During the audit, I examine whether regulations, documentation, and actual operations are aligned. The purpose of the audit is not merely to list deficiencies; the process enables the identification of compliance gaps—along with their associated risks and priorities—and the determination of necessary corrective actions.
The website was created within the framework and with the support of the Demján Sándor Program.
Dr. Erdélyi Gábor e.v., as the data controller, hereby informs Data Subjects regarding the processing of their personal data, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
Dr. Erdélyi Gábor e.v. 52717855 (registered office: 8900 Zalaegerszeg, Erdész utca 82 földszint 3 ajtó, Registration number: 52717855, tax identification number: 69113442-1-40, E-mail: info@drerdelyigabor.hu)
Data processing in connection with the data controller's website available at drerdelyigabor.hu
| Purpose of data processing | Legal basis for data processing | Scope of data processed | Duration of data processing |
|---|---|---|---|
| Processing of requests based on messages sent via the contact form, callback requests, or quote requests. | The consent of the data subject. | Name, e-mail address, and phone number of the data subject, as well as any personal data provided by the data subject for the purpose of making contact. | Until the purpose of data processing ceases to exist. |
No automated decision-making, including profiling, takes place during the data processing.
The service provider is not obliged to verify whether the data subject is authorized to provide the data they have submitted. The applicant bears sole responsibility for such authorization.
Access to the data is granted to those employees acting on behalf of the Data Controller for whom such access is necessary to perform their duties and who are aware of the obligations related to data processing.
Personal data will not be transmitted to a third party for the purpose of data processing.
Right to information
General rules regarding the information of the data subject and the right to information
The data controller must provide the data subject with detailed information regarding the data processing—specifically the information contained in this Notice—no later than the time the data subject's personal data are obtained, and prior to the commencement of data processing.
The data controller is responsible for providing this prior information.
In addition to the aforementioned prior information, the data subject may request information from the data controller at any stage of the data processing. In such cases, the data controller must provide the information without undue delay, but no later than within 30 days. This one-month deadline may be extended by a maximum of two months only in justified cases.
The data controller may refuse to provide the information only if it demonstrates that the data subject cannot be identified, or that the data subject's request is manifestly unfounded, repetitive, or excessive.
If the data controller fails to take action—that is, fails to fulfill its obligation to provide information—it must inform the data subject within 30 days of the failure to act, the reasons for such failure, and the data subject's right to lodge a complaint or seek judicial remedy regarding the data processing. This Notice contains further details below regarding complaints and judicial remedies. The controller must provide the information and take the action for the data subject free of charge. However, the controller may—in exceptional cases—charge a reasonable fee or refuse to provide the information or take the action if the data subject’s request is manifestly unfounded, repetitive, or excessive.
The data subject's right of access
The data subject has the right to obtain confirmation from the controller as to whether or not personal data concerning them are being processed, and, where that is the case, access to the personal data and the following information:
Based on the right of access, the data subject must be informed of the following information upon request:
The data controller shall provide the data subject with a copy of the personal data undergoing processing. For any further copies requested by the data subject, the data controller may charge a reasonable fee based on administrative costs; the data subject shall be informed of such costs in advance.
Where the data subject makes the request by electronic means, our company shall provide the information in a commonly used electronic format, unless the data subject requests otherwise.
Right to rectification
The data subject has the right to have inaccurate personal data concerning them rectified by the controller without undue delay upon their request. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Right to erasure, “right to be forgotten”
The data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay, and the controller has the obligation to erase personal data concerning the data subject without undue delay where one of the following grounds applies:
Where the controller has made the personal data public and is obliged to erase it pursuant to the list above, it shall, taking into account available technology and the cost of implementation, take reasonable steps—including technical measures—to inform controllers processing the data that the data subject has requested them to erase any links to, or copies or replications of, the personal data in question.
The data controller is not obliged to comply with a request for erasure made in the cases specified above if the processing is necessary:
If any of the above grounds apply and the data controller is not obliged to comply with the data subject's request for erasure, it must inform the data subject of this circumstance—and the reason for it—within 25 days.
Right to restriction of processing
The data subject has the right to obtain from the controller the restriction of processing where one of the following applies:
Where the processing of personal data is restricted on the basis of the foregoing, such personal data shall, with the exception of storage, only be processed with the data subject's consent or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.
The data controller shall inform the data subject—at whose request the processing was restricted pursuant to the above—in advance about the lifting of the restriction on processing.
Obligation to notify regarding the rectification or erasure of personal data or the restriction of processing
The controller is obliged to inform every recipient to whom the personal data have been disclosed of any rectification, erasure, or restriction of processing, unless this proves impossible or involves disproportionate effort.
The data subject shall have the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used, and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:
When exercising the right to data portability as described above, the data subject has the right to request—where technically feasible—the direct transmission of personal data between controllers.
