 4.3 Booking and holding the AI coffee | Name, e-mail address, the slot booked, the note written when booking (if any), the form of the meeting (in person or Teams), for Teams calls the technical data of the call (join time, display name). The information you share during the meeting and the short note I take of it. | Article 6(1)(b) GDPR: steps taken at your request to arrange and hold the meeting and to prepare a possible later cooperation. | At most twelve months from the meeting, or from the cancellation if cancelled. If the conversation turns into a mandate, the data belonging to the mandate follow the notice of the law firm handling it and the retention rules of the Üttv. |
| 4.4 Follow-up after the meeting | Name, e-mail address, organisation and role (if given), the date and topic of the meeting, the next step agreed. | Article 6(1)(f) GDPR: legitimate interest (delivering the next step agreed at the meeting, sending the material promised, keeping the professional relationship alive). I have carried out the balancing test; a summary is available on request. | At most twelve months from the meeting, or until you object if that is earlier. |
4.1 Logging is performed by the hosting provider in the course of providing the service; I do not use it for profiling.
4.2 Please do not send confidential or case-specific information to this address; that belongs within an attorney mandate.
4.3 Name and e-mail address are required to book; without them no slot can be booked. The note field is optional. The booking runs through Google Calendar's appointment scheduling; on the booking page Google also processes data as a controller in its own right (for example the reCAPTCHA bot check and security logging) under its own privacy policy.
4.4 Follow-up means a personal message tied to the meeting. I send no newsletter, and no direct-marketing e-mail without your separate prior consent (section 6 of Act XLVIII of 2008 on commercial advertising). You may object to the follow-up at any time, in which case I delete the record.
5. Recipients and providers
I do not sell data and do not pass it on for marketing. The recipients are the following.
- Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland): the Google Calendar appointment scheduling, the booking notification and the calendar entry (Gmail, Google Calendar), and the follow-up record (Google Sheets). Google provides the service under its terms of service and privacy policy; in operating the booking page Google also acts as a controller in its own right.
- Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland): Microsoft 365, including Exchange Online mail (janos.kopasz@drkj.hu) and Microsoft Teams video calls, under Microsoft's EU Data Boundary commitments.
- Vercel Inc. (440 N Barranca Avenue #4133, Covina, CA 91723, United States): hosting of the site and the technical logs.
- Authorities and courts: only where the law obliges me, and within its limits.
The providers access data stored in their systems under the security and confidentiality terms they have undertaken; nobody but me has access to the accounts.
6. Other people's data
If, when booking or writing, you provide another person's data (for example a colleague joining the meeting), I process their data for the same purposes, on the same basis and for the same period; in that case the source of the data is you. Please provide only the data of people you have told about this, and share this notice with them. They can exercise the rights in section 8 directly with me.
7. Transfers outside the European Economic Area
In the operation of the Google and Vercel services, data may also be transferred to the United States. Google LLC and Vercel Inc. are certified participants in the EU-U.S. Data Privacy Framework, covered by the European Commission's adequacy decision (EU) 2023/1795; Google additionally applies the standard contractual clauses adopted by the European Commission. Microsoft stores mail and Teams data within the European Union under its EU Data Boundary commitments; for the limited cases outside it, Microsoft relies on its Data Privacy Framework certification and on the standard contractual clauses. The certifications can be checked at dataprivacyframework.gov; a copy of the safeguards is available on request.
8. Your rights
The full set of GDPR rights applies:
- access (Article 15): you may ask whether I process your data and obtain a copy;
- rectification (Article 16): you may have inaccurate data corrected and incomplete data completed;
- erasure (Article 17): you may ask for your data to be deleted, in particular once the purpose has ended or after you have objected;
- restriction of processing (Article 18);
- data portability (Article 20): the data you provided under section 4.3 in a structured, machine-readable format;
- objection (Article 21): to the processing based on legitimate interest (sections 4.1, 4.2 and 4.4) on grounds relating to your particular situation at any time, and to the follow-up without giving reasons. I then delete the data unless compelling legitimate grounds exist or the data are needed for a legal claim.
No processing is based on consent, so there is no consent to withdraw. I carry out no automated decision-making or profiling (Article 22).
You can exercise your rights by writing to janos.kopasz@drkj.hu. I reply without undue delay and at the latest within one month; where a request is complex, that period may be extended by up to two further months, of which I will inform you together with the reason. Acting on a request is free of charge. Where the identity of the requester is in doubt, I may ask for confirmation, requesting no more data than necessary.
9. Complaints and remedies
If you consider that the processing infringes the GDPR, you may lodge a complaint with the supervisory authority: Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9-11.; postal address: 1363 Budapest, Pf. 9.; telephone: +36 (1) 391 1400; e-mail: ugyfelszolgalat@naih.hu; website: naih.hu. Under Article 77 GDPR the complaint may also be lodged with the supervisory authority of the Member State of your habitual residence, place of work or the place of the alleged infringement.
You may also bring proceedings before a court (Article 79 GDPR). Under section 23 of Act CXII of 2011 on informational self-determination and freedom of information, the action falls within the competence of the regional courts (törvényszék) and may, at your choice, be brought before the regional court of your place of residence or stay.
I would be glad if you raised any concern with me first: most questions can be settled in one exchange of e-mails.
10. Security
I protect the data with technical and organisational measures proportionate to the risk: only I have access to the accounts, with strong authentication; the connections to the site and to the providers are encrypted (TLS); the providers store the data under their own certified security programmes; when the retention period ends, I delete the data. I keep a paper note of a meeting only until it is recorded, then destroy it.
11. Changes to this notice
If I introduce any new processing (analytics, a newsletter), this notice changes first, and the footer of the site can no longer claim that there is no tracking. Changes are announced on the site and, where material, by e-mail to people who have booked.
Versions: 1.0 (20 July 2026): the site's short English privacy note. 2.0 (6 September 2026): full notice under Articles 13 and 14 GDPR in Hungarian and English; new sections on the AI coffee booking, the meeting and the follow-up.