Privacy Policy - ABT Hungária

In effect since: 2018.06.25.

Last review: 2025.04.04.

1. Data controllers and contact details

Name: ABT Hungária Tanácsadó Kft., ABT Hungária Könyvvizsgáló Kft.

(hereinafter, together: „ABT Treuhand Csoport” or „ABT”)

Contact:

Headquarters

E-mail address

Phone number

Data protection responsible

1037 Budapest, Montevideo u. 3/A.

[email protected]

06-1-4303400

Smohay Ferenc

[email protected]

2. Data processors

Name	Headquearters	Contact	Data processing activity
MediaCenter Hungary Kft.	H-6001 Kecskemét, Sosztakovics u. 3. II./6.	E-mail address: [email protected] Phone number: +36 21 201 0505	Handles hosting for this website.
Collective Art Kft.	H-1053 Budapest, Veres Pálné utca 13. fszt. 4.	E-mail address: [email protected]	Web developer, provides the technical background for the website.
MPC Hardver Kft.	H-3300 Eger, Petőfi S. u. 19.	E-mail address: [email protected] Phone number: +36 30 3 499 599	Provides IT support for ABT Treuhand.
Microsoft Ireland Operations Limited	One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland	Phone number: (+1) 425-882-8080	ABT Treuhand uses Microsoft’s mail system (Outlook).

3. Recipients

ABT does not, in principle, transfer personal data to third parties other than Data Processors.

Exceptions to this are when ABT needs to send an invoice containing personal data to the National Tax and Customs Administration of Hungary (hereinafter: NAV), or when ABT needs a power of attorney to provide its services and needs to transmit this power of attorney to the competent authority, bank – payroll, accounting – or to the NAV in the case of tax advice.

4. Processing of personal data

4.1. Contacting, enquiries and making an offer

Enquiries and requests for offers can be submitted to ABT via the contact details provided by ABT or via the contact form on the website. ABT requests the contact details and other offer-related information necessary for smooth communication and for establishing cooperation between the parties concerned. The submission of certain data (e.g. telephone number) is optional. ABT will prepare the offer for the contracting party in accordance with the requirements set out in the request for the offer. If this is necessary to prepare the offer, the ABT may also request additional information. The prepared proposal will be sent by ABT via the contact details provided by the contracting party.

You have the right to object to the processing of your personal data based on legitimate interests at any time on grounds relating to your particular situation.

Purpose of data processing	Legal basis of data processing	Scope of personal data	Duration of data processing
Identifying the contacting person and the interested parties and assessing their needs.	legitimate interest of ABT: Promoting possible assignments and business relations paragraph (f) of subsection (1) Article 6 of GDPR	· Contact persons’ identification and contact data: (e.g., name, e-mail address, phone number) · Information regarding the enquiry or the request of offer (e.g. service of interest, message content, date of consultation) · Other optional data (e.g. name of company, phone number)	The retention period is determined by taking into account the time needed to respond to the enquiry, to decide on the offer and to make an offer, and the timeliness of the request.
Preparing and sending a proposal for ABT’s services.	legitimate interest of ABT: maintaining and expanding its customer base paragraph (f) of subsection (1) Article 6 of GDPR	· Identification and contact details of the interested party (e.g. name, e-mail address, telephone number, position) · Other personal data required to prepare and send the proposal (e.g. in case of payroll services employment data)	For this purpose, the retention period will be determined by taking into account the validity of the offer and the decisions about it.
If an enquiry or request is received by the ABT via this website or e-mail, the following data processors are involved in the process:
MediaCenter Hungary Kft., Collective Art Kft., Microsoft Ireland Ltd, MPC Hardver Kft.

4.2. Contracting

ABT provides a wide range of services to its clients in a contractual relationship. When necessary for the performance of a particular service, in addition to the service contract, it also processes personal data related to the power of attorney (e.g. accounting, payroll, tax advice) or due diligence of the client (e.g. accounting, tax advice).

You have the right to object to the processing of your personal data based on legitimate interests at any time on grounds relating to your particular situation.

