Privacy Notice

Name and contact details of the Data Controller

• Name: CSB IT Hosting & Consulting BT.
• Registered office: 9985 Felsőszölnök, Hármashatár út 33.
• Email address: info@awh.hu
• Website: csb-it.hu
• Website: awh.hu
• Tax number: 27834866-2-18

Hereinafter, the service provider ‘aWh’ shall be referred to as: the Data Controller.

Contents of the Privacy Notice

The purpose of this Privacy Notice (hereinafter the ‘Privacy Notice’) is to ensure that the Customer is aware of which of their personal data the Data Controller collects, how and for what purposes it is collected and used, and how the Data Controller ensures the protection of their personal data. The Data Controller is committed to protecting and safeguarding the Customer’s personal data. This Privacy Notice sets out the Data Controller’s contact details, the scope of the personal data it processes, the purposes for which it processes personal data, the legal basis for such processing, the methods and duration of data processing, data protection and data security requirements, as well as the rights to which the Customer is entitled regarding the protection of their personal data and the means of enforcing those rights. This Privacy Notice applies only to the processing of personal data relating to natural persons. This Privacy Notice is written in Hungarian.

What is personal data?

Personal data means any information or set of information relating to the Customer as a natural person, on the basis of which the Customer can be identified either directly (e.g. by name) or indirectly (e.g. by means of a unique personal identifier). The Customer’s personal data may include, for example: the Customer’s first name and surname, address, email address, IP address or the MAC address of their mobile device, or cookie identifiers (i.e. cookies) stored on the Customer’s devices.

If you are under 18 years of age

Those under the age of 18 cannot order our services independently. If you would like to use our server or email services, please ask your parent to help you! A message appears on our website asking for your consent to the cookies we use. If you are under 16 years of age, please do not give your consent on your own; instead, ask your parent to read the information below and help you use the website.

For parents

The Data Controller’s services may be used independently by private individuals aged 18 or over. Therefore, if the Data Controller requests data in order to process an order for its services, in the case of a Customer under the age of 18, it shall request the data and declarations from the parent. Before browsing the Website, you may also consent to the use of cookies. Persons under the age of 16 may not independently consent to data processing. In such cases, the Data Controller will request consent from the parent. The parent’s (or legal representative’s) consent also entails assuming full responsibility for the child’s user activity. This section also applies to persons under guardianship whose legal capacity to act is restricted with regard to the processing of personal data.

Whose personal data does the Data Controller process?

The Data Controller hereinafter refers to those whose personal data it processes in connection with the Website or its services as ‘CUSTOMERS’ (or, where applicable, ‘data subjects’), regardless of whether a service contract exists between them.

Registered Customer: Users may register on the Website on a one-off basis in a single manner (hereinafter referred to as ‘Registration’). Users who have successfully completed Registration shall hereinafter be referred to as ‘Customers’. The personal data provided by the Customer during Registration or collected by the Data Controller shall be processed by the Data Controller in accordance with this Privacy Notice.

Customer ordering the service: it is possible to order server and email services from the Data Controller via the Website, or outside it, on paper, by email or by other means (‘Order’). The person placing the Order or their representative shall hereinafter be referred to as the Customer. The Data Controller shall process any personal data provided by the Customer during the Order process or collected by the Data Controller in accordance with this Privacy Notice.

Unregistered Customer: users browsing the Website without having registered or placed an order shall hereinafter also be referred to as ‘Customers’, and the provisions of this Privacy Notice shall also apply to the processing of their personal data.

Special rules:

• The Customer must indicate, before browsing, which cookies they consent to
• Upon Registration and when placing an Order, the Customer must provide the necessary data and
• You must declare that you have read, familiarised yourself with and understood this Privacy Notice, and furthermore
• You must declare that you accept the Website’s General Terms and Conditions as binding upon yourself
• The Customer may only place an Order independently if they are aged 18 or over.

