Data processing information of the website

For the website and customer relationships of Reklámajándék.hu Kft. (effective from 14 October 2026)

This notice explains how we process the personal data of website visitors, individual contact persons of our business partners, newsletter subscribers and job applicants. For each processing purpose, it describes the data, the legal basis, the retention period, the recipients of the data and the rights of data subjects.

1. The controller and the scope of this notice

Name: Reklámajándék.hu Kft.

Address: 1097 Budapest, Gubacsi út 61.

Telephone: +36 (1) 464-4444

Email and data protection requests: [email protected]

Representatives: Péter Martos, Managing Director, and Júlia Martos, Managing Director

Tax number: 23850727-2-43

Company registration number: 01-09-981320

Website: https://reklamajandek.hu

This notice is available at: https://reklamajandek.hu/adatvedelmi-nyilatkozat

The online store serves business customers. Nevertheless, the GDPR also applies to the personal data of corporate contact persons and representatives. Newsletter subscriptions do not require a purchase or an existing customer relationship. The data of a sole trader or an individual with a tax number may constitute personal data even when provided in the course of business activities.

Processing is governed by Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and the applicable Hungarian legislation, including Act CXII of 2011.

2. Sources of data and principles of processing

We generally obtain data directly from the data subject through use of the website, initiation of an order, an enquiry, a subscription or submission of a job application. A business partner may also provide the data of its representative, contact person or the person involved in delivery. In such cases, the source of the data is the business partner concerned; the data processed typically comprise the name, job title, business contact details and delivery details.

Where we do not obtain data directly from the data subject, we provide the information required under Article 14 of the GDPR within one month at the latest, at the first communication, or at the first disclosure of the data if this occurs earlier, except in the cases specified in the Regulation. Assistance from the business partner in providing information does not replace our own obligation.

We process only the data necessary for the relevant purpose. The legal bases specified for individual purposes are not interchangeable without restriction. We request consent only for processing that is genuinely optional. We assess the necessity and proportionality of processing based on legitimate interests through a legitimate interests assessment; a substantive summary of this assessment may be requested using the contact details above.

3. Purposes of processing

3.1. Website operation and security logging

Purpose: Ensuring the operation of the website, troubleshooting, and detecting, investigating and preventing unauthorised access and attacks.

Data processed: IP address, time of the request, address of the requested page or resource, technical response code; also the IP address (which may constitute personal data even if we do not link it to a customer profile).

Legal basis: Article 6(1)(f) of the GDPR: our legitimate interest in the secure and reliable operation of the website and in preventing misuse.

Retention: Generally, a maximum of 1 year. Evidence relating to an incident or a legal claim is kept separately and processed in accordance with Section 3.9.

Recipients and provision of data: The service providers involved in operating the website, as identified in Section 4. The transmission of technical data is inherent in accessing the website; without these data, the website cannot be served properly.

3.2. Cookies and measurement or advertising technologies

Cookies are small files stored in the browser. We use strictly necessary cookies to provide the service; consent is not required for their use under the relevant exemption in electronic communications rules. The legal basis for processing the associated personal data is Article 6(1)(f) of the GDPR; our legitimate interest is to provide the requested website functionality.

We activate non-essential statistical and marketing cookies and similar technologies only with prior consent. The legal basis for processing personal data is Article 6(1)(a) of the GDPR. Merely using the website, scrolling or a pre-selected option does not constitute consent. Refusal does not prevent the use of the website’s basic functions. Consent may be withdrawn or changed at any time in the cookie settings.

For each technology, the separate cookie notice specifies its name, provider, purpose, the data processed, the cookie’s lifetime and the retention period for associated personal data, as well as any transfers to third countries. Cookies may also be deleted in the browser; this alone does not necessarily erase data already transferred to service providers.

Cookie information

3.3. Requests for quotations orders and business communications

Purpose: Processing requests for quotations and the initiation of orders, preparing the quotation and contract, performing the contract, coordinating and delivering orders, and handling related customer correspondence.

Data processed: The contact person’s or representative’s name, telephone number, email address and, where necessary, job title; the content of the order and related communications, delivery name and address, and the recipient’s name and contact details. For a sole trader or an individual with a tax number, business identifiers and invoicing details may also constitute personal data.

