Privacy policy

AAA Events Korlátolt Felelősségű Társaság (registered office: 1026 Budapest, Riadó utca 5-11., Hungary; company registration number: 01-09-434029; tax number: 32623772-2-41; represented by: Molnár Viktor Zsolt, managing director, independently; hereinafter: the “Company” or the “controller”) hereby informs its contractual partners, the participants of its events and the visitors of its website (hereinafter together: the “data subject”) that it recognises the following data protection and data processing principles (hereinafter: the “Policy”) as binding on itself. The Company processes the personal data of data subjects in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: “GDPR” or the “Regulation”), Act V of 2013 on the Civil Code (hereinafter: the “Civil Code”), Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (hereinafter: the “Privacy Act”) and the legislation in force at any time. The Company reserves the right to amend this Policy if the legal background or its internal rules change; the version in force is always available on the website. In case of any discrepancy, the Hungarian version of this Policy prevails.

Contact details of the controller

Name: AAA Events Kft.
Registered office: 1026 Budapest, Riadó utca 5-11., Hungary
E-mail: office@aaaevents.hu
Website: https://aaaevents.hu

Scope of the Policy

This Policy covers the processing of the personal data of natural persons. It does not cover the processing of data relating to legal persons.

Lawfulness of processing

The processing of personal data is lawful only if and to the extent that at least one of the following applies:

1. the data subject has given consent to the processing of their personal data for one or more specific purposes;
2. processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract;
3. processing is necessary for compliance with a legal obligation to which the controller is subject;
4. processing is necessary in order to protect the vital interests of the data subject or of another natural person;
5. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
6. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Conditions for consent

Where processing is based on consent, the Company must be able to demonstrate that the data subject has consented to the processing of their personal data. If the data subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent must be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. The data subject has the right to withdraw their consent at any time; the withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. It must be as easy to withdraw consent as to give it.

Processing activities

Processing related to contractual partners

The Company always informs the natural persons in a legal relationship with it about the processing concerning them. Where, under Article 14(1) GDPR, the data is not obtained from the data subject, the Company informs the data subject about the details of the processing by publishing this Policy. When concluding a contract with a partner and performing the contract, the processing covers:

• the data of the representative and contact person of a contracting party that is a legal person (name, position, telephone number, e-mail address);
• the data of a partner who is a natural person (name, birth name, mother's name, place and date of birth, address, tax identification number) and their contact data (telephone number, e-mail address).

The purpose of the processing is the conclusion and performance of the contract and keeping contact. Its legal basis is Article 6(1)(b) GDPR (performance of a contract) and, for accounting documents, Article 6(1)(c) GDPR (legal obligation). Retention period: data qualifying as accounting documents are kept for 8 years from the closing of the matter under Section 169(2) of Act C of 2000 on Accounting; other data are kept for 5 years, in line with the general limitation period of the Civil Code.

Photos and recordings made at events

The Company may make or commission photo, video and audio recordings at the events it organises, and may publish them on its website, social media pages and reference materials to present its activities. Under Section 2:48(2) of the Civil Code, the consent of the data subject is not required for crowd shots and for recordings of public appearances; for recordings depicting a recognisable person individually, the Company asks for the data subject's consent to make and use the recording. The legal basis of the processing is Article 6(1)(a) GDPR (consent) or Article 6(1)(f) GDPR (the Company's legitimate interest in presenting its activities and references). The data subject may at any time request the removal of a recording of them at the Company's e-mail address above; the Company complies with such requests without undue delay.

Website visitors, contact requests

The Company operates a website to present its activities and to enable contact. On the website's contact form the data subject provides the topic of the enquiry, their name and e-mail address, and, at their choice, their company name, telephone number and message. The purpose of the processing is answering the enquiry and keeping contact; its legal basis is Article 6(1)(a) GDPR (the data subject's consent), given when the form is submitted. The data entered in the form reach the Company by e-mail; the Company keeps them for 6 months from the receipt of the enquiry, unless a contractual relationship arises from it. The data subject may withdraw their consent at any time, without restriction or justification, by a request sent to the Company's e-mail address above.

Cookies and web analytics

The website uses cookies and similar technologies. Strictly necessary cookies are indispensable for using the website and do not require consent. Statistical and marketing cookies and tags (Google Analytics, Google Ads, Meta Pixel, LinkedIn Insight Tag, HubSpot) operate only with the data subject's consent, according to the settings made in the cookie banner shown on the website (CookieYes); the consent can be changed or withdrawn at any time by reopening the banner or in the browser settings. The legal basis of the processing is Article 6(1)(a) GDPR. The retention periods of the cookies are shown in the cookie banner.

Processors and other recipients

The Company uses the following processors and service providers:

• Google Ireland Ltd. – Google Workspace (e-mail, document storage), Google Tag Manager, Google Analytics, Google Ads;
• Microsoft Ireland Operations Ltd. – Microsoft Azure (hosting of the website and its content, data centre within the European Union);
• Twilio Inc. – SendGrid (e-mail delivery of the contact form messages);
• ImageKit Private Ltd. – serving the website's images (content delivery network);
• CookieYes Ltd. – the cookie banner and the records of consents;
• HubSpot Ireland Ltd. – web analytics and marketing;
• Meta Platforms Ireland Ltd. – Meta Pixel, social media pages;
• LinkedIn Ireland Unlimited Company – LinkedIn Insight Tag, social media page.

