Privacy Policy
Protecting your personal data is important to us
We inform you about the processing of your personal data, your rights and our data protection practices.
Privacy Policy
Effective from: 15 February 2026
This notice (the "Notice") applies to the processing of information relating to identified or identifiable natural persons ("data subjects") (personal data) by Kiszely és Kiszely 2015 Tűzvédelmi és Szolgáltató Bt. (the "Data Controller"). This Notice relates solely to data processing in connection with the Data Controller's website (kiszelysafety.hu).
Data Controller: Kiszely és Kiszely 2015 Tűzvédelmi és Szolgáltató Bt.
Registered office: HU-6600 Szentes, Vécsei K. u. 26.
Registration number: Cg. 06-06-016713
Tax number: 25402272-1-06
Contact: kiszelyattila10@gmail.com
Mailing address: HU-6600 Szentes, Vécsei K. u. 26.
Representative: Attila Kiszely, managing director (kiszelyattila10@gmail.com)
The Data Controller has decided not to designate a data protection officer, as the regular and systematic monitoring of data subjects on a large scale, or the large-scale processing of special categories of personal data or criminal offence data, does not form part of its core activities. The Data Controller is not a public authority and does not perform a public task.
On matters not covered by this Notice, Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act CXII of 2011 on the Right to Informational Self-Determination and on Freedom of Information (Infotv.) apply.
I. Amendment of the Notice
The Data Controller reserves the right to amend this Notice unilaterally with effect from the date of the amendment. The Data Controller shall inform data subjects of any amendments without delay.
II. Acknowledgment and acceptance of the Notice
By providing personal data, the data subject confirms that they have read and expressly accepted the version of the Notice in force at the time of providing the data. Specific data protection terms may apply to certain services; the Data Controller shall inform the data subject of these before the service is used.
III. Data processing carried out by the Data Controller
III.1 Data processing related to cookie identifiers
Purpose of processing: ensuring the proper operation of the website and improving the user experience.
Categories of data subjects: all visitors to the website.
Legal basis: the data subject's consent to the processing of their personal data for one or more specific purposes (GDPR Article 6(1)(a)).
Categories of personal data processed: data processed by cookies: websites visited by the user from the device storing the cookie; advertisements clicked; browser type; IP address; and information provided to the website.
Categories of recipients: the Data Controller; where web analytics services are used, external service providers (e.g. Google).
Retention period: for as long as necessary for the use of the cookie, depending on the type. For processing under external web analytics services, the relevant provider's privacy notice applies.
Possible consequences of not providing data: impaired operation of the website and a significantly worse user experience.
III.2 Electronic sales
Purpose of processing: data processing necessary for the sale of products sold electronically by the Data Controller, in particular via the kiszelysafety.hu website.
Categories of data subjects: customers and their representatives.
Legal basis: processing is necessary for the performance of a contract (GDPR Article 6(1)(b)).
Categories of personal data processed: personal data provided to the Data Controller in connection with sales: name, email address (for determining the place of performance of the product purchased).
Source of data: data provided by the data subject.
Categories of recipients: the Data Controller, processors (accountant).
Retention period: until performance of the contract; for warranty and guarantee purposes, until the end of the warranty or guarantee period.
Possible consequences of not providing data: possible failure to perform the Data Controller's contractual obligations; any loss or disadvantage arising from failure to provide data is borne by the data subject.
III.3 Contact management
Purpose of processing: handling contact details of customers (data subjects) in connection with product sales.
Categories of data subjects: customers and their representatives.
Legal basis: processing is necessary for the performance of a contract (GDPR Article 6(1)(b)).
Categories of personal data processed: contact data provided to the Data Controller in connection with sales: phone number, email address.
Source of data: data provided by the data subject.
Categories of recipients: the Data Controller.
Retention period: until performance of the contract.
Possible consequences of not providing data: without provision of data, contact with the customer is not possible; the Data Controller cannot meet its cooperation and information obligations under the Civil Code and applicable laws; any loss or disadvantage arising from failure to provide data is borne by the data subject.
III.4 Marketing, customer records, market research
Purpose of processing: building a customer database, sending email newsletters including commercial advertising to data subjects, preparing personalised offers, forwarding the Data Controller's and partners' offers, market research.
Categories of data subjects: customers in a business relationship with the Data Controller.
Legal basis: the data subject's consent (GDPR Article 6(1)(a)).
