1. Introduction

AutoWallis Nyrt., the parent company of the AutoWallis Group, as the data controller (hereinafter: the Data Controller), places the utmost importance on ensuring and protecting the rights relating to personal data of its customers, employees and all persons who come into contact with it (hereinafter: Data Subjects).

In this privacy notice (hereinafter: Notice), the Data Controller explains how it processes the personal data of Data Subjects.

Please note that the provisions of this Notice apply only to data relating to natural persons.

1.1. Data Controller and contact details

Name:                          AutoWallis Plc.

Registered office:          1097 Budapest, Könyves Kálmán körút 34. - HUNGARY

Company registration number:  01-10-047350

 Telephone number:       (+36) 1 551 5773

Email address:              info@autowallis.com

1.2. Data Protection Officer and contact details

The Data Controller – together with other companies belonging to the AutoWallis Group – employs a joint Data Protection Officer pursuant to the authorisation set out in Article 37(2) of the GDPR.

Email address:              adatvedelem@autowallis.com

1.3. Purpose of this Notice

The purpose of this Notice is to answer the following questions:

 1. What personal data we collect about you when we process it.

2. For what purpose and on what legal basis we do this.

3. How long personal data is stored.

4. If we transfer them to someone else.

5. What rights and remedies you have in relation to the processing.

1.4. General rules on data processing

Source of data

We typically obtain personal data directly from the data subject. If we come into possession of your personal data by other means, we will draw your attention to the details in the relevant data processing notice.

Provision of data

Providing data to us is generally not compulsory, but it may be a condition of entering into a contract, or in certain cases we may be legally obliged to process it. We will also draw your attention separately to the consequences of failing to provide data voluntarily and to any obligation to process data.

Data transfers to third countries

In line with standard business practice, as a data controller, we also use the services of providers based in third countries outside the EEA. Due to their third-country location, the personal data processed in connection with these services may, in certain cases, be transferred outside the EEA. For example, with Microsoft Office software or the LinkedIn platform, this may involve transfers to the USA. From a data protection perspective, we continuously monitor the compliance of these providers and their services. For example, we check whether these providers are listed in the EU-US Privacy Shield Register. In accordance with our own data protection requirements and those imposed upon us, we only use providers who offer substantial guarantees of data protection compliance for their services.

Profiling or automated decision-making

We do not typically use profiling or automated decision-making in our data processing activities. If we do so, we will draw your attention to the details in the context of the specific data processing activity.

Data Processorss

Our subcontractors who have access to personal data undertake, under contractual obligations, to comply with our instructions on data processing and with the applicable data protection regulations.

2. Description of specific data processing activities

We set out the details of each data processing activity below:

2.1. General communication

2.2. Data processing relating to shareholders (maintenance of the register of shareholders)

2.3. Preparation and performance of contracts

2.4. Marketing activities

2.5. Description of data processing relating to the shareholder newsletter

2.6. Surveying satisfaction with the provision of services or products

2.7. Maintenance of social media pages

2.8. Prize draws and promotions

2.9. Processing of contact details of service providers used

2.10. Data processing relating to job applications and recruitment

2.11. Processing of CVs as evidence against discrimination

2.12. Enforcement of data subjects’ rights

2.1. General Communication and Contacts

Purpose and Legal Basis of Data Processing

The purpose of maintaining contact is to provide general communication regarding queries arising in connection with our services and sales activities. This includes responding to and handling all enquiries concerning the operation of the business and technical information. The legal basis for data processing is Article 6(1)(f) of the GDPR: the Data Controller’s legitimate interest in maintaining contact.

You may object at any time to the processing of your personal data on the basis of legitimate interests.

Scope of Processed Personal Data

• Name (identification details)

• Email address / postal address / telephone number (contact details)

• Any other personal data provided in the enquiry

Data Retention Period (How long do we keep your data?)

We store personal data for as long as is relevant to the related matter and retain it until the subsequent annual data deletion or until an objection is raised against the processing of the data.

