1. Purpose of the Information

This information sets out the data protection and data management principles applied by Cadline Limited Liability Company (abbreviated as: Cadline Kft., registered office: Montevideo utca 3/B, 1037 Budapest, Hungary, company registration number: 01-09-161726; hereinafter referred to as: “Company”, Service Provider, or “Data Controller”, or “Our Company”) and the Company’s data protection and data management policy.

This information, in accordance with the EU General Data Protection Regulation 2016/679 (GDPR) and the relevant Member State legislation, ensures that natural persons using the services, before using all of the Company's services, are informed about what personal data is processed, how their personal data is processed, what mandatory data protection rules apply to their legal relationship, what data processing practices the service provider engages in, what rights they have to protect their rights and interests, for what purpose and where their data can be transferred.

The Company primarily provides services to private individuals and businesses engaged in economic activity, within the framework of which it is inevitable that it also processes the data of natural persons. Most of the data processed by the Company is company data, relating to legal entities engaged in economic activity or unincorporated associations, which can be found in public databases, but the database also contains personal data relating to many natural persons, which cannot be separated during the provision of services.

This Policy also applies to the Personal Data of professionals whose business contact details appear in our Services.

The purpose of this Policy is to ensure that, in all areas of the services provided by the Company, every individual, regardless of nationality or place of residence, has their rights and fundamental freedoms, in particular the right to privacy, respected during the automatic processing of their personal data (data protection).

To remove your data please submit a request here.

2. Legal basis, purpose and method of Data Processing

2.1 The legal basis for Data Management within the framework of content provision is the provision of fundamental rights to information and expression of opinion, within the framework determined by law. In the case of using various services, the legal basis for Data Management is determined purpose by purpose: (a) your consent (Article 6(1)(a) GDPR) – e.g. direct marketing (newsletters, SMS), non-essential cookies and sharing data with business partners for their own marketing; (b) the performance of a contract with you or steps at your request prior to entering into a contract (Article 6(1)(b) GDPR) – e.g. account registration, provision of trial and purchased licenses, delivery and activation of license keys, order processing and support; (c) compliance with a legal obligation to which the Data Controller is subject (Article 6(1)(c) GDPR) – e.g. issuing and retaining invoices under Act C of 2000 on Accounting; (d) the legitimate interests of the Data Controller, balanced against your interests and fundamental rights (Article 6(1)(f) GDPR) – e.g. the secure and proper operation of the website and services, the prevention of fraud and license misuse, and the defense of legal claims; the balancing test is documented in Annex 1. Marketing activities are carried out exclusively on the basis of your consent. By registering on the Website, the Service Provider stores and uses the Personal Data provided during registration for the performance of the service contract; no separate consent is required for this purpose.

2.2 The purpose of the Data Processing carried out by the Data Controller is:

a) online content provision.

b) maintaining contact related to the Company's business activities.

c) identifying the User, maintaining contact with you.

d) identifying User rights (Services that you can use).

e)  ensuring the provision of services available through the Company's websites

f)  displaying personalized content and advertisements, preparing statistics

g)  facilitating the customization of the Services and advertisements used by you, using convenience functions.

h) managing and processing individual user inquiries.

i)  preparing statistics and analyses.

j) direct business acquisition or marketing inquiries (e.g. newsletter, SMS, etc.)

k) providing storage space for the publication of user-generated content (e.g. comments, forums, etc.);

l) organizing and conducting prize games in individual cases, notifying the winners and providing them with the prize;

m) in the case of an order, an e-mail confirming the order, creating a contract between the parties, defining its content, modifying it, monitoring its performance, delivering the ordered product or using the ordered service, invoicing the purchase price and enforcing related claims, documenting the adequacy of the performance, fulfilling accounting obligations.

n) Recruiting and selecting potential employees of the Data Controller,

o) technical development of the IT system.

p) protecting the rights of Users.

q) enforcing the legitimate interests of the Data Controller

r) facilitating the conclusion and performance of contracts within the scope of the Data Controller's activities.

Business Partners.

