Privacy Notice

D250 Systems Kft.

Effective date: 16 October 2026
Version: 2026.10.16

1. Purpose and scope of this notice

The purpose of this privacy notice is to provide clear and transparent
information
to the customers, website visitors, registered users, quotation requesters,
business partners, job applicants and support contacts of D250 Systems Kft.
about what personal data the company processes, for what purposes, on what legal
basis, for how long, and with the involvement of which categories of recipients.

This notice applies to personal data processing connected with the services
provided by D250 Systems Kft., the use of the d250.hu website and its
subdomains,
login and registration interfaces, internal web and mobile tools, customer
relations, contracting, invoicing, support, job applications and data processing
activities related to the company's operation.

2. Controller details

Controller name: D250 Systems Szolgáltató Korlátolt Felelősségű Társaság
Short name: D250 Systems Kft.
Registered office and postal address: 2083 Solymár, Orgona utca 9.,
Hungary
Company registration number: 13-09-198518
Registry court: Company Court of the Budapest Environs Regional Court
Tax number: 26680774-2-13
E-mail: info@d250.hu
Telephone: +36 20 975 3758

Requests and questions concerning data processing may be submitted by e-mail to
info@d250.hu or by post.

The Controller has not appointed a data protection officer because, based on the
processing activities described in this notice, such appointment is not
mandatory.
The data protection contact point is info@d250.hu.

3. Applicable legislation

The Controller processes personal data in accordance with, in particular, the
following legislation:

- Regulation (EU) 2016/679 of the European Parliament and of the Council, the
General Data Protection Regulation;
- Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of
Information;
- Hungarian Act CVIII of 2001 on Electronic Commerce Services and Information
Society Services;
- the applicable provisions of Hungarian electronic communications legislation
concerning cookies and electronic communications;
- the applicable Hungarian accounting and tax legislation;
- the contractual and claims-related provisions of the Hungarian Civil Code.

4. Data processing principles

The Controller processes personal data lawfully, fairly and transparently. Data
is collected only for specified, explicit and legitimate purposes and is not
processed in a manner incompatible with those purposes. The Controller processes
only data that is necessary and proportionate for the relevant purpose.

The Controller seeks to ensure that the personal data it processes is accurate
and up to date. Personal data is retained only for as long as necessary. The
Controller protects personal data by appropriate technical and organisational
measures against unauthorised access, alteration, transmission, disclosure,
erasure, destruction and damage.

5. Individual processing activities

5.1. Website visits and technical logging

Purpose: secure and proper operation of the website, troubleshooting,
prevention of abuse and maintenance of IT security.

Data processed: IP address, time of visit, browser and operating system
type,
pages visited, technical error logs and session identifiers.

Legal basis: the Controller's legitimate interest in operating and
securing
the website.

Retention period: technical log data is retained for no longer than 180
days,
unless longer retention is necessary for investigating a security incident,
asserting legal claims or complying with an authority procedure.

Recipients: the Controller's staff involved in IT operation and persons
assisting with the operation of the Controller's servers.

5.2. Creation and management of user accounts

Purpose: creating user accounts, enabling login, managing permissions
and
making the service available.

Data processed: name, e-mail address, password in hashed form (where
password login is used), the account's internal identifier and technical
identifiers connected with the account. Login events, together with the IP
address and timestamp, are recorded in the technical logs described in
section 5.1, and the IP address is used to limit repeated login attempts.

Sign-in with Google: where the user chooses to sign in with a Google
account, the login page loads Google's sign-in service (Google Identity
Services) in the browser, and Google transmits the user's name and e-mail
address to the Controller. If no account exists for that e-mail address,
the Controller creates one. Google receives the user's IP address and the
fact of the sign-in under its own privacy terms.

Legal basis: performance of a contract or taking steps prior to entering
into
a contract.

Retention period: for the lifetime of the user account. After deletion
of the
account, only the identification and evidentiary data necessary for the
establishment, exercise or defence of legal claims may be retained until the end
of the general limitation period.

Recipients: authorised staff and IT operators of the Controller.

5.3. Ordering services and performing contracts

Purpose: ordering services, creating and performing contracts, customer
identification, contact keeping and sending service-related notifications.

