 |
|
|
|
on the processing of personal data by the websites www.datahouse.hu, www.carinfo.hu and www.carinfoeu.com, as well as the related restricted-access web services.
The purpose of this notice is to inform data subjects in a concise, transparent and easily understandable manner, in accordance with Articles 12–14 of the GDPR.
|
Full company name |
DATAHOUSE Számítástechnikai Szolgáltató és Kereskedelmi Korlátolt Felelősségű Társaság |
|
Short company name |
DATAHOUSE Kft. |
|
Registered office |
1171 Budapest, Óvónő utca 52, ground floor 1, Hungary |
|
Company registration number |
01-09-693636 |
|
Tax number |
12584228-2-42 |
|
Representative |
István Bisztriánszky, Managing Director |
|
Data protection contact |
data@datahouse.hu |
|
Covered platforms |
www.datahouse.hu, www.carinfo.hu, www.carinfoeu.com and the related restricted-access web services |
|
Version and effective date |
V3.0 – 21 May 2026 |
This notice applies to visitors to the websites, persons initiating contact, persons requesting trial access, registered or designated users of the service, and natural-person contacts, representatives and contributors of DATAHOUSE Kft.’s customers, partners and service providers.
The processing of employees’ personal data is governed by a separate employee privacy notice.
This notice covers the processing of personal data collected directly from the data subject, as well as the processing activities specified herein where DATAHOUSE Kft. obtains personal data from another lawful source.
Purpose: To receive and respond to enquiries, provide quotations, present the service and prepare the requested trial access.
Data subjects: Natural persons who contact DATAHOUSE Kft. via a web form, email, telephone or another direct communication channel, and natural-person contacts of organisations.
Data: Name, contact email address, telephone number, organisation and position where required to handle the enquiry, as well as the content and date of the enquiry and any further data needed to provide a response.
Legal basis: If a natural person requests a quotation, trial or other pre-contractual measure in connection with their own potential contract, the legal basis is Article 6(1)(b) GDPR. If contact is made through an organisation’s representative or contact person, the legal basis is the legitimate interest under Article 6(1)(f) GDPR. The legitimate interest is handling enquiries, conducting business communications, and preparing and maintaining contractual relationships.
Retention: If no contract results from the contact, DATAHOUSE Kft. processes the personal data and communications related to the enquiry for six months after the communication is closed and then deletes them, unless another lawful purpose and appropriate legal basis justify further retention. If a contract results from the contact, the retention rules applicable to the relevant contractual or contact-data processing apply. Personal data in enquiries that are clearly unrelated to DATAHOUSE Kft.’s services and received in error must be deleted after the necessary verification.
Provision of data: The required data depend on the content of the enquiry and the requested method of contact. If data necessary for a substantive response or for preparing the requested quotation or trial access are unavailable, DATAHOUSE Kft. may be unable to fulfil the enquiry in whole or in part.
Google reCAPTCHA operates on the carinfo.hu registration page to detect and prevent automated submissions, spam and other misuse. reCAPTCHA may process technical and usage data necessary for its operation. The legal basis is the legitimate interest under Article 6(1)(f) GDPR. The legitimate interest is ensuring the security of the web form and service and protection against misuse.
Purpose: To create and manage the user account required to use the restricted-access web service, identify the user, provide appropriate permissions, enable login and use of the service, and provide user support.
Data subjects: Natural-person users of DATAHOUSE Kft.’s restricted-access web services.
Data: Name, email address, telephone number where necessary, organisation and position, username or other user identifier, permission role, account status, data required for password reset, and related log data necessary for secure operation of the service.
Legal basis: If the data subject is the contracting party, the legal basis is Article 6(1)(b) GDPR insofar as processing is necessary for performance of the contract. If the user is an employee, representative or contributor of a customer or other contractual partner of DATAHOUSE Kft., the legal basis is the legitimate interest under Article 6(1)(f) GDPR. The legitimate interest is performance of the contractual service, identification of authorised users, provision of appropriate access and secure operation of the service.
Retention: DATAHOUSE Kft. processes personal data related to a user account and permissions for as long as the user’s access to the service remains active. When access is permanently terminated, account data that are no longer needed must be deleted or anonymised, unless further retention is justified by a legal claim, statutory obligation, investigation of a security incident or another appropriate legal basis. Separate rules in Section 5 apply to the retention of technical and security log data.
Provision of data: Without the data required to create the user account and grant the appropriate permissions, the restricted-access web service cannot be used, or cannot be used in full.
Purpose: To prepare, maintain, perform, amend and terminate contractual and business relationships, and to handle operational communications, support, invoicing and legal administration.
Data subjects: Natural-person contacts, representatives and contributors of DATAHOUSE Kft.’s customers, partners and service providers.
Data: Name, business email address, telephone number, organisation, position or job title, representative or contact role, and personal data communicated during contact that are necessary to manage the business relationship.
