Privacy notice for clients
The protection of your personal data is of the utmost importance to us, and this Privacy Notice explains what personal data we process about you, for what purposes and on what legal basis. The Privacy Notice also sets out your rights.
Data of the Data Controller
Data Controller: Wozify Engineering Group Kft.
Head office: 1043 Budapest, Berda József utca 42. 2. floor. Door 11.
Company registration number: 01-09-414698
Tax number: 23879102-2-41
Website: www.wozify.com
Contact details of the Data Protection Officer: [email protected]
General legislation on which the processing is based
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR)
- Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (Infotv.)
- Act V of 2013 on the Civil Code (Civil Code)
- Act CXXVII of 2007 on Value Added Tax (VAT Act)
- Act C of 2000 on Accounting (Accounting Act)
Concepts
Personal Data: any information relating to an identified or identifiable natural person ("Data Subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Such typical personal data include in particular: name, address, place and date of birth, mother's name.
Data processing: any operation or set of operations which is performed upon personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Controller: the natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of the processing are determined by Union or Member State law, the Controller or the specific criteria for the designation of the Controller may also be determined by Union or Member State law.
Data Processor: a natural or legal person, public authority, agency or any other body that processes personal data on behalf of the Controller.
Recipient: the natural or legal person, public authority, agency or any other body, whether or not a third party, with whom or to which the personal data are disclosed.
Principles
The Data Controller shall take into account the following principles in the processing of personal data, including:
- be carried out lawfully and fairly and in a transparent manner for the Data Subject (lawfulness, fairness and transparency)
- collected only for specified, explicit and legitimate purposes and not processed in a way incompatible with those purposes; further processing for archiving purposes in the public interest, scientific and historical research purposes or statistical purposes is not considered incompatible with the original purpose in accordance with Article 89(1) of the GDPR (purpose limitation)
- be adequate, relevant and limited to what is necessary for the purposes for which the data are processed (data minimisation)
- be accurate and, where necessary, kept up to date; all reasonable steps must be taken to ensure that personal data which are inaccurate for the purposes for which they are processed are erased or rectified without delay (accuracy)
- be kept in a form which permits identification of Data Subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be kept for longer periods only if the personal data will be processed for archiving purposes in the public interest, scientific and historical research purposes or statistical purposes in accordance with Article 89(1) of the GDPR, subject to the implementation of appropriate technical and organisational measures to safeguard the rights and freedoms of Data Subjects as provided for in this Regulation (limited storage)
- be processed in such a way as to ensure adequate security of personal data, including protection against unauthorised or unlawful processing, accidental loss, destruction or damage (integrity and confidentiality), by using appropriate technical or organisational measures
- the Data Controller is responsible for compliance with the above and must be able to demonstrate such compliance (accountability)
Data management activities
Data processing activities in the capacity of data controller
contact us (website)
| Purpose of data processing | Contacting, maintaining contact |
| Legal basis for data processing | Article 6(1)(b) GDPR: necessary for the performance of the contract or for taking steps at the request of the Data Subject prior to the conclusion of the contract |
| Categories of Affected Persons | Interested |
| Scope of personal data | Name, phone number, email address, message content |
| Data retention time | 1 year from the date of contact |
| Data transmission | No transfer of data pursuant to Articles 44-49 of the GDPR |
| Addressees | The Data Controller uses Data Processor(s): mail system provider(s): Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland) Microsoft Hungary Ltd. (registered office: 1031 Budapest, Graphisoft Park 3., company registration number: 01-09-262313) Tárhely.Eu Szolgáltató Kft. (registered office: 1097 Budapest, Könyves Kálmán körút 12-14., company registration number: 01-09-909968) Hosting provider: UpCloud Oy. (headquarters: Aleksanterinkatu 15b 7th floor, 00100 Helsinki, Finland) |
