Legal information
Privacy notice
Information on the data processing connected to the adult training services of BDAT Solutions Kft.
This Privacy Notice explains how BDAT Solutions Kft. ("the Company", "we") processes the personal data of natural persons ("you") who interact with the Bdat.ACADEMY website (bdat.academy, bdatacademy.hu) and its training services. It provides the information required by Article 13 of the General Data Protection Regulation (GDPR).
1. Data controller
BDAT Solutions Kft.
Registered office: Kossuth Lajos utca 48–50., Building A, 1st floor, door 2, 1211 Budapest, Hungary
Company registration number: 01-09-377435 · EU VAT number: HU28960546
E-mail: [email protected]
Data protection contact: Gábor Sulok, Data Protection Officer (DPO), [email protected].
2. What data we process, why, and on what legal basis
| Activity | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Registration for an open course, waiting list | name, e-mail address, phone number, company name (optional), message (optional), the selected course and date | processing the registration, confirming the place, communication about the course | steps prior to a contract and performance of the contract (GDPR Art. 6(1)(b)) | until the course is closed and related claims are time-barred (general limitation period: 5 years); accounting records are kept for 8 years as required by Hungarian accounting law |
| Request for an in-house training proposal, general enquiries | name, e-mail address, phone number, company name, content of the message | answering the enquiry, preparing a proposal | steps prior to a contract (Art. 6(1)(b)); for other enquiries, our legitimate interest in responding and maintaining business contact (Art. 6(1)(f)) | until the enquiry is closed, or until the proposal expires; for contracts, as above |
| Ordering a self-paced (AI CERTs) course | name, e-mail address, company and billing details, the selected course | fulfilling the order and setting up access to the learning material on the partner's platform | performance of the contract (Art. 6(1)(b)) | until contractual claims are time-barred; accounting records for 8 years |
| Exams and certificates | participant's name, e-mail address, exam details | arranging the exam or exam voucher included in the course with the certification body | performance of the contract (Art. 6(1)(b)) | until the exam is completed and certificate-related claims are time-barred |
| Newsletter and course announcements | name, e-mail address | informing you about new courses and dates | consent (Art. 6(1)(a)), which you may withdraw at any time | until consent is withdrawn |
| Operating and protecting the website | IP address, browser and device data, time of the request, result of the bot check | serving and accelerating the website, protection against attacks and automated abuse | legitimate interest (Art. 6(1)(f)) | for the short period needed for security purposes, according to the provider's technical logging practice |
| Visit statistics and ad measurement (only with consent) | pseudonymous browser identifier, pages viewed, time of visit, device and browser data, the fact of an ad click and of a successful form submission | aggregated measurement of how the website is used, measuring the results of our ads and targeting ads | consent (Art. 6(1)(a)), which you may withdraw at any time via Cookie settings in the footer | cookies stored in your browser for the periods given in section 4 (on withdrawal the website deletes the measurement cookies on its own domain); in Google Analytics we keep the data for 14 months, while Google Ads, Meta and LinkedIn keep it under their own retention rules |
For registrations and proposal requests, the data not marked as optional in the table is required; without it we cannot fulfil your request. For self-paced courses and exams, passing on the participant's name and e-mail address is a condition of setting up access or arranging the exam; without it we cannot deliver the service. Subscribing to the newsletter is a separate consent, independent of any registration.
Where a registration or order is placed by an employer, we receive the participants' names and e-mail addresses from the employer and use them solely to organise the course or the exam. We ask the ordering party to inform the participants about this notice.
3. Processors and recipients
We process data with the help of the following providers under data processing agreements:
- Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA): hosting and content delivery of the website, storage of registrations, and bot protection (Turnstile). Cloudflare processes technical data such as IP addresses to operate and secure the website.
- Brevo (Sendinblue SAS, 7 rue de Madrid, 75008 Paris, France): transactional e-mails (confirmations) and newsletters.
- Microsoft Ireland Operations Ltd. (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland): e-mail and office document management (Microsoft 365).
The following organisations process the data they receive from us as independent controllers, under their own rules and not on our instructions, to the extent necessary to deliver the service:
- AI CERTs (United States): the learning material and exam of self-paced AI courses are provided on the partner's own online platform. To set up your access we pass on your name and e-mail address; on the platform the partner's own privacy rules also apply. We inform you about this separately on the course page before you order.
- The Open Group and PeopleCert (and their appointed exam centres): accredited TOGAF® and ITIL® exams, issuing exam vouchers and certificates.
With your consent, we use tools from the following providers to measure visits, track the results of our ads and target our ads. They load only after you consent; without consent no measurement or marketing cookie is placed.
- Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). For Google Analytics, Google acts on our behalf as a processor; for Google Ads, Google processes the data it receives for measuring and serving ads as an independent controller under its own rules. Google's privacy policy
- Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland): Meta Pixel. For the collection and transmission of the data to Meta, the Company and Meta are joint controllers (Art. 26 GDPR) under Meta's Controller Addendum; for any further processing Meta is an independent controller. Meta's privacy policy
- LinkedIn Ireland Unlimited Company (Wilton Plaza, Wilton Place, Dublin 2, Ireland): LinkedIn Insight Tag. LinkedIn processes the data under the LinkedIn advertising terms and also uses it for its own purposes as an independent controller when measuring and serving ads. LinkedIn's privacy policy
Beyond this, we disclose personal data to third parties only where required by law or with your explicit consent.
4. Cookies and similar technologies
The website uses local storage needed for it to work and, with your consent, statistics and marketing cookies. Without consent no measurement or marketing cookie is placed. On the cookie banner shown at your first visit you decide by category, and you can change or withdraw your decision at any time via the Cookie settings link in the footer. Technical data needed for the bot check is processed by Cloudflare in its own systems.
| Name | Type | Data | Lifetime | Purpose | Third party? |
|---|---|---|---|---|---|
| bdat-consent | essential (local storage) | your cookie consent decision | until deleted | remembers your choice on the cookie banner so that only the approved measurements load | no |
| bdat-form:* | essential (session storage) | what you typed into a form | until the browser tab is closed | restores the form fields after a failed submission so you do not have to type them again | no |
| bdat-lead:* | statistics and marketing (session storage, after consent) | a flag that a submission succeeded (value: 1) | until the browser tab is closed | so that the same submission is not counted twice on reload | no |
| _ga, _ga_* | statistics (after consent) | pseudonymous visitor identifier, time of visit, pages viewed | 2 years | Google Analytics: aggregated visit statistics | yes (Google) |
| _gcl_au, _gcl_aw and other _gcl_* cookies | marketing (after consent) | browser identifier; for ad clicks, the click identifier | 3 months | Google Ads: measuring the results of our Google ads | yes (Google) |
| _fbp, _fbc | marketing (after consent) | browser identifier; for ad clicks, the click identifier | 3 months | Meta Pixel: measuring the reach and results of our Facebook and Instagram ads, targeting | yes (Meta) |
| li_fat_id, li_sugr, li_gc, lidc, bcookie, UserMatchHistory, AnalyticsSyncHistory | marketing (after consent) | consent state, browser identifier; for ad clicks, the click identifier | lidc: 1 day; li_fat_id, UserMatchHistory, AnalyticsSyncHistory: 30 days; li_sugr: 90 days; li_gc: 6 months; bcookie: 1 year | LinkedIn Insight Tag: measuring the reach and results of our LinkedIn ads, targeting | yes (LinkedIn) |
5. Transfers to third countries
Among the providers and recipients listed above, Cloudflare (a processor) as well as AI CERTs and the certification bodies (independent controllers) may process data outside the European Economic Area, for example in the United States. With your consent, Google (as a processor for Google Analytics and an independent controller for Google Ads), Meta (as a joint or independent controller) and LinkedIn (as an independent controller) may also process data at their US affiliates; these providers transfer data on the basis of their certification under the EU–US Data Privacy Framework or standard contractual clauses. We transfer data only under the conditions of Chapter V of the GDPR (on the basis of an adequacy decision of the European Commission or standard contractual clauses); information on the legal basis and safeguards of a specific transfer is available on request.
6. Your rights
- Access: you may ask which personal data we process about you and request a copy.
- Rectification: you may ask us to correct inaccurate or incomplete data.
- Erasure: you may ask us to delete your data where there is no longer a legal basis or purpose for processing.
- Restriction: in certain cases you may ask us to restrict processing.
- Data portability: you may receive the data processed on the basis of a contract or consent in a structured, machine-readable format.
- Objection: you may object to processing based on legitimate interest.
- Withdrawal of consent: you may unsubscribe from the newsletter at any time via the link in the footer of each e-mail or by e-mail, and you can change or withdraw your cookie consent via the Cookie settings link in the website footer; withdrawal does not affect the lawfulness of earlier processing.
You may send your request to our data protection contact ([email protected]) or to [email protected]; we respond within one month, and for complex or numerous requests this period may be extended by up to two months, of which we will inform you.
7. Complaints
If you believe that we process your data unlawfully, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, Falk Miksa utca 9–11, 1055 Budapest, Hungary; postal address: P.O. Box 9, 1363 Budapest, Hungary; [email protected]; www.naih.hu), with the supervisory authority of your own country, or bring the matter before a court.
8. Data security
The Company operates an information security management system certified to ISO/IEC 27001:2022 (certification body: TAM CERT). Data is transmitted over encrypted connections, access is role-based, and registration data is stored in an access-controlled database separated from the public content of the website.
Our Information Security Policy is available here: Information Security Policy (PDF).
9. Changes to this notice
We update this notice as our services and the applicable law change. The current version is always available on this page. Last updated: 2026-10-03.