Data Controller
fiREG.hu Kft.
Privacy Notice
Introduction
fiREG.hu Kft. (registered seat: 9444 Fertőszentmiklós, Petőfi Sándor utca 44., tax number: 26112376-2-08, company registration / registry number: 08 09 029321) (hereinafter: Service Provider, Data Controller) submits itself to the following policy:
In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, “GDPR”) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, we provide the following information.
This privacy policy governs data processing on the following website / mobile application: https://www.fiREG.hu
The privacy notice is available at: https://fireg.hu/adatvedelmi-tajekoztato (also currently there).
Amendments to this policy enter into force upon publication at the above address.
Controller and contact details
- Name: fiREG.hu Kft.
- Registered seat: 9444 Fertőszentmiklós, Petőfi Sándor utca 44.
- E-mail: info@fiREG.hu
- Phone: +36 99 200 487
Definitions
“personal data”: any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
“processing”: any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
“controller”: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
“processor”: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
“recipient”: a natural or legal person, public authority, agency or another body to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing.
“consent of the data subject”: any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
“personal data breach”: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.
“profiling”: any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
Principles Relating to Processing of Personal Data
Personal data shall be:
- processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);
- collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered incompatible with the initial purposes (“purpose limitation”);
- adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”);
- accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (“accuracy”);
- kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as they will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1), subject to implementation of appropriate technical and organisational measures required by the GDPR in order to safeguard the rights and freedoms of the data subject (“storage limitation”);
- processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (“integrity and confidentiality”).
The controller is responsible for, and must be able to demonstrate, compliance with the above (“accountability”).
The controller declares that its data processing is carried out in accordance with the principles set out in this section.
Registration (Creating a User Account)
1. Facts of data collection, scope of processed data, purposes and legal bases
| Personal data | Purpose of processing | Legal basis |
|---|---|---|
| Surname, given name | Identification; enables secure login to the user account. | GDPR Article 6(1)(a) and (b). |
| E-mail address | Contact; sending system messages; login to the user account. | GDPR Article 6(1)(a) and (b). |
| Password | Enables secure login to the user account. | GDPR Article 6(1)(a) and (b). |
| Time of registration | Performing a technical operation. | GDPR Article 6(1)(a) and (b). |
| IP address at the time of registration | Performing a technical operation. | GDPR Article 6(1)(a) and (b). |
2. Data subjects
All data subjects registered on the website / in the app.
3. Storage period and deadline for erasure
If one of the conditions set out in GDPR Article 17(1) applies, processing lasts until the data subject’s request for erasure. Upon deletion of the registration, personal data are erased immediately. The controller informs the data subject electronically about the erasure of any personal data provided by the data subject pursuant to GDPR Article 19. If the data subject’s erasure request also covers the e-mail address provided, the controller will delete the e-mail address after providing the information.
4. Persons entitled to access the data; recipients
Personal data may be processed by the controller’s authorised employees in accordance with this notice.
5–6. Data subject rights and how to exercise them
The data subject may request from the controller access to personal data relating to them, rectification, erasure or restriction of processing; the data subject has the right to data portability and to withdraw consent at any time.
The data subject may initiate access, erasure, modification, restriction, or portability as follows:
- by post: 9444 Fertőszentmiklós, Petőfi Sándor utca 44.
- by e-mail: info@fiREG.hu
- by phone: +36 99 200 487
7. Legal basis
GDPR Article 6(1)(a) and (b).
8. Information
- Processing is based on your consent and/or is necessary to take steps at your request prior to entering into a contract.
- You must provide the personal data in order to register.
- If you do not provide the data, we cannot create the user account.
