.

Privacy Notice

Effective from 15 April 2025

I. General information and the Data Controller

1.1. Identity and activities of the Data Controller

The controller responsible for the processing operations specified in this Privacy Notice (“Notice”) is CREDIPASS Szolgáltató Korlátolt Felelősségű Társaság (registered office: 1027 Budapest, Kapás u. 6–12., Building A; company registration number: 01-09-733137; email: info@dh.hu; website: www.dh.hu; telephone: +36-1-555-2255; hereinafter referred to as “CREDIPASS” or the “Data Controller”).

CREDIPASS is a company registered in Hungary.

CREDIPASS acts as an independent intermediary (multiple agent), providing financial intermediation services under Act CCXXXVII of 2013 on Credit Institutions and Financial Enterprises (hereinafter referred to as the “Hpt.”). Multiple-agent activities are regulated by the Hpt. CREDIPASS acts as an intermediary for the products of the financial institutions with which it has contractual relationships. It does not provide loans or credit advisory services.

1.2. Applicable legislation

CREDIPASS carries out its activities under the laws of the European Union and Hungary. The processing of personal data is primarily governed by the European Union’s General Data Protection Regulation: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the “GDPR”).

The following legislation also applies:

  • Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information;

  • the Hpt.;

  • Act CLXII of 2009 on Consumer Credit (“Fhtv.”);

  • Act LIII of 2017 on the Prevention and Combating of Money Laundering and Terrorist Financing, in respect of the identification, reporting and record-keeping data required by that Act (hereinafter referred to as the “Pmt.”);

  • Section 169 of Act C of 2000 on Accounting, in respect of the retention of accounting documents (the “Accounting Act”).

The relevant legislation is available at http://net.jogtar.hu/.

1.3. Scope of the Notice and definition of the data subject

This Notice covers the processing of personal data relating to CREDIPASS’s financial intermediation activities. It applies exclusively to processing operations falling within the scope of the GDPR.

Under the GDPR, personal data means any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, a number, location data, an online identifier, or one or more factors specific to that natural person’s physical, physiological, genetic, mental, economic, cultural or social identity.

For the processing operations covered by this Notice, a data subject is a person who initiates the establishment of a legal relationship with CREDIPASS, contacts CREDIPASS for that purpose, or enters into a contract with CREDIPASS.

Accordingly, this Notice does not apply to data that does not relate to natural persons, such as company data, or that cannot be linked to natural persons, such as statistical or anonymised data.

This Notice applies exclusively to processing carried out by CREDIPASS.

II. Principles, purposes and legal bases of processing

2.1. Principles of processing

CREDIPASS processes data lawfully, fairly and transparently in relation to the data subject. CREDIPASS endeavours to ensure that the data it processes is accurate and up to date. CREDIPASS safeguards the exercise of data subjects’ rights and takes the necessary measures to ensure that processing is lawful at every stage.

2.2. Purposes of processing

CREDIPASS processes personal data to carry out its activities, namely the intermediation of financial services. The processing operations covered by this Notice serve the following purposes:

  • identifying the data subject and establishing and maintaining contact with them;

  • identifying the data subject’s needs, assessing their repayment capacity and creditworthiness, and evaluating risks;

  • retrieving the data subject’s data from the Central Credit Information System;

  • preparing a loan agreement or an agreement for another service;

  • contacting the financial institutions providing the service;

  • recording the data and declarations required to conclude a loan agreement or an agreement for another service, and transmitting them to the financial institutions providing the service;

  • performing the agency agreement;

  • exercising rights and fulfilling obligations arising from the legal relationship;

  • complying with obligations imposed by law;

  • enforcing CREDIPASS’s entitlement to remuneration;

  • advertising, subject to the data subject’s separate consent.

2.3. Legal bases of processing

As CREDIPASS processes personal data for several purposes, the legal basis for processing may also vary.

Consent of the data subject — Article 6(1)(a) of the GDPR

In certain cases, processing is based on the data subject’s consent. The data subject gives their consent by contacting CREDIPASS, initiating the establishment of a legal relationship and starting the process of applying for a service. Consent is always voluntary; however, failure to give consent may prevent a legal relationship from being established between the data subject and CREDIPASS. CREDIPASS always informs the data subject about the processing.