Acceptance of the Privacy Notice

By using the Website, the Customer confirms that they have read this Privacy Notice in full, are familiar with its contents and have understood it, and that they consent to the Data Controller processing their data in accordance with this Privacy Notice. If the Customer does not agree with the provisions of this Privacy Notice, please do not use the Website.

When the Customer decides to tick the box on the relevant interface (or, in the case of a paper-based contract, to sign) confirming that they have read the Privacy Notice and understood its contents, the Customer thereby accepts the Data Controller’s processing of data in accordance with this Privacy Notice. If the Customer does not agree with the provisions set out in the Privacy Notice, please do not tick the box (or sign) on the relevant interface to accept the Privacy Notice!

Amendment to the Privacy Notice

The Data Controller may unilaterally amend this Privacy Notice. Should the Data Controller’s range of services expand in the future, and should the introduction of new services result in any changes to the collection or use of personal data, the Data Controller will provide the Customer with further information in this regard. Unless otherwise stated, this Privacy Notice shall also apply to any new or additional services. Should this Privacy Notice be amended, the Data Controller shall publish the current Privacy Notice on the Website; furthermore, if the Customer is a registered Customer and/or their email address is available to the Data Controller for the relevant purpose, the Data Controller shall also send it to the email address provided by the Customer. To ensure that the Customer is aware of any changes or amendments, it is recommended that they regularly check the Website and the email address provided to the Data Controller.

Scope of personal data processed, purpose of data processing, legal basis and duration

The processing of personal data by the Data Controller is primarily based on the fulfilment of the Customer’s order for services, as a contract, or on the Customer’s consent (e.g. when the Customer consents to the use of cookies). In some cases, the Data Controller also processes personal data in accordance with legislation (e.g. accounting obligations). Below you will find a summary table providing important information on how the Data Controller collects the Customer’s personal data, what types of data are collected and how they are used, the legal basis for data processing, and how long the Customer’s personal data are retained in relation to each data processing purpose.

The Data Controller hereby informs the Customer that, in the course of data processing, it also engages data processors with whom it has a contractual relationship to carry out its activities. In some cases, the Data Controller may also transfer the Customer’s personal data to other data controllers. In the event of the enforcement of a legal claim by the Customer, the Data Controller or a third party, the Data Controller may transfer data primarily to the court with jurisdiction and competence, or to other public authorities (investigating authorities, law enforcement agencies, notaries, the National Tax and Customs Administration, etc.), or in response to a request from a court or other authority. Payment for our services may be made via independent data controllers, payment service providers or banks; in such cases, the Data Controller does not disclose any data to anyone, as the Customer provides this information directly to the service provider handling the payment.

The scope of the data transferred shall in all cases refer to the personal data specified for the data processing operation in question. Should the data concerned by the data processors’ activities or the scope of the personal data transferred differ from this, the Data Controller shall indicate this separately for each data processing operation. Recipients of personal data as described above are subject to confidentiality and data protection obligations.

The Data Controller reserves the right to assign its outstanding claims to a third party by way of assignment, in accordance with the provisions of the Civil Code. Assignment results in a change of the entitled party. In the event of assignment, the Data Controller shall transfer the data relating to the assigned claim to the person who, by virtue of the assignment, holds the position of the entitled party.

Pursuant to Section 5(5) of the Information Act, the Data Controller shall review the necessity of data processing carried out in fulfilment of a legal obligation every three years – provided that the relevant legislation does not specify a data retention period or any other review period for the Data Controller. Pursuant to the same statutory provision, the Data Controller shall retain documentation detailing the circumstances and outcome of the review for a period of ten years following the completion of the review.

Details of data processing

Registration

For what purposes does the Data Controller process personal data?

The Data Controller collects and processes the data of Customers registering on the Website in order to create and maintain a user account for the Customer. The Data Controller also processes the data for the purposes of identifying the Customer and establishing and maintaining contact, as well as for the purpose of sending information regarding changes relating to its services, affecting the content, quality and availability of the service, and for the purpose of carrying out data updates.

