The purpose of this Notice is to set out the data protection and data processing principles and policy applied by TRIUM-ITECH Zrt., and to fulfill the information obligations under Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: GDPR).
In the course of operating the website https://www.potapingpong.hu/ (hereinafter: the “Website“), TRIUM-ITECH Zrt. processes the data of visitors to the Website and of persons utilizing the services of the Data Controller that are available and purchasable via the Website (hereinafter: “Service” or “Services“) (hereinafter collectively: the “Data Subject“).
TRIUM-ITECH Zrt. acknowledges the content of this legal notice as binding upon itself. It undertakes to ensure that all data processing related to its activities complies with the requirements set forth in this policy, applicable national legislation, and the legal acts of the European Union.
TRIUM-ITECH Zrt. is committed to protecting the personal data of data subjects and attaches great importance to respecting their right to information self-determination (particularly that of users of the Service). TRIUM-ITECH Zrt. treats personal data confidentially and implements all security, technical, and organization-wide measures necessary to guarantee the security of data.
The basic concepts of data processing are defined in detail by Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (hereinafter: Infotv.) and the GDPR.
Key concepts for the interpretation of this notice:
“personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, a number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
“controller” means the natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of the processing are determined by Union or Member State law, the controller or the specific criteria for the designation of the controller may also be determined by Union or Member State law;
“processing” means any operation or set of operations which is performed on personal data or on data sets, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
“processor” means the natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller;
“recipient” means the natural or legal person, public authority, agency or any other body to whom or to which personal data are disclosed, whether or not a third party. Public authorities which may have access to personal data in the context of a specific investigation in accordance with Union or Member State law shall not be considered recipients; the processing of such data by those public authorities must comply with the applicable data protection rules in accordance with the purposes of the processing;
“restriction of processing”: the marking of stored personal data with a view to restricting their future processing;
“filing system”: a file of personal data, whether centralised, decentralised or organised by function or geographical area, which is accessible on the basis of specific criteria;
“third party”: a natural or legal person, public authority, agency or any other body other than the data subject, the controller, the processor or the persons who, under the direct authority of the controller or processor, are authorised to process personal data;
“data subject’s consent”: any freely given, specific, adequately informed and unambiguous indication of the data subject’s wishes by which the data subject, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data concerning him or her;
“data breach”: any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;
Personal data:
The controller shall be responsible for compliance with the above principles and shall be able to demonstrate such compliance (‘accountability’).
1.1. Data Controller:
Data Controller Name: TRIUM-ITECH Zrt.
Head Office: 1149 Budapest, Angol utca 34.
E-mail: info@potapingpong.hu
Website: www.potapingpong.hu
1.2. Data processor(s):
The data controller uses the following data processors:
| Reason for data processing: | Name of data processor: | Address and other contact details of data processor: |
| Hosting service, Mailing system operator | Tárhely.Eu Szolgáltató Kft. | 1097 Budapest, Könyves Kálmán körút 12-14. support@tarhely.eu |
| Accounting | ||
| Operator of electronic accounting system | KBOSS.hu Kft. | 1031 Budapest, Záhony utca 7. |
| Online payment service provider available on the website | SimplePay Zrt. | 1138 Budapest, Váci út 135-139. B. ép. 5. em. +36 1 3-666-611 +36 20 3-666-611 +36 30 3-666-611 +36 70 3-666-611 |
SimplePay Zrt. acts as an independent data controller with respect to its own-purpose data processing related to payment transactions, while in certain technical operations it may also act as a data processor in accordance with the applicable contracts. OTP Bank Nyrt., as the issuer of the OTP SZÉP card, processes cardholder data in accordance with its own data protection rules.
Current privacy notices of the payment service providers: https://simplepay.hu/adatkezelesi-tajekoztatok/ ; https://www.otpbank.hu/static/portal/sw/file/SZEPkartya_IB_adatkezelesi.pdf
1.3. Data Protection Officer
The Data Controller has considered the possibility of appointing a Data Protection Officer based on Article 37 of the GDPR and has concluded that the data processing occurring during visits to the Website or purchases made on the Website does not justify the appointment of a Data Protection Officer.
2.1. Data processing related to visiting the Website
Data processing carried out when visiting the Website and while staying on the Website as a visitor takes place in order to operate the site and ensure the user experience, including the use of web cookies.
Data processed:
The source of the data is our analytics software.
