Introduction
The purpose of the EN-CO Software Zrt. (hereafter referred to as the Data Controller) Data Protection Notice is to provide clear and detailed information to data subjects about all facts related to the processing of their personal data, their rights regarding data processing, and available remedies before the commencement of data processing.
EN-CO Software Zrt. is committed to protecting the personal data of its clients and partners and places great importance on respecting its clients’ right to informational self-determination. EN-CO Software Zrt. treats personal data confidentially and takes all reasonable security, technical, and organizational measures proportional to the risks involved, considering available technology and the cost of implementation to ensure data security.
EN-CO Software Zrt. recognizes the content of this legal notice as binding. It commits to ensuring that all data processing related to its activities complies with the expectations set forth in this policy, relevant national legislation, and the legal acts of the European Union.
EN-CO Software Zrt. reserves the right to amend this notice. Of course, it will inform the data subjects in a timely manner about any potential changes. Below, EN-CO Software Zrt. outlines its data processing practices.
Introduction of the Data Controller
Name of the Data Controller: EN-CO Software Zrt.
Company registration number of the Data Controller: 01-10-140987
Headquarters of the Data Controller: 1118 Budapest, Schweidel u. 5.
Electronic address of the Data Controller: info@encosoft.hu
Representative of the Data Controller: Márk Kaszó, Board Member
Data Protection Officer: Kinga Dékány
Fogalmak
| Data Processing | Any operation or set of operations performed on personal data or data sets, whether automated or non-automated, including collection, recording, organization, structuring, storage, transformation or alteration, retrieval, consultation, use, communication, transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction. |
| Data Controller | A natural or legal person, a public authority, agency, or any other body that determines the purposes and means of processing personal data, either independently or in conjunction with others. If the purposes and means of processing are determined by EU or Member State law, the Data Controller or specific criteria for the designation of the Data Controller may also be defined by EU or Member State law. |
| Data Processor | A natural or legal person, a public authority, agency, or any other body that processes personal data on behalf of the Data Controller. |
| Data Subject | The person who provides personal data on the EN-CO website. |
| Third Part | A natural or legal person, a public authority, agency, or any other body that is not identical to the Data Subject, the Data Controller, the data processor, or those individuals who have been authorized to process personal data under the direct authority of the Data Controller or the data processor. |
| Personal Data | Any information relating to an identified or identifiable natural person, i.e., the Data Subject; an identifiable natural person is one who can be identified, directly or indirectly, especially by reference to an identifier such as a name, number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. |
| Data privacy incident | A security breach is an event that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data that is transmitted, stored, or otherwise processed. |
Main Data Protection Regulations and Abbreviations
The data processing activities of EN-CO Software Ltd. are based on voluntary consent or statutory authorization. Its data processing principles comply with applicable data protection regulations, particularly:
- Act CXII of 2011 – on the Right of Informational Self-Determination and Freedom of Information (Infotv.);
- Regulation (EU) 2016/679 of the European Parliament and of the Council (April 27, 2016) – on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR);
- Act V of 2013 – on the Civil Code (Ptk.);
- Act C of 2000 – on Accounting (Accounting Act);
- Act LIII of 2017 – on the Prevention and Combating of Money Laundering and Terrorist Financing (AML Act);
- Act CCXXXVII of 2013 – on Credit Institutions and Financial Enterprises (Credit Institutions Act).
Purposes of Data Processing and Scope of Personal Data
EN-CO Software Ltd. processes the data of Data Subjects to respond to inquiries. Only employees responsible for customer relationship management or those providing professional responses to inquiries have access to this data.
Processing of Corporate Contact Information
If the Data Subject is in contact with our company as an employee or representative of a current or potential partner, we process their personal data (name, position, signature, company phone number, email address, postal address) under Article 6(1)(f) of the GDPR. This processing is necessary for maintaining communication between the two organizations during business operations. The purpose of data processing is to ensure contact between the two entities. Data is processed only for the duration of the contact person’s role. However, if these details are included in contracts or other mandatory records, they are retained for the legally required retention period (8 years for contracts and other accounting records).
Processing of Personal Data for Individual Clients
For individual entrepreneurs or private partners (such as subcontractors, agents, clients, etc.), we process personal data, including the name, subject of the contract, and value, as well as bank account details when payments are made. This processing is based on legal obligations to fulfill the contract. Address (registered office) and tax number are processed to comply with tax and accounting regulations, while contact information (phone number, email address) is necessary for communication with partners. The purpose of data processing is to fulfill the contract with the individual, ensure proper invoicing, and meet tax obligations, as well as to facilitate communication.
Data related to contracts and invoices, as accounting records, are retained for the legally mandated retention period (8 years), while contact information is retained as long as the business relationship is maintained.
