Privacy notice

Contents

I. Controller

You can contact us with your data protection questions and requests at office@qualchem.hu.

II. Cases of data processing related to the activities on the website and in business relationships, their legal basis and purpose, the scope of the personal data processed, and the duration of processing

Data processed for the conclusion and performance of contracts

Processing of data for the conclusion and performance of contracts may become necessary at several stages of the process. The processing carried out for the conclusion and performance of contracts is described in more detail below:

Quote requests on the website

Using the quote request form on the website (Get a quote), you can ask us for a quote for selling waste to us or for buying raw material from us.

Purpose of processing

Receiving and answering the quote request, preparing the quote, and communicating with you about the quote.

Data processed

• Company name (required)
• Contact person: the contact person’s name (required)
• Email: the contact person’s email address (required)
• Phone: the contact person’s phone number (optional)
• Notes: any data you enter in this free-text field (optional)

The other fields of the form (selling waste or buying material, the material types, the form of the waste or the type of product, the estimated quantity) do not contain personal data. In addition, the quote request email contains the time of submission and whether the request was sent from the Hungarian or the English version of the website. Please do not enter in the Notes field any personal data that is not needed for the quote.

Duration of processing

If the quote request is not followed by a contract, we keep the quote request for 1 year from its receipt and then delete it. If the quote request is followed by a contract, we process the data for the term of the contract and thereafter for the periods set out in the sections ‘Processing of orders’ and ‘Issuing invoices’.

Legal basis for processing

If you would conclude the contract yourself (for example, as a sole trader): taking steps at your request prior to entering into a contract. [Processing under Article 6(1)(b) of the Regulation]

If you request a quote as the contact person of a company or other organisation: the legitimate interest of the Controller in answering the quote request and in establishing and maintaining a business relationship with the organisation you represent. [Processing under Article 6(1)(f) of the Regulation]

Recipients, processor

The website forwards the quote request exclusively by email to sales@qualchem.hu, via the mail server of Domdom Kft., over an authenticated SMTP connection. The website does not store the data in a database. The emails are kept in the sales@qualchem.hu mailbox, which is also operated by Domdom Kft. (see Chapter III). The Controller’s sales staff have access to the quote requests.

Provision of data

Providing the data is voluntary. Without completing the required fields (Company name, Contact person, Email), the form cannot be sent and we cannot give you a quote. You can also request a quote by email (sales@qualchem.hu) or by phone (+36 23 342 238, weekdays 8:00–16:00).

Contacting us

You can contact us by email or by phone with a question about any of our services.

Data processed

The personal data you provide when contacting us.

Duration of processing

We process the data only until the contact has been concluded. If your enquiry is a quote request, or if it is followed by a contract, the retention periods set out in the section ‘Quote requests on the website’ apply.

Legal basis for processing

If the enquiry concerns a contract that you would conclude yourself: taking steps at your request prior to entering into a contract. [Processing under Article 6(1)(b) of the Regulation]

In other cases, including where you contact us as the contact person of a company or other organisation: the legitimate interest of the Controller in answering the enquiry and in maintaining business contact. [Processing under Article 6(1)(f) of the Regulation]

Processing of orders

On the basis of orders, processing activities are necessary for the performance of the contract. Orders cannot be placed on the website; this section applies to orders placed outside the website, within the business relationship.

Data processed

In the course of processing, the Controller processes your name, billing and delivery address, phone number and email address.

Duration of processing

We process the data for 5 years, in accordance with the limitation period under civil law.

Legal basis for processing

Performance of the contract.

[Processing under Article 6(1)(b) of the Regulation]

If the contracting party is a company or other organisation, we process the data of its contact persons on the basis of the Controller’s legitimate interest in the communication necessary for the performance of the contract. [Processing under Article 6(1)(f) of the Regulation]

Issuing invoices

This processing is carried out in order to issue invoices in accordance with the law and to comply with the obligation to retain accounting documents. Under Section 169(1)–(2) of Act C of 2000 on Accounting (Sztv.), business companies must retain the accounting documents that directly and indirectly support the bookkeeping records.

Data processed

Name, address, email address, phone number.

Duration of processing

Under Section 169(2) of the Sztv., issued invoices must be retained for 8 years from the date of issue.

Legal basis for processing

Under Section 159(1) of Act CXXVII of 2007 on Value Added Tax, issuing an invoice is mandatory, and under Section 169(2) of Act C of 2000 on Accounting, the invoice must be retained for 8 years.