Purpose of data processing	Legal basis of data processing	Scope of personal data	Duration of data processing
The conclusion of a valid contract between ABT and their customers, which facilitates their lawful performance.	· In the case of a contract with a legal person: · Legitimate interest of ABT: To support contractual performance paragraph (f) of subsection (1) Article 6 of GDPR	· Representative’s identification data · Contact person identification data (optional)	For this purpose, until the conclusion and duration of the contract.
	· For private persons, in the case of contracts with self-employed persons / contractors: · Performance of the contract paragraph (b) of subsection (1) Article 6 of GDPR	· Identifying data of the contracting Party · Contact details of the contracting party
Lawful preservation of contracts as accounting documents.	ABT’s legal obligation paragraph (c) of subsection (1) Article 6 of GDPR Act C of 2000 on Accounting Sections 166, 169	· Identifying data of the Representatives, contracting party · Contact person identification and contact details	The retention period is determined on the basis of 8 years from the date of the accounts for the financial year.
Granting a lawful power of attorney. Recipients: NAV/competent bank	legitimate interest of ABT: to support performance in accordance with the contract paragraph (f) of subsection (1) Article 6 of GDPR	· Identifying information of attorney and proxy · Identifying information of witnesses · Subject of the authorisation	For this purpose, the retention period is determined by the period of cooperation between ABT and their clients or the termination of the contract.
Customer identification and identity document verification.	ABT’s legal obligation paragraph (c) of subsection (1) Article 6 of GDPR Act LIII of 2017 on the Prevention and Combating of Money Laundering and Terrorist Financing Sections 7-14/A. and 57	· Owner’s identification data (e.g. name, place of birth, date, nationality, address, signature)	The retention period is determined by taking into account the 8 years from the termination of the business relationship or from the execution of the transaction order.
If a contract is negotiated and finalised by e-mail, the following data processors are involved in the process:
Microsoft Ireland Ltd, MPC Hardver Kft.

4.3. Maintaining contact

ABT cooperates and maintains contact with its clients throughout the performance of its services.

You have the right to object to the processing of your personal data based on legitimate interests at any time on grounds relating to your particular situation.

Purpose of data processing	Legal basis of data processing	Scope of personal data	Duration of data processing
Ensuring the collection of information necessary for the provision of the service, conducting consultations.	legitimate interest of ABT: Ensuring fast and timely performance. paragraph (f) of subsection (1) Article 6 of GDPR	· Contact details of the contact persons (e.g. name, e-mail address, phone number) · Content of the communication	The retention period is determined by the period of cooperation between ABT and their clients or the termination of the contract.
In case the parties maintain contact by e-mail, the following data processors are involved:
Microsoft Ireland Ltd, MPC Hardver Kft.

4.4. Performance

In order for ABT to provide the service to the client, it needs to process personal data. Consequently, it processes different personal data according to the different services it provides. This section should be read in conjunction with the content of the data processing contract concluded with ABT.

You have the right to object to the processing of your personal data based on legitimate interests at any time on grounds relating to your particular situation.

Purpose of data processing	Legal basis of data processing	Scope of personal data	Duration of data processing
Obtaining the information needed to complete the assignment.	ABT’s legal obligation paragraph (c) of subsection (1) Article 6 of GDPR	Audit: Personal data relating to the provision of the service as described above and in the data processing contract between the parties.	The termination of the contract between the ABT and the customer is taken into account.
	legitimate interest of ABT: Carrying out the assignment at expert level paragraph (f) of subsection (1) Article 6 of GDPR	Tax consulting / compliance, accounting, payroll services, risk and compliance, data privacy and HR services: Personal data relating to the provision of the service as described above and in the data processing contract between the parties.
If the personal data required for the performance are received by ABT via e-mail, the following data processors are involved in the process:
Microsoft Ireland Ltd, MPC Hardver Kft. These data processors are in addition to the data processors identified in the data processing contract related to the service contract.

4.5. Billing / invoicing

ABT shall keep the proof of performance received from its customers after the performance of the services undertaken and shall issue an invoice for its activities. If the invoice concerns a private individual or sole trader, it also processes the personal data necessary for issuing the invoice.

You have the right to object to the processing of your personal data based on legitimate interests at any time on grounds relating to your particular situation.

