for the services of R-Szoft Kft.
The processing activities of R-Szoft Kft. (R-Szoft Informatikai Korlátolt Felelősségű Társaság — a Hungarian limited liability company) as controller are governed by this Privacy Policy, which complies with the uniform European data protection regulation.
Service Provider: R-Szoft Kft.
Registered office: 1224 Budapest, XIII. utca 45.
Company registration number: 01-09-407280
Tax number: 26615934-2-43
Represented by: Bálint Rákosi, managing director
E-mail address: office@r-szoft.hu
Under Article 37 of the GDPR, our company is not required to appoint a data protection officer; you may therefore direct any data protection enquiries to our central contact details above.
If you have any questions concerning this notice or any other matter, please do not hesitate to contact us — we will be happy to answer all of your questions.
In the course of its data processing, our company follows the principles below:
Statutory references
Our data processing principles are in line with the applicable data protection legislation, in particular the following:
Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Infotv.);
The legal basis, purpose, nature and duration of the data we process, and the categories of data subjects concerned.
Enquiries, newsletter
Legal basis: Consent
Personal data processed: first name, surname, e-mail address, date of subscription, date of click-through, link clicked, date of e-mail opening, e-mail opened, IP address
Purpose of processing: Notification of promotions, new products, services and campaigns; contact for business development purposes; general communication
Duration: Until unsubscription / withdrawal of consent, but no longer than 6 months from the last identifiable activity
Handling of customer service enquiries
Legal basis: performance of a contract (point (b) of Article 6(1) GDPR) in the case of contracted customers, and legitimate interest (point (f) of Article 6(1) GDPR) in the case of prospective customers; for processing based on legitimate interest we have carried out a legitimate interest assessment (balancing test), which we will make available upon request
Personal data processed: the surname, first name, e-mail address and telephone number of the person making contact via the online form, the subject of the enquiry, and data provided in customer satisfaction feedback
Purpose of processing: Fulfilling the request set out in the enquiry, or providing feedback that it cannot be fulfilled; answering the questions raised; making the enquiries and responses available to the person making contact for reference; conducting customer satisfaction surveys and analysing their data; customer information
Duration: In the case of customer service matters relating to paid services or products, 5 years from the termination of the contract (the general limitation period under Section 6:22 of the Ptk.); in the case of documents qualifying as accounting records, 8 years (Section 169 of the Accounting Act (Számv. tv.))
Service-related user information e-mails
Legal basis: performance of a contract
Personal data processed: surname, first name, e-mail address
Purpose of processing: Delivery of financial and administrative information relating to the use of the services, the delivery of which is essential for the proper maintenance of the contractual relationship.
Examples:
Who exactly is affected: every customer of our services, at the e-mail address provided at the time of contracting
Unsubscription: possible only by deleting the user account
Duration: until the user account is deleted or the contract is terminated
Use of the AI assistant (chatbot)
Legal basis: performance of a contract (point (b) of Article 6(1) GDPR), and legitimate interest (point (f) of Article 6(1) GDPR)
Personal data processed: the full text of the conversation (chat), i.e. the messages entered by the user and the responses of the AI assistant; where voluntarily provided by the user: name, e-mail address, telephone number; technical data: session identifier, timestamp, type of device/browser used by the user, IP address
Purpose of processing: providing AI-based customer service, answering user questions, presenting the SmartAIChat service
Location of data processing: the AI-based processing of conversation data takes place in a Google Cloud (Vertex AI / Gemini API business access) data centre located within the European Economic Area (EU region); no international transfer of data outside the EEA takes place
Duration: for 90 days after the conversation is closed, after which the conversation data are erased or anonymised
Contracting, invoicing
Legal basis: performance of a contract, legal obligation
Personal data processed: name, company name, registered office/home address, billing address, tax number, bank account number, contact person's name, e-mail address, telephone number
Purpose of processing: Performance of contractual obligations, invoicing, bookkeeping, financial settlement
Duration: 8 years (accounting obligation)
Website visits, analytics
Legal basis: consent (in the case of statistical, analytical and marketing cookies), and legitimate interest (in the case of technical cookies essential for the operation of the website)
Personal data processed: IP address, browser type, operating system, pages visited, time of visit, cookie identifiers
Purpose of processing: Ensuring the operation of the website, development, statistical analyses, improving the user experience
Duration: 2 years or until consent is withdrawn
The legal basis for processing is primarily the performance of a contract, or, where applicable, consent or legitimate interest.