We process the above data in order to analyse the Data Subjects’ habits on the site, maintain the secure operation of our site, and understand the usefulness of our individual marketing decisions.
In the course of operating the Website, personal data may include, for example, the IP address, login ID, cookie ID and booking-related data. Technical data processing strictly necessary for operation is carried out for the purpose of providing the service securely, while statistical and marketing data processing is carried out in accordance with the relevant legal basis and cookie settings. Details are set out in Chapter VI.
2.2. Data processing related to the use of the Website (registration)
The Services displayed on the Website are available and can be used exclusively online through the Website.
On the Website, data subjects can learn about the services of Póta PingPong Hall, book time slots for table use, training sessions or programmes, and pay the service fee related to the booking using the available payment methods. The Website also supports related customer information and invoicing administration.
The General Terms and Conditions (GTC) for the use of the services available on the Website can be accessed electronically at: https://potapingpong.hu/altalanos-szerzodesi-feltetelek/
You can only use the services of the Website by registering. In this context, we process your personal data as follows:
Scope of personal data processed: username, surname and first name, residential address/billing address, email address, telephone number, and any other personal data provided by you.
Purpose of data processing: to identify you, to enable the use of the Website’s services, and to conclude and perform the contract between you and the Data Controller for the purchase of a Service.
Legal basis for data processing: necessary for the performance of a contract / for taking steps prior to entering into a contract [Article 6(1)(b) GDPR].
Duration of data processing: for the period necessary for the performance of the contract, booking administration and – where necessary – the enforcement of legal claims, in the latter case as a general rule taking into account the general five-year limitation period under civil law. A separate retention period, specified in Section 2.3.3, applies to the retention of accounting records.
The Data Controller does not verify the authenticity or accuracy of the personal data you provide (e.g. email address, etc.). The person who provided the data bears sole responsibility for its accuracy. The Data Controller excludes its liability arising from inaccurate data.
2.3. Data processing related to bookings and payments on the Website
2.3.1. Personal data processed for the purpose of paying the consideration for the Service
The consideration for the Service can be paid using the payment methods actually available for the given booking: bank card payment via SimplePay, OTP SZÉP card, and – if offered at checkout – bank transfer. The OTP SZÉP card is not the same as a regular bank card; it is accepted only for services marked accordingly at checkout.
Scope of personal data processed: name of the person making the booking, customer or user ID, email address, billing details as required, optional telephone number, the booked service and time slot, order/booking ID, payment method (including OTP SZÉP card), amount payable and currency, SimplePay transaction ID, payment status and time, and refund data where required. We process bank account numbers only in payment or refund processes where they are actually necessary.
Purpose of data processing: to process the booking and payment, determine the outcome of the transaction, invoicing, settle cancellations or refunds, and handle related customer service matters.
Legal basis for data processing: for data required for booking and payment, the conclusion or performance of a contract [Article 6(1)(b) GDPR]; for invoicing and mandatory record-retention data, legal obligation [Article 6(1)(c) GDPR]. The legal basis for retaining other data necessary to document potential legal claims may be legitimate interest, subject to a balancing test [Article 6(1)(f) GDPR].
Duration of data processing: for the period necessary for payment and booking administration, and, to the extent necessary for the enforceability of civil law claims, taking into account the general five-year limitation period; for accounting records and their essential supporting data, at least 8 years under the Accounting Act. The retention periods for the independent data processing of SimplePay and OTP Bank are set out in their own privacy notices.
The completion of payment involves the operation of an external payment service provider and – in the case of the OTP SZÉP card – the card issuer:
Name of the data processor/independent data controller: SimplePay Zrt.
Registered office: 1138 Budapest, Váci út 135-139. Building B, 5th floor
Company registration number: 01-10-143303
Scope of data transferred: username, surname, first name, country, telephone number, email address, name and amount of the purchased product/service, order number.
Purpose of the data transfer: providing customer service assistance to the Data Subject, confirming transactions, fraud monitoring, and fraud profiling carried out to protect Data Subjects.
Legal basis for the data transfer: the processing is necessary for the performance of a contract [Article 6(1)(b) GDPR].
Reference to the partner’s privacy notice: SimplePay’s detailed privacy notice is available at simplepay.hu, and directly at the following link: SimplePay Privacy Notice.