Data Processing Related to Using the Service
Facts of data collection, scope of processed data, purposes and legal bases
| Personal data | Purpose of processing | Legal basis |
|---|---|---|
| Surname and given name (site contact person’s name) | Necessary for contacting, using the service, and issuing a lawful invoice. | GDPR Article 6(1)(b) and Act CVIII of 2001 (Elker Act) Section 13/A(3). |
| E-mail address, phone number (user and site contact details) | Contact. | GDPR Article 6(1)(b). |
| Password | Enables secure login to the user account. | GDPR Article 6(1)(b). |
| Billing name and address | Issuing lawful invoices; creating, defining content, modifying, and performing the contract; tracking performance; billing fees; enforcing claims. | GDPR Article 6(1)(c) and Act C of 2000 on Accounting, Section 169(2). |
| Professional qualification exam (trade certificate) | Needed to check certain permissions by viewing the trade qualification of experts assigned by the maintenance company. | GDPR Article 6(1)(b). |
| Content of shared folders (if they contain personal data) | Data sharing. | GDPR Article 6(1)(b). |
| Visitor access | Providing a visitor user account in the system. | GDPR Article 6(1)(b). |
| Maintenance person’s name | Use of e-sticker. | GDPR Article 6(1)(b). |
2. Data subjects
All data subjects using the service on the website / in the application.
3. Storage period and deadline for erasure
If one of the conditions set out in GDPR Article 17(1) applies, processing lasts until the data subject’s request for erasure. The controller informs the data subject electronically about erasure pursuant to GDPR Article 19. If the erasure request also covers the e-mail address, the controller deletes the e-mail address after providing the information.
Exception: accounting documents must be retained for 8 years under Act C of 2000 on Accounting, Section 169(2). Contract-related data may be erased upon the data subject’s request after expiry of the civil-law limitation period.
Accounting records supporting bookkeeping (including general ledger accounts and analytical/detailed registers) must be kept in a readable form for at least 8 years, and must be retrievable based on bookkeeping references.
4. Persons entitled to access the data; recipients
Personal data may be processed by the controller’s sales and marketing staff, while respecting the principles above.
5–6. Data subject rights and how to exercise them
The data subject may request access, rectification, erasure or restriction; has the right to data portability and to withdraw consent at any time.
- by post: 9444 Fertőszentmiklós, Petőfi Sándor utca 44.
- by e-mail: info@fiREG.hu
- by phone: +36 99 200 487
7. Legal bases
7.1 GDPR Article 6(1)(b) and (c).
7.2 Act CVIII of 2001 (Elker Act) Section 13/A(3) (technical necessity for service provision).
7.3 Issuing invoices in compliance with accounting law: GDPR Article 6(1)(c).
7.4 Enforcement of contractual claims: limitation period of 5 years under Act V of 2013 (Civil Code), Section 6:21 and 6:22.
8. Information
- Processing is necessary for performance of the contract.
- You must provide the personal data so we can provide the service.
- If you do not provide the data, we cannot provide the service or perform the contract.
Contact
Facts of data collection, scope of processed data, purpose and legal basis
| Personal data | Purpose of processing | Legal basis |
|---|---|---|
| Name | Identification | GDPR Article 6(1)(a) |
| E-mail address | Contact; sending replies | GDPR Article 6(1)(a) |
| Phone number | Contact | GDPR Article 6(1)(a) |
| Message content (if it contains personal data) | Necessary to respond | GDPR Article 6(1)(a) |
For an e-mail address, it is not necessary that it contain personal data.
2. Data subjects
All data subjects who send a message via the contact form.
3. Storage period
The controller processes personal data until the purpose is achieved, but for a maximum of 2 years. If one of the conditions in GDPR Article 17(1) applies, processing continues until the data subject’s request for erasure.
4–6. Rights and legal basis
Legal basis: consent of the data subject, GDPR Article 6(1)(a). If you contact us, you consent that we process the personal data provided during the contact (name, phone number, e-mail address) in accordance with this policy.
7. Information
- This processing is based on your consent and is necessary for providing an offer/quotation.
- You must provide the personal data in order to contact us.
- If you do not provide the data, you cannot contact the controller.
- Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
Customer Relationship
1. Facts of data collection, scope of processed data, purpose and legal basis
| Personal data | Purpose of processing | Legal basis |
|---|---|---|
| Name, e-mail address, phone number | Contact, identification, performance of contracts, business purpose. | GDPR Article 6(1)(b) |
2–4. Data subjects, storage period, recipients
Data subjects: all persons who keep contact with the controller by phone/e-mail/in person, or are in a contractual relationship.
Storage period: correspondence is retained until the data subject’s erasure request, but for a maximum of 2 years.
Recipients: authorised employees of the controller, respecting the principles above.
5–7. Rights and information
The data subject may request access, rectification, erasure, restriction; has data portability and may withdraw consent at any time.
- Processing is necessary for performance of the contract and for providing an offer.
