This Privacy Policy describes the characteristics of the processing of personal data carried out through the website Abaúji Trafik Shop Kereskedelmi és Szolgáltató Bt. (hereinafter: the “Data Controller”) operates at abaujitrafikshop.hu (hereinafter: the “Website”), including, in particular, the collection, storage and use of data.
This Privacy Policy is effective as of April 30, 2026. The Data Controller shall make the currently effective version of the Privacy Policy available on its Website and at its registered office.
This Privacy Policy has been prepared on the basis of Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: “GDPR”), with due regard to the provisions of Act CXII of 2011 on Informational Self-Determination and Freedom of Information (hereinafter: “Infotv.”). Its terminology corresponds to the definitions set out in Article 4 of the GDPR and, in certain respects, is supplemented by the interpretative provisions of Section 3 of the Infotv. In matters not regulated by this Privacy Policy, the provisions of the GDPR and, where permitted by the GDPR, the supplementary provisions of the Infotv. shall apply.
The Data Controller is entitled to prepare extracts from the contents of this Privacy Policy in connection with individual data processing activities and may also ensure that data subjects, when receiving prior information concerning the processing of personal data, declare by signing this document that they have read and acknowledged the contents of the extract. The Data Controller reserves the right to amend this Privacy Policy. If an amendment affects the use of the personal data provided by the data subject, the Data Controller shall inform the data subject of the changes in an appropriate manner, for example by e-mail. If the details of the processing of personal data are also changed as a result of an amendment to this Privacy Policy, the Data Controller shall obtain the separate consent of the data subject.
- Details of the Data Controller
| Name of the Data Controller: | Abaúji Trafik Shop Kereskedelmi és Szolgáltató Bt. |
| Registered office of the Data Controller: | 3849 Forró, Fő út 188. |
| Representative of the Data Controller: | Krajnyák Istvan |
| Contact details of the Data Controller: | abaujitrafikshop.hu |
- Principles relating to the processing of personal data
When providing its services, the Data Controller pays particular attention to the protection of personal data, compliance with mandatory legal provisions, and the secure and fair processing of personal data. In accordance with Section 3 of this Privacy Policy, the Data Controller treats the personal data made available to it confidentially and, in the course of its activities, observes the principles of lawfulness, fairness and transparency under the GDPR. It processes personal data for specified purposes, taking into account the principle of data minimisation, complies with the principle of storage limitation, protects the confidentiality and integrity of personal data, and observes the principle of accuracy under the GDPR.
- Method and security of data processing
The Data Controller shall ensure the security of the data and shall take the technical and organisational measures and establish the procedural rules necessary to enforce the data protection and confidentiality requirements prescribed by the GDPR, the Infotv. and other applicable legislation. The Data Controller protects personal data against unauthorised access, alteration, transmission, disclosure, accidental deletion, destruction, damage, and becoming inaccessible as a result of changes in the technology used. The Data Controller places particular emphasis on protecting electronically processed datasets contained in various records in order to ensure that data stored in different records cannot be directly linked or attributed to the data subject, unless permitted by law.
- Processing of personal data in connection with the use of the Data Controller’s Website
- Contact
The Data Controller provides users visiting the Website and its customers with the opportunity to contact the Data Controller through the contact details published on the Website and by completing the designated contact form.
| Purpose of data processing | Answering questions and, in connection with this, establishing and maintaining contact. |
| Categories of personal data processed | Name and e-mail address of the data subject, telephone number in the case of a telephone enquiry, and the message containing the matter concerned. |
| Categories of data subjects | Persons who are in contact with the Data Controller. |
| Legal basis for processing | Consent of the data subject pursuant to Article 6(1)(a) of the GDPR. |
| Data retention period | Until the question has been successfully answered or the purpose has been fulfilled, but no longer than until deletion at the request of the data subject. |
| Method of processing | Electronically. |
| Source of data | Data provided by the data subject. |
| Automated decision-making and profiling | The Data Controller does not use automated decision-making and does not carry out profiling. |
| Possible consequences of failure to provide data | If the data subject does not provide the Data Controller with the requested data, the data subject will not be able to contact the Data Controller. |
| Who may access the personal data? | Persons employed by the Data Controller and any data processors engaged by the Data Controller. |
| Transfer of data to a third country or international organisation | No transfer of data to a third country or international organisation takes place. |
- Processing of data in connection with questionnaires
In order to speed up and simplify the process of the services it provides, the Data Controller allows persons contacting the Data Controller to complete questionnaires.
