Privacy Policy

Effective from: 14 September 2026

1. Data Controller

Requests concerning the Info Card system, user accounts and data processing may also be submitted at the following address:

info@infokartya.hu

2. Website Developer and Technical Data Processor

INFOtec Kft. is responsible for the development, maintenance, troubleshooting and technical support of the Info Card system.

In the course of performing its technical tasks, INFOtec Kft. may access personal data processed in the system only to the extent necessary for performing those tasks and may not use such data for its own purposes.

3. Hosting and E-mail Service Provider

The purpose of the data processing is to provide hosting for the infokartya.hu website and the Info Card system, to store databases and other data required for the operation of the system, and to provide the technical infrastructure for electronic mail services.

E-mails generated by the Info Card system are sent by WordPress using the SMTP protocol through the mail server provided by ELIN.hu Kft.

In providing the e-mail service, the service provider may process data necessary for delivery, including in particular the recipient’s e-mail address, sender information, technical data relating to the message and delivery log data, to the extent necessary for providing the service.

4. Registration and User Account

A user account is required to use the Info Card discount coupon system.

Personal data processed

• e-mail address,
• technical hash of the password,
• user identifier,
• technical data necessary for registration and the operation of the user account.

The system does not store the user’s password in readable form.

5. Requesting a Discount Coupon

When a coupon is requested, the system may record the following information in connection with the user’s account:

• the user’s identifier,
• the coupon requested,
• the date and time of the coupon request,
• the status of the request,
• the status of e-mail confirmation,
• the unique identifier of the issued coupon,
• the validity and current status of the coupon.

After a coupon request has been submitted, the system sends a confirmation message to the registered e-mail address. The coupon is issued after successful confirmation using the link contained in the e-mail.

6. Redemption of Discount Coupons

When a discount coupon is redeemed, the system records data in order to make the use of the coupon verifiable and to prevent unauthorised or repeated use of the same coupon.

For this purpose, the system may process:

• the user’s identifier,
• the coupon identifier,
• the type of coupon,
• the date and time of the coupon request and issuance,
• the fact and date/time of redemption,
• the place of redemption or the identifier of the accepting partner,
• the current redemption status,
• system data required for the technical execution of the redemption.

7. Redemption Using a Partner NFC Card

Discount coupons are redeemed using the Partner NFC Card associated with the participating location.

The NFC card is used for the technical identification of the partner or participating location. During redemption, the system links the relevant coupon to the participating location and records the fact and time of redemption.

Use of the NFC card itself does not provide access to photographs, contacts, messages or other personal content stored on the user’s mobile phone.

An NFC-enabled smartphone and an active internet connection are required to redeem a coupon.

8. System Messages and E-mails

The Data Controller may use the user’s registered e-mail address to send messages necessary for the operation of the service, including in particular:

• messages relating to registration,
• e-mail address confirmation,
• confirmation of a coupon request,
• notification of coupon issuance,
• resending a coupon,
• password reset messages,
• other system messages relating to the operation of the user account.

These are transactional messages related to the operation of the service and do not in themselves constitute marketing newsletters.

System messages are sent through the WordPress SMTP connection using the mail server provided by ELIN.hu Kft.

9. Google Analytics

The website uses Google Analytics to analyse website traffic and usage statistics.

Service provider: Google

According to information provided by Google, Google Analytics acts as a data processor within the meaning of the GDPR, and the customer has control over settings relating to data collection, access, retention and deletion.

The following data, among others, may be processed when using Google Analytics:

• pages visited and actions performed on the website,
• date, time and duration of visits,
• browser and device type,
• operating system,
• approximate geographical information,
• traffic source,
• technical identifiers and cookies,
• technical information associated with the IP address.

Google Analytics privacy settings allow, among other things, the configuration of data retention periods, the collection of detailed location and device data, Google Signals and advertising features.

The user may withdraw consent at any time through the website’s cookie/privacy settings. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

10. Google reCAPTCHA

The website may use Google reCAPTCHA to protect forms, registration and login functions and to detect automated abuse, spam and malicious bot traffic.