Legal bases for the processing of personal data:
1. Performance of a contract (point (b) of Article 6(1) GDPR)
The processing of personal data is necessary for the provision of the services in accordance with the contract, i.e. for the operation of the services, customer support, invoicing and related services. This constitutes the legal basis for the service provider to perform its obligations undertaken in the contract.
2. Consent of the data subject (point (a) of Article 6(1) GDPR)
Certain processing operations — for example marketing notifications or the use of cookies — require the user's prior, unambiguous consent. Until such consent is given, the service provider may not process these data. This consent may be withdrawn.
3. Legitimate interest (point (f) of Article 6(1) GDPR)
The service provider's legitimate interest may include, for example, the prevention of fraud, maintaining the security of the service, or optimising the operation of the system. In these cases, the processing is lawful provided that this interest does not excessively infringe the rights and freedoms of the data subject.
4. Compliance with a legal obligation (point (c) of Article 6(1) GDPR)
In order to comply with accounting, tax and other statutory obligations (e.g. retention of invoices for 8 years).
Data transfers
Data may be transferred to third parties in the following cases:
The data subject may request information about the processing of their personal data, and may request the rectification of their personal data or — except in the case of mandatory processing — their erasure or withdrawal, and may exercise their rights to data portability and to object, at the Controller's contact details set out above.
Right to information
The Controller shall take appropriate measures to provide data subjects with all information referred to in Articles 13 and 14 of the GDPR relating to the processing of personal data, and each communication under Articles 15 to 22 and 34, in a concise, transparent, intelligible and easily accessible form, using clear and plain language.
We provide our response within 30 days of the submission of the request. The information is provided free of charge, unless you have already submitted a request for information concerning the same set of data to us in the current year. We may refuse to provide the information only in the cases laid down by law, indicating the relevant statutory provision, and providing information on the possibility of seeking judicial remedy or lodging a complaint with the Authority.
Right of access
The data subject has the right to obtain confirmation from the Controller as to whether or not personal data concerning them are being processed, and, where such processing is ongoing, the right to access the personal data and the following information:
The controller shall provide the information within one month at the latest from the submission of the request.
Right to rectification of data
The data subject may request the rectification of inaccurate personal data concerning them processed by the Controller, and the completion of incomplete data.
Right to erasure
The data subject has the right to obtain from the Controller the erasure of personal data concerning them without undue delay where one of the following grounds applies:
Erasure of data may not be requested where the processing is necessary:
Where processing has been restricted, such personal data may, with the exception of storage, only be processed with the data subject's consent, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.
We record the withdrawal of consent without undue delay; the withdrawal does not affect the lawfulness of processing carried out before the withdrawal. Please note, however, that we may continue to process certain data after the withdrawal of consent for the purpose of complying with our legal obligations or pursuing our legitimate interests.
Right to data portability
The data subject has the right to receive the personal data concerning them which they have provided to the controller in a structured, commonly used and machine-readable format, and to transmit those data to another controller.
Right to object
The data subject has the right to object, on grounds relating to their particular situation, at any time to the processing of their personal data which is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or which is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, including profiling based on those provisions.
In the event of an objection, the controller may no longer process the personal data unless the processing is justified by compelling legitimate grounds which override the interests, rights and freedoms of the data subject, or which are related to the establishment, exercise or defence of legal claims.
If you object to the processing of your personal data, we will examine the objection within the shortest possible time from the submission of the request — within 14 days (but in no case later than 1 month) — and inform you of our decision in writing. If we conclude that your objection is well founded, we will terminate the processing — including any further data collection and data transfer — and block the data, and we will notify of the objection, and of the measures taken on its basis, all those to whom the personal data concerned by the objection were previously transferred and who are obliged to take measures to give effect to the right to object.
We will refuse to comply with the request if we demonstrate that the processing is justified by compelling legitimate grounds which override your interests, rights and freedoms, or which are related to the establishment, exercise or defence of legal claims.
If you disagree with our decision, or if we fail to meet the deadline, you may bring the matter before a court within 30 days of the communication of the decision or of the last day of the deadline.
Right to bring the matter before a court
In the event of an infringement of their rights, the data subject may bring court proceedings against the Controller. The court shall hear such cases as a priority.
The adjudication of data protection cases falls within the competence of the regional courts (törvényszék); at the data subject's choice, the proceedings may also be brought before the regional court of the data subject's place of residence or place of stay. A foreign national may also lodge a complaint with the supervisory authority competent for their place of residence.
Before turning to the supervisory authority or a court with your complaint — in the interest of consultation and resolving the issue as quickly as possible — please contact our Company at the e-mail address office@r-szoft.hu or by registered mail with return receipt addressed to our Company's registered office.