[Processing under Article 6(1)(c) of the Regulation]

Handling of consumer complaints

This processing is carried out in order to handle consumer protection complaints. If you have contacted us with a complaint, the processing and the provision of the data are indispensable.

Data processed

The customer’s name, phone number and email address, and the content of the message.

Duration of processing

We keep complaints for 3 years under the Consumer Protection Act.

Legal basis for processing

Under Section 17/A(7) of Act CLV of 1997 on Consumer Protection, we are required to keep the complaint for 3 years.

[Processing under Article 6(1)(c) of the Regulation]

Job applications

On the Careers page, we ask those interested to send their application (CV) by email to office@qualchem.hu. There is no application form on the website.

Purpose of processing

Assessing the application, selecting the right employee, and communicating with the applicant.

Data processed

The personal data you provide in your CV, in your cover letter and during the application process (typically name, contact details, education and professional experience). Please send only the data needed for your application.

Duration of processing

Until the selection procedure is closed; after that, we delete the application. If you have consented to us keeping your application for future job opportunities, we process the data for 1 year from the date your consent was given, or until you withdraw your consent, whichever is earlier.

Legal basis for processing

Taking steps at your request prior to entering into an employment contract. [Processing under Article 6(1)(b) of the Regulation]

If you expressly ask us to keep your application for future job opportunities as well: your consent, which you may withdraw at any time. [Processing under Article 6(1)(a) of the Regulation]

Recipients

Applications arrive in the office@qualchem.hu mailbox, which is operated by Domdom Kft. (see Chapter III). The Controller’s staff involved in the selection have access to the applications.

Provision of data

Applying is voluntary. Without the data, we cannot assess the application.

Processing related to the secure operation of the website

Prevention of abuse of the quote request form

We protect the quote request form against unsolicited messages (spam) and abuse. The form contains a hidden field that visitors cannot see, and the form can only be sent once a minimum completion time has passed. These two safeguards do not process any personal data.

In addition, the website limits the number of submissions per visitor: no more than 5 quote requests can be sent within 10 minutes, and no more than 20 within 24 hours. For this purpose, the server generates a digest (hash) of your IP address using a one-way cryptographic method (HMAC-SHA256). The secret key used to generate the hash changes daily. The server stores the hash in a small file for no more than 24 hours and uses it only to count submissions. The website’s code does not store the IP address itself.

Purpose of processing

Protecting the quote request form against unsolicited messages (spam) and abusive mass submissions.

Data processed

The hash generated from the IP address and the number of submissions associated with it. The IP address cannot be read from the hash. However, since the same IP address produces the same hash within a single day, we treat it as pseudonymised personal data.

Duration of processing

No more than 24 hours; after that, the hash is deleted.

Legal basis for processing

The legitimate interest of the Controller: protecting the website and the quote request form against unsolicited messages (spam) and abuse. [Processing under Article 6(1)(f) of the Regulation]

Recipients

The file is located on the hosting space provided by Domdom Kft. (see Chapter III). We do not transfer the data to third parties.

Technical logs of the hosting provider

Like web servers in general, the web server hosting the website may keep a technical log (access log) for the purposes of secure operation and maintenance.

Purpose of processing

Operating the website securely and without disruption; identifying and addressing errors and attacks.

Data processed

Typically the visitor’s IP address, the time of the visit, the address (URL) of the page opened and browser data.

Duration of processing

The retention period of the logs is determined by the hosting provider (Domdom Kft.), to the extent necessary for secure operation.

Legal basis for processing

Legitimate interest in operating the website securely and without disruption. [Processing under Article 6(1)(f) of the Regulation]

Recipients

The logs are handled by Domdom Kft. (see Chapter III).

Further processing

If the Controller intends to carry out further processing, it will provide prior information on the essential circumstances of the processing (the legal background and legal basis of the processing, the purpose of the processing, the scope of the data processed and the duration of the processing).

The Controller must comply with written requests for data from authorities that are based on statutory authorisation. The Controller keeps a record of data transfers (to which authority, what personal data, on what legal basis and when the Controller transferred data), and will inform you of its content upon request, unless the provision of such information is precluded by law.

III. Use of processors and their activities related to data processing

Processors process personal data on behalf of the Controller, on the basis of a contract concluded with the Controller.

