Privacy Notice

Effective from 15 April 2025

I. General information and the Data Controller

1.1. Identity and activities of the Data Controller

The personal data of data subjects is processed by DUNA HOUSE Biztosításközvetítő és Pénzügyi Tanácsadó Korlátolt Felelősségű Társaság (registered office: 1027 Budapest, Kapás u. 6–12., Building A; company registration number: 01-09-877554; email: biztositas@dh.hu; telephone: 06 1 555 2222; hereinafter referred to as the “Data Controller”).

The Data Controller is an insurance intermediary (multiple agent) registered by the Magyar Nemzeti Bank, the central bank of Hungary, acting as the supervisory authority under Act LXXXVIII of 2014 on the Business of Insurance (hereinafter referred to as the “Bit.”). The Data Controller acts as an intermediary for the insurance products of the insurers with which it has business relationships.

1.2. Scope of the Notice and definition of the data subject

This Privacy Notice (hereinafter referred to as the “Notice”) applies to processing carried out by the Data Controller.

Unless otherwise specified, this Notice does not cover processing carried out by third parties, particularly the insurers whose insurance products the Data Controller intermediates.

This Notice does not cover processing carried out by persons, organisations or companies whose information materials, newsletters or advertising communications informed the data subject about the Data Controller’s services.

This Notice does not cover processing carried out by persons advertising on www.dh.hu or by other companies belonging to the Duna House group named on www.dh.hu. It also does not cover processing carried out on www.credipass.hu (hereinafter referred to as the “Website”) by CREDIPASS Kft., a member of the Duna House group.

The Company operates a separate subpage on the Website, where its policies are also available.

This Notice applies only to the processing of personal data and therefore does not cover the processing of data relating to entities other than natural persons.

For the processing operations covered by this Notice, a data subject is a person who contacts the Data Controller for insurance intermediation purposes.

This Notice does not apply to data that does not relate to natural persons, such as company data, or that cannot be linked to natural persons, such as statistical or anonymised data.

1.3. Applicable legislation

The Data Controller carries out its activities under the laws of the European Union and Hungary. The processing of personal data is primarily governed by the European Union’s General Data Protection Regulation: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the “GDPR”).

The following legislation also applies:

• the provisions of the Bit. concerning insurance intermediation activities (Book Three) and insurance secrecy (Chapter X);

• Act LIII of 2017 on the Prevention and Combating of Money Laundering and Terrorist Financing, in respect of the identification, reporting and record-keeping data required by that Act (hereinafter referred to as the “Pmt.”);

• Section 169 of Act C of 2000 on Accounting, in respect of the retention of accounting documents.

The relevant legislation is available at http://net.jogtar.hu/.

II. Principles and legal bases of processing

2.1. Principles of processing

The Data Controller processes data lawfully, fairly and transparently in relation to the data subject. The Data Controller endeavours to ensure that the data it processes is accurate and up to date. It safeguards the exercise of data subjects’ rights and takes the necessary measures to ensure that processing is lawful at every stage.

2.2. Purposes of processing

The Data Controller processes personal data to carry out its insurance intermediation activities. The processing operations covered by this Notice may serve the following purposes:

• identifying the data subject and establishing and maintaining contact with them;

• identifying the data subject’s needs and assessing risks;

• establishing the data subject’s circumstances relevant to insurance and determining which insurance products may be offered to them;

• exercising rights and fulfilling obligations arising from the legal relationship;

• complying with obligations imposed by law;

• handling complaints;

• advertising, subject to the data subject’s separate consent;

• complying with statutory obligations.

2.3. Legal bases of processing

As the Data Controller processes personal data for several purposes, the legal basis for processing may also vary.

Consent of the data subject — Article 6(1)(a) of the GDPR

In certain cases, processing is based on the data subject’s consent. The data subject gives their consent by contacting the Data Controller, initiating the establishment of a legal relationship and starting the process of applying for a service.

Consent is always voluntary; however, failure to give consent may prevent a legal relationship from being established between the data subject and the Data Controller. The Data Controller always informs the data subject about the processing.

Compliance with a legal obligation — Article 6(1)(c) of the GDPR

In certain cases, processing is based on a statutory provision. The principal laws that also require the processing of data are listed in Section 1.3.

III. Collection of data, categories of data processed, the processing procedure and profiling

3.1. Collection of data

The Data Controller primarily collects data directly from the data subject. Data collection primarily takes place through a subcontractor participating in the Data Controller’s insurance intermediation activities.