• IT service provider

• Hosting provider

• Social media provider

Data Recipients (Who do we share your data with?)

• Where applicable, an AutoWallis subsidiary or affiliate,

• a dealership or specialist workshop within our group of interests

2.2. Data Processing Relating to Shareholders (maintenance of the register of shareholders)

Purpose and Legal Basis of Data Processing

Act V of 2013 on the Civil Code (Ptk.) and Act CXX of 2001 on the Capital Market (Tpt.) require the Data Controller to maintain a public register of shareholders. The legal basis for data processing is compliance with a legal obligation (Article 6(1)(c) of the GDPR). The Data Controller processes shareholder data only to the extent that such processing is unavoidable in relation to the legal relationship with shareholders.

Scope of Processed Personal Data

• Identification and contact details, as well as data relating to shares

• Shareholder’s name and address

• Details of the shareholder’s shares (series, nominal value) and the number of shares,

• The shareholder’s percentage shareholding,

• In the case of jointly held shares, the name and address of the joint representative,

• Details of the shareholder’s authorised representative (all details contained in the power of attorney)

• Information contained in company resolutions relating to the maintenance of the share register (e.g. rejection of an application for registration, the circumstances thereof)

• The date of entry in the share register

• Data relating to dividend payments

• Data processed by the Company in the course of the exercise of shareholders’ rights (e.g. motions at general meetings)

Data Retention Period (How long do we keep your data?)

Pursuant to Section 3:246(4) of the Civil Code, data deleted from the share register must remain identifiable in accordance with the statutory obligation. Such data will continue to be stored for 5 years from the date of the joint-stock company’s conversion, merger, demerger or dissolution without a legal successor.

Data Processors

• Server provider

• Credit card terminal operator/Online payment service provider

• Invoicing software operator

• Accounting service provider

Data Recipients (Who do we share your data with?)

• KELER Central Securities Depository Ltd. Clearing House (for the purposes of owner verification)

• Banks, financial institutions

• Legal representative

• Third-party shareholders in connection with access to information

• The Data Controller, as an issuer, is supervised by the Magyar Nemzeti Bank; within the scope of exercising its regulatory powers, the Magyar Nemzeti Bank is entitled to access personal data processed by the Company

 The Data Controller draws the attention of shareholders to the fact that, under the law, the register of shareholders is a public document that anyone may inspect; consequently, anyone may access data relating to shareholders.

2.3. Preparation and Performance of the Contract

Purpose and Legal Basis of Data Processing

If you use any of our services, we process your personal data to conclude the relevant contract and fulfil our contractual obligations. The legal basis for processing is Article 6(1)(b) of the GDPR: the preparation and subsequent performance of a contract between the Data Controller and the Data Subject.

The provision of personal data is a prerequisite for entering into a contract; without it, we cannot enter into a contract with you or provide you with our service.

The Scope of Processed Personal Data

• Identification and contact details: name, address, email address, telephone number.

• Financial details: bank account number, billing details.

• Contract-related data: order and fulfilment details, contractual documents.

• Communication data: content of correspondence, documents relating to consultations.

• Other: any other information necessary for the preparation and performance of the contract.

Data Retention Period (How long do we keep your data?)

We process your data for the general limitation period following the contractual relationship (5 years).

Data Processors

• Server provider,

• Hosting provider,

• Invoicing software operator,

• Accounting service provider

2.4. Marketing Activities and Personalized Online Advertising

Purpose and Legal Basis of Data Processing

As part of our marketing activities, we process personal data to provide our customers and potential customers with relevant information, offers and promotions tailored to their interests. Where they have subscribed, we send them newsletters.

Please note that as part of our marketing activities, we also promote services and products provided by our partners and third parties. In this context, we use targeted (personalised) online advertising (remarketing) and audience-targeting systems, utilising external advertising platforms (in particular Google and Meta) for these purposes.

Legal basis for data processing – Article 6(1)(a) of the GDPR: Your explicit consent, which you have given for marketing communications (and/or the use of marketing cookies on the website). Our cookie policy is also available on our website.