Some providers may also use the systems of their parent companies outside the European Economic Area (in particular in the United States); such transfers take place on the basis of an adequacy decision of the European Commission (EU–US Data Privacy Framework) or standard contractual clauses.

Personal data breach

Under Article 4 GDPR, a personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed. The Company notifies a personal data breach to the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the breach is likely to result in a high risk to the rights and freedoms of natural persons, the Company also informs the data subject without undue delay, describing in clear and plain language the nature of the breach, the related information and the measures taken.

Rights of data subjects

Right to information

The data subject has a fundamental right to adequate and transparent information. At the data subject's request, the Company provides the information on the processing of personal data, the circumstances of the processing and the data subject's rights in a concise, transparent, intelligible and easily accessible form, using clear and plain language.

Right of access

The data subject has the right to obtain from the Company confirmation as to whether or not personal data concerning them are being processed, and, where that is the case, access to the personal data and the following information:

1. the purposes of the processing;
2. the categories of personal data concerned;
3. the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
4. the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
5. the existence of the right to request from the Company rectification or erasure of personal data or restriction of processing, or to object to such processing;
6. the right to lodge a complaint with a supervisory authority;
7. where the personal data are not collected from the data subject, any available information as to their source;
8. the existence of automated decision-making, including profiling, and meaningful information about the logic involved and the envisaged consequences of such processing.

The Company provides a copy of the personal data undergoing processing. For further copies the Company may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, the information is provided in a commonly used electronic form, unless otherwise requested. Upon credible proof of identity, the data subject may also receive the information orally.

Right to rectification

The data subject has the right to obtain from the Company without undue delay the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject also has the right to have incomplete personal data completed.

Right to erasure (right to be forgotten)

The data subject has the right to obtain from the Company the erasure of personal data concerning them without undue delay, and the Company is obliged to erase them where one of the following grounds applies:

1. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
2. the data subject withdraws the consent on which the processing is based, and there is no other legal ground for the processing;
3. the data subject objects to the processing and there are no overriding legitimate grounds for the processing;
4. the personal data have been unlawfully processed;
5. the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the Company is subject;
6. the personal data have been collected in relation to the offer of information society services.

Erasure cannot be requested where the processing is necessary in the cases set out in Article 17(3) of the Regulation. The Company erases the data indispensable for providing the service if the contract is not concluded after all or is terminated, unless this is excluded by law.

Right to restriction of processing

At the data subject's request, the Company restricts the processing where one of the following applies:

1. the accuracy of the personal data is contested by the data subject, for a period enabling the Company to verify the accuracy of the personal data;
2. the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
3. the Company no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
4. the data subject has objected to the processing, pending the verification whether the legitimate grounds of the Company override those of the data subject.

Where processing has been restricted, the personal data may, with the exception of storage, only be processed with the data subject's consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another person, or for reasons of important public interest.

Right to data portability

The data subject has the right to receive the personal data concerning them which they have provided to the Company in a structured, commonly used and machine-readable format, and to transmit those data to another controller without hindrance from the Company, where the processing is based on consent or on a contract and is carried out by automated means. Where technically feasible, the data subject may request that the personal data be transmitted directly from one controller to another.

Right to object

The data subject has the right to object, on grounds relating to their particular situation, at any time to the processing of personal data concerning them which is based on the legitimate interests of the Company or of a third party, including profiling based on those provisions. In case of an objection, the Company no longer processes the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims. Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning them for such marketing, including profiling to the extent that it is related to such direct marketing.

Automated decision-making, profiling

The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. The Company does not use such decision-making.

Right of withdrawal

The data subject has the right to withdraw their consent at any time.

Procedural rules

The Company informs the data subject of the action taken on a request under Articles 15 to 22 of the Regulation without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests; the Company informs the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic means, the information is provided by electronic means where possible, unless otherwise requested by the data subject.

If the Company does not take action on the request of the data subject, it informs the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

The Company provides the requested information free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the Company may charge a reasonable fee taking into account the administrative costs, or refuse to act on the request.

The Company communicates any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The Company informs the data subject about those recipients if the data subject requests it.

Compensation and damages for injury to personality rights

Any person who has suffered material or non-material damage as a result of an infringement of the Regulation has the right to receive compensation from the Company or the processor for the damage suffered. The Company or the processor is exempt from liability if it proves that it is not in any way responsible for the event giving rise to the damage.

Right to a judicial remedy

In case of an infringement of their rights, the data subject may bring an action against the Company before a court; at the data subject's choice, the action may also be brought before the regional court of the data subject's place of residence or stay. The court decides the case out of turn. The Company compensates the damage caused to others by the unlawful processing of the data subject's data or by the breach of data security requirements; in case of an infringement of the data subject's personality rights, the data subject may claim damages for injury to personality rights. The Company is exempt from liability if the damage was caused by an unavoidable cause outside the scope of the processing, and does not compensate the damage if it resulted from the intentional or grossly negligent conduct of the injured party. If you have any comments regarding our processing, please contact us at the e-mail address above.

Lodging a complaint

A complaint against a possible infringement related to the Company's processing may be lodged with the Hungarian National Authority for Data Protection and Freedom of Information:

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
1055 Budapest, Falk Miksa utca 9–11., Hungary
Postal address: 1363 Budapest, Pf. 9.
Telephone: +36 1 391 1400
E-mail: ugyfelszolgalat@naih.hu
Website: www.naih.hu

Effective from 12 October 2026.