Source: Personal data may come directly from the data subject, from the organisation employing or engaging the data subject, or from a lawfully accessible business source. If personal data are not obtained directly from the data subject, DATAHOUSE Kft. informs the data subject in accordance with Article 14 GDPR.
Legal basis: The legitimate interest under Article 6(1)(f) GDPR. The legitimate interest is effective communication between DATAHOUSE Kft. and its contractual or business partners, preparation and performance of the contractual relationship, and related administration.
Retention: DATAHOUSE Kft. processes operational contact data for as long as the data subject’s contact or representative role, or the business relationship justifying the processing, continues. If DATAHOUSE Kft. becomes aware that the data subject’s contact role has ended or the data have become inaccurate, it rectifies or deletes the operational contact data, or excludes them from further use for contact purposes. If a contact’s personal data form part of a contract, accounting document or other document whose retention is required by law, the personal data may be retained together with that document for the statutory period. Such retention does not mean that the data may continue to be used for operational contact purposes during that period.
Purpose: To operate the websites and restricted-access services, troubleshoot errors, protect access and permissions, prevent and detect misuse, investigate information-security incidents, and, where necessary, verify use and provision of the service.
Data subjects: Visitors to the websites and users of the restricted-access web services.
Data processed: Technical and event data required for operation and security, in particular the date and time of the event, user identifier, identifier of the organisation or record concerned, type of operation, its successful or unsuccessful outcome, login and permission events, and metadata relating to report, export or dataset downloads. Where necessary for system operation or security, a session identifier or IP address may also be processed. Logging is limited to the necessary event data and metadata. The full content of a report or downloaded dataset is not recorded for logging purposes.
Legal basis: The legitimate interest under Article 6(1)(f) GDPR. The legitimate interest is the secure and auditable operation of DATAHOUSE Kft.’s IT systems and services, prevention and investigation of unauthorised access and misuse, remediation of errors, and, where necessary, verification of service use.
Retention: As a general rule, DATAHOUSE Kft. processes general technical and security log data for 90 days from their creation. If particular log data are required to investigate a security incident, misuse, disputed performance or a legal claim, the relevant log data may be segregated to the extent necessary and retained until the matter is closed or for as long as required to handle the related legal claim.
www.carinfo.hu uses cookies to operate the service and retain user settings. Google reCAPTCHA operates on the registration page to detect and prevent automated submissions, spam and other misuse.
DATAHOUSE Kft. provides information on the cookies and similar technologies actually used, tailored to the nature of the technology concerned.
If DATAHOUSE Kft. introduces analytics, marketing or other optional technology in the future that requires prior consent, it will use that technology only after providing the necessary information and obtaining appropriate consent.
|
Category |
Identifier |
Purpose |
Duration |
|
Strictly necessary |
CISESSION19 |
Maintaining the user session and ensuring operation of the service |
Session |
|
Notice setting |
ACCEPTED_COOKIES |
Retaining the fact that the user has acknowledged the cookie notice window |
1 year |
|
Functional |
ci2_va_legend |
Retaining the fact that the user has already viewed the volume-data screen so that the legend can be displayed in the appropriate location |
1 year |
Google reCAPTCHA, an external security service, operates on the carinfo.hu registration page. reCAPTCHA is associated with the www.google.com domain. According to Google’s documentation, the _GRECAPTCHA cookie required for risk analysis may be set during operation of the service. The purpose of reCAPTCHA is to detect and prevent automated misuse, spam and bots.
Personal data may be accessed by those employees and contributors of DATAHOUSE Kft. who need access to perform their duties. Access is limited to the data and permissions necessary for the task.
DATAHOUSE Kft. uses external service providers for certain processing operations. If a service provider processes personal data on behalf of DATAHOUSE Kft., it acts as a processor and performs the processing under contractual terms compliant with Article 28 GDPR.
The main external service providers involved in the processing activities covered by this notice are:
|
Service area |
Service provider |
Operation and data processed |
|
Hosting, server or system operations |
Rackhost Zrt. |
Providing server hosting and related infrastructure required for operation of the service |
|
Email and customer communications |
Microsoft Ireland Operations Limited, Microsoft 365 service |
Processing email communications and data related to messages and delivery |
|
System administration and IT operations |
Zoltán Dányi, sole trader |
System operations and technical support, during which access may be granted to personal data processed in the systems to the extent necessary to perform the task |
|
Web misuse and bot protection |
Google Cloud EMEA Limited |
Operating Google reCAPTCHA on the registration page. The service may process technical and usage data required to detect misuse |
DATAHOUSE Kft. transfers personal data to an authority, court or other body authorised to receive personal data only on an appropriate legal basis and limited to the data necessary.
DATAHOUSE Kft. uses Microsoft 365 and Google reCAPTCHA services. In limited cases, operation of these services may involve transfers of personal data outside the EEA or access from outside the EEA. Such transfers may take place only under the conditions set out in Chapter V GDPR. Further information on the applicable transfer mechanism and safeguards may be requested at data@datahouse.hu.
