Data Processing Statement
Privacy Notice
1.1 Preamble
This Privacy Notice applies to every domain from which this system is officially accessible, and it also extends to the legal relationships of the applications and networks connected to it. The Document is placed in the footer of the Website, is available in several languages, is effective from the date indicated and remains in force until revoked.
This notice provides information on the processing of personal data; it is not a contractual term and does not require a declaration of acceptance. The contractual terms are set out in the General Terms and Conditions, which you accept separately and expressly during the ordering process.
The Operator may amend the content of the Document. Any amendment shall not have retroactive effect, and we will provide information about material changes on the Website.
1.2 Data controller, operator
Enternova Kft.
2161 Csomád, Szent István utca 48., Hungary
Tax number: HU24892955
Data protection contact: [email protected], or via the contact form found in the footer of the website by selecting the "Data protection question" topic. The form is accessible to anyone, without registration or purchase.
Application development: NOVA26
1.3 Data processors and data transfer partners
| Partner | Activity | Registered office | Safeguards |
|---|---|---|---|
| Stripe, Inc. | Payment processing | USA / Ireland | EU-US Data Privacy Framework |
| ClickSend (Synph Pty Ltd) | Transactional SMS sending | Australia | SCC contractual safeguards |
| Cloudflare, Inc. | CDN and web security | USA | EU-US Data Privacy Framework |
| KBOSS.hu Kft. (Számlázz.hu) | Invoice issuance | Hungary (EU) | Data transfer within the EU |
| Google LLC (Google Ads) | Conversion measurement (from the URL parameter of the click, without any storage on the visitor's device – no cookies, no localStorage; exclusively via a server-side API, after the order has been fulfilled) | USA / Ireland | EU-US Data Privacy Framework |
| Tárhely.Eu Szolgáltató Kft. | Hosting services, server operation | Hungary (EU) | Data processing within the EU, contract pursuant to Article 28 GDPR |
| NOVA26 | Application and system development, technical support | Hungary (EU) | Data processing within the EU, contract pursuant to Article 28 GDPR |
| National toll operators and their official registration partners | E-vignette registration in accordance with the regulations of the given country | EU / destination countries | In accordance with the laws of the given country |
Data transfers to the USA take place on the basis of the EU-US Data Privacy Framework. Data transfers to Australia are based on Standard Contractual Clauses (SCC) contractual safeguards. We have concluded data processing agreements pursuant to Article 28 GDPR with our data processors.
With regard to the data transferred to them, the national toll operators qualify as independent data controllers: their data processing is governed by their own national laws. There is no joint controllership (Article 26 GDPR).
1.4 Definitions
- GDPR: the General Data Protection Regulation of the European Union (2016/679).
- Data processing: any operation or set of operations performed on personal data (collection, recording, organisation, storage, use, transfer, erasure, etc.).
- Controller: the person who determines the purposes and means of the data processing.
- Processor: the person who processes personal data on behalf of the controller.
- Operator, Company: the operator of the Website.
- Personal data: any information relating to an identified or identifiable natural person.
- Consent: any freely given, specific, informed and unambiguous indication of the data subject's wishes.
- Personal data breach: a breach of security leading to the destruction, loss, alteration or unauthorised disclosure of personal data.
- Third party: a person other than the data subject, the controller or the processor.
- User: visitors, users and customers of the Website (data subjects).
1.5 Principles of data processing
- Personal data are processed lawfully, fairly and in a transparent manner.
- Data are collected for specified, explicit and legitimate purposes.
- Data processing is limited to what is necessary for the purpose.
- Data are accurate and kept up to date; inaccurate data are rectified or erased.
- Data are stored only for as long as necessary.
- The security of the data is ensured by appropriate technical and organisational measures.
1.6 Automatically recorded data
When visiting the Website, the following logging parameters are automatically recorded: time of entry and exit, time spent and activity on the website, browser type, resolution and language, operating system and device type, as well as the IP address. The legal basis is legitimate interest pursuant to Article 6(1)(f) of the GDPR (secure operation of the system and prevention of misuse).
