Introduction
This Privacy Notice describes how BST Solar Kft. processes personal data in the course of its business activities, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the “GDPR”) and Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (the “Info Act”).
1. The Data Controller
Company name: BST Solar Kft.
Registered office: 1131 Budapest, Rokolya utca 1-13, Hungary
Company registration number: 01-09-437175
Tax number: 32682861-2-41
Represented by: Josip Kovács, Managing Director
E-mail: info@bst.solar
Telephone: +36 1 451 8070
Website: www.bstsolar.hu, www.bstsolartech.com
(hereinafter: the “Controller” or “BST Solar”)
2. Data subjects and categories of personal data processed
BST Solar processes the personal data of the following categories of data subjects:
- business partners, customers and their contact persons and representatives (name, position, business e-mail address, telephone number, name of employer);
- prospective customers requesting a quotation or otherwise contacting us (name, e-mail address, telephone number, company name);
- visitors of the websites www.bstsolar.hu and www.bstsolartech.com (technical data, e.g. IP address, cookie identifiers, browsing data, solely to the extent set out in the applicable Cookie Policy);
- suppliers, subcontractors and their contact persons.
BST Solar does not process special categories of personal data (Article 9 GDPR) and does not knowingly process the personal data of persons under 16 years of age.
3. Purposes and legal bases of processing
3.1 Preparation and performance of quotations, orders and contracts
Purpose: preparation of quotations, pro forma invoices and order confirmations, and performance of the resulting contracts (delivery, installation, commissioning, invoicing). Legal basis: Article 6(1)(b) GDPR (performance of a contract or taking steps prior to entering into a contract).
3.2 Business communication
Purpose: responding to enquiries, maintaining business relationships, technical support. Legal basis: Article 6(1)(f) GDPR (BST Solar’s legitimate interest in maintaining business relationships).
3.3 Compliance with legal obligations
Purpose: issuing invoices and retaining the related accounting documents. Legal basis: Article 6(1)(c) GDPR, in accordance with Act C of 2000 on Accounting and the applicable tax legislation.
3.4 Marketing communication (solely on the basis of consent)
Purpose: sending newsletters, professional information or business offers by electronic means. Legal basis: Article 6(1)(a) GDPR (consent), in accordance with Section 6 of Act XLVIII of 2008 on the Basic Conditions and Certain Restrictions of Commercial Advertising Activities (the Hungarian Advertising Act), which requires the prior, express consent of the data subject for electronic direct marketing. Consent may be withdrawn at any time, free of charge, without affecting the lawfulness of processing carried out before withdrawal.
3.5 Operation of the website
Purpose: ensuring the operation and security of the website. Legal basis: Article 6(1)(f) GDPR and, where required, consent given under the Cookie Policy.
Data provided through the contact form of the website (name, e-mail address, telephone number, company name, message) are processed for the purpose of responding to the enquiry, in accordance with Section 3.2.
4. Duration of processing
- Data relating to quotations and enquiries that do not result in a contract: for a maximum of 1 year from the last contact, unless the data subject requests earlier erasure.
- Contractual and invoicing data: for the term of the contract and thereafter for the mandatory 8-year retention period under Hungarian accounting and tax legislation.
- Processing based on legitimate interest (business communication, correspondence): for the duration of the business relationship and, after its termination, for the general 5-year limitation period under the Hungarian Civil Code, for the purpose of establishing, exercising or defending legal claims.
- Marketing data processed on the basis of consent: until consent is withdrawn.
5. Recipients of personal data
Personal data may be disclosed, to the extent necessary for the purposes set out above, to the following categories of recipients:
- members of the BST Solar group (BST Solartech s.r.o.), where this is necessary for the joint performance of a project;
- IT and hosting service providers (e.g. e-mail, ERP/CRM system, cloud storage) acting as processors on behalf of BST Solar;
- bookkeeping and accounting service providers;
- courts, authorities or other bodies, where BST Solar is legally obliged to disclose data.
BST Solar concludes a data processing agreement in accordance with Article 28 GDPR with each of its processors.
6. Transfers to third countries
BST Solar processes personal data primarily within the European Economic Area (EEA). Where a service provider is located outside the EEA, BST Solar transfers personal data only if the European Commission has adopted an adequacy decision for the country concerned, or if appropriate safeguards (e.g. standard contractual clauses adopted by the European Commission) are in place.
7. Automated decision-making
BST Solar does not use automated decision-making, including profiling, which produces legal effects concerning the data subject or similarly significantly affects him or her.
8. Data security
BST Solar applies appropriate technical and organisational measures (e.g. access management, encrypted data transmission, regular backups) to protect personal data against unauthorised access, alteration, disclosure, destruction or accidental loss.
9. Rights of data subjects
Under the GDPR, data subjects have the following rights in relation to the processing of their personal data:
- Right of access (Article 15): you may request confirmation as to whether your data are being processed and, if so, access to those data.
- Right to rectification (Article 16): you may request the rectification of inaccurate personal data.
- Right to erasure (“right to be forgotten”, Article 17): you may request the erasure of your data where there is a legal ground for doing so.
- Right to restriction of processing (Article 18).
- Right to data portability (Article 20): you may request that the data you have provided be transmitted in a structured, commonly used and machine-readable format.
- Right to object (Article 21): on grounds relating to your particular situation, you may object to processing based on legitimate interest, including direct marketing.
- Right to withdraw consent (Article 7(3)), at any time, without affecting the lawfulness of processing carried out before withdrawal.
Requests may be submitted to the e-mail address info@bst.solar. BST Solar will respond within one month of receipt of the request; where justified (e.g. due to the complexity or number of requests), this period may be extended by a further two months, of which the data subject will be informed.
10. Right to lodge a complaint
If the data subject considers that the processing of his or her personal data infringes the GDPR, he or she has the right to lodge a complaint with the competent supervisory authority, in particular:
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9-11, Hungary
Postal address: 1363 Budapest, Pf. 9, Hungary
Telephone: +36 1 391 1400
Website: www.naih.hu
E-mail: ugyfelszolgalat@naih.hu
The data subject is also entitled to seek a judicial remedy before the court having jurisdiction and competence.
11. Amendments to this Notice
BST Solar reserves the right to amend this Privacy Notice, in particular in the event of changes to its business activities or to the applicable legislation. The current version is available at www.bstsolar.hu and www.bstsolartech.com. The General Terms and Conditions of BST Solar Kft. are available at www.bstsolartech.com .