Privacy Policy

This Privacy Policy describes the data processing activities carried out by RAX Consulting and Services Kft. (hereinafter referred to as the “Data Controller”) through the website raxconsulting.hu (hereinafter referred to as the “Website”), including in particular the collection, storage and use of personal data.

This Privacy Policy shall be effective as of August 30, 2026. The Data Controller shall make the currently effective version of the Privacy Policy available on its Website and at its registered office.

This Privacy Policy has been prepared on the basis of Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: “GDPR”), with due regard to the provisions of Act CXII of 2011 on Informational Self-Determination and Freedom of Information (hereinafter: “Info Act”). Its terminology corresponds to the definitions set out in Article 4 of the GDPR and, in certain respects, is supplemented by the definitions contained in Section 3 of the Info Act. For matters not defined in this Privacy Policy, the provisions of the GDPR and, where permitted by the GDPR, the provisions of the Info Act shall apply on a supplementary basis.

The Data Controller is entitled to prepare extracts from the content of this Privacy Policy in relation to individual data processing activities and may also ensure that data subjects, in connection with prior information concerning the processing of personal data, declare by signing this document that they have read and acknowledged the contents of the extract. The Data Controller reserves the right to amend this Privacy Policy. If an amendment affects the use of personal data provided by the data subject, the Data Controller shall inform the data subject of the changes in an appropriate manner, for example by e-mail. If the details of data processing also change as a result of an amendment to this Privacy Policy, the Data Controller shall separately request the data subject’s consent.

Details of the Data Controller

Name of the Data Controller:	RAX Consulting and Services Kft.
Registered office of the Data Controller:	1124 Budapest, Tamási Áron utca 32. 2. em. 8.
Representative of the Data Controller:	Reök András György
Contact details of the Data Controller:	raxconsulting.hu

Principles relating to data processing

In providing its services, the Data Controller pays particular attention to the protection of personal data, compliance with mandatory legal provisions, and secure and fair data processing. As set out in Section 3 of this Privacy Policy, the Data Controller treats the personal data made available to it confidentially and, in its procedures, observes the principles of lawfulness, fairness and transparency under the GDPR. The Data Controller processes personal data for specific purposes, taking into account the principle of data minimisation, complies with the principle of limited storage, protects the confidentiality and integrity of personal data, and also takes into account the principle of accuracy under the GDPR.

Method and security of data processing

The Data Controller ensures the security of data and takes the technical and organisational measures and establishes the procedural rules necessary to enforce the data protection and confidentiality requirements prescribed by the GDPR, the Info Act and other applicable legislation. The Data Controller protects personal data against unauthorised access, alteration, transmission, disclosure, accidental deletion, destruction, damage, as well as becoming inaccessible as a result of changes in the technology used. The Data Controller places particular emphasis on protecting data sets processed electronically in various databases in order to ensure that the data stored in different databases cannot be directly linked or attributed to the data subject, unless permitted by law.

Data processing carried out in connection with the use of the Data Controller’s Website

Contact

The Data Controller provides visitors to the Website and its clients with the opportunity to contact the Data Controller through the contact details published on the Website and by completing the contact form provided for this purpose.

Purpose of data processing	Answering questions and, in connection therewith, establishing and maintaining contact.
Scope of processed data	Name and e-mail address of the data subject, telephone number in the case of a telephone enquiry, and the message containing the legal matter.
Categories of data subjects	Persons who are in contact with the Data Controller.
Legal basis for data processing	The consent of the data subject pursuant to Article 6(1)(a) of the GDPR.
Data retention period	Until the question has been successfully answered or the purpose has been achieved, but at the latest until deletion at the request of the data subject.
Method of data processing	Electronically.
Source of data	Data obtained directly from the data subject.
Automated decision-making and profiling	The Data Controller does not use automated decision-making and does not carry out profiling.
Possible consequences of failure to provide data	If the data subject does not provide the Data Controller with the requested data, the data subject will not be able to contact the Data Controller.
Who may access the personal data?	Persons employed by the Data Controller and any data processors engaged by the Data Controller.
Transfer of data to a third country or international organisation	No transfer of data to a third country or international organisation takes place.

Data processing related to questionnaires

In order to speed up and simplify the process of providing its services, the Data Controller provides persons who contact the Data Controller with the opportunity to complete questionnaires.

Purpose of data processing	Preparation of the service provided by the Data Controller and establishing contact.
Scope of processed data	Identification data of persons contacting the Data Controller (name, e-mail address, telephone number), as well as basic information relating to the type of matter concerned.
Categories of data subjects	Persons completing the Data Controller’s questionnaire.
Legal basis for data processing	The legal basis for data processing is the consent of the data subject pursuant to Article 6(1)(a) of the GDPR.
Data retention period	One year from the submission of the questionnaire.
Method of data processing	Electronically.
Source of data	Data obtained directly from the data subject.
Automated decision-making and profiling	The Data Controller does not use automated decision-making and does not carry out profiling.
Possible consequences of failure to provide data	The provision of personal data and information relating to the type of matter concerned is not mandatory; however, providing such data facilitates the preparation of the service provided by the Data Controller and the establishment of contact.
Who may access the personal data?	Persons employed by the Data Controller and any data processors engaged by the Data Controller.
Transfer of data to a third country or international organisation	No transfer of data to a third country or international organisation takes place.

