1. Introduction

1.1. Purpose of the Data Protection Notice

The purpose of this Data Protection Notice (hereinafter: “Notice”) is to transparently and comprehensively present how we process personal data during the activities of Inter-Csavar Kft. (hereinafter: “Data Controller”), as well as to provide information on the rights of data subjects and the methods of exercising them.

1.2. Legal compliance (GDPR, Act CXII of 2011)

Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR): establishes uniform EU rules for the protection of personal data.
Act CXII of 2011 (Infotv.): the fundamental law of Hungarian data protection regulations concerning the right to informational self-determination and freedom of information.

This Notice aims to comply with the requirements set forth in the above legislation.

2. Data Controller Details

2.1. Name and contact details of the Data Controller

Name: Inter-Csavar Kft.
Registered office: 1135 Budapest, Petneházy út 55. 2/205.
Company registration number: 01-09-353106
Tax number: 27306639-2-41
Representative: Mester Gábor György
E-mail: [email protected]
Phone number: +36-30-432-8192

2.2. Availability of the data protection notice

This Notice is available in electronic form at www.intercsavar.hu, and can also be viewed in printed form upon request at our customer service office.

3. Definitions

3.1. Basic GDPR concepts

Personal data: any information relating to an identified or identifiable natural person (“data subject”).
Data Controller: the natural or legal person which determines the purposes and means of the processing of personal data.
Data Processor: the natural or legal person which processes personal data on behalf of the Data Controller.
Consent: any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which they signify agreement to the processing of personal data relating to them.
Data subject: any identified or identifiable natural person to whom the personal data relates.

3.2. Definition of a personal data breach (incident)

A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

4. Data Processing Guidelines

4.1. Legal bases and principles

Lawfulness, fairness, and transparency: We process data only for specific and lawful purposes.
Purpose limitation: Only for predefined purposes, to the extent necessary to achieve the goal.
Data minimization: We collect and process only the personal data that is essential for achieving the purpose.
Accuracy: We ensure that processed personal data is accurate and, where necessary, kept up to date.
Storage limitation: We store personal data only for as long as necessary for the purposes of processing.
Integrity and confidentiality: We apply appropriate technical and organizational measures to ensure the security of personal data.

4.2. Accuracy and security of data

Both the Data Controller and the data subject are responsible for regularly updating the data; the latter is obliged to report any changes in their personal data.
The Data Controller makes every effort to ensure the recorded data is accurate and protects it from unauthorized access with appropriate security measures.

5. Data Processing Purposes and Legal Bases

5.1. Website registration

Purpose: Creating a user account and providing related services.
Legal basis:
- Consent (GDPR Article 6(1)(a)) if registration is voluntary and requested by the data subject.
- Performance of a contract (GDPR Article 6(1)(b)) if registration is a prerequisite for providing the service.
Scope of processed data: Name, e-mail address, password (encrypted), date of registration, IP address.

5.2. Order management

Purpose: Processing orders, fulfilling the contract, invoicing, and delivery.
Legal basis: Performance of a contract (GDPR Article 6(1)(b)).
Scope of processed data: Name, delivery and billing address, contact details (phone number, e-mail), order details.

5.3. Invoicing

Purpose: Compliance with applicable accounting laws (e.g., Act C of 2000).
Legal basis: Compliance with a legal obligation (GDPR Article 6(1)(c)).
Scope of processed data: Name/company name, address, tax number (for legal entities), and other data required for invoicing.

5.4. Newsletter sending

Purpose: Marketing communication, providing information about new products and promotions.
Legal basis: Consent (GDPR Article 6(1)(a)).
Scope of processed data: Name, e-mail address.
Note: You can unsubscribe from the newsletter at any time by clicking the link at the bottom of the newsletter or by notifying the Data Controller directly.

5.5. Use of cookies

Purpose: Ensuring the proper functioning of the website, improving user experience, analyzing visitor data, marketing purposes.
Legal basis:
- Consent (GDPR Article 6(1)(a)) – for any cookies that are not essential for the website’s operation.
- Legitimate interest or performance of a contract (GDPR Article 6(1)(f) or (b)) – for technical cookies essential for operation.
Further details: See the “Use of cookies” section (Point 11) of this Notice.

5.6. Social media data processing

Purpose: Contact, sharing information (Facebook, Instagram, etc.).
Legal basis: Voluntary decision, consent (GDPR Article 6(1)(a)).
Note: The data processing practices of social platforms must be viewed in the privacy policy of the respective platform.

6. Scope of Processed Data

6.1. Types of personal data

Identification data: name, username, password (encrypted).
Contact data: e-mail address, phone number, address.
Technical data: IP address, browser type, cookies, login time.
Billing data: billing name, address, tax number (for companies).

6.2. Method and duration of data storage

In electronic form on protected servers, secured with passwords and other security solutions.
In paper form (if applicable) at the registered office or premises, in a locked place.
Storage duration: until legal obligations are fulfilled and the data processing purpose is achieved, or until consent is withdrawn. Following this, the data is deleted or anonymized.

7. Rights of Data Subjects

7.1. Right to information

The data subject has the right to request information about the purpose, legal basis, source, and duration of the processing of their personal data, as well as who has access to it.

7.2. Right to rectification

If the data subject believes their processed personal data is inaccurate or incomplete, they may request its rectification or completion.

7.3. Right to erasure (“right to be forgotten”)

The data subject may request the erasure of their personal data if the data is no longer necessary for its original purpose, or if the data subject withdraws their consent and there is no other legal basis for processing.