1.7 Data provided by the User
The scope of the data processed: personal name, e-mail address, telephone number, billing name, billing address, tax number, vehicle registration number, country of origin (country code), vehicle category, the validity period of the road use entitlement. The toll systems of certain countries may require the provision of further data as well: vehicle identification number (VIN), name of the vehicle's owner or operator, passport or identity document number. These additional data requirements are not based on the Operator's decision, but on the rules of the given country's official toll system; the data are transmitted exclusively to the relevant toll administrator for the purpose of completing the registration.
The purpose of the data processing: use of the Website, the conclusion and performance of the contract of purchase, the invoicing of fees, and the enforcement of claims arising therefrom.
Nature of the data provision: the provision of the above data is a precondition for the conclusion of the contract; in the absence thereof we are unable to fulfil the order. The provision of billing data is based on a statutory obligation.
1.8 Data categories, purposes, legal bases and retention periods
| Data category | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Identification data (name, e-mail, phone) | Conclusion and performance of the contract | GDPR Art. 6(1)(b) – performance of a contract | 5 years (limitation period under the Hungarian Civil Code); data forming part of accounting documents: 8 years |
| Billing data (name, address, amount) | Issuing invoices, tax compliance | GDPR Art. 6(1)(c) – legal obligation | 8 years (Section 169 of Act C of 2000) |
| Vehicle data (licence plate number, country code) | Registration of the e-vignette, performance of the contract | GDPR Art. 6(1)(b) – performance of a contract | 5 years |
| Country-specific additional data (chassis number/VIN, name of the owner or keeper, passport/document number) | Completing the registration required by the toll system of the given country | GDPR Art. 6(1)(b) – performance of a contract | 5 years |
| Payment data (card reference, transaction ID) | Processing of the payment | GDPR Art. 6(1)(b) – performance of a contract | 8 years (accounting document) |
| IP address, browser, session data | Security, abuse prevention | GDPR Art. 6(1)(f) – legitimate interest | 1 year |
| Google Ads click identifier (gclid) | Conversion measurement, business analysis | GDPR Art. 6(1)(f) – legitimate interest | 2 years |
| SMS data | Confirmation of the transaction | GDPR Art. 6(1)(b) – performance of a contract | 3 years |
| Customer service communication | Customer service, complaint handling | GDPR Art. 6(1)(b) and (f) | 3 years |
| Stripe risk assessment | Fraud prevention (by the payment processor) | GDPR Art. 6(1)(f) – legitimate interest | In accordance with the payment processor's own privacy policy, for as long as the fraud prevention purpose exists, but no longer than 8 years from the transaction (data related to accounting documents) |
Balancing of interests: for data processing based on legitimate interest (security logging, conversion measurement, fraud prevention) we have carried out a legitimate interest assessment (balancing test), a summary of which is available upon request. According to the outcome of the balancing test, these processing activities do not entail a disproportionate restriction on the rights of the data subjects.
1.9 Erasure of data
We fulfil the data subject's erasure request within one month at the latest (Article 12(3) GDPR); where the request is complex, this deadline may be extended by a further two months, of which we will provide information. In practice, we carry out the erasure within a considerably shorter period. Accounting documents constitute an exception, as we are required to retain them for 8 years pursuant to Act C of 2000 on Accounting.
Requests may be submitted at the e-mail address [email protected] or via the contact form found in the footer of the website. If it is not clear that the request has been submitted by the person entitled to do so, we may request additional identification data.
2.0 Cookies
Detailed information on the website's cookie management is provided in the separate Cookie Policy. The website currently uses only cookies strictly necessary for its operation (technical cookies); no analytical or marketing cookies, nor embedded external tracking codes, are in operation on it. Should we use any such tools, this would take place exclusively with your prior, explicit consent.