Which of your personal data does the Data Controller process?	On what basis does the Data Controller process this personal data (legal grounds)?	For how long does the Data Controller process this personal data (duration of data processing)?
Name, Telephone number, Email address, Address	The Customer’s consent. (Article 6(1)(a) of the GDPR)	The Data Controller will process your personal data until you withdraw your consent. You can also delete your registration via your user account.

Ordering a service

Ordering domain name registration and maintenance

Payment and invoicing

For what purposes does the Data Controller process personal data?

The Data Controller processes the following personal data of Customers ordering the service or otherwise affected by it for the purposes of documenting the purchase and payment, issuing invoices for the purchase or use of the service, and fulfilling the Data Controller’s accounting obligations.

Which of your personal data does the Data Controller process?	On what basis does the Data Controller process this personal data (legal grounds)?	For how long does the Data Controller process this personal data (duration of data processing)?
Name, Address	Data processing relating to documents supporting accounting records: Compliance with a legal obligation (Article 6(1)(c) of the GDPR) on the basis of Section 169(1) and (2) of the Accounting Act and Section 159(1) and (2) of the VAT Act. The legal basis for processing data beyond the data in the documents supporting accounting records, in the case of a private individual ordering party, is the performance of the contract between the ordering party and the Data Controller (Article 6(1)(b) of the GDPR). The contract is the General Terms and Conditions concluded with the ordering party for the use of the services, or the taking of steps at the ordering party’s request before concluding the General Terms and Conditions. The legal basis for processing contact person and representative data (in the case of a corporate ordering party) is the legitimate interest of the party ordering the service (Article 6(1)(f) of the GDPR). The Data Controller processes the data to ensure rapid and interactive communication, as well as the efficient processing and fulfilment of the Order. Having weighed up the Customer’s interests, rights and freedoms regarding the free disposal of their personal data, the Data Controller concludes that the processing of the data is necessary for the processing and fulfilment of the Order. The Data Controller has chosen the measures involving the least restriction, whilst also taking cost-effectiveness into account. The Data Controller ensures appropriate data security measures and the right to object for the Customer, as required by the GDPR. The Customer may therefore object at any time to the processing of data based on legitimate interests.	Accounting documents directly and indirectly supporting the accounting records shall be retained by the Data Controller for 8 years from the date of issue, in accordance with Section 169(2) of the Accounting Act. Data processing commences when the first personal data are provided to the Data Controller during the initial contact prior to the conclusion of the contract (Order), for the purpose of concluding the contract (Order). The Data Controller shall also retain contact details processed for the performance of the contract and on the basis of legitimate interest until the above deadline, where they are data appearing on accounting documents. Personal data processed for the performance of the contract that do not qualify as documents supporting accounting records shall be retained by the Data Controller, for the settlement of any legal disputes, until the end of the civil law limitation period calculated from the fulfilment of the Order or the exercise of the warranty, which is expected to be 5 years; after this period the data are deleted. Data processed on the basis of legitimate interest that appear on documents not supporting accounting records shall be processed by the Data Controller for as long as the interest subsists or until the Customer’s objection has been assessed, unless the Data Controller’s legitimate interest permits further processing.

Rendering electronic data inaccessible or restoring it

For what purposes does the Data Controller process personal data?

The Data Controller processes the data of data subjects affected by the relevant decision during criminal proceedings for the purpose of implementing the provisions set out in the court’s decision concerning the making electronic data inaccessible or restoring it, and in order to comply with a legal obligation.

Which of your personal data does the Data Controller process?	On what basis does the Data Controller process this personal data (legal grounds)?	For how long does the Data Controller process this personal data (duration of data processing)?
Personal data contained in the court decision: - name and position of the person making the decision - the personal data that must be made inaccessible or restored - the data of the Customer whom the Data Controller is obliged to inform of the making inaccessible or restoration	Compliance with a legal obligation (Article 6(1)(c) of the GDPR) pursuant to Section 12/A of Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services	The Data Controller shall retain the decision (and thus the personal data contained therein) until the end of the limitation period (which is generally 5 years). The Data Controller shall also retain the document or record proving that the data has been made inaccessible or restored until the end of the limitation period (which is generally 5 years).