Categories of personal data processed: identification number, name, address, email, phone number.
Source of data: the data subjects.
Categories of recipients: the Data Controller, partners in a marketing business relationship with the Data Controller.
Retention period: until withdrawal of the data subject's consent.
Possible consequences of not providing data: the data subject will not receive offers from the Data Controller and its partners.
III.5 Invoicing, accounting obligations, retention of records
Purpose of processing: issuing invoices, documenting payment, fulfilling accounting obligations, retaining accounting records that directly or indirectly support the accounts.
Categories of data subjects: natural persons in a legal relationship with the Data Controller; natural person representatives of legal persons.
Legal basis: processing is necessary for compliance with a legal obligation on the Data Controller (GDPR Article 6(1)(c); Section 169(2) of the Accounting Act).
Categories of personal data processed: for invoices, data specified in Section 169 of the VAT Act; for other accounting records, data specified in the applicable legislation.
Source of data: the data subjects.
Categories of recipients: the Data Controller, processors (accountant).
Retention period: eight years in accordance with Section 169(2) of the Accounting Act.
Possible consequences of not providing data: the data subject cannot use the Data Controller's services.
III.6 Complaint handling
Purpose of processing: handling complaints.
Categories of data subjects: data subjects who lodge a complaint with the Data Controller.
Legal basis: processing is necessary for compliance with a legal obligation on the Data Controller (GDPR Article 6(1)(c)), including Section 17/A of the Consumer Protection Act.
Categories of personal data processed: personal data provided by the data subject when lodging the complaint; in particular data specified in Section 17/A of the Consumer Protection Act, including the complainant's name, address and contact details.
Source of data: the data subjects; where processing of personal data obtained by the Data Controller in connection with other processing (and not from the data subject) is necessary to deal with the complaint, the persons who provided such data.
Categories of recipients: the Data Controller, processors (e.g. legal representative), consumer authority, courts.
Retention period: for consumer complaints, five years for minutes and copies of written responses (Section 17/A(7) of the Consumer Protection Act); otherwise until the response to the complaint is communicated.
Possible consequences of not providing data: the Data Controller cannot deal with the complaint; the legal consequences are borne solely by the data subject.
III.7 Enforcement of legal claims
Purpose of processing: enforcement of civil and criminal law claims relating to data subjects in a legal relationship with the Data Controller.
Categories of data subjects: persons in a legal relationship with the Data Controller.
Legal basis: processing is necessary for the legitimate interests of the Data Controller (GDPR Article 6(1)(f)).
Categories of personal data processed: data of the data subjects recorded in this Notice that are necessary for enforcement, and all documents and copies relating to the data and transactions.
Source of data: the data subjects, and public and authentic registers and databases required by the Data Controller for enforcement.
Categories of recipients: the Data Controller, processors (legal representatives), investigating authorities, prosecution, courts, consumer authority, other authorities.
Retention period: the limitation or prescription period applicable under the contract or law (general limitation period: 5 years).
Possible consequences of not providing data: the Data Controller may refuse to conclude a contract with the data subject.
III.8 Recruitment
Purpose of processing: securing human resources, advertising vacancies, recruitment, running the selection process.
Categories of data subjects: applicants to the Data Controller.
Legal basis: processing is justified by the Data Controller's legitimate interest in having information relevant to establishing the employment relationship that is not obtainable from other sources.
Categories of personal data processed: personal data provided by the applicant during the application process, in particular data in the applicant's CV.
Source of data: the data subjects.
Categories of recipients: the Data Controller, processors (employment agencies).
Retention period: until the application is rejected or an employment contract is concluded.
Possible consequences of not providing data: the Data Controller cannot accept the application and will delete all personal data from the applicant.
III.9 Data processing in connection with employment
Purpose of processing: exercise of rights and performance of obligations arising from the employment relationship.
Categories of data subjects: employees.
Legal basis: performance of contract (GDPR Article 6(1)(b)), legal obligation on the Data Controller (GDPR Article 6(1)(c)).
Categories of personal data processed: name, maiden name, address, data on ID card, address card and health insurance card, tax ID, bank account, email, phone; data relating to previous employment and the employment contract; copies of documents made when concluding the contract; where family tax allowance is claimed, data of children and spouse.
Source of data: the data subjects, documents provided by them, public and authentic registers.