We may share Personal Data such as name, email, phone, location, and related data with our business partners, including for the purposes of sales, marketing and other related purposes. We may share Personal Data with our business partners in order to contact potential customers, market products and services and for other related purposes. Any such sharing for the business partners' own sales or marketing purposes takes place only with your separate, explicit consent, which you may withdraw at any time.

s) The Company sends the newsletter based on the user's consent. System messages, which contain information of particular importance or critical importance to the user regarding the use of the system, are sent on the basis of Article 6(1)(b) GDPR.

The legal basis applicable to each purpose listed above is summarized in the following table:

3. PRESENTATION OF DATA PROCESSING ACTIVITIES ACCORDING TO DATA PROCESSING PURPOSES

3.1. TRIAL (trial version)

Anyone can try out the ARCHLine.XP program. The purpose of the trial version is to introduce and test the tools supporting computer-aided design for a limited time. We ask visitors to our website for their personal data if they initiate the download and use of the ARCHLine.XP program.

3.1.1. Scope of processed data and purpose of data processing

3.1.2. Duration of data processing

Recorded personal data will be deleted within 90 days after the authorized trial period.

3.1.3.  Legal basis for data processing: Article 6(1)(b) GDPR – the e-mail address, name and phone number are necessary for the provision of the trial license and related support at your request prior to a potential license agreement; Article 6(1)(a) GDPR – your separate, voluntary consent for sending personalized information and newsletters (the trial can be downloaded and used without this consent); Article 6(1)(f) GDPR – IP address and technical logs for the secure operation of the download service.

3.2. ARCHLine.XP software NON-Profit version

The ARCHLine.XP NON-Profit version is intended for educational (non-commercial) use of the software for a limited period of time. Educational use is free of charge but is subject to a user agreement.

3.2.1. Scope of processed data and purpose of data processing

3.2.2. Duration of data processing

The recorded personal data will be processed for the period of use permitted in the contract or for 1 year after the termination of the contract. After that, the data will be further processed in accordance with Section 3.5 (Storing system messages based on our legitimate interest)

3.2.3. Legal basis for data processing: Article 6(1)(b) GDPR – performance of the (free) educational license agreement and related support; Article 6(1)(f) GDPR – verification of educational eligibility (educational institution, instructor, duration of training).

3.3. Storing the invoice after purchasing the ARCHLine.XP software

3.3.1. Scope of processed data and purpose of data processing

3.3.2. Duration of data processing

8 years from the date of issue of the invoice. Pursuant to Section 169 (2) of Act C of 2000 on Accounting, accounting documents directly and indirectly supporting accounting settlements - including invoices - must be kept for at least 8 years. The user's data will be processed until the user requests the deletion of the account, given that in the event of deletion, Cadline Kft. will not be able to fulfill its contractual obligations.

3.3.3. Legal basis for data processing: Article 6(1)(c) GDPR – name or company name, address and tax number for issuing and retaining invoices (Section 169 (2) of Act C of 2000 on Accounting); Article 6(1)(b) GDPR – e-mail address and contact data for delivering serial numbers, activation codes and support during the contract; Article 6(1)(f) GDPR – retention of purchase records after performance for the defense of legal claims until the expiry of the limitation period.

3.4. Sending system messages regarding purchases

In order for our customer to be able to follow the steps of the service delivery, either we or our data processors send system messages. These messages occur in the following cases:
- confirmation of payment in case of payment by bank card,
- sending identification data of purchased programs (serial numbers, activation codes)
- sending an invoice,
- message about order confirmation,
- message about payment acceptance
- message about unsuccessful payment,
- message about the amount waiting to be transferred (in case of payment by bank transfer).

3.4.1. Scope of processed data and purpose of data processing

3.4.2. Duration of data processing

For this purpose, we process system messages (including the data included in the system message in Section 3.4.1) until the termination of the contract. However, after the termination of the contract, we continue to store system messages in accordance with Section 3.5.

3.4.3. Legal basis for data processing: Article 6(1)(b) GDPR – transactional system messages (payment confirmation, delivery of license data, invoices, order status) are necessary for the performance of the purchase contract; these are not direct marketing and do not require consent.