Data processed: name, company name, contact details, e-mail address,
telephone number, billing address, tax number, order details, contractual data,
payment status, and technical and administrative information related to the
service.

Legal basis: performance of a contract. In the case of contact persons
of
legal entity customers, the Controller's legitimate interest in maintaining
business contact.

Retention period: during the term of the contract and, after termination
of
the contract, until the end of the general limitation period for legal claims.

Recipients: the Controller's management, staff involved in
administration,
performance, finance and IT, the accountant, the bank and the legal
representative if this is necessary for the establishment, exercise or defence
of
legal claims.

5.4. D250.hu login, internal subdomains and permission management

Purpose: secure use of internal, customer-side or partner-side functions
available on the d250.hu website and on subdomains operated by D250 Systems
Kft.;
identification of users; allocation and verification of permissions; support for
internal workflows; logging; troubleshooting; prevention of abuse; and
maintenance of IT security.

Data processed: name, e-mail address, password in hashed form,
organisational or customer relationship identifiers, roles and permissions,
login timestamps, IP address, browser and
device data, session identifiers, logs of actions performed on the interfaces,
and business or technical data necessary for using the relevant internal
function.

Legal basis: performance of a contract if use of the interface is
connected
to a customer or user service. In relation to contact persons of legal entity
customers, partners or employers, the Controller's legitimate interest in
operating the service, internal administration and IT security. In the case of
employees and contractors, performance of obligations arising from employment,
mandate or another internal relationship, and the Controller's legitimate
interest in work organisation, asset protection, accountability and IT security.

Registration, login or continued use on the d250.hu website or its subdomains
means that the user has read and accepted the terms of use applicable to the
relevant interface and this privacy notice. This acceptance is not a general
data
protection consent covering all processing activities. Where the legal basis of
a
processing activity is consent, the Controller requests separate, explicit and
withdrawable consent. Processing necessary for operation, security, performance
of a contract, legal obligations or legitimate interests is carried out on the
separate legal bases identified in this notice.

Retention period: for as long as the user's permission exists. After the
permission ends, basic account identification and permission data may be
retained
until the end of the general limitation period for legal claims. Technical and
security log data is retained, as a rule, for no longer than 180 days, unless a
security incident, abuse, troubleshooting, authority request or dispute requires
longer retention.

Recipients: the Controller's management, staff involved in IT operation,
customer management, internal administration and permission management, and
processors assisting with the operation of the Controller's servers, systems and
backups.

5.5. FOX – Field Operations Extension internal mobile application

The Controller may operate an internal mobile application named FOX – Field
Operations Extension. FOX is intended to support field and internal operations,
in particular the registration and tracking of assets, equipment, inventory,
on-site tasks, inspections, maintenance and administrative processes. FOX is
intended for authorised users approved by the Controller, in particular
employees, contractors, subcontractors and partners. Although the application
may be distributed through public app stores for ease of installation and
update, access to FOX backend services requires an account issued by the
Controller and is not available to the general public.

Purpose: internal operational support, asset tracking, inventory
management,
field task documentation, identification of equipment and documents,
verification
of work processes, quality assurance, asset protection, accountability,
troubleshooting and IT security.

Data processed:

- account and identification data: user name, work-related e-mail address and
    contact details, internal user identifier, role and permissions;
- authentication and session data: login timestamps, session identifiers,
    password in hashed form, IP address;
- device data: an application-generated device identifier, the device name
    (on iOS this is the name the user gave the device, for example
    "Anna's iPhone", together with the model), whether the device is a
    physical device, and the push notification token (a Firebase Cloud
    Messaging token on both Android and iOS);
- workflow content: text messages, attachments, voice messages, photographs
    and video recordings made for internal workflows together with their
    technical metadata (which may include the capture location stored by
    the camera), barcodes, QR codes, serial numbers, inventory identifiers
    and other asset identifiers, comments, status changes, task records and
    timestamps;
- location data: latitude, longitude and altitude. While the FOX
    application is open in the foreground, the user has granted the
    location permission and the Controller has enabled location for the
    user and the device, the device sends its location to the FOX server
    when it has moved about 10 metres, at least every 10 minutes, when the
    application returns to the foreground, and when a workflow function
    requests a current position. The server keeps only the most recent
    position of the session; it does not build a location history. Location
    is attached to individual workflow actions (for example a scan, see
    below). The application does not perform background location tracking
    — when the application is not in the foreground, location reporting
    stops. The user may withdraw the permission at any time in the
    operating system settings;
- short-range device data: when the user starts a Bluetooth scan, the
    identifiers of all Bluetooth Low Energy devices within range during the
    scan (on Android these are hardware addresses), which may include
    devices not related to the workflow;
- NFC data: the content of the NFC tags read by the user during a workflow
    action.

