ID&Trust Kft. (registered office: 1021 Budapest, Versec sor 18.; company registration number: 01-09-710179; telephone: +36-1-307-8035; email: info@ittirdala.hu; “ID&Trust”) attaches particular importance to the secure processing of the data of the Customer, the Customer’s Users and the Invitee. The ittirdalá.hu service enables the Customer and/or the Invitee to apply an electronic signature quickly and easily to a document submitted for signature.
1. The controller, the data processed and retention periods
1.1. This Privacy Notice addresses data protection matters relating to the use of the ittirdalá.hu website and service (the “Service”), developed and operated by ID&Trust.
1.2. The terms used in this Privacy Notice, in particular Customer, User and Invitee, are defined in the general terms of service of ittirdalá.hu. The current version is available at the following link: https://ittirdala.hu/docs/adatkezeles
1.3. If you use the Service to apply an electronic signature using ID&Trust’s non-qualified trust service for the creation of advanced electronic signatures (the “Trust Service”), you enter into contractual relationships, separate from the Service, with the Trust Service and with the identity service provider that has a contract with the Trust Service. Please read the contractual and data processing terms of the providers concerned carefully. Their acceptance is a condition for applying an advanced electronic signature.
1.4. When you register for the Service as a Customer or, where the Customer is a legal entity, as a User, or when you initiate signing as an Invitee, you accept this Privacy Notice and the processing of personal data as set out in clause 1.5.
1.5. ID&Trust processes the following data of the Customer, the User and the Invitee for the following purposes:
| Type of data | Purpose of processing | Retention period |
|---|---|---|
| Customer’s name | Communication. | Until the last User associated with the Customer is deleted. |
| User’s name | Communication, creating the registration and accounting for the service fee. | Until the User is deleted. |
| User’s email address | Communication and creating the registration. | Until the User is deleted. |
| Hash of the User’s email address | Preventing abuse. | Until the 365th day after deletion of the User account. |
| Billing data: Customer’s name and registered office address or residential address | Issuing invoices. | Data needed to meet tax obligations are kept until the tax limitation period expires: five years from the last day of the calendar year in which a tax return or notification should have been filed or, in the absence of a return or notification, the tax should have been paid. This means a maximum of seven years. Data required for ID&Trust to meet its accounting obligations are retained for a maximum of eight years. |
| Identifier used by the payment service provider | Data required for recurring card payments. | Until the subscription is cancelled. |
| Invitee’s name | Communication. | Until the 60th day after the signing workflow begins. |
| Invitee’s email address | Communication, submitting the document to the Invitee for signature and enabling download of the signed document. | Until the 60th day after the signing workflow begins. |
| Invitee’s full name as used with the trust service provider | Enabling download of the signed document. | Until the 60th day after the signing workflow begins. |
| Number of the identity document used by the Invitee with the trust service provider | Enabling download of the signed document. | Until the 60th day after the signing workflow begins. |
2. Legal basis for processing
2.1. ID&Trust processes the personal data referred to in clause 1.5 as described above, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, “GDPR”).
2.2. The legal basis for processing each category of data is as follows:
| Type of data | Legal basis for processing |
|---|---|
| Customer’s name | Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(c) GDPR (compliance with a legal obligation), section 169(2) of the Hungarian Accounting Act. |
| User’s name | Article 6(1)(f) GDPR (the controller’s legitimate interest). |
| User’s email address | Article 6(1)(f) GDPR (the controller’s legitimate interest). |
| Hash of the User’s email address | Article 6(1)(f) GDPR (the controller’s legitimate interest). |
| Billing data: Customer’s name and registered office address or residential address | Article 6(1)(c) GDPR (compliance with a legal obligation), section 169(2) of the Hungarian Accounting Act. |
| Identifier used by the payment service provider | Article 6(1)(f) GDPR (the controller’s legitimate interest). |
| Invitee’s name, where the Invitee is not the same person as the Customer | Article 6(1)(f) GDPR (the controller’s legitimate interest). |
| Invitee’s email address | Article 6(1)(f) GDPR (the controller’s legitimate interest). |
| Invitee’s full name as used with the trust service provider | Article 6(1)(f) GDPR (the controller’s legitimate interest). |
| Number of the identity document used by the Invitee with the trust service provider | Article 6(1)(f) GDPR (the controller’s legitimate interest). |