3.5. Storing system messages based on our legitimate interest

In the case of the data processing purpose set out in Section 3.4, our right to process personal data ceases upon the performance of the contract. However, in order to be able to prove in the event of a potential legal dispute that we have properly performed the contract and that we have fully provided what we have undertaken, it is necessary that these system messages are stored until the end of the limitation period (see the period in more detail in Section 8). For this reason, we retain the data pursuant to Section 6:22 of Act V of 2013 on the Civil Code (“Civil Code”) until the end of the limitation period, i.e., for 5 years after the system message was sent.

3.5.1. Scope of the processed data and purpose of data processing

As explained above, the purpose of data processing is to be able to prove the performance of the contract in the event of a legal dispute. Therefore, it is necessary to retain the system messages contained in Section 3.4, as this is the only way we can prove the performance of the contract. The scope of data is therefore identical to the scope of data contained in Section 3.4.

3.5.2.Duration of data processing.
For this purpose, we process the data until the end of the limitation period, i.e., 5 years from the conclusion of the contract, pursuant to Section 6:22 of the Civil Code.

3.5.3. Legal basis for data processing.
The legal basis for the processing of personal data is the legitimate interest of Cadline Kft., which is related to the purpose of being able to prove its contractual performance in the event of a possible legal dispute. Annex 1 to this information sheet shows how our legitimate interest is established through the so-called balancing of interests test.

3.5.4.  Name and activity of the data processor

For this purpose, our company uses the data processors listed in Section 3.4, which companies process the data indicated in the same point in accordance with this purpose, for the period indicated in Section 8.

3.6. Sending newsletters about ARCHLine.XP software and related products

3.6.1. Scope of processed data and purpose of data processing

3.6.2. Legal basis for data processing
The legal basis for data processing is your consent. This notice is a unilateral commitment of the data controller in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter referred to as the GDPR) and the relevant Member State legislation.

3.6.3. Duration of data processing

Our company will process the data you provide until you withdraw your consent. Based on the withdrawal of consent, we will delete the data specified in Section 3.6.1 from our newsletter database within 30 days at the latest, and we will no longer send you a newsletter.

3.7. Registration on the website

3.7.1. Scope of processed data and purpose of data processing

Registration on the website serves to ensure that information related to ARCHLine.XP software and related products is personalized and transparent. After registration, the purpose of data processing is to identify customers for the use of services available through the Website, to conclude a service contract, to document the provision of services and the adequacy of performance, and, where applicable, to enable invoicing and to prove the contracts concluded.

During registration, the User is required to provide the following personal data:

After providing the data, our Company will notify the User by e-mail about the success of the registration. Our Company only stores the hash of the User's password, not the password itself.
In order to ensure the security of your data and prevent illegal access, we ask for your help in carefully keeping your password and not sharing it with anyone. 

The Customer may optionally provide additional data during registration, if necessary to perform or facilitate the service provided by the Service Provider.

3.7.2. The legal basis for data processing is Article 6(1)(b) GDPR – the performance of the service contract concluded by registration (user identification, account management, provision of the services available through the Website). Newsletter and cookie consents are requested separately and are not a condition of registration.

3.7.3. Duration of data processing
We process the user's data until the user requests deletion of the account or - if the user does not use the account - we delete it after 1 year. If we notice that the account has become inactive, we will ask the user to log in to their account in an e-mail message after 6 months from registration and inform them that if this is not done, we will delete the account. If there is no login, we will send a repeated e-mail message two weeks after the previous message, in which we will indicate that the e-mail is the last invitation to log in before the account data is deleted. If there is no login even then, the account data will be deleted after six months from registration.

In the case of emails sent by the User, if the User is not registered, the Data Controller will delete the email address 90 days after the closure of the case referred to in the request, unless in an individual case the legitimate interest of the Data Controller justifies the further processing of the Personal Data, until such time as the Data Controller's legitimate interest exists.

The Personal Data of participants in competitions and prize games organized by the Data Controller will be deleted by the Data Controller – unless the User has also consented to data processing for other purposes – 90 days after the conclusion of the given event or prize game.

Personal Data provided for marketing purposes and direct marketing purposes will be processed until the User requests their deletion.

3.7.4.Registration process

By clicking on the Create Account (Registration) link, the User provides the necessary data (name, email address, Details). Registration is subject to reading and accepting the privacy statement.

By clicking on the “Register” link, the User declares that he has read the privacy statement, understood its contents, validly accepts them, and expressly consents to the processing of his/her provided data. He/she also agrees

• to send the newsletter (separate consent required),

• a www.archlinexp.com, www.archlinexp.eu  to use cookies found in the link,

• the consent also includes the service provider storing the personal data until the service is terminated or the consent is withdrawn, or, based on its legitimate interest, until the deadline for asserting the claim.

After finalizing the registration, the Service Provider sends a confirmation to the e-mail address provided by the User, informing the User about the details of the registration.

The Service Provider provides the services that can be used without paying a fee after registration for an indefinite period, at most until the User's registration is deleted.

If, after registration, the User requests the sending of the Newsletter, he can provide his consent under Contact / Personal data / Newsletter authorization, the basis of data processing is the personal data provided during registration.

The User has the right to withdraw his consent later and request the deletion of his personal data, for which his consent was required, in this case

• data processing related to services available without payment of a fee will cease with immediate effect for the future,

• deletion of data processing relating to services provided against payment of a fee is considered termination of the service according to the GTC and, according to the GTC, it ceases at the end of the data processing period ,

• the User will not receive any future newsletters, and

• you cannot visit pages that use cookies that require consent.

The withdrawal of consent to the processing of personal data will terminate the data processing for the future, and the lawful data processing prior to the withdrawal will remain valid. It does not apply to data processing required by law, and the data retention obligation will continue to exist despite the withdrawal. The lawfulness of data processing on other legal grounds is not affected by the withdrawal.

Data processing is lawful even after the termination or cessation of the service, citing the legitimate interest of the service provider.

4. Data security

We inform you that we have taken the technical and organizational measures and have developed and operate the procedural rules that are necessary to ensure the adequate protection of your personal data. You can access the data stored in our system after password identification, and access to the data is tied to an authorization level. In order to prevent accidental destruction of data, our data processors perform backups. We enable access to the website via a secure “https” protocol.

5. Data transfer to third countries

  We share your personal data within Cadline Partners (“distributors“) as follows:

When registering on our websites, you provide us with certain personal data. In this case, if you consent to this sharing, Cadline as a data controller may share your identity data, contact details and marketing and communication data with our distributors.
These transfers may include transfers of your data outside the European Economic Area (EEA).

We only transfer your personal data to the country where the registered office of your chosen distributor is. The list of our distributors may be accessed via the following link: https://archline.pro/en/contact/where-to-buy

If you choose a distributor from outside a third country in relation to which the European Commission has not deemed to provide an adequate level of protection for personal data, we transfer the relevant personal data only on the basis of appropriate safeguards and following an assessment of the transfer; the countries concerned and the safeguards applied are set out in this Section. 

6. Cookies used on the website

In order to ensure that the Website and the service are used smoothly, certain cookies (these are so-called session cookies) are automatically installed on your computer when you visit the Website. These cookies are also cookies without which neither our website nor the service available through it could function, therefore we also call these cookies essential cookies, which support the operating session and are used to identify individual user sessions. As the name of the cookie indicates, if the visitor refuses to install these cookies, it may cause disruption in the operation of the website or the service, or it may prevent the service from functioning completely. For this reason, these cookies are “on” by default when visiting the Website and are automatically installed on your computer and the visitor cannot turn them off. We process personal data collected using these cookies (in particular the IP address of your computer) based on our legitimate interest in the secure and smooth operation of the Website, for a maximum period of time as long as you are on our website. These are automatically deleted from your computer when you close your browser.

