Privacy Statement

View this page in: Hungarian

General information on our data processing activities

PricewaterhouseCoopers Hungary Ltd. (registered office: Bajcsy-Zsilinszky út 78., 1055 Budapest, Hungary, entered in the company register by the Budapest Metropolitan Court as court of registry under Cg. 01-09-063022),

PricewaterhouseCoopers Auditing Ltd. (registered office: Bajcsy-Zsilinszky út 78., 1055 Budapest, Hungary, entered in the company register by the Budapest-Metropolitan Court as court of registry under Cg. 01-09-961102), and

(hereinafter “PwC”, “we”, “us” or “our”) have prepared and updated this privacy statement to comply with the obligation to provide information on our data processing.

We divided the privacy statement into chapters, from which you can choose below depending on which of our data processing practices you would like to read in more detail.

Introduction

Personal data is any information relating to an identified or identifiable individual (“data subject”).

PwC is strongly committed to protecting and lawfully processing personal data. This privacy statement, in accordance with the provisions of the GDPR[1] and relevant Hungarian sectoral legislation, in particular Act CXII of 2011 on the Right of Informational Self-Determination and the Freedom of Information, describes for what purpose, on what legal grounds, and how we process personal data, and provides information about the rights of individuals in connection with such processing, and any other circumstances relevant to the data processing.

In all cases, our data processing will comply with the following principles:

We will use the personal data for a genuine, legitimate and lawful purpose or purposes specified in this privacy statement or other information provided at the time of collection. We may use the personal data provided to us solely for the purposes stated at the point of collection, or as obvious from the context of the collection and as reasonably expected by the data subject.
We process the data lawfully and fairly and in a way that is transparent to the data subject.
We will only process data that are strictly necessary for the purposes for which they are processed.
We ensure that the data we process are accurate and up to date and we will take all reasonable steps to ensure that inaccurate data are promptly deleted or rectified. We ask for your cooperation in this regard, as in some cases, such as a change in data, we can only ensure that the data is up to date if you notify us of the changes.
We store the data in a form which allows the identification of the data subjects only for the time necessary to achieve the purposes for which the data are processed.
In accordance with the principles of integrity and confidentiality, we will process the data in a way that ensures adequate security of personal data by using appropriate technical or organisational measures.

Given its activity, PwC processes personal data for numerous purposes, and certain characteristics of the processing, such as the means of collection, the lawful basis of processing, and the retention periods may differ for each purpose. In any case, we will provide prior information on these aspects.

We have robust organisational and IT measures in place to keep the data we process secure. We adhere to internationally recognised security standards, and our information security management system relating to client data is independently certified as complying with the requirements of ISO/IEC 27001:2013. We have a framework of policies, procedures and training in place covering data protection, confidentiality, and data security, and we ensure that our staff continuously improve their privacy awareness through regular data protection training.

We consult other member firms in the PricewaterhouseCoopers network in order to improve the efficiency of our internal privacy and data security procedures, and to bring them into line with the applicable regulations.

We regularly review our internal processes, data processing practices and related documentation.

We also have a Data Protection Officer who monitors the lawfulness of data processing, and serves as a point of contact for data subjects, and for the Hungarian National Authority for Data Protection and Freedom of Information (“NAIH”).

Data Protection Officer:

Name: dr. Orsolya Hosszú, attorney-at-law, lawyer specialized in data privacy and data security.

Email: hu_dataprotection@pwc.com

Phone: +36 1 461 9100

When processing personal data, our policy is to be transparent. In order to make clear distinction between the data processing activities, this privacy statement contains the related information per processing purpose.

To find out more about our specific processing activities, please see the relevant chapters of this statement.

[1] Regulation (EU) 2016/678 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

PwC's Academy
Business contacts
Individuals associated with our corporate clients
Private Individual clients
Individuals using our applications
Individuals whose personal data we obtain in connection with providing services
Others who get in touch with us
Job applicants
Alumni Programme
Suppliers and subcontractors, including individuals associated with them
Visitors to our offices
Visitors to PwC events (notwithstanding PwC’s Academy events)
Visitors to our website
Cookies and IP addresses
Newsletter registrants, recipients of direct marketing communications

PwC's Academy

In relation to the provision of the training services of PwC’s Academy, we may process the personal data of private individual clients or individuals associated with our corporate clients (typically individuals registered for training by a corporate client).

Training organised within the scope of the Adult Education Act

Pursuant to Section 21 (1) of Act LXXVII of 2013 on Adult Education (“Adult Education Act”), and – if applicable - Annex 11 to Government Decree 93/2002 (V. 5.) on the Registration of Accounting Service Providers, we are required to process the following information in respect of data subjects participating in trainings organised by PwC’s Academy within the scope of the Adult Education Act (e.g. state-funded training, or any additional type of training for which PwC has obtained an adult education licence):

the personal identification data and educational identification number of the participant;
email address;
training-related data that concern the participants’ highest level of education, qualifications and foreign language skills, the fact of starting and completing the training or leaving the training without completion, assessment and qualification during training, training-related payment obligations and any training loans utilised;
in the case of the compulsory professional training of accounting service providers, the name and registration number of the person required to complete the training, in the case of those not having such a registration number, the birth name, place and time of birth and mother’s birth name.