3. Who may access the data
3.1. Certain employees of ID&Trust and its data processors are authorised to access the data.
3.2. ID&Trust uses the following data processors:
| Name | Activity relating to processing | Registered office | Contact person | Place of processing | Processing technology | |
|---|---|---|---|---|---|---|
| Amazon Web Services EMEA SARL | Technical infrastructure and server hosting | 38 Avenue John F. Kennedy, L-1855, Luxembourg | Eva Orszaghova | orszagho@amazon.co.uk | www.aws.amazon.com | AWS provides the server hosting and technical infrastructure for operation of the Service and for sending the message used to verify that the User controls the email address. |
| Challenger-Solution-it Kft. | Technical and operational support | 3000 Hatvan, Madách utca 10/A | Mihály Árpád | info@devwing.hu | https://devwing.hu | Operational support for the Service. |
| Emergence Engineering Kft. | 1123 Budapest, Nagyenyed u. 5., basement level | szamlabridge@emergence-engineering.com | Transmission of billing data between Stripe and szamlazz.hu. | |||
| TAXENSE Consulting Kft. | Accounting services | 1054 Budapest, Bank u. 6., 3rd floor, 10/a | office@taxense.hu | www.taxense.hu and www.taxense.eu | Accounting services. | |
| KBOSS.hu Kft | Issuing and sending invoices | 1031 Budapest, Záhony utca 7. | Dr. Istvánovics Éva, attorney-at-law | dpo@kboss.hu | www.szamlazz.hu | Issuing and sending invoices. |
| Stripe Payments Europe, Limited | Payment services | The One Building, 1, Lower Grand Canal Street, Dublin 2 | – | dpo@stripe.com | www.stripe.com | Card payment services. |
4. Your rights in relation to processing
4.1. You may request further information about the processing of your personal data by writing to ID&Trust, as controller, using the contact details given at the beginning of this Privacy Notice.
4.2. You have the following rights in relation to the processing of your personal data:
a) Right of access (Article 15 GDPR). You have the right to obtain confirmation from ID&Trust as to whether your personal data are being processed. If so, you have the right to access the personal data and the information set out in this Notice.
ID&Trust will provide you, on request, with a copy of the personal data undergoing processing. For any further copies you request, ID&Trust may charge a reasonable fee based on its administrative costs. If you make your request electronically, we will provide the information in a commonly used electronic format unless you request otherwise.
b) Right to rectification (Article 16 GDPR). You have the right to have ID&Trust rectify inaccurate personal data about you without undue delay upon request. You may also request that incomplete personal data be completed.
c) Right to erasure (Article 17 GDPR). You have the right to have ID&Trust erase personal data concerning you without delay upon request, and ID&Trust must erase those data without delay, if any of the following grounds applies:
• The personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
• Where processing is based on your consent, you withdraw that consent and there is no other legal basis for processing.
• You object to processing and there are no overriding legitimate grounds for it.
• The personal data have been unlawfully processed.
• The personal data must be erased to comply with a legal obligation under Union or Member State law applicable to ID&Trust.
The provisions of point (c) above do not apply to the extent that processing is necessary (i) to comply with a legal obligation requiring processing under Union or Member State law to which ID&Trust is subject, or (ii) for the establishment, exercise or defence of legal claims.
d) Right to restriction of processing (Article 18 GDPR). You have the right to have ID&Trust restrict processing upon request if any of the following applies:
• You contest the accuracy of the personal data. The restriction applies for a period enabling ID&Trust to verify their accuracy.
• Processing is unlawful and you oppose erasure of the data, requesting restriction of their use instead.
• ID&Trust no longer needs the personal data for the purposes of processing, but you require them for the establishment, exercise or defence of legal claims.
• You have objected to processing. The restriction applies until it is determined whether ID&Trust’s legitimate grounds override yours.
e) Right to object (Article 21 GDPR). You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on the controller’s legitimate interest. ID&Trust may then no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or grounds relating to the establishment, exercise or defence of legal claims.
f) Right to information concerning the above rights (Article 12 GDPR). ID&Trust will inform you about the circumstances of processing without delay and in any event within one month of receiving a request made under points (a) to (e) above. Where necessary, taking account of the complexity and number of requests, that period may be extended by two further months. ID&Trust will inform you of any extension within one month of receiving your request and give the reasons for the delay.
The information is provided free of charge. If your request is manifestly unfounded or excessive, particularly because it is repetitive, ID&Trust may, taking account of the administrative costs of providing the information or communication or taking the action requested, (i) charge a reasonable fee or (ii) refuse to act on the request.
g) Right to lodge a complaint (Article 77 GDPR). If you consider that the processing of personal data concerning you infringes the GDPR, you may lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. A complaint may be lodged with the Hungarian National Authority for Data Protection and Freedom of Information (address: 1055 Budapest, Falk Miksa u. 9–11.; telephone: +36 1 391 1400; fax: +36 1 391 1410; www.naih.hu; ugyfelszolgalat@naih.hu).
h) Right to a judicial remedy (Article 79 GDPR). You have the right to a judicial remedy if you consider that your rights under the GDPR have been infringed because your personal data were processed in a manner that does not comply with the GDPR. Proceedings against ID&Trust must be brought before a court in the Member State where ID&Trust has an establishment. Such proceedings may also be brought before a court in the Member State of your habitual residence.
i) Right to data portability (Article 20 GDPR). You have the right to data portability if the legal basis for processing is your consent or the contract concluded with you under Article 6(1)(a) or (b) GDPR. In that case, you have the right to receive the personal data concerning you which you have provided to ID&Trust in a structured, commonly used and machine-readable format, and to transmit those data to another controller without hindrance from ID&Trust. Where technically feasible, you may also request that ID&Trust transmit the data directly between the controllers.