Privacy notice
Clear and understandable information on the protection of your data
Table of contents
- 1. Definitions
- 2. Details of the data controller
- 3. The purpose, legal basis and duration of data processing
- 4. Data processing and external service providers
- 5. Data transfer
- 6. Rights of data subjects
- 7. Options for enforcing one’s rights
- 8. Handling data protection incidents
- 9. External links
- 10. Data security
- 11. Other provisions
WebSegély.hu Bt. (hereinafter: „Data Controller”), as the https://websegely.hu/ The operator of the website available at [address] (hereinafter: „the Website”) sets out in this Privacy Notice its data processing practices in relation to the personal data of visitors to the Website, enquiries, those requesting quotations, customers and other contacts (hereinafter collectively referred to as „Data Subjects”) regarding the processing of their personal data.
The Data Controller is committed to the protection of personal data and carries out its data processing activities in accordance with the relevant Hungarian and European Union legislation.
Data processing is governed in particular by the following legislation:
– Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, hereinafter: GDPR).
– Act CXII of 2011 on the right to informational self-determination and freedom of information.
– Act C of 2000 on Accounting.
– Act C of 2003 on Electronic Communications.
– Act CVIII of 2001 on certain aspects of electronic commerce services and services relating to the information society.
– Other Hungarian and European Union legislation applicable to data processing.
The purpose of this privacy notice is to enable Data Subjects to understand what personal data the Data Controller processes, for what purposes, on what legal basis and for how long, as well as what rights they are entitled to.
Simply viewing the Website does not in itself constitute general consent to the processing of personal data. The Data Controller applies an appropriate legal basis to all data processing activities.
1
Concepts
Personal data: Any information relating to an identified or identifiable natural person, including, in particular, their name, email address, telephone number, postal address, IP address or other online identifier.
Data subject: A natural person whose personal data is processed by the Data Controller.
Data controller: A natural or legal person who, either alone or jointly with others, determines the purposes and means of the processing of personal data.
Data processor: A natural or legal person who processes personal data on behalf of the Data Controller.
Data management: Any operation carried out on personal data, in particular the collection, recording, organisation, storage, use, disclosure, alteration, restriction or erasure of such data.
Consent: A clear expression of will by the data subject, given voluntarily, specifically, on the basis of adequate information, by which they consent to the processing of their personal data for a specific purpose.
To: The natural or legal person to whom personal data is disclosed, subject to the exceptions set out in the GDPR.
Data breach: A breach of security is any incident resulting in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to, personal data being processed.
Profile creation: A form of automated processing of personal data in which personal characteristics relating to a natural person are evaluated, analysed or predicted.
2
Data controller data
Company name: WebSegély.hu Limited Partnership.
Registered office: 2316 Tököl, 7 Pozsonyi Street.
Member of Parliament: Erika Udvarhelyi
Telephone number: +36 70 803 6066
Email address: info@websegely.hu
Website: https://websegely.hu/
Data subjects may submit their questions, requests and comments regarding data processing via the contact details provided above.
3
The purpose, legal basis and duration of data processing
The Data Controller shall process personal data solely for specified, explicit and legitimate purposes, to the extent and for the duration necessary to fulfil those purposes.
3.1. Ordering a service, requesting a quote
Purpose of the processing:
Processing requests for quotations, preparing quotations, coordinating services, preparing and fulfilling contracts, and liaising with clients.
Scope of personal data processed:
– Name, company name, contact person’s name.
– Email address, telephone number.
– Requirements, ideas and individual preferences relating to the service.
– Information relating to the business’s activities, target audience and website, which is necessary for the preparation of the proposal.
– Additional personal data provided during the request for quotation and the subsequent discussions.
The legal basis for data processing:
Article 6(1)(b) of the GDPR in relation to the preparation and performance of a contract to which a natural person is a party.
In the case of a natural person acting as the contact person for a legal entity client, a legitimate interest within the meaning of Article 6(1)(f) of the GDPR.
The legitimate interest is the preparation, organisation and maintenance of contractual cooperation.
Duration of processing:
If no contract is concluded as a result of the request for a quotation, the Data Controller will, as a general rule, retain the relevant personal data for a maximum of one year following the closure of the request for a quotation.