A contract between CREDIPASS and the data subject — Article 6(1)(b) of the GDPR

Where the data subject enters into a contract with CREDIPASS, they provide the data necessary for the performance of that contract in the contract itself and in the related forms. In such cases, processing is carried out for the performance of the contract and to take steps initiated by the data subject, pursuant to the above provision of the GDPR.

If the data subject does not consent to the processing of any data requested by CREDIPASS or specified in the contract, they have the right to refuse to provide that data. If processing is required by law, or the contract cannot be performed without the data, the contract will not be concluded if the data is not provided.

Compliance with a legal obligation — Article 6(1)(c) of the GDPR

In certain cases, processing is based on a statutory provision. The principal laws that also require the processing of data are listed in Section 1.2.

III. Collection of data, categories of data processed, the processing procedure and profiling

3.1. Collection of data

CREDIPASS primarily collects data directly from the data subject. CREDIPASS collects data from other sources only where the data subject has consented to this, for example in the case of an employer, or where legislation expressly authorises such collection.

3.2. Categories of data processed

CREDIPASS processes the following categories of data relating to data subjects:

a. Data required to identify the data subject

The data processed includes surname and given name, surname and given name at birth, mother’s birth name, place and date of birth, permanent address, correspondence address and nationality.

The purpose of processing this data is to identify the data subject unambiguously. As the contract cannot be concluded or performed without identification, providing this data is a condition for entering into the contract.

b. Data required to maintain contact

The purpose of processing this data is to maintain contact with the data subject. In addition to the data listed in paragraph a, the data processed includes the data subject’s telephone number and email address.

Processing at least one contact detail, either a telephone number or an email address, is necessary for the performance of the contract and for communications relating to it. Providing this data is voluntary.

c. Data relating to the requested service

CREDIPASS processes data relating to the requested service, including its type, nature, amount and other characteristics.

As CREDIPASS cannot provide the service without this data, it is closely connected to the service and its processing is therefore mandatory.

d. Data required to assess needs relating to the intermediated financial service, conclude a contract, provide information, determine the extent of the customer’s obligations and enable the customer to decide whether to enter into the contract

CREDIPASS aims, and is legally required, to fulfil its information obligations relating to the financial services it intermediates.

CREDIPASS can provide the data subject with appropriate information about the terms on which an intermediated service is available, such as interest, discounts and instalments, only if it has access to all data that may be relevant to that service.

The scope of this data varies depending on the service. For loans, CREDIPASS typically processes data relating to the property to be used as collateral, including its address, type and purchase price, as well as data relating to income and regular financial obligations. Certain service providers may require additional data.

Providing this data is voluntary, but supporting evidence may be required to conclude the service agreement. If the data subject does not provide the data, the application may be rejected or accepted on less favourable terms.

e. Data relating to the loan applied for and disbursed, or to another intermediated service

This includes the loan amount, application details, data relating to disbursement and payment, the nature and value of another service, and other data relating to the provision and performance of the service.

The purpose of processing is to provide the service and to record and enforce the parties’ rights and obligations. As this data describes the service provided, CREDIPASS processes it in all cases.

f. Data generated when CREDIPASS is contacted for other purposes

Where the data subject contacts CREDIPASS and provides information to customer service, for example in connection with a complaint, CREDIPASS processes that data.

The purpose of processing is to investigate and record the data subject’s complaints and requests. The legal bases are the contract between CREDIPASS and the data subject, and the Hpt.

g. Recorded telephone conversations

CREDIPASS records telephone conversations, after informing the data subjects, as described in Chapter IV below. The data subject may request information about the recorded conversation.

The purposes of processing are consumer protection, recording the data subject’s legal declarations and quality assurance, including monitoring CREDIPASS personnel to ensure that communications with the data subject comply with the law.