Legal basis: Where the data subject is the individual contracting party, Article 6(1)(b) of the GDPR: performance of a contract or steps taken at the data subject’s request prior to entering into a contract. For the data of a legal entity’s representative or contact person and the person involved in delivery, Article 6(1)(f) of the GDPR: our legitimate interest in preparing and performing the business contract and maintaining the necessary communications.

Retention: Until the ongoing matter has been handled. Following performance, we retain accounting records under Section 3.4 and data necessary for enforcing claims under Section 3.9. For requests for quotations closed without an order, the retention period is 1 month from closure, except for data necessary for a specific legal claim. For a continuing contact-person register maintained independently of further enquiries, the retention period is 1 year from the most recent contact.

Recipients: Administrative and IT service providers performing the necessary tasks, and the delivery providers listed in Section 4 to the extent necessary for delivery.

Provision of data: Without the data necessary to process and deliver an order, the matter concerned cannot be handled. Optional data are provided voluntarily. A legal entity is not itself a data subject, but the individuals associated with it may be.

3.4. Invoicing and retention of accounting records

Purpose: Issuing invoices, bookkeeping, retaining accounting records supporting economic transactions and fulfilling the related legal obligations.

Data processed: The name, billing address, tax number, transaction and performance details shown on invoices and accounting records, and the personal data necessary to substantiate them.

Legal basis: Article 6(1)(c) of the GDPR: compliance with a legal obligation, in particular Section 169(2) of Act C of 2000 on Accounting and, for issuing invoices, the applicable tax provisions.

Retention: Accounting records are retained for at least 8 years; under the company’s retention policy, the starting date is the deadline for closing the financial year concerned, typically 31 May of the following year. Longer retention is permitted only on a separately substantiated legal basis and where necessary. The 8-year retention period does not automatically apply to every email, telephone number or contact detail passed to a courier.

Recipients and provision of data: The bookkeeping service provider performing the task and authorities acting under the applicable legislation. An invoice cannot be issued without the invoicing data required by law.

3.5. Individual access to the online store

Purpose: Providing a business partner with individual login access and displaying the prices and discounts assigned to it. According to the source document, self-service online registration is not available; access is provided by the account manager upon request.

Data processed: The username assigned to the partner, authentication data, the contact person’s name and contact details, and the association between the access account and the partner.

Legal basis: For corporate users, Article 6(1)(f) of the GDPR: our legitimate interest in verifying the partner’s authorisations and operating individual access. For an individual contracting in their own name, point (b) applies where access is necessary for performance of the contract.

Retention: Until access is terminated; we review inactive access accounts annually. We erase the authentication data of terminated accounts and keep business records retained on a separate legal basis separately.

Recipients and provision of data: The service providers operating the online store and business administration system, as specified in Section 4. Requesting access is voluntary; individual access cannot be provided without the necessary identification data.

3.6. Enquiries and callback requests

Purpose: Responding to questions received through the website form, by email or by telephone, making requested callbacks and handling general feedback.

Data processed: Name, company name, email address, telephone number, the content of the message and related communications, limited to what is actually necessary for the enquiry.

Legal basis: Article 6(1)(f) of the GDPR: our legitimate interest in responding to business and general enquiries addressed to us. Point (b) applies to a pre-contractual request made by an individual wishing to enter into a contract in their own name.

Retention: 1 month from closure of the enquiry. If the enquiry develops into an order or a legal dispute, only the data necessary for that purpose are processed under Section 3.3, 3.4 or 3.9; this does not justify retaining the entire archive of submitted forms.

Recipients and provision of data: Service providers involved in operating the website and email services. The provision of data is voluntary; without an email address or telephone number, we cannot respond to the data subject.

3.7. Newsletter

Purpose: Sending subscribers electronic newsletters about Reklámajándék.hu products, offers, new products and industry-related content.

Data processed: The subscriber’s name and email address, the declaration necessary to demonstrate consent and its withdrawal, the version of the notice, and the date, time and method of subscription and any confirmation.

Legal basis: Article 6(1)(a) of the GDPR: voluntary prior consent based on adequate information. Section 6 of Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities also applies where the advertising recipient is a natural person.

Retention: For newsletter purposes, until consent is withdrawn or the newsletter service is discontinued. Upon unsubscribing, we erase the data from the active newsletter register without delay and send no further newsletters. Data retained separately to demonstrate consent or for a specific legal claim may not be used to send newsletters.

Access: Authorised staff members and decision-makers involved in sending newsletters.

