3. Information regarding the engagement of a data processor
Access to the data is granted to those employees acting on behalf of the Data Controller for whom such access is necessary to perform their duties and who are aware of the obligations related to data processing.
Personal data will not be transmitted to a third party for the purpose of data processing.
4. Rights of the data subject regarding data processing activities
- right to be informed,
- right of access,
- right to rectification,
- right to erasure, “right to be forgotten”,
- right to restriction of processing,
- right to object,
- right to data portability,
- right to withdraw consent,
- right to lodge a complaint,
- right to judicial remedy.
Right to information
General rules regarding the information of the data subject and the right to information
The data controller must provide the data subject with detailed information regarding the data processing—specifically the information contained in this Notice—no later than the time the data subject's personal data are obtained, and prior to the commencement of data processing.
The data controller is responsible for providing this prior information.
In addition to the aforementioned prior information, the data subject may request information from the data controller at any stage of the data processing. In such cases, the data controller must provide the information without undue delay, but no later than within 30 days. This one-month deadline may be extended by a maximum of two months only in justified cases.
The data controller may refuse to provide the information only if it demonstrates that the data subject cannot be identified, or that the data subject's request is manifestly unfounded, repetitive, or excessive.
If the data controller fails to take action—that is, fails to fulfill its obligation to provide information—it must inform the data subject within 30 days of the failure to act, the reasons for such failure, and the data subject's right to lodge a complaint or seek judicial remedy regarding the data processing. This Notice contains further details below regarding complaints and judicial remedies. The controller must provide the information and take the action for the data subject free of charge. However, the controller may—in exceptional cases—charge a reasonable fee or refuse to provide the information or take the action if the data subject’s request is manifestly unfounded, repetitive, or excessive.
The data subject's right of access
The data subject has the right to obtain confirmation from the controller as to whether or not personal data concerning them are being processed, and, where that is the case, access to the personal data and the following information:
Based on the right of access, the data subject must be informed of the following information upon request:
- the purposes of the processing;
- the categories of personal data concerned;
- the recipients or categories of recipients to whom the personal data have been or will be disclosed,
- including in particular recipients in third countries or international organisations;
- where applicable, the envisaged period for which the personal data will be stored;
- the data subject’s right to request from the controller rectification or erasure of personal data or
- restriction of processing concerning the data subject, and to object to such processing;
- the right to lodge a complaint with the supervisory authority (NAIH);
- where the personal data are not collected from the data subject, any available information as to their source;
- the existence of automated decision-making, including profiling, or the absence thereof, as well as—at least in those cases—meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
The data controller shall provide the data subject with a copy of the personal data undergoing processing. For any further copies requested by the data subject, the data controller may charge a reasonable fee based on administrative costs; the data subject shall be informed of such costs in advance.
Where the data subject makes the request by electronic means, our company shall provide the information in a commonly used electronic format, unless the data subject requests otherwise.
Right to rectification
The data subject has the right to have inaccurate personal data concerning them rectified by the controller without undue delay upon their request. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Right to erasure, “right to be forgotten”
The data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay, and the controller has the obligation to erase personal data concerning the data subject without undue delay where one of the following grounds applies:
- the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- where the processing is based on the data subject's consent (e.g., sending a newsletter) and the data subject withdraws their consent
to the processing, and there is no other legal ground for the processing;
- the data subject objects to the processing and there are no overriding legitimate grounds for the processing;
- the personal data have been processed unlawfully;
- the personal data must be erased for compliance with a legal obligation under Union or Member State law to which the controller is subject;
- the personal data have been collected in relation to the offer of information society services.
Where the controller has made the personal data public and is obliged to erase it pursuant to the list above, it shall, taking into account available technology and the cost of implementation, take reasonable steps—including technical measures—to inform controllers processing the data that the data subject has requested them to erase any links to, or copies or replications of, the personal data in question.
The data controller is not obliged to comply with a request for erasure made in the cases specified above if the processing is necessary:
- for the purpose of exercising the right to freedom of expression and information;
- for compliance with a legal obligation under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
- for reasons of public interest in the area of public health;
- for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, and the right to erasure would likely render impossible or seriously impair the achievement of the objectives of that processing; or e) for the establishment, exercise, or defence of legal claims.
If any of the above grounds apply and the data controller is not obliged to comply with the data subject's request for erasure, it must inform the data subject of this circumstance—and the reason for it—within 25 days.
Right to restriction of processing
The data subject has the right to obtain from the controller the restriction of processing where one of the following applies:
- the data subject contests the accuracy of the personal data, in which case the restriction applies for a period enabling the controller to verify the accuracy of the personal data;
- the data subject has objected to the processing; in this case, the restriction applies for the period until it is verified whether the legitimate grounds of the controller override those of the data subject.
Where the processing of personal data is restricted on the basis of the foregoing, such personal data shall, with the exception of storage, only be processed with the data subject's consent or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.
The data controller shall inform the data subject—at whose request the processing was restricted pursuant to the above—in advance about the lifting of the restriction on processing.
Obligation to notify regarding the rectification or erasure of personal data or the restriction of processing
The controller is obliged to inform every recipient to whom the personal data have been disclosed of any rectification, erasure, or restriction of processing, unless this proves impossible or involves disproportionate effort.