You may withdraw your consent at any time; in this case, we will erase your data and will no longer process it for this purpose. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of your consent prior to withdrawal.

Scope of Processed Personal Data

• Name, other identifiers (identification data)

• Email address / postal address / telephone number (contact details)

• Contact details based on the settings of the platform used

• Preferences

• Any data that you have brought to our attention during your dealings with us.

Source of personal data

• Data subject

Data Retention Period (How long do we keep your data?)

• Until consent is withdrawn or

• at the latest, for 5 years following the end of the contractual relationship between us or

• the last contact.

Data Processors

• IT service provider

• Server provider

• Email service provider

• In the case of advertising campaigns, the agency managing the advertising

• Social media provider

• Newsletter provider

Data Recipients (Who do we share your data with?)

• Where applicable, an AutoWallis subsidiary or affiliate,

• a dealership or specialist workshop within our group of companies

Profiling or automated decision-making

During data processing, a profile is created based on data subjects’ interests and purchasing preferences to support targeted marketing activities. This profile defines the categories of advertisements displayed (for example, by age group or geographical area) and has no other decision-making or legal implications.

The logic applied when creating a profile from your data: categorisation based on your preferences, our previous business relationship and your browsing patterns. The data subject has the right to request human intervention, to express their views and to challenge a decision made on the basis of the profile. You may send a request to this effect to the DPO’s address (point 1.2).

2.5. Data Processing in Relation to the Shareholder Newsletter

Purpose and Legal Basis of Data Processing

The newsletter provides general marketing and informational content to data subjects who have subscribed to it. In this context, you may receive news about the Company, market developments, new services, and other information of interest to the investor community, but not information required by law.

Legal basis for data processing: Article 6(1)(a) of the GDPR – the data subject’s voluntary, unambiguous and informed consent, given by subscribing to the newsletter.

You may withdraw your consent at any time; in this case, we will erase your data and will no longer process it for this purpose. Withdrawal of consent does not affect the lawfulness of data processing carried out on the basis of consent prior to withdrawal.

Scope of Processed Personal Data

• Name

• Email address

• Telephone number (optional)

Data Retention Period (How long do we keep your data?)

Until consent is withdrawn or for the duration of the newsletter service.

Data Processors

• Server provider

• Newsletter provider

Please note!

Unsubscribing from the shareholder newsletter does not mean that we, as the Data Controller, will no longer be able to contact you in any form. In certain cases, the Company has a legal obligation, and in others a legitimate interest, to contact its shareholders.

 We may send you information without your consent in the following cases:

a.     On the basis of a legal obligation (Article 6(1)(c) of the GDPR): Where the law expressly requires it.

Example: Sending an invitation to the annual general meeting, providing information on dividend payments.

b.     On the basis of legitimate interests (Article 6(1)(f) of the GDPR): Where the request is necessary to pursue the legitimate interests of the Company or its shareholders, and this interest does not disproportionately infringe upon your privacy.

Example: Information regarding a significant business development affecting one of our subsidiaries, that does not require the approval of the General Meeting but may affect the value of your investment.

2.6. Product and Service Satisfaction Surveys (Quality Assurance)

Purpose and Legal Basis of Data Processing

As part of our quality assurance process, we conduct surveys to gather our customers’ opinions and experiences of the quality of our services, as well as their level of satisfaction. The legal basis for data processing is Article 6(1)(f) of the GDPR: the Data Controller’s legitimate interest in quality assurance.

You may object at any time to the processing of your personal data on the basis of legitimate interests.

Scope of Processed Personal Data

• Name

• Identifier

• Fact and date of response

• Responses provided

Duration of storage of personal data

• Until an objection is raised against the processing of data, but

• at the latest, until the end of the contractual relationship between us or

• 5 years following the last contact

Data Processors

• IT service provider

• Call centre provider

• Hosting provider

2.7. Social Media

Purpose and Legal Basis for Data Processing

Social media is one of the most important communication platforms today. We are present on these platforms to share breaking news, events and promotions, and to engage with our followers to build community, respond to their questions and support them in other ways. Social media also enables us to run targeted marketing campaigns and market research activities to help us improve our services.

