On the processing of customers’ personal data

Preamble

Data subjects must be provided with concise, transparent, intelligible and easily accessible information about the processing of their personal data in accordance with Articles 12–14 of the GDPR, as a general rule at the time of data collection. Such information may also be provided electronically.

Objecting to the processing of personal data or withdrawing consent does not automatically result in the termination of the contract; the consequences depend on the specific legal basis for the processing and whether the processing is necessary for the performance of the contract.

Processing of customers’ personal data

Pursuant to Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information and Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, GDPR, repealing Directive 95/46/EC), ATTRACT Kft., acting as the data controller, hereby informs its customers about the processing of personal data in connection with their contractual relationship.

The data controller

Name of the Data Controller: ATTRACT Kft.
Registered office: 7622 Pécs, Siklósi út 1/1., Hungary
Tax identification number: 11777364-2-02
Company registration number: 02-09-066227
Telephone number: +36 72 551 642
Email address: contact@nosiboo.com
Name of the Data Protection Officer (if applicable): –
Contact details of the Data Protection Officer: –
The Data Controller informs data subjects that no Data Protection Officer has been appointed, with reference to Article 37 of the GDPR. Data subjects may contact the Data Controller through any of the contact details provided in this section regarding complaints, comments or questions relating to the processing of their personal data.

Categories of Personal Data Processed, Purposes and Legal Bases of Processing

In addition to the above, the Data Controller’s employees may also access the data subject’s personal data to the extent and for the duration necessary to perform their work-related duties.

Social Media Pages

The Data Controller operates Meta and TikTok pages to periodically inform its followers about its business activities. Advertisements relating to the Data Controller’s business activities, offers from its partners and announcements of competitions and giveaways are also published on these Meta and TikTok pages.

Personal data generated on the Meta and TikTok pages (first and last name, profile picture where applicable, comments) are processed by the Data Controller for the purpose of maintaining contact with followers, similarly to contact established by telephone or email, on the basis of consent pursuant to Article 6(1)(a) of Regulation (EU) 2016/679 of the European Parliament and of the Council.

Use of cookies on the website

Cookies are packages of information consisting of letters and numbers that websites send to users’ browsers for the following purposes:

Cookies are pieces of information stored in or retrieved from a browser or device. Some cookies, particularly those containing unique identifiers, may involve the processing of personal data and allow visitors to be distinguished or tracked. There are both session cookies, which are deleted at the end of a browsing session, and persistent cookies.

Users can manage or delete cookies through their browser settings. Cookies that are not strictly necessary, including, as a general rule, analytics and marketing cookies, require prior informed consent before information is stored or accessed. Users must also be given the opportunity to refuse or withdraw their consent.

The use of website analytics services, including Google Analytics as mentioned in this document, may involve the processing of cookies and online identifiers. The conditions for using such technologies, the legal basis for processing and any potential international data transfers must be determined based on the actual settings in place. Analytics cookies that are not strictly necessary may only be activated on the basis of valid consent.

The names, purposes, providers, categories and expiry periods of the cookies actually used by the website must be included in an up-to-date cookie list. The retention period of analytics data depends on the specific settings of the service; it cannot be generally stated that all Google Analytics data is anonymous or that it is uniformly retained for two years.

By clicking on the links below, users can find information on how to access cookie management settings in the most commonly used browsers (Mozilla Firefox, Google Chrome, Internet Explorer and Safari):

Web browsers accept cookies by default, but users can also choose settings that reject cookies automatically or notify them when cookies are received.

Detailed information about the cookies used by the website is provided in the tables below.
For detailed information on the cookies used by the website, please refer to the attached table.

Withdrawal of consent

Processing based on consent only applies where the Data Controller can lawfully rely on Article 6(1)(a) of the GDPR.

The rules governing the withdrawal of consent do not automatically apply to processing necessary for the performance of a contract, processing based on a legal obligation or processing based on legitimate interests.

The legal basis for the following activities must be assessed separately according to their specific purposes and actual operation:

Consent may be withdrawn at any time, and withdrawing consent must be as easy as giving it.

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

Data subjects may also submit requests relating to the processing of their personal data by contacting contact@nosiboo.com.

Based on the request, the Data Controller will examine which data may be deleted and which data must continue to be processed under applicable law or another appropriate legal basis.

Contractual and legal obligation

The Data Controller is legally required to issue invoices for the services provided, containing the information prescribed by law. Accordingly, maintaining invoicing data and issuing invoices are statutory obligations.

If the Data Controller does not receive the information required by law from the data subject, it will be unable to provide the agreed service.

The legal basis for processing is compliance with the Data Controller’s legal obligations pursuant to Article 6(1)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council, Section 169(c) of Act CXXVII of 2007 on Value Added Tax, and Sections 167(1)(a)–(j) and 169(1) of Act C of 2000 on Accounting.

The Data Controller draws the data subject’s attention to the fact that the right to erasure cannot be exercised in respect of documents and records associated with a sales contract during the mandatory statutory retention period.

Duration of Data Processing (Data Retention Period)

Profiling during data processing

No profiling takes place during data processing.

Automated decision-making during data processing

No automated decision-making takes place during data processing.

Source of the personal data processed

The personal data processed are obtained directly from the data subject.