We can also distinguish between convenience cookies that support usability, which allow our website to remember that you have previously accepted the cookie policy when using the service. These types of cookies essentially represent the setting data stored in the cookie. This is done so that you do not have to accept the cookie policy again and again on your next visit. We do not record personal data in the convenience cookie, we only store an identification number, from which the website is informed that the cookie policy has been previously accepted. The convenience cookie is stored by the client's browser with an expiration date of 1 month.

Based on your consent provided on the Website (by allowing cookies), analytical cookies may be installed on your computer for the following purposes:

6.1 Cookies for statistical purposes, serving web analytics measurements (e.g. Google Analytics, Facebook, Hotjar, etc.). These are important to us because they allow us to learn about certain characteristics of our visitors (IP address, city, type of device, browser, operating system used by you, as well as which subpages of our website you visited and how much time you spent on them). We use the anonymous data to prepare general statistics and reports related to the number of visitors to the Website to further develop them and improve our marketing strategy.

6.2 Remarketing cookies (e.g., Facebook, Google Ads), which allow us to analyze how you use our website and, accordingly, display personalized content and advertisements to you, even on online platforms outside our website (e.g., on other websites or social media).

In addition, we distinguish between session cookies and persistent cookies. A session cookie only lives until the visitor closes the browser. Persistent cookies live longer, they are not automatically deleted when the browser is closed. Persistent cookies help the site and service work faster, they remember things that the visitor has set for themselves on the Website.

You can withdraw your consent at any time, free of charge and without restrictions, by visiting the Website again – by clicking on the pop-up window when the Website loads.

You can also manage cookies in your browser settings, or withdraw your previously given consent and delete cookies from your computer. The settings depend on the type of browser.

You can find information about cookie settings in the most popular browsers at the following links:

Google Chrome: https://support.google.com/chrome/answer/95647?hl=hu-hu&p=cpn_cookies

Firefox: https://support.mozilla.org/hu/kb/sutik-informacio-amelyet-weboldalak-tarolnak-szami

Edge: https://support.microsoft.com/hu-hu/help/17442/windows-internet-explorer-delete-manage-cookies

7. Recipients of personal data

The Service Provider[1] [2] , as a Data Controller, uses data processors within the framework of its billing service,

7.1 In the case of the User's order, the User is provided with access to the invoice issuance data in order to facilitate the User's accounting.

7.2 In addition to the above, the transfer of the User's personal data is only possible in the case of mandatory data transfer as specified in the legislation. In the case of a request, the Service Provider provides data to the notary, bailiff, courts and other authorities in accordance with the data content specified in the laws and other legislation in order to fulfill their legal obligations.

7.3 Invoice issuance enabled in the NAV online invoicing circle transmits data directly to the NAV network.

Duration of data processing

§  Upon termination of the contract, personal data processed for the performance of the contract is retained on the legal basis of our legitimate interest (enforcement and defense of legal claims) until the end of the limitation period under Section 6:22 of the Civil Code (up to 5 years).

§  The issued invoices are subject to a retention obligation for 8 years in accordance with Section 169 (2) of Act C of 2000 on Accounting, and are stored for an additional year for possible audits, citing the legitimate interest of the data controller.

The following job positions are held within the data controller's organization: Managing Director, Marketing Manager, Sales Manager, Project Manager, Secretariat Manager.

8. Name and activities of data processors

We use a data processor for invoicing and to implement the technical conditions for invoice storage. Name of data processor: KBOSS. Hu kft.

Address: 1031 Budapest, Záhony utca 7. E-mail: dpo@kboss.hu, Tax number: 13421739-2-41

We use accountant Mariann Zsuzsa Tóthné Szanati as a data processor to store the invoices. Address: 1221 Budapest Ady Endre út 59. E-mail:szanatizsuzsa5@gmail.comTax number: 41365533-2-43

9.Name of External Service Providers Providing Payment

Our company contracts with Third-Party Service Providers to provide payment services and web shop services. The Third-Party Service Providers process the Personal Data provided to them (e.g., name, bank card number, bank account number, etc.) in accordance with the provisions of their own data protection notices, more information about which is available on the website of the Third-Party Service Provider providing payment.

