B OnSite

Privacy Notice

Effective from: 19 October 2026

Modified: 19 October 2026

(website, sales and the B OnSite application)

Version: v4.6 (2026-10-19)

Effective: from 13 October 2026

Issued by: B Consulting Kft. (registered office: 1102 Budapest, Kőrösi Csoma Sándor út 18-20., Hungary; company registration number: 01-09-067467; tax number: 10387355-2-42; e-mail: adatvedelem@bconsulting.hu)

Introduction and scope

This notice explains how B Consulting Kft. processes personal data on the B OnSite website (www.bonsite.hu), in its sales process, and when operating the cloud-based B OnSite application. It has been prepared under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information.

The notice has two parts. Part A applies to website visitors, prospects and registered users: here B Consulting Kft. is the controller. Part B applies to data processed in the B OnSite application: here the controller is typically the organisation (customer) using the application, and B Consulting Kft. is the processor.

This notice is for information only. Reading it does not constitute consent, and accepting it is not a condition for exercising data subject rights.

1. Controller details

  • Company name: B Consulting Kft.
  • Registered office: 1102 Budapest, Kőrösi Csoma Sándor út 18-20., Hungary
  • Company registration number: 01-09-067467
  • Tax number: 10387355-2-42
  • Data protection contact: adatvedelem@bconsulting.hu
  • Website: www.bonsite.hu

Please use the data protection e-mail address above for privacy questions, data subject requests and objections.

PART A: WEBSITE, CONTACT AND SALES

In this part B Consulting Kft. acts as an independent controller.

2. Personal data we process and its source

We receive the data directly from the data subject through the following forms and functions:

  • Contact form: name, e-mail address, company name and phone number (if provided), and the content of the message.
  • Package recommender (calculator): name, e-mail address, company name, phone number, role or job title, message, the answers given and the modules selected, and data indicating the source of the visit (referring page, campaign identifiers).
  • Quotation request, demo request, trial and audit request form: name, e-mail address, phone number, company name, type of enquiry and newsletter consent. For demo requests received earlier, the data also includes the requested modules, the preferred start date and the message.
  • Downloads (requesting downloadable materials): e-mail address and, if the data subject provides them, name and company name, the name of the requested material and the time of submission. To demonstrate consent (Article 7(1) GDPR), we store together with the download the type of consent (download form), the exact text of the consent statement shown (where the version shown can be identified), its language, the version of the privacy notice in force and the time of consent. The download form does not ask for a phone number. The material is downloaded directly on the download page; it is not sent by e-mail. For signed-in users the form shows a summary of the name, company name and e-mail address stored in the account and the material is downloaded with them; the "Use different details?" link allows other details to be entered.
  • Newsletter signup: e-mail address, language, place of signup (which page it was made from), text and time of consent.
  • Registration and customer account: name, e-mail address, phone number, company name, language and notification settings; quotation requests and orders recorded in the account (billing name, address, tax number), support tickets and messages, and the fact and time of downloads from the login-protected document library.
  • Log of acceptance of legal documents: at registration, and when a new version of a document is accepted, we record the user identifier and e-mail address, the type, version and content checksum of the document, the time and place of acceptance (registration or login), the IP address and the browser identifier.
  • Evidence log of declarations made in the customer portal: the type of declaration (offer accepted, rejected, ratification document uploaded), the user's account identifier, the identifiers of the offer and of the acceptance, for an acceptance the commitment period chosen and the hashes of the declaration texts, for an upload the hash of the uploaded file, the time of recording and the end of the retention period (in detail in section 8/A). No name, e-mail address, IP address or browser identifier is entered in this log.
  • Campaign and source data: when the quotation request, demo request, trial or audit request form or the package recommender (calculator) is submitted, we record the UTM parameters (utm_source, utm_medium, utm_campaign), the address of the referring page (without the query string), the path of the page, and which button or placement the enquiry came from. We record the Google Ads click identifier (gclid) only if the visitor has accepted marketing cookies. We store this data together with the enquiry.
  • Session of the package recommender (calculator): When the package recommender (calculator) is opened, we create an anonymous session. In it we store the campaign data of the visit (UTM parameters), the address of the referring page (without the query string), and the answers given in the calculator and the recommended package. If the visitor sends an enquiry, the session is linked to the enquiry.
  • Hash of the IP address (rate limiting): when the quotation request, demo request, trial or audit request form or the calculator is submitted, we create a hash of the visitor's IP address using a secret key that is changed daily (HMAC-SHA-256) and store it together with the time of submission. For an IPv6 address the hash is created from the subscriber network prefix. We do not store the raw IP address in this record, and the rows of this record do not refer to the enquiry. The hash is pseudonymised data, so we treat it as personal data.
  • Technical data: IP address, browser and device type, timestamps, cookies and similar identifiers (see section 7).

