Privacy and data security notice

For our contractual partners

With regard to the data provided by its contractual partners, BELUX Csoport Kft. applies the measures set out in this Notice in the interests of data protection and data security.

Edition 2 · effective from 21 September 2026

Preamble

Pursuant to Article 13 of the General Data Protection Regulation of the European Union (Regulation (EU) 2016/679, hereinafter: the “GDPR”), we hereby provide you with detailed information below on our data processing principles and practices concerning the safeguarding of the fundamental rights and freedoms of natural persons in relation to their personal data.

As Controller, we acknowledge the contents of this Notice as binding upon us.

As Controller, we reserve the right to amend the contents of this legal notice from time to time. We shall, of course, always notify data subjects of any changes in good time.

In the course of our data processing activities, we are committed to processing your personal data lawfully, fairly and in a transparent manner; we ensure the enforcement of your right to informational self-determination and take all necessary organisational and technical measures to ensure the secure processing of your personal data.

Our data processing practices comply with the provisions of the following legislation:

  • Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR);
  • Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (“Infotv.”);
  • Act V of 2013 on the Civil Code (“Ptk.”);
  • Act C of 2000 on Accounting (“Számv. tv.”);
  • Act CLV of 1997 on Consumer Protection.

1. Details of the Controller

BELUX CSOPORT Korlátolt Felelősségű Társaság (hereinafter: “BELUX Kft.” or the “Company”) Registered office: 1122 Budapest, Városmajor utca 13.

  • Company registration number: 01 09 738681
  • Tax number: 13504243-2-43
  • Represented by: Eszter Lukács, Managing Director

Contact details:

2. Categories of data processed, purposes and legal bases of processing

2.1. General data processing

BELUX Kft. requests the provision of personal data solely for the purpose of performing contracts, and processes personal data for the performance of contracts on the legal basis set out in Article 6(1)(b) GDPR.

Prior to the conclusion of a contract, we process the data provided by our potential business partners in their enquiries on the basis of legitimate interest (Article 6(1)(f) GDPR).

Since certain legal requirements oblige us to process data beyond the performance of the contract, we process the personal data provided to us in connection with invoicing and for the purpose of handling consumer protection complaints pursuant to Article 6(1)(c) GDPR.

For the performance of the contract, we process the following data:

  • the name of the legal representative of the contracting partner;
  • the name and contact details (e-mail address, telephone number, postal address) of the natural person designated by the contracting partner as contact person.

Data processed to the extent necessary for invoicing: name and address of the customer.

Duration of data processing

Data processed for the conclusion and performance of a contract (to which the data subject is a party) and on the basis of legitimate interest:

Description of personal data Retention / storage period
Name, address, contact details (name, e-mail address, telephone number, postal address) 5 years following the performance or termination of the contract or the cessation of the legitimate interest, in accordance with the applicable statutory provision (Section 6:22 of the Civil Code)
Personal data contained in general enquiries (any information that the data subject discloses to the Controller) 5 years from the cessation of the legitimate interest

Data processed on the basis of statutory requirements (compliance with a legal obligation):

Description of personal data Retention / storage period
Data contained in accounting documents: billing name, billing address, tax number / tax identification number, description of invoice item, unit price, total price At least 8 years pursuant to Section 169(2) of the Accounting Act; in the case of de minimis aid, the retention period for supporting documents is 10 years
Name, residential address, e-mail address and other personal data contained in the complaint 5 years pursuant to Section 17/A(7) of Act CLV of 1997 on Consumer Protection

2.2. Our activities as a processor

BELUX Kft. qualifies as a processor with regard to the software sold and operated by it. With regard to the data processed, stored and entered in the software, the controller shall in all cases be our contracting partner who ordered the Software and our services relating to the operation of the Software, and who has also designated the natural persons using the Software.

Our activities as a processor are aimed solely at ensuring the proper functioning of the Software and the performance of our contractual obligations.

In this context, BELUX Kft. does not take any substantive decisions concerning the processing, processes the personal data that come to its knowledge exclusively in accordance with the instructions of the Controller, may not process data for its own purposes, and is obliged to store and retain the personal data in accordance with the instructions of the Controller.

BELUX Kft. processes data to a high standard and with the degree of care that may reasonably be expected of it. In performing these activities, we ensure full compliance with data protection requirements and take the technical and organisational measures that guarantee the security of the processing. We use appropriate measures to protect data against unauthorised access, alteration, transmission, disclosure, erasure or destruction, as well as against accidental destruction and damage, and against becoming inaccessible as a result of changes in the technology used.

