Sellvio / Legal documents

Privacy notice

Privacy notice on the rights of data subjects in relation to the processing of their personal data

REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter: the Regulation or GDPR) requires the Controller to take appropriate measures to provide the data subject with all information relating to the processing of personal data in a concise, transparent, intelligible and easily accessible form, using clear and plain language, and to facilitate the exercise of the data subject's rights.

The obligation to inform the data subject in advance is also prescribed by Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Infotv.). With the information below we fulfil this statutory obligation.

Chapter I – Identity of the Controller

The issuer of this notice, and at the same time the Controller:

  • Company name: ErdSoft Hungary Kft.
  • Registered seat: 6720 Szeged, Kígyó utca 4., Hungary
  • Company registration number: 06-09-030198 (Company Registry Court of the Szeged Regional Court)
  • Tax number: 32725458-2-06 (EU VAT number: HU32725458)
  • Representative: Erdudac Dániel, managing director
  • E-mail address: [email protected]
  • Website: sellvio.com

(hereinafter: the Company)

Chapter II – Identity of the processors

Processor: a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller (Article 4(8) of the Regulation). Engaging a processor does not require the data subject's prior consent, but the data subject must be informed. Accordingly, we provide the following information:

1. The Company's IT service provider

For the maintenance and management of its website, the Company engages a processor that provides the IT services (hosting) and, in this context – for the duration of the contract with it – processes the personal data provided on the website; the operation it carries out is the storage of personal data on the server.

  • Company name: ErdSoft Hungary Kft.
  • Registered seat: 6720 Szeged, Kígyó utca 4., Hungary
  • Company registration number: 06-09-030198 (Company Registry Court of the Szeged Regional Court)
  • Tax number: 32725458-2-06 (EU VAT number: HU32725458)
  • Representative: Erdudac Dániel
  • E-mail address: [email protected]

Chapter III – Ensuring the lawfulness of processing

1. Processing based on the data subject's consent

(1) If the Company intends to carry out processing based on consent, the data subject's consent to the processing of their personal data must be requested with the content and information set out in the data request form specified in the data processing policy.

(2) Consent also includes the data subject ticking a relevant box when visiting the Company's website, making relevant technical settings when using information society services, and any other statement or conduct which clearly indicates in the given context the data subject's consent to the intended processing of their personal data. Silence, a pre-ticked box or inactivity does not constitute consent.

(3) Consent covers all processing activities carried out for the same purpose or purposes. Where processing serves several purposes at once, consent must be given for all processing purposes.

(4) If the data subject gives consent in the context of a written declaration that also concerns other matters (e.g. the conclusion of a sales or service contract), the request for consent must be presented in a manner clearly distinguishable from those other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of a declaration containing the data subject's consent that infringes the Regulation is not binding.

(5) The Company may not make the conclusion or performance of a contract conditional on consent to the processing of personal data that is not necessary for the performance of the contract.

(6) It must be as easy to withdraw consent as it is to give it.

(7) If personal data was recorded with the data subject's consent, the controller may – unless otherwise provided by law – process the recorded data for the purpose of fulfilling a legal obligation applicable to it, without further separate consent and even after the data subject has withdrawn their consent.

(8) The site does not collect data from minors (persons under the age of 16). Should this nevertheless occur, such data is deleted without delay.

2. Processing based on compliance with a legal obligation

(1) In the case of processing based on a legal obligation, the scope of data that may be processed, the purpose of processing, the storage period and the recipients are governed by the provisions of the underlying legislation.

(2) Processing on the legal basis of compliance with a legal obligation is independent of the data subject's consent, since the processing is determined by law. Before the processing begins, the data subject must be informed that the processing is mandatory, and must be informed clearly and in detail of all facts relating to the processing of their data, in particular the purpose and legal basis of the processing, the person entitled to carry out the processing, the duration of the processing, and who may access the data. The information must also cover the data subject's rights in relation to the processing and their remedies.

3. Facilitating the exercise of the data subject's rights

In all its processing activities, the Company is obliged to ensure that the data subject can exercise their rights.

Chapter IV – Processing of visitor data on the Company's website; information on the use of cookies

1. Visitors to the website must be informed on the website about the use of cookies and – with the exception of technically indispensable session cookies – their consent must be requested.

2. General information about cookies

2.1. A cookie is a piece of data that the visited website sends to the visitor's browser (in variable name–value form) to be stored, so that the same website can later load its content. A cookie may have a validity period: it may be valid until the browser is closed, or even indefinitely. The browser sends this data to the server with subsequent HTTP(S) requests as well.

2.2. The purpose of cookies is to allow the website to mark the user (e.g. that they have logged in) and to handle them accordingly thereafter. The risk is that the user is not always aware of this, and that it may enable the website operator or another service provider (e.g. Facebook, Google Analytics) to track the user and build a profile of them; in that case the content of the cookie may be regarded as personal data.

2.3. Types of cookies:

  • Technically indispensable session cookies: without these the site would not function; they are necessary for identifying the user (e.g. handling login, adding to cart). They typically involve storing a session identifier, with the remaining data stored on the server.
  • Functionality cookies: they remember the user's choices, for example the form in which they wish to view the site.
  • Performance cookies: they collect information about the user's behaviour within the website, the time spent there and their clicks. They are typically third-party applications (e.g. Google Analytics, Google Ads) and are capable of profiling the visitor.

You can find information about Google Analytics cookies here: developers.google.com, and about Google Ads cookies here: support.google.com.

2.4. Accepting the use of cookies is not mandatory. Browser settings can be reset so that the system rejects all cookies or indicates when a cookie is received. Most browsers accept cookies automatically by default, but this can be changed. You can find information about the cookie settings of the most popular browsers on the following pages:

Please note that certain website functions or services do not work properly without cookies.

3. Information on the cookies used on the Company's website and the data generated during a visit

3.1. Scope of data processed during a visit: while the website is being used, the Company's website may record and process the following data about the visitor and the device they use for browsing: the visitor's IP address, the browser type, the characteristics of the operating system of the device used for browsing (language setting), the time of the visit, the (sub)page, function or service visited, and clicks. We retain this data for a maximum of 90 days and use it primarily to investigate security incidents.

3.2.1. Technically indispensable session cookies. The purpose of the processing is to ensure the proper operation of the website: these cookies are necessary for visitors to browse the website and use its functions smoothly, including remembering the actions performed by the visitor on the given pages or identifying a logged-in user during the visit. The processing period of these cookies covers only the visitor's current visit; at the end of the session, or when the browser is closed, these cookies are deleted automatically. The legal basis for the processing is Section 13/A(3) of Act CVIII of 2001 on certain issues of electronic commerce services and information society services (Ekertv.).

3.2.2. Functionality cookies. They remember the user's choices (e.g. the form in which they wish to view the site, light/dark mode). The legal basis for the processing is the visitor's consent; its purpose is to increase the efficiency of the service and the user experience, and to make using the website more convenient.

3.2.3. Performance cookies. They collect information about the user's behaviour within the website, the time spent and clicks; they are typically third-party applications (e.g. Google Analytics, Google Ads). The legal basis for the processing is the data subject's consent; its purpose is to analyse the website and send advertising offers.

Chapter V – Information on the rights of the data subject

The data subject's rights in brief

  • transparent information, communication and facilitation of the exercise of the data subject's rights;
  • the right to prior information where personal data is collected from the data subject;
  • information where the data has not been obtained from the data subject;
  • right of access;
  • right to rectification;
  • right to erasure („right to be forgotten”);
  • right to restriction of processing;
  • notification obligation regarding rectification, erasure and restriction;
  • right to data portability;
  • right to object;
  • rights relating to automated decision-making and profiling;
  • restrictions;
  • communication of a personal data breach;
  • right to lodge a complaint with a supervisory authority;
  • right to an effective judicial remedy against a supervisory authority, a controller or a processor.

1. Transparent information, communication and facilitation of the exercise of the data subject's rights

The controller provides the data subject with all information relating to the processing of personal data in a concise, transparent, intelligible and easily accessible form, using clear and plain language, and facilitates the exercise of the data subject's rights. The controller informs the data subject of the measures taken on a request without undue delay and in any event within one month of receipt of the request; this period may be extended by a further two months under the conditions set out in the Regulation. If the controller does not take action, it informs the data subject of the reasons within one month at the latest, and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy. Information and action are provided free of charge; in the cases specified in the Regulation a fee may be charged. (Article 12 of the Regulation)

2. Right to prior information – where personal data is collected from the data subject

The data subject has the right to be informed, before the processing begins, of the facts and information relating to the processing: the identity and contact details of the controller, the contact details of the data protection officer (if any), the purpose and legal basis of the processing, the legitimate interests where processing is based on legitimate interest, the recipients of the personal data, and, where applicable, the fact of a transfer to a third country. In the interest of fair and transparent processing, the data subject must also be informed of the storage period, their rights as a data subject, the right to withdraw consent, the right to lodge a complaint with a supervisory authority, the basis for providing the data and the consequences of failing to provide it, and the existence and logic of automated decision-making. (Article 13 of the Regulation)

3. Information where the data has not been obtained from the data subject

If the controller has not obtained the personal data from the data subject, it informs the data subject of the facts set out in point 2, together with the categories of personal data concerned and the source of the data, within one month of obtaining the data at the latest – where the data is used for contact purposes, at the latest at the time of the first contact, and where the data is disclosed to another recipient, at the latest at the time of the first disclosure. (Article 14 of the Regulation)

4. The data subject's right of access

The data subject has the right to obtain confirmation as to whether their personal data is being processed and, if so, to obtain access to the personal data and the related information. In the case of a transfer to a third country, the data subject may be informed of the safeguards under Article 46 of the Regulation. The controller provides the data subject with a copy of the personal data undergoing processing; for further copies a reasonable fee based on administrative costs may be charged. (Article 15 of the Regulation)