Before the conversation begins, the data subject is always informed about the recording and the retention period. The primary legal basis is the Hpt., supplemented by the contract between CREDIPASS and the data subject or, in the absence of a contract, the data subject’s consent.

h. Documents

CREDIPASS may copy the document used to identify the data subject if the data subject consents to the copying.

The purpose of copying is to facilitate the conclusion of the contract, as CREDIPASS transmits the data to the credit institution providing the service, and to demonstrate that CREDIPASS has carried out the identification.

The legal basis is the data subject’s consent.

3.3. The processing procedure

If the data subject contacts the Duna House or Smart Ingatlan network and expresses an interest in a loan, the estate agent obtains the data subject’s consent and then transfers the contact details required to establish contact to CREDIPASS. The CREDIPASS representative responsible for the relevant area then contacts the data subject. The data subject may also contact a CREDIPASS representative directly.

When the data subject contacts a CREDIPASS representative, they receive information about the processing of their data. The data required to prepare an offer, as listed in Sections 3.2.a–e above, is then recorded and the data subject is identified.

CREDIPASS subsequently prepares an offer containing details of the available loans and other services, together with the agency information form and agreement. If the data subject signs these documents and selects the requested service, CREDIPASS transfers the data to the financial institution providing the service and assists in preparing the conclusion of the contract.

CREDIPASS subsequently retains the data as specified in this Notice.

3.4. Profiling

Under the GDPR, profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, particularly to analyse or predict aspects concerning that person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

CREDIPASS uses profiling in the following cases:

3.4.1. Preparing offers

Where the data subject uses CREDIPASS’s financial intermediation service, processing takes place as described in Section 4.1.

CREDIPASS is required to analyse and present several services to the data subject in accordance with its Business Regulations. Offers are compiled through automated decision-making, using only the data provided by the data subject to CREDIPASS, as listed in Sections 3.2.a–e.

The CREDIPASS representative assisting the data subject uploads the provided data electronically to the systems of CREDIPASS and its partner. A pre-programmed software application then evaluates the data without human intervention and, based on the information provided, such as the requested loan and income, draws conclusions about the services available. The offer is compiled on this basis.

As described in Section 4.1 below, the legal bases for profiling are:

  • the data subject’s consent, given by using CREDIPASS’s service and accepting the Privacy Notice;

  • the contract between the parties, as CREDIPASS can present the most suitable offer to the customer by analysing the services of several credit institutions;

  • compliance with a legal obligation: under Section 3(1) of NGM Decree 53/2016 (XII. 21.) on the General Rules Governing the Pre-Contractual Information Obligations of Financial Services Intermediaries, an independent intermediary must analyse competing offers from at least three service providers.

Profiling is used exclusively to determine which services are suitable and available based on the data subject’s needs. CREDIPASS does not use data from other sources for profiling. The CREDIPASS representative communicates the result to the data subject by presenting the offer.

Profiling is necessary to prepare and perform the contract between the data subject and CREDIPASS and to provide the service.

The sole consequence of profiling is the compilation of the offer.

The data subject has the right to request information about profiling. They may request that CREDIPASS review the profiling and make an individual decision involving human intervention. The data subject has the right to express their point of view.

3.4.2. Advertising

If the data subject consents, CREDIPASS may send them advertising pursuant to Section 4.4 below.

When determining the content of advertisements, CREDIPASS uses the data provided by the data subject. The offer displayed in an advertisement is the result of profiling.

The software used to compile advertisements evaluates the data available to CREDIPASS about the data subject within a closed system and without human intervention. Based on this data, the software determines whether the data subject belongs to the target group for the advertisement to be sent.

After sending the advertisement, CREDIPASS deletes all profiling data.

Profiling is used solely to decide which advertisement should be sent to the data subject.

The sole legal basis for profiling is the data subject’s consent.

The data subject has the right to request information about profiling and to express their point of view. They may prohibit profiling.

IV. Specific processing operations

4.1. Processing relating to intermediation activities

Description of processing: CREDIPASS’s primary activity is the intermediation of financial services. Where the data subject contacts CREDIPASS, CREDIPASS establishes contact, carries out identification and then processes the data as described in Section 3.3 above.