| Purpose of data processing | Preparation of the service provided by the Data Controller and establishing contact. |
| Categories of personal data processed | Identification data of persons contacting the Data Controller (name, e-mail address, telephone number), as well as basic data relating to the type of matter concerned. |
| Categories of data subjects | Persons completing the Data Controller’s questionnaire. |
| Legal basis for processing | The legal basis for processing is the consent of the data subject pursuant to Article 6(1)(a) of the GDPR. |
| Data retention period | One year from the date the questionnaire is submitted. |
| Method of processing | Electronically. |
| Source of data | Data provided by the data subject. |
| Automated decision-making and profiling | The Data Controller does not use automated decision-making and does not carry out profiling. |
| Possible consequences of failure to provide data | Providing personal data and information relating to the type of matter concerned is not mandatory; however, providing such data facilitates the preparation of the service provided by the Data Controller and the establishment of contact. |
| Who may access the personal data? | Persons employed by the Data Controller and any data processors engaged by the Data Controller. |
| Transfer of data to a third country or international organisation | No transfer of data to a third country or international organisation takes place. |
- Cookies
The Data Controller uses so-called “cookies” when operating the Website. A cookie is a small data file (hereinafter: “cookie”) which the Data Controller sends to the browser of the data subject and which is stored on the data subject’s device. The Data Controller uses cookies necessary for basic functionality on its Website, i.e. Session Cookies (temporary cookies).
The cookies used on the Website are not, in themselves, capable of identifying individual data subjects. They are necessary for providing the services of the Website, and their use is essential for navigating the Website and for the proper operation of its functions. Most web browsers accept cookies by default, but the data subject may select a setting that rejects cookies or notifies the user when cookies are received. Without accepting cookies, the Website or parts thereof may not be displayed or may not function properly. Temporary cookies are stored only until the end of the data subject’s browsing session and are essential for the proper operation of certain functions or applications of the Website. These cookies ensure the proper operation of the Website, facilitate its use, and collect information about its use without identifying visitors to the Website.
| Purpose of data processing | Ensuring the operation of the Website. |
| Categories of personal data processed | The computer’s Internet Protocol address (IP address), domain name (URL), access data, client file request (file name and URL), HTTP response code, information about the website from which the request originated, the amount of bytes transferred during the visit, the time of the visit, and information about the pages viewed. |
| Categories of data subjects | Users visiting the Data Controller’s Website. |
| Legal basis for processing | Consent of the data subject pursuant to Article 6(1)(a) of the GDPR, in accordance with Section 155(4) of Act C of 2003 on Electronic Communications. |
| Data retention period | Until the end of the relevant visitor session (duration of the session). |
| Method of processing | Electronically. |
| Source of data | Data provided by the data subject. |
| Automated decision-making and profiling | The Data Controller does not use automated decision-making and does not carry out profiling. |
| Possible consequences of failure to provide data | Providing personal data and information relating to the type of matter concerned is not mandatory; however, providing such data facilitates the preparation of the service provided by the Data Controller and the establishment of contact. |
| Who may access the personal data? | The personal data relating to the use of the Website may only be accessed by employees of the Data Controller. |
| Data transfer | No transfer of data to a third country or international organisation takes place. |
| Who may access the personal data? | The personal data relating to the use of the Website may only be accessed by employees of the Data Controller. |
| Data transfer | No transfer of data to a third country or international organisation takes place. |
- Data Processors
Data Processors do not make independent decisions and are authorised to act exclusively on the basis of the agreement concluded with the Data Controller and the instructions received. Data Processors record, handle and process the personal data transferred to them by the Data Controller and processed or handled by them in accordance with the provisions prescribed by the GDPR. Data Processors carry out processing operations on the personal data provided by data subjects within the period of use specified in this Privacy Policy and corresponding to the individual purposes of processing. The Data Controller uses the following Data Processors in connection with the processing activities covered by this Privacy Policy:
| Category of Data Processor | Purpose of data processing | Data Processor | ||
| Name | Registered office | Tax number / Company registration number | ||
| Hosting provider | Hosting services | ErdSoft Hungary Kft. | 4 Kígyó Street, 6720 Szeged, Hungary |
32725458-2-06 / 06-09-030198 |
- Exercise of the rights of data subjects
As a data subject, you may request information about the processing of your personal data and may request the rectification of your personal data, restriction of processing, and deletion of your data at [email protected]. You are also entitled to exercise your right to data portability, your right to an effective legal remedy, and your right to withdraw your consent. In the event of a complaint in Hungary, you may contact the Hungarian National Authority for Data Protection and Freedom of Information or, at your discretion, a court. In judicial proceedings, the competent court shall have jurisdiction.
If you have submitted a request concerning the processing of your personal data in a manner other than that specified in this Privacy Policy and the Data Controller has been unable to carry out the appropriate identification required for data security and/or confidentiality purposes under this Privacy Policy (i.e. has been unable to identify you as the data subject), the Data Controller shall request you to provide the missing information. If you fail to do so or do not fully comply with the request, the Data Controller may be unable to respond to your request.
The period between the Data Controller’s request for the necessary personal data or completion of the missing activity and the provision of the personal data shall not be included in the deadline for responding to the request.
The Data Controller shall inform all recipients to whom the personal data have been disclosed of any rectification, deletion or restriction of processing, unless this proves impossible or requires disproportionate effort. At the request of the data subject, the Data Controller shall inform the data subject of such recipients.
- Right to information and access
As a data subject, you have the right to obtain confirmation from the Data Controller as to whether or not personal data concerning you are being processed and to access the following information:
- information as to whether your personal data are being processed;
- the purpose of the processing;
- the categories of personal data concerned;
- the recipients or categories of recipients to whom the personal data have been or will be disclosed;
- the envisaged period for which the personal data will be stored or, where this is not possible, the criteria used to determine that period;
- information about your rights and available legal remedies.
The Data Controller shall inform you of the measures taken in response to your request without undue delay and, in any event, within one month of receipt of the request. Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months. The Data Controller shall inform the applicant of any such extension within one month of receipt of the request, stating the reasons for the delay.
Information shall generally be provided free of charge. The Data Controller may charge a fee only in the cases specified in Article 12(5) and Article 15(3) of the GDPR.
If the Data Controller takes no action on the data subject’s request, it shall inform you, as the data subject, without undue delay and at the latest within one month of receipt of the request of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking judicial remedy.
- Right to rectification
As a data subject, you have the right to obtain from the Data Controller without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you also have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
For the period during which the Data Controller verifies the accuracy of the personal data, the processing of the personal data concerned may be restricted in accordance with this Privacy Policy.
- Right to object
As a data subject, you may object to the processing of your personal data by submitting a statement to the Data Controller if the legal basis for processing is
- the performance of a task carried out in the public interest pursuant to Article 6(1)(e) of the GDPR; or
- the legitimate interests pursued pursuant to Article 6(1)(f) of the GDPR.
Where you exercise your right to object, the Data Controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or which are related to the establishment, exercise or defence of legal claims.
The head of the Data Controller shall decide whether the processing is justified by compelling legitimate grounds. The Data Controller shall inform you, as the data subject, of its position in this regard.