In addition to the above, the telephone number provided by the participant during the application process will be used for contact purposes in order to ensure the successful completion of the training.

Training not covered by the Adult Education Act

Some of our training courses are not covered by the above legislation, however, depending on the subject matter of the training, we may need to process the above data in order to successfully organise the training.

Use of personal data

We use the personal data for the following purposes:

organization of training courses and related exams;
issuing certificates of completion of the services provided;
meeting our legal data retention obligations;
exercising any legal claims related to the training.

In addition, please note that PwC provides data to the Adult Education Data System pursuant to Section 15 of the Adult Education Act. By registering for the training, the participant acknowledges that when his/her personal data is transferred to the Adult Education Data System under the Adult Education Act, the participant's identification data will be compared against the data contained in the register pursuant to Act LXVI of 1992 on the Registration of Personal Data and Address of Citizens.

Legal grounds

The legal grounds for our data processing are as follows:

in respect of the mandatory reporting requirements described above, to comply with the legal obligations to which we are subject;
in absence of a legal obligation, in the case of private individual clients the performance of our training agreement concluded with them as data subjects, and in the case of individuals registered for the training by our corporate clients, our legitimate interest related to performing our agreement concluded with our client.

Data retention

We retain the personal data processed by us for as long as strictly necessary for the purpose for which it was collected.

As part of that process:

If a mandatory retention period is prescribed by law for a given activity, personal data will be retained until the expiry of the statutory retention period. We note in this respect that in the case of trainings within the scope of the Adult Education Act, training providers are required to retain the data until the last day of the 8th year following the entry into the adult education agreement, in accordance with Section 21 (5) of the Adult Education Act. In addition, pursuant to Section 10/G (k) of Government Decree 93/2002 (5 May 2002), PwC as an accredited training organisation is obliged to keep the records it has in connection with training for at least 8 years.
The data necessary to fulfil accounting obligations will be kept for 8 years.
In the absence of other specific legal, regulatory or contractual requirements, where the processing of personal data is necessary to exercise a claim or protect our legal position, our retention period for personal data follows the statutory limitation period prescribed by law (e.g. statutory limitation in tax matters). If no special statutory limitation is applicable, the retention period will follow the general statutory limitation period under civil law (five years).

Business contacts

Processing of personal data

PwC processes business contact details of existing and potential PwC clients and/or individuals associated with them for the purposes, based on the legal grounds and using the methods set out below.

Business contact details are collected and stored in the Salesforce customer relationship management system (“PwC CRM”). The collection of personal data about contacts and the inclusion of that personal data in the PwC CRM is in some cases carried out manually (e.g. by a PwC employee receiving a business card with contact details from a client) or such data are automatically uploaded from forms completed by the data subject, from email correspondence, or from calendaring systems used by PwC.

The data collected include

the data subject’s name,
the name of the employer of the data subject or the name of the organisation on whose behalf the data subject is acting;
the position held by the data subject with his or her employer or with the organisation on whose behalf he or she is acting;
the data subject’s contact details, in particular his/her telephone number and organisational email address.

Use of personal data

We use the personal data listed in this section for the following purposes:

proposals for specific professional services;
provision of professional services;
maintaining business relations;
confirmation of performance, exercising of any legal claims arising from the professional service.

Legal grounds

If we are bound by a contract to provide professional services, in the case of our natural person clients the legal ground of the data processing is the performance of our contractual obligations to the data subject client, while in the case of non-natural clients, the legal ground is our legitimate interest related to performing our contractual obligations.
If a contractual legal relationship has not yet been established with the data subject or the organisation on whose behalf the data subject is acting, the legal basis for our data processing is our legitimate interest related to pre-contractual consultation and communication.
The legal basis of data processing in connection with the confirmation of performance and the exercising of potential legal claims arising from the professional service is our legitimate interest related to the defense of our legal position.

Data retention

We retain the personal data processed for as long as strictly necessary for the purpose for which it was collected.

As part of that process:

Personal data will be retained for as long as the business relationship between PwC and the client exists or as long as it is strictly necessary for the data to be retained for any of the above purposes;
If a mandatory retention period is prescribed by law for a given activity, personal data will be retained until the expiry of the statutory retention period, e.g. data required to fulfil accounting obligations will be retained for 8 years.
In the absence of other specific legal, regulatory or contractual requirements, where the processing of personal data is necessary for the purposes of asserting a claim or defending our legal position, our retention period for personal data follows the related statutory limitation period prescribed by law (e.g. tax statute of limitations). If no other limitation period is applicable, the retention period will follow the general statutory limitation period under civil law (five years).

Individuals associated with our corporate clients

Processing of personal data

In the interest of providing our professional services we may process the personal data of individuals associated with our corporate clients (e.g. employees or representatives of such clients).

In all cases, we limit the data processed to the necessary minimum. In accordance with the principle of purpose limitation, we kindly ask data subjects to share personal data with us only where it is relevant and strictly necessary for the purpose of communication or managing our legal relationship with the client we provide the services to. We also kindly ask our corporate clients to bring this notice to the attention of the relevant individuals associated with them.

In view of the diversity of the services provided by PwC, the scope of the personal data processed cannot be defined exhaustively, but depending on the type of service, we collect, in particular, the following personal data:

name,
position,
corporate phone number.email address,
corporate phone number.