If the request for a quotation leads to the conclusion of a contract, the data will be processed for the duration of the contract and for the period necessary to enforce any related legal claims; as a general rule, this is for a period of 5 years from the date of termination of the contract.
Data may be retained in a manner other than that described above where this is required by law, or where it is justified by the enforcement or defence of a specific legal claim.
3.2. Establishing and maintaining contact
Data subjects may contact the Data Controller via the following channels:
– Email
– Telephone
– The contact form on the website
– Facebook
– Facebook Messenger
– Instagram
Scope of personal data processed:
Depending on how you get in touch:
– Name
– Email address
– Telephone number
– Name or username of social media profile
– The content of the enquiry and the reply to it
– Further information required for processing the application
In the case of telephone enquiries, the Data Controller does not make audio recordings of the conversations. However, it may take notes of the information required to deal with the enquiry.
Purpose of the processing:
Receiving, processing and responding to enquiries, providing information, making offers and maintaining business contacts.
The legal basis for data processing:
Depending on the nature of the enquiry:
– Article 6(1)(b) of the GDPR – steps taken prior to entering into a contract or the performance of a contract.
– Article 6(1)(f) of the GDPR – the Data Controller’s legitimate interest in responding to enquiries and conducting necessary business communications.
Duration of processing:
As a general rule, the Data Controller retains correspondence relating to general enquiries for a maximum of one year from the date the enquiry is closed.
Correspondence relating to the contractual relationship and required for the purposes of verifying performance or legal claims shall be retained for the duration of the contract and, as a general rule, for a period of five years following its termination.
The Data Controller may delete messages that are no longer relevant for administrative purposes at any time.
3.3. Contact form
The contact form on the website uses the WPForms plugin to enable users to send messages.
Scope of data processed:
The name, email address and other contact details provided on the form, the content of the message, and the technical data required for the form to function.
Purpose of the processing:
Receiving, processing and responding to enquiries.
The legal basis for data processing:
Depending on the nature of the request, Article 6(1)(b) or (f) of the GDPR.
Data storage:
Based on the settings for WPForms Lite used on this website, form submissions are not stored permanently in WPForms’ own WordPress database.
The external submission saving feature of WPForms Lite Connect is not enabled.
Messages received via the forms are forwarded as emails. The rules set out in section 3.2 of this information notice apply to the retention of data received by email.
The contact form is protected by Google reCAPTCHA, a service designed to prevent automated abuse and spam.
Further information on Google’s data processing in relation to reCAPTCHA can be found in Google’s privacy policy:
https://policies.google.com/privacy?hl=hu
3.4. Invoicing and accounting obligations
The Data Controller uses the VOSZPort invoicing programme to prepare and manage invoices issued for its services.
Invoicing is carried out independently of the Website.
It is not possible to make direct purchases or pay online via the website.
Scope of personal data processed:
– Billing name
– Billing address
– Tax registration number, where applicable
– The service and financial details shown on the invoice
– In the case of electronic invoice transmission, the recipient’s email address
Purpose of the processing:
Issuing, recording, forwarding and posting invoices, and fulfilling accounting and tax obligations.
The legal basis for data processing:
Article 6(1)(c) of the GDPR – compliance with a legal obligation.
Duration of processing:
Accounting documents supporting the accounting entries must be retained for at least 8 years in accordance with Section 169(2) of Act C of 2000 on Accounting.
Reports and related records referred to in Section 169(1) of the Act are subject to a retention period of at least 10 years.
During the mandatory retention period, the erasure of personal data cannot be requested if their continued processing is necessary to comply with a legal obligation.
3.5. Technical data generated whilst using the Website
When you access and use the Website, the server and certain technical systems may automatically record certain data.
The data processed may include:
– IP address
– Date and time of the visit
– Technical specifications of the browser and the operating system
– Requests received by the server
– Technical data relating to the pages viewed
– Log entries relating to technical faults and security incidents
Purpose of the processing:
To ensure the Website functions properly, to identify technical faults, to detect security incidents, and to prevent unauthorised access and other forms of misuse.