Scan-activity log: every barcode, QR code or other identifier scan that the
FOX application transmits to the Controller's servers is recorded in an
append-only scan log. Each entry contains the scanned identifier, the
identity of the scanning user (user identifier and name), the time of the
scan and — where the device reported one — the GPS coordinates current at
the time of the scan. An identifier not yet known to the system is also
registered in the asset identifier register, with the scanning user as its
creator. Where a scan is made in an asset checkpoint workflow, a checkpoint
record with the scan location and the recording user is also created. The
purpose of these records is asset tracking and inventory history
(establishing where and when a given asset, device or identifier was last
sighted), accountability and asset protection; they are not used to
evaluate employee performance or to track persons.

Mobile operating system permissions used by FOX:

The FOX Android and iOS applications may request the following operating
system permissions. Each permission is granted or denied by the user in the
operating system permission dialog. Denial does not prevent use of the
application, but the corresponding function is not available.

- Camera (CAMERA): reading barcodes, QR codes and asset identifiers,
    and taking photographs and video recordings related to maintenance,
    damage, condition assessment, on-site fulfilment or internal records.
    Barcode recognition runs on the device.
- Microphone (RECORD_AUDIO): recording voice messages, dictation and the
    optional hands-free voice mode of the AI assistant (see section 5.11).
- Speech recognition (iOS) and the operating system's speech service
    (Android): dictation converts speech to text through the speech
    recognition service of the operating system. Depending on the device
    and its settings, Apple or Google may process the audio on their own
    servers for this purpose, under their own terms. Only the recognised
    text is sent to the Controller.
- Location (ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION): reporting the
    device's location to the FOX server while the application is open in
    the foreground, as described above. The application does not request
    background location access. The user may revoke the permission in the
    operating system settings at any time, after which the application
    continues to function but location-dependent features become
    unavailable.
- Bluetooth (BLUETOOTH, BLUETOOTH_ADMIN, BLUETOOTH_SCAN,
    BLUETOOTH_CONNECT): scanning for nearby Bluetooth Low Energy devices
    such as beacons and sensors used in the relevant workflow. The
    application does not use Bluetooth scanning to derive the user's
    location.
- Near Field Communication (NFC): reading NFC tags attached to
    physical assets where the workflow uses NFC-based identification.
- Push notifications (POST_NOTIFICATIONS; remote notifications on iOS):
    delivering operational notifications, for example a request to
    identify a device. Delivery is performed by Firebase Cloud Messaging,
    which on iOS forwards the notification to the Apple Push Notification
    service.
- Photo library and media access: selecting an image, video or document
    that the user wishes to attach to an internal workflow (through the
    system picker), and, on iOS, saving an image to the photo library at
    the user's request.
- Network access (INTERNET, ACCESS_NETWORK_STATE): communicating with
    the Controller's servers and detecting network availability.
- Vibration, audio settings and wake lock (VIBRATE,
    MODIFY_AUDIO_SETTINGS, WAKE_LOCK): tactile feedback, audio routing
    for voice features and receiving push notifications; no personal data
    is processed.

The Controller does not use these permissions to collect private images,
private audio outside the in-app voice features, location data outside the
periods when the FOX application is open in the foreground, or any content
unrelated to work performance.

FOX users must not record photographs, documents or comments that contain
personal data, special category data, private information or unnecessarily
identifiable images of third parties where such information is not necessary for
the internal workflow. If such data is nevertheless recorded, the Controller
will
delete or restrict it as soon as possible, unless retention is required for a
legal claim, authority procedure or another lawful purpose.

