Privacy Notice
Effective date: 1 August 2026
Last modified: 17 August 2026
1. The Data Controller and the Purpose of this Notice
The Data Controller for the processing of personal data in connection with the services available on the secaas.hu website, enquiries, requests for quotations, conclusion of contracts, and client communications is:
Data Controller Name: SECaaS Kft.
Registered Office: 8887 Bázakerettye, Iskola u. 3A, Hungary
Postal Address: 1118 Budapest, Rodostó u. 4B 306, Hungary
Company Registration Number: 20-09-079397
Tax Number: 27457137-2-20
Email: info@secaas.hu
Telephone: +36 1 300 9052
Websites: secaas.hu ; awaretium.eu
Data Protection Officer: The Data Controller has not appointed a Data Protection Officer.
The purpose of this Privacy Notice is to provide transparent information on the processing of personal data relating to visitors to our website, enquirers, and individuals utilising our services. This Notice has been prepared, in particular, pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information, and Act CVIII of 2001 on Certain Aspects of Electronic Commerce Services and Information Society Services (E-Commerce Act).
2. Principles of Data Processing
SECaaS Kft. processes personal data lawfully, fairly, and in a transparent manner; collects data for specified, explicit, and legitimate purposes; restricts processing strictly to what is necessary; and implements appropriate technical and organisational measures to safeguard data against unauthorised access, alteration, loss, or disclosure.
3. Data Processing Activities
3.1. Website Visits and Security Logging
During the use of the website, technical log data may be generated to facilitate hosting and operational services.
- Processed Data: IP address, browser type, device and operating system data, timestamp of visit, pages accessed, and technical log data.
- Purpose: Ensuring the secure and proper operation of the website, troubleshooting, and the prevention and investigation of security incidents or cyber attacks.
- Legal Basis: Article 6(1)(f) GDPR – legitimate interest.
- Retention Period: As a general rule, up to 30 days; in the event of a security incident, until the matter is definitively resolved.
Legitimate Interest: Maintaining the security of our website, IT infrastructure, and users, resolving operational errors, and preventing fraudulent or malicious activities. Our legitimate interest is not overridden by the rights and freedoms of data subjects. Data subjects possess the right to object to this processing at any time.
3.2. Contact and Requests for Quotations
- Processed Data: Name, email address, telephone number, organisation name, job title, contents of the message, and other information provided in the course of communication.
- Purpose: Responding to enquiries, addressing queries, preparing tailored quotations, and assessing customer requirements.
- Legal Basis: In the event of a specific intent to enter into a contract or a request for a quote: Article 6(1)(b) GDPR (steps taken prior to entering into a contract). For general business enquiries: Article 6(1)(f) GDPR – legitimate interest.
- Retention Period: 1 year from the resolution/closing of the inquiry; in the event of contract conclusion, for the period applicable to contractual data processing.
Legitimate Interest: Responding to business enquiries and maintaining proportionate, purpose-bound communications with prospective clients. When contacting us, please refrain from submitting special category (sensitive) personal data or data belonging to third parties unless strictly necessary.
3.3. Contracting, Service Provision, and Contractual Performance
| Processed Data | Purpose | Legal Basis | Retention Period |
|---|---|---|---|
| Contractual and Client Relationship Data: Name, job title, email address, telephone number, and contractual statements of individual customers or designated contact persons/representatives of corporate customers. | Execution and operational management of the contract, operational coordination of service delivery, and contractual notices. | For natural person counterparties: Article 6(1)(b) GDPR (performance of a contract). For corporate contact persons: Article 6(1)(f) GDPR (legitimate interest – smooth execution of the contract and business communication). . | 5 years following termination of the contract or expiry of the civil law limitation period (Section 6:22 of the Hungarian Civil Code). |
| Invoicing and Financial Data: Billing name/company name, billing address, tax identification number / VAT number, bank account details, and records of payment transactions and credits. | Issuing proforma invoices, invoices, and accounting vouchers; settlement and collection of service fees; compliance with taxation and statutory accounting obligations. | Article 6(1)(c) GDPR (compliance with a legal obligation). | 8 years from invoice issuance, pursuant to Section 169(2) of Act C of 2000 on Accounting. |
| Professional Performance, Documentation, and Acceptance Data: Certificates of completion, minutes, administrative documentation of security audits/tests and specialist reviews, acceptance declarations, and project-related activity logs. | Performance of cybersecurity and professional engagements, verification of contractual compliance, quality assurance, and dispute resolution. | Article 6(1)(b) GDPR (performance of a contract) and, in the event of legal disputes, Article 6(1)(f) GDPR (legitimate interest – establishment, exercise, or defence of legal claims) | 5 years from termination of the contractual relationship or expiry of the limitation period. |
Consequences of Failure to Provide Data:
The provision of personal data necessary to access services, process orders, conclude contracts, and perform contractual obligations constitutes a contractual requirement. Providing data required for statutory invoicing and accounting compliance is a legal requirement. Without providing these details, SECaaS Kft. is unable to process enquiries or orders, conclude agreements, perform ordered specialist services, or issue compliant accounting vouchers and tax invoices.
3.4. Professional Newsletter and Direct Marketing
Consent may be withdrawn at any time, free of charge, without reason and without restriction:
- by clicking the „Unsubscribe” link in the footer of any dispatch; or
- by submitting a written notice to the contact email address set out in Section 1.