Categories of recipients: National Tax and Customs Administration and other bodies exercising public authority, processors (accountant).
Retention period: from establishment of the employment relationship until 50 years after its termination (for pension rules).
Possible consequences of not providing data: the Data Controller will terminate the relationship with the employee.
Other data processing
The Data Controller may process data other than the types listed above. Where it processes types of data not set out in this Notice, or processes the types set out here for a different purpose or on a different legal basis, it shall inform data subjects separately before processing begins. The separate notice shall be interpreted in accordance with this Notice.
The processing described in sections III.8–III.9 applies to all legal relationships for the performance of work, including in particular agency relationships.
For the processing of personal data of natural person representatives and members of legal persons, this Notice shall be applied as appropriate depending on the purpose; in such cases the source of data may also be an authentic register containing the representatives' or members' data.
Where this Notice does not govern the processing (e.g. contact by email, requests for quotes), the Data Controller shall process the data provided only for the purpose specified by the data subject or assumed from the circumstances, with the data subject's consent, until that purpose is fulfilled.
IV. Processors and transfer of data to third countries
In connection with its processing, the Data Controller may use processors for various processing operations. Processors shall process personal data made available to them only in accordance with the Data Controller's instructions and in line with this Notice. A processor may not take substantive decisions on processing or use the data for its own purposes.
In the course of its processing, the Data Controller in particular uses the following processors:
Hosting
Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA)
Website: vercel.com
The hosting provider operates the website and stores personal data under an agreement with the Data Controller. It is not entitled to access the content of personal data.
Email sending service
Resend, Inc. (USA)
The email sending service provider handles the delivery of messages submitted through the contact form. It is not entitled to access the content of personal data.
The Data Controller transfers personal data to the United States in connection with its hosting provider (Vercel Inc.) and email sending service (Resend, Inc.). The legal basis for such transfers is provided by the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses approved by the European Commission.
V. Personal data of children and third parties
Where processing is based on consent, persons under 16 may not provide their own personal data unless the person with parental responsibility (or, in their absence, the guardian) has consented to the processing of their personal data.
The Data Controller shall take all reasonable steps to verify that consent has been given by the holder of parental responsibility where personal data of persons under 16 are provided. If it finds that data of a person under 16 have been provided without consent or that consent was not given by a person entitled to give it, it shall delete the data without delay.
VI. Data subject rights and remedies
Right to be informed
The Data Controller shall take appropriate measures to provide the data subject with all information referred to in Articles 13 and 14 of the GDPR and all notices under Articles 15–22 and 34 in a concise, transparent, intelligible and easily accessible form, in clear and plain language.
Right of access
The data subject has the right to obtain from the Data Controller confirmation as to whether their personal data are being processed and, if so, access to the personal data and the following: the purposes of processing; the categories of personal data; the categories of recipients; the envisaged retention period; the right to rectification, erasure or restriction and to object; the right to lodge a complaint with a supervisory authority; information on the sources of the data; whether automated decision-making, including profiling, is used.
The Data Controller shall provide a copy of the personal data undergoing processing. For any further copies it may charge a reasonable fee based on administrative costs. At the data subject's request, the information shall be provided by electronic means, by email.
The right of access may be exercised in writing at the contact details set out in this Notice. At the data subject's request, and after verification of identity, the information may also be given orally.
Right to rectification
The data subject has the right to obtain from the Data Controller without undue delay the rectification of inaccurate personal data. Taking the purposes of processing into account, the data subject has the right to have incomplete personal data completed, including by means of a supplementary statement.
Right to erasure
The data subject has the right to obtain from the Data Controller the erasure of personal data without undue delay where one of the following applies:
- the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
- the data subject withdraws consent and there is no other legal basis for processing;
- the data subject objects to processing and there are no overriding legitimate grounds;
- the personal data have been unlawfully processed;
- erasure is necessary for compliance with a legal obligation under EU or member state law;
- the personal data have been collected in relation to the offer of information society services.
Right to restriction of processing
Erasure may not be requested where processing is necessary: for the right to freedom of expression and information; for compliance with a legal obligation on the Data Controller; for reasons of public interest in the area of public health or for archiving, scientific or historical research; or for the establishment, exercise or defence of legal claims.