We do not request or process special categories of personal data; there is no need to enter such data in the message field either. We cannot process a request without the mandatory fields.

3. Purposes and legal bases

The following legal bases apply to each purpose:

  • Answering enquiries, making contact and sales follow-up (contact form, quotation request, demo request, trial and audit request, calculator): legitimate interest, Article 6(1)(f) GDPR. The legitimate interest is answering the enquiry received, arranging the requested demonstration, and building and maintaining the business relationship.
  • Preparing a quotation and a contract: where the data subject is the prospective contracting party (for example a sole trader), the legal basis is taking steps prior to entering into a contract, Article 6(1)(b) GDPR. Where the data subject is the contact person or representative of an organisation, the legal basis is legitimate interest, point (f).
  • Operating the customer account and customer portal (registration, quotations, orders, support tickets, document library): performance of a contract, point (b); for a person acting on behalf of an organisation, legitimate interest, point (f).
  • Evidencing acceptance of the legal documents (acceptance log): legitimate interest, point (f). The legitimate interest is being able to prove that the user accepted the General Terms and Conditions in force and read the Privacy Notice, and the establishment, exercise and defence of legal claims.
  • Evidence of declarations made in the customer portal (evidence log): legitimate interest, point (f). The legitimate interest is being able to show on the basis of which declaration texts, when and what declaration the customer's representative made, and the establishment, exercise and defence of legal claims (section 8/A).
  • Invoicing and retention of accounting documents: compliance with a legal obligation, point (c) (Section 169 of Hungarian Act C of 2000 on Accounting).
  • Website security and prevention of abuse (bot protection, system logs, limiting the frequency of form submissions by e-mail address and by hash of the IP address): legitimate interest, point (f). The legitimate interest is filtering out mass, automated or bad-faith submissions, so that genuine enquiries are not lost and the system stays operational.
  • Recording campaign and source data (UTM parameters, referring page, page path, the button the enquiry came from): legitimate interest, point (f). The legitimate interest is establishing which advertisement, campaign or page an enquiry received came from, and thereby measuring and improving the effectiveness of our marketing and sales activity. Without consent the browser keeps the UTM parameters only in its memory, at most until the page is reloaded, and does not write them to a cookie or session storage; we record them only together with the enquiry and in the anonymous session of the package recommender.
  • Anonymous session of the package recommender (calculator) (UTM parameters, referring page, the answers given in the calculator and the recommended package): legitimate interest, point (f). The legitimate interest is the same as for recording campaign and source data (establishing which advertisement, campaign or page the visit came from, and thereby measuring and improving the effectiveness of our marketing and sales activity), and analysing and improving how the calculator is used.
  • Recording the Google Ads click identifier (gclid) and storing first-touch campaign data in the session storage of the browser (bonsite_utm): consent, point (a) (marketing cookies), which can be withdrawn at any time in the cookie settings. Without consent we do not record the gclid.
  • Visitor statistics and marketing measurement (analytics and marketing cookies): consent, point (a), which can be withdrawn at any time in the cookie settings.
  • Requesting downloadable materials (lead magnet) and contact about the material (download page): consent, point (a). The data subject gives consent on the download form through a separate checkbox, expressly for B Consulting Kft. to process the data provided for the purpose of contacting the data subject about the downloaded material. Giving consent is required in order to download the material. Consent can be withdrawn at any time at the data protection e-mail address; withdrawal does not affect the lawfulness of the earlier processing, and after withdrawal we no longer process the data for this purpose. To demonstrate consent (Article 7(1) GDPR), we record the evidence data listed in section 2 together with the download; the legal basis for this is legitimate interest, point (f). The legitimate interest is being able to show that consent was given, on the basis of which text and when, and the establishment, exercise or defence of legal claims. The data is handled by authorised staff of B Consulting Kft., the processors are listed in section 6, and the data is not transferred to B ERP (section 4).
  • Newsletter and direct marketing: only on the basis of consent given through a separate, optional checkbox, point (a), in line with Section 6 of Hungarian Act XLVIII of 2008 on Commercial Advertising. After signing up for the newsletter, we send one informational welcome e-mail to the address, which contains the unsubscribe link.