The legal basis for data processing:
Article 6(1)(f) of the GDPR – the Data Controller’s legitimate interest in maintaining the secure operation of the Website.
Duration of processing:
Technical logs are retained for a period consistent with the purpose of the relevant log file, the security objective and the retention rules of the technical system in use.
The retention of hosting provider logs is governed by the applicable terms and conditions of service and data processing of Tárhely.Eu Szolgáltató Kft.
The Data Controller shall not retain technical data processed separately by it for longer than is necessary for the purposes of data processing, unless this is justified by legislation or the investigation of a specific security incident.
3.6. Cookies and similar technologies
The Website uses cookies and other data storage and identification technologies that operate within the browser.
The specific purposes of cookies are:
– To ensure the basic functioning of the website.
– A note on visitor settings.
– Operating security and fraud prevention functions.
– Analysis of visitor numbers and user interactions.
– Measuring advertising performance, where such a service is available.
The CookieYes system is used on the Website to manage consent settings relating to cookies.
In order to use cookies and similar technologies that are not strictly necessary, the Data Controller requests prior consent in accordance with the relevant legislation.
Data subjects may withdraw their consent at a later date and may also change their cookie settings.
A detailed list of cookies, their purposes, providers and expiry dates is published separately on the Website Cookie information contains.
3.7. Analytics and advertising measurement services
Depending on the actual technical configuration, the analytics and measurement systems used on the Website may process online identifiers, visit data and information relating to the use of the Website.
The purpose of such data processing is to analyse the use of the Website, improve the user experience and measure the effectiveness of any advertising activities.
During an audit of the Website’s cookie management, the following elements relating to the technologies listed below were identified:
Google Analytics
Google Analytics is a service that helps analyse website traffic and usage.
Cookies identified: _ga _ga_PRDLEQKPC5
The legal basis for data processing for analytical purposes, which is subject to consent, is Article 6(1)(a) of the GDPR.
Microsoft Clarity
Microsoft Clarity is a system for analysing visitor interactions and website usage.
Cookies identified:
_clck
_clsk
Depending on its configuration and consent settings, Microsoft Clarity may also transmit cookie-free measurement data.
The Data Controller processes data for analytical purposes in accordance with the relevant data protection requirements.
Google advertising measurement technologies
On the website, the _gcl_au A cookie has also been identified which may be linked to Google’s advertising measurement technologies.
The legal basis for the processing of measurement data for this purpose, which is subject to consent, is Article 6(1)(a) of the GDPR.
Google reCAPTCHA
A security solution for the contact form.
To use the service, the rc::a and rc::c Browser storage items may be associated with them.
Cloudflare
During the technical investigation, issues relating to the Cloudflare service __cf_bm The biscuit has also appeared.
This technology may be used for automated traffic detection and security checks.
The presence of this cookie does not in itself mean that the entire Website operates via the Cloudflare infrastructure.
CookieYes
It is used to manage consent settings relating to cookies and to record visitors’ preferences.
The related biscuit:
- cookieyes-consent
Detailed information on the cookies currently in use, the options for consent and the retention periods is set out in the separate Cookie Policy.
4
Data processing and external service providers
4.1. Web hosting and email service provider
Name: Tárhely.Eu Service Provider Ltd.
Registered office: 1144 Budapest, 4 Ormánság Street, 10th floor, room 241.
Telephone: +36 1 789 2789
E-mail: support@tarhely.eu
Website: https://tarhely.eu/
Activity:
To provide web hosting for the Website, to store personal data using technical means, to ensure the operation of the servers, and to provide the infrastructure necessary for electronic correspondence.
The Data Controller also uses email accounts linked to its own domain via the Tárhely.Eu service.
4.2. Billing provider
Invoicing software: VOSZPort
The operator of the app: R34dy Ltd.
Registered office: 17 Hegyalja Street, 2040 Budaörs.
Related organisation: National Association of Entrepreneurs and Employers (VOSZ)
Purpose of the processing:
Issuing, recording and managing invoices relating to services.
The scope of the data concerned:
The billing name, billing address, tax number (if required), and any further details necessary for the issue and management of invoices.
The invoicing programme is used independently of the website.