- Right to restriction of processing
Restriction of processing may take place where:
- you, as the data subject, contest the accuracy of the data, for a period enabling the Data Controller to verify the accuracy of the personal data;
- the processing is unlawful and you, as the data subject, oppose the erasure of the personal data and request the restriction of their use instead;
- the Data Controller no longer needs the personal data, but you, as the data subject, require them for the establishment, exercise or defence of legal claims;
- you, as the data subject, have objected to processing pursuant to Article 21 of the GDPR, pending verification of whether the legitimate grounds of the Data Controller override those of the data subject.
For the duration of the assessment of the data subject’s objection to the processing of personal data, the Data Controller shall suspend the processing, examine the grounds for the objection and make a decision, of which the applicant shall be informed.
If the objection is justified, the Data Controller shall restrict the processing of the data, meaning that only storage may take place until
- the data subject consents to the processing;
- the processing of personal data is necessary for the establishment, exercise or defence of legal claims;
- the processing of personal data becomes necessary for the protection of the rights of another natural or legal person; or
- processing is required by law for reasons of public interest.
If the restriction of processing was requested by the data subject, the head of the relevant organisational unit shall inform the data subject in advance of the lifting of the restriction.
- Right to erasure (“right to be forgotten”)
As a data subject, you have the right to obtain from the Data Controller the erasure of personal data concerning you without undue delay upon request, and the Data Controller shall be obliged to erase personal data concerning you without undue delay where one of the following grounds applies:
- the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- you, as the data subject, withdraw your consent on which the processing is based and there is no other legal ground for the processing;
- you, as the data subject, object to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR;
- the personal data have been unlawfully processed;
- the personal data must be erased for compliance with a legal obligation in Union or Member State law to which the Data Controller is subject; or
- the personal data have been collected in relation to the offer of information society services.
The data subject’s right to erasure may be restricted only where one of the exceptions specified in the GDPR applies.
- Right to data portability
As a data subject, you have the right to receive the personal data concerning you which you have provided to the Data Controller in a structured, commonly used and machine-readable format (.XML, .CSV), and you have the right to transmit those data to another data controller without hindrance from the Data Controller to which the personal data were provided, where:
- the processing is based on your consent or is necessary for the performance of a contract to which you, as the data subject, are a party, or for taking steps at your request prior to entering into a contract [Article 6(1)(a) or (b), or Article 9(2)(a) of the GDPR].
and
- the processing is carried out by automated means.
The Data Controller shall inform all recipients to whom the personal data have been disclosed of any rectification, deletion or restriction of processing, unless this proves impossible or requires disproportionate effort. At the request of the data subject, the Data Controller shall inform the data subject of such recipients.
- Right to withdraw consent
Where the legal basis for the processing of the data subject’s personal data by the Data Controller is the consent of the data subject, you, as the data subject, may withdraw your consent to the processing at any time. The Data Controller informs data subjects that, following withdrawal of consent, it may continue to process the data subject’s personal data for the purpose of fulfilling its legal obligations or pursuing its legitimate interests, provided that the enforcement of such interests is proportionate to the restriction of the right to the protection of personal data.
- Legal remedies
If you, as the data subject, consider that the processing of your personal data infringes the provisions of the GDPR or the Infotv., or consider the manner in which the Data Controller processes your personal data to be prejudicial, you may submit a complaint to the Data Controller at [email protected]. The data subject may also lodge a complaint directly with the competent authority concerning the Data Controller’s data processing procedures and may submit a complaint to the Hungarian National Authority for Data Protection and Freedom of Information (address: 1055 Budapest, Falk Miksa utca 9-11., postal address: 1363 Budapest, Pf. 9., telephone: +36 (1) 391-1400, e-mail: [email protected], website: naih.hu). The data subject may also bring an action before a court for the protection of their personal data, and the court shall deal with the case as a matter of priority. In such proceedings, the data subject may freely choose whether to bring the action before the court having jurisdiction according to their permanent residence or temporary place of residence (birosag.hu/ugyfeleknek/torvenyszekek). The court having jurisdiction according to the data subject’s place of residence or temporary place of residence can be found at birosag.hu/birosag-kereso.