Profiling takes place during the credit assessment process as described in Section 3.4.1 above.

Categories of data processed: The data listed in Sections 3.2.a–e above.

Purposes of processing:

  • identifying the data subject and establishing and maintaining contact with them;

  • identifying the data subject’s needs, assessing their repayment capacity and creditworthiness, and evaluating risks;

  • preparing a loan agreement or an agreement for another service;

  • contacting the financial institutions providing the service;

  • recording the data and declarations required to conclude a loan agreement or an agreement for another service, and transmitting them to the financial institutions providing the service;

  • performing the agency agreement;

  • exercising rights and fulfilling obligations arising from the legal relationship;

  • complying with obligations imposed by law.

Legal bases of processing: The data subject’s consent, given by using CREDIPASS’s service and accepting the Privacy Notice; the contract between the parties; and compliance with a legal obligation under the Hpt. and NGM Decree 53/2016 (XII. 21.) on the General Rules Governing the Pre-Contractual Information Obligations of Financial Services Intermediaries.

Retention period: If a legal relationship is established between the data subject and CREDIPASS, CREDIPASS processes the data throughout that relationship and for eight years after it ends. This period is justified by the possibility of claims being enforced after the relationship has ended.

If no contract is concluded, CREDIPASS processes the data for five years from collection pursuant to Section 166/A(2) of the Hpt.

4.2. Recording telephone conversations during complaint handling

Description of processing: CREDIPASS records telephone conversations with data subjects concerning complaints received on the telephone number specified in its Complaint Handling Policy.

Before recording begins, the data subject is informed about the recording. If they do not consent to it, they may handle the matter in person. CREDIPASS retains recorded calls for five years under Section 288(2) of the Hpt.

For other calls, where CREDIPASS records them, the purposes of recording are to facilitate the enforcement of claims and settlement of accounts, ensure that communications with the data subject can be verified, and protect consumers. CREDIPASS retains these recorded calls for five years.

The data subject may request information about the recording, its circumstances and the use of recorded calls. Upon request, CREDIPASS provides access to listen to the recording and, free of charge within twenty-five days, supplies a certified transcript or a copy of the recording.

Categories of data processed: Identification data, contact details and recorded audio from among the data specified in Sections 3.2.a, c and h above.

Purposes of processing:

  • identifying the data subject and establishing and maintaining contact with them;

  • performing the agency agreement;

  • exercising rights and fulfilling obligations arising from the legal relationship, and enforcing claims.

Legal bases of processing: Performance of the contract between the data subject and CREDIPASS, and a statutory provision, namely Section 288(2) of the Hpt.

Retention period: CREDIPASS stores telephone recordings for five years.

4.3. Processing for advertising purposes

Description of processing: If the data subject consents, CREDIPASS may use their provided contact details, including email address, postal address and telephone number, for advertising purposes.

CREDIPASS may send advertisements directly to the data subject and contact them for opinion polling, market research and direct marketing purposes. The data subject may withdraw their consent at any time.

Profiling takes place when advertisements are sent and their content is determined, as described in Section 3.4.2 above.

Categories of data processed: Identification data and contact details from among the data specified in Sections 3.2.a and b above.

Purpose of processing:

  • advertising, subject to the data subject’s separate consent.

Legal basis of processing: The data subject’s consent.

Retention period: CREDIPASS deletes the data if the data subject requests this or objects to the processing.

4.4. Recording telephone conversations during advertising activities

Description of processing: If the data subject consents, CREDIPASS contacts them by telephone to present offers, assess their needs and carry out preliminary screening.

CREDIPASS records the telephone conversation. The conversation begins with information about the recording and processing. If the data subject does not consent to the recording, they may end the call and contact CREDIPASS in person or by email instead.

The data subject may request information about processing, including during the call. Upon request, CREDIPASS provides access to listen to the recording and, free of charge within twenty-five days, supplies a certified transcript or a copy of the recording.

Categories of data processed: Identification data, contact details and recorded audio relating to the data specified in Sections 3.2.a and b above.