The exercise of the right to data portability shall not prejudice the right to erasure. The exercise of the right to data portability shall not adversely affect the rights and freedoms of others.
Right to protest
The data subject has the right to object, on grounds relating to their particular situation, at any time to the processing of their personal data. In such a case, the controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.
Where personal data are processed for direct marketing purposes (e.g., sending marketing communications to clients), the data subject has the right to object at any time to the processing of personal data concerning them for such purposes, including profiling to the extent that it is related to such direct marketing. If the data subject objects to the processing of personal data for direct marketing purposes, the personal data shall no longer be processed for such purposes.
Right to withdraw consent
The data subject has the right to withdraw their consent to data processing at any time, provided that the legal basis for the processing is the data subject's consent (e.g., sending a marketing newsletter). However, the withdrawal of consent does not render the data processing carried out prior to the withdrawal unlawful.
Consent is deemed withdrawn if the data subject deletes their user account; alternatively, consent for the processing of personal data may be withdrawn via email by sending a deletion request to info@drerdelyigabor.hu.
Legal remedy, Right to lodge a complaint, Judicial remedy
In other words, what can the data subject do if they believe their personal data is not being processed in accordance with the rules?
Right to lodge a complaint
The data subject has the right to lodge a complaint with a supervisory authority—particularly in the Member State of their habitual residence, place of work, or the place of the alleged infringement—if they consider that the processing of their personal data infringes the law. In Hungary, the competent supervisory authority is the National Authority for Data Protection and Freedom of Information (NAIH).
Exercising the right to lodge a complaint does not preclude the data subject from pursuing other administrative or judicial remedies if they believe that the processing of their personal data is unlawful. Thus, the data subject may initiate administrative or judicial proceedings concurrently with exercising their right to lodge a complaint.
You may lodge a complaint with the National Authority for Data Protection and Freedom of Information; the contact details for the Authority are as follows:
Name: National Authority for Data Protection and Freedom of Information ("Nemzeti Adatvédelmi és Információszabadság Hatóság")
Registered office: Hungary, 1055 Budapest, Falk Miksa utca 9-11.
Mailing address: 1530 Budapest, Pf.: 5.
Phone: +36 1 391 1400
Fax: +36 1 391 1410
Web: http://www.naih.hu
E-mail: ugyfelszolgalat@naih.hu
Data processing registration number: NAIH-126761/2017
Right to a judicial remedy against a decision of the NAIH or another supervisory authority
If you have turned to the supervisory authority (NAIH) regarding the processing of your data and the authority has issued a decision on your case, you—as the data subject—are entitled to seek judicial remedy against that decision (i.e., to challenge the decision in court). This right to judicial remedy also applies if the competent supervisory authority (NAIH) fails to handle the complaint or fails to inform you, within three months, of the procedural developments regarding the complaint or its outcome.
Proceedings against the supervisory authority (NAIH) must be initiated before the courts of the Member State where the supervisory authority is established.
Right to a judicial remedy against the controller or processor
The data subject is entitled to seek judicial remedy if they consider that their rights regarding data processing have been infringed as a result of the unlawful processing of their personal data. Exercising the right to judicial remedy does not preclude the data subject—should they consider that the processing of their personal data is unlawful—from pursuing other administrative or judicial remedies or exercising their right to lodge a complaint.
Proceedings against the controller or the processor shall be brought before the courts of the Member State where the controller or the processor has its place of establishment.
In the case of Dr. Erdélyi Gábor e.v. the courts of the place of activity are the courts of Hungary, whereas the court with jurisdiction based on Dr. Erdélyi Gábor e.v.’s registered office is Zalaegerszeg District Court.
The judicial remedy procedure can also be initiated before the court of the Member State of the habitual residence of the person concerned, unless the data controller or the data processor is a public authority of a Member State acting in its public authority.
Liability for Damages and Compensation for Non-Pecuniary Loss
In other words, how are the data controller and the data processor liable to the data subject in the event of damage?
If improper data processing causes damage to the data subject, the data controller is liable for compensation. A claim for damages arises if the data processing was unlawful or constituted a breach of contract, and the data subject suffered a financial loss as a result. In the event of unlawful data processing, the data subject may also claim compensation for non-pecuniary harm (grievance fee).
Claims for damages or compensation for non-pecuniary harm may primarily be asserted against the data controller. The data processor is liable for damages only if it violated the rules applicable to it or failed to follow the data controller’s lawful instructions; in other words, the data processor is not liable for errors committed by the data controller.
The IT tools and solutions used for data management, especially the security systems, are chosen and used in such a way that the processed personal data is accessible to those authorized to do so, its authenticity and authentication are ensured, its immutability can be verified, and it is protected against unauthorized access.
Taking into account the current level of technical development, we ensure the security and protection of our data management with technical, organizational and organizational measures that ensure an adequate level of protection for your personal data.
September 10, 2026