Purpose of data processing	Legal basis of data processing	Scope of personal data	Duration of data processing
Preparation of a certificate of completion, lawful invoicing of the services.	legitimate interest of ABT: Documented evidence of completion paragraph (f) of subsection (1) Article 6 of GDPR	· Identification data of the person accepting the certificate of completion · Subject of the certificate of completion	For this purpose, it is determined by the issuing of the invoice.
Issuing invoices to individuals, sole traders. Recipient: NAV	ABT’s legal obligation paragraph (c) of subsection (1) Article 6 of GDPR	· Invoice recipient’s identification data · Other data written on the invoice	It takes into account 8 years from the date of the accounts for the financial year.
If the confirmation of performance, invoices are transmitted by ABT via e-mail, the following data processors are involved in the process:
Microsoft Ireland Ltd, MPC Hardver Kft.

4.6. Lawful performance

You have the right to object to the processing of your personal data based on legitimate interests at any time on grounds relating to your particular situation.

Purpose of data processing	Legal basis of data processing	Scope of personal data	Duration of data processing
Providing proof of lawful performance	legitimate interest of ABT: Clarifying and preventing disputes about performance. paragraph (f) of subsection (1) Article 6 of GDPR	· Personal data related to the offer · Personal data relating to contracts, authorisations · Personal data processed in relation to the provision of the service · Personal data relating to contacts (identification data, content of relevant consultations) · Personal data included in the certificate of performance (identification data, content of the certificate of performance)	Determined by the enforceability of claims arising from the contract between ABT and the client.
If the personal data required for the performance are received by ABT via e-mail, the following data processors are involved in the process:
Microsoft Ireland Ltd, MPC Hardver Kft.

5. Data transfers outside the EU

ABT, in principle, does not transfer personal data outside the European Union.

However, as ABT uses the Microsoft Outlook mailing system, in the case of this service provider personal data may be transferred outside the European Union. In the case of such transfers, ABT must provide one of the safeguards set out in Chapter V of the GDPR to ensure adequate protection of personal data. For data transfers by Microsoft, depending on the specific location of the transfer, an adequacy decision or standard contractual clauses adopted by the Commission of the European Union will ensure adequate security of personal data.

6. Your Rights as a Data Subject

6.1. Right to information and access

You have the right to receive information whether ABT processes your personal data and if they do, about the relevant circumstances of the processing.

Such relevant information may be:

the type of data processed by ABT;
the purpose, duration, and legal basis for data processing;
the name and address of ABT as well as their activities related to data processing;
the identity of third parties to whom personal data are transferred and the purpose of such disclosures.

You have the right to access, obtain or request a copy of your personal data. Exercising this right cannot adversely affect the rights and freedoms of others.

6.2. Right to rectification

You are entitled to request correction of inaccurate data and completion of incomplete data.

6.3. Right to erasure

You have the right to have ABT erase your personal data if one of the following conditions apply:

the data are no longer necessary in relation to the purposes for which they were collected or otherwise processed by ABT
you withdraw consent and there is no other legal ground for the processing
you object to the processing and ABT has no overriding legitimate grounds for the processing
the data have been unlawfully processed,
the data must be erased for compliance with a legal obligation.

In exceptional cases, your data cannot be deleted even if one of the above conditions is met. For example, if it is necessary to retain for the establishment, exercise, or defence of legal claims.

6.4. Right to restriction of processing

If you dispute the accuracy of your personal data, you have the right to request ABT to restrict the processing of your data until verification. If the data processing is unlawful or the storage period has expired, but you need them in order to enforce your legal rights, you may also request the restriction of processing instead of the erasure your data.

Restriction of processing means that ABT will only store your data. They will not change the data or perform any other processing activity. ABT may use your restricted data IF you consent to the processing, or it is necessary for the establishment, exercise, or defence of legal claims OR to protect the rights of another person.

6.5. Right to object

If the data processing is based on legitimate interest, You have the right to object to the processing of your personal data at any time on grounds relating to your particular situation. Unless ABT demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the visitor or the processing is necessary for the establishment, exercise or defence of legal claims the personal data will no longer be processed.

ABT may still process your personal data if:

there is a compelling legitimate interest,
it is necessary for the establishment, exercise, or defence of legal claims.