Ticking the checkbox on our forms that refers to this notice confirms that the data subject has read the notice. It is not consent to the processing. The exception is the separate checkbox that names the purpose, shown when requesting downloadable materials and when signing up for the newsletter, which is consent.

The legitimate interest assessment for the processing based on legitimate interest is available on request at the data protection e-mail address.

4. Customer relationship management (CRM) system: B ERP

Data entered in the contact form, the quotation request, demo request, trial and audit request forms and the calculator is transferred automatically to B ERP, the customer relationship management (CRM) system of B Consulting Kft. The data transferred is: name, e-mail address, company name, phone number, message, requested modules, role and the type of the enquiry. For the quotation request, demo request, trial and audit request forms and the calculator, the transfer also includes the campaign and source data listed in section 2 (UTM parameters, referring page, page path, the button the enquiry came from and, with consent, the Google Ads click identifier); in B ERP this data appears in the notes of the enquiry. The hash of the IP address is not transferred to B ERP. An enquiry flagged as suspicious is transferred only after review by a member of our staff (section 8).

In B ERP the data is processed to handle the enquiry, make contact, prepare a quotation and follow up the sales process.

B ERP is the internal system of B Consulting Kft., operated by the company itself, so the transfer is not a disclosure to a third party. The B ERP database is located in the European Union (Ireland).

Data provided for downloads is not transferred to B ERP.

The prospect data transferred to B ERP does not include marketing consent.

5. Retention periods

  • Website database (enquiries submitted through forms): up to 12 months from submission.
  • Requesting downloadable materials: up to 12 months from submission in the website database, or until consent is withdrawn if that happens earlier. Evidence of consent (section 2) is deleted together with the enquiry. If the data subject withdraws consent, we stop contacting them, and from then on we keep the enquiry data only to demonstrate consent and to defend legal claims, for at most 12 months from submission.
  • Campaign and source data: together with the enquiry, up to 12 months in the website database and, in B ERP, for the period that applies to the prospect data kept there.
  • Session of the package recommender (calculator): a session that is not linked to an enquiry is kept for 12 months and is then deleted by a daily cleanup. A session linked to an enquiry is kept for the retention period of the enquiry.
  • Hash of the IP address (rate limiting): up to 1 day. The rows containing the hash are deleted when the secret key is changed each day; we do not keep the previous key, so earlier hashes can no longer be linked to an IP address. Rows older than 1 day are also deleted at the next submission. In backups, the rows and the previous key are kept at most for the backup retention period.
  • Browser session storage (bonsite_utm): until the browser tab or window is closed.
  • Transfer queue to B ERP: a successfully transferred item is deleted from the temporary queue of the website within 30 days.
  • CRM (B ERP), closed prospect that did not become a customer: 36 months from the last contact.
  • CRM (B ERP), prospect that became a customer: according to the retention period that applies to contract data.
  • Contract and invoicing data: for the period required by law; 8 years for accounting documents.
  • Customer account data: until the account is closed.
  • Acceptance log: 5 years from acceptance (general limitation period).
  • Evidence log (customer portal): the record of an acceptance for 5 years from the end of the commitment period (Section 6:22(1) of the Civil Code), the record of a rejection or an upload for 5 years from recording, but not earlier than the acceptance record of the same offer; then automatic deletion, or, in the case of a legal hold, until it ceases. Closing an account does not affect the records.
  • Data based on consent (newsletter, marketing): until consent is withdrawn.
  • Technical logs: up to 6 months for system security; this does not apply to the acceptance log and the hash of the IP address. The same applies to the evidence log of declarations made in the customer portal, which is kept under its own retention rule (section 8/A).

