1. Introduction

The purpose of this Privacy Notice (hereinafter: “Notice”) is to provide adequate and transparent information regarding the processing of personal data to the users of the website by the service provider identified below (hereinafter: “Data Controller”) as data controller and operator.

Governing legislation: Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR); Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (Infotv.).

By using the website, you confirm that you have read, understood, and acknowledged the contents of this Notice. Information regarding data processing by the Data Controller for other purposes and subjects can be found in separate documents. If you have any questions, please feel free to contact our colleagues!

2. Data Controller

3. Definitions

• “data subject”any natural person identified or identifiable based on any information;
• “personal data”any information relating to the data subject;
• “consent”any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
• “data controller”the natural or legal person, or entity without legal personality, which alone or jointly with others determines the purposes and means of the processing of personal data within the framework laid down by law or binding legal act of the European Union, makes and executes decisions on data processing (including the tools used), or has them executed by the data processor;
• “data processing”any operation or set of operations performed on data, regardless of the procedure used, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, as well as preventing further use of data, taking photographs, audio or video recordings, and recording physical characteristics suitable for identifying a person (e.g. fingerprints, palm prints, DNA sample, iris image);
• “data transmission”making data accessible to a specified third party;
• “data processing operations”the aggregate of data processing operations carried out by a data processor acting on behalf of or under the instructions of the data controller;
• “data processor”a natural or legal person, or entity without legal personality, which processes personal data on behalf of or under the instructions of the data controller, within the framework and conditions laid down by law or binding legal act of the European Union;
• “third party”a natural or legal person, or entity without legal personality, other than the data subject, data controller, data processor and persons who, under the direct authority of the data controller or data processor, are authorized to process personal data;
• “personal data breach”a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed;
• “profiling”any form of automated processing of personal data consisting of the use of personal data to evaluate, analyze or predict certain personal aspects relating to a natural person, in particular aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements;
• “recipient”a natural or legal person, or entity without legal personality, to which the personal data are disclosed by the data controller or data processor;
• “EEA State”a Member State of the European Union and any other state party to the Agreement on the European Economic Area, as well as any state whose citizen enjoys the same legal status as a citizen of a state party to the Agreement on the European Economic Area based on an international treaty concluded between the European Union and its Member States and a state not party to the Agreement on the European Economic Area;
• “third country”any state that is not an EEA State;
• “international organization”an organization governed by public international law or its subordinate bodies, or any other body set up by, or on the basis of, an agreement between two or more countries.

4. Data Processing Principles

1. Lawfulness, fairness and transparency
   Personal data may only be processed for specified, explicit, and legitimate purposes, for exercising rights and fulfilling obligations. Data processing must meet the purpose of processing at every stage; the collection and processing of data must be fair and lawful.
2. Purpose limitation
   Only personal data that is essential for achieving the purpose of processing and suitable for achieving that purpose may be processed. Personal data may only be processed to the extent and for the duration necessary to achieve the purpose.
3. Data minimization
   Personal data must be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.
4. Accuracy
   During data processing, the accuracy, completeness, and—if necessary in view of the purpose of processing—up-to-date nature of the data must be ensured, as well as ensuring that data subjects can only be identified for as long as necessary for the purpose of processing.
5. Storage limitation
   Personal data must be stored in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. Personal data retains this quality during processing as long as its connection with the data subject can be restored. The connection with the data subject is restorable if the data controller possesses the technical conditions necessary for restoration.
6. Integrity and confidentiality
   Appropriate security of personal data must be ensured during processing by applying appropriate technical or organizational measures, including protection against unauthorized or unlawful processing, accidental loss, destruction, or damage.
7. Accountability
   The Data Controller is responsible for compliance with the principles above and must be able to demonstrate such compliance.

5. Information

5.1. Links to External Websites

The website may contain links to websites operated by third parties. The use of external websites and services available thereon is subject to the terms of use and privacy notices of the respective operator, including provisions regarding cookie usage. The content, operation, and data protection and data security practices of external websites are determined by the operator of the respective website; the Data Controller assumes no liability for these to the extent permitted by law. If the Data Controller becomes aware that the content of any linked website or the placement of the link violates applicable law, it will immediately remove the link.

5.2. Cookie Tools and Tracking

In order to make the website even more attractive to you and to enable the operation of certain website features and make specific functions available, we use cookies. Cookies are small text files stored by your browser on your device. Session cookies remain on your device until the end of the browsing session, while persistent cookies remain until their specified expiration period or until you delete them, serving, for example, to retain previous settings.

Consent is not required for cookies that are strictly necessary to transmit electronic communications or to provide a service explicitly requested by you. Consent-based cookies are applied by the Data Controller exclusively after obtaining your prior, informed consent. You can enable or reject these by purpose on the cookie management interface and modify your settings at any time later. The withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.

Refusing consent does not prevent the use of essential functions of the website, but it may restrict the availability of certain additional features or embedded content. Detailed information regarding the names, providers, purposes, lifespans, and legal bases of the cookies used is provided on the cookie management interface.