Hosting, web server and email services

Domdom Kft. provides the hosting and the web server for the website, as well as the email service for the qualchem.hu domain. The data entered in the quote request form are forwarded to sales@qualchem.hu by the mail server of Domdom Kft. The emails are stored in the mailboxes operated by Domdom Kft. (sales@qualchem.hu, office@qualchem.hu). The file used to prevent abuse and the technical logs of the web server are also located on Domdom Kft.’s hosting space.

Processing related to accounting and invoicing

For the bookkeeping of accounting documents, the Controller uses an accounting service provider, which acts as a processor.

On the basis of a written contract concluded with the Controller, the accounting service provider assists in the bookkeeping of accounting documents. In doing so, the accounting service provider processes the data subject’s name and address to the extent necessary for the accounting records, for the period required by Section 169(2) of the Sztv., and deletes them without delay thereafter.

IV. Cookies and analytics

The website does not use cookies, and it does not store any data in your browser either (for example in its local storage, localStorage). The website has no visitor analytics, tracking, advertising, social media plug-ins, embedded maps or videos. We load the fonts from our own hosting space, so the website does not connect to the Google Fonts service either. For this reason, we do not ask you for cookie consent.

The external links on the website (our Facebook page and Google Maps route planning) take you to a third party’s site only if you click them. There, the provider’s own privacy notice applies.

The technical processing necessary for the operation of the website (abuse prevention and the hosting provider’s logs) is described in Chapter II.

V. Your rights in relation to data processing

During the period of processing, you have the following rights under the provisions of the Regulation:

• the right to withdraw consent
• access to personal data and to information related to the processing
• the right to rectification
• restriction of processing
• the right to erasure
• the right to object
• the right to data portability
• rights related to automated decision-making.

Which rights can be exercised for a given processing operation depends on its legal basis (Chapter II states the legal basis for each processing operation). Consent can be withdrawn where processing is based on consent, and you can object where processing is based on legitimate interest. Where processing is based on a legal obligation (for example, the retention of invoices), erasure cannot be requested for as long as the law requires the data to be retained.

You can send your request by email to office@qualchem.hu or by post to the Controller’s registered office. We will act on your request without undue delay and in any event within one month of its receipt. That period may be extended by two further months, taking into account the complexity and number of the requests; we will inform you of any such extension, and of the reasons for it, within the one-month period.

Right to withdraw consent

Where processing is based on your consent, you have the right to withdraw your consent to the processing at any time. In that case, we delete the data processed from our systems. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Right of access by the data subject

You have the right to obtain from the Controller confirmation as to whether or not your personal data are being processed, and, where that is the case, the right to access the personal data processed and, where such processing is taking place, the right to access the following information from the Controller:

• the purposes of the processing;
• the categories of personal data processed about you;
• the recipients or categories of recipients to whom the personal data have been or will be disclosed by the Controller;
• the envisaged period for which the personal data will be stored, or, if that is not possible, the criteria used to determine that period;
• your right to request from the Controller rectification or erasure of personal data or restriction of processing of personal data concerning you, and, in the case of processing based on legitimate interest, to object to such processing;
• the right to lodge a complaint with a supervisory authority;
• where the personal data are not collected from you, any available information as to their source;
• the existence of automated decision-making (if such a procedure has been applied), including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.

The purpose of exercising this right may be to establish and verify the lawfulness of the processing; therefore, in the case of repeated requests for information, the Controller may charge a reasonable fee for providing the information.

The Controller provides access to the personal data by sending you the personal data processed and the information by email, after identifying you.

Please indicate in your request whether you are requesting access to the personal data or the information related to the processing.

Right to rectification

You have the right to have the Controller rectify, at your request and without delay, inaccurate personal data concerning you.

Right to restriction of processing

You have the right to obtain from the Controller, at your request, restriction of processing where one of the following applies:

• you contest the accuracy of the personal data; in this case, the restriction applies for a period enabling the Controller to verify the accuracy of the personal data; if the accurate data can be established immediately, no restriction takes place;
• the processing is unlawful, but you oppose the erasure of the data for any reason (for example, because the data are important to you for enforcing a legal claim), and you therefore request the restriction of their use instead of their erasure;
• the Controller no longer needs the personal data for the stated purposes of the processing, but you require them for the establishment, exercise or defence of legal claims; or
• you have objected to the processing, but the Controller’s legitimate interest may also justify the processing; in this case, the processing must be restricted until it has been determined whether the legitimate grounds of the Controller override your legitimate grounds.