We note that corporate clients that provide personal data to us for the purposes of rendering our professional services (e.g. personal data of contact persons) qualify as independent data controllers with regard to their own data processing (i.e. before they provide the personal data to us), for which PwC cannot be held liable. PwC is solely responsible for its own data processing, from the date on which the personal data are provided to PwC.

Use of personal data

The personal data listed in this section may be used for the following purposes:

making offers for specific professional services;
provision of professional services;
confirmation of performance, exercising of any legal claims arising from the professional service.maintaining business relations;
confirmation of performance, exercising of any legal claims arising from the professional service.

Legal grounds

The processing takes place based on the following legal grounds:

our legitimate interest related to the performance of a contract with our corporate clients;
the legal basis for data processing in connection with the confirmation of performance and the exercising of our potential legal claims arising from the professional service is our legitimate interest related to the defense of our legal position.

Data retention

We retain the personal data processed by us for as long as strictly necessary for the purpose for which it was collected.

As part of that process:

If a mandatory retention period is prescribed by law for a given activity, personal data will be retained until the expiry of the statutory retention period, e.g. data required to fulfil accounting obligations will be retained for 8 years.
In the absence of other specific legal, regulatory or contractual requirements, where the processing of personal data is necessary for the purposes of asserting a claim or defending our legal position, our retention period for personal data follows the related statutory limitation period prescribed by law (e.g. tax statute of limitations). If no other limitation period is applicable, the retention period will follow the general statutory limitation period under civil law (five years).

Private Individual clients

Processing of personal data

During the provision or in relation to the provision of our professional services to private individual clients we process certain personal data of such clients.

In accordance with the principle of purpose limitation, we kindly ask data subjects who may come into contact with us to share personal data with us only where it is relevant and strictly necessary for the purposes of communicating or managing our relationship with them. Please also provide your explicit consent to the processing of any special categories of personal data that you consider necessary to share with us, otherwise we will not be able to process such data.

If applicable, we kindly ask our clients to provide the necessary information regarding our data processing to other data subjects concerned whose personal data we need in order to render our services (such as family members in the case of preparing personal income tax returns), and, where applicable, provide us with their explicit consent to the processing of any special categories of their personal data.

Given the diversity of the services we provide to private individual clients (click here for information on our services) we process various categories of personal data, including, in particular the following, as appropriate for the services we are providing:

name, contact details;
business activities, positions held in certain organisations, membership in companies;
family information, where relevant to the provision of our services;
income, taxation and other financial-related details;
investments and other financial interests.

Use of personal data

We use personal data for the following purposes:

making offers for specific professional services;
provision of professional services;
maintaining business relations;
confirmation of performance, exercising of any legal claims arising from the service.

Legal grounds

The legal grounds for our data processing are as follows:

in the case of data processing in our contractual relationship with private individual clients, the preparation of the contract and the performance of our contractual obligations to the client, and in the phase preceding the conclusion of the contract, our legitimate interest related to negotiation and communication;
the legal basis for data processing in connection with the confirmation of performance and the exercising of our potential legal claims arising from the service is our legitimate interest related to the defense of our legal position.

Data retention

We retain the personal data processed by us for as long as strictly necessary for the purpose for which it was collected.

As part of that process:

If a mandatory retention period is prescribed by law for a given activity, personal data will be retained until the expiry of the statutory retention period, e.g. data required to fulfil accounting obligations will be retained for 8 years.
In the absence of other specific legal, regulatory or contractual requirements, where the processing of personal data is necessary for the purposes of asserting a claim or defending our legal position, our retention period for personal data follows the related statutory limitation period prescribed by law (e.g. tax statute of limitations). If no other limitation period is applicable, the retention period will follow the general statutory limitation period under civil law (five years).

Individuals using our applications

In some cases, we may provide external users access to various applications and systems managed by us.

Such applications will contain their own, integrated privacy statements explaining why and how personal data is collected and processed in their context. We encourage the users of our applications to refer to said privacy statements and use the application only if they have read and accepted the contents of the privacy statement.

If there is no privacy statement in the relevant application, the data protection provisions of this statement relating to the provision of services shall apply accordingly.

Individuals whose personal data we obtain in connection with providing services

Processing of personal data

For certain services or activities, we may process information and documents (e.g. as part of an audit of an organisation) that contain the personal data of individuals not directly associated with our corporate clients. We may obtain personal data from our clients or from a third party acting on the instructions of the relevant client.

We note that corporate clients that share personal data with us for the purposes of providing our services qualify as independent data controllers with regard to their own data processing (i.e. before they provide personal data to us), for which we will not be held liable. PwC is solely responsible for its own data processing, from the date on which the personal data are provided to PwC.

For the above purposes, we process many categories of personal data, including:

name, contact details, position held;
business activities of individuals;
information about representatives and employees;
payroll and other financial details relating to individuals;
investments and other financial interests relating to individuals.

Use of personal data

We use personal data for the following purposes:

provision of professional services;
maintaining business relations;
confirmation of performance, exercising of any legal claims arising from the professional service.

Legal grounds

The legal grounds for our processing comprise

for personal data obtained by us in connection with fulfilling our contractual obligations to a client, our legitimate interests related to fulfilling such obligations;
in connection with the confirmation of performance and the exercising of our potential legal claims arising from the professional service, our legitimate interest related to the defense of our legal position.

Data retention

We retain the personal data processed by us for as long as strictly necessary for the purpose for which it was collected. As part of that process:

If a mandatory retention period is prescribed by law for a given activity, personal data will be retained until the expiry of the statutory retention period;
In the absence of other specific legal, regulatory or contractual requirements, where the processing of personal data is necessary for the purposes of asserting a claim or defending our legal position, our retention period for personal data follows the related statutory limitation period prescribed by law (e.g. tax statute of limitations). If no other limitation period is applicable, the retention period will follow the general limitation period under civil law (five years).

Others who get in touch with us

Processing of personal data

In order for any individual to contact us with a question, comment or complaint, it is essential that they provide us with the personal information necessary to respond.

These data are as follows:

name;
contact details;
contents of the communication (which may also include information qualifying as personal data);
the information contained in the electronic signature of the person contacting us (e.g. the name of his/her employer, the position held there);
the content of the record of the consumer complaint.

In these cases, the individual is in control of the personal data shared with us.

We kindly ask you to share personal data with us only where in your view it is strictly necessary for the purposes of responding to the question or comment, or investigating the complaint concerned. Please also provide us with your explicit consent to the processing of any special categories of personal data that you deem absolutely necessary to share with us, otherwise we will not be able to process such data.

Use of personal data

We use personal data for the following purposes:

answering questions;
handling complaints;
ensuring the exercise of the data subject’s rights under the GDPR;
fulfilling our obligations under the Consumer Protection Act.

Legal grounds

In cases where we are legally obliged to handle a complaint received or to ensure the exercise of the rights of the data subject - pursuant to Article 17/A of Act CLV of 1997 on Consumer Protection ("Consumer Protection Act") and Articles 12-21 of the GDPR - the legal basis for our processing is the fulfilment of said legal obligations.
In the absence of a specific legal obligation, the legal basis for our data processing is our legitimate interest related to providing an informative and substantive response to the persons contacting us within a reasonable time.

Data retention

We retain the personal data processed by us for as long as strictly necessary for the purpose for which it was collected.

As part of that process:

We process personal data in relation to questions or complaints received until the complaint is finally resolved or the question is successfully answered.
If a written record of the complaint is made, we are obliged to keep it for three years pursuant to Section 17/A (7) of the Consumer Protection Act.
If, in our view, the communications conducted in response to a complaint or question contain information that may subsequently be required in pursuing a legal claim, the retention period will follow the general statutory limitation period under civil law (five years), which starts from the date of the conclusion of the communication regarding the complaint.

Alumni Programme

PwC Hungary has created an Alumni Programme for former employees who now pursue their careers at other organisations and companies. Applicants to the Alumni Programme become members of our Alumni Club, and will receive the latest information on PwC’s initiatives, networking activities and events. The purpose of providing this information is to maintain relationships with former colleagues.

Processing of personal data

In order to register for the Alumni Programme, the following personal data is needed:

name;
email address;
details of former employment at PwC (line of service, industry);
current business details (position, company name, industry, office email address);
portrait photo (optional).

Use of personal data

Personal data provided in connection with the Alumni Programme will be used for the following purposes:

publishing news in the Alumni newsletter about our firm and former employees;
providing information about our latest initiatives and current
discussing possible ways of cooperation with our Alumni Club members.

Legal grounds

The legal grounds for data processing is the applicant’s fully informed, voluntary and explicit consent.

Changes in personal details, termination of membership

You can update your personal information related to your club membership at any time by visiting the registration page at http://www.pwc.com/hu/alumni or by sending an email to alumni.hungary@hu.pwc.com. To cancel your membership, please use the same email address.

Data retention

We will retain the data you have provided as long as you are an Alumni Club member.

We inform our Club members that they may withdraw their consent to the data processing at any time in which case their processed data will be deleted immediately. However, in this case we will no longer be able to communicate with the given Club member.

Suppliers and subcontractors, including individuals associated with them

Processing of personal data

We process personal data about our suppliers, subonctractors and the individuals associated with them, in order to establish and manage the business relationship, conclude contracts, enlist services and provide services to our clients.

For example, where a supplier is providing us with facilities management or other outsourced services, we will process personal data about the individuals appointed as contact persons or involved in the provision of the services. Where a supplier is helping us to deliver professional services to our clients, we process personal data about the individuals involved in providing the services in order to manage our relationship with the supplier and provide such services to our clients.

Data processed by us for such purposes include in particular the following:

name;
title or position at the supplier or subcontractor;
email address;
organisational phone number;
other contact details;
image - in the form of a photo or video recording - and voice of individuals involved in the provision of the services when we organize presentations, courses, trainings or other events to our clients or colleagues with the contribution of our suppliers, subcontractors, and photos or video recordings are taken during such events.

Use of personal data

We use personal data for the following purposes:

Enlisting the services of our suppliers and subcontractors and maintaining contact with them;
Providing professional services to clients through our suppliers and subcontractors;
in relation to videos and photos taken at our events, making the content of the event available after the event and providing information about our events and activities (in certain cases we send the photos or video recordings to the individuals who participated in the event or upload them to one of our online surfaces).