5.3. Social Plugins

Social media provider plugins and embedded content may also appear on the website. Consent-based plugins are activated exclusively following your prior consent. Upon activation, your browser may establish a direct connection to the servers of the respective provider, during which information—in particular your IP address, the address of the visited page, the time of access, as well as technical information regarding the browser and device—may be transmitted to the provider.

If you are logged into the respective social media service, the provider may link data regarding your visit to your user account. Data collection can occur even without logging in; therefore, logging out of the account alone does not prevent data transfer.

Data collection and transmission connected to embedding the plugin are subject to data protection obligations binding the Data Controller. Further data processing carried out by the provider for its own purposes, data retention, data subject rights, and setting options are governed by the provider’s own privacy notice. Depending on the service used, data transfers outside the EEA may also take place, strictly subject to compliance with the conditions set out in Chapter V of the GDPR.

5.4. Social Media Pages

The Data Controller may operate social media pages to present its activities, provide information, and maintain contact. During interactions on these pages, it may process, in particular, the data subject’s displayed name, profile ID, accessible profile data, and the content of comments, reactions, and messages. The source of the data is the data subject or the social platform provider. The Data Controller may also receive aggregated statistics from the platform regarding page visits and usage. The availability of pages without registration depends on the platform’s operation and settings.

The legal basis for the Data Controller’s own page management activity is legitimate interest under Article 6(1)(f) GDPR: providing information regarding its activities, communicating with interested parties, and operating the social media interface as intended. The data subject may object to data processing based on legitimate interest for reasons relating to his or her particular situation. Handling direct inquiries is governed by section 5.5.

Data related to comments and reactions are processed by the Data Controller for the duration of the availability of the given content, to the extent necessary for operating the page, taking into account the data subject’s request for erasure or objection. It does not create a separate database of followers and page visitors apart from the platform. Further data processing conducted by the platform provider and retention of data at the provider are governed by its own privacy policy.

When operating a Facebook page, the Data Controller and Meta Platforms Ireland Limited act as joint controllers regarding the processing of personal data serving as the basis for page insights/statistics, in respect of operations falling under the scope of the corresponding agreement. The allocation of responsibilities and the procedure for exercising data subject rights are contained in Meta’s Page Insights Controller Addendum.

5.5. Contact

The data subject may send an inquiry via the contact form or through the provided contact details of the Data Controller. The purpose of data processing is receiving and answering the inquiry, necessary consultation, and, in case of such request, providing a quote and preparing contract conclusion. The scope of processed data includes the data subject’s name, e-mail address, provided phone number, content of the message, as well as data generated during related communication. Data is received directly from the inquiring party.

For general inquiries and organizational contact, the legal basis for processing is legitimate interest under Article 6(1)(f) GDPR: responding substantively to inquiries addressed to the Data Controller and maintaining communication necessary for this. If a natural person initiates contract conclusion in their own name, the legal basis for processing objectively necessary for this is taking steps prior to entering into a contract under Article 6(1)(b) GDPR. Data provision is voluntary; however, in the absence of contact details or information necessary to respond, substantive handling cannot be ensured.

The Data Controller processes the data until the inquiry is answered or the consultation is concluded, and deletes it within 30 days at the latest. If a response necessary to continue the consultation is missing, the Data Controller considers it closed on the 90th day following the last outgoing substantive message. Upon contract conclusion, separate notice will be provided regarding further data processing. Data necessary to establish, exercise, or defend specific legal claims may be processed further under an appropriate legal basis for a duration adjusted to the claim; general inquiry alone does not justify a 5-year retention period.

6. Data Transmission / Data Transfers

We use various businesses providing adequate security guarantees for processing, storing, and handling your data, to whom personal data necessary for the service purposes below are transferred. The following data processors carry out the processing of your data:

Data transfer to third countries: Certain data processors engaged by the Data Controller are located outside the European Union. Data protection is ensured by the following safeguards:

• partners certified under the EU-US Data Privacy Framework (DPF);
• partners protected by Standard Contractual Clauses (SCC);
• all data transfers take place with an adequate level of protection;
• the validity of DPF certifications is regularly verified;
• SCCs are the new clauses under EU Commission Decision 2021/914;
• users may receive detailed information on the safeguards applied upon request.

Please be informed that courts, prosecutors, investigative authorities, administrative offense authorities, administrative bodies, or other bodies authorized by law may oblige the Data Controller to provide information or disclose data. In order to fulfill legal obligations regarding compulsory data provision, the Data Controller shall disclose only those personal data that are indispensable for achieving the purpose of the request.

7. Data Security, Automated Decision-Making, Profiling

The Data Controller ensures data security proportionate to the risk, and takes technical and organizational measures as well as establishes procedural rules necessary to enforce the GDPR and other data and secrecy protection rules. The Data Controller protects data with measures proportionate to risk, in particular against unauthorized access, alteration, transmission, disclosure, erasure or destruction, as well as accidental destruction and damage, and inaccessibility resulting from changes in the technology used.