Information on data protection relating to the service is available on the VOSZ’s official website:
https://www.vosz.hu/hu/adatvedelmi-tajekoztato
4.3. Electronic correspondence and email forwarding
Email provider: Tárhely.Eu Service Provider Ltd.
Email forwarding service: Brevo
Website: https://www.brevo.com/
Technical WordPress plugin: WP Mail SMTP
The Data Controller uses the WP Mail SMTP plugin and the Brevo service to forward electronic messages sent via the WordPress system.
Brevo is used solely as a technical email forwarding service.
The Data Controller does not use it to send newsletters, for marketing email campaigns or to collect newsletter subscribers.
The data processed during transmission may include:
– The sender’s email address.
– The recipient’s email address.
– The subject of the message.
– The content of the message.
– Technical information required for transmission and delivery.
Purpose of the processing:
The transmission of electronic messages sent via the Website, contact notifications and necessary WordPress system messages.
Duration of processing:
The retention period for Brevo’s transaction email logs is determined by the Data Controller’s settings 1 month.
Brevo does not store previews of the content of newly forwarded emails, as this feature has been disabled.
This setting does not mean that the data processing required for the delivery of electronic messages will cease, nor does it automatically delete previously stored previews.
The retention rules set out in section 3.2 of this information notice apply to correspondence stored in the Tárhely.Eu email system.
4.4. Accounting service provider
Name: Gabriella Mária Duzs, sole trader
Registered office: 2316 Tököl, 7 Pozsonyi Street.
E-mail: duzskft@gmail.com
Activity:
To carry out the Data Controller’s bookkeeping, accounting and related tax duties.
In the course of carrying out accounting tasks, the service provider may access personal data contained in invoices, accounting documents and related records to the extent necessary.
The accounting service provider’s role in data protection is determined by the tasks actually carried out and the contractual relationship.
4.5. Social media service providers
The Data Controller also accepts enquiries via Facebook, Messenger and Instagram.
These services are part of the Meta group of companies.
Meta may also process personal data for its own data processing purposes whilst users are using the services it operates.
The Data Controller processes the personal data contained in messages received by it for the purpose of processing and responding to enquiries.
Joint data processing may also take place between Meta and the site operator in relation to certain features of social media sites.
Meta Privacy Notice:
https://www.facebook.com/privacy/policy/
4.6. Other technical service providers
In connection with the operation of the Website, the following technology providers and systems may also be involved in the processing of personal data:
– Google – Google Analytics, advertising measurement technologies and reCAPTCHA.
– Microsoft – Clarity website analytics system.
– CookieYes – managing consent for the use of cookies.
– Cloudflare – the security features of the associated technical integrations.
The data processing activities relating to these services are governed by the actual operation of the service in question, the relevant contractual terms and conditions, and the applicable data protection provisions.
4.7. Data transfers to third countries
In the course of the operations of certain international technology service providers used by the Data Controller, personal data may be transferred to countries outside the European Economic Area or may become accessible from such countries.
Such data transfers are subject to the requirements set out in Chapter V of the GDPR.
The appropriate legal basis for the transfer of data may include, in particular:
– The European Commission’s decision establishing an adequate level of protection.
– The EU–US Data Privacy Framework, provided that the US organisation concerned holds the relevant certification and the data transfer falls within the scope of that certification.
– The Standard Contractual Clauses (SCCs) adopted by the European Commission, supplemented by additional safeguards where necessary.
– Other data transfer arrangements permitted under the GDPR.
Google, Microsoft, Meta and other international service providers may use data transfer mechanisms as set out in their applicable privacy policies.
According to information provided by Brevo, its primary data storage infrastructure is located within the European Union. However, this does not in itself preclude international data transfers by the service provider or its subcontractors, provided that appropriate safeguards are in place.
Data subjects may request further information regarding data transfers and the safeguards in place by contacting the Data Controller using the contact details provided in point 2.
5
Data transmission
The Data Controller shall only transfer personal data for specific, legitimate purposes, on an appropriate legal basis and to the extent necessary.
Data may be transferred, in particular:
– To service providers necessary for the performance of the contract.
– For invoicing and bookkeeping service providers.