Right to lodge a complaint
Supervisory Authority: Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság — NAIH)
Registered office: 1055 Budapest, Falk Miksa utca 9-11.
Postal address: 1363 Budapest, Pf. 9.
Telephone: +36 (1) 391-1400
Fax: +36 (1) 391-1410
E-mail: ugyfelszolgalat@naih.hu
Website: https://naih.hu/
Further information: https://naih.hu/panaszuegyintezes-rendje.html
The contributors and employees of our company involved in its data processing and/or data processing operations are entitled to access your personal data to a predetermined extent, subject to an obligation of confidentiality.
We protect your personal data by appropriate technical and other measures, and we ensure the security and availability of the data, and protect them against unauthorised access, alteration, damage, disclosure and any other unauthorised use.
Where the AI-based chat service is used, the respective controller roles of the Service Provider and Google Ireland Limited / Google Cloud EMEA Limited are governed accordingly by the provisions of the SmartAIChat Privacy Policy.
As part of our organisational measures, we control physical access, provide continuous training to our employees, and keep paper-based documents locked away with appropriate protection. In the course of our data processing operations, we use encryption, password protection and antivirus software commensurate with the nature of the processing. Please note, however, that data transmission over the internet cannot be considered fully secure.
Our websites always communicate over an encrypted channel (https protocol), so the data you send or receive cannot be accessed by third parties.
In the event of a personal data breach (unauthorised access to or destruction of personal data), the Service Provider shall, pursuant to Article 33 of the GDPR, notify the data protection authority (NAIH) no later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the personal data breach is likely to result in a high risk to the rights and freedoms of data subjects, the Service Provider shall, pursuant to Article 34 of the GDPR, also inform the data subjects without undue delay. The Service Provider shall in all cases take the necessary measures to mitigate the damage.
We store personal data for the period determined in accordance with statutory requirements, for example under the accounting rules (generally 8 years), after which they are securely erased or anonymised. Data that are not necessary are erased without delay.
What are cookies and how do we handle them?
Cookies are small data files (hereinafter: cookies) that are placed on your computer through the website, by using the website, in such a way that your internet browser downloads and stores them.
The general functions of cookies:
In order to provide a personalised service, a small data package, a so-called cookie, is placed on the user's computer and read back during a later visit. If the browser returns a previously saved cookie, the service provider handling the cookie is able to link the user's current visit with previous ones, but only with respect to its own content.
Most of the commonly used internet browsers (Chrome, Firefox, Edge, Explorer, Opera, Safari, etc.) accept and enable the downloading and use of cookies by default; it is, however, up to you to refuse or disable them by changing your browser settings, and you can also delete cookies already stored on your computer.
The "Help" menu of each browser provides further information on the use of cookies.
We have collected for you how to disable cookies at system level in the individual browsers.
Disabling cookies:
There are cookies that do not require your prior consent. Our website provides brief information about these at the start of your first visit; examples include session cookies used for authentication, multimedia playback, load balancing and customisation of the user interface, as well as user-centric security cookies.
Regarding cookies that require consent — where the processing already begins upon visiting the page — our Company informs you at the start of your first visit and asks for your consent. Accepting cookies that require consent is not mandatory; however, our Company accepts no responsibility if, in the absence of enabled cookies, our website may not function as expected.
Our Company does not use, nor does it permit, cookies that would allow third parties to collect data without your consent.
Our company does not carry out decision-making based solely on automated processing (including profiling) which would produce legal effects concerning the data subject or similarly significantly affect them (Article 22 GDPR). The responses provided by the AI assistant are for information purposes only; no automated decisions are made on their basis.
The AI assistant available on our website is an artificial intelligence system falling within the scope of Regulation (EU) 2024/1689 of the European Parliament and of the Council (AI Act). Throughout the entire duration of the conversation, the chat interface continuously and clearly indicates that the user is interacting with artificial intelligence (an AI assistant), and the user receives explicit information about this before starting the conversation (Article 50 AI Act). Our company ensures that the members of its staff involved in operating the service have an appropriate level of knowledge of the operation and limitations of the AI assistant (Article 4 AI Act).
We regularly review this privacy policy and update it to reflect our planned changes to data processing. In the event of a change, depending on the extent of the change and its impact on the data subjects, we choose the manner in which we notify the data subjects (e.g. you). If the change is significant, we notify all data subjects affected by the change by e-mail; if the change is not significant, we publish the new version on our website but do not send an e-mail notification.
________________________________________
Date of last update: 1 August 2026
Valid: from publication until withdrawal
This English text is a translation provided for information purposes only. In the event of any discrepancy or dispute regarding its interpretation, the Hungarian language version shall prevail.