Legal basis: in the case of employees, processing necessary for
performance
of the employment relationship and work organisation, and the Controller's
legitimate interest in internal operation, asset protection, quality assurance,
accountability and IT security. In the case of contractors, subcontractors or
partners, performance of a contract or the Controller's legitimate interest in
documenting contractual and internal processes. Where the mobile operating
system
technically displays a permission request, granting the permission is a
technical
condition for using the relevant app function, but it does not replace the need
to identify the legal basis of processing under the GDPR.

Retention period: workflow, asset, inventory, maintenance, inspection
and task
data processed in FOX is retained for as long as necessary for the relevant
internal process, contract, asset register or legal claim. As a rule, it is
retained for 5 years from closure of the relevant matter or removal of the asset
from the register. Security and application logs are retained, as a rule, for no
longer than 180 days, unless an incident, dispute, troubleshooting or authority
request requires longer retention. Private data or data unnecessary for the
purpose is deleted or restricted once identified.

Recipients: the Controller's management, IT operators, staff responsible
for
internal administration, finance, asset management, technical, operational or
field tasks, and processors assisting with the operation of the FOX application,
related servers, databases, backups or permission-management systems.

Sub-processors and third-party services used by FOX:

- Google LLC (United States) — Firebase Cloud Messaging: delivery of
    push notifications to Android and iOS devices. Data shared with the
    recipient: the FCM device token and the notification content required
    for delivery (for example the name of the device to be identified).
    Firebase components of the application (Firebase Installations) also
    exchange technical installation identifiers with Google. Transfer
    safeguard: EU–U.S. Data Privacy Framework. Privacy information:
    https://policies.google.com/privacy
- Apple Inc. (United States and Ireland) — Apple Push Notification
    service: final delivery to iOS devices of the notifications forwarded
    by Firebase Cloud Messaging. Privacy information:
    https://www.apple.com/legal/privacy/
- AI assistant providers: the FOX conversation function and its voice
    features use the AI assistant service described in section 5.11, with
    the providers listed there.

Hosting and operation of the Controller's own backend services for FOX is
performed within the European Economic Area. If the Controller engages an
additional sub-processor in the future, it updates this notice and, where
the legal basis is consent, obtains separate consent before activating the
new sub-processor.

Account and data deletion for FOX users:

A FOX user may request deletion of their FOX account and the personal data
associated with the account (including their scan-log entries, registered
devices, conversations and session data) by sending an e-mail to
info@d250.hu from the e-mail address registered with the account. The
FOX application itself has no account deletion function. The Controller
verifies the request, completes the deletion within 30 days of receipt and
informs the user of completion.

The Controller may continue to retain only the data it is legally required
to retain or the data necessary for the establishment, exercise or defence
of legal claims (in particular, accounting and tax data under section 5.6
and data under section 5.10), and informs the user of the categories of
data retained and the legal basis for the retention.

Children:

The FOX application is intended for adult professional users. The Controller
does not knowingly process personal data of children under 16 through the
FOX application. If the Controller becomes aware that the personal data of a
child has been processed without an appropriate legal basis, it deletes the
data without undue delay.

5.6. Invoicing and accounting obligations

Purpose: issuing invoices, bookkeeping and complying with tax and
accounting
obligations.

Data processed: name, company name, billing address, tax number, order
and
invoice data, and payment data.

Legal basis: compliance with a legal obligation.

Retention period: the retention period specified by accounting and tax
legislation, as a rule 8 years.

Recipients: accountant, invoicing system, bank, tax authority and other
authorities specified by law.

5.7. Support, quotation requests, error reports and general contact

Purpose: responding to inquiries, providing quotations, handling error
reports, complaint handling and service-related communication.

Data processed: name, e-mail address, telephone number, postal address,
the
content of the inquiry, data generated during response and administration, and
technical data connected with an error report.

Legal basis: performance of a contract or taking steps prior to entering
into
a contract where the inquiry is contract-related; otherwise the Controller's
legitimate interest in handling and evidencing inquiries.

Retention period: 5 years after closure of the matter, or, in the case
of a
complaint or dispute, until the final closure of the dispute.

Recipients: the Controller's support, technical, finance and management
staff.