| Source of data | The source of the personal data is the interested party |
| How to provide data, consequences | The data must be provided. If you do not provide the personal data, the Data Controller will not be able to contact you. |
contact by email
| Purpose of data processing | Contact us by email |
| Legal basis for data processing | Article 6(1)(b) GDPR: necessary for the performance of the contract or for taking steps at the request of the Data Subject prior to the conclusion of the contract |
| Categories of Affected Persons | Interested |
| Scope of personal data | Name, phone number, email address, message content |
| Data retention time | 1 year from the date of contact |
| Data transmission | No transfer of data pursuant to Articles 44-49 of the GDPR |
| Addressees | The Data Controller uses Data Processor(s): mail system provider(s): Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland) Microsoft Hungary Ltd. (registered office: 1031 Budapest, Graphisoft Park 3., company registration number: 01-09-262313) Tárhely.Eu Szolgáltató Kft. (registered office: 1097 Budapest, Könyves Kálmán körút 12-14., company registration number: 01-09-909968) |
| Source of data | The source of the personal data is the interested party |
| How to provide data, consequences | The data must be provided. If you do not provide the personal data, the Data Controller will not be able to contact you. |
booking an appointment
| Purpose of data processing | Booking an appointment |
| Legal basis for data processing | Article 6(1)(b) GDPR: necessary for the performance of the contract or for taking steps at the request of the Data Subject prior to the conclusion of the contract |
| Categories of Affected Persons | Customer, customer's employee |
| Scope of personal data | Name, email address, message |
| Data retention time | 1 year from the date of booking |
| Data transmission | Transfers are made in accordance with Articles 44-49 of the GDPR |
| Addressees | The Data Controller uses Data Processor(s): time booking system provider: Calendly Inc. (271 17th Street North West 10th Floor, Atlanta, Georgia, 30363, USA) |
| Source of data | The source of the personal data is the customer, customer's employee |
| How to provide data, consequences | The data must be provided. If you do not provide personal data, you will not be able to book an appointment |
online consultation
| Purpose of data processing | Hold an online consultation |
| Legal basis for data processing | Article 6(1)(b) GDPR: for the performance of the contract or for taking steps at the request of the Data Subject prior to the conclusion of the contract |
| Categories of Affected Persons | Client |
| Scope of personal data | Name, email address |
| Data retention time | 1 year from the date of consultation |
| Data transmission | No transfer of data pursuant to Articles 44-49 of the GDPR |
| Addressees | The Data Controller uses Data Processor(s): mail system provider(s): Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland) Microsoft Hungary Ltd. (registered office: 1031 Budapest, Graphisoft Park 3., company registration number: 01-09-262313) Tárhely.Eu Szolgáltató Kft. (registered office: 1097 Budapest, Könyves Kálmán körút 12-14., company registration number: 01-09-909968) online meeting platform provider: Zoom Lionheart Squared Ltd. (based at 2 Pembroke House, 28-32 Upper Pembroke Street, Dublin DO2 EK84, Ireland) |
| Source of data | Source of personal data is the customer |
| How to provide data, consequences | The provision of data is voluntary. If you do not provide the personal data, the Data Controller will not be able to consult you. |
conclusion of a contract
| Purpose of data processing | Conclusion of contract (agency, contracting and services) |
| Legal basis for processing | Article 6(1)(b) GDPR: necessary for the performance of the contract or for taking steps at the request of the Data Subject prior to the conclusion of the contract |
| Categories of Affected Persons | Client, affiliate partner, partner (sole proprietor, LLC, Bt., Zrt.) |
| Scope of personal data | Company name, registered office, company registration number, tax number, representative's name, signature |
| Data retention time | For 5 years from the date of performance or termination of the contract |
| Data transmission | No transfer of data pursuant to Articles 44-49 of the GDPR |