The Data Controller does not request, have access to or store the full card number, expiry date, CVC/CVV code or cardholder authentication data of regular bank cards or OTP SZÉP cards. The data subject enters the card data on the appropriate secure interface of the payment service provider. Only the status and reference data necessary for identifying the transaction, confirming completion and processing any refund may be returned to the Data Controller.
2.3.1.1. Supplementary information for payment by OTP SZÉP card
Online payment by OTP SZÉP card can be selected on the Website only for services marked accordingly at checkout. The selected payment method operates via the SimplePay payment interface; the card issuer is OTP Bank Nyrt.
Data processed by the Service Provider: data of the person making the booking or the paying party necessary for the booking, the ordered service, the order/booking ID, the amount, the designation of the payment method as OTP SZÉP card, the SimplePay transaction ID, the time and the successful/unsuccessful payment result, and, in the event of cancellation or refund, the related settlement data.
The source of the data is the data provided by the User at the time of booking and the transaction feedback received from the SimplePay payment system. The Service Provider does not receive the card balance, the full SZÉP card number or the cardholder’s authentication code.
The purpose of the data processing is to execute and verify the OTP SZÉP card payment, confirm the booking, handle any erroneous payment or refund, and issue invoices as required by law. The legal basis is the performance of a contract as set out in Section 2.3.1 above and, for accounting data, legal obligation. Without the data necessary for OTP SZÉP card payment, payment cannot be made using this payment method.
The recipient of the transaction data necessary for payment is SimplePay Zrt.; data processing related to the issuance of the OTP SZÉP card and the authorisation of cardholder payments is carried out by OTP Bank Nyrt. within its own sphere of responsibility. SimplePay and OTP Bank ensure data subject rights with respect to the data they process in accordance with their own privacy notices.
The retention of data necessary for settling payment status, refunds and any complaints is governed by Section 2.3.1, and invoicing data by Section 2.3.3. The retention periods for data processed by the card issuer and SimplePay are set out in their own privacy notices.
OTP Bank Nyrt. – OTP SZÉP card privacy notice: https://www.otpbank.hu/static/portal/sw/file/SZEPkartya_IB_adatkezelesi.pdf ; SimplePay privacy notices: https://simplepay.hu/adatkezelesi-tajekoztatok/
2.3.2. Personal data processed for the purpose of providing information related to purchases
Contact and communication between the Data Controller and you are essential for purchases made on the website. You will receive confirmation of the purchase/order by email. In some cases, the Data Controller sends data subjects electronic notifications by email or via the Application about products or services, as well as changes to the General Terms and Conditions. However, the Data Controller does not use such notifications for advertising purposes.
In this context, we process your personal data as follows:
Scope of personal data processed: surname and first name, email address.
Purpose of data processing: to identify you and to perform the contract between you and the Data Controller for the purchase (use) of the Service.
Legal basis for data processing: performance of a contract (Article 6(1)(b) GDPR).
Duration of data processing: the period necessary for the performance of the contract, but no longer than the limitation period for civil law claims (5 years).
Personal data required for customer notifications related to bookings and payments may be accessed primarily by the Data Controller and by the commissioned technical service provider to the extent necessary under the contract.
2.3.3. Personal data processed for the purpose of accounting obligations
Pursuant to Section 169(2) of the Accounting Act, the Data Controller is obliged to retain, in legible and retrievable form for 8 years, the accounting records directly and indirectly supporting the bookkeeping, including general ledger accounts and analytical or detailed records. To this end, we process your personal data as follows:
Scope of personal data processed: billing name, billing address (postcode, city, street, house number), tax number (for companies), email address (for sending the electronic invoice).
Purpose of data processing: fulfilment of the obligation set out in the Accounting Act to retain accounting records directly and indirectly supporting the bookkeeping.
Legal basis for data processing: compliance with a legal obligation to which the Data Controller is subject (Article 6(1)(c) GDPR).
Duration of data processing: 8 years, in order to fulfil the obligation to retain accounting records (Section 169(2) of the Accounting Act).
Personal data processed for the purpose of fulfilling the obligation set out in the Accounting Act to retain accounting records directly and indirectly supporting the bookkeeping may be accessed primarily by the Data Controller and, in connection with the operation of the electronic invoicing system, by the following operator (data processor):
Use of a data processor for online invoicing (szamlazz.hu)
Name of the data processor: KBOSS.hu Kft.
Registered office: 1031 Budapest, Záhony utca 7.
