1. Scope of this notice and the controller
The controller is Fábián László Márió, sole trader, whose registered office is 1106 Budapest, Harmat köz 6., B lépcsőház, földszint 2., tax number is 67441765-1-42 and sole trader registration number is 50238561. For privacy enquiries and requests to exercise your data protection rights, please email iroda@officexpert.hu.
This notice covers officexpert.hu and weblapneked.hu, related enquiries and the service-related processing described below. This page presents the notice for the OfficeXpert brand. The two websites use a shared WordPress system; this shared technical infrastructure does not, by itself, mean that visitor profiles are linked.
The legal framework is provided by the GDPR, in particular Articles 5–6 and 12–22. We process only the data needed for each purpose.
2. Where do we obtain personal data?
Enquiry details are generally provided by the individual concerned by email. A business contact's details may also be provided by their employer or the organisation they represent. In that case, we inform the contact about the processing and the source of the data within a reasonable period, and no later than one month. If we contact them or disclose the data to another recipient sooner, we provide the information by that point at the latest. Technical data may arise from communication between the browser and server, or from security events.
You do not need to provide your name or email address simply to browse the website. To reply to an enquiry, we need contact details; to prepare a meaningful quotation, we need the relevant project details. Without these, we may be unable to reply or prepare an appropriate quotation. Providing other personal data is voluntary; please send only information that is necessary for the task.
Contacting OfficeXpert
Contact links on the public business pages open your own email application. The data in an email enquiry reaches the controller only when you actually send the message; opening the link does not send it.
3. Purposes and legal bases for processing
Individuals enquiring or contracting on their own behalf
We process the name, contact details, project information and correspondence necessary to prepare a quotation at an individual's request and to perform their contract under Article 6(1)(b) GDPR. This legal basis can also apply to a sole trader contracting on their own behalf if the processing is objectively necessary for the contract.
Retention of enquiries that do not result in a contract: there is currently no confirmed, uniform deletion deadline for this category of data that we can publish; the detailed retention and deletion arrangements require clarification. Where a contract is concluded, documents are retained separately according to their purpose: service delivery, invoicing or, where necessary, handling legal claims.
Business contacts and general business enquiries
We process the name, role, business contact details and relevant correspondence of a contact acting for a legal entity to communicate with them, prepare a quotation and perform the company's contract. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is orderly business communication. The same purpose-specific legal basis may apply when answering a general business question that does not involve preparing a contract with the individual concerned.
Where we rely on legitimate interests, we weigh the necessity of the processing against the individual's rights. You may object and request information about the substance of this assessment at our contact address. Retention: there is currently no confirmed, uniform deletion deadline for this category of data that we can publish; the detailed retention and deletion arrangements require clarification, or, for an ongoing client relationship, a separately determined period necessary for the relevant purpose.
Technical operation and server logs
Depending on the actual logging settings, serving the website, investigating faults and examining abuse may generate an IP address, timestamp, requested URL, browser details or error data. Necessary and proportionate processing for operation, availability and security relies on Article 6(1)(f) GDPR. The legitimate interest is to operate and protect the website.
Actual retention of the website's server logs: we have not yet received confirmation from the provider of the access-log retention period for the specific hosting package. The hosting provider's own notice states a maximum of three months for server logs; the specific service settings must be considered separately. Details: MikroVPS Privacy Notice.
Security events and administration
Depending on the event, local Solid Security Pro logs may contain an IP address, time, affected username or user ID, and request and event data. The current configuration uses database logging with a 60-day log rotation period. Logging relates to security events. The legal basis is Article 6(1)(f) GDPR; the legitimate interest is to detect, investigate and prevent unauthorised access and abuse.
We also process authorised administrators' sign-ins, access records and necessary activity data for secure operation. The administration area's sign-in technologies may differ from those used when a logged-out visitor browses public pages. Only people whose duties require it may access the logs.
Consumer complaints
We process the identification, contact and case details needed for a consumer complaint, the complaint itself and the substantive response to comply with a legal obligation: Article 6(1)(c) GDPR and Section 17/A of the Consumer Protection Act. Complaint records and responses covered by the Act are retained for three years.
Invoicing and related records
We process the name, address, tax number where justified, and transaction-record details needed for invoicing to comply with a legal obligation under Article 6(1)(c) GDPR. As a sole trader, we apply the relevant tax-law retention period: generally until the limitation period for tax assessment expires. The standard five-year period is calculated from 31 December of the year in which the relevant tax return, notification or payment falls due; statutory circumstances may extend it. Legal source: Sections 78 and 202–203 of the Act on the Rules of Taxation.
Active contractual communication continues as needed until performance and final settlement are complete. The rules for selecting and retaining contractual records subsequently needed for legal claims are: the arrangements for selecting, retaining and deleting records needed for legal claims after contractual performance have not yet been finalised; the starting point and review process linked to the applicable limitation period require further clarification. The same retention period cannot automatically be applied to all correspondence.
If particular records need to be retained longer to establish, exercise or defend a specific legal claim, we treat this as a separate, proportionate legitimate-interest purpose under Article 6(1)(f) GDPR; it does not automatically justify retaining data that is unnecessary for that claim.
4. Recipients and service providers
- Hosting and email
- NewPush Europe Kft. — MikroVPS; 1054 Budapest, Honvéd utca 8. 1. em. 2. ajtó; support@mikrovps.net. Website and email hosting, associated storage and technical support.
- Invoicing provider
- KBOSS.hu Kft. — Számlázz.hu; contact/postal address: 1031 Budapest, Záhony utca 7/D.; email: info@szamlazz.hu. The online invoicing service processes the name, billing address, tax number required under the applicable rules, and transaction-record data needed to issue and manage invoices.
- Accounting service provider
- Contracted external accounting provider (recipient category). Invoices and related transaction-record data needed for accounting and tax compliance are shared, including the name, billing address, tax number where justified, and details of the service and its price. Access is limited to what is necessary for the accounting task.
The invoicing provider's own notice and contact details: Számlázz.hu Privacy Notice, Számlázz.hu Legal Notice. The external accountant is listed here as a recipient category; when exercising your data protection rights, you can also ask the controller for information about the actual disclosure and recipient.
Service providers may access only the data necessary for their actual tasks. Their roles and data processing terms must be determined according to their services and agreements. Required data may be disclosed in response to a lawful request from an authority or court.
Solid Security network protection
Under the operating terms of network brute-force protection, suspicious login IP addresses may be checked centrally and shared across the network. The purpose is to detect and block abusive access attempts. Its operation is described in the manufacturer's product documentation explains the details.
The SolidWP brand's notice identifies Liquid Web, LLC as the controller under its own policy; its address is 2703 Ena Drive, Lansing, MI 48917, USA. Its specific role in the central network service, the data fields it receives and the central retention arrangements are: we have not yet been able to confirm the central service's specific recipient role, transferred data fields and retention period through product-specific provider documentation. The local 60-day log rotation period does not determine the central service's retention period. SolidWP / Liquid Web Privacy Notice.
5. International data transfers
Recipients outside the EEA, purposes and safeguards involved in the services actually used must be identified separately. The SolidWP notice refers to storage in the United States and, to a limited extent, the Netherlands; this alone does not establish the data centre or appropriate transfer safeguards for our specific central service.
The transfer arrangements verified for these services and how to obtain information about the safeguards: the specific international transfer arrangements and safeguards for Solid's network IP protection still await provider confirmation; the general notice available to us does not currently allow us to verify their adequacy.
6. Storage, deletion and backups
Data retention is limited by what is necessary for each processing purpose, applicable legal obligations and any specific legal claim. The detailed deletion process still requires clarification; this notice does not confirm that automatic deletion or backup rotation has been configured.
Backup retention and the arrangements for removing deleted data from backups: the actual retention, overwrite and deletion cycles for hosting and email backups still require provider confirmation; we also cannot currently specify how long it takes for data deleted from the active system to disappear from all backups. We restrict access according to duties and apply technical and organisational measures appropriate to the risks.
7. Your rights and requests
Where the relevant conditions are met, you may request access to your personal data and a copy of it, rectification, erasure or restriction of processing. The right to data portability may also apply to automated processing based on consent or a contract. Legal retention duties or other statutory exceptions may limit erasure.
You may object to processing based on legitimate interests on grounds relating to your particular situation. Where processing relies on consent, you may withdraw that consent without affecting the lawfulness of earlier processing. The conditions for each right are set out in Articles 15–22 GDPR.
You can send your request to iroda@officexpert.hu or to the controller's registered office. If necessary, we will ask for proportionate proof of identity. We normally respond within one month; the complexity or number of requests may justify an extension of up to two further months, with the reasons communicated within the first month. Exercising your rights is generally free of charge. If we refuse a request, we provide reasons and information about available remedies.
You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), or seek a judicial remedy. The authority's current contact details are available on its website.
8. Automation and other website features
In the public website operation examined, we do not use decisions based solely on automated processing that produce legal effects or similarly significant effects on an individual. Enquiries are assessed by a person. The security system may make technical protection decisions, such as blocking an abusive request.
The audit of the current public operation found no analytics or marketing tracking service, newsletter subscription, active booking feature or public commenting facility. The website does not use these features in the operation described here. Browser technologies are detailed in the cookie and browser storage notice.
We review this information before introducing a new processing purpose or service, and inform affected individuals in accordance with the applicable rules.