5. The right to rectification

The data subject has the right to obtain from the controller, without undue delay, the rectification of inaccurate personal data concerning them and, taking into account the purposes of the processing, to have incomplete data completed. (Article 16 of the Regulation)

6. The right to erasure („the right to be forgotten”)

At the data subject's request, the controller erases the personal data concerning them without undue delay where: the data is no longer necessary for the purposes for which it was collected; the data subject withdraws consent and there is no other legal basis; the data subject objects and there are no overriding legitimate grounds; the data has been unlawfully processed; the data has to be erased for compliance with a legal obligation; or the data was collected in relation to information society services offered to children. The right to erasure cannot be exercised where processing is necessary: for exercising the right of freedom of expression and information; for compliance with a legal obligation or the performance of a task carried out in the public interest; for reasons of public interest in the area of public health; for archiving purposes in the public interest, scientific or historical research or statistical purposes; or for the establishment, exercise or defence of legal claims. (Article 17 of the Regulation)

7. The right to restriction of processing

At the data subject's request, the controller restricts processing where: the data subject contests the accuracy of the data (for a period enabling the accuracy to be verified); the processing is unlawful but the data subject requests the restriction of use instead of erasure; the controller no longer needs the data but the data subject requires it for legal claims; or the data subject has objected to the processing (pending verification of whether the controller's legitimate grounds override those of the data subject). Where processing is restricted, the data may, apart from storage, only be processed with the data subject's consent, in connection with legal claims, for the protection of the rights of another person, or for reasons of important public interest. The data subject must be informed before the restriction is lifted. (Article 18 of the Regulation)

8. Notification obligation

The controller communicates any rectification, erasure or restriction of processing to each recipient to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate effort. The controller informs the data subject about those recipients if the data subject requests it. (Article 19 of the Regulation)

9. The right to data portability

The data subject has the right to receive the personal data concerning them which they have provided to the controller in a structured, commonly used, machine-readable format, and to transmit that data to another controller, where the processing is based on consent or on a contract and is carried out by automated means. The data subject may also request that the data be transmitted directly between controllers. This right must not adversely affect the right to erasure or the rights and freedoms of others. (Article 20 of the Regulation)

10. The right to object

The data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of their personal data based on the public interest, the performance of a public task or a legitimate interest, including profiling. In such a case the controller may no longer process the data unless it demonstrates compelling legitimate grounds for the processing which override the interests and rights of the data subject. Where personal data is processed for direct marketing purposes, the data subject may object at any time to processing for such purposes, including profiling; where the data subject objects, the data may no longer be processed for those purposes. (Article 21 of the Regulation)

11. Automated individual decision-making, including profiling

The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract, is authorized by law, or is based on the data subject's explicit consent. Even in such cases the controller is obliged to implement suitable measures to safeguard the data subject's rights, including at least the right to obtain human intervention, to express their point of view and to contest the decision. (Article 22 of the Regulation)

12. Restrictions

Union or Member State law applicable to the controller or processor may restrict by way of a legislative measure the scope of the rights and obligations (Articles 12 to 22, Article 34 and Article 5 of the Regulation), provided that the restriction respects the essence of fundamental rights and freedoms. (Article 23 of the Regulation)

13. Communication of a personal data breach to the data subject

Where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller communicates the breach to the data subject without undue delay: it describes the nature of the breach in clear and plain language, the name and contact details of the contact point, the likely consequences of the breach, and the measures taken or proposed to address it. Communication is not required if the controller has implemented appropriate protection measures (e.g. encryption), if it has taken subsequent measures ensuring that the high risk is no longer likely to materialize, or if communication would involve disproportionate effort – in the latter case the data subject must be informed by means of a public communication. (Article 34 of the Regulation)

14. The right to lodge a complaint with a supervisory authority

The data subject has the right to lodge a complaint with a supervisory authority – in particular in the Member State of their habitual residence, place of work or place of the alleged infringement – if they consider that the processing of personal data relating to them infringes the Regulation. (Article 77 of the Regulation) In Hungary, the competent supervisory authority is:

  • Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH – Hungarian National Authority for Data Protection and Freedom of Information)
  • Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary
  • Postal address: 1363 Budapest, Pf. 9., Hungary
  • Phone: +36 (1) 391-1400
  • E-mail: [email protected]
  • Website: naih.hu

15. The right to an effective judicial remedy against a supervisory authority

Every natural and legal person has the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them, and also where the supervisory authority does not handle a complaint or does not inform the data subject within three months of the progress of the complaint. Proceedings must be brought before the courts of the Member State where the supervisory authority is established. (Article 78 of the Regulation)

16. The right to an effective judicial remedy against a controller or processor

Every data subject has the right to an effective judicial remedy where they consider that their rights under the Regulation have been infringed as a result of the improper processing of their personal data. Proceedings may be brought before the courts of the Member State where the controller or processor has an establishment, or of the Member State where the data subject has their habitual residence. (Article 79 of the Regulation)

Dated: Szeged, 1 September 2026

ErdSoft Hungary Kft.
Erdudac Dániel, managing director