Privacy notice

This notice explains to Website visitors and people interested in our services (“data subjects”) how we process their personal data and the key features and circumstances of that processing. It is provided in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the General Data Protection Regulation, “GDPR”).

Privacy terms used in this notice have the meanings given in Article 4 of the GDPR, supplemented by Hungary’s Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (the “Information Act”).

Controller contact details

Purposes of processing

Visitors can use the calculators on the NIS2, security officer and ISO/IEC 27001 pages under Services, then submit the results and their contact details to request a proposal from the Controller.

Categories of personal data

For the purposes described above, the Controller processes the following personal data:

• the data subject’s first and last name,
• the name of the company provided by the data subject,
• the data subject’s email address,
• the data subject’s phone number,
• the service in which the data subject has expressed an interest,
• any additional free-text comments provided,
• the calculation result and date,
• the date of the submitted message.

Lawful basis for processing

The Controller processes personal data under Article 6(1)(b) of the GDPR: processing is necessary for the performance of a contract with the data subject, or to take steps at their request before entering into a contract. Here, the Controller uses the submitted calculation to prepare a potential contract with the data subject.

Retention of personal data

If the submitted calculation does not lead to a contract, the Controller deletes the personal data within 90 days.

If a contract is concluded, the Controller retains the personal data for five years after the contract ends, corresponding to the general limitation period under Hungary’s Act V of 2013 on the Civil Code.

Cookies, web analytics and advertising

The Website uses cookies and similar technologies. Strictly necessary technologies support its essential operation. Analytics and advertising cookies are used only with your prior, express consent, which you can give separately for analytics and marketing in the cookie banner. Without consent, these cookies are not activated (Google Consent Mode).

Google Tag Manager and Google Ads

We use Google Tag Manager to manage tags and, with your consent, Google Ads conversion measurement and remarketing. These tools measure campaign performance, such as an enquiry submitted as a conversion, and optimise advertising. The provider is Google Ireland Limited. Data may include cookie identifiers, advertising click IDs such as gclid, device and browser information, approximate location based on IP address and Website interactions. Data may also be transferred to Google LLC in the United States, with safeguards under the EU–US Data Privacy Framework and Standard Contractual Clauses (SCCs). Privacy information: policies.google.com/privacy.

Cookies and storage used on the Website

• _gcl_au (Google) supports Google Ads conversion measurement. Category: marketing. Lifetime: 90 days.
• IDE and test_cookie (Google / doubleclick.net) support remarketing and advertising measurement. Category: marketing. Lifetime: up to 13 months.
• _ga and _ga_* (Google) support anonymous traffic measurement through Google Analytics. Category: analytics. Lifetime: up to two years.
• zem-consent (zemITis, local storage) remembers your cookie choices. Category: necessary. Lifetime: persistent localStorage.
• zem-language (zemITis, local storage) remembers the language you select. Category: necessary. It persists until you clear this site’s data in your browser.

Withdrawing consent

You can change or withdraw consent at any time for future processing using Cookie settings in the footer, or by clearing your browser’s cookies and storage. Withdrawal does not affect the lawfulness of processing carried out before it.

Recipients and processors

For the purposes described in this notice, the Controller uses the following service providers in connection with processing under Article 28 of the GDPR.

The following processor provides Website hosting:

Your rights in relation to personal data

The Controller responds to requests concerning your rights without undue delay and within one month of receipt. This period may be extended by two further months where necessary, taking account of the complexity and number of requests.

You have the following rights in relation to this processing:

The right to information and access, which allows you to obtain confirmation of whether your personal data is being processed and, if so, access to:

• the personal data being processed,
• the categories of personal data concerned,
• the purposes of processing,
• the recipients or categories of recipients to whom the data has been or will be disclosed,
• the envisaged retention period or, where this is not possible, the criteria used to determine it,
• information about your right to request rectification, erasure or restriction of processing, and to object to processing,
• information about your right to complain to a supervisory authority,
• any available information about the source of data not collected directly from you,
• the existence of automated decision-making, including profiling, meaningful information about the logic involved, and its significance and envisaged consequences for you.

The right to rectification, which allows you to have inaccurate personal data corrected without undue delay and incomplete data completed, including by providing a supplementary statement, taking account of the purposes of processing.

The right to restriction of processing: You may request restriction of processing where one of the following applies:

• you contest the accuracy of the data, for the period needed to verify it;
• processing is unlawful and you oppose erasure, requesting restriction instead;
• the Controller no longer needs the data for processing, but you need it to establish, exercise or defend legal claims; or
• you have objected under Article 21(1), pending verification of whether the Controller’s legitimate grounds override yours.

The right to erasure, which allows you to request deletion of your personal data without undue delay where:

• the data is no longer necessary for the purposes for which it was collected or otherwise processed,
• you withdraw consent and no other lawful basis applies,
• you object to processing and no overriding legitimate grounds apply,
• the data has been unlawfully processed,
• erasure is necessary to comply with a legal obligation of the Controller,
• the data was collected in connection with the offer of information society services.

The Controller will comply with a valid erasure request without undue delay, unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or a legal obligation requires retention.

The Controller does not erase data where processing is necessary:

• to exercise freedom of expression and information;
• to comply with a legal obligation requiring processing;
• for archiving in the public interest, scientific or historical research, or statistical purposes, where erasure would make the processing impossible or seriously impair it;
• to establish, exercise or defend legal claims, including use as evidence in court proceedings.

The right to data portability, which allows you to receive personal data you have provided in a structured, commonly used, machine-readable format, and transmit it to another controller without hindrance from the Controller.

Complaints and legal remedies

If you are concerned about how your personal data is handled, we recommend first contacting the Controller using the details at the beginning of this notice. We investigate every complaint and make every effort to resolve it. If you remain dissatisfied, the following remedies are available.

The right to complain to a supervisory authority:

Without prejudice to other administrative or judicial remedies, you may lodge a complaint with Hungary’s National Authority for Data Protection and Freedom of Information if you believe the Controller’s or its processor’s actions or omissions infringe, or risk infringing, your rights.

The right to an effective judicial remedy against the Controller or processor:

Without prejudice to available administrative or non-judicial remedies, including a complaint to the supervisory authority, you have the right to an effective judicial remedy if you believe your rights have been infringed through the processing of your personal data.

The regional court has jurisdiction. You may bring proceedings before the regional court for your place of residence or habitual residence.

A list of regional courts is available on the https://birosag.hu/torvenyszekek website.