Other data processing

For any data processing activities not listed in this Privacy Policy, the Data Controller provides information at the time the data are collected.

The Data Controller informs data subjects that public authorities and other bodies authorised by law may contact the Data Controller for the purpose of obtaining information, requesting the disclosure or transfer of data, or requiring documents to be made available.

Even in such cases, the Data Controller will disclose only such personal data, and only to the extent, as is strictly necessary to fulfil the purpose of the request.

Data transfers:

Personal data are transferred to the following entities:

Data Processors

(Data processors are entities performing technical tasks related to data processing operations.)

Additional Data Processors

(Data processors are entities performing technical tasks related to data processing operations.)

Recipients of Personal Data

Recipients are natural or legal persons, public authorities, agencies or other bodies to which personal data are disclosed.

Transfers of Personal Data to Third Countries (Non-EU Countries)

Joint Controllership

Joint processing of personal data takes place in connection with the following activities:

Access to Personal Data and Data Security Measures

Access restrictions: Documents containing personal data are handled using appropriate security measures, and access is restricted to authorised personnel.

Documents containing personal data are stored in a structured system, separately from other records, throughout the company’s business processes.

Paper-based documents are stored in lockable offices. An alarm system operates in the offices to protect property and personal safety.

Data security measures: A business email system is used in the course of data processing activities.

Cloud-based storage is secured through user access management and password protection. Data are transferred to data controllers through this platform.

The network is protected by antivirus software and a firewall. Backups are performed at regular intervals.

Personal data are stored in a structured manner within the software systems used by the company. Centralised password and access rights management is in place.

The Data Controller selects its IT equipment and systems in such a way as to ensure that the processed data are accessible to authorised persons, that their authenticity is ensured, that their integrity can be verified, and that they are protected against unauthorised access.

The Data Controller’s IT systems and networks are protected against computer-assisted fraud, espionage, sabotage, vandalism, fire and flooding, as well as computer viruses, hacking and denial-of-service attacks.

The Data Controller ensures security through server-level and application-level protection measures.

Electronic communication and data processing may involve IT-related risks.

Pursuant to Article 32 of the GDPR, the Data Controller must implement appropriate technical and organisational measures proportionate to the risks involved.

In the event of a personal data breach or unlawful data processing, liability cannot be excluded by means of a general declaration. Compensation and liability are governed in particular by Article 82 of the GDPR.

Rights of Data Subjects

Right to information

Data subjects have the right to receive information about how their personal data will be processed before the processing begins.

Right to rectification

Data subjects have the right to request the rectification of inaccurate personal data concerning them without undue delay and, taking into account the purposes of processing, to have incomplete personal data completed (Article 16 of the GDPR).

Right of access

Data subjects have the right to obtain confirmation as to whether or not their personal data are being processed and, where that is the case, to access those data and the information specified in Article 15 of the GDPR.

Right to data portability

Where the conditions set out in Article 20 of the GDPR are met, data subjects have the right to receive the personal data they have provided in a structured, commonly used and machine-readable format and to transmit those data to another data controller.

Rights relating to automated decision-making

In the circumstances specified in Article 22 of the GDPR, data subjects have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning them or similarly significantly affects them.

Where applicable exceptions permit such decision-making, appropriate safeguards must be provided.

Lodging a Complaint

Data subjects have the right to lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information.

Name: Hungarian National Authority for Data Protection and Freedom of Information (NAIH)

Registered office: 1055 Budapest, Falk Miksa utca 9-11., Hungary

Postal address: 1063 Budapest, Pf.: 9., Hungary

Email: ugyfelszolgalat@naih.hu

Telephone: +36 (1) 391-1400

Fax: +36 (1) 391-1410

Website: https://naih.hu

Judicial Remedies

Pursuant to Articles 77–79 of the GDPR, data subjects may lodge a complaint with a supervisory authority and seek judicial remedies in accordance with the applicable legal requirements.

Additional provisions under Hungarian law are set out in Act CXII of 2011.

The Data Controller is required to respond to requests from data subjects without undue delay and, as a general rule, within one month of receiving the request.

Where necessary, this period may be extended by a further two months. The data subject must be informed of any such extension and the reasons for it within the original one-month period (Article 12(3)–(4) of the GDPR).

Data subjects may seek legal remedies against violations of their rights in accordance with applicable legislation.

Where their rights have been infringed, or in the cases described above, data subjects may bring legal proceedings against the Data Controller.

The court shall handle such proceedings as a matter of priority.

At the data subject’s discretion, proceedings may also be initiated before the competent regional court having jurisdiction over their place of residence or temporary residence.

A person who would otherwise lack legal capacity to participate in proceedings may also be a party to such proceedings.

The data protection authority may intervene in the proceedings in support of the data subject’s successful claim.

Compensation may be claimed for material or non-material damage suffered as a result of an infringement of the GDPR, subject to the conditions laid down in Article 82 of the GDPR.

The liability of the Data Controller and the data processor depends on the specific infringement, their respective roles and the conditions established by the Regulation.

A data controller or processor may be exempt from liability for compensation under Article 82 of the GDPR if it proves that it is in no way responsible for the event giving rise to the damage.

Mandatory rules governing liability and legal remedies cannot be overridden by a general exclusion of liability.

Date and place of entry into force: Pécs, 7 October 2026.