6.6. Right to data portability

You have the right to receive the personal data concerning you that you have provided to the data controller in a structured, commonly used, machine-readable format and the right to transmit such data to another data controller without hindrance from the data controller to whom you have provided the personal data, IF the processing is based on your consent or on the performance of a contract (if you are a contracting party); and the processing is carried out by automated means.

When exercising your right to data portability, you have the right to request, where technically feasible, the direct transfer of personal data between controllers.

The right to data portability must be without prejudice to the provisions governing the right to erasure and must not adversely affect the rights and freedoms of others.

6.7. Fulfilling the data subjects’ requests

If you think that your personal data is not being processed in accordance with the applicable data protection requirements, you may request ABT to rectify it. ABT will respond to your request within a maximum of one month after it was received. If ABT is unable to comply with your request or more time is needed because of its complexity or, in the case of multiple requests, its volume, you will be informed within the one-month period. In such cases, the deadline may be extended, up to two months.

6.8. How to exercise your rights

You have the right to lodge a complaint with the competent data protection supervisory authority. In Hungary the authority is the Nemzeti Adatvédelmi és Információszabadság Hatóság (National Authority for Data Protection and Freedom of Information) or briefly ‘NAIH’. NAIH’s website: https://naih.hu/

Postal address

E-mail / mailing address

Telephone number

Falk Miksa street 9-11

1055 Budapest,

Hungary

[email protected]

1363 Budapest, Pf.: 9.

+36 (30) 683-5969

+36 (30) 549-6838

If you believe that your rights have been violated, you also have the right to seek judicial remedy at a court of law, which falls within the jurisdiction of the Törvényszék (General Court). Upon the request, the action can be brought before the Court which is competent based on the domicile or the place of residence of the data subject (you). More information is available here: https://birosag.hu/en

In effect since: 2018.06.25.

Last review: 2025.04.04.

1. Data controllers and contact details

Name: ABT Hungária Tanácsadó Kft., ABT Hungária Könyvvizsgáló Kft.

(hereinafter, together: „ABT Treuhand Csoport” or „ABT”)

Contact:

Headquarters

E-mail address

Phone number

Data protection responsible

1037 Budapest, Montevideo u. 3/A.

[email protected]

06-1-4303400

Smohay Ferenc

[email protected]

2. Recipients

ABT does not transfer personal data to third parties other than Data Processors.

3. Data processors

Name	Headquearters	Contact	Data processing activity
MediaCenter Hungary Kft.	H-6001 Kecskemét, Sosztakovics u. 3. II./6.	E-mail address: [email protected] Phone number: +36 21 201 0505	Handles hosting for this website.
Collective Art Kft.	H-1053 Budapest, Veres Pálné utca 13. fszt. 4.	E-mail address: [email protected]	Web developer, provides the technical background for the website.
MPC Hardver Kft.	H-3300 Eger, Petőfi S. u. 19.	E-mail address: [email protected] Phone number: +36 30 3 499 599	Provides IT support for ABT Treuhand.
Microsoft Ireland Operations Limited	One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland	Phone number: (+1) 425-882-8080	ABT Treuhand uses Microsoft’s mail system (Outlook).
The Rocket Science Group LLC	675 Ponce de Leon Ave NE, Suite 500, Atlanta, GA 30308 USA	Privacy contact: https://mailchimp.com/privacy-rights/	It provides the MailChimp platform that ABT uses to send newsletters and other marketing content, event invitations.
Google Ireland Limited	Google Building Gordon House, Barrow St, Dublin 4, Ireland	Phone number: +353 1 436 1000	It provides Google Analytics for statistical analysis of the ABT website.

4. Processing of personal data

4.1. Contacting, enquiries

You have the right to object to the processing of your personal data based on legitimate interests at any time on grounds relating to your particular situation.

Purpose of data processing	Legal basis of data processing	Scope of personal data	Duration of data processing
Identifying the contacting person and the interested parties and assessing their needs.	legitimate interest of ABT: Promoting possible assignments and business relations paragraph (f) of subsection (1) Article 6 of GDPR	· Contact persons’ identification and contact data: (e.g., name, e-mail address, phone number) · Information regarding the enquiry or the request of offer (e.g. service of interest, message content, date of consultation) · Other optional data (e.g. name of company, phone number)	The retention period is determined by taking into account the time needed to respond to the enquiry, to decide on the offer and to make an offer, and the timeliness of the request.
If an enquiry or request is received by the ABT via this website or e-mail, the following data processors are involved in the process:
MediaCenter Hungary Kft., Microsoft Ireland Ltd, MPC Hardver Kft.