If the data subject contacts the Data Controller through its broker subcontractor, the subcontractor records the data using the form designated for that purpose. In such cases, the data subject must also declare that they consent to the processing of their data.

The Data Controller obtains data from other sources only where authorised by law. The Data Controller informs the data subject about the collection.

3.2. Categories of data

a. Data required to identify the data subject and maintain contact

This includes surname and given name, email address and telephone number.

The purposes of processing are to identify the data subject and maintain contact with them. The legal bases are the data subject’s consent, given by a declaration, and a statutory provision, namely Section 393(1) of the Bit.

Providing this data is mandatory.

b. Data relating to customer due diligence obligations

This includes:

• surname and given name;

• surname and given name at birth;

• mother’s birth name;

• place and date of birth;

• permanent address or, in its absence, residential address;

• postal address;

• type and number of identification document;

• address card number;

• nationality;

• whether the data subject acts on their own behalf or on behalf of another beneficial owner;

• in the latter case, the beneficial owner’s surname and given name, surname and given name at birth, nationality, place and date of birth, permanent address or, in its absence, residential address;

• information concerning the data subject’s status as a politically exposed person.

The purpose of processing is to comply with obligations imposed by law. The legal basis is compliance with the obligation under Section 7 of the Pmt.

Where customer due diligence is carried out under the Pmt. before entering into a life insurance contract, providing the data is mandatory under the Pmt. The contract cannot be concluded without it.

c. Data relating to the insurance the data subject wishes to take out

The Data Controller processes data relating to the type of insurance the data subject wishes to take out, such as home or motor insurance, the insured subject matter and the insurance terms.

The categories of data depend on the insurers providing the insurance products intermediated by the Data Controller.

Providing this data is voluntary. However, failure to provide certain data may mean that some insurance products or discounts are unavailable to the data subject.

The legal basis is the data subject’s consent.

d. Data relating to the completed transaction or intermediated insurance

Where insurance intermediation takes place, the Data Controller records the transaction data necessary to demonstrate the intermediation activity and settle accounts between the Data Controller and the insurer.

The legal bases are the data subject’s consent and a statutory provision, namely Section 393(1) of the Bit.

e. Data generated when contacting the Data Controller

Where the data subject contacts the Data Controller and provides information to customer service, for example in connection with a complaint, the Data Controller processes that data.

The purpose of processing is to investigate and record the data subject’s complaints and requests.

The legal bases are the data subject’s consent and statutory provisions, namely Sections 159 and 382 of the Bit.

f. Recorded telephone conversations

The Data Controller may record telephone conversations after informing the data subjects, as described in Section 4.4 below.

The data subject may request information about the recorded conversation and an accurate transcript.

The purposes of processing are consumer protection, recording the data subject’s legal declarations and quality assurance, including monitoring the Data Controller’s personnel to ensure that communications with the data subject comply with the law.

The legal bases are the data subject’s consent and statutory provisions, namely Sections 159 and 382 of the Bit.

Processing is mandatory when contact is made by telephone. If the data subject does not consent, they may handle the matter in person or in writing.

The Data Controller processes special categories of personal data only where this is indispensable for taking out a particular insurance product.

Such processing always takes place in accordance with the requirements of the insurer providing that insurance. If the data subject does not provide the special-category data required for the insurance, it may not be possible to take out the insurance, or it may be available only on less favourable terms.

As the special-category data is always requested by the insurer providing the intermediated insurance, the insurer’s provisions govern the processing.

IV. Specific processing operations

4.1. Determining and processing data relating to insurance

Description of processing: The data subject may contact the Data Controller or an intermediary acting on its behalf. The Data Controller primarily carries out its insurance intermediation activities through intermediaries acting on its behalf. These intermediaries always act in the Data Controller’s name and as its subcontractors.

When the data subject contacts the Data Controller, either directly or through an intermediary, the Data Controller or intermediary records the data relevant to the selected type of insurance product and the selected insurance.

This data may differ between insurers, as individual insurers set different conditions and offer different discounts for their insurance products.

If the data subject selects an insurance product, the Data Controller or intermediary records the data on the relevant insurer’s portal. Accordingly, the data necessary to take out the selected insurance is recorded in the insurer’s system rather than the Data Controller’s or intermediary’s own system.

The Data Controller or intermediary prints the documents generated by the insurer’s system that are required to take out the insurance, such as information documents, the contract and the data processing declaration. These documents are necessary to conclude the contract between the insurer and the data subject.

As the Data Controller or intermediary records the data in the insurer’s system, that data is processed only by the insurer.

Where insurance intermediation takes place, the Data Controller records the data necessary to identify the transaction. It does not process any other data beyond this.