Contact: info@szamlazz.hu, szamlazz.hu
Scope of data transferred: billing name, billing address (postcode, city, street, house number), tax number (for companies), email address (for sending the electronic invoice).
Purpose of data processing: issuing and sending to the Data Subject an electronic invoice in compliance with the law (in particular the VAT Act and the Accounting Act).
Legal basis for data processing: compliance with a legal obligation (Article 6(1)(c) GDPR).
Reference to the partner’s privacy notice: Detailed information on Számlázz.hu’s data protection principles and data processing activities can be found in the Számlázz.hu Privacy Notice.
In the case of payment by OTP SZÉP card, an invoice is also issued for the service actually provided, in accordance with the statutory requirements; the card number and cardholder authentication data are not transferred to the invoicing system. The designation of the payment method and the amount and identification data necessary for settlement may appear in the accounting process.
2.4. Complaint handling
If you are not satisfied with the ordered Service or if you have any other objection regarding the Website, the Data Controller – with regard to Sections 17/A–17/C of the Consumer Protection Act – provides you with the opportunity to submit a complaint. In this case, we process your personal data as follows:
Scope of personal data processed: surname and first name, delivery address, email address, Service details (name, purchase price), the claim the consumer wishes to enforce, the determination of the defect, the method of resolving the objection, the date the record was taken.
Purpose of data processing: handling customer objections and complaints.
Legal basis for data processing: compliance with the Data Controller’s legal obligation relating to the handling of consumer protection complaints (Article 6(1)(c) GDPR).
Duration of data processing: 3 years for the records taken and for copies of responses to written complaints.
Personal data processed for the purpose of handling complaints may be accessed by the Data Controller.
2.5. Email customer service, contact – support for customers and enquirers
The Website enables customers or other interested parties to send messages to the Data Controller, express their interest or address questions to the Data Controller by email sent to the Data Controller’s email address, info@potapingpong.hu.
Purpose of data processing: responding to requests for information related to purchases and services.
Scope of data processed: surname and first name, email address, telephone number, and any personal data that may appear in the message.
Legal basis for data processing: necessary for the performance of a contract / for taking steps prior to entering into a contract [Article 6(1)(b) GDPR].
Duration of data processing: the limitation period for civil law claims (5 years).
2.6. Providing a telephone number:
Purpose of data processing: Although processing the telephone number – as personal data – is not a condition for the performance of the contract, the Website allows it to be provided if the data subject wishes to display it. In all other cases, the data subject can communicate with the Data Controller via the email address provided on the Website when placing the order.
Legal basis for data processing: the data subject’s voluntary consent (Article 6(1)(a) GDPR).
Duration of data processing: for the period necessary for the performance of the contract between you and the Data Controller for the purchase (use) of the Service, but no longer than the limitation period for civil law claims (5 years).
Personal data processed for the purpose of purchases may be accessed primarily by the Data Controller.
Data subject rights: in addition to the data subject rights set out in Chapter IV of the Privacy Notice, the data subject is entitled to withdraw their consent to the processing of the above personal data at any time; in this case, the Data Controller will no longer process their personal data and will delete the personal data processed on this legal basis, unless another legal basis permits the processing of such data. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
2.7. Data processing related to sending newsletters
The Data Controller sends emails containing advertisements or promotional material (newsletters) to the email addresses provided during subscription only with the Data Subject’s express consent, in the cases and manner prescribed by law. The newsletter contains direct marketing elements and advertising. The Data Controller processes the data provided by the Data Subject when subscribing to the newsletter.
Scope of data processed: email address
Legal basis for data processing: the data subject’s voluntary consent (Article 6(1)(a) GDPR).
Duration of data processing: in the case of the newsletter, the Data Controller processes the data provided by the Data Subject when subscribing until the Data Subject unsubscribes from the newsletter by clicking the “Unsubscribe” button at the bottom of the newsletter, or requests removal from the newsletter subscriber list by email or post. Upon unsubscribing, the Data Controller will not contact the Data Subject with further newsletters or offers. The Data Subject may unsubscribe from the newsletter and withdraw their consent at any time, free of charge.
2.8. Processing of photo and video recordings for marketing purposes
Photo, audio and video recordings may be made periodically at Póta PingPong Hall in order to present the facility, events and sporting life, and to promote the services.
Purpose of data processing:
Presenting the services, events and community life of Póta PingPong Hall, marketing and communication activities, publication on the website and social media platforms.
