Effective date: 1 December 2019 · Last updated: 5 October 2026
This policy explains how T&H Consulting International Kft. handles personal data when you use our website, contact us, become a client or attend one of our courses, and when you are connected to a matter we investigate.
Who is responsible · What we collect · Suspected offences · Purposes and legal bases · Cookies · AI and analytics tools · Who we share data with · Transfers · How long we keep data · Your rights · Security
Who is responsible for your data
This policy is issued by T&H Consulting International Kft., a company registered in Hungary:
- Operational address: Budapest, Széchenyi István tér 7-8, 1051 Ungarn, Hungary
- Company registration number: 01-09-350838
Where your agreement is with T&H Holdings Limited, a separate company in the United Kingdom, it is the controller of your data and we process it on its behalf. Enquiries sent through this website go into T&H Holdings Limited’s client database. In all other cases, T&H Consulting International Kft. is the controller and this policy applies.
Where we work for a client such as a law firm that instructs us, we process data as its processor and the client’s own privacy notice applies.
For any question about your data or this policy, write to with “Data protection” in the subject line.
What we collect and where it comes from
When you visit the website
Technical data such as your IP address, browser and device type, and the pages you visit. Our hosting and security providers process this to deliver and protect the site. With your consent, analytics, session-recording and advertising cookies also collect information about how you use the site (see Cookies).
When you contact us
Through the contact form: your name, email address, phone number, country, the type of enquiry and your message. The form is protected by a spam-prevention service. Through the chat, email, phone or a messaging app: what you tell us and your contact details.
Your message will often describe a suspected fraud or other offence. We use it to assess and answer your enquiry. Please do not send identity documents, card numbers or passwords through the form or the chat.
When you become a client
Your identification and contact details, the information we need for client checks, the facts and documents of your matter (for example transaction records, wallet addresses, account statements, correspondence with platforms and reports made to the police), billing details, and our correspondence with you, including call recordings where we record a call.
When you attend one of our courses
Your name, contact details, attendance and certificate details, and the data that Hungarian adult education law requires training providers to record and report.
When you are connected to a matter we investigate
In our investigations we process data about people who are not our clients and have not contacted us, for example people or companies who received funds, ran a website or platform, or appear in the evidence.
- What we process: names and aliases, contact details, wallet addresses and transaction data, bank, payment and exchange account identifiers, company and ownership records, domain and website records, online profiles and public statements.
- Where it comes from: our client and the evidence they provide; public blockchains and blockchain analytics platforms; company, court and other public registers; domain and website records; other open sources; and replies from exchanges, payment firms and authorities that our client shares with us.
We use public sources and lawfully available platforms only. We do not use covert methods, hacking or unauthorised access. We process this data only as far as it is relevant to the matter. We give this information here rather than to each person directly, because contacting them would usually be impossible, involve disproportionate effort or defeat the purpose of the investigation (Article 14(5) GDPR). You can object to this processing at any time (see Your rights).
Information about suspected offences
Enquiries, case files and data about people connected to a matter often relate to suspected fraud or other offences. We use this information only to assess enquiries and carry out the work agreed with our client. Access is limited to the people working on the matter, and we share it only as described in Who we share data with. We do not publish it or use it for any other purpose.
Our contact form does not ask for special-category data, such as information about health, religion or political views. If you choose to share it, we use it only where your matter requires it.
Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Answering enquiries made through the form, chat, email, phone or messaging apps | Steps you ask us to take before entering into an agreement (Article 6(1)(b)); our legitimate interest in answering people who contact us (Article 6(1)(f)) |
| Checks before we take on a client, for example confirming identity and screening against sanctions lists | Legal obligation where sanctions law requires it (Article 6(1)(c)); our legitimate interest in not acting for sanctioned or fraudulent parties (Article 6(1)(f)) |
| Carrying out the work agreed with a client, including reports, requests to exchanges and banks, and submissions to authorities with the client’s written authority | Performance of our agreement with the client (Article 6(1)(b)) |
| Investigating people and companies connected to a client’s matter | Legitimate interests (Article 6(1)(f)): our client’s interest in establishing the facts and protecting or pursuing their legal claims, and ours in providing the service |
| Accounting, invoicing and tax | Legal obligation (Article 6(1)(c)), including under the Hungarian Accounting Act |
| Recording telephone calls | Legitimate interests (Article 6(1)(f)): keeping an accurate record of instructions and of what was agreed. We tell you at the start of a call if it is being recorded. |
| Running our courses | Performance of the training agreement (Article 6(1)(b)); legal obligation under Hungarian adult education law (Article 6(1)(c)) |
| Keeping the website secure and working, including strictly necessary cookies | Legitimate interests (Article 6(1)(f)) |
| Analytics, session recording and advertising measurement | Your consent, given in the cookie banner (Article 6(1)(a)) |
| Handling complaints, and establishing, exercising or defending legal claims | Legal obligation (Article 6(1)(c)); legitimate interests (Article 6(1)(f)) |
If you do not give us the information we need to answer your enquiry or carry out the work, we may not be able to help you.
Cookies and similar technologies
We use strictly necessary cookies to run the website and to remember your cookie choice. We use other cookies only if you accept them in the cookie banner, and you can change your choice at any time in Cookie settings.
| Category | What it is used for | When it is used |
|---|---|---|
| Necessary | Security, delivering the site, protecting the contact form from spam, and remembering your cookie choice | Always |
| Functional | The chat on our website | Only with your consent |
| Analytics | Measuring visits and how pages are used, including recordings of how visitors move through pages | Only with your consent |
| Advertisement | Measuring whether our adverts lead to enquiries or calls, and showing our adverts to people who have visited the site | Only with your consent |
Cookie settings names the provider behind each category and lists each cookie and how long it is kept.
AI and analytics tools
We use AI assistants from established providers for research, summarising, translation and drafting support, including on case material. A consultant reviews every output before it is used in any communication, decision or report.
In our investigations we use specialist blockchain analytics platforms, which apply automated processing such as risk scoring, clustering and pattern detection to transaction data. These tools support, but do not replace, the judgement of the person handling the case: a qualified consultant assesses and interprets every finding before it is relied on or communicated.
We do not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects.
Who we share data with
T&H Holdings Limited
Enquiries and client data are shared with T&H Holdings Limited, as explained under Who is responsible.
Service providers acting for us
We use service providers in the following categories. They process data on our instructions and under data processing terms:
- Website hosting, security and delivery
- Email, document storage and collaboration
- Client records, web forms and chat
- AI assistants
- Blockchain analytics platforms
- Analytics and advertising measurement, with your consent
- Accountants, banks and IT support
Messaging apps
If you choose to contact us through a messaging app, your messages are also handled by that app’s provider under its own terms, which may involve processing outside the EEA. You can always use email or the phone instead.
Others, as part of the work
Where the work for a client requires it, and with the client’s instruction or written authority, we share relevant data with:
- the police, prosecutors and other law enforcement authorities
- regulators and financial ombudsmen
- cryptocurrency exchanges and other virtual asset or crypto-asset service providers (VASPs/CASPs), banks and payment firms, for example when asking them to preserve or disclose information
- the client’s lawyers and our partner law firms, where legal notices or representation are needed
Where the law requires
We disclose data to authorities when the law requires us to, and to our own professional advisers where needed. We do not sell personal data.
Transfers outside the EEA
Some of our providers process data outside the European Economic Area, mainly in the United States and the United Kingdom. Where they do, we rely on:
- an adequacy decision of the European Commission, such as the decisions covering the United Kingdom and US companies certified under the EU–US Data Privacy Framework; or
- Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), with a transfer impact assessment where needed.
Where a provider offers it, we use its European data regions.
How long we keep data
- Enquiries that do not lead to an engagement: up to 5 years, as they may be relevant to case history, fraud-related assessments and disputes
- Client case files: up to 7 years after the matter closes, or longer if legal proceedings or a legal hold require it
- Accounting and billing records: 8 years, as required by the Hungarian Accounting Act
- Emails, chat and messaging-app correspondence: up to 5 years
- Call recordings: up to 5 years, the general limitation period for civil claims in Hungary
- Course records: for the period set by Hungarian adult education law
- Security and technical logs: 1 to 3 years, depending on the system
- Cookies: as shown in Cookie settings
When data is no longer needed, we delete it securely or anonymise it.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you
- have inaccurate or incomplete data corrected
- have your data erased in certain circumstances
- restrict how we use your data in certain circumstances
- receive data you gave us in a commonly used, machine-readable format, where we process it on the basis of consent or a contract
- object at any time to processing based on our legitimate interests, including the processing of data about people connected to a matter
- withdraw your consent at any time, for example in Cookie settings, without affecting processing that took place before you withdrew it
To exercise a right, write to . We reply within one month. For complex requests this can be extended by up to two further months, and we will tell you why. We may need to confirm your identity first. Some rights are limited by law, for example where we need the data to establish, exercise or defend legal claims.
You can complain to the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH), or to the data protection authority in the EU country where you live or work. You may also go to court.
- Address: 1055 Budapest, Falk Miksa utca 9–11
- Postal address: 1363 Budapest, Pf. 9
- Phone: +36 1 391 1400
- Website: naih.hu
How we protect data
We use appropriate technical and organisational measures, including encryption in transit, access controls, secure storage and regular review of our safeguards. Case material is exchanged through secure channels, and access to it is limited to the people working on the matter.
If a personal data breach is likely to put your rights and freedoms at risk, we notify NAIH without undue delay and, where feasible, within 72 hours of becoming aware of it. If the risk to you is high, we also tell you without undue delay.
Children
Our website and services are not intended for anyone under 18.
Changes to this policy
We update this policy when our practices or the law change. The date at the top of this page shows the latest version.