Data Processing Notice

I. The Data Controller and Contact Details

The data controller is ReadyPass Kft. You may contact us regarding data processing at the following details:

• Company name: ReadyPass Kft.
• Registered office: 2161 Csomád, Levente utca 14/a
• Company registration number: 13-09-216457 (Registry Court of the Budapest Environs Regional Court)
• Tax number: 27845619-2-13, EU VAT number: HU27845619
• Data protection contact: hello@readypass.eu

II. Definitions

The most important terms used in this notice, as defined in Article 4 of the GDPR:

• Personal data: any information relating to an identified or identifiable natural person
• Processing: any operation performed on personal data
• Controller: the organization that determines the purposes and means of processing
• Processor: the organization that processes personal data on behalf of the controller
• Data subject: the natural person to whom the personal data relates

III. Purposes and Legal Bases of Processing

The purpose and legal basis of each processing activity are as follows:

• Contact, quotation — legal basis: pre-contractual steps and legitimate interest (GDPR Article 6(1)(b) and (f))
• Performance of contract, customer management — legal basis: performance of contract (GDPR Article 6(1)(b))
• Invoicing, accounting — legal basis: legal obligation (GDPR Article 6(1)(c))
• Newsletter, marketing — legal basis: consent (GDPR Article 6(1)(a))
• Website security, improvement, analytics — legal basis: legitimate interest or consent (GDPR Article 6(1)(f) and (a))

IV. Data Retention Period

We process personal data only for as long as necessary:

• Contact data: 24 months
• Contractual data: 5 years after the contract ends (general limitation period)
• Accounting documents: 8 years (Hungarian Act C of 2000 on Accounting)
• Consent-based processing: until consent is withdrawn

V. Processors and Recipients

We process your data solely with the involvement of contracted processors operating within the EEA:

• Cloud infrastructure: Amazon Web Services EMEA SARL (EU region, Frankfurt)
• eIDAS qualified trust service provider (QTSP) for electronic signatures (EU)
• Email and customer relationship (CRM) service provider (EU)
• Error tracking, monitoring, and security service provider (EU)

VI. Data Security Measures

We apply the technical and organizational measures under Article 32 of the GDPR:

• Encryption at rest and in transit (AES-256, TLS 1.3)
• Role-based access control and multi-factor authentication
• Regular security testing and independent penetration testing
• Logging, monitoring, and regular backups
• Confidentiality obligation and data protection training of staff

VII. Rights of the Data Subject

Under the GDPR you have the following rights:

• Right to information and access (Article 15)
• Right to rectification (Article 16)
• Right to erasure (right to be forgotten) (Article 17)
• Right to restriction of processing (Article 18)
• Right to data portability (Article 20)
• Right to object (Article 21)
• Right to withdraw consent, and the right to lodge a complaint with the supervisory authority

VIII. Procedural Rules

You may submit your request to adatvedelem@readypass.eu. Within one month at the latest from receipt of the request, we will inform you of the measures taken. This deadline may be extended by a further two months in justified cases, of which you will be notified. The information is provided free of charge.

IX. Remedies

If you consider that our data processing infringes the law, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH — address: 1055 Budapest, Falk Miksa utca 9-11.; postal address: 1363 Budapest, Pf. 9.; phone: +36 1 391 1400; email: ugyfelszolgalat@naih.hu; web: naih.hu). In the event of an infringement of your rights, you may also turn to the courts; the action may also be brought before the regional court of your place of residence or stay.

X. Amendment of the Notice

ReadyPass Kft. reserves the right to unilaterally amend this notice. We will inform data subjects of any amendments through the current version published on the website.