When the retention period expires, the data is deleted or anonymised. Following a justified objection or erasure request the data is deleted before the retention period expires, unless further processing is required by law or is necessary for the establishment, exercise or defence of legal claims.

6. Recipients and processors

Personal data is accessed by authorised staff of B Consulting Kft. We use the following service providers to operate the website and our sales process:

  • Supabase: database, user authentication and file storage (the database of the website and of B ERP).
  • Vercel: hosting and delivery of the website, and bot protection on the newsletter signup form (Vercel BotID). When the form is submitted, the bot protection evaluates technical characteristics of the browser and technical data of the request (for example IP address, user agent, request headers) to decide whether the request comes from a person or an automated program.
  • Resend and SparkPost: delivery of system messages and notification e-mails, including the internal notification sent to the staff of B Consulting Kft. when a download form is submitted.
  • Google (Google Analytics 4, Google Tag Manager): visitor statistics; analytics cookies are activated only after consent.
  • Meta (Meta Pixel) and LinkedIn (Insight Tag): marketing measurement; marketing cookies are activated only after consent.

Processors act only on the instructions of B Consulting Kft. under a data processing agreement. We do not sell personal data to third parties.

Some of these providers are companies established in the United States, so personal data may be transferred outside the European Economic Area. In that case the transfer is safeguarded by the adequacy decision on the EU-US Data Privacy Framework (Article 45 GDPR) or, failing that, by the standard contractual clauses adopted by the European Commission (Article 46 GDPR). Further information on the safeguards is available at the data protection e-mail address.

7. Cookies and similar technologies

The website uses the following cookies and storage:

  • sb-*-auth-token: Supabase authentication session (necessary, for the duration of the session)
  • onsite_cookie_consent: stores cookie preferences in the local storage of the browser (necessary)
  • NEXT_LOCALE: language preference (functional, 12 months)
  • _ga, _ga_*, _gid: Google Analytics 4 statistics (analytics, 2 years and 24 hours respectively)
  • bonsite_utm: first-touch campaign data (utm_source, utm_medium, utm_campaign, gclid) in the session storage of the browser (sessionStorage); written only after marketing cookies have been accepted (marketing); deleted when the browser tab is closed. Without consent the browser keeps the UTM parameters only in its memory, does not write them to a cookie or session storage, and we do not record the gclid.
  • bonsite.downloadProfile (local storage): the name, company name and e-mail address entered on the download form, only if the data subject ticks "Remember my details on this device for my next download (180 days)." (at the user's request, independent of the cookie settings); its purpose is to avoid re-entering them at the next download. The legal basis is the data subject's consent (Article 6(1)(a) GDPR; Section 155(4) of the Hungarian Electronic Communications Act (Eht.)), which can be withdrawn at any time with the "Not you? Clear my details" link. It stays on the data subject's device and reaches B Consulting Kft. only when the download form is submitted. Kept for 180 days from last use; once expired, it is deleted automatically the next time the website is opened, or earlier when the "Not you? Clear my details" link is clicked.
  • Google Tag Manager: manages the measurement tags; it does not set an identifier cookie of its own
  • _fbp, _fbc: Meta Pixel conversion tracking (marketing, 90 days)
  • LinkedIn Insight Tag cookies (for example li_fat_id, bcookie, lidc): LinkedIn campaign measurement (marketing; only if the measurement is switched on)

The website does not work properly without the necessary cookies. Analytics and marketing cookies are activated only after consent is given. Preferences can be changed at any time through the "Cookie Settings" link in the website footer.

8. Data security

B Consulting Kft. applies technical and organisational measures under Article 32 GDPR, in particular:

  • encrypted (TLS) data transmission
  • access control and restricted administrator access
  • access logging
  • regular backups
  • bot protection and rate limiting on forms

If an unusually large number of submissions arrives within a short time, the system flags the submission as suspicious. Flagging does not mean the enquiry is rejected: a flagged enquiry is not transferred to B ERP automatically but is reviewed by a member of our staff.

We do not make decisions based solely on automated processing that produce legal effects concerning the data subject or similarly significantly affect them (Article 22 GDPR).

