Privacy Policy

1. This Personal Data Processing Policy (hereinafter: the “Policy”) sets out the rules governing the processing of personal data by FirmaX Hungary Kft. (registered office: 1062 Budapest, Andrássy út 79; company registration number: 01-09-988266; tax number: 23994690-2-42) (hereinafter: the “Data Controller”) in connection with the online services available at https://www.firmaxhungary.com/ (hereinafter: the “Service”).
2. The purpose of this Policy is to inform you of the rules and principles governing the use and retention of the data you provide to the Data Controller during our relationship.
3. This Policy applies solely to data provided to the Data Controller and does not cover cases in which an individual voluntarily makes all or part of their personal data public on, or through, https://www.firmaxhungary.com/.
4. Definitions under Section 3 of Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information:
   1. data subject: any natural person who is identified or identifiable on the basis of any information;
   2. identifiable natural person: a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
   3. personal data: any information relating to a data subject;
   4. special categories of personal data: any data falling within special categories of personal data, including personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health, and data concerning a natural person’s sex life or sexual orientation;
   5. consent: a voluntary and specific expression of the data subject’s wishes, based on appropriate information, by which the data subject unambiguously agrees to the processing of personal data relating to them, either in full or for specified operations;
   6. data controller: a natural or legal person, or an organisation without legal personality, which, alone or jointly with others, determines the purposes of data processing, makes and implements decisions regarding the processing (including the means used), or has those decisions implemented by a data processor;
   7. data processing: any operation or set of operations performed on data, regardless of the method used, including collection, recording, organisation, storage, alteration, use, retrieval, transmission, disclosure, alignment or combination, blocking, erasure and destruction, prevention of further use, taking photographs or audio or video recordings, and recording physical characteristics suitable for identifying a person (e.g. fingerprints, palm prints, DNA samples or iris images);
   8. data transfer: making data available to a specified third party;
   9. disclosure to the public: making data available to anyone;
   10. erasure of data: rendering data unrecognisable in such a way that it can no longer be restored;
   11. restriction of processing: marking stored data in order to block it and restrict its further processing;
   12. destruction of data: the complete physical destruction of the data carrier containing the data;
   13. processing on behalf of a controller: the set of data-processing operations carried out by a data processor acting on the instructions or authority of the data controller;
   14. data processor: a natural or legal person, or an organisation without legal personality, which processes personal data on behalf of or on the instructions of the data controller, within the framework and subject to the conditions laid down by law or a binding legal act of the European Union;
   15. data file: the entirety of the data managed in a single register;
   16. third party: any natural or legal person, or organisation without legal personality, other than the data subject, the data controller or the data processor;
   17. EEA State: a Member State of the European Union, another State party to the Agreement on the European Economic Area, or a State whose nationals enjoy the same legal status as nationals of an EEA State under an international agreement between the European Union and its Member States and a State that is not a party to the EEA Agreement;
   18. third country: any State that is not an EEA State;
   19. recipient: a natural or legal person, or an organisation without legal personality, to which the data controller or data processor makes personal data available.
5. Contact and requests for quotations
   1. Certain services on the Data Controller’s website may be used only following prior, voluntary contact initiated by the user. When making contact or requesting a quotation, users may provide information qualifying as personal data under Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information; the processing of such data is governed by the provisions of that Act.
   2. To successfully contact us, users are required to provide the following information:
      • name
      • company name
      • email address
      • telephone number
      • subject of the enquiry
6. Purposes of data processing
   1. The purpose of data processing is to facilitate communication with users and enable communications associated with the newsletter service.
   2. When the website is visited, the system records users’ IP addresses, which may in certain cases allow a person to be identified. It also records the operating system, browser type and address of the page visited. This information is primarily stored for technical purposes and is necessary for the continuous operation of the system. The additional purposes of collecting this information are to analyse user behaviour and compile website traffic statistics to help improve the standard of service. The Data Controller does not link information obtained through analysing log files with other information and does not seek to identify individual users.
   3. The Data Controller does not process special categories of personal data. If users publish such data on the website, disclose them to the Data Controller or enter them into its database for any reason or by any means, the Data Controller is entitled to erase them without delay upon becoming aware of them.
   4. The rules on data processing and the protection of users’ personal data apply only to natural persons, since personal data can relate only to natural persons (pursuant to Section 3(1) of Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information). Accordingly, this Policy is binding only in relation to the processing of personal data of natural persons.
   5. The Data Controller retains data for an indefinite period, but no longer than five years following the user’s last login, and deletes them during that period only at the user’s request or as a result of a change in legislation.
7. Consent to data processingBy contacting the Data Controller and providing personal data, the user expressly consents to the Data Controller processing the information required for that contact.
8. Data security
   1. The Data Controller endeavours to take all measures reasonably expected of it to ensure the security of the IT systems it uses, particularly to prevent unauthorised access to data stored on the website. However, the Data Controller states that it does not operate the IT equipment hosting the website and that responsibility in this respect rests with the hosting provider at the relevant time.
9. Users’ rights concerning data processing
   1. Users may request information about the processing of their personal data and may request the rectification or erasure of those data.
   2. Upon request, the Data Controller provides information about the data it processes, the purpose, legal basis and duration of processing, the name and address (registered office) of the data processor and its activities relating to processing, and the persons who receive or have received the data and for what purposes. The Data Controller must provide this information in writing, in an intelligible form, as soon as possible and in any event within 30 days of submission of the request. Users may request correction or amendment of their data at any time.
   3. Users may object to the processing of their personal data where such processing is necessary solely to enforce a right or legitimate interest of the Data Controller (unless the processing is required by law), or where the personal data are used or transferred for direct marketing, public opinion polling or scientific research. In such cases, while simultaneously suspending processing, the Data Controller must examine the objection without delay and no later than 15 days after receipt, and inform the applicant of the outcome in writing. If the objection is justified, the Data Controller must cease processing, including any further data collection or transfers, block the data, and notify all persons to whom the personal data concerned were previously transferred of the objection and the measures taken, so that they may take the necessary action to uphold the right to object.
10. Miscellaneous provisions
    1. The Data Controller reserves the right to amend this Policy unilaterally. In the event of an amendment, the Data Controller will publish the amended Policy on the Service website; it will enter into force on the eighth day following publication.
    2. Although the Data Controller implements security measures in line with industry standards to safeguard the data it processes, it cannot guarantee that personal data relating to users’ activities within the Service or displayed through the Service will be processed exclusively in the ways specified in this Policy. Third parties, including other users, may unlawfully intercept or obtain messages or data protected by legislation safeguarding privacy and personality rights. Furthermore, users may disclose their personal data to third parties, who may use them unlawfully. Under Section 13/A(8) of Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services, the Data Controller is entitled to process certain personal data, including billing and traffic data, even without the users’ express consent. Under Section 154(1) of Act C of 2003 on Electronic Communications, internet access providers and other communications service providers are likewise entitled, in certain circumstances, to process users’ personal and other data irrespective of their consent to such processing.
    3. By contacting the Data Controller, requesting a quotation or using the Service, users acknowledge and accept the terms of this Policy.
    4. A user who believes that the Data Controller or the data processor has infringed their right to the protection of personal data may assert their claim before a civil court or seek assistance from the data protection commissioner.
    5. The detailed statutory provisions concerning Section 10.4 of this Policy and the obligations of the Data Controller are set out in Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information.