The web shop purchase pages of our website may contain payment connection points (links) that lead to the pages of other banking or payment service providers. The Company transmits the data provided during the order to these service providers (Name, e-mail address, Postal code, City, Street, house number, and Tax ID (According to the legal regulations, after July 1, 2020, the tax ID is mandatory on the invoice for corporate customers)) and by clicking on the provided link, the user can directly go to the payment service provider's page. The data processing information of the payment service providers will apply, the Company is not responsible for their data protection practices and other activities.

Our company does not have access to the bank card details you enter, you provide them directly to the External Service Providers. Accordingly, the External Service Provider is considered a data controller in relation to the payment.

Third-party payment service provider(s) cooperating with our company:

Barion Payment Inc.

Headquarter: 1083 Budapest, Bókay János utca 44–46, Building C5, 8th floor

Legal Information - Barion

Duration of data processing

8 years from the date of issue of the invoice. Pursuant to Section 169 (2) of Act C of 2000 on Accounting, accounting documents directly and indirectly supporting accounting records – including invoices – must be kept for at least 8 years.

10. YOUR RIGHTS RELATED TO DATA PROCESSING

10.1 Right to request information

The User may request that the Data Controller inform him/her whether he/she processes the User’s personal data and, if so, to provide him/her with access to the Personal Data processed by him/her.

The Personal Data provided by the User in connection with the given Service can be viewed on the User’s profile page on the Company’s website after password identification.

Regardless of this, the User may request information about the processing of Personal Data at any time in writing, by registered or registered letter with return receipt sent to the Data Controller’s address, or by e-mail sent to the e-mail address office@cadline.hu. The Data Controller shall consider a request for information sent by letter as authentic if the User can be clearly identified based on the request sent. The Data Controller shall only consider a request for information sent by e-mail as authentic if it is sent from the User’s registered e-mail address, but this does not exclude the Data Controller from identifying the User in another way before providing the information.

The request for information may cover the User's data processed by the Data Controller, their source, the purpose, legal basis, duration of the Data Processing, the name and address of any Data Processors, the activities related to the Data Processing, and in the case of the transfer of Personal Data, who received or will receive the User's data and for what purpose.

We will fulfill your request within a maximum of 30 days, by letter sent to the contact information you provided, or in the case of an electronic request, to the electronic email address provided.

The Data Controller may only refuse to provide information to the data subject if it is restricted by law, in the interests of the external and internal security of the state, such as national defense, national security, crime prevention or crime prevention, in the interests of state or local government financial interests, and in the interests of protecting the rights of the data subject or others. The data controller is obliged to inform the data subject of the reason for refusing to provide information. The data controller shall notify the Data Protection Commissioner annually of rejected requests.

10.2 The right to rectification
You can view or modify the Personal Data provided by you on the Company's website after password identification on your profile page.

After modifying Personal Data, previous (deleted) data can no longer be restored.

You can also cancel the sending of newsletters by modifying the user interface settings on the profile page.

You can request in writing, through the contact details provided in Section 1, that our company modify any of your personal data (for example, you can change your e-mail address or postal address at any time). Our company will fulfill your request within a maximum of 30 days and will notify you of this in a letter sent to the contact details provided. If our company is unable to fulfill your request, we will notify you of the refusal of fulfillment within the same deadline by letter to the contact details provided, or in the case of an electronic request, to the electronic address.

Taking into account the purpose of Data Management, our Company may request the completion of incomplete Personal Data and the data necessary for invoicing to provide the service.

10.3 The right to erasure

You can request the deletion of your personal data from our company in writing via the contact details provided in Section 1. We will reject the deletion request if the law obliges our company to further store the personal data. Such a case is, for example, if we are obliged to process data related to invoicing until the deadline specified in the law. Our company will fulfill your request within a maximum of 30 days and will notify you of this in a letter sent to the contact details provided. If our company is unable to fulfill your request because the law requires mandatory data processing, we will notify you of the refusal to fulfill it within the same deadline by letter to the contact details provided, or in the case of an electronic request, to the electronic email address.