Processing of Personal Data of Job Applicants
If a Data Subject applies for a position advertised by us or voluntarily submits a resume or job application, we process the personal data provided in the resume and application, as well as a copy of the resume and, if provided, copies of certificates and qualification documents. The purpose of processing these resume data and related documents is to screen applicants and make hiring decisions. The contact information provided is processed to maintain communication with the applicant. The legal basis for processing is the Data Subject’s consent (Article 6(1)(a) of the GDPR).
Notice on Withdrawal of Consent
Please note that consent may be withdrawn at any time. Consent can be withdrawn by sending an email to dpo@encosoft.hu. Withdrawal of consent does not affect the legality of data processing prior to the withdrawal. If consent is withdrawn before the evaluation of the application, we will no longer be able to consider the application. In the case of a successful application, we process the resume and related documents until the decision on establishing an employment relationship is communicated to the Data Subject. Upon onboarding, we provide information on how personal data is handled during employment. In the case of an unsuccessful application, unless a specific written request for withdrawal or deletion is made, the data is retained for a maximum of 5 years and then deleted without further notice.
During the recruitment process, a professional test and personal interview may be conducted, during which the Data Subject’s name, test results, and impressions from the interview are processed as personal data. The purpose of data processing is to assess job suitability and to evaluate any related security risks based on the test and personal impressions. The legal basis for this processing is the Data Controller’s legitimate interest in using appropriate selection methods (Article 6(1)(f) of the GDPR). Data processing continues until the decision on establishing an employment relationship is communicated.
Data Processing on Our Website and Social Media Platforms
To handle inquiries, we require the following information:
- Name
- Email address
- If provided by the Data Subject, a phone number to enable contact by phone.
Cookies
To provide a personalized service, the web application places a small data packet, called a cookie, on the user’s computer, which is read during subsequent visits. If the browser returns a previously stored cookie, the cookie provider can link the user’s current visit with previous visits but only in relation to its own content. Cookies collect information about visitors and their devices; they remember individual settings, so there is no need to re-enter them; they facilitate website use and ensure a high-quality user experience. The detailed cookie policy is available at the following link: www.encosoftware.hu/cookiepolicy.
reCAPTCHA
Before sending messages, we perform a reCAPTCHA check using Google’s reCAPTCHA service. This function operates through Google’s servers. Google processes the reCAPTCHA function, so we do not handle personal data and do not receive any information about users or their behavior. The reCAPTCHA check is necessary to prevent bots from filling out the form and sending bulk spam messages. During this process, we do not access any personal data, as the verification is fully automated by Google’s servers. The reCAPTCHA check does not add any content to the message itself.
You can find more information on the applicable reCAPTCHA data processing policies here:
https://www.google.com/recaptcha/about/
Data Provided Through the Contact Form
The data and information provided in messages sent via the contact form are used solely to respond to the sender’s inquiries. These details are not stored in a database. Messages sent in this way do not entitle us to send newsletters, offers, or notifications about downloads to the provided contact email address; therefore, no such messages will be sent to that address.
Technical Data
EN-CO Software Ltd. selects and operates the IT tools used for personal data processing during service provision to ensure that the processed data:
- is accessible to authorized individuals (availability),
- has its authenticity and authentication assured (data processing authenticity),
- has its integrity maintained (data integrity),
- is protected against unauthorized access (data confidentiality).
Data Security Measures
EN-CO Software Ltd. protects data through appropriate measures against unauthorized access, modification, transmission, disclosure, deletion, or destruction, as well as accidental destruction.
EN-CO Software Ltd. employs technical, organizational, and structural measures to ensure the security of data processing, providing a level of protection corresponding to the risks involved in data processing.
In the course of data processing, EN-CO Software Ltd. ensures confidentiality by protecting information so that only authorized individuals have access; integrity by safeguarding the accuracy and completeness of information and the methods of processing; and availability by ensuring that authorized users have access to the necessary information and resources when needed.
EN-CO Software Ltd. retains all incoming emails, including related personal data, for a maximum of 5 years, unless a specific written request for deletion is submitted, after which they are deleted without further notice.
Rights of Data Subjects and Enforcement Options
Data Subjects may request information regarding the processing of their personal data, and they may request the correction, deletion (except for mandatory data processing), or withdrawal of their data. They also have the right to data portability and the right to object, which can be exercised in the manner indicated at the time of data collection or via the contact information provided above.
Right to Information
EN-CO Software Ltd. takes appropriate measures to ensure that Data Subjects receive all information regarding the processing of their personal data, as required by Articles 13 and 14 of the GDPR, and all notices stipulated in Articles 15–22 and 34, in a concise, transparent, intelligible, and easily accessible format, clearly and comprehensibly communicated.