| Addressees | The Data Controller uses Data Processor(s): mail system provider(s): Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland) Microsoft Hungary Ltd. (registered office: 1031 Budapest, Graphisoft Park 3., company registration number: 01-09-262313) Tárhely.Eu Szolgáltató Kft. (registered office: 1097 Budapest, Könyves Kálmán körút 12-14., company registration number: 01-09-909968) electronic signature provider: Adobe Inc. (based at Citywest Business Campus Saggart, Dublin 24 Ireland) |
| Source of data | The source of the personal data is the customer, affiliate partner, partner (sole trader, Ltd., Bt., Zrt.) |
| How to provide data, consequences | The data must be provided. If you do not provide the personal data, the Data Controller cannot conclude a contract with you. |
billing
| Purpose of data processing | Issuing an invoice |
| Legal basis for data processing | Article 6(1)(c) GDPR: fulfilment of a legal obligation: section 159(1) of the VAT Act |
| Categories of Affected Persons | Client |
| Scope of personal data | Name, address, tax number (for business customers), email address |
| Data retention time | Pursuant to paragraphs (1) and (2) of § 169 of the Accounting Act 8 years |
| Data transmission | No transfer of data pursuant to Articles 44-49 of the GDPR |
| Addressees | The Data Controller uses Data Processor(s): billing software operator: KBOSS.hu Kft. (registered office: 1031 Budapest, Záhony utca 7/D., company registration number: 01-09-303201) accountant: AC Business Connect Kft. (registered office: 1157 Budapest, Nyírpalota út 83. 7. floor 44., company registration number: 01-09-974166) The Data Controller shall provide data to the National Tax and Customs Administration (NAV) in accordance with point 1 of Annex 10 of Act CXXVII of 2007 on Value Added Tax (VAT Act). |
| Source of data | Source of personal data is the customer |
| How to provide data, consequences | Providing the data is mandatory. If you do not provide the personal data, the Data Controller will not be able to fulfil its legal obligation to invoice. |
payment for services
| Purpose of data processing | Payment for the service by bank transfer |
| Legal basis for data processing | Article 6(1)(b) GDPR: necessary for the performance of the contract or for taking steps at the request of the Data Subject prior to the conclusion of the contract |
| Categories of Affected Persons | Client |
| Scope of personal data | Name, service ID, bank account number, amount of transfer, time of transfer |
| Data retention time | Pursuant to paragraphs (1) and (2) of § 169 of the Accounting Act 8 years |
| Data transmission | No transfer of data pursuant to Articles 44-49 of the GDPR |
| Addressees | The Data Controller does not use Data Processor(s) The personal data is accessed by the Controller's bank as a separate Controller: Raiffeisen Bank Zrt. (head office 1133 Budapest, Váci út 116-118., company registration number: 01-10-041042). The Bank's Privacy Policy is available here: https://www.raiffeisen.hu/documents/10165/12833/Altalanos_adatvedelmi_es_adatkezelesi_tajekoztato.pdf payment service provider: Wise Europe SA (head office: Rue du Trône 100, 3rd floor, Brussels, 1050 Belgium) The provider's privacy policy is available here: https://wise.com/gb/legal/global-privacy-policy-en#chapter1 |
| Source of data | Source of personal data is the customer |
| How to provide data, consequences | The data must be provided. If you do not provide the personal data, the Data Controller will not be able to provide you with services. |
customer opinion
| Purpose of data processing | Show customer reviews |
| Legal basis for processing | Article 6(1)(a) GDPR: consent |
| Categories of Affected Persons | Client |
| Scope of personal data | Name, content of opinion |
| Data retention time | Until the withdrawal of consent or for 30 days after the withdrawal of consent |
| Data transmission | Transfers are made in accordance with Articles 44-49 of the GDPR |
| Addressees | The Data Controller uses Data Processor(s): Hosting provider: UpCloud Oy. (headquarters: Aleksanterinkatu 15b 7th floor, 00100 Helsinki, Finland) assessment management software provider: Clutch (headquarters: 1800 Massachusetts Ave, Suite 200, Washington, DC 20036., USA) form builder software provider: Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland) |
| Source of data | Source of personal data is the customer |
| How to provide data, consequences | The provision of data is voluntary. If you do not provide personal data, the Data Controller will not be able to display your opinion. |
contractual relations
In the case of its contracted partners (suppliers, customers), the Data Controller communicates and maintains business relations through its contact person as set out in the contract.