Access to data, data security measures

The Data Controller shall do everything in its power to ensure the security of the Customer’s personal data in accordance with Article 32 of the GDPR. Furthermore, the Data Controller shall take the necessary technical and organisational measures and establish the procedural rules required to comply with the provisions of the GDPR and other data protection and confidentiality regulations.

The Data Controller guarantees an appropriate level of data security in the following ways:

• stores the Customer’s data in a secure technical environment and makes it accessible only to authorised persons (our staff, following appropriate identification),
• When processing website data, it uses the https protocol, meaning that communication between the Customer and the server takes place via an encrypted connection,
• Natural persons with access to personal data may process such data only in accordance with the Data Controller’s instructions,
• protects the Customer’s data from unauthorised access and, to this end, implements security measures,
• when transferring data, [specify encryption or other measures],
• Our security measures are regularly tested, assessed and improved on a quarterly basis

Data incident: Should a data incident involving the Customer’s data occur, the Data Controller shall, upon becoming aware of it, take all necessary measures to mitigate the risks. Should an incident occur involving the Customer’s data which, despite the protective measures taken by the Data Controller (or its data processor), is likely to result in a high risk to the Customer’s rights and freedoms, we shall inform the Customer and the competent authority of this incident without delay and free of charge.

Links to other websites, social media sites

Where, for the convenience of the Customer and to provide them with more comprehensive information, the Data Controller has placed links or icons on the Website pointing to other websites or social media pages, it hereby informs the Customer that these websites operate independently of the Data Controller, have their own privacy policies, and the Data Controller has no influence over the data processing carried out by these websites. It further recommends that the Customer reads the privacy policies of the linked websites when visiting them. The Data Controller accepts no liability whatsoever for the content of the linked websites, their use or their privacy policies, except where the linked website is also operated by the Data Controller.

Data transfers to third countries

Personal data may be transferred to a third country if that third country ensures an adequate level of protection. No separate authorisation is required for such data transfers.

In the absence of an adequacy decision, data transfers are permitted if they are necessary for the performance of a contract between the data subject and the Data Controller, or for the implementation of pre-contractual measures taken at the data subject’s request, and furthermore if they are necessary for the establishment, exercise or defence of legal claims.

Data is currently transferred to the following data controllers and data processors in the following third countries outside the EU for the following purposes:

Name, registered office and country of the data processor (or its categories)	Decision on adequacy – pursuant to Article 45(1) of the GDPR	Purpose of data transfer, data transmission and data processing
None	None	None

Recipients of personal data as described above are subject to confidentiality and data protection obligations.

Cookies

An anonymous user identifier (cookie) is a unique string of characters – suitable for identification or for storing profile information – which service providers place on the Customer’s computer. It is important to note that such a string of characters is in no way capable of identifying the Customer on its own; it is only suitable for recognising the Customer’s computer. In the world of the internet, personalised information and tailored services can only be provided if service providers are able to individually identify their customers’ habits and needs. Service providers resort to anonymous identification so that, on the one hand, they can learn more about their customers’ information usage habits with a view to further improving the standard of their services and, on the other hand, to offer their customers personalised options.

Disabling cookies: If the Customer does not wish such identifiers to be placed on their computer, they may configure their browser to prevent the placement of unique identifiers, or to permit only the placement of certain unique identifiers; in which case, however, the Customer may not be able to access certain Services, or may not be able to access them in the same way as if they had permitted the placement of identifiers.

The cookies used on the website are as follows

Type of cookie	Validity	Type	Why we use it	Classification
N	N	N	N	N

Profiling

Google Analytics

The Website uses the Google Analytics service.