– For service providers involved in electronic communications.
– To authorities authorised by law.
– On the basis of the data subject’s consent, where consent is required for the processing in question.
– In other cases permitted by the GDPR.
The Data Controller does not sell personal data.
Should the Data Controller wish to use personal data for a purpose other than the original purpose of data processing, it shall act in accordance with the relevant legislation and, where necessary, inform the Data Subjects in advance.
6
The rights of data subjects
6.1. The right to information and access
The Data Subject is entitled to receive confirmation as to whether the Data Controller is processing their personal data.
Where data processing takes place, the Data Subject is entitled to be informed, in particular, of:
– The purpose of data processing.
– The categories of personal data processed.
– The recipients of the data or categories of recipients.
– The intended period for which personal data will be stored, or the criteria used to determine that period.
– The data protection rights to which he is entitled.
– Information regarding any transfers of data to third countries.
– Other information as set out in Article 15 of the GDPR.
The data subject is entitled to a copy of the personal data processed about them.
As a general rule, the first copy is provided free of charge.
The Data Controller may charge a reasonable fee for further copies, in accordance with the provisions of the GDPR.
6.2. Right to rectification
The Data Subject may request the rectification of any inaccurate personal data relating to them, or the completion of any incomplete data.
The Data Controller shall comply with the request without undue delay, provided that the legal conditions for doing so are met.
6.3. The right to restriction of processing
The data subject may request that the processing of their personal data be restricted in the circumstances set out in Article 18 of the GDPR.
This may be the case, in particular, if:
– Disputes the accuracy of the personal data.
– The processing of data is unlawful, but he objects to the erasure of the data.
– The Data Controller no longer requires the data, but it is necessary for the Data Subject to assert their legal claims.
– The data subject has objected to the processing of their data on the grounds of legitimate interests, and the balancing of interests has not yet been concluded.
6.4. Right to erasure
The Data Subject is entitled to request the erasure of their personal data, subject to the conditions set out in Article 17 of the GDPR.
Deletion may be appropriate, in particular, if:
– The data is no longer required for the original purpose of data processing.
– The data subject withdraws their consent, and there is no other legal basis for the processing of their data.
– The data subject has successfully objected to the processing of their data.
– The processing of personal data is unlawful.
– The data must be deleted in order to comply with a legal obligation.
The right to erasure is not unlimited.
The Data Controller is not obliged to erase the data if their further processing is necessary, for example, to comply with a legal obligation or to establish, exercise or defend legal claims.
6.5 Right to data portability
Subject to the conditions set out in Article 20 of the GDPR, the data subject is entitled to receive the personal data they have provided in a structured, commonly used and machine-readable format, and to transmit that data to another data controller.
This right applies to automated data processing carried out on the basis of consent or a contract.
6.6. The right to protest
The Data Subject may object at any time to the processing of their personal data on the grounds of Article 6(1)(f) of the GDPR, on grounds relating to their particular situation.
In such cases, the Data Controller may no longer process the personal data, unless it demonstrates that the processing is justified on compelling legitimate grounds which override the interests, rights and freedoms of the Data Subject, or which relate to legal claims.
The Data Subject may object at any time to the processing of their data for the purposes of direct marketing.
6.7. Withdrawal of consent
Where data processing is based on consent, the Data Subject may withdraw their consent at any time.
The withdrawal does not affect the lawfulness of any data processing carried out on the basis of consent prior to the withdrawal.
Consent regarding cookies can be amended or withdrawn via the Website’s cookie settings.
6.8. Automated decision-making
The data subject is entitled to the rights set out in Article 22 of the GDPR relating to decision-making based solely on automated processing.
The analytics and security systems used on the Website may carry out automated technical assessments.
These do not, in themselves, necessarily constitute automated decision-making with legal effects or similarly significant effects within the meaning of Article 22 of the GDPR.
6.9. Time limit for responding to data subjects’ requests
The Data Controller shall, without undue delay and no later than one month from receipt of the request, inform the Data Subject of the measures taken in response to their request.
If necessary, the deadline may be extended by a further two months, taking into account the complexity of the application and the number of applications received.