Legal grounds

The legal grounds of our data processing are as follows:

in the case of our individual (natural person) subcontractors and suppliers, performing the contracts concluded with them;
in relation to persons acting on behalf of our corporate (non-natural person) subcontractors or suppliers, our legitimate interests in performing the contracts concluded with our subcontractor or supplier;
in connection with the confirmation of performance and the exercise of our potential legal claims arising from the professional service, our legitimate interest related to the defense of our legal position;
in relation to photos or videos, our legitimate interest related to recording the content of the event and making such content available later on, further, to providing information about our events.

Data retention

We retain the personal data processed by us for as long as strictly necessary for the purpose for which it was collected.

As part of that process:

If a mandatory retention period is prescribed by law for a given activity, personal data will be retained until the expiry of the statutory retention period.
In the absence of other specific legal, regulatory or contractual requirements, where the processing of personal data is necessary for the purposes of asserting a claim or defending our legal position, our retention period for personal data follows the related statutory limitation period prescribed by law (e.g. tax statute of limitations). If no other limitation period is applicable, the retention period will follow the general limitation period under civil law (five years).

Visitors to our offices

We have security measures in place at our office building, including CCTV and building access controls operated by the facility manager of the building. Please note that the data controller for these processes is not PwC, but the manager of the office building, thus, the manager can provide more information in this regard.

When you arrive at PwC's reception, located on the 3rd floor of the office building, we will ask you to provide us with the information necessary to identify you and the member of our staff who will be receiving you, including primarily

your name;
which organisation you are representing (if relevant) and
and to whom you have come.

In addition, if you have also requested a parking space in our underground parking lot, we will process your name and the license plate number of your vehicle in order to reserve a parking space specifically assigned to you.

Please note that, due to the COVID pandemic, additional data processing may take place at the time of entry, the details of which will be made available to you separately.

The data will be processed until the end of your visit, unless we need to retain the data in order to exercise our claims. In this case, the retention period is subject to the limitation period under civil law (5 years).

Visitors to PwC events (notwithstanding PwC’s Academy events)

Processing of personal data

To ensure the successful organisation of our events, we process, in particular, the following personal data:

name;
title, if relevant;
email address;
phone number;
other contact details;
the license plate number of your vehicle if you have previously requested a parking space in the office building;
your image in the form of a photo or video recording (if you do not wish your image to be recorded, please take a seat in one of the last two rows at our events);
personal data related to the measures required due to the COVID-19 pandemic, including the content of a statement on the detection of certain symptoms and contact with potentially infected persons, as well as the result of any measurement of body temperature (the latter data will not be recorded or retained in any form). We will provide you with a separate, detailed privacy statement about the processing related to COVID before your visit (by e-mail or at the reception before entry).

Use of personal data

Personal data may be used for the following purposes:

organising and managing the event;
in relation to photos and videos, developing and promoting our business, providing information about our events and activities;
ensuring the health and safety of our colleagues and visitors during the COVID-19 pandemic;
for our paid events, fulfilling our legal obligations in relation to invoicing.

Legal grounds

The legal grounds for our processing comprise

for our paid events:
- for natural person participants, the performance of the contractual obligation to host the event;
- for participants registered by non-natural persons, our legitimate interest related to the performance of the contractual obligation to host the event;
for our free events
- the explicit and voluntary, informed consent of the data subject;
our legitimate interest related to developing our business;
in relation to invoicing, our relevant legal obligations;
as for COVID, see the relevant privacy statement.

Data retention

Personal data that are strictly needed for organising an event will be retained until the event has successfully taken place.

We will keep the data necessary to fulfil our accounting obligations (e.g. invoicing in the case of paid events) for 8 years.

Where data is necessary for the enforcement of potential legal claims or to defend our legal position, the retention period is subject to the general civil law limitation period (5 years).

Visitors to our website

Processing of personal data

Visitors are not required to provide any personal data or to register in order to access the public content on our website.

Access to premium content (e.g. studies, whitepapers, analyses) available on our website requires prior registration.

The registration requires the acceptance of the related general terms and conditions, as well as providing the following personal data:

username;
name;
email address;
country and chosen language;
if the data subject registers on behalf of a company or other organization, the name of the company or other organization and the title of the data subject therein;
type of relationship with PwC (choosing from the following categories: client, media, other)

Use of personal data

Personal data processed in the context of our website is processed for the following purposes:

enabling the ordering of publications and professional materials.providing access to premium content;
enabling the ordering of publications and professional materials.

Legal grounds

The legal grounds for our processing are as follows:

in relation to ordering publications and other professional materials, the data subject’s explicit, voluntary and informed consent.
in the case of data processing related to registration prior to accessing premium content, the legal basis depends on whether the data subject registers as a private individual or on behalf of a company or other organization. If the data subject registers as a private individual, the legal basis is the performance of our contractual obligations as the registration and the acceptance of the related general terms and conditions creates a contractual legal relationship between the individual and PwC. If the data subject registers on behalf of a company or other organization, the legal basis for data processing is PwC’s legitimate interest related to fulfilling its obligations derived from the legal relationship between the company or other organization registering by way of its representative and PwC by providing access to the premium content.