4.2. Sending newsletters and other direct marketing messages

ABT regularly compiles newsletters on professional news and news related to its activities and services, which it sends to its subscribers and clients. In addition, ABT also sends festive greetings to existing clients on major holidays (e.g. Christmas).

You have the right to object to the processing of your personal data based on legitimate interests at any time on grounds relating to your particular situation.

Purpose of data processing	Legal basis of data processing	Scope of personal data	Duration of data processing
To inform subscribers about the professional issues and articles that ABT considers important.	Consent of the data subject paragraph (a) of subsection (1) Article 6 of GDPR	· Identifying and contact data (e.g. name, e-mail address)	The retention period shall be subject to the withdrawal of the data subject’s consent, but not more than 3 years from the date on which the consent was given. After that period, the ABT will request separate consent.
Tracking the validity of the subscription to the newsletter, tracking the expiry of the consent given.	ABT’s legitimate interest: Pursuing a legitimate and practical newsletter sending practice paragraph (f) of subsection (1) Article 6 of GDPR	· Subscription data: (e.g. date of subscription, IP address at the time of subscription) · Data relating to the sending and delivery of newsletters (e.g. date and time of activity)	The retention period is determined by the time of subscription to the newsletter.
To inform subscribers about the professional issues and articles that ABT considers important.	ABT’s legitimate interest: To promote customer satisfaction, confidence and the possibility of new projects. paragraph (f) of subsection (1) Article 6 of GDPR	· Identifying and contact data (e.g. name, e-mail address) · Contact details (contact type, source, language, message content)	The retention period is determined by the existence of the working relationship between the ABT and the client.
Sending holiday greetings to ABT clients.	ABT’s legitimate interest: Building good relations with clients paragraph (f) of subsection (1) Article 6 of GDPR
The following data processors are involved in this process:
MediaCenter Hungary Kft., Collective Art Kft., Microsoft Ireland Ltd, The Rocket Science Group LLC, MPC Hardver Kft.

4.3. Social media presence

The website offers the possibility to click on the LinkedIn sign to redirect the visitor directly to the LinkedIn page, where the visitor can view and follow ABT’s LinkedIn page. ABT shares some of the content of its website (e.g. blog posts) on this page, where users of the social networking site can provide feedback or comments on the content.

LinkedIn’s data processing is governed by its own privacy policies, and ABT has no control over LinkedIn’s data processing. More detailed information on LinkedIn’s data processing can be found here: https://www.linkedin.com/legal/privacy-policy?trk=organization-guest_footer-privacy-policy

You have the right to object to the processing of your personal data based on legitimate interests at any time on grounds relating to your particular situation.

Purpose of data processing

Legal basis of data processing

Scope of personal data

Duration of data processing

To publish and communicate widely information on the activities of the ABT and the professional articles of its employees.

ABT’s legitimate interest: Promoting ABT’s activities and services.

paragraph (f) of subsection (1) Article 6 of GDPR

· LinkedIn profile identification data (e.g. public name, photo)

· Reactions to shared content, comments

It is determined by the following criteria:

· deletion of user’s reaction and comment

· the existence of ABT’s LinkedIn page

4.4. Cookies

ABT uses cookies to operate the abt.hu website. Cookies are variable files of letters and numbers that are stored on your computer or mobile device and are stored for a predetermined period of time. Cookies allow the website to remember your actions and personal preferences (such as your username, language, font size and other unique settings related to the website’s display) for a certain period of time, so that you do not have to re-enter them each time you visit our website or navigate from one page to another. ABT can also use cookies to gain an insight into visitors’ habits when using the website.

ABT uses cookies managed by Google Analytics to help measure website traffic and other web analytics data, but ABT has little control over Google’s processing of data.

ABT also uses Hotjar to help understand user activity. Like Google, these cookies contribute to the measurement of website traffic and other web analytics data.

In addition, ABT also uses marketing cookies from Meta Platforms, Inc. if you consent to the collection of data by ABT cookies for marketing purposes.