The processing procedure includes obtaining the data subject’s consent at the beginning of the insurance intermediation process.

Categories of data processed: From among the data specified in Sections 3.2.a and c above: the Data Controller’s internal identifier, proposal number, sales representative’s name, data subject’s name, insurer’s name, product name, policy number, annual premium, date of submission to the insurer, payment frequency, commission and the fact that the insurance has been cancelled.

Purposes of processing:

• identifying the data subject and establishing and maintaining contact with them;

• identifying the data subject’s needs and assessing risks;

• establishing the data subject’s circumstances relevant to insurance and determining which insurance products may be offered to them;

• exercising rights and fulfilling obligations arising from the legal relationship;

• complying with obligations imposed by law.

Legal bases of processing: The data subject’s consent and statutory provisions under the Bit.

Retention period: If a contract is concluded between the data subject and the insurer, the Data Controller erases the data five years after the contract is cancelled.

If the Data Controller is not informed of the cancellation, it erases the data five years after the insurer’s obligation to pay commission has ended.

4.2. Processing under the Pmt. and customer due diligence

Description of processing: For contracts falling within the life insurance branch, the Data Controller identifies customers pursuant to Section 7(2) of the Pmt. It also provides data to third parties or authorities in the cases and manner specified by law.

This processing is mandatory and based on legislation.

Categories of data processed: The data specified in Section 3.2.b above.

Purpose of processing:

• complying with obligations imposed by law.

Legal basis of processing: The Pmt.

Retention period: Eight years after the contract ends or, if no contract is concluded, five years after the customer due diligence procedure.

4.3. Processing for advertising purposes

Description of processing: If the data subject consents, the Data Controller may use their provided contact details, including email address, postal address and telephone number, for advertising purposes.

The Data Controller may send advertisements directly to the data subject. The data subject may withdraw their consent at any time.

Categories of data processed: Name, email address and telephone number from among the data specified in Section 3.2.a above.

Purpose of processing:

• advertising, subject to the data subject’s separate consent.

Legal basis of processing: The data subject’s consent.

Retention period: The Data Controller erases the data if the data subject requests this or objects to the processing.

4.4. Recording telephone conversations

Description of processing: The Data Controller may record telephone conversations with the data subject.

Before recording begins, the data subject is informed about the recording. If they do not consent, they may handle the matter in person or by post.

For complaints, recording is mandatory under the Bit. The Data Controller retains recorded calls for five years pursuant to Sections 159(2) and 382(2) of the Bit.

For other calls, the purposes of recording are the enforcement of claims, consumer protection and quality assurance. In these cases, processing is based on the data subject’s consent, given by continuing the call after receiving information about the recording. The Data Controller retains these recordings for six months.

The data subject may request information about the recording, its circumstances and the use of recorded calls.

Upon request, the Data Controller provides access to listen to the recording and supplies the customer with a transcript or makes a copy of the conversation and provides it in a format the customer can use.

Categories of data processed: The recording referred to in Sections 3.2.e and f above, together with identification data relating to the conversation that enables the data subject, and where necessary the recording, to be identified.

Purposes of processing:

• identifying the data subject and establishing and maintaining contact with them;

• exercising rights and fulfilling obligations arising from the legal relationship;

• complying with obligations imposed by law;

• handling complaints.

Legal bases of processing: The data subject’s consent and, in certain cases, statutory provisions.

Retention period: For complaints, the Data Controller retains recorded calls for five years pursuant to Sections 159(2) and 382(2) of the Bit. For other calls, recordings are retained for six months.

V. Other information relating to processing

5.1. Disclosure of data

a. General rules on disclosure

The Data Controller discloses personal data to a third party only if the data subject has expressly consented, with knowledge of the categories of data to be disclosed and the recipient, or if disclosure is authorised by law.

b. Rules on insurance secrecy

Under Section 4(1), point 12 of the Bit., insurance secrets comprise all data available to the Data Controller, excluding classified information, relating to a customer’s personal circumstances, financial position, financial management or contracts with an insurer or reinsurer.

Insurance secrets may be disclosed to third parties only if:

a) the Data Controller’s customer or their representative provides a written release from the confidentiality obligation, specifying precisely the insurance secrets that may be disclosed;

b) the confidentiality obligation does not apply under the Bit.;

c) a certification body engaged by the Data Controller and its subcontractor obtain the information as part of the certification procedure.

c. Disclosure to an insurer

Where the data subject initiates the conclusion of an insurance contract, the Data Controller transfers identification data and data relating to the selected insurance to the insurer providing that insurance.