Purposes of processing:

  • identifying the data subject’s needs, assessing their repayment capacity and creditworthiness, and evaluating risks;

  • preparing a loan agreement or an agreement for another service;

  • advertising, subject to the data subject’s separate consent.

Legal basis of processing: The data subject’s consent.

Retention period: CREDIPASS deletes the data and recording if the data subject requests this or objects to the processing. CREDIPASS deletes the data and recording sixty days after recording.

4.4. Processing where an agency agreement is refused

Description of processing: If CREDIPASS refuses to enter into a contract, it processes the data for the purpose of enforcing potential claims pursuant to Section 166/A(2) of the Hpt.

Categories of data processed: The data provided by the data subject.

Purpose of processing:

  • exercising rights and fulfilling obligations arising from the legal relationship.

Legal basis of processing: A statutory provision, namely Section 166/A(2) of the Hpt.

Retention period: CREDIPASS deletes the data when the period for enforcing claims expires, meaning when the claim becomes time-barred. This period is five years from the date the data is recorded.

4.5. Processing after the legal relationship ends

Description of processing: Where the contractual legal relationship between CREDIPASS and the data subject ends, CREDIPASS continues to process the data generated during that relationship.

Categories of data processed: Contract-related data from among the data specified in Section 3.2 above.

Purpose of processing:

  • exercising rights and fulfilling obligations arising from the legal relationship.

Legal bases of processing: The data subject’s consent and performance of the contract.

Retention period: Data is processed for five years after the contract ends. Within that period, CREDIPASS deletes the data if the data subject requests this and no other legal basis for processing exists.

4.6. Processing relating to commission settlement

Description of processing: If the data subject enters into a financial services agreement as a result of CREDIPASS’s intermediation, the financial institution pays commission to CREDIPASS in accordance with the applicable legislation.

The commission is based on the amount of the loan taken out by the data subject or the value of another service. The financial institution providing the service supplies the relevant data to CREDIPASS.

Categories of data processed: The data specified in Section 3.2.e above.

Purpose of processing:

  • enforcing CREDIPASS’s entitlement to remuneration.

Legal basis of processing: Performance of the contract.

Retention period: Data is processed for the duration of the entitlement to commission and for five years thereafter.

V. Other information relating to processing

5.1. Disclosure of data

a. General rules on disclosure

CREDIPASS discloses personal data to a third party only if the data subject has expressly consented, with knowledge of the categories of data to be disclosed and the recipient, or if the disclosure is authorised by law. This includes, in particular, disclosure to the financial institution providing the financial service selected by the data subject.

b. Rules on banking secrecy

Under Section 160(1) of the Hpt., banking secrets comprise any facts, information, solutions or data available to a financial institution about individual customers concerning their identity, personal data, financial position, business activities, financial management, ownership and business relationships, the balance and transactions of their accounts held with the financial institution, and their contracts with that institution.

Banking secrets may be disclosed to third parties only if:

a) the customer of the financial institution or their legal representative requests or authorises disclosure in a public document or a private document with full probative force, specifying precisely the banking secrets that may be disclosed. Such a document is not required if the customer submits the written declaration as part of entering into a contract with the financial institution;

b) the Hpt. provides an exemption from the obligation to maintain banking secrecy;

c) the interests of the financial institution require disclosure for the sale of a claim against the data subject or the enforcement of an overdue claim.

5.2. Data processors and subcontractors

CREDIPASS may engage data processors to carry out its activities. Data processors do not make independent decisions and may act on behalf of CREDIPASS only in accordance with their contracts with CREDIPASS and the instructions received.

CREDIPASS monitors the work of its data processors. Data processors may engage further processors only with CREDIPASS’s consent.

CREDIPASS engages intermediaries with which it has intermediary relationships, including subcontractors, and cooperating partners as data processors.

As these parties change regularly, CREDIPASS provides separate information, upon the data subject’s request, about the particular intermediary subcontractor processing their data. All CREDIPASS intermediary subcontractors can also be checked in the register maintained by the Magyar Nemzeti Bank, the central bank of Hungary:

https://alk.mnb.hu/bal_menu/piaci_szereplok/nyilvantartasok/penz_kozv_lekerdezo

If the data subject contacts CREDIPASS through one of its subcontractors, that subcontractor processes the data subject’s data. The subcontractor does not use the data for purposes other than intermediation.