For more detailed information, please see the Cookie Notice.

You have the right to object to the processing of your personal data based on legitimate interests at any time on grounds relating to your particular situation.

Purpose of data processing	Legal basis of data processing	Scope of personal data	Duration of data processing
Necessary cookies: to provide the technical support necessary for the smooth operation of the website.	ABT’s legitimate interest: the smooth running of the website paragraph (f) of subsection (1) Article 6 of GDPR	· Identification data (e.g. visitor’s IP address, country of visit) · Information about the visitor’s cookie preferences	More detailed information can be found in section 3 of the Cookie Notice.
Preferences cookies (settings): to improve the user experience of the website.	Consent of the data subject paragraph (a) of subsection (1) Article 6 of GDPR	· Site-related settings (e.g. language)
Statistics cookies (Google Analytics): analysing data on the website, monitoring the number of visits, improving the website.		· Statistical identification data (separate ID) · Statistics related to your website visits (e.g. pages viewed, time spent, clicks, opens)
Marketing cookies: assessing advertising that is relevant to users, their interests.		· Data on users’ activities and interests related to the website
The following data controller is involved in the process of using marketing cookies:
Meta Platforms Ireland Ltd.
The following data processors are involved in the process regarding cookies:
Google Ireland Ltd., Hotjar Ltd.

5. Data transfers outside the EU

ABT, in principle, does not transfer personal data outside the European Union.

However, as ABT uses service providers outside the EU personal data may be transferred outside the European Union. In the case of such transfers, ABT must provide one of the safeguards set out in Chapter V of the GDPR to ensure adequate protection of personal data. To this end, the ABT applies the following guarantees to service providers outside the European Union:

For data transfers by Microsoft, LinkedIn and MailChimp and also for Google and using Google Analytics, depending on the specific location of the transfer, an adequacy decision or standard contractual clauses adopted by the Commission of the European Union will ensure adequate security of personal data.
In the case of Hotjar, the standard contractual clauses ensure that your personal data is adequately protected.

6. Your Rights as a Data Subject

6.1. Right to information and access

You have the right to receive information whether ABT processes your personal data and if they do, about the relevant circumstances of the processing.

Such relevant information may be:

the type of data processed by ABT;
the purpose, duration, and legal basis for data processing;
the name and address of ABT as well as their activities related to data processing;
the identity of third parties to whom personal data are transferred and the purpose of such disclosures.

You have the right to access, obtain or request a copy of your personal data. Exercising this right cannot adversely affect the rights and freedoms of others.

6.2. Right to rectification

You are entitled to request correction of inaccurate data and completion of incomplete data.

6.3. Right to erasure

You have the right to have ABT erase your personal data if one of the following conditions apply:

the data are no longer necessary in relation to the purposes for which they were collected or otherwise processed by ABT
you withdraw consent and there is no other legal ground for the processing
you object to the processing and ABT has no overriding legitimate grounds for the processing
the data have been unlawfully processed,
the data must be erased for compliance with a legal obligation.

In exceptional cases, your data cannot be deleted even if one of the above conditions is met. For example, if it is necessary to retain for the establishment, exercise, or defence of legal claims.

6.4. Right to restriction of processing

6.5. Right to object

ABT may still process your personal data if:

there is a compelling legitimate interest,

it is necessary for the establishment, exercise, or defence of legal claims.

6.6. Right to data portability

When exercising your right to data portability, you have the right to request, where technically feasible, the direct transfer of personal data between controllers.

The right to data portability must be without prejudice to the provisions governing the right to erasure and must not adversely affect the rights and freedoms of others.

6.7. Fulfilling the data subjects’ requests

6.8. How to exercise your rights

Postal address

E-mail / mailing address

Telephone number

Falk Miksa street 9-11

1055 Budapest,

Hungary

[email protected]

1363 Budapest, Pf.: 9.

+36 (30) 683-5969

+36 (30) 549-6838

1. Data controller and contact details:

Name: ABT Hungária Tanácsadó Kft. (hereinafter referred to as “ABT”)

Contact details:

Registered office

E-mail address

Telephone number

Data Protection Responsible

HU-1037 Budapest, Montevideo utca 3/A

[email protected]

+36-1-4303400

Mr. Ferenc SMOHAY

[email protected]

2. Data processor and contact details:

Name of processor

Registered office

Contact details

Activity

MPC Hardware Kft.