E-mail received at the Controller's addresses is stored on the Controller's
mail server and in its internal case-handling system. Incoming messages are
processed automatically on arrival: the sender's authentication results are
checked, and the message is classified and labelled for routing. This
automated processing serves sorting and abuse prevention and produces no
decision with legal effect.

5.8. Newsletters and direct marketing communications

At the effective date of this notice, the Controller does not operate a regular
newsletter database.

If the Controller intends to send newsletters or direct electronic marketing
communications in the future, it will do so only with an appropriate legal
basis,
by obtaining the necessary consent or documenting another applicable legal
basis,
by providing an unsubscribe option, and by updating this notice.

The Controller may send service messages directly connected with a service
without separate marketing consent where such messages are necessary for
contract
performance, service security, service operation or compliance with a legal
obligation.

5.9. Job applications

Purpose: receiving job applications, conducting the selection process
and
contacting applicants.

Data processed: name, e-mail address, telephone number, CV, motivation
letter, data concerning education, professional experience and salary
expectation, and other data voluntarily provided by the applicant.

Legal basis: taking steps prior to entering into a contract at the
request of
the data subject. If the Controller wishes to retain the application for future
opportunities, it requests separate consent.

Retention period: in the case of unsuccessful applications, 6 months
from the
closure of the selection process. On the basis of separate consent, data may be
retained for a talent database for no longer than 1 year.

Recipients: the Controller's management and staff participating in the
selection process.

5.10. Establishment, exercise and defence of legal claims

Purpose: establishment, exercise, defence and proof of contractual,
civil-law,
tax, authority or other legal claims.

Data processed: personal data relevant to the case, contractual data,
communications, invoices, payment data, technical logs and authority or court
documents.

Legal basis: the Controller's legitimate interest in establishing,
exercising
and defending legal claims; compliance with a legal obligation where an
authority
or court order applies.

Retention period: until the end of the limitation period for the claim,
or,
if proceedings are pending, until their final closure.

Recipients: legal representative, accountant, court, authority, bailiff,
insurer or another organisation acting under law.

5.11. AI assistants

Purpose: providing conversational AI assistants to users of the FOX
application, of the web interfaces on d250.hu subdomains (including the
duma chat service) and of the administration interface; answering
questions, drafting text, transcribing and generating speech, and, where
the user's permissions allow, reading or modifying data in the Controller's
systems at the user's request.

Data processed: the messages the user writes or dictates; voice recordings
and, in hands-free voice mode, the live microphone audio while the user is
speaking; attachments, photographs and files the user selects for the
conversation; the assistant's replies; and the data the assistant reads
from the Controller's systems to answer the request, which may include
personal data of other persons stored there (for example customer or
colleague names). Conversations are stored on the Controller's servers.

Legal basis: performance of a contract or, for employees and contractors,
the Controller's legitimate interest in efficient internal operation.
Using the assistant is optional.

Retention period: conversations are retained for as long as necessary for
the relevant service or internal process; the user may request their
deletion at any time (section 13).

Recipients: the assistant sends the conversation content to the AI
provider selected for the given assistant. The Controller uses these
services under the providers' business API terms, under which the
transmitted content is not used to train the providers' models. Providers
currently used:

- Anthropic, PBC (United States) — text conversation (Claude models).
    Privacy information: https://www.anthropic.com/legal/privacy
- OpenAI, L.L.C. (United States) — text conversation, speech-to-text,
    text-to-speech and real-time voice conversation (Realtime API).
    Privacy information: https://openai.com/policies/privacy-policy
- Google LLC (United States) — text conversation, speech-to-text,
    text-to-speech and real-time voice conversation (Gemini API and Gemini
    Live API). Privacy information: https://policies.google.com/privacy
- ElevenLabs, Inc. (United States) — speech-to-text and text-to-speech.
    Privacy information: https://elevenlabs.io/privacy-policy

Some assistants run on language models operated on the Controller's own
servers; their content does not leave the Controller's infrastructure.

