Privacy policy

Effective: 25 August 2026

1. The data controller

Name / business name: Borics Krisztián e.v. (sole trader)
Registered address: 5130 Jászapáti, Pacsirta u. 21., Hungary
Tax number: 59531524-1-36
Represented by: Krisztián Borics
E-mail: borics.krisztian@devnullsec.hu
Phone: +36 30 570 9246
Website: https://devnullsec.hu

Data Protection Officer (DPO): under GDPR Article 37, the controller is not required to appoint a Data Protection Officer.

2. Purpose of this notice and legal background

This notice explains what personal data the Controller processes, for what purpose, on what legal basis and for how long, and what rights data subjects may exercise.

Processing is carried out under the following legislation:

GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council.
Infotv. – the Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information.
Ekertv. – the Hungarian Act CVIII of 2001 on Electronic Commerce Services.
Grt. – the Hungarian Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Business Advertising Activity.
Sztv. – the Hungarian Act C of 2000 on Accounting.

3. Principles of processing

The Controller processes personal data lawfully, fairly and transparently; collects it only for specified, explicit and legitimate purposes; stores it only for as long and to the extent necessary for that purpose; keeps it accurate; and secures it with appropriate technical and organisational measures.

4. Individual processing activities

4.1 Contact (form, e-mail, phone)

Purpose: Receiving and responding to enquiries, staying in touch
Data processed: Name, e-mail address, phone number, the content of the message, the time of the enquiry
Legal basis: Consent of the data subject – GDPR Art. 6(1)(a) (or steps prior to entering into a contract: Art. 6(1)(b))
Retention: 1 year after the enquiry is closed, or until consent is withdrawn

4.2 Order / contract performance

Purpose: Processing the order, performing the contract, delivery, customer service
Data processed: Name, billing and delivery address, e-mail address, phone number, order details
Legal basis: Performance of a contract – GDPR Art. 6(1)(b)
Retention: 5 years from termination of the contract (general limitation period under the Hungarian Civil Code)

4.3 Invoicing and bookkeeping obligations

Purpose: Compliance with statutory accounting and tax obligations
Data processed: Name, address, tax number, invoice details
Legal basis: Compliance with a legal obligation – GDPR Art. 6(1)(c)
Retention: 8 years – Sztv. Section 169(2)

5. Transfers to third countries

The Controller does not transfer personal data outside the European Economic Area.

6. Data security

The Controller protects data with appropriate technical and organisational measures against unauthorised access, alteration, transmission, disclosure, erasure or destruction. This includes an encrypted (HTTPS) connection, password protection, access control and regular backups. Only authorised staff may access the data.

The Controller does not carry out automated decision-making or profiling.

7. Data subject rights

Under the GDPR, data subjects may exercise the following rights:

Access (Art. 15) – information on what data is processed, and a copy of it.
Rectification (Art. 16) – correction of inaccurate data, completion of incomplete data.
Erasure / "the right to be forgotten" (Art. 17) – requesting deletion of the data where the conditions are met.
Restriction of processing (Art. 18)
Data portability (Art. 20) – requesting a structured, machine-readable copy, or its transmission to another controller.
Objection (Art. 21) – objecting to processing based on legitimate interest; for direct marketing this can be exercised at any time, without restriction.
Withdrawing consent (Art. 7(3)) – at any time, free of charge; this does not affect the lawfulness of processing before the withdrawal.

Requests can be submitted by e-mail to borics.krisztian@devnullsec.hu or by letter to the registered address above. The Controller responds within one month at the latest; this may be extended by a further two months where necessary, taking into account the complexity of the request, of which the data subject will be informed.

8. Remedies

Supervisory authority

Name: National Authority for Data Protection and Freedom of Information (NAIH), Hungary
Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary
Postal address: 1363 Budapest, Pf. 9., Hungary
Phone: +36 (1) 391-1400
E-mail: ugyfelszolgalat@naih.hu
Website: www.naih.hu

Judicial remedy: the data subject may turn to the competent regional court (törvényszék) of their place of residence or stay in Hungary.

9. Changes to this notice

The Controller reserves the right to amend this notice unilaterally. The version currently in force is always available on this page. Data subjects will be informed in advance of any material change.