The data subject has the right to obtain from the Data Controller restriction of processing where one of the following applies:
- the data subject contests the accuracy of the data (restriction applies for the period enabling the Data Controller to verify accuracy);
- processing is unlawful and the data subject opposes erasure and requests restriction instead;
- the Data Controller no longer needs the data but the data subject needs them for the establishment, exercise or defence of legal claims;
- the data subject has objected to processing (Article 21(1) GDPR); restriction applies until it is verified whether the Data Controller's legitimate grounds override those of the data subject.
Where processing has been restricted, the personal data may, with the exception of storage, only be processed with the data subject's consent or for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for important reasons of public interest of the EU or a member state. The Data Controller shall inform the data subject before the restriction is lifted.
Right to object
The data subject has the right to object at any time, on grounds relating to their situation, to processing of their personal data necessary for the legitimate interests of the Data Controller or a third party, including profiling. Where the data subject objects, the Data Controller may no longer process the data unless it demonstrates compelling legitimate grounds that override the interests, rights and freedoms of the data subject or that relate to the establishment, exercise or defence of legal claims.
Where processing is for direct marketing, the data subject has the right to object at any time to processing of their personal data for that purpose. Where the data subject objects to processing for direct marketing, the data may no longer be processed for that purpose.
The Data Controller shall examine the objection as soon as possible and no later than 15 days, decide on its merits and inform the data subject in writing. If the data subject disagrees with the decision or the Data Controller fails to meet the 15-day deadline, the data subject may bring court proceedings within 30 days of the decision or the last day of the deadline.
Right to data portability
The data subject has the right to receive the personal data concerning them which they have provided to the Data Controller in a structured, commonly used, machine-readable format, and the right to transmit those data to another controller where processing is based on consent or contract and is carried out by automated means. Where technically feasible, the data subject may request that the data be transmitted directly between controllers.
Right to withdraw consent
Where processing is based on consent, the data subject has the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
Supervisory and judicial remedies
The data subject may bring court proceedings if their rights are infringed. Proceedings may be brought before the court of the data subject's place of residence or stay, at the data subject's choice.
The data subject has the right to lodge a complaint with a supervisory authority if they consider that the processing of their personal data infringes the GDPR. The competent supervisory authority in Hungary is:
National Authority for Data Protection and Freedom of Information (NAIH)
Mailing address: 1530 Budapest, P.O. Box 5.
Phone: +36-1-391-1400
Fax: +36-1-391-1410
Email: ugyfelszolgalat@naih.hu
Website: naih.hu
The data subject has the right to an effective judicial remedy against a legally binding decision of the supervisory authority, and if the supervisory authority does not deal with the complaint or does not inform the data subject within three months of the progress or outcome of the complaint. Proceedings against the supervisory authority shall be brought before the courts of the member state where the authority has its seat.
VII. Data security measures
The Data Controller protects the personal data it processes by restricting access. Only those persons who need the data for the purposes set out above may access them.
VIII. Cookie policy
What is a cookie?
When you visit the website, the Data Controller uses so-called cookies. A cookie is a small package of letters and numbers that the website sends to your browser to save certain settings, make the site easier to use and help collect relevant, statistical information about visitors. Cookies do not contain personal information and cannot identify individual users. They often contain a unique identifier – a secret, randomly generated number – stored on your device. Some cookies disappear when you close the site; others are stored on your computer for longer.
Main features of cookies used on the website
Strictly necessary cookies: These cookies are essential for using the website and enable basic functions. Without them, many features would be unavailable. These cookies last only for the session.
User experience cookies: These cookies collect information about how you use the site, e.g. which pages you visit most or what error messages you see. They do not collect information that identifies you and use only general, anonymous data. We use the data to improve the site. These cookies last only for the session.
Cookie consent cookie: When you arrive on the site, you accept the cookie notice in the pop-up.
If you do not accept the use of cookies, some features may not be available. For more information on deleting cookies, see the links below:
Web analytics services
Google Analytics: Google Analytics is a Google tool that helps website owners understand their visitors' activity. The service may use cookies to collect and report statistical information on use of the site without identifying individual visitors to Google. The main cookie used is "__ga". With IP anonymisation enabled on the site, Google shortens users' IP addresses within the EU and in other states party to the EEA agreement before processing.
Google Maps: Enables use of Google Maps, display of maps and route planning. The site includes embedded Google Maps, which connects to Google's servers so that visitors' IP addresses and browser data are sent to Google.
For more on Google's privacy practices, see: https://policies.google.com/privacy?gl=HU&hl=en