Withdrawal: At any time, without giving reasons and free of charge, using the unsubscribe link in the newsletter, by email to [email protected] or by post to the controller’s address. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

Provision of data: Voluntary. Subscribing and giving consent are not conditions for making a purchase or contacting us. Without the necessary data and consent, we do not send newsletters.

3.8. Job applications and the careers page

Purpose: Filling the position applied for, assessing the applicant’s suitability, arranging interviews and communicating during the recruitment process.

Data processed: Name, email address, telephone number, CV, cover letter, qualifications, professional experience and skills necessary for the position, and professional assessments relating to the interview. Providing a photograph is not mandatory. Please do not send unnecessary health data, copies of identity documents or other special categories of personal data.

Legal basis: Article 6(1)(b) of the GDPR: steps taken at the applicant’s request prior to entering into an employment contract. This legal basis applies to processing necessary for the specific recruitment procedure.

Retention: Until the recruitment procedure is completed or the application is withdrawn, after which we erase an unsuccessful application after 1 month. For successful applications, only data necessary for employment are transferred to the separate employee data processing arrangements. Evidence relating to a specific legal dispute may be processed separately under Section 3.9.

Access and recipients: Authorised staff members and decision-makers conducting the recruitment procedure.

Provision of data: Applying is voluntary; without the necessary contact and professional details, the application cannot be assessed or the applicant cannot be contacted. The absence of a photograph alone cannot be grounds for excluding an application.

3.9. Legal claims and obligations towards authorities

Purpose and data concerned: Resolving contractual claims, complaints or legal disputes and establishing, exercising or defending legal claims, using only the contractual, contact and evidentiary data necessary for the claim concerned.

Legal basis: Article 6(1)(f) of the GDPR: the legitimate interest in establishing, exercising or defending legal claims. For mandatory disclosure to an authority, point (c) and the legislation forming the basis of the relevant request apply.

Retention: Evidence necessary for a contractual claim is retained until the end of the general 5-year limitation period calculated from performance or from the date the claim falls due; any different applicable period and any suspension or interruption of the limitation period must be taken into account separately. If proceedings are ongoing, the data are retained until the final conclusion of the proceedings and the settlement of directly related enforceable claims, subject to documented necessity. This does not justify retaining the entire customer or applicant database as a general practice.

Recipients: The legal representative, court or authority involved in the matter, as necessary. Disclosure is limited to the necessary data. The data subject’s consent is not required to comply with an obligation towards an authority.

4. Processors and other recipients

Authorised staff members have access to personal data to the extent necessary for their duties. We may use service providers for certain technical and administrative tasks. A processor acts on our documented instructions under a data processing agreement; an independent controller processes the data disclosed to it for its own purposes and in accordance with its own legal obligations.

4.1. Hosting and IT operations

The hosting provider identified in the original notice is EVOLUTIONET Kft., 7342 Mágocs, Széchenyi utca 75.; email: [email protected]; tax number: 14992511-2-02. Its role is to provide website hosting; it may access technical data and data processed on the website to the extent necessary for the service.

4.2. Delivery service providers

GLS General Logistics Systems Hungary Csomag-Logisztikai Kft. - registered office: 2351 Alsónémedi, GLS Európa u. 2.

Magyar Posta Zrt. - registered office: 1138 Budapest, Dunavirág utca 2-6.

Express Europe Kft. - registered office: 1044 Budapest, Szilaspatak sor 14.

We disclose the data necessary for delivery: the addressee’s or recipient’s name, delivery address, necessary contact details and shipment details; an email address is disclosed only if justified by the service actually used.

5. Storage data security and erasure

We protect personal data against unauthorised access, alteration, loss and disclosure through technical and organisational measures appropriate to the risks. Access is limited to what is necessary for the relevant duties. When the retention period expires, we erase or irreversibly anonymise the data; where particular data are subject to a separate legal retention obligation, we keep them separately and restrict their processing to that purpose.

6. Rights of data subjects

You may exercise your rights using the email or postal address provided in Section 1. Please indicate the processing activity and the right to which your request relates. You do not need a user account to exercise your rights. Where we have reasonable doubts about your identity, we request only the additional information necessary to identify you.

6.1. Information and access

Under Articles 13-15 of the GDPR, you may request information about the processing of your personal data and whether we process data concerning you. You may access the data and obtain information, in particular about the purposes, categories of data, recipients, the retention period or the criteria used to determine it, the source of the data, your rights and any automated decision-making. You may request a copy of the personal data being processed. We must also protect the rights and freedoms of others when providing a copy.