Scope of personal data processed:
The data subject’s image and/or voice, and the data subject’s appearance in video recordings (face and body image).
Legal basis for data processing; voluntary nature:
The legal basis for data processing is the data subject’s voluntary, express consent, which may be withdrawn at any time, pursuant to Article 6(1)(a) GDPR.
Recipient of the data:
TRIUM-ITECH Zrt., data controller
Areas of use of the data:
The photo, audio and video recordings may appear on the official website of Póta PingPong Hall (https://potapingpong.hu/), on its Facebook, Instagram, TikTok and other social media platforms, and in printed or electronic marketing materials.
Duration of data processing:
Until consent is withdrawn, but no longer than 5 years from the date the photo, audio or video recording was made.
Rights of the data subject:
In addition to the data subject rights set out in Chapter IV of the Privacy Notice, the data subject is entitled to withdraw their consent to the processing of the above personal data at any time; in this case, the Data Controller will no longer process their personal data and will delete the personal data processed on this legal basis, unless another legal basis permits the processing of such data. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
The data is only accessible to the data controller and its commissioned data processors (e.g. hosting service providers, payment service providers and online billing platforms) to the extent necessary.
The Data Controller, taking into account the state of science and technology, implements appropriate technical, administrative and organizational measures to guarantee data security:
The Data Controller shall keep records of any data protection incidents, indicating the facts related to the data protection incident, its effects and the measures taken to remedy it.
The Data Controller shall notify the National Data Protection and Freedom of Information Authority of any data protection incident without delay and, if possible, no later than 72 hours after it has become aware of the data protection incident, unless the data protection incident is unlikely to result in a risk to the rights and freedoms of natural persons. We regularly review our security measures, record the necessary actions in our internal Incident Management Policy and our employees always perform their duties in accordance with the current policy.
The Data Subject may at any time request information about the processing of his or her personal data processed by the Data Controller, and may request the correction of his or her personal data, or – with the exception of mandatory data processing – its deletion, withdrawal, and exercise his or her right to data portability and objection through the Data Controller’s contact details provided in point 1. The deletion does not apply to any data processing required by law (e.g. accounting regulations), which the Data Controller will retain for the necessary period.
Right to information:
The data subject has the right to contact the Data Controller in writing via the Data Controller’s contact details provided in point I. with a request for information regarding the processing of his or her personal data. The Data Controller shall inform the data subject without undue delay, but in any case within one month of receipt of the request, of the measures taken in response to the data subject’s request. If necessary, taking into account the complexity of the request and the number of requests, the 30-day deadline may be extended by another two months. The Data Controller shall inform the data subject of the extension of the deadline, indicating the reasons for the delay, within one month of receipt of the request. If the data subject submitted the request electronically, the Data Controller shall provide the information electronically, unless the data subject requests otherwise. The Data Controller shall provide the information and the action free of charge. If the data subject’s request is manifestly unfounded or, in particular, excessive due to its repetitive nature, the Data Controller may charge a reasonable fee, taking into account the administrative costs of providing the requested information or information or taking the requested action, or may refuse to take action on the basis of the request.
Right of access:
The data subject shall have the right to receive from the Data Controller feedback on whether personal data concerning him or her are being processed and, where such processing is being carried out, access to the personal data and the following information: the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipients to whom the personal data have been or will be disclosed, including in particular recipients in third countries or international organisations; the planned period for which the personal data will be stored; the right to rectification, erasure or restriction of processing and to object; the right to lodge a complaint with a supervisory authority; information on the sources of the data; the fact of automated decision-making, including profiling, as well as intelligible information on the logic involved and the significance and foreseeable consequences of such processing for the data subject. The controller shall provide the data subject with a copy of the personal data subject to processing. For further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. At the data subject’s request, the controller shall provide the information in electronic form.
Right to rectification:
The data subject may request the rectification of inaccurate personal data concerning him or her and the completion of incomplete data.
Right to erasure:
The data subject shall have the right to obtain from the Controller the erasure of personal data concerning him or her without undue delay where one of the following grounds applies:
Erasing of data cannot be requested in the case of mandatory processing: Article 6 GDPR. in the case of a legal basis based on Article (1) point (c) of the GDPR.