The transfer takes place by recording the data in the insurer’s system.

5.2. Processing by data processors

The Data Controller may engage data processors to carry out its activities.

Data processors do not make independent decisions and may act on behalf of the Data Controller only in accordance with their contracts with the Data Controller and the instructions received.

The Data Controller monitors the work of its processors. Processors may engage further processors only with the Data Controller’s consent.

The Data Controller engages intermediaries with which it has intermediary relationships, including subcontractors, and cooperating partners as data processors.

As these parties change regularly, the Data Controller provides information about them in a separate document available at its registered office or on the Website.

If the data subject contacts the Data Controller through one of its subcontractors, that subcontractor acts as a data processor. The subcontractor does not use the data.

For the processing operations described in Sections 4.1 and 4.2, concerning the categories of data specified in Sections 3.2.a–c, the Data Controller engages Bankmonitor Kft. (1037 Budapest, Montevideo utca 16/B; company registration number: 01-09-976265; tax number: 23745025-2-41) as a data processor, particularly for needs assessments and comparative analyses relating to certain insurance products.

For the processing operations described in Sections 4.1 and 4.2, concerning the categories of data specified in Sections 3.2.a and b, the Data Controller may engage Comnica Kft. (1119 Budapest, Fehérvári út 99; company registration number: 01-09-895207; tax number: 14242036-2-43) as a data processor, depending on the method of contact and identification.

5.3. Data security

The Data Controller safeguards data security by implementing the technical and organisational measures and procedural rules necessary to meet data security requirements.

The Data Controller maintains its records in accordance with applicable legislation and ensures that data is accessible only to employees and other persons acting on its behalf who need it to perform their duties or tasks.

All persons acting on behalf of the Data Controller may access only the data necessary to perform their duties. These persons must treat the data as confidential.

When determining and implementing data security measures, the Data Controller takes account of the state of the art.

Where several processing solutions are available, the Data Controller chooses the one that provides a higher level of protection for personal data, unless this would involve disproportionate difficulty.

Protection of electronic records

As part of its IT security responsibilities, the Data Controller takes particular care to ensure:

• protection against unauthorised access, including the protection of software and hardware and physical protection, such as access controls and network security;

• measures enabling data files to be restored, including regular backups and the separate, secure management of copies, such as mirroring and backups;

• protection of data files against viruses;

• physical protection of data files and the devices containing them, including protection against fire, water damage, lightning and other natural hazards, and the ability to restore data following damage caused by such events, through measures such as archiving and fire protection.

Protection of paper records

The Data Controller takes the necessary measures to protect paper records, particularly regarding physical security and fire protection.

Employees and other persons acting on behalf of the Data Controller must securely store any media they use or possess that contains personal data, regardless of how that data is recorded.

They must protect such media against unauthorised access, alteration, transmission, disclosure, erasure or destruction, and against accidental destruction or damage.

5.4. Retention periods

By establishing and following rules on erasure, the Data Controller ensures that personal data is not processed for longer than is necessary and lawful.

Data is erased in the following cases:

a. The personal data is no longer necessary for the purposes for which it was collected or otherwise processed.

If the purpose of processing no longer exists and retention is not required by law, the Data Controller erases the data.

b. The data subject withdraws consent.

If the data subject withdraws consent or requests erasure, the Data Controller always checks whether processing is required by law. If it is, the Data Controller refuses the erasure request.

If processing is not mandatory but the Data Controller has a legal basis for it and processing is necessary for the establishment, exercise or defence of legal claims, the Data Controller examines whether the data can be erased.

If processing is not required by law and the Data Controller has no legal basis other than consent, or continued processing is not justified despite the existence of a legal basis, the Data Controller erases the data at the data subject’s request.

If the Data Controller refuses the erasure request, it always informs the data subject and specifies the legal basis for refusal and the available remedies.

c. The data subject objects to processing.

If processing is based on the Data Controller’s legitimate interests, the data subject may object to it.

In such cases, the Data Controller erases the data unless it can demonstrate compelling legitimate grounds for processing that override the data subject’s interests, rights and freedoms, or grounds relating to the establishment, exercise or defence of legal claims.

If the data subject objects to processing for advertising purposes, the Data Controller erases the data relating to that processing.

d. It is established that processing is unlawful.

If processing is unlawful, the Data Controller always erases the data as soon as the unlawfulness becomes apparent.

e. Erasure is necessary to comply with a legal obligation or has been ordered by a court or the Hungarian National Authority for Data Protection and Freedom of Information.