Where processing has been restricted, such personal data may, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

The Controller will inform you in advance (at least 3 working days before the restriction is lifted) of the lifting of the restriction of processing.

Right to erasure (‘right to be forgotten’)

You have the right to obtain from the Controller the erasure of personal data concerning you without undue delay where one of the following grounds applies:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed by the Controller;
• you withdraw your consent and there is no other legal ground for the processing;
• you object to processing based on legitimate interest, and there are no overriding legitimate grounds (i.e. legitimate interest) for the processing;
• the personal data have been unlawfully processed by the Controller, and this has been established on the basis of a complaint;
• the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the Controller is subject.

Where the Controller has, for any lawful reason, made public the personal data processed about you and is obliged to erase them for any of the reasons set out above, it shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform other controllers processing the data that you have requested the erasure of any links to, or copy or replication of, those personal data.

Erasure cannot be carried out where the processing is necessary:

• for exercising the right of freedom of expression and information;
• for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject (such as processing in the context of invoicing, since the retention of invoices is required by law), or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• for the establishment, exercise or defence of legal claims (e.g. if the Controller has a claim against you that you have not yet settled, or if a consumer or data protection complaint is being dealt with).

Right to object

You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data based on legitimate interest. In this case, the Controller may no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or which relate to the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such purposes, which includes profiling to the extent that it is related to such direct marketing. Where you object to processing for direct marketing purposes, the personal data may no longer be processed for such purposes.

Right to data portability

Where the processing is carried out by automated means and is based on your freely given consent or on a contract, you have the right to request from the Controller the data you have provided to the Controller, which the Controller will make available to you in XML, JSON or CSV format. Where technically feasible, you may request that the Controller transmit the data in this form to another controller.

Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which would produce legal effects concerning you or similarly significantly affect you. In these cases, the Controller must implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, including at least the data subject’s right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

The above does not apply if the decision:

• is necessary for entering into, or performance of, a contract between you and the controller;
• is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
• is based on your explicit consent.

In the processing operations described in this notice, the Controller does not take any decision based solely on automated processing which would produce legal effects concerning you or similarly significantly affect you, nor does it carry out profiling.

VI. Statements of the Controller

Data security measures

The Controller declares that it has taken appropriate security measures to protect personal data against unauthorised access, alteration, transfer, disclosure, erasure or destruction, as well as against accidental destruction and damage, and against becoming inaccessible as a result of changes in the technology used.

Within its organisational and technical means, the Controller does everything it can to ensure that its processors also take appropriate data security measures when working with your personal data.

Legal remedies

If you believe that the Controller has infringed a statutory provision on data processing or has failed to comply with one of your requests, you may initiate an investigation by the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) to bring the alleged unlawful processing to an end. The Authority’s contact details:

We also inform you that, in the event of an infringement of the statutory provisions on data processing, or if the Controller has failed to comply with one of your requests, you may bring civil proceedings against the Controller before a court. At your option, you may also bring the action before the regional court (törvényszék) competent for your place of residence or place of stay.

Amendments to the privacy notice

The Controller reserves the right to amend this privacy notice in a way that does not affect the purpose and legal basis of the processing. We publish the amended notice on the website with an updated date.

If the Controller intends to further process the collected data for a purpose other than that for which they were collected, it will inform you, prior to that further processing, of the purpose of the processing and of the following:

• the period for which the personal data will be stored, or, if that is not possible, the criteria used to determine that period;
• your right to request from the Controller access to, rectification or erasure of personal data concerning you or restriction of their processing, to object to the processing where it is based on legitimate interest, and, where the processing is based on consent or on a contractual relationship, to request that the right to data portability be ensured;
• where processing is based on consent, the fact that you may withdraw your consent at any time;
• the right to lodge a complaint with a supervisory authority;
• whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, whether you are obliged to provide the personal data, and the possible consequences of failure to provide such data;
• the existence of automated decision-making (if such a procedure has been applied), including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.

Processing may begin only after this; where the legal basis of the processing is consent, you must also consent to the processing in addition to being informed.

This document contains all relevant information on data processing in connection with the operation of the website and the business processing described in Chapter II, in accordance with Regulation (EU) 2016/679 of the European Union, the General Data Protection Regulation (hereinafter: the Regulation or GDPR), and Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (hereinafter: Infotv.).

Zsámbék, 25 September 2026

In case of any discrepancy, the Hungarian version prevails.