5.12. Maps and address lookup

Where an interface displays a map or converts between addresses and
coordinates, the browser loads map tiles from the OpenStreetMap tile
servers and marker images from the unpkg.com content delivery network, and
the Controller's server sends the address or coordinates to be looked up
to the OpenStreetMap Nominatim service. These services receive the user's
IP address (for tiles and images) and the looked-up address or coordinates.
Legal basis: the Controller's legitimate interest in providing map-based
functions. Privacy information:
https://osmfoundation.org/wiki/Privacy_Policy

6. Cookies and similar technologies

The website, d250.hu login interfaces and internal systems on subdomains may use
without consent only those cookies and similar technologies that are strictly
necessary for operation, security, session management, permission management or
for providing a service expressly requested by the user.

At the effective date of this notice, the Controller does not use marketing,
remarketing, heatmap, session-replay or social-media tracking cookies requiring
consent without the user's prior consent.

If the Controller introduces analytics, marketing, advertising, heatmap or
social-media tracking technologies, it will use them only with a cookie
management solution that enables prior consent, withdrawal of consent,
equivalent options to accept and reject, and presentation of the cookies by
purpose, provider, expiry and data transfer.

Cookies currently used, all strictly necessary or set at the user's
request: the session cookie (login session, up to 30 days), a CSRF
protection cookie (security), a login continuity cookie (60 seconds) and a
theme cookie (the user's display preference, 1 year).

Cookies may be deleted or blocked in the browser. If strictly necessary cookies
are blocked, the website or some of its functions may not operate properly.

7. Automated decision-making and profiling

The Controller does not make decisions based solely on automated processing that
would produce legal effects concerning the data subject or similarly
significantly affect the data subject.

The Controller does not carry out profiling that would significantly affect the
rights or legitimate interests of the data subject.

8. Special category data

As a rule, the Controller does not request or process special category personal
data, including in particular health data, data concerning political opinions,
religious or philosophical beliefs, trade union membership, genetic or biometric
identification, sex life or sexual orientation.

If the data subject voluntarily provides such data, for example in a CV, message
or document, the Controller does not use it for decision-making unless
processing
of the specific data is required by law or by the explicit request of the data
subject.

9. Processors and recipients

During its operation, the Controller may transmit or make personal data
available
to the following categories of recipients:

- accountant and tax adviser;
- invoicing and financial administration service provider;
- bank and payment service provider;
- service providers involved in IT operation, maintenance or development;
- legal representative;
- authority, court or other body acting under law;
- postal or courier service provider where sending a paper document is
    necessary.

The Controller uses only processors that provide appropriate guarantees for the
protection of personal data and process data solely according to the
Controller's
instructions.

The Controller enters into a written data processing agreement with processors
where the processor processes personal data on behalf of the Controller.

10. Transfers to third countries

The Controller transfers personal data to a third country or international
organisation only where the conditions laid down in the GDPR are met.

Transfers outside the European Economic Area may take place, in particular, on
one of the following safeguards:

- an adequacy decision of the European Commission;
- the EU–U.S. Data Privacy Framework, where the U.S. recipient holds a valid
certification;
- the standard contractual clauses adopted by the European Commission;
- another appropriate safeguard permitted by the GDPR.

Where the Controller uses a recipient in a third country, it examines the
lawfulness of the transfer, the recipient's data protection safeguards and the
enforceability of data subject rights.

Identified third-country recipients in current use:

- Google LLC (United States) — Firebase Cloud Messaging push delivery for the
    FOX application, Google sign-in, and AI assistant services (section
    5.11) — EU–U.S. Data Privacy Framework.
- Apple Inc. (United States and Ireland) — Apple Push Notification service
    for the FOX iOS application — EU–U.S. Data Privacy Framework where
    applicable, complemented by Apple's standard data processing terms.
- Anthropic, PBC, OpenAI, L.L.C. and ElevenLabs, Inc. (United States) — AI
    assistant services (section 5.11) — EU–U.S. Data Privacy Framework where
    the recipient is certified, otherwise the standard contractual clauses
    adopted by the European Commission, incorporated in the provider's data
    processing terms.

The Controller does not transfer personal data to AI providers established
in other third countries.

This list is updated when the Controller introduces, replaces or removes a
third-country recipient.

11. Data security

The Controller protects personal data by appropriate technical and
organisational
measures. These include, in particular:

- permission management and restriction of access;
- password protection and control of administrative access;
- encrypted or protected communication where appropriate;
- access to personal data only on the basis of job-related or contractual need;
- use of backups;
- handling of vulnerabilities, errors and incidents;
- storage of paper documents in a locked location;
- confidentiality obligations for staff and contributors;
- documentation and, where necessary, notification of incidents.