Right of Access
Data Subjects have the right to receive confirmation from the Data Controller regarding whether their personal data is being processed. If such data processing is ongoing, they are entitled to access their personal data and obtain the following information: the purposes of data processing; categories of personal data; recipients or categories of recipients with whom the personal data has been or will be shared, including specifically recipients in third countries or international organizations; the planned storage period for the personal data; the right to correction, deletion, restriction of processing, or objection; the right to submit a complaint to a supervisory authority; information on data sources; and information on automated decision-making, including profiling, along with comprehensible details on the logic applied and the significance and expected consequences of such data processing for the Data Subject. The Data Controller will provide this information within one month from the submission of the request.
Right to Rectification
The Data Subject has the right to request that EN-CO Software Ltd. correct any inaccurate personal data concerning them and complete any incomplete data.
Right to Erasure
The Data Subject has the right to request that EN-CO Software Ltd. delete their personal data without undue delay if any of the following conditions are met:
- The personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
- The Data Subject withdraws their consent on which the processing is based, and there is no other legal basis for the processing;
- The Data Subject objects to the processing, and there are no overriding legitimate grounds for the processing;
- The personal data has been processed unlawfully;
- The personal data must be deleted to comply with a legal obligation under Union or Member State law applicable to the Data Controller;
- The personal data has been collected in relation to the offer of information society services.
Instead of deletion, the Data Controller will restrict the personal data upon the Data Subject’s request or if it is presumed that deletion would infringe on the Data Subject’s legitimate interests. Such restricted personal data may only be processed as long as the purpose of data processing, which prevents deletion, remains in effect.
Right to Restrict Processing
Upon request, EN-CO Software Ltd. will restrict data processing if any of the following conditions are met:
- The Data Subject contests the accuracy of the personal data, in which case the restriction applies for a period that allows the accuracy of the personal data to be verified;
- The processing is unlawful, and the Data Subject opposes deletion and requests restriction of data usage instead;
- The Data Controller no longer needs the personal data for processing purposes, but the Data
- Subject requires it for the establishment, exercise, or defense of legal claims; or
- The Data Subject has objected to the processing, pending verification of whether the Data Controller’s legitimate grounds override those of the Data Subject.
If data processing is restricted, personal data may only be processed (except for storage) with the Data Subject’s consent, for the establishment, exercise, or defense of legal claims, for protecting the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State.
Right to Data Portability
The Data Subject has the right to receive the personal data concerning them, which they have provided to the Data Controller, in a structured, commonly used, and machine-readable format and to transmit this data to another Data Controller.
Right to Object
The Data Subject has the right to object at any time, on grounds relating to their particular situation, to the processing of their personal data carried out for tasks necessary in the public interest or in the exercise of official authority vested in the Data Controller, or for the purposes of the legitimate interests pursued by the Data Controller or a third party, including profiling based on these provisions. In case of an objection, the Data Controller may no longer process the personal data unless they demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the Data Subject or that relate to the establishment, exercise, or defense of legal claims.
Automated Individual Decision-Making, Including Profiling
The Data Controller declares that no profiling is carried out concerning the Data Subject, nor is any automated decision-making based on the data processed.
Right of Withdrawal
The Data Subject has the right to withdraw their consent at any time; however, this does not affect the lawfulness of the processing based on consent before its withdrawal.
Right to Seek Judicial Remedy
If the Data Subject’s rights are violated, they have the right to bring action against the Data Controller in court. The case falls under the jurisdiction of the tribunal. At the Data Subject’s discretion, the lawsuit may also be initiated at the tribunal where the Data Subject resides or is located.
Enforcement of Rights
The Data Subject may exercise their rights based on the applicable laws and the current Civil Code.
For any written inquiries regarding data processing, please contact us at:
Name: EN-CO Software Ltd.
Mailing Address: 1113 Budapest, Bocskai út 77-79. Building B, 2nd Floor
Email: dpo@encosoft.hu
Additionally, any complaints related to personal data may be submitted directly to the National Authority for Data Protection and Freedom of Information:
Name: National Authority for Data Protection and Freedom of Information
Address: 1055 Budapest, Falk Miksa utca 9-11
Mailing Address: 1363 Budapest, P.O. Box: 9
Fax: +36-1-391-1410
Email: ugyfelszolgalat@naih.hu
Website: http://www.naih.hu
Additional Provisions
We inform our partners that the Data Controller may be approached by the court, prosecutor, investigative authority, administrative authority, the National Authority for Data Protection and Freedom of Information, the Hungarian National Bank, or other entities empowered by law to request information, provide data, disclose information, or make documents available.
EN-CO Software Ltd. will disclose personal data to authorities only to the extent and in the manner necessary to fulfill the purpose of the request, provided the authority specifies the exact purpose and scope of the requested data or as required by law.
The Data Controller reserves the right to modify this privacy notice unilaterally at any time. The effective date of this privacy notice is the date of issuance.
Issued: 2022.03.21
Document Version: 20220321.1