Data retention

Personal data collected via our websites will be retained by us for as long as strictly necessary for the purpose it was collected (e.g. as long as we have an active relationship with the relevant individual), or as long as required by law.

As part of that process:

contact information about visitors (such as personal data provided through registration for access to certain areas of the site) will be retained as long as the information is required to completely service the contact request or until the user requests that we erase the information prior to this. Mailing list emails and data are retained only for the period necessary to carry out the visitor’s requests.
If, in our view, the personal data we hold for the purposes of a specific data processing may be required in relation to exercising a legal claim, the retention period will follow the general civil law statutory limitation period (five years).

Data collection for marketing purposes, profiling, remarketing

Our websites do not collect personal data for the dissemination or sale to third parties for consumer marketing purposes or host mailings on behalf of third parties.

However, PwC uses cookies from its external partners for marketing purposes, including the Google Ads tracking cookie. These cookies only work if the user explicitly allows it in the cookie setting of the website and consents to their use.

Besides blocking it in the cookie settings, you can opt out of Google’s use of cookies by visiting Google’s Ads Settings. Alternatively, you can opt out of a specific cookie by visiting the Network Advertising Initiative opt-out page.

Using DoubleClick’s remarketing pixels – PwC may use DoubleClick’s remarketing pixels. You can opt out of DoubleClick’s use of cookies by visiting the DoubleClick opt-out page or the Network Advertising Initiative opt-out page.

Links to other websites

There are surfaces at our website that may link or redirect to websites that do not operate in line with our privacy practices or those of www.pwc.com. When you click on such surfaces while browsing and are redirected accordingly, PwC’s privacy principles and rules no longer apply. We have no control over any third-party websites, and it is the operator of such websites that will be regarded as the controller.

We encourage visitors to review each website’s privacy statement before disclosing any personally identifiable information.

Website analytics

Although it does not involve the processing of personal data, we note that we use Google Analytics and Adobe Analytics systems for the statistical analysis of visitor data relating to our website and the corresponding development of our website.

Such data cannot be used to individually identify each user.

However, in order to allow users to have complete control over the collected data, both systems offer the possibility to unsubscribe from data collection using the following links:

Google Analytics: https://tools.g oo g le.com/dlpa g e/g aoptout
Adobe Analytics: http://www.adobe.com/privac y /opt-out.html

Newsletter registrants, recipients of direct marketing communications

The prerequisite for any direct marketing communication, including newsletters, is that the recipient gives prior and explicit consent to PwC sending them marketing content in accordance with the provisions of Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities. You may withdraw your consent at any time. Each newsletter will contain an unsubscribe link, or you can withdraw your consent using the contact details provided in this notice.

The scope of the data we process in connection with direct marketing is limited to the email address in case of the newsletter registrants. In other cases, when providing prior consent, in addition to the email address, the name and job title of the recipient (e.g. managing director) at the given organization (employer) may be provided, in which case we will also process this personal data.

Use of personal data

Your personal data may be used for the following purposes:

providing you with the newsletter you have subscribed to or other direct marketing communication;
providing information to you about our company, our range of services and events.

Legal grounds

the data subject’s explicit, voluntary and informed consent.

Data retention

We retain your personal data as part of the data processing detailed in this section until you withdraw your consent.

We note that consent is voluntary, and refusal to give consent will not put you at a disadvantage. However, newsletter or other direct marketing content can only be sent subject to valid consent.

Our other data processing activities

In addition to the above, we necessarily process personal data in order to comply with our legal obligations and ensure the protection of the data we process. In order to identify security threats, it is inevitable that we process personal data. For example, in the event of a threat to the personal data we process (such as an external hacker attack), we process data to investigate and prevent security incidents or data breaches, and in the event of a threat that cannot be prevented, to mitigate its consequences.
We process data to comply with our legal obligations to identify high risk individuals and organisations and to check whether there are circumstances that make it impossible for us to provide services to a particular client. We process data in this context to comply with our legal obligations in relation to client identification as well as anti-money laundering and anti-terrorism measures. We monitor the services we provide to our clients for quality assurance and risk management purposes, which may include the processing of personal data contained in digitally stored material about the client. In addition, we also obtain information from publicly available sources (e.g. internet searches, sanctions lists, data from public registers), which may also involve the processing of personal data.
Like any professional services firm, we are subject to a multitude of legal and professional requirements. To comply with the law and professional standards, we must keep records to demonstrate that we provide our services in compliance with our legal and professional obligations, and these records may contain personal data. For example, we may keep records of personal data provided to us in the course of client identification (representatives, beneficial owners, other owners).
In order to comply with the law, we may have to transmit certain data to the bodies controlling the use of budgetary or EU funds for the purpose of verifying the lawful receipt and use of such funds, and the representatives of public authorities may have access to the documentation containing personal data during an inspection.
We process data to verify compliance with the law and professional standards, and to exercise and defend our claims in the event of disputes, including in particular to guarantee the admissibility of evidence of our claims in the dispute. As any legal entity, we have a fundamental interest in having the information we need to assert our legitimate claims and defend our positions in the event of a legal dispute. This necessarily involves the processing of personal data.

