DATA PROCESSING PROVISIONS
(AppSolution Kft. Privacy Notice)
This English version is a translation provided for your convenience. In case of any discrepancy, the Hungarian version prevails.
Contents
1. Introduction
1.1. Data controller details
| Company name | AppSolution Kft. |
|---|---|
| Registered office | Petőfi Sándor utca 48., 2724 Újlengyel, Hungary |
| Contact (email) | info@appsolution.hu |
| Contact (phone) | +36 30 661 9814 |
| Tax number | 26648343-2-13 |
| Company registration number | 13-09-248422 |
The Company has not appointed a data protection officer.
1.2. Applicable laws
- GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data
- Infotv. – Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information
- Act CXXXIII of 2005 – Hungarian act on the rules of personal and property protection and private investigation
2. Rights of data subjects
Data subjects have the following rights:
- Right to information – The data subject may obtain information about the circumstances of the processing
- Right of access – The data subject has the right to obtain confirmation as to whether their personal data is being processed and to access all information related to the processing
- Right to data portability – The data subject has the right to receive their personal data in a structured, commonly used and machine-readable format
- Right to rectification – The data subject has the right to request the correction of inaccurate personal data
- Right to erasure (“right to be forgotten”) – The data subject has the right to request the erasure of their personal data where one of the grounds set out in Article 17(1) of the GDPR applies
- Right to restriction of processing
- Right to object
3. Response time
The controller will act on the data subject's request without undue delay and in any event within one month. Where necessary, this period may be extended by two months.
4. Security of data processing
The Company implements appropriate technical and organizational measures to ensure the security of processing, taking into account:
- The state of the art
- The costs of implementation
- The nature, scope, context and purposes of the processing
- The risks to the rights and freedoms of natural persons
5. Personal data breaches
In the event of a personal data breach, the controller:
- Notifies the competent supervisory authority (NAIH) within 72 hours
- Informs the data subjects if the breach is likely to result in a high risk to their rights and freedoms
- Documents the breach and the measures taken
6. Legal remedies
The data subject's options for legal remedy:
- Filing a complaint with the Company – Through the controller's contact details
- Filing a complaint with the supervisory authority:
- Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
- Address: Falk Miksa utca 9-11., 1055 Budapest, Hungary
- Phone: +36 1 391 1400
- Email: ugyfelszolgalat@naih.hu
- Website: www.naih.hu
- Judicial remedy – At the data subject's choice, before the regional court having jurisdiction over their place of residence or place of stay
7. Data processors
In the course of its processing activities, the Company uses the following data processors:
| Processor | Activity | Location |
|---|---|---|
| Hosting provider | Website hosting, server operation | Within the EU/EEA |
| Email provider (SMTP) | Email delivery (delivering messages received through the contact form and the AI calculator) | Within the EU/EEA |
| Anthropic, Inc. | AI language model service – processing the AI calculator's chat messages and generating responses | USA – legal basis for the transfer: EU–US Data Privacy Framework (Anthropic, Inc. is a certified participant) |
Processors are not entitled to use personal data on their own and may act only on the controller's instructions. The Company only uses processors that provide sufficient guarantees of meeting the requirements of the GDPR.
8. Processing activities
8.1. Processing related to people interested in our services
| Purpose of processing | Getting in touch and providing information about our services |
|---|---|
| Legal basis | GDPR Article 6(1)(a) – consent of the data subject |
| Data processed | Name, email address, phone number, message content |
| Retention period | Until consent is withdrawn, but no longer than 5 years |
| Recipients | The Company's relevant employees |
| How consent is given | Before submitting the contact form, the data subject actively and unambiguously consents to the processing of their personal data by ticking a separate checkbox, after being informed of this Privacy Policy. The checkbox is unticked by default, and the form cannot be submitted without giving consent. |
8.2. Processing related to client relationships
| Purpose of processing | Concluding and performing contracts, maintaining client relationships |
|---|---|
| Legal basis | GDPR Article 6(1)(b) – performance of a contract |
| Data processed | Name, address, email, phone number, billing details |
| Retention period | 5 years after the contract ends (accounting obligations: 8 years) |
8.3. Newsletter
| Purpose of processing | Direct marketing communication and information |
|---|---|
| Legal basis | GDPR Article 6(1)(a) – consent of the data subject |
| Data processed | Name, email address |
| Retention period | Until consent is withdrawn |
| Unsubscribing | Every newsletter contains an unsubscribe link |
8.4. Cookies
| Purpose of processing | Operating the website, improving the user experience, statistics |
|---|---|
| Legal basis | GDPR Article 6(1)(a) – consent of the data subject |
| Data processed | IP address, browser type, visit data |
| Cookie types | Session cookies, persistent cookies, analytics cookies |
| Retention period | Session: until the end of the session; persistent: for the configured period |
8.5. CCTV surveillance system
| Purpose of processing | Protection of property, security |
|---|---|
| Legal basis | GDPR Article 6(1)(f) – legitimate interest + Hungarian Act CXXXIII of 2005 |
| Data processed | Video footage, likeness |
| Where footage is stored | On a server located in the server room at the Company's registered office |
| Retention period | If not used, no longer than 60 days |
| Operating hours | 24 hours a day, 7 days a week |
| Note | There is no continuous live monitoring; footage is recorded |
| Legitimate interest assessment | See Annex 1 |
No cameras are installed:
- In restrooms
- In dining or break areas
- In smoking areas
- In any other place where employees spend their breaks
8.6. Processing related to job applicants
| Purpose of processing | Recruitment process, facilitating contact |