- You must provide the personal data so we can perform the contract / fulfil your request.
- If you do not provide the data, we cannot perform the contract / process your request.
Newsletter and Direct Marketing Based on Consent
Under Section 6 of Act XLVIII of 2008 on the basic conditions and certain limitations of economic advertising activity, the User may give prior and explicit consent for the Service Provider to contact them with advertising offers and other mailings via the contact details provided during registration.
The Customer may also, taking this notice into account, consent to the processing of the personal data necessary for sending advertising offers.
The Service Provider does not send unsolicited advertising messages. The User may unsubscribe free of charge, without restriction and without providing reasons. In that case, the Service Provider deletes all personal data necessary for sending advertising messages from its records and will not contact the User with further advertising offers. The User can unsubscribe by clicking the link in the message.
Facts of data collection, scope of processed data, purpose and legal basis
| Personal data | Purpose of processing | Legal basis |
|---|---|---|
| Name, e-mail address | Identification; enabling subscription to newsletters/promotional coupons. | Consent of the data subject; GDPR Article 6(1)(a). |
| Time of subscription | Performing a technical operation. | Consent; GDPR Article 6(1)(a). |
| IP address at the time of subscription | Performing a technical operation. | Consent; GDPR Article 6(1)(a). |
Newsletter sending is performed in compliance with Act XLVIII of 2008.
Data subjects: all persons subscribing to the newsletter.
Purpose: sending electronic messages containing advertising (e-mail, SMS, push) and providing information about current news, products, promotions, new features, etc.
Storage period: until consent is withdrawn (unsubscribe / erasure request) or until the newsletter ends.
Information
- Processing is based on your consent.
- You must provide personal data if you wish to receive newsletters.
- If you do not provide the data, we cannot send newsletters to you.
- You can withdraw your consent at any time by clicking unsubscribe.
- Withdrawal does not affect the lawfulness of processing based on consent before withdrawal.
Google Ads Conversion Tracking
The controller uses the online advertising program called “Google Ads” and, within it, uses Google’s conversion tracking service. Google conversion tracking is an analytics service of Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; “Google”).
When a User reaches a website via a Google advertisement, a cookie required for conversion tracking is placed on the User’s computer. These cookies are valid for a limited time and do not contain personal data, so the User cannot be identified by them.
When the User browses certain pages and the cookie has not expired, both Google and the controller can see that the User clicked on the advertisement. Each Google Ads customer receives a different cookie, so they cannot be tracked across Ads customers’ websites.
The information obtained using conversion tracking cookies is used to create conversion statistics for Ads customers who choose conversion tracking. Customers learn how many users clicked on their ads and were redirected to a page with a conversion tracking tag. However, they do not gain information by which any user could be identified.
If you do not wish to participate in conversion tracking, you can refuse by disabling cookie installation in your browser. Then you will not appear in conversion tracking statistics.
Under Google Consent Mode v2, Google also uses two new cookie types: ad_user_data and ad_personalization, which are based on the data subject’s consent and relate to data usage and sharing. ad_user_data is used to capture consent for sharing user data with Google for advertising purposes. ad_personalization controls whether data may be used to personalise ads (e.g., remarketing). The controller ensures that appropriate consents are obtained and can be withdrawn via its cookie banner/panel. Withdrawal of consent does not affect the lawfulness of processing based on consent before withdrawal.
Further information and Google’s privacy policy are available at: https://policies.google.com/privacy
Google Analytics
This website uses Google Analytics, a web analytics service provided by Google Inc. (“Google”). Google Analytics uses so-called “cookies”, text files stored on your computer, to help analyse how users use the website.
The information generated by the cookies about your use of the website is generally transmitted to and stored on a Google server in the USA. By activating IP anonymisation on the website, Google shortens the User’s IP address within EU Member States or other states party to the EEA Agreement beforehand.
Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there. On behalf of the website operator, Google uses this information to evaluate your use of the website, compile reports on website activity for the operator, and provide other services related to website and internet usage.
The IP address transmitted by your browser within Google Analytics is not merged with other data held by Google. You can prevent the storage of cookies by adjusting your browser settings, but please note that in this case you may not be able to use all functions of this website fully.