CREDIPASS engages Bankmonitor Kft. (1037 Budapest, Montevideo u. 16/B, 3rd floor) as a data processor. This processor assists in preparing offers and develops and operates the IT system that generates them.

For certain customers, CREDIPASS engages Comnica Kft. (1119 Budapest, Mohai út 38; company registration number: 01-09-895207) as a data processor. This processor assists in contacting customers and handling and recording telephone conversations.

5.3. Data security and access to data

CREDIPASS safeguards data security by implementing the technical and organisational measures and procedural rules necessary to meet data security requirements.

CREDIPASS maintains its records in accordance with applicable legislation and ensures that data is accessible only to employees and other persons acting on its behalf who need it to perform their duties or tasks.

All persons acting on behalf of CREDIPASS may access only the data necessary to perform their duties. These persons must treat the data as confidential.

As part of its IT security responsibilities, CREDIPASS takes particular care to ensure:

  • protection against unauthorised access, including the protection of software and hardware and physical protection, such as access controls and network security;

  • measures enabling data files to be restored, including regular backups and the separate, secure management of copies, such as mirroring and backups;

  • protection of data files against viruses;

  • physical protection of data files and the devices containing them, including protection against fire, water damage, lightning and other natural hazards, and the ability to restore data following damage caused by such events, through measures such as archiving and fire protection.

CREDIPASS takes the necessary measures to protect paper records, particularly regarding physical security and fire protection.

Employees, agents and other persons acting on behalf of CREDIPASS must securely store and protect any media they use or possess that contains personal data, regardless of how that data is recorded.

5.4. Retention periods

By establishing and following rules on erasure, CREDIPASS ensures that personal data is not processed for longer than is necessary and lawful. Data is erased in the following cases:

a. The personal data is no longer necessary for the purposes for which it was collected or otherwise processed.

If the purpose of processing no longer exists and retention is not required by law, CREDIPASS erases the data.

b. The data subject withdraws consent.

If the data subject withdraws consent or requests erasure, CREDIPASS always checks whether processing is required by law. If it is, CREDIPASS refuses the erasure request.

If processing is not mandatory but CREDIPASS has a legal basis for it and processing is necessary for the establishment, exercise or defence of legal claims, CREDIPASS examines whether the data can be erased.

If processing is not required by law and CREDIPASS has no legal basis other than consent, or continued processing is not justified despite the existence of a legal basis, CREDIPASS erases the data at the data subject’s request.

If CREDIPASS refuses the erasure request, it always informs the data subject and specifies the legal basis for refusal and the available remedies.

c. The data subject objects to processing.

If processing is based on the Data Controller’s legitimate interests, the data subject may object to it.

In such cases, CREDIPASS erases the data unless it can demonstrate compelling legitimate grounds for processing that override the data subject’s interests, rights and freedoms, or grounds relating to the establishment, exercise or defence of legal claims.

If the data subject objects to processing for advertising purposes, CREDIPASS erases the data relating to that processing.

d. It is established that processing is unlawful.

If processing is unlawful, CREDIPASS always erases the data as soon as the unlawfulness becomes apparent.

e. Erasure is necessary to comply with a legal obligation or has been ordered by a court or the Hungarian National Authority for Data Protection and Freedom of Information.

If erasure is required by law or ordered by a court or the Authority in a final and binding decision, CREDIPASS erases the data.

f. The retention period specified in advance by law or in the consent has expired.

If legislation prescribes a retention period, CREDIPASS erases the data when that period expires.

5.5. Handling personal data breaches

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed.

CREDIPASS reports a personal data breach to the Hungarian National Authority for Data Protection and Freedom of Information without delay, unless the breach is unlikely to result in a risk to the rights and freedoms of data subjects.

CREDIPASS keeps a record of personal data breaches and the measures taken in connection with each breach.