10.4 The right to block

You may request in writing that your personal data be blocked by our company through the contact details provided in Section 1. The blocking will last as long as the reason you have indicated makes it necessary to store the data. You may request the blocking of your data, for example, if you believe that your request was processed unlawfully by our company, but due to an official procedure initiated by you, it is necessary for our company not to delete your request. In this case, our company will continue to store your request - which is considered personal data - until the authority requests it - after which it will delete the data. Our company will fulfill your request within a maximum of 30 days and will notify you of this in a letter sent to the contact details provided, or in the case of an electronic request, to your electronic email address..

10.5 The right to protest

You may object in writing to data processing, via the contact details provided in Section 1, if your personal data is forwarded or used by our company for direct marketing, public opinion polling or scientific research purposes. For example, you may object to our company using your personal data for sending newsletters without your consent. You may also object to data processing if you believe that it is necessary to fulfil a legal obligation that applies exclusively to our company or to exercise your legitimate interest, except for data processing based on legal authorization. For example, you may not object to us processing your data specified in the law during invoicing.

The data controller is obliged to examine the objection within the shortest possible time from the submission of the request, but no later than one month (extendable by a further two months for complex cases, with notice to you), and to inform the applicant of the result in writing. Where the objection concerns direct marketing, we stop processing for direct marketing purposes immediately and unconditionally. If the objection is justified, the data controller is obliged to terminate the data processing - including further data collection and transmission - and block the data, and to notify all those to whom the personal data affected by the objection were previously transmitted about the objection and the measures taken on its basis, and who are obliged to take measures to enforce the right to object. If the data subject does not agree with this decision of the data controller, he may appeal to the court against it - within 30 days of its notification.

The data controller may not delete the data of the data subject if the data processing was ordered by law. However, the data may not be transferred to the data recipient if the data controller agreed with the objection or the court has established the legitimacy of the objection.

10.6 Right to withdraw consent

The data subject has the right to withdraw his/her consent at any time. The withdrawal of consent does not affect the lawfulness of the processing based on consent before its withdrawal.

The data subject may take legal action against the controller in the event of a violation of his/her rights. 

11. Amendment to the Data Protection Notice

11.1 The Data Controller reserves the right to modify this Notice at any time by its unilateral decision.

11.2 The data subjects must be informed of the modification of the Data Management Policy in an appropriate manner (in a newsletter, in a pop-up window upon entry). Where a modification affects processing based on consent, data subjects are informed and, where required, their consent is requested again; processing based on other legal bases remains governed by the notice in force at the time of processing.

12. Your right to exercise your rights regarding data processing

If you have submitted a request for rectification, blocking or deletion to us or objected to the processing of your data, but we have not complied with your request, you have the right to contact a court or authority. In court proceedings, you have the right to initiate proceedings at the court of your place of residence, which will decide without delay. You can find the competent court at this link:

http:// birosag.hu/ugyfelkapsulate-portal/illetekessegkereso. You can also initiate proceedings at the National Authority for Data Protection and Freedom of Information (NAIH) if you experience a data protection violation. You may also lodge a complaint with the supervisory authority of your habitual residence, place of work or of the place of the alleged infringement, in any EU Member State. Please note that the NAIH recommends that data subjects first contact the data controller in the event of a problem in order to find an amicable solution. In this case, we therefore ask that if you have any problems or claims, you first submit them to us, although we cannot of course expect you to do so on a mandatory basis. You can contact the NAIH as follows: you can reach the Authority by e-mail at ugyfelszolgalat@naih.hu, or by letter at 1530 Budapest, Pf.: 5. You can read about the investigation of complaints related to the exercise of the rights concerned at the following link: https://www.naih.hu/panasz-vagy-kozerdeku-bejelentes-a-panasztorveny-szerint.

In addition, with any questions or comments related to Data Management, you can also contact the Data Controller's staff at office@cadline.hu.

This updated Privacy Policy will be effective October 1, 2026. 

Budapest, 2026.09.015.