You can also prevent Google from collecting and processing data generated by cookies relating to your use of the website (including your IP address) by downloading and installing the browser plugin available at: https://tools.google.com/dlpage/gaoptout?hl=hu
Cookies
- No prior consent is required for the use of cookies used for “password-protected sessions”, “shopping cart cookies”, “security cookies”, “strictly necessary cookies”, “functional cookies”, and “cookies responsible for managing website statistics”.
- Scope of data: unique identification number, dates, times.
- Data subjects: all visitors to the website.
- Purpose: user identification, tracking visitors, providing customised operation.
Storage periods
| Cookie type | Legal basis | Duration |
|---|---|---|
| Session cookies or other cookies strictly necessary for website operation | No data processing occurs through cookie use. | Until the visitor session ends, i.e., only until the browser is closed. |
| Statistical, marketing cookies | GDPR Article 6(1)(a) | 1 day–2 years (per cookie notice) or until consent is withdrawn. |
Data subjects may delete cookies in the Tools/Settings menu of browsers, usually under Privacy settings.
Most browsers allow you to set which cookies to store and to delete (certain) cookies. If you restrict cookie storage on certain websites or do not allow third-party cookies, this may, under certain circumstances, lead to our website no longer being fully usable.
Browser help links (as listed in the original)
- Google Chrome: https://support.google.com/chrome/answer/95647?hl=hu
- Microsoft Edge: https://support.microsoft.com/...
- Firefox: https://support.mozilla.org/hu/kb/sutik-engedelyezese-es-tiltasa-amit-weboldak-haszn
- Safari: https://support.apple.com/hu-hu/guide/safari/sfri11471/mac
Processors Used
Hosting provider
- Activity: hosting service
- Processor name and contact: fws online Kft., Registered seat: 9444 Fertőszentmiklós, Petőfi u. 44., E-mail: office@fws.hu
- Scope of data: all personal data provided by the data subject.
- Data subjects: all users of the website / mobile application.
- Purpose: making the website / mobile app available and ensuring proper operation.
- Storage period: until the agreement between controller and hosting provider ends, or until the data subject’s deletion request addressed to the hosting provider.
- Legal basis: GDPR Article 6(1)(c) and (f), and Act CVIII of 2001 (Elker Act) Section 13/A(3). Legitimate interest: proper operation of the website; protection against attacks and fraud.
Other processors (if any)
- Billingo
Billingo Technologies Zrt.
1133 Budapest, Árbóc utca 6., 3rd floor
E-mail: hello@billingo.hu - MailerLite Limited
38 Mount Street Upper, Dublin 2, D02 PR89, Ireland
E-mail: privacy@mailerlite.com
Social Media
Scope of data: registered name and public profile picture on Twitter/Pinterest/YouTube/Instagram/TikTok/LinkedIn, etc.
Data subjects: any data subject registered on the above social networks who “liked” the Service Provider’s page or contacted the controller via the social network.
Purpose: sharing/liking/following/promoting content elements, products, promotions, or the website itself.
Duration, recipients, rights: Information about the source of the data, their processing and transfer, and legal basis can be obtained on the given social media platform. Processing is carried out on the platforms; therefore, their rules apply to duration, method, and deletion/modification options.
Legal basis: the data subject’s voluntary consent on social media platforms.
Facebook / Meta joint controllership
The controller maintains a Facebook / Meta profile. Statistical processing on Facebook is a joint processing activity of the controller and Facebook Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland). Details are available in Facebook’s Page Insights Controller Addendum: https://www.facebook.com/legal/terms/page_controller_addendum
The controller communicates via private message on the social platform only if you contact us there.
1. Categories of data subjects
- data subject registered on the social platform and who liked the controller’s profile page;
- data subject who contacts the controller via private message on the social platform.
2. Purpose
The purpose is sharing and promoting the controller’s activity and services on Facebook. Data provided by the data subject in a private message may be used by the controller to respond. Otherwise, the controller does not collect data via social media platforms and does not extract data from them.
3. Legal basis
GDPR Article 6(1)(a): consent of the data subject on Facebook.
4. Scope of data
- registered name of the data subject;
- public profile picture;
- other public data shared by the data subject on the platform.
5. Source of personal data
The source is the data subject.
6. Withdrawal of consent
You may withdraw your consent at any time and may delete your post/comment. Processing takes place via platforms operated by third parties. If you withdraw consent, the controller deletes the conversation with you. Withdrawal does not affect lawfulness before withdrawal.