Google’s information on the service: The Data Controller measures the Website’s traffic data using the Google Analytics web analytics service provided by Google LLC (‘Google’). Google Analytics compiles reports on user interactions on Google Analytics clients’ websites, primarily based on first-party cookies. The advertising features of Google Analytics can be activated using Google advertising cookies – for example, remarketing – for products on the Google Display Network such as AdWords. Information on privacy settings and disabling cookies can be found here: https://support.google.com/analytics/answer/6004245?hl=en. Every computer and device connected to the internet is assigned a unique number, known as an IP address (Internet Protocol address). These numbers are allocated in blocks by country; an IP address can often be used to identify the country, state/county and city from which the computer is connecting to the internet. As websites use IP addresses due to the way the internet works, website owners can identify their users’ IP addresses even if they do not use the Google Analytics service. However, Google Analytics collects the IP addresses of website users solely to safeguard the security of the service and to enable website owners to gain an understanding of the geographical regions from which their visitors originate (this is also known as ‘IP-based geolocation’). Google stores the data in a performance-optimised, encoded format rather than in traditional file systems or databases. To make access more difficult and to ensure redundancy, the data is distributed across multiple physical and logical volumes to prevent data misuse. Google’s applications run in a distributed environment. It does not keep individual customers’ data isolated on a single machine or group of machines, but instead stores the data of all Google customers (individuals, businesses and even Google’s own data) in a mixed manner, distributed across a shared infrastructure comprising numerous homogeneous machines located in Google’s data centres. Further information on Google’s privacy policy can be found here: policies.google.com/privacy?hl=en. You also have the option to opt out of Google Analytics tracking in future by downloading the Google Analytics Opt-out Browser Add-on and installing it in your current browser: tools.google.com/dlpage/gaoptout.

Ahrefs Analytics

The Data Controller also measures the Website’s traffic data using the Ahrefs Web Analytics service provided by Ahrefs Pte. Ltd. (16 Raffles Quay #33-03 Hong Leong Building, Singapore 048581, ‘Ahrefs’).

Ahrefs Web Analytics does not place cookies on the Customer’s device and does not use persistent identifiers. The service records the following data: the address of the page viewed (including URL parameters), the address of the referring page, the browser, operating system and device type, the browser language, screen size, as well as page views, link clicks and form submissions.

The service uses the Customer’s IP address solely to determine the country and city; it does not store the raw IP address either in its database or in its logs. To distinguish between visitors, it uses a one-way code (hash) generated from the IP address, the browser’s identification data (user agent) and a random value that is refreshed daily. The daily random value is deleted after 24 hours, meaning that the same visitor cannot be identified on different days.

According to Ahrefs’ privacy policy, the data it collects is stored in the United States of America. Further information about the service can be found here: https://help.ahrefs.com/articles/10247870-about-ahrefs-web-analytics, and Ahrefs’ privacy policy here: https://ahrefs.com/legal/privacy-policy.

The customer’s rights and means of redress

Right of access

The Customer is entitled to receive confirmation as to whether their personal data is being processed; in this regard, they may request information on what data the Data Controller processes about the Customer, which categories of personal data this data falls under, for what purposes and for how long it is processed, and to whom it is disclosed (categories of recipients, including in particular recipients outside the European Union). Within the scope of this right, the Customer may also be informed of their rights in relation to data processing; in particular, they may request the erasure of their data, the restriction of its processing, the rectification of their personal data, and may object to the processing of their personal data. The Customer also has the right in this regard to lodge a complaint with the supervisory authority (National Authority for Data Protection and Freedom of Information). If the data was not provided by the Customer, they may also request information regarding the source of the data.

Right of rectification

If the Customer’s data changes or has been recorded incorrectly by the Data Controller, the Customer may request that their data be rectified, corrected or clarified. If their data has been recorded incompletely, the Customer may also request that it be supplemented by means of a supplementary statement in this regard.

Right to erasure

The Customer may request that the Data Controller erase their personal data under the following conditions:

• the personal data is no longer necessary for the purpose for which it was collected or processed
• the Customer withdraws their consent, which forms the basis for data processing, and there is no other legal basis for data processing
• the Customer objects to the processing of their data, and there is no overriding legitimate ground for the processing
• the Data Controller processed personal data unlawfully
• The data must be deleted in order to comply with the legal obligation
• in relation to services offered directly to children.

Where the Data Controller has made the personal data public, it shall take the measures that may reasonably be expected of it to inform other data controllers processing the data that the Customer has requested the deletion of links to the personal data in question, or of copies or duplicates of such personal data.

The Data Controller draws the attention of Customers to the fact that it will not be able to comply with a request for erasure if the data is necessary for the establishment, exercise or defence of legal claims, or if doing so would restrict the freedom of expression or the right to information, or if a legal obligation applicable to the Data Controller (or a public interest, scientific, research or statistical purpose) imposes an obligation on the Data Controller that conflicts with the erasure request.

Right to restriction of processing

In the following cases, the Customer may request that the Data Controller restrict the processing of data:

• if the Customer considers the data to be inaccurate, in which case the restriction applies for the period during which the Data Controller verifies the accuracy of the personal data
• the processing of personal data is unlawful, but the Customer objects to the erasure of the data and instead requests that its use be restricted
• the Data Controller no longer requires the personal data, but the Customer requires it for the purpose of establishing, exercising or defending legal claims
• if the Customer objects to the processing of data, in which case the restriction shall apply for as long as it has not been established whether the Data Controller’s legitimate grounds take precedence over the Customer’s legitimate grounds

Where data processing is subject to restrictions, personal data may only be processed – with the exception of storage – with the data subject’s consent, or for the purpose of establishing, exercising or defending legal claims, or for the protection of the rights of another natural or legal person, or for reasons of substantial public interest of the Union or of a Member State.

The Data Controller shall inform all those to whom it has disclosed personal data of any rectification, erasure or restriction of processing, unless this is impossible or would involve a disproportionate effort. The Customer may, upon request, obtain a list of such recipients.

Right to data portability

The Customer has the right to receive their personal data processed by the Data Controller, to transfer this data to another data controller, or to instruct the Data Controller to transfer it to another data controller designated by the Customer, provided that the data processing is based on the Customer’s consent or the performance of a contract and is carried out by automated means. Such transfer must not infringe the rights and freedoms of others, or the right to erasure (the right to be forgotten).

Right to object

Where the processing of the Customer’s data is based on the legitimate interests of the Data Controller or a third party, or is carried out in the public interest or in the exercise of official authority, the Customer may object specifically to such processing, including profiling. The Data Controller carries out profiling in accordance with the provisions set out in the section entitled ‘PROFILING’ above. In the event of an objection, the Data Controller shall no longer process the personal data to which the objection relates, unless the processing is justified by compelling legitimate grounds which take precedence over the Customer’s interests, rights and freedoms, or which are necessary for the establishment, exercise or defence of legal claims. Where the processing of your personal data is carried out for the purposes of direct marketing, you have the right to object at any time to the processing of your personal data for this purpose, including profiling, and the Data Controller may no longer process the data following such an objection.

Right to withdraw consent

The Customer is entitled to withdraw their consent at any time. The withdrawal of consent does not affect the lawfulness of any data processing carried out on the basis of that consent prior to the withdrawal.

Exercising rights relating to personal data following the data subject’s death

Within five years of the data subject’s death, the person authorised by the data subject by an administrative disposition or by a declaration made to the Data Controller in a public document or a private document of full probative value, is entitled to exercise the following rights in relation to the deceased person’s data: access, rectification, erasure, restriction and objection. If the data subject has made more than one declaration, the rights may be exercised on the basis of the declaration made at the later date. If the data subject has not made an administrative disposition or submitted a relevant declaration to the Data Controller, then, in accordance with the Civil Code, the closest relative who first comes forward to the Data Controller is entitled to request rectification or to object to the processing of data, and – if the data processing was already unlawful during the data subject’s lifetime or the purpose of the data processing ceased upon the data subject’s death – they have the right to request the erasure or restriction of the deceased’s data within five years of the data subject’s death. The Data Controller shall, upon request, inform close relatives of the measures taken, unless the data subject has prohibited this.

The person exercising the data subject’s rights must prove to the Data Controller, in accordance with statutory requirements, the fact and date of the data subject’s death by means of a death certificate or a court order, as well as their own identity and their status as a close relative by means of an official document.