We process personal data for the purposes of maintaining our social media presence, promoting our services, and for communication and marketing. The legal basis for data processing is Article 6(1)(a) of the GDPR: consent of the data subject.

You may withdraw your consent at any time; in this case, we will erase your data and will no longer process it for this purpose. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to withdrawal.

Scope of Processed Personal Data

• Viewing a page, post, video, story or other content associated with the page

• Actions and interactions relating to stories, the page or posts (following, liking, sharing, commenting)

• Details of actions and interactions (date and time, location, browser data)

• User ID

Source of personal data

• Data subject

• The relevant social media site, e.g. Facebook page features

Duration of storage of personal data

Duration of social media use or until you object to the processing.

Data Processors

• Hosting provider

• Marketing agency

• The relevant social media platform (e.g. Facebook, LinkedIn)

Profiling or automated decision-making

During marketing activities, the relevant social media provider independently creates target groups based on advertising settings. The members of these target groups cannot be accessed or modified directly by the site owner (Data Controller). The data subject may choose not to allow targeted advertising whilst using social media.

In certain cases, the data controller acts jointly as a data controller with the relevant social media platform (Meta Platforms Ireland Limited, YouTube/Google LLC) pursuant to Article 26 of the GDPR. The agreement on joint data processing is publicly available in the platform’s terms of use.

2.8. Sweepstakes and Promotions

Purpose and Legal Basis of Data Processing

When organising prize draws and promotions, we use participants’ data to record their participation, verify eligibility, and ensure the prize is delivered to the winner. Legal basis for data processing – Article 6(1)(b) of the GDPR: Data processing is necessary for the preparation and performance of a contract between the Data Controller and the entrant.

The provision of personal data is voluntary, but failure to provide it will result in an invalid entry or exclusion from the prize draw.

Scope of Processed Personal Data

• Name

• Fact and date of entry,

• Subject and value of the prize draw or promotion

• Fact and date of winning

Data Retention Period (How long do we keep your data?)

Data relating to prize draws and promotions will be deleted five years after they conclude. An exception is data relating to financial accounting, which we retain for the period stipulated by the Accounting Act (8 years).

Data Processors

• IT service provider

• Hosting provider

• Email service provider.

• IT service provider

• In the case of marketing campaigns: marketing agency

• Social media provider

• CRM platform provider

Data Recipients (Who do we share your data with?)

• Where applicable, an AutoWallis subsidiary or affiliate,

• a dealership or specialist workshop within our group of interests

2.9. Processing of Contact Details of Service Providers

Purpose and Legal Basis of Data Processing

We process the personal data of staff involved in our work processes to maintain contact with our contractual partners and businesses that contact us, and to ensure cooperation. The legal basis for processing is Article 6(1)(f) of the GDPR: the Data Controller’s legitimate interest in maintaining contact with contractual partners.

You may object at any time to the processing of your personal data on the basis of legitimate interests.

Scope of Processed Personal Data

• Name,

• Contact details: email address, telephone number,

• Company name, job title

• The content of correspondence and meetings.

• Dates and other organisational information.

Source of personal data

The data is provided by the contact person’s employer or the contractual partner.

Data Retention Period (How long do we keep your data?)

For the duration of the contractual relationship or the relevant period of contact, until the retention period for the relevant document expires (for example, invoices are retained for 8 years and contracts for 5 years in Hungary).

Data Processors

• IT service provider

• Server provider

• Email provider

Data Recipients (Who do we share your data with?)

·       In the event of a data breach, any AutoWallis subsidiary or affiliate

2.10. Data Processing in Connection with Job Applications and Recruitment

We’d be delighted if you’d like to join our team and apply for one of our advertised roles. For the selection process, we’ll process your name, email address, telephone number, CV and any other personal information you send us.