| Purpose of data processing | Maintaining communication and cooperation in order to fulfil the purpose of the contract between the Data Controller and the Partner |
| Legal basis for data processing | Article 6(1)(f) GDPR: legitimate interest |
| Categories of Affected Persons | Employee of the partner (sole trader, Ltd., Bt., Zrt.) as the designated contact person |
| Scope of personal data | Name, position, phone number, email address |
| Data retention time | For 5 years from the date of performance or termination of the contract |
| Data transmission | No transfer of data pursuant to Articles 44-49 of the GDPR |
| Addressees | The Data Controller uses Data Processor(s): mail system provider(s): Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland) Microsoft Hungary Ltd. (registered office: 1031 Budapest, Graphisoft Park 3., company registration number: 01-09-262313) Tárhely.Eu Szolgáltató Kft. (registered office: 1097 Budapest, Könyves Kálmán körút 12-14., company registration number: 01-09-909968) |
| Source of data | Source of personal data is the contact person of the partner |
| How to provide data, consequences | The data must be provided. If you do not provide the personal data, the Data Controller will not be able to match the partner |
communication on social networking sites
| Purpose of data processing | Communicating on social networking sites |
| Legal basis for processing | Article 6(1)(a) GDPR: consent |
| Categories of Affected Persons | Person registered on a community site |
| Scope of personal data | Name, public profile data |
| Data retention time | The data processing takes place on social networking sites, so the privacy policy of the relevant social networking site is applicable. |
| Data transmission | No transfer of data pursuant to Articles 44-49 of the GDPR |
| Addressees | The Data Controller does not use Data Processor(s) The Data Controller is a joint controller with the social networking site operator , whose company name, registered office and privacy policy are set out in Chapter 7. |
| Source of data | The source of personal data is the registered person |
| How to provide data, consequences | The provision of data is voluntary. If you do not provide the personal data, the Data Controller will not be able to communicate with you on social networking sites |
Data processing activities in the capacity of a data processor
a) use of the service
| Purpose of data processing | Use of software development services (development and operation of software applications) |
| Legal basis for processing | Article 6(1)(b) GDPR: necessary for the performance of the contract or for taking steps at the request of the Data Subject prior to the conclusion of the contract |
| Categories of Affected Persons | Customer, customer contact person |
| Scope of personal data | Data required to perform the service |
| Data retention time | For 5 years from the date of performance or termination of the contract |
| Data transmission | No transfer of data pursuant to Articles 44-49 of the GDPR |
| Addressees | The Data Controller will use Data Processor(s), which will be individually informed |
| Source of data | Source of personal data is the customer, customer contact person |
| How to provide data, consequences | The data must be provided. If you do not provide the personal data, the Data Controller will not be able to provide you with services. |
Website data management
The Website uses cookies.
A cookie is a file that is placed on your computer when you visit a website. A cookie is a packet of information that the server sends to the browser, and then each time you request a cookie, the browser sends it back to the server with the data content specified by the server. The purpose of this is to save the Internet settings of the website you are visiting, so that when you visit the same website again from the same device, the site will remember the parameters you have set.
The cookie has countless functions. Cookies are most often used to personalise ads, services and analyse website traffic.
Under current legislation, cookies can only be stored on your device if they are absolutely necessary, i.e. they are essential for the website to function, and are called "necessary cookies". For all other types of cookies, your consent is required. You can view and set the cookies currently used on the website in a pop-up window when you access the website.
Modern browsers allow you to change cookie settings. Some browsers automatically accept cookies by default, but you can change this setting to prevent automatic acceptance in the future. If you change this setting, the browser will offer you the option to set cookies each time you change it.
Given that the cookies are intended to support and facilitate the usability and processes of the website, it cannot be guaranteed that you will be able to use all the features of the website to their full extent if you disable cookies. The website may then function differently than intended in the browser. For more detailed information on cookie settings for the browsers below:
Google Chrome
Firefox
Microsoft Internet Explorer 11
Microsoft Internet Explorer 10
Microsoft Internet Explorer 9
Microsoft Internet Explorer 8
Microsoft Edge
Safari
Social media
The Data Controller is available on the following social networking site(s).
The operator of the social networking site together with the Data Controller is considered a joint Data Controller, information on data processing is available at the following links:
| Community page: | |
| Name of data controller: | Meta Platforms Ireland Ltd. (Merrion Road, Dublin 4 D04 X2K5, Ireland) |
| Contact details of the Privacy Notice: | https://www.facebook.com/privacy/explanation |
| Name of data controller: | LinkedIn Ireland Unlimited Company (based in Wilton Plaza Wilton Place, Dublin 2 Ireland) |
| Contact details of the Privacy Notice: | https://www.linkedin.com/legal/privacy-policy |
The Data Controller does not record or process personal data about the user of the given social networking site in its internal database and system.
Access to data
Personal data may be accessed by the competent staff of the Data Controller to the extent necessary for the performance of their tasks.
Data security measures
The Data Controller shall take appropriate IT, technical and personnel measures to protect the personal data it processes against, inter alia, unauthorised access or unauthorised alteration.
Data Subjects' rights in relation to data processing and their content
| About data management Right of access | Content of the Data Subject's right in relation to data processing |
| Right to information /Articles 13-14 of the GDPR/ | You have the right to be informed of the fact and purposes of the processing at the time of obtaining your personal data. The Controller will also provide you with such additional information as is necessary to ensure fair and transparent processing, taking into account the specific circumstances and context in which the personal data are processed. You shall also be informed of the fact of profiling and its consequences. |
| Right of access /Article 15 of the GDPR/ | You have the right to request information from as to whether or not your personal data is being processed and, if such processing is taking place, you have the right to be informed that the Data Controller: what personal data on what legal basis for what processing purpose how long it treats to whom, when, under which law, to which personal data, to whom you have given access or to whom you have transferred your personal data the source of your personal data (if not provided by you to the Data Controller) whether it uses automated decision-making and its logic, including profiling. |
| Right to rectification /Article 16 of the GDPR/ | You have the right to have inaccurate personal data concerning you corrected or incomplete personal data completed by the Data Controller at your request. You may therefore request that the Controller amend any of your personal data (for example, you may change your e-mail address or other contact details at any time). |
| Right to erasure ("right to be forgotten") /Article 17 of the GDPR/ | You have the right to have your personal data deleted by the Data Controller at your request if one of the following grounds applies: your personal data are no longer necessary for the purposes for which they were collected or otherwise processed you withdraw your consent on the basis of which the processing was based pursuant to Article 6(1)(a) or Article 9(2)(a) and there is no other legal basis for the processing you object to processing on the basis of Article 21(1) and there are no overriding legitimate grounds for processing, or you object to processing on the basis of Article 21(2) your personal data have been unlawfully processed your personal data must be erased in order to comply with a legal obligation under Union or Member State law to which the Data Controller is subject your personal data have been collected in connection with the provision of information society services referred to in Article 8(1). |
| Right to restriction /Article 18 of the GDPR/ | You have the right to have the Controller restrict the processing of your personal data at your request if one of the following grounds applies: You contest the accuracy of your personal data (in which case the limitation applies for the period of time that allows the Controller to verify the accuracy of the personal data) the processing is unlawful and you oppose the erasure of the data and instead request the restriction of their use the Controller no longer needs the personal data for the purposes of processing, but you require them for the establishment, exercise or defence of a legal claim You have objected to the processing pursuant to Article 21(1) (in which case the restriction applies for the period until it is established whether the legitimate grounds of the Controller prevail over your legitimate grounds). |
| Right to data portability /Article 20 of the GDPR/ | You have the right to receive personal data concerning you which you have provided to a Data Controller in a structured, commonly used, machine-readable format and the right to transmit such data to another Data Controller without hindrance from the Data Controller to which you have provided the personal data, if: the processing is based on consent within the meaning of Article 6(1)(a) or Article 9(2)(a), or on a contract within the meaning of Article 6(1)(b), and the processing is carried out by automated means. You have the right to request, where technically feasible, the direct transfer of your personal data between Data Controllers. |
| Right to object /Article 21 of the GDPR/ | You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Article 6(1)(e) or (f), including profiling based on those provisions. In such a case, the Controller may no longer process your personal data unless the Controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims. If your personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such purposes, including profiling, where it is related to direct marketing. |
| Right to withdraw consent /Article 7(3) GDPR/ | You have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of the processing based on consent prior to its withdrawal. You must be informed of this before consent is given. The withdrawal of consent shall be made possible in the same simple manner as the granting of consent. |
Data subject's remedies in relation to data processing and their content
| Legal remedies | Content of the remedy |
| Right to complain to the Supervisory Authority /Article 77 of the GDPR/ | If your right to the protection of your personal data is infringed, you may lodge a complaint with the following Authority: National Authority for Data Protection and Freedom of Information head office: 1055 Budapest, Falk Miksa utca 9-11. mailing address: 1363 Budapest, Pf. 9. phone: +36 (1) 391-1400 email: [email protected] Website: www.naih.hu |
| The right to an effective judicial remedy against the Controller or the Processor (initiation of legal proceedings) /Article 79 of the GDPR/ | You have the right to take legal action against the Controller or Processor if you consider that the processing of your personal data is unlawful. The court will decide the case out of turn. In such a case, you are free to decide whether to bring your action before the competent court in your place of residence or domicile. Contact details of the courts: www.birosag.hu/torvenyszekek |
Update of the Privacy Notice
The Data Controller reserves the right to unilaterally amend this Privacy Notice. In particular, this Privacy Notice may be amended if necessary due to changes in legislation, data protection authority practices, business needs or other circumstances. At the Data Subject's request, the Controller shall send him a copy of the current version of the Privacy Notice in the form agreed with him.
Budapest, 15 April 2025.