The data subject shall have the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used, and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:
- the data processing is based on the consent of the data subject (e.g. sending a newsletter) or on the fulfillment of a contractual obligation between the parties; and
- The data processing is carried out in an automated manner.
When exercising the right to data portability as described above, the data subject has the right to request—where technically feasible—the direct transmission of personal data between controllers.
The exercise of the right to data portability shall not prejudice the right to erasure. The exercise of the right to data portability shall not adversely affect the rights and freedoms of others.
Right to protest
The data subject has the right to object, on grounds relating to their particular situation, at any time to the processing of their personal data. In such a case, the controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.
Where personal data are processed for direct marketing purposes (e.g., sending marketing communications to clients), the data subject has the right to object at any time to the processing of personal data concerning them for such purposes, including profiling to the extent that it is related to such direct marketing. If the data subject objects to the processing of personal data for direct marketing purposes, the personal data shall no longer be processed for such purposes.
Right to withdraw consent
The data subject has the right to withdraw their consent to data processing at any time, provided that the legal basis for the processing is the data subject's consent (e.g., sending a marketing newsletter). However, the withdrawal of consent does not render the data processing carried out prior to the withdrawal unlawful.
Consent is deemed withdrawn if the data subject deletes their user account; alternatively, consent for the processing of personal data may be withdrawn via email by sending a deletion request to boristattoowien@gmail.com.
Legal remedy, Right to lodge a complaint, Judicial remedy
In other words, what can the data subject do if they believe their personal data is not being processed in accordance with the rules?
Right to lodge a complaint
The data subject has the right to lodge a complaint with a supervisory authority—particularly in the Member State of their habitual residence, place of work, or the place of the alleged infringement—if they consider that the processing of their personal data infringes the law. In Hungary, the competent supervisory authority is the National Authority for Data Protection and Freedom of Information (NAIH).
Exercising the right to lodge a complaint does not preclude the data subject from pursuing other administrative or judicial remedies if they believe that the processing of their personal data is unlawful. Thus, the data subject may initiate administrative or judicial proceedings concurrently with exercising their right to lodge a complaint.
You may lodge a complaint with the National Authority for Data Protection and Freedom of Information; the contact details for the Authority are as follows:
Name: National Authority for Data Protection and Freedom of Information ("Nemzeti Adatvédelmi és Információszabadság Hatóság")
Registered office: Hungary, 1055 Budapest, Falk Miksa utca 9-11.
Mailing address: 1530 Budapest, Pf.: 5.
Phone: +36 1 391 1400
Fax: +36 1 391 1410
Web: http://www.naih.hu
E-mail: ugyfelszolgalat@naih.hu
Data processing registration number: NAIH-126761/2017
Right to a judicial remedy against a decision of the NAIH or another supervisory authority
If you have turned to the supervisory authority (NAIH) regarding the processing of your data and the authority has issued a decision on your case, you—as the data subject—are entitled to seek judicial remedy against that decision (i.e., to challenge the decision in court). This right to judicial remedy also applies if the competent supervisory authority (NAIH) fails to handle the complaint or fails to inform you, within three months, of the procedural developments regarding the complaint or its outcome.
Proceedings against the supervisory authority (NAIH) must be initiated before the courts of the Member State where the supervisory authority is established.
Right to a judicial remedy against the controller or processor
The data subject is entitled to seek judicial remedy if they consider that their rights regarding data processing have been infringed as a result of the unlawful processing of their personal data. Exercising the right to judicial remedy does not preclude the data subject—should they consider that the processing of their personal data is unlawful—from pursuing other administrative or judicial remedies or exercising their right to lodge a complaint.
Proceedings against the controller or the processor shall be brought before the courts of the Member State where the controller or the processor has its place of establishment.
In the case of László Borsos Sole Proprietor the courts of the place of activity are the courts of Hungary, whereas the court with jurisdiction based on László Borsos Sole Proprietor’s registered office is Zalaegerszeg District Court.
The judicial remedy procedure can also be initiated before the court of the Member State of the habitual residence of the person concerned, unless the data controller or the data processor is a public authority of a Member State acting in its public authority.
Liability for Damages and Compensation for Non-Pecuniary Loss
In other words, how are the data controller and the data processor liable to the data subject in the event of damage?
If improper data processing causes damage to the data subject, the data controller is liable for compensation. A claim for damages arises if the data processing was unlawful or constituted a breach of contract, and the data subject suffered a financial loss as a result. In the event of unlawful data processing, the data subject may also claim compensation for non-pecuniary harm (grievance fee).
Claims for damages or compensation for non-pecuniary harm may primarily be asserted against the data controller. The data processor is liable for damages only if it violated the rules applicable to it or failed to follow the data controller’s lawful instructions; in other words, the data processor is not liable for errors committed by the data controller.
5. Storage of personal data and data processing security
The IT tools and solutions used for data management, especially the security systems, are chosen and used in such a way that the processed personal data is accessible to those authorized to do so, its authenticity and authentication are ensured, its immutability can be verified, and it is protected against unauthorized access.
Taking into account the current level of technical development, we ensure the security and protection of our data management with technical, organizational and organizational measures that ensure an adequate level of protection for your personal data.
September 10, 2026