The Controller designs security measures taking into account the nature, scope,
context and purposes of processing, and the risk posed to the rights and
freedoms
of data subjects.

12. Handling of personal data breaches

A personal data breach means a breach of security leading to the accidental or
unlawful destruction, loss, alteration, unauthorised disclosure of, or access
to,
personal data transmitted, stored or otherwise processed.

The Controller keeps a record of personal data breaches. If a breach is likely
to
result in a risk to the rights and freedoms of natural persons, the Controller
notifies the Hungarian National Authority for Data Protection and Freedom of
Information without undue delay and, where feasible, no later than 72 hours
after
becoming aware of it.

If the personal data breach is likely to result in a high risk to the rights and
freedoms of data subjects, the Controller also informs the affected data
subjects
without undue delay.

13. Rights of data subjects

The data subject may request from the Controller:

- information about the processing of their personal data;
- access to personal data concerning them;
- rectification of inaccurate personal data;
- completion of incomplete personal data;
- erasure of personal data;
- restriction of processing;
- data portability where its conditions are met;
- the right to object to processing based on legitimate interest;
- the right to object to processing for direct marketing purposes;
- withdrawal of consent where processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out
before the withdrawal.

The Controller responds to the request without undue delay and no later than one
month after receipt of the request. Where necessary, taking into account the
complexity and number of requests, this period may be extended by two further
months. The Controller informs the data subject of the extension within the
first
month.

Before fulfilling a request, the Controller may request proof of the data
subject's identity if it has doubts concerning the identity of the person making
the request.

As a rule, the Controller fulfils requests free of charge. In the case of a
manifestly unfounded or excessive request, the Controller may charge a
reasonable
fee or refuse to act on the request.

Account and data deletion: in addition to the rights listed above, a
registered user — including a FOX application user — may request deletion of
their account and the personal data associated with the account by sending
an e-mail to info@d250.hu from the e-mail address registered with the
account. The Controller verifies the request and completes the deletion
within 30 days of receipt, except for data the Controller is legally required to retain or
data necessary for the establishment, exercise or defence of legal claims;
in such cases the Controller informs the user of the categories of data
retained and the legal basis for the retention.

A registered web user may also delete their account immediately on their
profile page. This removes the account and its login data at once; to have
other associated data (such as FOX records or AI conversations) deleted as
well, the user may send the e-mail request described above.

14. Remedies

The data subject may first contact the Controller with questions, comments or
complaints concerning data processing at info@d250.hu.

The data subject has the right to lodge a complaint with a data protection
supervisory authority. Pursuant to Article 77 of the GDPR, the data subject
may lodge the complaint, at their choice, with the Hungarian National
Authority for Data Protection and Freedom of Information or with the
supervisory authority of the EU Member State of the data subject's habitual
residence, place of work or place of the alleged infringement.

Hungarian National Authority for Data Protection and Freedom of Information
Registered office: 1055 Budapest, Falk Miksa utca 9-11., Hungary
Postal address: 1363 Budapest, Pf. 9., Hungary
E-mail: ugyfelszolgalat@naih.hu
Telephone: +36 1 391 1400
Website: www.naih.hu

The data subject also has the right to bring proceedings before a court. The
proceedings may be initiated, at the data subject's choice, before the court
having jurisdiction based on the Controller's registered office or before the
court having jurisdiction based on the data subject's place of residence or
stay.

15. Amendment of this notice

The Controller reviews this notice at least annually and whenever there is a
material change in processing, technology, services or applicable legislation.

The Controller publishes the amended notice on its website or by another
appropriate means. If an amendment materially affects the rights of data
subjects
or the essential circumstances of processing, the Controller also draws the data
subjects' attention to the change in an appropriate manner.

16. Final provisions

This notice was prepared by reviewing, consolidating and modernising the 2019
privacy documents. With the entry into force of this notice, earlier privacy
notices and policies are no longer used for public privacy information purposes.

Place and date: Solymár, 16 October 2026

D250 Systems Kft.