During the operation of reCAPTCHA, various technical and behavioural signals may be analysed, including information relating to the IP address, device and interaction with the website. According to Google, reCAPTCHA risk analysis may analyse, among other things, user behaviour, device information, IP addresses and previous interaction patterns.

From 2 April 2026, Google acts as a data processor in relation to reCAPTCHA Customer Data and, according to information provided by Google, processes such data as necessary for the operation and security of the service, threat detection and protection against abuse. The _grecaptcha cookie remains in use.

11. Cookies

The website may use cookies and similar technologies.

Strictly Necessary Cookies

These cookies are necessary for the basic operation of the website, maintaining user sessions, login functions, security features and providing services explicitly requested by the user.

As a general rule, separate consent is not required for the use of these cookies.

Statistical Cookies

Statistical cookies associated with Google Analytics allow the Data Controller to obtain information about how visitors use the website.

These cookies may be activated only after the user has given consent.

The exact names, providers, purposes and lifetimes of cookies should be described separately in a Cookie Policy.

12. Deletion of the User Account

The user may request deletion of their user account at any time by sending an e-mail to:

info@infokartya.hu

Deletion of the account entails deletion of personal data associated with the user account, as well as previous coupon request and coupon usage data recorded in the system.

This does not affect the possible continued retention of data where retention is required by law or necessary for the establishment, exercise or defence of legal claims.

13. Data Retention Period

As a general rule, personal data associated with the user account and coupons are processed by the Data Controller for as long as the user account remains active.

Technical log data relating to the operation and security of the system are retained only for as long as necessary to achieve their purpose.

The retention period for Google Analytics data is determined according to the Data Controller’s Google Analytics settings. Google provides options for configuring the retention period of Analytics data.

14. Data Transfers and External Service Providers

The Data Controller does not sell users’ personal data for marketing purposes.

Apart from the Data Controller, personal data may only be accessed by data processors and service providers whose involvement is necessary for the operation of the Info Card system.

The use of Google services may involve international transfers of personal data. Google Analytics also provides separate information concerning international data transfers.

Such transfers are subject to the GDPR-compliant transfer mechanisms and contractual safeguards applied by the service provider.

15. Data Security

The Data Controller and its data processors implement appropriate technical and organisational measures to protect personal data, in particular against:

• unauthorised access,
• unauthorised alteration,
• unauthorised disclosure,
• unauthorised deletion or destruction,
• accidental loss of data.

Access to systems processing personal data is subject to appropriate access permissions.

16. Rights of the Data Subject

In accordance with the GDPR and depending on the circumstances and legal basis of the relevant processing, the user is entitled to:

• request access to their personal data,
• request rectification of their personal data,
• request erasure of their personal data,
• request restriction of processing,
• exercise the right to data portability where the applicable conditions are met,
• object to processing based on legitimate interests,
• withdraw consent at any time where processing is based on consent.

According to information provided by the NAIH, data subjects may, among other things, request access, rectification, erasure and restriction of processing and, where the applicable conditions are met, exercise their rights to data portability and objection.

Requests relating to data subject rights may be submitted to:

info@infokartya.hu

17. Right to Object to Processing Based on Legitimate Interests

Where processing is based on the legitimate interests of the Data Controller – in particular, ensuring website security and protection against abuse – the data subject has the right to object to the processing on grounds relating to their particular situation.

In such a case, the Data Controller will cease processing the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing is necessary for the establishment, exercise or defence of legal claims.

18. Legal Remedies

If the user considers that the processing of their personal data infringes the GDPR or other applicable data protection legislation, they have the right to lodge a complaint with the supervisory authority.

According to information provided by the NAIH, a data subject has the right to lodge a complaint with the Authority if they consider that the processing of their personal data infringes the GDPR. Judicial remedies are also available.

19. Amendments to this Privacy Policy

The Data Controller reserves the right to amend this Privacy Policy, in particular where the operation of the Info Card system, the technology used, the method of data processing, the data processors involved or the applicable legislation changes.

The current version of this Privacy Policy is always available on the infokartya.hu website.