2.1 Consent management
The website uses exclusively cookies that are strictly necessary for its operation (technical cookies), for which — pursuant to Article 5(3) of Directive 2002/58/EC (ePrivacy), which exempts storage that is strictly necessary solely for the transmission of an electronic communication or for the provision of a service explicitly requested by the data subject — your consent is not required. In all other respects, Section 155 of Act C of 2003 on Electronic Communications governs the storage of, and access to, data on terminal equipment. Should we use analytics or marketing cookies in the future, we would do so exclusively with your prior, explicit consent. Refusing consent would be just as easy as giving it, and consent may be withdrawn at any time, just as easily; withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal (Article 7(3) GDPR).
2.2 Automated data processing
The processing of orders, the registration of the e-vignette and the sending of confirmations take place largely in an automated manner. However, no solely automated decision-making or profiling within the meaning of Article 22 GDPR takes place that would produce legal effects concerning you or similarly significantly affect you. In disputed or irregular cases, one of our staff members intervenes in the processing.
Stripe, as the payment processor, applies its own risk assessment system (Stripe Radar) for fraud prevention purposes. This is Stripe's own system; Enternova Kft. does not take automated decisions on the basis of this assessment.
2.3 Data transfers to third countries
Data transfers to the United States of America (Stripe, Cloudflare, Google) take place on the basis of the EU-US Data Privacy Framework. The data transfer to Australia (ClickSend) is based on the contractual safeguards of the Standard Contractual Clauses (SCC). A copy of these safeguards is made available upon request.
2.4 Data Protection Officer (DPO)
Enternova Kft. is not obliged under Article 37 GDPR to designate a data protection officer, as it is not a public authority, its core activities do not require regular and systematic monitoring of data subjects on a large scale, and it does not process special categories of data on a large scale. Data protection enquiries may be submitted at the e-mail address [email protected] or via the contact form found in the footer of the website.
3.1 Your rights
- Right to information and access (Article 15 GDPR): you may request information about which of your data we process, on what legal basis, for what purpose and for how long. We respond to such requests within one month at the latest.
- Right to rectification (Article 16): you may request the rectification of your inaccurate data.
- Right to erasure (Article 17): you may request the erasure of your data, with the exception of data subject to statutory retention obligations.
- Right to restriction of processing (Article 18): you may request the restriction of processing.
- Right to data portability (Article 20): you may receive the data you have provided to us in a structured, machine-readable format.
- Right to withdraw consent (Article 7(3)): you may withdraw your consent given to consent-based processing at any time, just as easily.
3.2 Right to object
You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interests (Article 6(1)(f) GDPR) — including security logging and conversion measurement. In the event of your objection, we will cease the processing unless there are compelling legitimate grounds which override your interests, or which relate to the establishment, exercise or defence of legal claims. In the event of an objection to processing for direct marketing purposes, we will erase the data for this purpose immediately and unconditionally.
3.3 Remedies
If you consider that unlawful data processing has taken place, you may lodge a complaint with the supervisory authority of the Member State of your habitual residence, place of work or the place of the alleged infringement, or with the Hungarian supervisory authority below (Article 77 GDPR):
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
1055 Budapest, Falk Miksa utca 9-11., Hungary
Postal address: 1363 Budapest, P.O. Box 9., Hungary
www.naih.hu
In addition, you may seek a judicial remedy (Article 79 GDPR), and if you have suffered damage as a result of the processing, you may claim compensation (Article 82 GDPR).
3.4 Data security
Data transmission takes place via an encrypted connection (SSL/TLS). Only authorised staff members may access the system, accesses are logged, and regular backups are made of the data. We have concluded contracts with our data processors in accordance with Article 28 GDPR. In the event of a personal data breach, we act in accordance with Articles 33-34 GDPR.
3.5 Final provisions
If you discover any error or omission in this notice, please notify us immediately at the e-mail address [email protected] or via the contact form in the footer of the website.
Legislation underlying the data processing:
- Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).
- Act CXII of 2011 on Informational Self-Determination and Freedom of Information.
- Act CVIII of 2001 on Electronic Commerce Services.
- Act C of 2003 on Electronic Communications (in particular Section 155).
- Act C of 2000 on Accounting (retention of accounting documents).
- Act V of 2013 on the Civil Code.
Effective from: 12 August 2026