Privacy notice
REGARDING DATA PROCESSING IN CONNECTION WITH THE ADULT EDUCATION SERVICES OF BDAT ACADEMY
1. Data of the Data Controller
Name of the Data Controller: BDAT Solutions Kft. . („Data Controller” or “Controller”)
Registered seat, mail address: 1211 Budapest, Kossuth Lajos Street 48-50. A. building, 1st floor, door 2;
Company registration number: 01-09-377435;
E-mail: admin@bdatsolutions.com
The purpose of this notice is to provide detailed information about the data processing activities related to the adult education services provided by the Data Controller. It provides information to you on what personal data we process, for what purposes, on what legal basis and for how long, to which organizations we transfer it, and what rights you can exercise in this context.
This notice applies to and shall be appropriately applied to anyone who participates in training or events organised by the Data Controller, expresses interest in its services, or uses its services.).
This notice is based on the General Data Protection Regulation of the European Union (“GDPR“), Act CXII of 2011 (“Information Act”) and other legislation on data protection.
2. Data Processing Related to Cookies
What are cookies?
A cookie is a small text file that a website you visit stores on your computer or other device used for browsing the internet. Your device stores the cookie for a specific period depending on the type of cookie. This allows the website to “remember” certain data and settings (e.g. login, language, font size, and other display preferences) for a defined period. Some cookies are also necessary to ensure the proper functioning of the website and to make all its content accessible to you. Cookies do not pose a security risk to your computer or other device and do not cause operational issues.
How, for what purpose, and on what legal basis do we use cookies on our website?
To ensure the uninterrupted use of our website, certain cookies (so-called session cookies) are automatically installed on your computer or other device when you visit our website. These cookies aim to guarantee the security of our website, ensure the error-free display of its content, and balance the website’s load. Without these cookies, the proper functioning of the website cannot be guaranteed. The personal data collected through these cookies (especially the IP address of your computer or other device) are processed based on our legitimate interest in the secure and smooth operation of our website, and only for the duration of your visit. These cookies are automatically deleted when you close your browser.
Some cookies serve only convenience functions or are used for statistical and web analytics purposes. These are important to us because they help us understand certain characteristics of our visitors (IP address, city, device used, browser, operating system type, and which subpages were visited and for how long). We use this data to compile general statistics and reports about website traffic and to improve and optimise our website, so we can provide more relevant content for you in the future. Additionally, marketing cookies are used to display advertisements tailored to your interests alongside the main content. Since these cookies are not strictly necessary for the operation of the website or the services we provide, but may be useful for the purposes mentioned above, we only use them with your consent. These cookies remain active as long as the functions they enable are needed or until you withdraw your consent. You can give your consent via the pop-up interface that appears when you visit the website. If you do not give your consent, these types of cookies will not be used on your device. You can withdraw your consent at any time by changing your cookie settings.
Please note that you can also manage cookies in your browser settings and delete all cookies stored on your computer or other device at any time.
The functions and properties of individual cookies are detailed in the pop-up window that appears when visiting the website, allowing you to give informed consent after reviewing the cookie details.
The functions and properties of individual cookies are as follows:
| Name | Category | Duration | Description |
| wp-wpml_current_language | functional cookie | session | Stores the current website language. |
| kv_gdpr_popup | functional cookie | 1 year | Stores whether the GDPR popup was shown. |
| _fbp | marketing cookie | 4 months | Facebook Pixel identifier used for ad performance tracking. |
| _ga | statistical cookie | 2 years | Google Analytics: tracks visitor behaviour using a unique ID. |
| _ga_NV64V6SGBN | statistical cookie | 2 years | Google Analytics: secondary identifier for detailed tracking. |
| _gcl_au | marketing cookie | 4 months | Google Ads conversion tracking cookie. |
| bcookie | marketing cookie | 1 year | LinkedIn browser ID for remarketing. |
| li_gc | consent cookie | 6 months | LinkedIn: stores cookie consent. |
| lidc | functional / routing cookie | 1 day | LinkedIn load-balancing cookie. |
3. Scope of personal data processed, purpose of processing, legal basis, and the retention period for personal data
| Scope of Processed Data | Purpose of Data Processing | Legal Basis for Processing | Retention Period |
| Personal data provided by individuals interested in our services listed on the BDAT website (bdat.academy) (data subject’s full name, email address, phone number, content of the inquiry) |
|
Explicit and voluntary consent of the data subject; legitimate interest of the parties | Until the data subject withdraws consent |
| Data provided by individuals interested in training programmes (“Applicant”) |
|
Explicit and voluntary consent of the applicant | Until consent is withdrawn or the contract is concluded |
| Data required for organising and fulfilling training under Act LXXVII of 2013 on Adult Education (“Fktv.”):
a) personal identification data of the participant, b) education ID number, c) email address, d) data on highest level of education, e) data related to qualifications, f) data on enrolment, completion, or dropout, g) data on evaluation and grading, h) data on payment obligations, i) attendance records |
|
|
Data is retained for 5 years from the fulfilment of the reporting obligation, in line with Section 20 (9) of the Fktv.
Accounting-related data is retained for 8 years. In the absence of specific legal or contractual provisions, if data processing is necessary for legal claims or protection of legal positions, retention follows the relevant limitation period (e.g. tax law). If no other applies, the general civil law limitation period of 5 years is used. |
| Bank account number, name of the financial institution | Settlement of payments related to contract performance
|
Performance of the contract | If the bank account number is part of an accounting document, the retention period is governed by the Accounting Act (at least 8 years) |
| Additional data required for issuing a certificate of successful training completion (e.g. place and date of birth, mother’s name)
|
Performance of the contract | Performance of the contract | Until the completion of the training |
| Photographs, audio recordings, and video recordings made during the Training of participants in the Training | Taking photos, audio recordings, and video recordings of the Data Subject, as well as using and publishing them, either on their own or together with other photos, audio recordings, and video recordings, on BDAT’s own online and offline communication channels, including social media platforms (Facebook, Instagram), for marketing and direct business acquisition purposes. | Express and voluntary consent of the Data Subject, legitimate interest of the parties | Until the Data Subject withdraws their consent |
| Name and email address of subscribers interested in the Data Controller’s news and offers (“Subscriber”) | Direct marketing in accordance with Section 6 of Act XLVIII of 2008 on the basic conditions and certain restrictions of economic advertising activities | Explicit and voluntary consent of the data subject, legitimate interest of the parties | Until the data subject withdraws their consent |
| Data collected through form submission (Microsoft Forms): name, e-mail address, phone number, and other form fields (e.g. interest, registration details, etc.) |
contact, application handling, managing enquiries, preparing offers | the data subject’s explicit and voluntary consent; legitimate interest of the parties | until the withdrawal of consent or until the completion of the administrative process |
In connection with the above data processing, please note that provision of your personal data that we process on the basis of a legal obligation or on the basis of preparation or performance of the contract is mandatory, because without the provision of these data we are not able to fulfil the obligations required by the law or undertaken by us in connection with the legal relationship.
You are entitled to object against the processing of your data at any time, if the processing is based on our legitimate interest (for detailed rules, see section 4.5). In such a situation, we will examine case-by-case whether Your right to object overrides our legitimate interests and, if so, we will stop the processing immediately. In such a case, however, certain processing may become impossible due to the absence of the necessary data.
If the data processing is based on Your consent, provision of Your consent is completely optional, and You are entitled to withdraw Your consent at any time without any adverse consequences for you. The withdrawal of Your consent does not affect the lawfulness of the processing prior to Your withdrawal.
In connection with most of the above-mentioned data, data processing for the purposes of legal claims may also arise, and in the table above the retention periods are defined in the view of the longest retention period. The legal basis of data processing for the purposes of legal claims is our legitimate interest in being able to defend our legal position by means of appropriate evidence in the event of a claim (e.g. a possible legal dispute arising from the adult education legal relationship).