If the breach is serious, meaning that it is likely to result in a high risk to the data subject’s rights and freedoms, CREDIPASS informs the data subject about the breach without undue delay.

VI. Data subjects’ rights and how to exercise them

6.1. Data subjects’ rights

Information and access

The data subject has the right to receive information about the processing of their data. CREDIPASS provides information when collecting the data, and this Notice remains available to the data subject at any time.

During processing, the data subject may request comprehensive information about the processing of their data at any time. They may also request a copy of the data.

Rectification

The data subject may request that CREDIPASS correct inaccurate data relating to them and complete any incomplete data.

Erasure and withdrawal of consent

The data subject may withdraw their consent to processing and request erasure of their data at any time.

CREDIPASS refuses erasure only where processing is based on legislation or is necessary for the establishment, exercise or defence of legal claims.

Restriction of processing

The data subject has the right to request restriction of processing in the following cases:

a) the data subject contests the accuracy of the personal data, in which case processing is restricted for a period enabling the Data Controller to verify its accuracy;

b) processing is unlawful and the data subject opposes erasure and requests restriction of use instead;

c) the Data Controller no longer needs the personal data for processing purposes, but the data subject requires it for the establishment, exercise or defence of legal claims;

d) the data subject has objected to processing, in which case restriction applies pending verification of whether the Data Controller’s legitimate grounds override those of the data subject.

Where processing has been restricted, the personal data may, apart from storage, be processed only with the data subject’s consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.

Objection

Where processing is based on the legitimate interests of CREDIPASS or a third party, the data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of their personal data.

In such cases, the Data Controller may no longer process the personal data unless it demonstrates compelling legitimate grounds that override the data subject’s interests, rights and freedoms, or grounds relating to the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing purposes, the data subject has the right to object at any time to the processing of their personal data for those purposes.

Data portability

The data subject has the right to receive personal data relating to them in a structured, commonly used and machine-readable format and to transmit that data to another controller, provided that processing is carried out by automated means.

Where technically feasible, the data subject may request that the personal data be transmitted directly to another controller.

6.2. Safeguarding data subjects’ rights and handling their requests

CREDIPASS informs the data subject about processing when contact is established. Upon request, CREDIPASS provides this Notice to the data subject and also makes it available on its website.

This detailed Notice is available to the data subject, and CREDIPASS draws their attention to its existence and availability. CREDIPASS also provides an information document based on this Notice containing the principal data protection rules.

The data subject may exercise the rights specified in Section 6.1 as follows:

a) by email to CREDIPASS at info@credipass.hu;

b) by post to CREDIPASS Kft., 1027 Budapest, Kapás u. 6–12., Building A;

c) by telephone on 06-1-555-2222.

CREDIPASS examines the request without delay, decides whether to grant it and takes the necessary measures.

CREDIPASS informs the data subject about the measures taken within one month. The response always includes the action taken by CREDIPASS or the information requested by the data subject.

If CREDIPASS refuses the request and does not take the measures necessary to fulfil it, the response includes the legal basis and reasons for refusal and the remedies available to the data subject.

CREDIPASS does not make fulfilment of a request conditional on payment of a fee or reimbursement of costs.

If the circumstances or method of submission make it uncertain whether the request originates from the data subject, CREDIPASS may ask the applicant to verify their entitlement or submit the request in a way that clearly establishes it.

CREDIPASS communicates any rectification, erasure or restriction of processing to each recipient to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate effort. Upon request, the Data Controller informs the data subject about those recipients.

6.3. Remedies

If their rights are infringed, the data subject may request that CREDIPASS cease unlawful processing and review the processing or the refusal of their request.

CREDIPASS investigates every such complaint and informs the data subject of the outcome.

Data subjects may submit complaints using the contact details specified in Section 1.1.

The data subject may also lodge a complaint directly with the Hungarian National Authority for Data Protection and Freedom of Information:

If their rights are infringed, the data subject has the right to bring proceedings before a court.

Upon request, CREDIPASS provides the data subject with detailed information about the court with subject-matter and territorial jurisdiction to hear the case and about the possibility of bringing proceedings.