This notice explains the processing of personal data in connection with the introductory website of A & A Systems Kft. and contact with the company. Processing relating to service contracts is also governed by the relevant contract and applicable legislation.
1. Controller and contact
- Controller
- A & A Systems Szolgáltató és Tanácsadó Korlátolt Felelősségű Társaság
- Registered office and postal contact
- 2310 Szigetszentmiklós, II. Rákóczi Ferenc utca 7., Building A, 3rd floor, door 30, Hungary
- Company registration number
- 13-09-148708
- Tax number
- 23442320-2-13
- info@aasystems.hu
- Telephone
- +36 30 413 1471; +36 30 427 8959
Requests concerning processing may be sent to the email or postal address above. Please identify the matter concerned and the right you wish to exercise. We request only the information necessary to establish your identity and identify the matter in order to fulfil the request.
2. Principles of processing
We process personal data lawfully, fairly and transparently, for specified purposes and limited to the data necessary. We seek to ensure accuracy and retain data for the period necessary for the purpose of processing. Access and security measures are adapted to the nature of the data and the risks of processing.
3. Data, purposes, legal bases and retention
3.1. Visiting the website
When serving the website, the web server may process technical data, including IP address, request time, requested path, response status and technical headers sent by the browser. The purposes are to serve the website, investigate operational errors and protect against abuse. The legal basis is legitimate interests under Article 6(1)(f) GDPR: secure and reliable operation of the website.
Technical data are retained for the time necessary to investigate operational and security events and resolve related claims. The application does not perform visitor profiling or tracking for marketing. Server log processing is also governed by the hosting operation and retention rules.
3.2. Contact and requests for quotations
When you contact us, we process your supplied name, email address, message content and correspondence relating to the enquiry. Telephone or direct email enquiries may include additional contact data voluntarily supplied by you. The purposes are to answer the enquiry, discuss technical requirements and prepare a quotation.
The legal basis for enquiries through the web form is the consent given there, under Article 6(1)(a) GDPR. Processing necessary to prepare a contract at the data subject's request is based on Article 6(1)(b). For business contacts of legal persons, the legitimate interest in maintaining contact may also apply under Article 6(1)(f).
Providing data is voluntary. We cannot handle an enquiry without the contact information needed to respond or a substantive message. Consent may be withdrawn without affecting the lawfulness of earlier processing. Data processed on consent are processed until withdrawal and, after closure of the matter, only for as long as necessary for the original purpose. The need to delete data about prospective customers that are no longer necessary must be reviewed regularly, at least annually. Data relating to contract formation, legal claims or statutory obligations are retained under the corresponding legal basis.
After a successful web enquiry, an automatic acknowledgement email may be sent to the supplied address containing the submitted data. It is neither an order nor a contract. Please do not send passwords, access codes or special categories of personal data.
3.3. Customer relationships, billing and complaints
Customer and contact data necessary for performance of the contract are used to provide the service and handle administration. The legal basis for billing is a legal obligation under Article 6(1)(c) GDPR. Invoices and accounting records must be retained for at least eight years under accounting legislation. Retention of complaint data is determined by applicable complaint-handling legislation. Further conditions for hosting and domain registration are contained in the relevant service document and individual contract.
4. Cookies and technical protection
The introductory pages do not use Google Analytics, advertising or social media tracking code, external fonts or embedded third-party services. The introductory website has no newsletter subscription or user registration.
The contact endpoint uses a technical, session-related cookie named AAContact for secure form handling and CSRF protection. It is not a marketing cookie; its lifetime is related to the browser session, although session restoration may affect how long it actually persists. Blocking it may prevent the form from working. The other website content remains readable.
To limit sending abuse, the endpoint uses an identifier derived from the IP address with a secret key and attempt timestamps. The rate-limiting window is 15 minutes. This application file does not store raw IP addresses, names, email addresses or messages. A separate cleanup task removes expired files. The pseudonymised identifier may also be personal data; the legal basis is the legitimate interest in preventing abuse.
5. Access and recipients
Authorised managing directors, employees and contributors necessary for the task may access the data. Recipient categories may include hosting and IT operations providers, technical email providers and, for billing, the accounting contributor. Data may also be disclosed to authorities where required by law or a binding authority order.
A processor may process data only on the controller's instructions and within appropriate contractual arrangements. Access must be limited to what is necessary for the task. If processing requires transfer to a third country, the conditions and appropriate safeguards under Chapter V GDPR must be ensured. Information about recipients and transfer conditions used in a particular matter may be requested at the data protection contact address.
The webmail, MyAdmin and ISPConfig links open separate customer interfaces. Processing there is also governed by the relevant service relationship and interface notice.
6. Data subject rights
Subject to GDPR conditions, you may request access, rectification, erasure and restriction of processing. You may also have the right to data portability for automated processing based on consent or contract. You may object to processing based on legitimate interests on grounds relating to your particular situation. You may withdraw consent at any time. The right to erasure does not override mandatory retention or other GDPR exceptions.
We respond without undue delay, normally within one month of receiving the request. If necessary, we notify you within the first month of an extension under the GDPR and its reasons. Exercising rights is normally free of charge; for manifestly unfounded or excessive requests, Article 12(5) GDPR may apply. The website does not perform automated decision-making or profiling.
7. Complaints and remedies
You may contact the controller directly about processing; this is not a prerequisite for recourse to an authority or court. Complaints may be lodged with Hungary's National Authority for Data Protection and Freedom of Information (NAIH) or the competent supervisory authority. Judicial remedies are also available.
NAIH: 1055 Budapest, Falk Miksa utca 9–11, Hungary; postal address: 1363 Budapest, Pf. 9; telephone: +36 (1) 391 1400. Contact details and how to initiate proceedings: NAIH — customer service and contact. The authority's ordinary email address may be used for information; according to NAIH, proceedings cannot be initiated by email.
8. Data security and breaches
Restricted access, encrypted transmission and appropriate technical and organisational safeguards form part of processing. In a personal data breach, the company assesses risk, documents the event and makes the notification or communication to data subjects required under Articles 33–34 GDPR if the relevant conditions are met.