Scope of data processed

In the context of the purposes set out in this section, we process primarily the following personal data:

names, contact details and position of our clients or individuals acting on behalf of our clients;
personal data processed in the context of client identification and anti-money laundering and anti-terrorism measures;
the content of communications, in particular by email, in connection with the provision of our services, and any personal data contained in documents delivered;
personal data relating to a security incidents or data breaches, in order to ensure that the incident or breach is handled appropriately and inform the clients and individuals concerned and, where appropriate, make a report to the public authority;
the personal data content of documents that are relevant to any legal action against or by PwC (e.g. civil lawsuits).

Legal grounds

The legal grounds for our data processing are primarily based on our legal obligations including in particular, in relation to our client identification procedures, certain obligations under Act LIII of 2017 on the Prevention and Combating of Money Laundering and Terrorist Financing. The exact legal basis for these legal obligations will always be provided prior to the collection of data on the form used for this purpose.
In case of the data processing in relation to which no explicit and specific legal obligation is derived from the applicable law, the legal basis for the processing is our legitimate interest related to the lawful, professional and economically sustainable operation of PwC.
In the context of legal disputes, the legal basis for processing is our legitimate interest related to exercising our claims and defending our position in the dispute.

Transferring data

We will only share personal data with third parties when we are legally obliged to do so or where it is otherwise lawful to do so. When we share personal data with other parties, we put contractual arrangements and security mechanisms in place as appropriate to protect the data and to comply with both the legal requirements and our internal data protection, confidentiality and security standards, as well as the relevant professional standards.

We are part of PwC’s global network and in common with other professional service providers, we use third parties located in other countries to help us run our business. As a result, personal data may be transferred and become available outside the countries where we and our clients are located.

Cross-border transfers may include transfers to countries outside the European Union (“EU”) and to countries that do not have laws that provide the level of protection for personal data expected by the EU. We have taken steps to ensure all personal data are provided with adequate protection as required by the EU also in cases in which personal data is transferred outside the EU. Where we transfer personal data outside of the EU to a country not determined by the European Commission as providing an adequate level of protection for personal data, the transfers will be under an agreement which covers the EU requirements for the transfer of personal data outside the EU, such as the European Commission approved standard contractual clauses.

In certain cases, the recipient to whom the personal data are transferred will act as data controller, as it will determine the purpose of processing independently. This may be the case when our services provided to clients involve the services of other PwC member firms, where these member firms determine their own policies for providing their services.

In other cases, the recipient may act as PwC’s data processor, as it will not determine the purpose and method of processing by itself, but rather follow PwC’s documented instructions. For example, an IT services company may provide us services by processing data based on our instructions (e.g. data storage), or we may transfer data to an external event organiser for the sole purpose of facilitating the technical organisation of an event. If the recipient acts as PwC’s data processor, we will make sure that it carries out its activities in accordance with an appropriate data processing agreement that complies with GDPR requirements, ensuring that such processing is carried out lawfully.

Personal data held by us may be transferred to:

Other PwC member firms;

For the details of our member firm locations, please click here. We may share personal data with other PwC member firms where necessary for administrative purposes and to provide professional services to our clients (e.g. when providing services involving PwC member firms in different countries). The fact of our business contacts is visible to other PwC member firms;

Third-party organisations that provide applications, IT or other services to us or that we work with to serve a customer.

For example, providers of information technology, cloud-based software infrastructure providers, identity management, website hosting and management, data analysis, data backup, security and storage services.

Third-party organisations that otherwise support us in providing goods, services or information (e.g. subcontractors contributing to the provision of professional advice, event organisers);
Auditors, insurers and professional advisers, translation agencies;
Correspondent law firms, including in particular, the member firms of the PwC Legal network;
Courts, law enforcement or other governmental agencies, professional bodies or other third parties as required by, and in accordance with, applicable law or regulation.

Changes to this privacy statement

We recognise that transparency and ensuring compliant data processing is an ongoing responsibility, thus, we will review this privacy statement on a regular basis.

We reserve the right to modify or amend this privacy statement at any time.

Data controllers and contact information

For the purposes of data processing covered by this privacy statement, the data controller is:

PricewaterhouseCoopers Hungary Ltd. (registered office: Bajcsy-Zsilinszky út 78., 1055 Budapest, Hungary, entered in the company register by the Budapest Metropolitan Court as court of registry under Cg. 01-09-063022) and

PricewaterhouseCoopers Auditing Ltd. (registered office: Bajcsy-Zsilinszky út 78., 1055 Budapest, Hungary, entered in the company register by the Budapest Metropolitan Court as court of registry under Cg. 01-09-961102)

Given the organisational structure of the PwC group in Hungary and the allocation of administrative and operative functions between the individual companies, PricewaterhouseCoopers Hungary Ltd. and PricewaterhouseCoopers Auditing Ltd. may, in certain cases, act as joint data controllers. In such cases, the data controllers will clearly agree among themselves on their obligations and responsibilities.

If you have any questions about this privacy statement or the processing of personal data, or you wish to exercise your rights detailed below, please contact us via our website or:

Email: hu_dataprotection@pwc.com

Phone: +36 1 461 9100

Data Protection Officer: dr. Orsolya Hosszú, attorney-at-law, specialized in data privacy and data security.

What rights do you have as a data subject in relation to your personal data processed by PwC?