The Data Controller shall inform the Data Subject of the extension and the reasons for it within the original one-month time limit.
Where necessary, the Data Controller may request further information to verify the applicant’s identity.
As a general rule, the exercise of data subjects’ rights is free of charge.
In the case of requests that are clearly unfounded or excessive, the Data Controller may, in accordance with the provisions of the GDPR, charge a reasonable fee or refuse to comply with the request.
7
Enforcement options
Data subjects may submit requests relating to data processing using the contact details below:
WebSegély.hu Limited Partnership.
2316 Tököl, 7 Pozsonyi Street.
E-mail: info@websegely.hu
Telephone: +36 70 803 6066
The Data Subject has the right to lodge a complaint with the competent data protection supervisory authority and to bring the matter before a court.
National Authority for Data Protection and Freedom of Information (NAIH)
Registered office: 1055 Budapest, 9–11 Falk Miksa Street.
Postal address: 1363 Budapest, PO Box 9.
Telephone: +36 1 391 1400
E-mail: ugyfelszolgalat@naih.hu
Website: https://www.naih.hu/
It is not possible to initiate administrative proceedings directly via the NAIH’s customer service email address. Information on the correct procedure for initiating proceedings is available on the Authority’s website.
The Data Subject may also seek judicial redress under Article 79 of the GDPR.
8
Handling data protection incidents
The Data Controller implements technical and organisational measures proportionate to the risks in order to prevent, detect and manage data protection incidents.
In the event of a data breach, the Data Controller shall assess its nature, circumstances, the scope of the personal data concerned and the potential impact on the rights and freedoms of the data subjects.
Where the incident is likely to pose a risk to the rights and freedoms of data subjects, the Data Controller shall, in accordance with Article 33 of the GDPR, without undue delay, where possible, within 72 hours of becoming aware of it, to the competent supervisory authority.
Where the incident is likely to result in a high risk to the rights and freedoms of data subjects, the Data Controller shall, in accordance with the rules set out in Article 34 of the GDPR, without undue delay, unless one of the exceptions set out in the Regulation applies.
The Data Controller documents data breaches in accordance with the requirements of the GDPR and, where necessary, takes measures to mitigate their consequences and prevent similar incidents from occurring.
9
External links
The Website may also contain links to websites operated by third parties.
The data processing activities carried out independently by such websites are governed by the relevant service provider’s data protection provisions.
The Data Controller does not determine the purposes or means of data processing on websites independent of it, and accepts no responsibility for their independent data processing practices.
This provision does not affect the Data Controller’s legal liability for its own data processing activities.
10
Data security
In accordance with Article 32 of the GDPR, the Data Controller implements technical and organisational measures proportionate to the risks in order to safeguard the security of personal data.
The measures taken are intended, in particular, to:
– Safeguarding the confidentiality and integrity of personal data.
– Preventing unauthorised access.
– Minimising the risk of accidental or unauthorised loss, destruction or alteration of data.
– Maintaining system availability.
– Detecting and managing security incidents.
– Appropriate regulation of access rights.
The Data Controller restricts access to personal data to authorised individuals and service providers.
The Data Controller adapts its security measures to the nature of the personal data being processed, the circumstances of the data processing, the technology used and the identified risks.
In the case of internet data transmission and IT systems, it is not possible to guarantee that security risks can be completely ruled out.
However, this does not affect the Data Controller’s obligations and liabilities arising from legislation.
In the event of a data breach or unauthorised access, the Data Controller will investigate the circumstances and take the measures required by law.
As a general rule, it is not necessary to provide any special categories of personal data in order to use the Data Controller’s services.
Data subjects are advised to provide only the personal data necessary for the processing of their enquiry when contacting us.
11
Other provisions
The Data Controller reserves the right to amend this Privacy Notice, in particular in the event of changes to legislation, changes to the operation of the Website, or the introduction of new data processing activities.
The current information leaflet is available on the website at all times.
In the event of any substantive changes to data processing, the Data Controller shall inform the Data Subjects in accordance with the law and, where necessary, shall seek separate consent for the new data processing.
Continued use of the Website does not in itself constitute the consent required by law.
Last updated: 30 October 2026.
EN 
HU