4. Recipients of personal data, and categories of the recipients
Your personal data will only be transferred to other organisations (recipients) if it is strictly necessary due to a legal obligation or a binding decision, or if it is essential for our operations and the intended purpose.
Among the recipients, there are data processors who do not make independent decisions regarding your personal data but act solely based on our instructions. In some cases (primarily involving external photographers or videographers), we may not directly transfer your personal data to the processor, yet they may still process data concerning you (e.g. taking a photograph of you) under our instructions.
There are also independent data controllers among the recipients who are solely responsible for the lawful processing of the personal data they receive and use it for their own purposes.
Below you will find the recipients who may, in certain cases, have access to the personal data we process:
4.1. Names or categories of data processor
| Impressive.hu Informatikai Szolgáltató Kft. (registered office: 7030 Paks, Öreghegy Street 63, Building B, Hungary) | hosting service provider |
| KBOSS.hu Kft. (registered office: 1031 Budapest, Záhony utca 7.) | billing service provider |
| Google LLC (registered office: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) |
Google Analytics software provider |
| Microsoft Ireland Operations Limited (registered office: One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland) |
provider of the Microsoft Forms and M365 services (including data storage) |
| Brevo (Sendinblue SAS) (registered office: 106 boulevard de Sébastopol, 75003 Paris, France) |
newsletter and marketing communication service provider |
4.2. Names or categories of recipient Controllers
- Banks
- Law firms providing legal services to us
- National Tax and Customs Administration, police, prosecutor’s office, and other authorities depending on the case type
- Courts in case of legal disputes
- Independent judicial enforcement officers
- Adult Education Data Reporting System
5. Your Rights in relation to the data processing
During the processing of Your data, You are entitled to exercise the rights specified in this section.
You may exercise Your rights by contacting us via the contact details set out in section 1 above. All requests, questions and complaints received will be addressed individually and will be answered as soon as possible, but not later than 1 month.
You may request at any time:
- access to Your personal data
- the rectification, erasure of Your personal data, and in some cases
- the restriction of processing Your data
- You may object to the data processing, and
- You are entitled to data portability
You are also entitled to lodge a complaint with the supervisory authority, and legal redress.
In case the basis of the data processing is Your consent, You are also entitled to withdraw it.
5.1. Right of access
You are entitled to obtain from the Controller information as to whether we process or not Your personal data, and where that is the case, information on the means of the processing, including purposes of the processing, the recipients to whom Your personal data have been or will be disclosed, the source where we received Your personal data from, the retention period, Your rights relating to the data processing and if Your data is being transferred to third countries or international organization information on the safeguards. Simultaneously with exercising Your right of access, You may request a copy of Your personal data undergoing processing. If exercising Your right of access adversely affects the rights and freedoms of others, especially trade secrets or intellectual property rights of others, we may refuse to fulfill your request, to the extent necessary and proportionate.
5.2. Right to rectification
At Your request (e.g. in case of data change) we will rectify Your data that we process, and we ask You to notify us in case of any modifications to Your data, as determined above, since these data are relevant to your adult education legal relationship.
If there is any doubt about the modification in Your data, we may ask you to confirm the modifications by means of a document.
In case we have previously disclosed Your personal data affected by the rectification to a third person (i.e. to a recipient such as a data processor), we will inform such persons of the rectification without undue delay after the rectification, provided that the notification is not impossible or does not involve a disproportionate effort. At Your request we will inform you of these recipients.
5.3. Right to erasure (“right to be forgotten”)
Upon Your request we will erase, without undue delay, all or a part of Your personal data processed by us, provided that
- the data is no longer necessary for the purposes for which they were collected;
- the processing was based on Your consent which You withdrew, and there is no other legal basis for the processing;
- You objected to the data processing based on our legitimate interest, and we cannot demonstrate compelling legitimate grounds that override Your interests, rights and freedoms
- processing of Your personal data was unlawful, despite our best efforts
- it must be erased in order to fulfil a legal obligation imposed on the Controller.