Purpose and Legal Basis of Data Processing

When you apply for a job vacancy advertised by the Data Controller, we process your personal data to conduct the selection process, invite you to an interview, assess your eligibility, carry out the recruitment procedure and fill the vacancy. The legal basis for data processing is Article 6(1)(f) of the GDPR: the Data Controller’s legitimate interest in recruitment. If you also provide special categories of personal data in connection with your application, the condition for processing is your voluntary, informed and explicit consent in accordance with Article 9(2)(a) of the GDPR.

No special categories of personal data (e.g. racial or ethnic origin, political opinions, religious or philosophical beliefs, health data, etc.) are required to apply for this vacancy. Please refrain from providing such data. If, despite our request, you still consider it important to provide such data, please clearly state that you consent to the processing of this personal data (Article 9(2)(a) of the GDPR). In the absence of your explicit, separate consent, we will delete this data.

You may object at any time to the processing of your personal data on the basis of a legitimate interest.

Scope of Processed Personal Data

• Basic data: name, email address, telephone number.

• Identification data: place and date of birth, photograph.

• Data required for selection: CV, references, certificates, presentation of identification documents.

• Any other data provided: any further personal information voluntarily provided by the data subject.

Source of personal data

• Data subject (in connection with the application, the data subject decides whether to provide data and the scope of such data)

• Headhunter

• Employment agency (outsourced recruitment activities)

• Job portal

• LinkedIn

• Internal referral

Data Retention Period (How long do we keep your data?)

We process the data for the duration of the selection process.

If a candidate is not selected, we may retain their data for a further maximum of one (1) year as a potential candidate, subject to their specific consent, for the purpose of contacting them regarding a possible future vacancy.

Data Processors

We use the following data processors in the course of our services:

• IT service provider

• Server provider

• Headhunter

• Job portal

Data Recipients (Who do we share your data with?)

• Where relevant, member company(ies) of the AutoWallis Group.

2.11. Processing of CVs as Evidence Against Discrimination

Purpose and Legal Basis of Data Processing

At the end of the recruitment process, we do not discard CVs from applicants who were unsuccessful in the selection process. The purpose of data processing is to enable the Data Controller to document and demonstrate that no discrimination occurred during the selection process. Legal basis for data processing – Article 6(1)(f) of the GDPR: The Data Controller’s legitimate interest in protecting its legal rights (for example, in relation to compliance with national or European Union legislation on equal treatment, such as the Act on Equal Treatment and the Promotion of Equal Opportunities in Hungary).

Scope of Processed Personal Data

Data collected and processed in connection with the application, such as

• Name

• Email address

• Telephone number

• Place and date of birth

• Photograph

• CV

• References and other personal information sent to us

Data Retention Period (How long do we keep your data?)

3 years following the conclusion of the selection process, taking into account the limitation period for labour law claims.

Data Processors

• Server provider

• HR service provider

2.12. Exercising Data Subject Rights

Purpose and Legal Basis of Data Processing

If, as a data subject, you contact our company regarding your personal data, we will process your data to respond to your enquiry, enforce your rights, fulfil our obligations under data protection regulations, and ensure accountability. Legal basis for data processing – Article 6(1)(c) of the GDPR: Compliance with a legal obligation to which the Data Controller is subject.

Scope of Processed Personal Data

• Name

• Email address

• Content of the enquiry,

• Data provided by the data subject in the context of exercising their rights

• Other personal data obtained during the identification process, etc.

Data Retention Period (How long do we keep your data?)

5 years from the date of receipt of the data subject’s request

Data Processors

• Server provider

• DPO/Company entrusted with data processing

Data Recipients (Who do we share your data with?)

• Where applicable, member company(ies) of the AutoWallis Group.

3. Rights of Data Subjects

As a data subject, you may, using the contact details provided above (1.1 and 1.2), request information about the processing of your personal data and access such data. You can also request the rectification of your personal data or—except for data processing necessary to enforce mandatory or legal claims—their erasure, withdrawal, and, where applicable, exercise your right to data portability. You may object to data processing based on legitimate interests at any time. To be recognized as a data subject, you must properly verify your identity (e.g., at a minimum, by writing from the email address you used to register).   