The Company ensures the secure storage and safekeeping of personal data, within its own competence, as follows:

  • personal data may be accessed only by persons authorised to do so;
  • access is protected through the establishment of appropriate authorisation levels; and
  • the protective measures taken are continuously monitored and reviewed to ensure their effectiveness and security.

We do not transfer the data processed by us in connection with the operation of the software to anyone. Where a further processor (sub-processor) is engaged, we ensure the same level of protection as we apply in the course of our own processing activities.

The Processor processes personal data within the territory of Hungary or, where the data processing agreement so provides, within the territory of the European Union. The Processor may engage a sub-processor operating outside the territory of the European Union only with the prior written consent of the Controller and subject to the safeguards required by the GDPR.

The Processor shall take all necessary measures and shall cooperate with the Controller’s data protection officer and with other relevant organisational units in identifying the cause of any data protection irregularity or personal data breach, in remedying it and in eliminating any adverse consequences of the breach.

Further detailed provisions concerning processing activities are set out in the individual data processing agreements concluded with our partners.

2.3. Data processing in connection with the operation of the GLOBALSPEECH speech recognition software, the eRAD PACS and HIS systems and AI decision support systems

As the contractual partner of the relevant software developers, BELUX Kft. holds the right to use the base software developed by the relevant manufacturers and developers. On the basis of this licence, BELUX has developed its software portfolio by building on and further developing the base software.

The proper functioning of our GLOBALSPEECH speech recognition software also requires the processing of additional personal data; accordingly, we record the name and voice sample of the user of the software in our system, as this is the only way to ensure the proper functioning of the software.

The user logs in to the system using his or her name, which enables the system to recognise the voice sample category recorded against the user’s name, thereby ensuring the proper functioning of the system.

Since speech recognition is based on a pre-recorded voice sample of the given user of the software, the user’s voice sample is recorded upon installation of the software on the basis of a text read aloud by the user, and the software assigns the user’s voice to the appropriate category.

The voice sample does not constitute biometric data and is not in itself suitable for identifying the data subject; it serves exclusively to categorise the data subject’s voice for speech recognition purposes.

Text dictated during the use of the software is stored exclusively on the user’s computer or server. During synchronisation, the system records only new words not previously included in the dictionary, thereby contributing to the continuous improvement of its operation. Coherent sentences and any personal data that may appear in the text are not recorded.

In the case of the other software offered by us (eRad PACS, HIS, etc.), any further personal data entered by our partners are likewise recorded on storage facilities and devices under the control of our partners, and we do not carry out any data processing operations, whether as controller or as processor, in relation to such data. Our contractual partners qualify as controllers in respect of the data entered into the systems. If requested by our partners, processing activities may be carried out on the basis of a separate agreement and subject to the conditions set out therein.

2.4. Our document management software

Our document management software is installed on the controller’s computer or server; we have no access to the data stored therein and do not carry out any processing whatsoever in relation to such data.

2.5. Support

Where support from BELUX Kft. is required in connection with the operation of the software, our staff will generally access your computer remotely in order to resolve the fault. In such cases, if you leave documents open on your computer, our staff may be able to see the data contained therein, possibly including personal data.

In such cases, it is your responsibility to protect the data and to close the relevant documents before requesting assistance from our staff.

Even if you fail to do so, we do not record any data or copy any content from your computer. Our access serves exclusively to provide technical support for the use of the software and to resolve the fault that has arisen.

3. Recipients of personal data; data transfers

The Company’s employees and officers involved in liaising with prospective and existing Contractual Partners and clients may process personal data to the extent necessary for the performance of their duties.

Our Company does not transfer the data processed to any other controller. Our Company discloses personal data at the request of a court, investigating authority or other authority, upon their official request, provided that the exact purpose of the request and the scope of the data requested are specified in detail.

4. Safeguarding the rights of data subjects

We provide data subjects and the controller with all information and assistance necessary to safeguard the rights of data subjects.

Rights of the data subject in relation to data processing:

  • The data subject has the right to receive information about the processing of his or her personal data.
  • The data subject may request from the Company access (pursuant to Article 15 GDPR) to the personal data concerning him or her, i.e. the data subject has the right to obtain confirmation from the Company as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the personal data and to information about the processing. At the request of the data subject, the Company shall also provide the data subject with a copy of the personal data undergoing processing.
  • In addition, the data subject may request the rectification (pursuant to Article 16 GDPR) and completion of his or her personal data.
  • At the request of the data subject, the Company shall erase (pursuant to Article 17 GDPR) the personal data concerning the data subject without undue delay where one of the following grounds applies:
    • the personal data are no longer necessary for the Company in relation to the purposes set out above, or the period of processing has expired;
    • where the processing is based on the data subject’s consent, the data subject withdraws his or her consent to the processing of his or her data;
    • the data subject objects to the processing;
    • the personal data have been unlawfully processed;
    • the personal data have to be erased for compliance with a legal obligation under Union or Member State law.
  • At the request of the data subject, the Company shall restrict (pursuant to Article 18 GDPR) processing where the accuracy of the personal data is contested, the processing is unlawful, the data subject objects to the processing, or the Company no longer needs the personal data provided but they are required by the data subject for the establishment, exercise or defence of legal claims.
  • In the case of automated processing, the data subject has the right to data portability (pursuant to Article 20 GDPR), i.e. the data subject may receive the personal data concerning him or her, which he or she has provided, in a structured, commonly used and machine-readable format, and may transmit those data to another undertaking, organisation or person, where the processing is carried out by automated means and is based on his or her consent, or is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. In this context, the data subject may also request that the Company transmit his or her personal data directly to another controller.
  • On grounds relating to his or her particular situation, the data subject may object (pursuant to Article 21 GDPR) to the processing of his or her personal data where the processing is based not on the data subject’s consent but on the necessity of performing a task carried out in the public interest or in the exercise of official authority, or where the processing is necessary for the purposes of the legitimate interests pursued by the Company or a third party, or where personal data are processed for direct marketing purposes.
  • The data subject has the right to withdraw his or her consent to the processing of his or her personal data at any time (pursuant to Article 7(3) GDPR); the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

The data subject may contact us with any questions or comments regarding the operation of the Company as controller or the processing of his or her personal data using the contact details set out in Section 1. The Company shall examine the data subject’s request without undue delay and in any event within one month of receipt of the request and, where the request is well founded, shall take action and inform the requesting party thereof in writing. Where necessary, this period may be extended by two further months. The Company shall inform the data subject of any such extension, together with the reasons for the delay, within one month of receipt of the request. If the Company does not take action on the data subject’s request, it shall inform the data subject of the reasons for not taking action and of the remedies available to the data subject.

With regard to data processed in the course of our processing activities, we may erase, rectify or restrict any data only on the instructions of the controller. Where a data subject submits a request concerning data processed in the course of our processing activities, we shall forward the request to the controller without delay and inform the requesting party thereof in writing.

5. Automated decision-making and profiling

No automated decision-making is used in the course of the processing.

6. Failure to provide personal data

The provision of personal data to the Company is a prerequisite for the conclusion and performance of a contract or agreement. The Contractual Partner is not obliged to provide the necessary personal data to the Company, and failure to provide such data shall not entail any adverse consequences for the data subject; however, in such a case the Company will be unable to enter into a contract with the Partner.

7. Remedies

If you believe that, in the course of our data processing, we have failed to comply with or have infringed the applicable legal requirements or the obligations undertaken by us in this Notice, please notify us at iroda@belux.hu or by post.

We shall respond to your complaint in writing as a matter of priority and in any event within one month, and shall remedy it where it is justified.

In the event of an infringement of his or her rights, the data subject may bring proceedings against the controller before a court (at the data subject’s choice, the court having jurisdiction for the defendant’s registered office or for the data subject’s place of residence). The court shall hear the case as a matter of priority. Proceedings relating to the protection of personal data are exempt from court fees.

Pursuant to Act V of 2013 on the Civil Code, the data subject may enforce his or her rights before a court and, if he or she has suffered material damage or an infringement of personality rights as a result of the processing, may claim compensation and/or restitution for the infringement of personality rights (sérelemdíj) from the controller in respect of the damage or infringement suffered. Since 25 May 2018, the data subject may bring court proceedings against the controller even in the absence of damage if he or she considers that the processing of his or her data was unlawful, and may request the termination of the unlawful processing, the restoration of the lawfulness of the processing and the safeguarding of the enforcement of his or her rights. The case falls within the jurisdiction of the regional court (törvényszék).

Furthermore, if, following a written request to the Company, the data subject considers that the Company has committed an infringement in connection with the processing of his or her data through its acts or omissions, he or she may initiate official proceedings before the Hungarian National Authority for Data Protection and Freedom of Information (hereinafter: the “NAIH”) for the investigation of his or her complaint.

Contact details of the NAIH:

  • Address: 1125 Budapest, Szilágyi Erzsébet fasor 22/c
  • Postal address: 1530 Budapest, Pf. 5 (PO Box 5)
  • E-mail: ugyfelszolgalat@naih.hu
  • Website: www.naih.hu
  • Telephone: +36 1 391 1400
  • Fax: +36 1 391 1410