8/A. Evidence of declarations made in the customer portal (evidence log)

In the customer portal of B Consulting Kft., representatives of organisations can view offers and make declarations related to entering into a contract: they can accept or reject an offer and upload the ratification (approval) document. B Consulting Kft. keeps a separate evidence log of these declarations. B Consulting Kft. is the data controller for this processing. The log does not record viewing or downloading of documents.

Purpose. To be able to show which declaration texts were displayed to the customer's representative, when, and what declaration was made, and to establish, exercise or defend legal claims. The log is not a monitoring or performance-measurement tool, it is not used for any other purpose and no profile is built from it.

Data processed. For each declaration the log contains:
- the type of declaration (offer accepted, offer rejected, ratification document uploaded);
- the account identifier of the signed-in user (an internal, random identifier of the authentication system; not an e-mail address or a name);
- the identifiers of the offer and of the acceptance;
- for an acceptance, the commitment period chosen in months, and the version and verification hashes of the mandatory declaration texts displayed (the log does not store the content of the texts);
- for the upload of a ratification document, the SHA-256 verification hash of the uploaded file (the log does not store the content of the document);
- a unique identifier of the operation, which is a code derived by a one-way procedure (for acceptance and rejection from the account, offer and one-time-code challenge identifiers, for an upload from the account identifier, the acceptance identifier and the file hash; the same input always gives the same code, so a repeated submission can be recognised) and an indication whether the operation was a repeated submission;
- the time of recording and the end of the retention period.

The log does not contain a name, e-mail address, phone number, tax number, the signatory's name and position, IP address, browser identifier, one-time code, the reason for a rejection or any free text. The identifiers and the time can together be linked to a person (the account identifier to the data subject's e-mail address in the authentication system, the offer and acceptance identifiers to the transaction in the customer's records), so we treat them as pseudonymised personal data, not as anonymous data. The content data of the declaration (the signatory's name, position and capacity, the customer's details, the IP address and browser identifier of the acceptance) are recorded by B ERP, not by this log; the B ERP's own privacy notice (available among the offer's documents) governs how that data is handled and retained.

Legal basis. Legitimate interest, Article 6(1)(f) GDPR. The legitimate interest is the establishment, exercise and defence of legal claims and, for that purpose, being able to show that the content and time of a contractual declaration correspond to what was recorded. The legitimate interest assessment is available on request at adatvedelem@bconsulting.hu.

Retention. The record of an acceptance is kept for 5 years counted from the end of the commitment period chosen (5 years from the acceptance plus the commitment period). For a variant without a commitment period (monthly), the retention is 5 years from the acceptance. Records of a rejection and of the upload of a ratification document are kept for 5 years from recording; if the acceptance record of the same offer or acceptance is kept for longer, these records are not deleted earlier either. The 5 years follow the general 5-year limitation period of the Hungarian Civil Code (Section 6:22(1)): we keep the log because of claims that can be enforced within that time. At the end of the retention period the record is deleted automatically (by a procedure that runs daily). In the case of a pending or anticipated dispute, claim or request of an authority, the records of the offer concerned are not deleted until the reason for keeping them has ceased, up to the deadline recorded for it (legal hold). Deleting or closing an account does not delete the records, because they remain necessary to enforce and defend legal claims. Rows deleted remain in backups at most for the backup retention period, and expired rows are deleted again from a restored backup, and individual deletions made earlier on the basis of a request are repeated from the case file.

Protection and immutability. To preserve the value of the evidence, records of the log cannot be modified: the database permissions and protective rules allow neither modification nor deletion during the operation of the application, except for the automatic deletion of expired records and an individual deletion carried out on the basis of a data subject's request in an identified and recorded manner. The record of deletions (time, number of rows deleted, reason, case reference) does not contain a name, contact details or the identifiers of the deleted records; it can be linked to the requester only through the case reference and the request file. Its rows are kept for 5 years from the run, after which the same daily procedure deletes them. The log cannot be reached through the website's user interface; designated staff of B Consulting Kft. have access to the records to the extent necessary to handle a legal claim, a request of an authority or a data subject's request.