Right to restriction of processing: At the request of the data subject, the Controller shall restrict processing where one of the following applies:
the accuracy of the personal data is contested by the data subject, in which case the restriction applies for a period enabling the verification of the accuracy of the personal data;
the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise, or defence of legal claims; or
the data subject has objected to processing; in this case, the restriction applies for a period pending the verification whether the legitimate grounds of the controller override those of the data subject.
Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise, or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State. A data subject shall be informed by the Controller before the restriction of processing is lifted. Right to data portability: The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to the controller, in a structured, commonly used, and machine-readable format, and have the right to transmit those data to another controller. Right to object: The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to the processing of personal data concerning him or her which is necessary for the purposes of the legitimate interests pursued by the controller or by a third party. In case of objection, the controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defence of legal claims. Procedural rules: The controller shall provide information on action taken on a request under Articles 15 to 22 of the GDPR to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject. If the controller does not take action on the request of the data subject, the controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy. The Controller shall provide the requested information and notifications free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request. The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it. The controller shall provide a copy of the personal data undergoing processing to the data subject. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, the information shall be provided in a commonly used electronic form, unless otherwise requested by the data subject. Right to an effective judicial remedy: In the event of an infringement of their rights, the Data Subject may bring proceedings against the Controller before a court. The court shall hear the case expeditiously.
Supervisory authority proceedings:
Complaints may be lodged with the Hungarian National Authority for Data Protection and Freedom of Information: National Authority for Data Protection and Freedom of Information (NAIH)
Registered office: 1055 Budapest, Falk Miksa u. 9-11., Hungary
Postal address: 1363 Budapest, Pf.: 9., Hungary
Phone: +36 1 391 1400 Fax: +36 1 391 1410
Email: ugyfelszolgalat@naih.hu
Website: http://www.naih.hu
The Data Controller does not carry out automated decision-making and profiling with the Data Subject’s personal data.
The website uses technical cookies for the operation of the website and for the best possible user experience.
In addition, cookies for statistical and marketing purposes only work with the consent of the Data Subject.
The Data Subject can modify or delete cookies in the browser settings at any time.
Regarding cookie settings, we would like to point out that the use of cookies is permitted by default in browsers. The Data Subject can delete cookies from their computer or even set their browser to block their use. In the latter case, we would like to point out that the operation of the site will not be fully functional.
By clicking the “I accept” button on the Website, the Data Subject consents to the use of cookies managed by our own or external service providers (“third parties”) necessary to record the data and information written in this notice. Such data is the data of the Data Subject’s computer that is generated when using our website or that is recorded as an automatic result of technical processes by the cookies used on our website. The automatically recorded data is automatically logged by the system – without the specific consent of the Data Subject – when visiting or leaving the website. We do not link this data with any other personal data and the Data Subject cannot be identified. Only we and the service provider managing the cookies have access to this data.
More detailed information about cookie settings for the following browsers:
https://support.google.com/accounts/answer/61416?hl=en
https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer
https://support.microsoft.com/en-us/edge/microsoft-edge-browsing-data-and-privacy
The Data Controller reserves the right to unilaterally modify or withdraw this data management information at any time, with prior notification to the Data Subjects on the Website. The information is published on the Website. By continuing to use the Website, the Data Subject accepts the modified terms and conditions.
This Privacy Policy is valid from Oct 9, 2026 until withdrawn
The content of the Privacy Policy has been prepared in accordance with the provisions of the following legal acts:
Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data Act CVIII of 2016 on certain aspects of electronic commerce services and information society services Act XLVIII of 2016 on the basic conditions and certain restrictions of economic advertising
The court, the prosecutor, the investigating authority, the misdemeanour authority, the administrative authority, the National Data Protection and Freedom of Information Authority, the Hungarian National Bank, or other bodies authorized by law may contact the Data Controller to provide information, communicate, transfer data, or make documents available.
The Data Controller shall only disclose personal data to the authorities – if the authority has specified the precise purpose and scope of the data – to the extent and insofar as this is absolutely necessary to achieve the purpose of the request.
The Data Controller shall not be subject to the provisions of any code of conduct.
Dated: Budapest, Oct 9, 2026.
I acknowledge that the following personal data stored in the user database of www.potapingpong.hu by the data controller TRIUM-ITECH Zrt. (1149 Budapest, Angol utca 34.) will be transferred to SimplePay Zrt. as the data processor. The scope of data transmitted by the data controller is as follows:
The nature and purpose of the data processing activity carried out by the data processor can be viewed in the SimplePay Data Processing Information, at the following link:
