Privacy Policy

1. What principles do we follow when processing data?

When processing data, our company follows the principles below:

• we process personal data lawfully and fairly, and in a manner that is transparent to you.
• we collect personal data only for specified, explicit and legitimate purposes and do not process it in a manner incompatible with those purposes.
• the personal data we collect and process is adequate and relevant to the purposes of the processing and limited to what is necessary.
• our company takes every reasonable step to ensure that the data we process is accurate and, where necessary, kept up to date; inaccurate personal data is erased or rectified without delay.
• we store personal data in a form which permits your identification for no longer than is necessary for the purposes of the processing.
• by applying appropriate technical and organisational measures we ensure the appropriate security of personal data against unauthorised or unlawful processing, accidental loss, destruction or damage.

Our company processes your personal data

• on the basis of your prior informed and voluntary consent, only to the extent necessary and always for a specified purpose – that is, we collect, record, organise, store and use it.
• in certain cases the processing of your data is based on statutory provisions and is mandatory; in such cases we draw your attention to this fact separately.
• and in certain cases our company, or a third party, has a legitimate interest in processing your personal data – for example the operation, development and security of our website.

2. Who are we?

Name of the business

AAForgácsműhelye (Szilágyi Attila János, sole trader)

Registered seat

5630 Békés, Kecskeméti utca 20., Hungary

Website

https://aaforgacsmuhelye.hu

Postal address

5630 Békés, Kecskeméti utca 20., Hungary

E-mail address

info@aaforgacsmuhelye.hu

Tax number

41877742-1-24

Under Article 37 of the GDPR, our company is not obliged to appoint a data protection officer.

Our company's hosting provider:

Name of the hosting provider

Contact Net Kft.

Registered seat of the hosting provider

4400 Nyíregyháza, Toldi u. 52., Hungary

Website of the hosting provider

https://contactnet.hu/

E-mail address of the hosting provider

info@contactnet.hu

In the course of processing data – in order to serve our clients to a high standard – our company uses the following data processors:

Data controller (1)

Szilágyi Attila János

Address (1)

5630 Békés, Kecskeméti utca 20., Hungary

Areas of responsibility (1)

All activities

If the range of our data processors changes, we will update this notice accordingly.

The data we process:

We only ask visitors to our website for their personal data if they wish to register, log in or take part in a prize draw.

We do not link the personal data provided in connection with registration or the use of our marketing services, and identifying our visitors is fundamentally not our aim.

For any questions relating to data processing you may request further information at info@aaforgacsmuhelye.hu or at our postal address; we will send our reply to the contact details you provide within 15 days (but no later than 1 month).

3. What are cookies and how do we handle them?

Cookies are small data files (hereinafter: cookies) that are placed on your computer through the website while you use it, in such a way that your internet browser saves and stores them. Most of the most commonly used internet browsers (Chrome, Firefox, etc.) accept and allow the downloading and use of cookies by default; however, it is up to you whether you refuse or disable them by changing your browser settings, and you can also delete cookies already stored on your computer. The “help” menu of each browser provides more detailed information on the use of cookies.

There are cookies that do not require your prior consent. Our website provides brief information about these when you first begin your visit; such cookies include authentication, multimedia player, load balancing and user-interface customisation session cookies, as well as user-centric security cookies.

With regard to cookies that require consent – where the processing begins as soon as the page is visited – our company informs you when you first begin your visit and asks for your consent.

Our company does not use or permit cookies by means of which third parties could collect data without your consent.

Accepting cookies is not mandatory; however, our company accepts no responsibility if our website does not work as expected without cookies being enabled.

Which cookies do we use?

You can read about third-party cookies in detail on this page .

4. What else should you know about the data processing related to our website?

You provide your personal data to us voluntarily during registration or while in contact with our company, and we therefore ask you to take particular care that the data you supply is true, correct and accurate, as you are responsible for this. Incorrect, inaccurate or incomplete data may prevent you from using our services.

If you provide the personal data of another person rather than your own, we presume that you have the necessary authorisation to do so.

You may withdraw your consent to the processing at any time, free of charge

• by deleting your registration,
• by withdrawing your consent to the processing, or
• by withdrawing your consent to the processing or use of any data that must be provided during registration, or by requesting that it be blocked.

We undertake to register the withdrawal of consent – for technical reasons – within 30 days; we draw your attention, however, to the fact that in order to fulfil a legal obligation or to enforce our legitimate interests we may process certain data even after consent has been withdrawn.

In the event that misleading personal data is used, or if one of our visitors commits a criminal offence or attacks our company's system, we will delete that visitor's data without delay at the same time as terminating their registration, or – where necessary – retain it for the duration of establishing civil liability or conducting criminal proceedings.

5. What should you know about our data processing for direct marketing and newsletter purposes?

By means of the declaration you make during registration, or later by modifying the personal data stored on the newsletter and/or direct marketing registration interface (that is, by clearly expressing your intention to consent), you may consent to us using your personal data for marketing purposes as well. In that case – until your consent is withdrawn – we also process your data for direct marketing and/or newsletter purposes and send you advertising and other communications, as well as information and offers, and/or forward a newsletter to you (Section 6 of the Hungarian Advertising Act).

You may give your consent for direct marketing and for the newsletter together or separately, and you may withdraw it or them free of charge at any time.

We consider the deletion of a registration to be a withdrawal of consent in every case. We do not interpret the withdrawal of consent to data processing for direct marketing and/or newsletter purposes as a simultaneous withdrawal of consent to the data processing relating to our website. Each consent is given for a specific purpose, so registering on the website and subscribing to the newsletter are two separate purposes and two separate databases; the two cannot be linked.

We undertake to register the withdrawal of individual consents or unsubscriptions – for technical reasons – within 15 days.

6. What should you know about prize draws?

Our company may organise prize draws on a campaign basis, the individual conditions of which are set out in separate rules. The rules of the current campaign can always be found on the home page of our website, at a centrally placed link.

7. Other data processing questions

We may transfer your data only within the limits laid down by law, and in the case of our data processors we ensure through contractual stipulations that they cannot use your personal data for purposes contrary to your consent. Further information can be found in point 2.

Our company does not transfer data abroad.

Courts, the public prosecutor's office and other authorities (e.g. the police, the tax authority, the Hungarian National Authority for Data Protection and Freedom of Information) may contact our company to request information, the disclosure of data or the provision of documents. In such cases we must fulfil our obligation to supply data, but only to the extent strictly necessary to achieve the purpose of the request.

Our contributors and employees involved in our company's data processing are entitled to access your personal data to a predetermined extent, subject to an obligation of confidentiality.

We protect your personal data by appropriate technical and other measures, ensure the security and availability of the data, and protect it against unauthorised access, alteration, damage, disclosure and any other unauthorised use.

As part of our organisational measures we control physical access to our buildings, we train our employees on an ongoing basis and we keep paper documents locked away with appropriate protection. As part of our technical measures we use encryption, password protection and antivirus software. We draw your attention, however, to the fact that data transmission over the internet cannot be regarded as entirely secure. Our company does everything it can to make these processes as secure as possible, but we cannot accept full responsibility for data transmitted through our website; for data that has reached our company we observe strict rules in order to keep your data secure and to prevent unlawful access.

On matters of security we ask for your help in carefully safeguarding your access password to our website and in not sharing that password with anyone.

8. What are your rights and remedies?

In relation to the data processing you may

• request information,
• request the rectification, modification or completion of the personal data we process,
• object to the processing and request the erasure and blocking of your data (with the exception of mandatory processing),
• seek a remedy before a court,
• lodge a complaint with the supervisory authority or initiate proceedings ( https://naih.hu/panaszuegyintezes-rendje.html).

Supervisory Authority: Hungarian National Authority for Data Protection and Freedom of Information (NAIH)

Registered seat

1125 Budapest, Szilágyi Erzsébet fasor 22/c., Hungary

Postal address

1530 Budapest, P.O. Box 5, Hungary

Telephone

+36 (1) 391-1400

Fax

+36 (1) 391-1410

E-mail

ugyfelszolgalat@naih.hu

Website

https://naih.hu/

At your request we will provide information about the data of yours that we process, or that is processed by us or by the data processor appointed by us, including

• your data,
• its source,
• the purpose and legal basis of the processing,
• its duration, or if that is not possible, the criteria used to determine that duration,
• the name and address of our data processors and their activities relating to the processing,
• the circumstances and effects of any personal data breaches and the measures we have taken to remedy and prevent them, and
• in the case of a transfer of your personal data, the legal basis for and the recipient of the transfer.

We will provide our response within 15 days of the submission of the request (but no later than 1 month). The information is free of charge unless you have already submitted a request for information concerning the same set of data to us in the current year. We will refund any cost reimbursement you have already paid if we processed the data unlawfully or if the request for information led to a rectification. We may refuse to provide information only in the cases set out in law, indicating the relevant legal provision and informing you of the possibility of a judicial remedy and of turning to the Authority.

Our company notifies you, and all those to whom the data was previously transferred for processing purposes, of the rectification, blocking, marking and erasure of personal data, unless the failure to notify does not prejudice your legitimate interests.

If we do not comply with your request for rectification, blocking or erasure, within 15 days of receiving the request (but no later than 1 month) we will communicate the reasons for our refusal in writing or – with your consent – electronically, and inform you of the possibility of a judicial remedy and of turning to the Authority.

If you object to the processing of your personal data, we will examine the objection within 15 days of the submission of the request (but no later than 1 month) and inform you of our decision in writing. If we decide that your objection is well founded, we will cease the processing – including any further data collection and transfer – and block the data, and we will notify of the objection and the measures taken on its basis all those to whom we previously transferred the personal data concerned and who are obliged to take action in order to enforce the right to object.

We will refuse to comply with the request if we demonstrate that the processing is justified by compelling legitimate grounds which override your interests, rights and freedoms, or which relate to the establishment, exercise or defence of legal claims. If you do not agree with our decision, or if we fail to meet the deadline, you may turn to a court within 30 days of the communication of the decision or of the last day of the deadline.

Data protection lawsuits fall within the competence of the regional court; the action may also be brought – at the choice of the data subject – before the regional court of the data subject's place of residence or stay. A foreign national may also lodge a complaint with the supervisory authority competent at their place of residence.

Before turning to the supervisory authority or a court with your complaint, we ask you to contact our company first – for the sake of consultation and the quickest possible resolution of the problem.

9. What are the main laws governing our activities?

• Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (GDPR)
• Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Info Act)
• Act V of 2013 on the Civil Code
• Act CVIII of 2001 on certain issues of electronic commerce services and information society services (E-commerce Act)
• Act C of 2003 on Electronic Communications
• Act CLV of 1997 on Consumer Protection
• Act CLXV of 2013 on Complaints and Public Interest Disclosures
• Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activity (Advertising Act)

10. Amendment of this privacy notice

Our company reserves the right to amend this privacy notice, of which it will inform data subjects in an appropriate manner. Information relating to data processing is published on the https://aaforgacsmuhelye.hu website.

Dated: Budapest, 12 August 2026.