7. Duration
- until consent is withdrawn;
- if message exchange occurs: 2 years.
8. Transfers and recipients
The concept of “recipient” is defined in GDPR Article 4(9). The controller discloses personal data only in exceptional cases and on the basis of legal obligation to state bodies/authorities, in particular courts, prosecution offices, investigative authorities, administrative offence authorities, and the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).
9. Possible consequences of not providing data
If data are not provided, the data subject cannot obtain information about the controller’s activities/services via Facebook or send messages via Facebook Messenger.
10. Automated decision-making / profiling
No automated decision-making, including profiling, is carried out.
11. Joint controller agreement
Page Insights displays aggregated data helping to understand how the Facebook page is used. Facebook Ireland Limited and the controller are joint controllers for the processing of insights data. The Page Insights Addendum sets out responsibilities. Facebook Ireland assumes primary responsibility for GDPR compliance for insights data and makes an extract of the addendum available to data subjects. The controller ensures an appropriate legal basis and compliance with other relevant obligations. Facebook Ireland is solely responsible for processing personal data in the context of Page Insights, except for data within the scope of the addendum. The addendum does not grant the controller the right to request personal data of Facebook users processed by Facebook Ireland. The controller may not act on behalf of Facebook Ireland or respond in its name when handling data protection requests.
Customer Relationships and Other Processing
If questions arise or a data subject has an issue while using our services, they may contact the controller via the channels provided on the website (phone, e-mail, social media, etc.).
The controller deletes incoming e-mails, messages, and data provided via phone, Meta, etc., together with the inquirer’s name, e-mail address, and other voluntarily provided personal data, no later than 2 years after the disclosure.
For processing not listed in this notice, information will be provided at the time of data collection.
In the event of an exceptional official request or where another body requests data based on legal authorisation, the Service Provider is obliged to provide information and disclose/transfer data and/or make documents available. In these cases, personal data will be disclosed only to the extent strictly necessary to fulfil the purpose of the request, provided the requesting party specified the exact purpose and scope.
Rights of Data Subjects
1. Right of access
You have the right to obtain confirmation from the controller as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and the information listed in the GDPR.
2. Right to rectification
You have the right to obtain from the controller, without undue delay, the rectification of inaccurate personal data concerning you. Taking into account the purposes of processing, you have the right to have incomplete personal data completed, including by means of a supplementary statement.
3. Right to erasure
You have the right to obtain from the controller the erasure of personal data concerning you without undue delay, and the controller is obliged to erase personal data without undue delay under certain conditions.
4. Right to be forgotten
If the controller has made the personal data public and is obliged to erase it, the controller shall, taking account of available technology and implementation costs, take reasonable steps, including technical measures, to inform other controllers processing the data that you have requested the erasure of any links to, or copy or replication of, those personal data.
5. Right to restriction of processing
You have the right to obtain restriction of processing where one of the following applies:
- you contest the accuracy of personal data (for a period enabling the controller to verify accuracy);
- processing is unlawful and you oppose erasure and request restriction instead;
- the controller no longer needs the data, but you require them for legal claims;
- you have objected to processing (pending verification whether the controller’s legitimate grounds override yours).
6. Right to data portability
You have the right to receive personal data you provided to a controller in a structured, commonly used, machine-readable format, and to transmit those data to another controller without hindrance (...).
7. Right to object
Where processing is based on legitimate interests or the exercise of official authority, you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you, including profiling based on those provisions.
8. Objection to direct marketing
If personal data are processed for direct marketing purposes, you have the right to object at any time to such processing, including profiling to the extent it relates to direct marketing. If you object, the personal data shall no longer be processed for such purposes.
9. Automated decision-making in individual cases, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
This does not apply if the decision:
- is necessary for entering into or performance of a contract;
- is authorised by Union or Member State law with appropriate safeguards; or
- is based on your explicit consent.
Deadline for Taking Action
The controller informs you without undue delay, but in any event within 1 month of receipt of the request, of actions taken in response to the requests above. If necessary, this may be extended by 2 months; the controller will inform you of the extension and reasons within 1 month.