HU-3300 Eger, Petőfi Sándor utca 19

E-mail address:

[email protected]

Telephone number:

+36 30 3 499 599

Providing a technical background and IT support to ABT.

3. Recipients

ABT does not transfer personal data to third parties other than the data processor.

4. Transfers of data to a third country

ABT does not transfer personal data to third countries or international organisations. Personal data are stored in Hungary.

5. How the DIA works

ABT is the developer and maintainer of the DIA system. The company has developed this software to enable its customers to perform accounting activities and related tasks as quickly and efficiently as possible. The DIA is an internet-based invoice management system into which the data of invoices issued in Hungary are fed automatically through data exchange with the online interface of the Hungarian tax authority (Tax and Customs Administration, NAV). This allows the parties to have quicker access to these invoice data, which do not qualify as official invoices, thereby the performance of accounting-related tasks, as well as related communication are simplified and speeded up.

The DIA consists of three modules:

Invoice Approval Module: Invoice data are administered, verified and processed here. On the one hand, this module records invoice data and the documents enclosed to invoices as attachments, which mostly contain company data, except when they are related to natural persons (e.g. invoices of sole proprietors). In addition, the DIA also records and stores user activities related to invoice data in this module. In doing so, the DIA does not track your activities as a user, but the life cycle of individual invoices, as well as the administration, acceptance, correction, erasure or approval of invoice data.
Transfer Preparation Module: It aims to facilitate the management of payments. This module helps you manage invoice-related payments by systemising the necessary information. In the Transfer Preparation Module, personal data may only be collected, recorded, used and stored in exceptional cases, if the recipient of the payment is a sole proprietor. For all other payments, the system manages company information. This module does not collect or record personal data concerning you as a user.
Accounting Preparation Module: It supports the faster and simpler performance of accounting activities. This module is also used for the processing of invoice data, thus personal data are collected, recorded, used and stored only if a specific invoice contains personal data. This is the case when an invoice is issued by or to a sole proprietor. This module does not collect or record personal data concerning you as a user.

6. Processing of personal data

Data processing in the Invoice Approval Module

In this module, invoice data are administered and processed, and user activities related to invoice operations are tracked.

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on legitimate interest.

Purpose of data processing

Legal basis of data processing

Scope and source of personal data

Duration of data processing

Transparent verification of invoice data so that they can be finalised in a traceable manner.

ABT’s legitimate interest: Ensuring accurate, authentic and fast invoice processing (Article 6(1)(f) of GDPR)

· Personal data related to invoices:

o Financial and invoice data (if the invoice was issued by or to a sole proprietor)

o Content of other documents related to invoices and invoice attachments (where personal data is contained therein)

Source: Hungarian Tax and Customs Administration (NAV)

· Personal data related to users:

o User identification data (e.g. e-mail address)

o User activities related to invoice transactions (e.g. approval, cancellation, correction, etc.)

Source: data subject

The retention period of personal data is adjusted to the period during which the tax authority has a statutory right to inspect invoices (statute of limitations to assess taxes).

User logins

The use of DIA is possible only after proper identification; in this context, users’ login data are processed.

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on legitimate interest.

Purpose of data processing

Legal basis of data processing

Scope of personal data

Duration of data processing

Providing access to the DIA system for users who are authorised to log in.

ABT’s legitimate interest: Supporting the security of data processed in the DIA system (Article 6(1)(f) of GDPR)

· Identification data required for logging in:

o E-mail address

o Password

The retention period of personal data is adjusted to the duration of the user’s account.

Communication by users

In DIA, users can write each other comments and suggestions.

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on legitimate interest.

Purpose of data processing

Legal basis of data processing

Scope of personal data

Duration of data processing

Simple and quick contact in relation to the processing and accounting of invoices.

ABT’s legitimate interest: Facilitating the faster performance of accounting tasks by ensuring the internal exchange of information between software users (Article 6(1)(f) of GDPR)

· Personal data related to users:

o User identification data

o Content of users’ comments and suggestions

The retention period of this category of personal data is adjusted to the period during which the tax authority has a statutory right to inspect invoices (statute of limitations to assess taxes).