Following an unsubscribe request, details (name, email address) are retained on a suppression list pursuant to Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities (Advertising Act), ensuring no further marketing communications are transmitted.
| Processed Data | Purpose | Legal Basis | Retention Period |
|---|---|---|---|
| Name, email address, timestamp, and method of consent. | Sending professional newsletters, cybersecurity bulletins, company portfolios, and marketing messages relating to services; verifying the lawfulness of consent. | Article 6(1)(a) GDPR (consent of the data subject), in alignment with Section 6(1) of the Advertising Act. | Until consent is withdrawn (unsubscribed). |
| Suppression / Objection Data (Email address, timestamp of unsubscribe request). | Purpose: Maintaining records of opt-out requests (suppression list), preventing future contact, and complying with statutory suppression requirements. | Article 6(1)(c) GDPR (compliance with a legal obligation – Section 6(5) of the Advertising Act). | Until termination of direct marketing activities or upon the data subject’s explicit request for erasure. |
4. Data Processors, Recipients, and Data Transfers
SECaaS Kft. transfers or makes personal data accessible strictly to the extent necessary to fulfil the purposes set out in this Notice. Access is restricted to authorised personnel of SECaaS Kft.:
| Recipient / Processor | Role & Activitie | Data |
|---|---|---|
| Websupport Magyarország Kft. | Data Processor – web hosting and related infrastructure services. | Data stored on the website, submitted via webforms, and technical log data generated through website operations. |
| IT, Cloud, and Office Suite Providers (e.g., corporate email, CRM / task management systems). | Data Processor – provision of corporate email, calendar, document management, and customer relationship systems; facilitating business correspondence. | Contact details and contractual data provided during communication, quotation requests, and contractual performance. |
| Invoicing and Accountancy Service Providers (e.g., online invoicing platforms, accounting firms). | Data Processor – provision of electronic invoicing software, fulfillment of statutory accounting, bookkeeping, and tax obligations. | Billing name/company name, billing address, tax identification number, service description, fee, and payment details. |
| Legal advisors, professional consultants; regulatory authorities, courts, and bodies legally entitled to request data. | Independent recipients/controllers – establishment, exercise, and defence of legal claims; fulfilling statutory obligations and mandatory requests by official bodies or courts. | Strictly the personal data indispensable for fulfilling the specific mandate, resolving the dispute, or complying with official requests.. |
5. Cookies and Similar Technologies
The secaas.hu website may use strictly necessary cookies essential for its core functionality. Analytics, marketing, or other non-essential cookies and tracking technologies are activated only with your prior consent. Withholding or withdrawing consent will not adversely affect core browsing functionalities.
The cookie preference interface affords equal prominence to „Accept” and „Reject” options; settings may be adjusted by category and withdrawn at any time. A dedicated Cookie Policy available on the website details cookie names, purposes, providers, retention periods, and any third-country data transfers.
6. Automated Decision-Making
SECaaS Kft. does not employ automated decision-making processes, including profiling, that would produce legal effects concerning you or similarly significantly affect you.
7. Data Security
SECaaS Kft. applies appropriate technical and organisational measures to ensure a level of security appropriate to the nature, scope, context, and purposes of processing, as well as the risks to the rights and freedoms of data subjects.
Such measures include, but are not limited to: access governance and role-based access controls (RBAC), unique user identification, robust authentication and password policies, comprehensive logging, regular software updates and vulnerability management, encrypted communications, regular backups, and incident response and recovery procedures.
Access to personal data is restricted strictly to personnel who require such knowledge for the performance of their duties or contractual commitments.
8. Data Subject Rights and Requests
Subject to statutory conditions under the GDPR, you are entitled to exercise the rights of access, rectification, erasure („right to be forgotten”), restriction of processing, data portability, objection, and withdrawal of consent. Where data processing relies on legitimate interest, you maintain the right to object to processing at any time.
Requests may be submitted to the email address indicated in Section 1. Requests will be assessed and responded to without undue delay, and as a rule within one month of receipt. Where justified by complexity or volume, this period may be extended by two further months, with notification provided within the initial month. The right to erasure is not absolute, notably where processing remains required for statutory retention or legal claims defence.
9. Complaints and Legal Remedies
If you believe that the processing of your personal data infringes applicable data protection legislation, we encourage you to contact us first so that the issue may be reviewed promptly. You also possess the right to lodge a complaint with the supervisory authority:
National Authority for Data Protection and Freedom of Information (NAIH)
Address: Falk Miksa utca 9–11, 1055 Budapest, Hungary
Postal Address: 1363 Budapest, Pf. 9, Hungary
Telephone: +36 1 391 1400
Email: ugyfelszolgalat@naih.hu
Website: naih.hu
You may also seek judicial remedy before a court of law; at your election, proceedings may be initiated before the regional court (Törvényszék) having jurisdiction over your domicile or habitual residence.
10. Amendments to this Notice
SECaaS Kft. reserves the right to amend this Privacy Notice to reflect legislative changes, new processing activities, service expansions, or technological developments. The amended Notice shall apply from its published effective date. Please consult the current version prior to submitting personal data, requesting a quote, or engaging with our website.