The Data Controller’s procedures to ensure the above rights

The Data Controller shall inform the Customer, without undue delay and in any event within one month of receipt of the request, of the measures taken in response to the request, or of the reasons for failing to take such measures. If the request is complex or a large number of requests are received, the deadline may be extended by a further two months. The information shall be provided electronically where possible. The provision of information and the taking of action shall be free of charge, except in the case of requests that are manifestly unfounded or excessive, in particular due to their repetitive nature. In such cases, it will charge a reasonable fee or refuse to take the requested action. In connection with the request, the Data Controller may ask the Customer to provide the information necessary to verify their identity. A copy of the Customer’s personal data processed by the Data Controller is also free of charge on the first occasion; for any further copies, the Data Controller will charge a fee equivalent to the administrative costs.

The Customer is entitled to the following rights and remedies in relation to the processing of their personal data by the Data Controller:

1. Right to complain
2. Right to judicial redress
3. Right to compensation

The Customer may enforce their rights under the GDPR and the Civil Code (Ptk.).

Right to complain

The Customer is entitled to lodge a complaint with the supervisory authority regarding data processing if they believe that data processing is not being carried out in accordance with the law. The supervisory authority in Hungary is the National Authority for Data Protection and Freedom of Information, whose registered office is at 1024 Budapest, Szilágyi Erzsébet fasor 22/C, website: www.naih.hu, telephone number: +36 (1) 391-1400.

Right to take legal action

The Customer has the right to bring a matter before a court:

• against a binding decision by the supervisory authority concerning the Customer
• in the event that the supervisory authority fails to deal with a complaint submitted by the Customer, rejects a complaint which the Customer considers to be justified, or fails to inform the Customer at all within three (3) months of the progress of the complaint or its outcome
• where, following a request from the Customer, the Data Controller does not take action without delay, but at the latest within one month of receipt of the request
• Without prejudice to their right to lodge a complaint, they may bring the matter before a court if they consider that their rights under the Regulation have been infringed as a result of data processing that does not comply with the rules of the GDPR.

Hungarian courts have jurisdiction over proceedings brought against the supervisory authority; proceedings against the Data Controller may also be brought before the court with jurisdiction over the Data Controller’s registered office or the court with jurisdiction over the Customer’s place of residence or habitual residence.

Right to compensation

Where the Customer has suffered pecuniary or non-pecuniary damage (compensation for non-pecuniary damage) as a result of a breach of the GDPR, they are entitled to compensation for the damage suffered from the Data Controller or the data processor. The Data Controller or the data processor shall be exempt from liability if they can prove that they bear no responsibility whatsoever for the event giving rise to the damage. Such proceedings may be brought before the court having jurisdiction over the Data Controller’s registered office or before the court having jurisdiction over the Customer’s place of residence or habitual residence.

The Data Controller hereby informs Customers that, as a general rule, these property law disputes may be brought before the regional court; this also includes actions for damages or compensation for injury arising from the exercise of public authority. Notwithstanding the general rule, property law proceedings where the value of the subject matter does not exceed thirty million forints, or where the value of the claim cannot be determined, fall within the jurisdiction of the district court.

Legislation forming the basis for data processing

• REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (‘GDPR’)
• Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (‘Information Act’)
• Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services (‘Eker Act’)
• Act V of 2013 on the Civil Code (‘Ptk.’)

Applicable law and other provisions

This Privacy Notice is governed by Hungarian law.

Where the legislation in force in the Customer’s country imposes stricter rules on the parties than those set out in this Privacy Notice, the Customer shall be obliged to comply with them. However, the Customer acknowledges and accepts that the Data Controller’s liability is based on the legislation governing this Privacy Notice, and that the Data Controller excludes its liability to the fullest extent possible under the relevant legislation and court rulings for any failure to comply with the provisions applicable in the Customer’s country.

The section headings in this Privacy Notice are for information purposes only and are not, in themselves, sufficient to understand the data processing activities.