6.2. Rectification

Under Article 16 of the GDPR, you may request the rectification of inaccurate data without undue delay and the completion of incomplete data, taking into account the purposes of processing.

6.3. Erasure

Under Article 17 of the GDPR, you may request erasure of the data, particularly if they are no longer necessary for the original purpose, we have processed them unlawfully, or you have withdrawn consent and there is no other applicable legal basis. Erasure may also be required following a valid objection or a legal obligation to erase data. There are exceptions to erasure: for example, data cannot be erased where their processing is necessary to comply with a legal obligation or to establish, exercise or defend legal claims. If we refuse a request, we provide the specific reason.

6.4. Restriction of processing

Under Article 18 of the GDPR, you may request restriction if you contest the accuracy of the data, for the period of verification; if processing is unlawful but you request restriction instead of erasure; if we no longer need the data but you need them for a legal claim; or if you have objected, for the period during which the legitimate interests are assessed. As a rule, restricted data are only stored; any further processing requires a separate condition under the Regulation. We inform you before lifting the restriction.

6.5. Notification of recipients

Under Article 19 of the GDPR, we notify recipients to whom we have disclosed the data of rectification, erasure or restriction, unless this proves impossible or involves disproportionate effort. We inform you about those recipients upon request.

6.6. Data portability

Under Article 20 of the GDPR, you may request personal data that you have provided to us and that are processed by automated means on the basis of consent or a contract, in a structured, commonly used and machine-readable format. You may transmit these data to another controller or, where technically feasible, request their direct transmission. This right does not automatically extend to data processed on the basis of legitimate interests or a legal obligation.

6.7. Objection

Under Article 21 of the GDPR, you may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. In such cases, we stop processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or processing is necessary for a legal claim. You may object to direct marketing at any time; in that case, we no longer process the data for that purpose, including related profiling.

6.8. Withdrawal of consent

Under Article 7(3) of the GDPR, you may withdraw your consent at any time. This does not affect the lawfulness of processing before withdrawal. The means of withdrawing consent are specified for the relevant processing activity; the contact details in Section 1 may also be used generally.

6.9. Automated decision-making and profiling

We do not carry out decision-making based on automated processing, nor do we carry out profiling.

6.10. Handling requests

We inform you of the action taken without undue delay and no later than one month after receiving your request. The period may be extended by a further two months due to the complexity or number of requests; we notify you of this and the reasons within the first month. If we refuse a request, we provide the reasons and information on available remedies within the same period.

As a rule, information and the exercise of rights are free of charge. A reasonable fee may be charged or action refused only for requests that can be demonstrated to be manifestly unfounded or excessive within the meaning of Article 12(5) of the GDPR. For further copies of the data, a reasonable fee based on administrative costs may be charged under Article 15(3) of the GDPR. Repeating a request within the same year does not in itself make the provision of information subject to a fee.

7. Complaints and judicial remedies

You may contact us directly with a data protection question or complaint, but doing so is not a prerequisite for seeking a remedy from an authority or court. If you consider that the processing of your personal data infringes the GDPR, you may lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement.

Hungarian supervisory authority: Hungarian National Authority for Data Protection and Freedom of Information (NAIH)

Registered office: 1055 Budapest, Falk Miksa utca 9-11.

Postal address: 1363 Budapest, Pf. 9.

Telephone: +36 (1) 391-1400

Email: [email protected]

Website and information on electronic procedures: https://www.naih.hu

According to the information on the NAIH website, proceedings cannot be initiated by ordinary email. Information about the current methods for submitting a complaint or initiating proceedings is available on the Authority’s website.

You may also seek a judicial remedy under Article 79 of the GDPR. In Hungary, data protection proceedings fall within the jurisdiction of the regional courts; under Section 23 of Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Infotv.), you may also choose to bring proceedings before the regional court competent for your place of residence or stay. Under Article 82 of the GDPR, compensation for material or non-material damage caused by an infringement of the Regulation may be claimed subject to the conditions set out in the Regulation.

8. Changes to this notice

We publish the current version of this notice on the website and indicate its effective date. We inform data subjects appropriately of changes that materially affect processing. Before processing data for a new purpose, we provide the necessary information and, where required by the legal basis, obtain separate consent. A subsequent amendment to this notice does not remedy a previous lack of consent.