|---|---|
| Legal basis | GDPR Article 6(1)(a) – consent of the data subject |
| Data processed | Name, home address, place and date of birth, mother's name, contact details (email, phone number), education and training details, photo, language skills, professional experience, previous employers, hobbies |
| Data subjects | Everyone who applies for a job posting or position |
| Recipients | The controller does not share application documents (résumé, cover letter, application materials) with third parties |
| Retention period | Until the selection process closes + 6 months, or until consent is withdrawn |
Rights of data subjects:
- They may obtain information about the circumstances of the processing
- They may obtain confirmation as to whether their personal data is being processed
- They have the right to receive their data in a structured, commonly used and machine-readable format
- They may request the correction of inaccurate data
- They may request the erasure of their personal data (GDPR Article 17)
8.7. AI calculator – cost estimation chat
| Purpose of processing | Providing AI-based development cost estimates and facilitating contact with the prospective client |
|---|---|
| Legal basis | GDPR Article 6(1)(a) – consent of the data subject |
| Data processed | Name, email address, project description (content of chat messages), content of any attached document, the full chat transcript |
| Where data is stored | The browser's local storage (localStorage), which the data subject can clear at any time; the chat transcript is also stored as an email in the controller's mailbox |
| Retention period | localStorage: until the browser data is cleared; email transcript: until consent is withdrawn, but no longer than 5 years |
| Data transfer | To Anthropic, Inc. (USA), to the extent needed to generate AI responses, under the EU–US Data Privacy Framework (see Section 7) |
| How consent is given | Before using the AI calculator, the data subject actively and unambiguously consents to the processing of their personal data by ticking a separate checkbox, after being informed of this Privacy Policy. The checkbox is unticked by default, and the chat cannot be started without giving consent. |
| Note | The AI calculator provides an indicative estimate and does not make any legally binding automated decision about the data subject (it does not fall under Article 22 of the GDPR). |
8.8. Processing related to our social media profiles
| Purpose of processing | Maintaining social media profiles, publishing content, analyzing visitor statistics |
|---|---|
| Platforms concerned | Facebook, Instagram, LinkedIn, YouTube |
| Legal basis | GDPR Article 6(1)(f) – the controller's legitimate interest (maintaining a social media presence, brand communication) |
| Data processed | Name and any personal data the data subject publishes on the social media platform or writes in a comment |
| Recipients | The Company's relevant employees |
| Storage | The Company does not store personal data in its own systems, only anonymized statistics |
| Duration | For as long as the platform's policies allow or until the data subject deletes the relevant information |
Note: The Company does not track or archive individual profiles, and the statistics are anonymized. It only sees the public profiles of registered users/followers and their comments on the pages the Company manages.
9. Other information
- The Company does not engage in automated decision-making or profiling.
- Withdrawal of consent: Where processing is based on the data subject's consent, or the data subject has given explicit consent to the processing of special categories of personal data, consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. Consent can be withdrawn in writing using the Company's contact details (see Section 1.1).
Annex 1: Legitimate interest assessment under the GDPR for CCTV surveillance
1. Legal basis, personal data processed and purpose of processing
Under Article 6(1)(f) of the GDPR: “Processing shall be lawful only if and to the extent that at least one of the following applies: [...] processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”
Personal data processed: video footage recorded by the electronic surveillance system and the likenesses of the data subjects.
2. The controller's legitimate interest
The Company has a legitimate interest in the security of property at its registered office/premises. The controller operates the electronic surveillance system in premises that are also open to clients. The Hungarian legislature has also recognized the weight of the interest in protecting property by expressly permitting, within the framework of Act CXXXIII of 2005, the operation of electronic surveillance systems for such purposes, with a restriction of the right to informational self-determination.
3. The data subjects' rights and freedoms regarding the protection of personal data
The electronic surveillance system records footage of the data subjects (employees and other visitors to the area). This footage can only be viewed by the persons specified in the policy, and if not used, it is deleted after no more than 60 days. In general, the processing does not affect the data subject's privacy.
Safeguards for employees:
- A detailed privacy notice is available to data subjects
- The camera system is not aimed at monitoring individual employees; the cameras cover work areas
- The camera system is not suitable for monitoring work performance or an individual's work
- It is not suitable for influencing employees' behavior at work
- Human dignity is respected (no cameras in restrooms, dining or break areas, smoking areas, etc.)
- The cameras' field of view covers only the areas consistent with their purpose
- Only a small group of people may review the footage, and the circumstances must be documented
- The recording method does not allow searching by person; recordings are indexed by date and event
4. Outcome of the assessment
The assessment concluded that the controller has a legitimate interest in maintaining the security of property, and that the processing does not affect the data subject's privacy, since in general neither the controller nor any third party identifies the data subject using the processed data.
The surveillance therefore carries no risk, or only a very low risk, of negative impact on the rights and freedoms of employees and data subjects. It is the least intrusive form of monitoring with respect to privacy.
Therefore, the data specified above may be processed by the controller under Article 6(1)(f) of the GDPR.
Document date: May 21, 2026