Cookies

The Data Controller uses so-called “cookies” when operating the Website. A cookie is a small data file (hereinafter: “cookie”) sent by the Data Controller to the data subject’s browser and stored on the data subject’s device. The Data Controller uses cookies that are necessary for basic functionality of the Website, i.e. Session Cookies (temporary cookies).

The cookies used on the Website cannot, in themselves, be used to identify data subjects. They are necessary for providing the Website’s services, and their use is essential for navigating the Website and for the proper functioning of its features. Most web browsers accept cookies by default, but the data subject may choose settings that reject cookies or notify the user when cookies are being received. Without accepting cookies, the Website or certain parts of it may not be displayed or may function incorrectly. Temporary cookies are stored only until the end of the data subject’s browsing session and are essential for the proper functioning of certain features or applications related to the Website. These cookies ensure the proper operation of the Website, facilitate its use, and collect information about its use without identifying Website visitors.

Purpose of data processing	Ensuring the operation of the Website.
Scope of processed data	The Internet Protocol address (IP address) of the computer, domain name (URL), access data, client file request (file name and URL), HTTP response code, data of the website from which the request originated, amount of bytes transferred during the visit, time of the visit, and data relating to the pages viewed.
Categories of data subjects	Users visiting the Data Controller’s Website.
Legal basis for data processing	The consent of the data subject pursuant to Article 6(1)(a) of the GDPR, in accordance with Section 155(4) of Act C of 2003 on Electronic Communications.
Data retention period	Until the end of the relevant visitor session (duration of the session).
Method of data processing	Electronically.
Source of data	Data obtained directly from the data subject.
Automated decision-making and profiling	The Data Controller does not use automated decision-making and does not carry out profiling.
Possible consequences of failure to provide data	The provision of personal data and information relating to the type of matter concerned is not mandatory; however, providing such data facilitates the preparation of the service provided by the Data Controller and the establishment of contact.
Who may access the personal data?	Only employees of the Data Controller may access personal data relating to the use of the Website.
Data transfer	No transfer of data to a third country or international organisation takes place.
Who may access the personal data?	Only employees of the Data Controller may access personal data relating to the use of the Website.
Data transfer	No transfer of data to a third country or international organisation takes place.

Data Processors

Data Processors do not make independent decisions and are only entitled to act on the basis of contracts concluded with the Data Controller and in accordance with the instructions received. Data Processors record, process and handle the personal data transferred to them by the Data Controller and processed or handled by them in accordance with the provisions required by the GDPR. Data Processors perform data processing operations involving the personal data provided by data subjects within the period of use specified in this Privacy Policy and corresponding to the individual purposes of data processing. The Data Controller uses the following data processors in connection with the data processing activities described in this Privacy Policy:

Category of Data Processor	Purpose of data processing	Data Processor
Category of Data Processor	Purpose of data processing	Name	Registered office	Tax number / Company registration number
Hosting provider	Hosting services	ErdSoft Hungary Kft.	Kígyó utca 4., 6720 Szeged, Hungary	32725458-2-06 / 06-09-030198

Enforcement of the rights of data subjects

As a data subject, you may request information concerning the processing of your personal data and may request the rectification of your personal data, restriction of processing, or deletion of your data by contacting [email protected]. You are also entitled to exercise your right to data portability, your right to legal remedy, and your right to withdraw your consent. In the event of a complaint, you may contact the Hungarian National Authority for Data Protection and Freedom of Information or, at your discretion, a court in Hungary. In judicial proceedings, the competent court shall have jurisdiction.

If you submit a request concerning the processing of your personal data in a manner other than that specified in this Privacy Policy and the Data Controller is unable to properly identify you using the identification necessary for data security and/or confidentiality protection as set out in this Privacy Policy, the Data Controller shall request you to provide the missing information. If you fail to do so or do not fully comply with the request, the Data Controller may be unable to respond to your request.

The period between the Data Controller’s request for the necessary personal data or completion of the missing action and the provision of the personal data shall not be included in the deadline for responding to the request.

The Data Controller shall inform all recipients to whom the personal data have been disclosed of any rectification, deletion or restriction of processing, unless this proves impossible or requires disproportionate effort. At the request of the data subject, the Data Controller shall inform the data subject of those recipients.

Right to information and access

As a data subject, you are entitled to receive confirmation from the Data Controller as to whether your personal data are being processed and to obtain access to the following information:

information as to whether your personal data are being processed;
the purpose of the data processing;
the categories of personal data concerned;
the recipients or categories of recipients to whom the personal data have been or will be disclosed;
the envisaged period for which the personal data will be stored or, if this is not possible, the criteria used to determine that period.
information about your rights and legal remedies.

The Data Controller shall inform you of the measures taken in response to your request without undue delay and in any event within one month of receiving the request. Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months. The Data Controller shall inform the applicant of any such extension within one month of receiving the request, together with the reasons for the delay.