If erasure is required by law or ordered by a court or the Authority in a final and binding decision, the Data Controller erases the data.

f. The retention period specified in advance by law or in the consent has expired.

If legislation prescribes a retention period, the Data Controller erases the data when that period expires.

5.5. Handling personal data breaches

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed.

The Data Controller reports a personal data breach to the Hungarian National Authority for Data Protection and Freedom of Information without delay, unless the breach is unlikely to result in a risk to the rights and freedoms of data subjects.

The Data Controller keeps a record of personal data breaches and the measures taken in connection with each breach.

If the breach is serious, meaning that it is likely to result in a high risk to the data subject’s rights and freedoms, the Data Controller informs the data subject about the breach without undue delay.

VI. Data subjects’ rights and how to exercise them

6.1. Data subjects’ rights

Information and access

The data subject has the right to receive information about the processing of their data.

The Data Controller provides information when collecting the data, and this Notice remains available to the data subject at any time.

During processing, the data subject may request comprehensive information about the processing of their data at any time. They may also request a copy of the data.

Rectification

The data subject may request that the Data Controller correct inaccurate data relating to them and complete any incomplete data.

Erasure and withdrawal of consent

The data subject may withdraw their consent to processing and request erasure of their data at any time.

The Data Controller refuses erasure only where processing is based on legislation or is necessary for the establishment, exercise or defence of legal claims.

Restriction of processing

The data subject has the right to request restriction of processing in the following cases:

a) the data subject contests the accuracy of the personal data, in which case processing is restricted for a period enabling the Data Controller to verify its accuracy;

b) processing is unlawful and the data subject opposes erasure and requests restriction of use instead;

c) the Data Controller no longer needs the personal data for processing purposes, but the data subject requires it for the establishment, exercise or defence of legal claims;

d) the data subject has objected to processing, in which case restriction applies pending verification of whether the Data Controller’s legitimate grounds override those of the data subject.

Where processing has been restricted, the personal data may, apart from storage, be processed only with the data subject’s consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.

Objection

Where processing is based on the legitimate interests of the Data Controller or a third party, the data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of their personal data.

In such cases, the Data Controller may no longer process the personal data unless it demonstrates compelling legitimate grounds that override the data subject’s interests, rights and freedoms, or grounds relating to the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing purposes, the data subject has the right to object at any time to the processing of their personal data for those purposes.

Data portability

The data subject has the right to receive personal data relating to them in a structured, commonly used and machine-readable format and to transmit that data to another controller, provided that processing is carried out by automated means.

Where technically feasible, the data subject may request that the personal data be transmitted directly to another controller.

6.2. Safeguarding data subjects’ rights and handling their requests

The Data Controller informs the data subject about processing when contact is established.

Upon request, the Data Controller provides this Notice to the data subject and also makes it available on the Company’s website.

This detailed Notice is available to the data subject, and the Data Controller draws their attention to its existence and availability.

The data subject may submit a request to exercise their rights using any of the contact details specified in Section 1.1.

The Data Controller examines the request without delay, decides whether to grant it and takes the necessary measures.

The Data Controller informs the data subject about the measures taken within one month. The response always includes the action taken by the Data Controller or the information requested by the data subject.

If the Data Controller refuses the request and does not take the measures necessary to fulfil it, the response includes the legal basis and reasons for refusal and the remedies available to the data subject.

The Data Controller does not make fulfilment of a request conditional on payment of a fee or reimbursement of costs.

If the circumstances or method of submission make it uncertain whether the request originates from the data subject, the Data Controller may ask the applicant to verify their entitlement or submit the request in a way that clearly establishes it.

The Data Controller communicates any rectification, erasure or restriction of processing to each recipient to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate effort.

Upon request, the Data Controller informs the data subject about those recipients.

6.3. Remedies

If their rights are infringed, the data subject may request that the Data Controller cease unlawful processing and review the processing or the refusal of their request.

The Data Controller investigates every such complaint and informs the data subject of the outcome.

Data subjects may submit complaints using the contact details specified in Section 1.1.

The data subject may also lodge a complaint directly with the Hungarian National Authority for Data Protection and Freedom of Information:

• Address: 1055 Budapest, Falk Miksa utca 9–11.

• Telephone: +36 (30) 683-5969

• Email: ugyfelszolgalat@naih.hu

• Website: www.naih.hu

If their rights are infringed, the data subject has the right to bring proceedings before a court.

Upon request, the Data Controller provides the data subject with detailed information about the court with subject-matter and territorial jurisdiction to hear the case and about the possibility of bringing proceedings.