7.4. Right to data portability

The data subject has the right to receive the data they have provided in a widely used, machine-readable format, and may request its transmission to another data controller.

7.5. Right to object

The data subject may object at any time to the processing of their personal data if the legal basis for processing is the legitimate interest of the Data Controller.
The data subject has a specific right to object to the processing of personal data for direct marketing purposes.

8. Data Security

8.1. Protection of electronic data

Multi-level authorization system.
Regular backups.
Use of antivirus protection and firewalls.

8.2. Technical and organizational measures

Use of a closed office network and secure Wi-Fi.
Storing paper-based documents in a locked cabinet.
Regular data protection training for employees and data processors.

9. Handling of Personal Data Breaches

9.1. Reporting an incident to the authorities (72-hour rule)

In the event of a personal data breach, the Data Controller shall, without undue delay and, where feasible, not later than 72 hours after having become aware of it, report it to the National Authority for Data Protection and Freedom of Information (NAIH), unless the breach is unlikely to result in a risk to the rights and freedoms of data subjects.

9.2. Informing data subjects in case of high risk

If the incident is likely to result in a high risk to the rights and freedoms of data subjects, the Data Controller will also inform the data subjects without undue delay, describing the nature of the incident and the measures taken.

10. Data Processors and Third Parties

10.1. Hosting provider

Name: Vitarex Stúdió Kft.
Registered office: 1016 Budapest, Aladár utca 17. Fsz 1.
Contact: [email protected], +36 1 385 1949
Data processing activity: operating the web server, technical maintenance. Processes personal data only based on the Data Controller’s instructions.

10.2. Accountant and other partners

The Data Controller may use an accountant, courier service, marketing agency, and other partners for processing personal data.

Accountant: Telek Zsolt, activity: accounting, payroll, performing tax-related tasks.
Courier service: Magyar Posta, GLS, activity: delivering ordered products.
Marketing agency: activity: planning and executing marketing campaigns.

The Data Controller always concludes a written agreement with these partners (data processors) in accordance with GDPR requirements. The contracts stipulate that partners may process the data solely based on the Data Controller’s instructions, for the specified purpose, and for the necessary duration.

11. Use of Cookies

11.1. Purpose and types of cookies

Session cookies: essential for the operation of the website, they are deleted when the browser is closed.
Functional cookies: aid user convenience, for example, by remembering login details or the selected language.
Analytical cookies (e.g., Google Analytics): serve statistical purposes, helping to understand user behavior and improve website performance.
Marketing cookies: support the display of relevant advertisements and the measurement of advertising effectiveness.

11.2. Managing user settings

Users can control the management of cookies in their browser settings, allowing them to disable or delete them.
When changing cookie settings, certain functions of the website may not work properly.
Upon the first visit to the website, there is an opportunity to enable or reject non-essential (e.g., marketing) cookies via a pop-up window.

12. Data Protection Officer (DPO)

12.1. Conditions and tasks of appointment

Under Article 37 of the GDPR, the Data Controller is obliged to appoint a Data Protection Officer (DPO) if its core activities:

consist of processing operations which, by virtue of their nature or scope, require regular and systematic monitoring of data subjects on a large scale; or
consist of processing sensitive data on a large scale.

The tasks of the officer include:

continuously monitoring compliance with the GDPR,
advising the Data Controller and employees,
liaising with the supervisory authority (NAIH) and the data subjects.

12.2. Status and contact details

The Data Protection Officer reports directly to senior management and cannot be instructed regarding their duties as an officer.

Name: [Name of Data Protection Officer]
Contact: [E-mail address, phone number]

If appointing a DPO is not mandatory for the Data Controller but it still designates one, it will properly inform the data subjects in this Notice.

13. Enforcement Options for Data Subjects

13.1. Submitting a complaint to the National Authority for Data Protection and Freedom of Information (NAIH)

If the data subject believes that the processing of their personal data violates applicable laws, they may submit a complaint to the National Authority for Data Protection and Freedom of Information:

Address: 1055 Budapest, Falk Miksa utca 9-11.
Phone: +36 (1) 391-1400
E-mail: [email protected]

13.2. Possibility of judicial remedy

In case of a violation of their rights, the data subject may turn to a court. The lawsuit can be initiated—at the data subject’s choice—before the regional court having jurisdiction over their permanent or temporary residence.

14. Legislation Underlying Data Processing

14.1. GDPR (EU Regulation 2016/679)

Regulation (EU) 2016/679 of the European Parliament and of the Council, aimed at protecting natural persons regarding the processing of personal data and ensuring the free movement of such data within the EU.

14.2. Act CXII of 2011 on the Right of Informational Self-Determination

The Hungarian data protection law, which regulates domestic principles and limits for processing personal data.

14.3. Other relevant Hungarian legislation

Act C of 2000 on Accounting.
Act V of 2013 on the Civil Code (Ptk.).
Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities.

15. Final Provisions

15.1. Scope and modification possibilities of the data protection notice

This Notice is valid from [Date].
The Data Controller is entitled to unilaterally modify this Notice, particularly to take into account legislative changes, the introduction of new data processing activities, or the recommendations of the supervisory authority.
Modifications will be published on the website, and after their entry into force, data subjects accept the new rules by continuing to use the services.

Dated: [City], [Date]

[Name of Data Controller (company)]
(Representative of the Data Controller)

Privacy Policy