Recipients and processors. The log is operated by Supabase (database service, in a data centre in Ireland, in the European Union); writing is carried out by a server function of Vercel (the website host). Both are processors under the conditions described in section 6 (including the safeguards for transfers outside the European Economic Area). We do not pass the records to third parties unless required by law or an authority, or necessary to enforce or defend a legal claim (for example to a court or a legal representative).

Rights of the data subject. The data subject may request access to the data in the log (Article 15 GDPR) and restriction of processing (Article 18). The data subject may object, on grounds relating to the particular situation, to processing based on legitimate interest (Article 21) and may request erasure (Article 17). Objections and erasure requests are assessed individually. As the purpose of the log is the establishment, exercise and defence of legal claims, an objection or erasure may be refused if keeping the record is still necessary for that purpose (Article 21(1), Article 17(3)(e) GDPR). In that case we give the decision with reasons within one month of receiving the request and inform the data subject of the remedies before the supervisory authority and the courts (section 14). If keeping the record is no longer necessary, we also delete it before the end of the retention period. Data portability does not apply to this processing, as it is based neither on consent nor on a contract.

PART B: THE B ONSITE APPLICATION

This part applies to data processed in the B OnSite application (administration interface, employee portal, subcontractor portal, mobile and terminal-based functions).

9. Roles in the application

The controller of the personal data processed in the application is the organisation (customer) that uses the application to manage the data of its own employees, subcontractors, visitors and partners. The customer determines the purpose and legal basis of the processing, the scope of the data and the retention period, and it is also the customer's task to inform the data subjects.

In this context B Consulting Kft. is a processor (Article 28 GDPR): it processes the data on the customer's instructions, under the Data Processing Agreement that forms a schedule to the Master License Agreement.

B Consulting Kft. is an independent controller of the data of the customer's contact persons and of the application's users that it processes for concluding and performing the contract, invoicing, support and system security (see section 12).

10. Data and purposes typically processed in the application

The list below shows the typical purposes and legal bases linked to the modules of the application. The actual legal basis is always determined by the customer as controller.

  • HR and Document Management: establishing and managing employment, keeping mandatory records. Typical legal basis: Article 6(1)(b) and (c) GDPR (Hungarian Labour Code, personal income tax and tax procedure legislation).
  • Occupational Safety: recording safety training, authorisations and incidents. Typical legal basis: point (c) (Hungarian Act XCIII of 1993 on Occupational Safety).
  • Digital Training: delivering and documenting mandatory or internal training. Typical legal basis: point (f) (compliance with audit and certification requirements).
  • Time Tracking and Access Control: recording working time, entry and exit of persons, permission management. Typical legal basis: point (c) (Section 134 of the Hungarian Labour Code), and points (b) and (f).
  • Truck Gate Management: entry of vehicles and drivers, security logging. Typical legal basis: point (f) (site security).
  • Guard Service: recording the on-site presence of the security company's staff based on gate movements. Typical legal basis: point (f) (property protection).
  • Visitor Management: identifying visitors, recording entry. Typical legal basis: point (f) (property protection and auditability).
  • Subcontractor Portal and Employee Portal: managing partner and employee data, documents and access. Typical legal basis: points (b) and (f).
  • Reports and Analytics, Operational Performance Measurement: resource usage and workflow analysis. Typical legal basis: point (f) (organisational efficiency).
  • Integrations and Automations: data exchange with external systems designated by the customer, on the customer's instructions.

Typical data categories: name, place and date of birth, mother's name, address, e-mail address, phone number, identity document number, tax identification number, photograph, access and working time data, training and occupational safety records, vehicle registration number, performance data, and system usage logs. Location data linked to recording working time is processed only if the customer uses this function.

The application does not make decisions based solely on automated processing; performance measurement supports evaluation carried out by the customer's staff.

11. Storage, sub-processors and retention in the application

  • Infrastructure: Amazon Web Services (AWS), EU (Frankfurt) region. Personal data is stored in the European Union.
  • Delivery of notification e-mails: SparkPost (system messages sent by the application).
  • Encryption: encrypted data transmission (TLS 1.2 or higher) and encrypted storage (AES-256).
  • Separation: multi-tenant architecture in which each customer's data is logically separated.
  • Access: role-based access control; support and development staff of B Consulting Kft. access customer data only at the customer's request, in a logged manner.
  • Backup: regular encrypted backups and a recovery plan.
  • Retention: B Consulting Kft. stores the data for the term of the license agreement. On termination the customer may request an export of its data within 30 days; after that the data is permanently deleted, and removed from backups according to the backup rotation.