You may request access to and rectification or erasure of your personal data or, in certain cases, restriction of the data processing, and may object to the processing of personal data. You have the right to data portability, the right to file a complaint with the supervisory authority, and the right to judicial remedy. In the case of automated individual decision-making, you have the right not to be subject to the automated decision, and the right to obtain human intervention.

Where the processing is based on your consent, you have the right to withdraw consent at any time, without affecting the lawfulness of the processing based on your consent before its withdrawal.

Right of access

You have the right to obtain information at any time about whether PwC processes personal data about you, the means and purposes for which the data are processed, the recipients to whom the personal data have been disclosed, the source from which PwC has obtained the personal data, the term for which the personal data are processed, and information on automated decision-making and profiling. In the case of data transfer to third countries and international organisations you have the right to request information on the related additional safeguards. When exercising your right of access, you also have the right to receive a copy of your personal data; in the case of a request filed electronically, unless otherwise noted, PwC will provide the requested information electronically (e.g. in PDF format).

If your right of access adversely affects the rights or freedoms of others, including trade secrets or intellectual property, PwC is entitled to refuse to act on your request to the necessary and proportionate extent. If you request the above information in additional copies, PwC will charge you a reasonable fee that is proportionate to the administrative costs incurred in preparing any additional copies.

Right to rectification

You have the right to request PwC to amend or rectify your personal data where it is inaccurate. If there is any doubt regarding the data to be amended, PwC may request you to verify the data by any appropriate means (primarily by means of an official document). If PwC has disclosed the personal data concerned to other parties (recipients such as processors), PwC will communicate any rectification of personal data to each recipient to whom the data have been disclosed, unless this proves impossible or involves disproportionate effort. PwC will inform you about such recipients if you request so.

Right to erasure (“right to be forgotten”)

If you request PwC to erase any or all of your personal data, PwC will erase the personal data concerned without undue delay if:

PwC no longer needs the personal data for the purposes for which it was collected or otherwise processed;
you withdraw your consent on which the processing is based, and there is no other legal ground for the processing;
the data processing was based on grounds of the legitimate interests of PwC or a third party, but you objected to the processing, and there are no overriding compelling legitimate grounds for the processing;
PwC has unlawfully processed the personal data or the personal data have to be erased in order to comply with a legal obligation.

If PwC has disclosed the personal data concerned to other parties (recipients such as processors), PwC will communicate any erasure of personal data to each recipient to whom the data have been disclosed, unless this proves impossible or involves disproportionate effort. PwC will inform you about such recipients if you request so.

PwC’s obligation to erase the personal data will not apply to the extent that processing is necessary for the establishment, exercise or defence of legal claims.

Right to restriction of processing

You may request restriction of the processing of your personal data in the following cases:

you contest the accuracy of the personal data (in this case the restriction will cover the period enabling PwC to verify the accuracy of the personal data);
the processing is unlawful but you oppose the erasure of the personal data and request the restriction of its use instead;
PwC no longer needs the personal data for the purposes of the processing, but you need the data for the establishment, exercise or defence of legal claims; or
you have objected to the processing, pending verification of whether there are any legitimate compelling grounds that override your right to object.

Where processing has been restricted, PwC does not process, except for storage, the personal data subject to the restriction, or only to the extent you have consented to. Even in the absence of such consent, PwC may process data that is necessary for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of an EU Member State.

PwC will inform you before the restriction of processing is lifted. If PwC has disclosed the personal data concerned to other parties (recipients such as processors), PwC will communicate any restriction of processing to each recipient to whom the data have been disclosed, unless this proves impossible or involves disproportionate effort. PwC will inform you about such recipients if you request so.

Right to object

If the data processing is carried out on grounds of the legitimate interests of PwC or a third party, you have the right to object to the processing. PwC may refuse to comply with the objection if PwC demonstrates

compelling legitimate grounds for the processing which override your interests, rights and freedoms, or
for the establishment, exercise or defence of legal claims.

Right to lodge a complaint, and judicial remedy

You have the right to lodge a complaint with a data protection supervisory authority in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that PwC’s processing of your personal data infringes the existing data protection laws, in particular the provisions of the GDPR. In Hungary, you may turn to the Hungarian National Authority for Data Protection and Freedom of Information (“NAIH”).

You may contact NAIH at:

Website: http://naih.hu/

Address: 1055 Budapest, Falk Miksa utca 9-11.

Mailing address: 1363 Budapest, Pf. 9.

Phone: +36-1-391-1400

Fax: +36-1-391-1410

Email: ugyfelszolgalat@naih.hu

Without prejudice to your right to lodge a complaint, you have the right to judicial remedy. You have the right to judicial remedy also against a legally binding decision of a data protection supervisory authority concerning you. You also have the right to judicial remedy where the supervisory authority does not handle a complaint or does not inform you within three months on the progress or outcome of the complaint you have lodged.

If you wish to exercise any of the above rights (except for lodging a complaint with NAIH or seeking judicial remedy), please email us at hu_dataprotection@pwc.com.

Complaints relating to our use of personal data may be sent by email, with details of your complaint, to hu_dataprotection@pwc.com. We will look into and respond within one month to any complaints we receive.

If possible, please let us know of your complaint or question first before taking any further action and we will do our best to resolve it!

This privacy statement was adopted on 22 May 2018. Date of last revision: 16 January 2023.