Processing related to cookies

Cookies are small text files that a web server sends to the user’s device, where they are stored for a predetermined period of time. The cookie used by ABT automatically updates the token so that the user’s session is not lost even in case of inactivity.

In providing the DIA service, ABT does not use cookies other than the one mentioned in the previous sentence.

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on legitimate interest.

Name and source of cookie used

Purpose of data processing

Legal basis of data processing

Scope of personal data

Cookie expiry time

refreshToken

Source: dia.abt.hu

Providing the technical background necessary for the functioning of DIA.

ABT’s legitimate interest: supporting the smooth functioning of the DIA (Article 6(1)(f) of GDPR)

o User ID (email address)

o Session ID

Every 15 minutes to be calculated from each refresh.

7. The data subject’s rights

Right to information and right of access

You shall have the right to obtain from ABT confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and the following information:

purposes of the processing,
the categories of personal data concerned,
the recipients or categories of recipient to whom the personal data have been or will be disclosed,
in particular recipients in third countries and the safeguards for such data transfers,
the period for which the personal data will be stored, or, if not possible, the criteria used to determine that period,
your rights.

In addition to all this, you shall also have the right to access your personal data and request a copy of them. However, your right to access your personal data should not adversely affect others, so your right of access may be limited to protect the rights of others.

Right to rectification

The right to rectification means that you shall have the right to obtain from ABT the rectification of inaccurate personal data or the completion of incomplete personal data concerning you. However, due to the specifics of these data processing operations, this right should be interpreted as a limited one, as for example, rectification or completion is not applicable as regards the data on user actions automatically recorded by the system.

Right to erasure

You may request ABT to erase your personal data if

the purpose of the data processing has ceased to exist,
you have withdrawn the consent on which the processing was based, and where there is no other legal ground for the processing,
you have objected to data processing based on legitimate interest and ABT does not have a compelling legitimate interest in the processing,
the processing is unlawful,
the personal data have to be erased for compliance with a legal obligation to which ABT is subject,
the personal data have been collected in relation to the offer of information society services (which is not case here).
Right to restriction of processing

You shall have the right to obtain from ABT restriction of processing where one of the following applies:

the accuracy of the personal data is contested by you, for a period enabling ABT to verify the accuracy of the personal data,
the processing is unlawful, and you oppose the erasure of the personal data and request the restriction of their use instead,
ABT no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims,
you have objected to processing, pending the verification whether the legitimate grounds of ABT override your legitimate grounds.

Where the processing has been restricted for any of the above-mentioned reasons, such personal data shall, with the exception of storage, only be processed with your consent or:

for the establishment, exercise or defence of legal claims or
for the protection of the rights of another natural or legal person or
for reasons of important public interest of the Union or of a Member State.

You shall be informed by ABT before the restriction of processing is lifted.

Right to object

Where the legal basis of the processing is a legitimate interest, as is in the case of the data processing activities specified herein, you shall have the right to object to the processing at any time on grounds relating to your particular situation.

In this case, ABT shall no longer process the personal data unless ABT demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims .

Exercising your rights

If you send a request to ABT to assert any of your above rights, ABT shall provide information to you on the action taken on your request without undue delay and in any event within one month of receipt of the request. You shall also be given information within this period where ABT cannot fulfil your request, or if it takes more time to respond due to its complexity or the number of requests. In that case, the above deadline may be extended by a maximum of two months.

Right to a legal remedy related to data processing

If you believe that your personal data are not being processed in accordance with the currently applicable data protection requirements, please feel free to contact ABT using the contact details indicated above and ABT will try to remedy your grievance by all means.

In addition:

You can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH).

Website	https://naih.hu/
E-mail	[email protected]
Telephone number	+36 30 683-5969, +36 30 549-6838
Registered office, postal address	HU-1055 Budapest, Falk Miksa utca 9-11, HU-1363 Budapest, Pf.: 9

You have the right to go to court. In the event of unlawful data processing, you can bring a legal action, the hearing of which falls within the jurisdiction of general courts (“törvényszék”). At your discretion, the action may be brought before the court that is competent based on your domicile. More information is available at http://birosag.hu/torvenyszekek.