8. Rights of the Data Subject

You may exercise your rights listed in the following points by submitting a request to the Data Controller. The contact details of the Data Controller are included in Chapter 2 of this Notice. The Data Controller fulfills the request of the data subject without undue delay, but at the latest within one month of receipt of the request, unless this period is extended by two further months where necessary, taking into account the complexity and number of the requests.

Right to Information and Access

The data subject has the right to obtain confirmation from the Data Controller as to whether or not personal data concerning him or her are being processed. Where that is the case, the data subject has the right to access detailed information regarding data processing concerning him or her, including the categories of personal data processed. The Data Controller shall provide a copy of the personal data undergoing processing. Information is provided free of charge if the data subject has not submitted an information request for the same scope of data to the Data Controller in the current year. For further copies requested by the data subject, the Data Controller may charge a reasonable fee based on administrative costs.

Right to Rectification

The data subject has the right to obtain from the Data Controller without undue delay the rectification of inaccurate personal data concerning him or her. The Data Controller rectifies personal data if it does not correspond to reality and accurate personal data is available. Taking into account the purposes of processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Right to Erasure (“Right to be Forgotten”)

The data subject has the right to obtain from the Data Controller the erasure of personal data concerning him or her without undue delay. The Data Controller shall fulfill this request if the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed. Erasure of personal data concerning the data subject shall also be carried out if the data subject objects to the processing and there are no overriding legitimate grounds for the processing on the part of the Data Controller or a third party. The Data Controller is also obliged to erase personal data if they have been unlawfully processed, or if personal data must be erased for compliance with a legal obligation under Union or Hungarian law to which the Data Controller is subject.

Please note that personal data cannot be erased if processing is necessary for compliance with a legal obligation, for performance of a retention period prescribed by law, or for the establishment, exercise, or defense of legal claims.

Right to Restriction of Processing

The data subject has the right to obtain from the Data Controller restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by the data subject, for a period enabling the Data Controller to verify the accuracy of the personal data;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the Data Controller no longer needs the personal data for the purposes of processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims; or
• the data subject has objected to processing, pending verification whether the legitimate grounds of the Data Controller override those of the data subject.

Where processing has been restricted as above, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. The Data Controller shall communicate any rectification, erasure, or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.

Right to Data Portability

The data subject has the right to receive the personal data concerning him or her, which he or she has provided to the Data Controller, in a structured, commonly used and machine-readable format, and has the right to transmit those data to another controller without hindrance from the Data Controller, if the processing is based on consent and processing is carried out by automated means. In exercising the right to data portability, the data subject has the right to have personal data transmitted directly from one controller to another, where technically feasible. The exercise of this right shall be without prejudice to the right to erasure. This right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller. The right shall not adversely affect the rights and freedoms of others.

Right to Object

The data subject has the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her based on legitimate interest, or if processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller, including profiling based on those provisions. In such case, the Data Controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds for processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.

Right to Object to Automated Individual Decision-Making

The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. This provision shall not apply if the decision:

• is necessary for entering into, or performance of, a contract between the data subject and the Data Controller;
• is authorized by Union or Member State law to which the Data Controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or
• is based on the data subject’s explicit consent.

The Data Controller is obliged to implement suitable measures to safeguard the data subject’s rights, including at least the right to obtain human intervention on the part of the controller, to express his or her point of view, and to contest the decision.

Right to Lodge a Complaint and Judicial Remedy

You have the right to lodge a complaint regarding data processing with the National Authority for Data Protection and Freedom of Information (NAIH) as supervisory authority, or to initiate civil court proceedings directly against the Data Controller before the competent Regional Court.

Proceedings may be initiated—at the choice of the data subject—before the Regional Court competent according to the data subject’s place of residence or place of stay. A person who otherwise lacks legal capacity to be a party to litigation may also be a party to the lawsuit. The supervisory authority may intervene in the lawsuit in favor of the data subject’s success.

Prior to lodging a complaint or initiating potential civil litigation, however, it may be expedient for the data subject to report their grievance directly to the Data Controller via an informal request sent to any of the contact details specified in this Notice.

9. Final Provisions

The Data Controller does not verify personal data provided to it. The user is solely responsible for the accuracy and up-to-date nature of the provided data. If the data subject provides personal data of a third party instead of their own, they are obliged to have an appropriate legal basis to do so.

Personal data of a data subject under the age of 16 may only be processed with the consent of an adult exercising parental authority over them. The Data Controller is not in a position to verify the authorization or the content of the declaration of the consenting person; thus, the user or the person exercising parental authority guarantees that the consent complies with applicable law. In the absence of a consent statement, the Data Controller does not collect personal data relating to a data subject under 16 years of age—with the exception of the IP address used when consuming the service, which is recorded automatically due to the nature of internet services.

Effective as of: October 26, 2026