The provision of information is generally free of charge. The Data Controller may charge a fee only in the cases specified in Article 12(5) and Article 15(3) of the GDPR.

If the Data Controller does not take action on the data subject’s request, it shall inform the data subject without undue delay and at the latest within one month of receiving the request of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking judicial remedy.

Right to rectification

As a data subject, you have the right to obtain from the Data Controller without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

For the period during which the Data Controller verifies the accuracy of the personal data, the processing of the personal data concerned may be restricted in accordance with this Privacy Policy.

Right to object

As a data subject, you may object to the processing of your personal data by submitting a statement to the Data Controller if the legal basis for the processing is

the public interest referred to in Article 6(1)(e) of the GDPR; or
the legitimate interest referred to in Article 6(1)(f) of the GDPR.

Where the right to object is exercised, the Data Controller may no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or which are related to the establishment, exercise or defence of legal claims.

The head of the Data Controller shall decide whether the processing is justified by compelling legitimate grounds. The Data Controller shall inform the data subject of its position in this regard.

Right to restriction of processing

Restriction of processing may take place where:

you, as the data subject, contest the accuracy of the data, for the period enabling the Data Controller to verify the accuracy of the personal data;
the processing is unlawful and you, as the data subject, oppose the erasure of the personal data and request the restriction of their use instead;
the Data Controller no longer needs the personal data, but you, as the data subject, require them for the establishment, exercise or defence of legal claims;
you, as the data subject, have objected to processing pursuant to Article 21 of the GDPR, pending the verification of whether the legitimate grounds of the Data Controller override those of the data subject.

For the duration of the assessment of the data subject’s objection to the processing of personal data, the Data Controller shall suspend the processing, examine whether the objection is justified and make a decision, of which it shall inform the applicant.

If the objection is justified, the Data Controller shall restrict the processing of the data, meaning that only storage may take place until

the data subject gives consent to the processing;
the processing of the personal data is necessary for the establishment, exercise or defence of legal claims;
the processing of the personal data becomes necessary for the protection of the rights of another natural or legal person; or
processing is required by law for reasons of public interest.

If the restriction of processing was requested by the data subject, the head of the relevant organisational unit shall inform the data subject in advance of the lifting of the restriction.

Right to erasure (“right to be forgotten”)

As a data subject, you have the right to obtain from the Data Controller the erasure of personal data concerning you without undue delay, and the Data Controller is obliged to erase personal data concerning the data subject without undue delay where one of the following grounds applies:

the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
you, as the data subject, withdraw your consent on which the processing is based, and there is no other legal ground for the processing;
you, as the data subject, object to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);
the personal data have been unlawfully processed;
the personal data must be erased for compliance with a legal obligation in Union or Member State law to which the Data Controller is subject; or
the personal data have been collected in relation to the offer of information society services.

The data subject’s right to erasure may only be restricted where one of the exceptions specified in the GDPR applies.

Right to data portability

As a data subject, you have the right to receive the personal data concerning you, which you have provided to the Data Controller, in a structured, commonly used and machine-readable format (.XML, .CSV), and you have the right to transmit those data to another data controller without hindrance from the Data Controller to which the personal data were provided, where:

the processing is based on your consent or the processing is necessary for the performance of a contract to which you, as the data subject, are a party, or in order to take steps at your request prior to entering into a contract [Article 6(1)(a) or (b), or Article 9(2)(a) of the GDPR]

and

the processing is carried out by automated means.

Right to withdraw consent

Where the legal basis for the processing of the data subject’s personal data by the Data Controller is the data subject’s consent, you, as the data subject, may withdraw your consent to the processing at any time. In this regard, the Data Controller informs data subjects that, even following withdrawal of the consent given by the data subject, the Data Controller may continue to process the data subject’s personal data for the purpose of fulfilling its legal obligations or pursuing its legitimate interests, provided that the enforcement of such interests is proportionate to the restriction of the right to the protection of personal data.

Legal remedies

If you, as the data subject, consider that the processing of your personal data violates the provisions of the GDPR or the Info Act, or if you consider the way in which the Data Controller processes your personal data to be detrimental, you may lodge a complaint with the Data Controller at [email protected]. In addition, the data subject may directly lodge a complaint with the supervisory authority concerning the Data Controller’s data processing activities and may submit a complaint to the Hungarian National Authority for Data Protection and Freedom of Information (address: 1055 Budapest, Falk Miksa utca 9-11., postal address: 1363 Budapest, Pf. 9., telephone: +36 (1) 391-1400, e-mail: [email protected], website: naih.hu). The data subject may also bring proceedings before a court for the protection of their data, and the court shall deal with the matter as a matter of priority. In such proceedings, the data subject may freely choose whether to submit the claim to the court competent according to their place of residence (permanent address) or place of stay (temporary address) (birosag.hu/ugyfeleknek/torvenyszekek). The court competent according to the data subject’s place of residence or place of stay can be located on the birosag.hu/birosag-kereso website.

Privacy policy

Privacy Policy

Cookie settings