If the controller does not take action, it informs you without delay and at the latest within 1 month of receipt of the request of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
Security of Processing
The controller and the processor implement appropriate technical and organisational measures to ensure a level of security appropriate to risk, considering the state of the art, implementation costs, nature, scope, context and purposes of processing, and the varying likelihood and severity of risk to rights and freedoms of natural persons, including, where appropriate:
- pseudonymisation and encryption of personal data;
- ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services;
- ability to restore availability and access to personal data in a timely manner in the event of a physical or technical incident;
- a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures.
Data must be stored so that unauthorised persons cannot access them. For paper-based media, this is ensured through proper physical storage and archiving; for electronically processed data, through a central authorisation management system.
The IT storage method must allow erasure when the erasure deadline expires (also considering different deadlines). Deletion must be irreversible.
Paper-based media must be destroyed using a shredder or a specialised external document destruction organisation. For electronic media, physical destruction must comply with relevant disposal rules and, if needed, preceded by secure, irreversible deletion.
Specific security measures
Physical protection (paper-based personal data):
- Documents are stored in a secure, well-lockable, dry room.
- If paper-based personal data are digitised, rules for digitally stored documents apply.
- Employees may leave a room where processing takes place only after locking away entrusted media or locking the room.
- Only authorised persons may access personal data; third parties cannot access them.
- The provider’s building and rooms are equipped with fire protection and property protection systems.
IT protection:
- Computers and mobile devices used for processing are owned by the provider.
- The system containing personal data is protected by antivirus software.
- Backups and archiving are used to protect digitally stored data.
- Only designated persons with proper authorisation can access the central server.
- Access to data on computers is possible only with username and password.
Informing Data Subjects About a Personal Data Breach
If the breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller informs the data subject without undue delay.
The notification shall describe the nature of the breach in clear language and provide the name and contact details of the data protection officer or other contact point; describe the likely consequences; and describe measures taken or proposed to address the breach and mitigate adverse effects.
The data subject need not be informed if any of the following conditions is met:
- appropriate technical and organisational measures were implemented and applied (e.g., encryption rendering the data unintelligible to unauthorised persons);
- subsequent measures ensured that the high risk is no longer likely to materialise;
- notification would involve disproportionate effort (then public communication or similar measures shall be used).
If the controller has not yet communicated the breach to the data subject, the supervisory authority may, after considering whether the breach is likely to result in high risk, require the controller to do so.
Notification of a Breach to the Authority
The controller notifies the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach, unless the breach is unlikely to result in a risk to rights and freedoms. If notification is not made within 72 hours, reasons for the delay must be provided.
Periodic Review for Mandatory Processing
If the duration of mandatory processing or the need for periodic review is not specified by law, a municipal decree, or a binding EU legal act, the controller reviews at least every three years from the start of processing whether processing of personal data is necessary to achieve the purpose.
The controller documents the circumstances and results of the review, retains the documentation for ten years, and makes it available to NAIH upon request.
Right to Lodge a Complaint
You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):
- Nemzeti Adatvédelmi és Információszabadság Hatóság
- 1055 Budapest, Falk Miksa utca 9-11.
- Mailing address: 1363 Budapest, Pf. 9.
- Phone: +36 1 391 1400
- Fax: +36 1 391 1410
- E-mail: ugyfelszolgalat@naih.hu
Closing Provisions
When preparing this notice, we took into account the following legislation and recommendations:
- Regulation (EU) 2016/679 (GDPR) (27 April 2016);
- Act CVIII of 2001 on certain issues of electronic commerce services and information society services (especially Section 13/A);
- Act XLVII of 2008 on the prohibition of unfair commercial practices against consumers;
- Act XLVIII of 2008 on the basic conditions and certain limitations of economic advertising activity (especially Section 6);
- Act XC of 2005 on electronic freedom of information;
- Act C of 2003 on electronic communications (especially Section 155);
- Opinion 16/2011 on best practices for behavioural online advertising (EASA/IAB recommendation);
- NAIH recommendation on data protection requirements for prior information.
Previous Versions of the fiREG.hu Privacy Notice
- fiREG.hu Privacy Notice (effective date: 2022-09-01)
- fiREG.hu Privacy Notice (effective date: 2022-09-01)
Document authenticated and prepared by: Virtualjog.hu
View / download in PDF format: View / Download
Date of the latest update: 2026-02-17