According to Microsoft’s documentation, operation of the Microsoft 365 service used by DATAHOUSE Kft. may, in limited cases, involve transfers of personal data outside the European Economic Area or access from outside it. For such transfers, Microsoft applies appropriate safeguards under Article 46 GDPR, including the standard contractual clauses adopted by the European Commission.
Further information on the applicable transfer safeguards and relevant Microsoft data protection terms is available in Microsoft’s official privacy and service documentation.
If there is a material change in the service providers used or in the transfer conditions, DATAHOUSE Kft. reviews the information concerning transfers to third countries.
In the processing activities described in this notice, DATAHOUSE Kft. does not use decision-making based solely on automated processing that produces legal effects concerning the data subject or similarly significantly affects them.
If DATAHOUSE Kft. introduces such automated decision-making or related profiling in the future, before processing begins it will assess its lawfulness, the applicable safeguards for data subjects and the need for a data protection impact assessment, and will provide data subjects with appropriate prior information under the GDPR.
To protect personal data, DATAHOUSE Kft. applies technical and organisational measures appropriate to the nature, circumstances and risks of the processing.
The measures are intended in particular to prevent unauthorised disclosure, access, modification, communication, loss or destruction of personal data and to maintain appropriate security of IT systems.
DATAHOUSE Kft. limits access to what is necessary for the performance of duties, carries out IT administration through protected access, logs relevant system and security events to the extent necessary, and applies incident-response measures in the event of a data protection or information-security incident.
DATAHOUSE Kft. adapts the measures used to protect personal data in line with changes in the technological environment, processing activities and risks.
Depending on the circumstances and legal basis of the particular processing, the data subject may exercise the following rights:
· request information about the processing of their personal data and access to personal data concerning them
· request rectification of inaccurate personal data and completion of incomplete data
· request erasure of their personal data where the conditions under the GDPR are met
· request restriction of the processing of their personal data where the applicable conditions are met
· request data portability where the conditions laid down in the GDPR are met
· object, on grounds relating to their particular situation, to processing based on legitimate interests
· where processing is based on consent, withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal
· lodge a complaint with the supervisory authority
· seek a judicial remedy
Individual data-subject rights do not apply in the same manner to every processing activity. DATAHOUSE Kft. assesses the data subject’s request based on the purpose, legal basis and circumstances of the relevant processing and provides appropriate information about its decision.
Submitting a data-subject request:
The data subject may submit a data protection request using the following contact details:
Email: data@datahouse.hu
Postal address: 1171 Budapest, Óvónő utca 52, ground floor 1, Hungary
DATAHOUSE Kft. provides information on the action taken in response to the data subject’s request without undue delay and in any event within one month of receipt of the request.
Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months. DATAHOUSE Kft. informs the data subject of the extension and the reasons for it within one month of receipt of the request.
If DATAHOUSE Kft. does not take action on the data subject’s request, it informs the data subject without undue delay and in any event within one month of receipt of the request of the reasons for not taking action and of the possibility of lodging a complaint with the supervisory authority and seeking a judicial remedy.
If the request is submitted electronically, DATAHOUSE Kft. provides the response electronically where possible, unless the data subject requests otherwise.
DATAHOUSE Kft. requests additional information necessary to confirm identity only where it has reasonable doubts concerning the identity of the person making the request. Only necessary and proportionate data may be requested for identification.
Information and action concerning data-subject requests are generally provided free of charge. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, DATAHOUSE Kft. may, under the conditions of the GDPR, charge a reasonable fee taking administrative costs into account or refuse to act on the request. DATAHOUSE Kft. bears the burden of demonstrating that the request is manifestly unfounded or excessive.
Complaint to the supervisory authority
The data subject has the right to lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information if they consider that the processing of their personal data infringes applicable data protection provisions.
Hungarian National Authority for Data Protection and Freedom of Information
Address: 1055 Budapest, Falk Miksa utca 9–11, Hungary
Mailing address: 1363 Budapest, P.O. Box 9, Hungary
Email: ugyfelszolgalat@naih.hu
Telephone: +36 1 391 1400
Website: www.naih.hu
Judicial remedy
The data subject may bring proceedings before a court if they consider that their rights under the GDPR have been infringed in the processing of their personal data. At the data subject’s choice, proceedings may also be brought before the competent regional court for their place of residence or habitual residence.
13. AMENDMENT OF THIS NOTICE
DATAHOUSE Kft. reviews this notice if the processing processes, technology used, service-provider landscape, processing purposes or applicable legal requirements change in a manner that affects the content of the notice.
DATAHOUSE Kft. informs data subjects of material changes affecting the processing of personal data in an appropriate manner suited to the nature and significance of the change.
The current version of the notice must always be made available on the website. The version of the notice and its effective date must be clearly indicated in the document.