Data is transferred outside the European Economic Area only with the safeguards under Articles 44-49 GDPR. In the event of a personal data breach, B Consulting Kft. notifies the customer within 72 hours of becoming aware of it.

12. Processing by B Consulting Kft. as controller in the customer relationship

B Consulting Kft. is an independent controller for the following processing:

  • Concluding and performing the contract, keeping in contact: name, job title, e-mail address and phone number of the customer's representative and contact persons. Legal basis: legitimate interest, point (f) (performing the contract and keeping in contact); point (b) where the contracting party is a natural person. Retention: 5 years after termination of the contract (general limitation period).
  • Invoicing: the data shown on the invoice. Legal basis: legal obligation, point (c). Retention: 8 years.
  • Support and issue handling: name and contact details of the person reporting, and the content of the report. Legal basis: legitimate interest, point (f). Retention: 5 years after termination of the contract.
  • System security: login and activity logs of user accounts (IP address, time, action). Legal basis: legitimate interest, point (f) (protecting the system and the data). Retention: according to the internal data security rules.

COMMON PROVISIONS

The sections below apply to both parts of this notice.

13. Data subject rights

Under the GDPR the data subject has the right to:

  • request information about and access to the data processed about them (Article 15)
  • request rectification of inaccurate data (Article 16)
  • request erasure of the data (Article 17)
  • request restriction of processing (Article 18)
  • data portability for automated processing based on consent or on a contract (Article 20)
  • withdraw consent at any time; withdrawal does not affect the lawfulness of earlier processing

Right to object (Article 21 GDPR): the data subject may object at any time, on grounds relating to their particular situation, to processing based on legitimate interest, in particular making contact, sales follow-up, the recording of campaign and source data and the handling of the package recommender session. Where the data subject objects to processing for direct marketing, we no longer process the data for that purpose. Objections and all other requests can be sent to adatvedelem@bconsulting.hu. We respond without undue delay and at the latest within one month. In the case of the evidence log of declarations made in the customer portal, an objection does not lead to automatic erasure: if keeping the entry is necessary for the establishment, exercise or defence of legal claims, we maintain the processing and give our reasons (section 8/A).

Requests concerning data processed in the application (Part B) must first be submitted to the customer acting as controller (typically the employer or the site operator). We forward any such request received by B Consulting Kft. to the customer without delay.

14. Remedies

If the data subject believes that the processing does not comply with the law, they may lodge a complaint with the supervisory authority:

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)

Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary

Phone: +36 1 391 1400

E-mail: ugyfelszolgalat@naih.hu

Website: www.naih.hu

The data subject may also bring the matter before a court; at the data subject's choice the action may be brought before the regional court of their place of residence or stay. Data subjects in another EU Member State may also contact their local supervisory authority.

15. Version and amendment of this notice

Version: v4.6 (2026-10-19). This version replaces v4.5 (2026-10-15). Version v4.5 replaced v4.4 (2026-10-14). Version v4.4 replaced v4.3 (2026-10-13). Version v4.3 replaced v4.2 (2026-10-13). Version v4.2 replaced v4.1 (2026-10-12). Version v4.1 replaced v4.0 (2026-10-07). Version v4.0 replaced the website privacy policy of 19 February 2026 and the B OnSite Privacy Notice v3.0 (1 August 2025).

Changes compared with v4.5: introduction of the evidence log of declarations made in the customer portal: the data processed, the purpose, the legal basis, the retention and the limits of the data subject's rights (sections 2, 3, 5, 8/A and 13).

We record the version identifier with each enquiry, so it can later be established which version was in force at the time of the enquiry.

B Consulting Kft. reviews this notice at least once a year and whenever the law or its operations change. The current version is available on the website; earlier versions are available on request.

In the event of any discrepancy between the Hungarian and the English version, the Hungarian version prevails.