In case we have previously disclosed Your personal data of which erasure You requested to a third person (i.e. to a recipient such as a data processor), we will inform such persons on the erasure, without undue delay after the erasure, provided that the notification is not impossible or does not involve a disproportionate effort. At Your request we inform you of these recipients.
Please note, that we are not always obliged to erase Your data as You requested, and if we erase some of your data, it may not be possible to maintain your education legal relationship.
5.4. Right to restriction of processing
You are entitled to request the restriction of the processing of Your personal data in the cases below. Restriction of processing means that, with the exception of storage, we will neither perform any data processing activity on Your data, nor will we use it in any way.
You may request the restriction of processing in the following situations:
- You contest the accuracy of the personal data, in which case, the restriction applies until we check the accuracy of the data;
- we have unlawfully processed the personal data, but You request restriction instead of erasure;
- the purpose for which we have carried out the processing no longer exists (and therefore the data should be erased), but You require such data for the establishment, exercise or defense of legal claims;
- You objected to the processing of Your data – in this case, the restriction shall remain in place until it is determined whether our legitimate interests override Your right to object, in other words until it is determined whether we may continue processing Your data despite of Your objection
In case we have previously disclosed Your personal data of which restriction of processing you requested to a third person (i.e. to a recipient such as a data processor), we will inform such persons on the restriction, without undue delay after the restriction, provided that the notification is not impossible or does not involve a disproportionate effort. At Your request we inform you of these recipients.
5.5. Right to object
You have the right to object to the processing of Your personal data, provided that the legal ground of the processing is our legitimate interest. In the event of Your objection, we are not obliged to fulfill such a request, if we can prove that:
- there exist compelling legitimate grounds for the processing which override Your right to object;
- processing is necessary for the establishment, exercise or defense of our legal claims.
In any other cases, we will stop processing Your personal data upon your objection.
5.6. Right to data portability
You are entitled to request that we provide you with a copy of Your personal data, the processing of which is based on a contractual legal basis or Your consent, in a structured, commonly used and machine-readable format (e.g. via e-mail, as a PDF attachment or on a USB stick) and You have the right to transmit those data to another controller without any hindrance from us. If exercising Your right determined in this section adversely affects the rights and freedoms of others, we may refuse to fulfill your request, to the extent necessary and proportionate.
5.7. Right to complain, judicial remedy
We always do our best not to give reason for any complaints.
If you believe that our processing infringes the provisions of the relevant data protection regulations, in particular the provisions of the GDPR, You are entitled to contact the supervisory authority competent after Your residence, place of work or the place where the alleged infringement took place. In Hungary the supervisory authority is the National Authority for Data Protection and Freedom of Information (“NAIH”).
Contact details of NAIH:
Website: http://naih.hu/
Address: 1055 Budapest, Falk Miksa utca 9-11.
Mailing address: 1363 Budapest, Pf.:9.
Phone: +36 1 391 1400
Fax: +36 1 391 1410
E-mail: ugyfelszolgalat@naih.hu
Besides the above, You may file a lawsuit with the competent court. You are also entitled to appeal a legally binding decision issued by the supervisory authority, as well as you are entitled to bring an action if the supervisory authority did not deal with your complaint or it did not inform you of the procedural developments or the outcome of your complaint within 3 months.
6. Profiling, automated decision-making
Please note, that we do not make any automated decisions or carry out profiling when processing Your personal data.
This means that:
- we do not analyze Your personal data in order to draw any additional conclusions about You; and
- no action is carried out by which an algorithm or artificial intelligence makes any decision about You.
7. Notification of third persons
Above, You may have read about data processing that entails the processing of third persons’ personal data (e.g. your relatives) in connection with your adult education legal relationship.
Therefore, we ask You to make this privacy notice available to such third persons, as we do not have direct contact with them. In this way, we can ensure that they are properly informed about the processing that concerns them.
Date: July 15, 2025.
* * *