Upon your request, we will provide the requested information without delay, but no later than one month from receiving your request—provided the request is not unfounded or excessive—free of charge.

Right to be Informed

We provide information about data processing in a clear, transparent, and easily understandable way, using plain language. This document has been prepared in summary form for this purpose.

The Right of Access

You have the right to request a response from us confirming whether your personal data is being processed. If you provide sufficient proof of your identity and we are processing your personal data, you are entitled to receive information about the processing and a copy of your personal data.  

Right of Rectification

Any Data Subject can request the correction of their personal data processed by us if it is inaccurate for any reason, or ask for incomplete data to be completed. We may request additional information to clarify. 

Right to Erasure (‘Right to be Forgotten’)

You have the right to request the deletion of your personal data if any of the following conditions apply:  

• if the data is no longer needed for the purpose it was collected;  

• if you have withdrawn your consent and there is no other legal basis for processing;  

• if you object to the processing and we have no other legitimate grounds for processing that override your interests;  

• if the processing of the data is found to be illegal; or  

• ·       if we are legally required to delete the data.

Right to Restriction of Processing

You can request that the processing of your personal data be restricted in situations outlined by the GDPR. For example, this may apply when verifying the accuracy of your data, or when you request that data that would normally be deleted be retained to assert a legal claim. If processing is restricted, we will only store your personal data and will process it further only in exceptional cases. We will also notify you in advance before lifting the restriction on data processing.

Right to Data Portability

You have the right to receive your personal data from us in a structured, commonly used, machine-readable format and to transfer it to another data controller. We can usually fulfil such a request in MS Word or Excel. You also have the right to data portability if the processing is automated and the legal basis for processing is either your consent or the performance of a contract. 

Right to Object

You have the right to object at any time, on grounds relating to your specific situation, to the processing of your personal data based on the Data Controller’s legitimate interests. The Data Controller may continue processing the data only if there are compelling legitimate grounds for doing so, or if it is necessary for establishing, exercising, or defending legal claims. 

Right to Withdraw Consent

When we process your data based on your consent, you have the right to withdraw that consent at any time. If you do, we will stop processing your data. Withdrawing consent does not affect the lawfulness of any data processing that occurred before your withdrawal.

4. Procedural rules, legal remedies

Procedural rules

If you exercise any of the data subject rights described above, we will notify you of the actions taken in response to your request, or, if no action is taken, the reason why, without undue delay and, in any event, within one month of receiving the request.

If necessary, given the complexity of the request and the number of requests, this deadline may be extended by a further two months. We will notify you of any extension of the deadline—explaining the reasons for the delay—within one month of receiving your request.

Regardless of the submission format of your request, our response will be sent by email unless you explicitly request a different method.

We will notify all recipients to whom we have shared your personal data of any corrections, deletions, or restrictions on processing that we have made, unless this proves impossible or involves a disproportionate effort. At your request, we will also inform you of these recipients.

Remedies

In the process of managing, recording, processing, and transferring the personal data of Data Subjects, the Data Controller complies with Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation (“GDPR”), as well as other legal provisions and official recommendations relating to data protection and recruitment.

DPO - As a data subject, you may contact our Data Protection Officer with any questions, comments, or complaints regarding data processing using the contact details in Section 1.2.

Supervisory Authority - If you believe that we have violated your rights to data self-determination, you are entitled to submit a complaint to the Data Protection Authority at

[HU] National Authority for Data Protection and Freedom of Information (NAIH)

Hungary - 1363 Budapest, P.O. Box 9

+36 (1) 391-1400

ugyfelszolgalat@naih.hu

https://www.naih.hu/

Court - As a data subject, you can also file a lawsuit if you believe your personal data is being processed in violation of the laws or legal acts of the European Union relating to data processing.