Effective: 29 September 2026
This is an English translation of the Hungarian Privacy Policy (Adatkezelési tájékoztató). In the event of any discrepancy, the Hungarian version shall prevail.
The purpose of this privacy policy (hereinafter: the Policy) is to explain, in a transparent and easy-to-understand way, what personal data FleetMate Solutions Kft. (hereinafter: the Controller) processes on its website (fleetmate.hu) and in the course of providing its services, for what purposes and on what legal basis, and what rights data subjects have.
In processing personal data, the Controller acts in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.), and other applicable Hungarian legislation.
1. Controller details
The Controller is not obliged to designate a data protection officer (DPO) and, pursuant to Article 37 GDPR, has not appointed one. For data protection matters, please use the Controller’s contact details above.
2. Purpose, legal basis and duration of processing
2.1. Quote requests and contact via the website
When you fill in the contact / quote request form on the website, the Controller processes the data provided in the form as follows.
| Data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Name, phone number, email address, service type, preferred date, client type (private individual / B2B), message | Responding to the enquiry, sending a tailored quote, contacting you with a view to concluding a contract | Article 6(1)(b) GDPR — taking steps at the request of the data subject prior to entering into a contract; and Article 6(1)(a) GDPR — consent of the data subject (if no contract is concluded) | If a contract is concluded: according to the retention periods for contractual data (see 2.2). If not: no more than 6 months, after which the data is deleted. |
| The fact that the data processing consent checkbox was ticked | Proof of consent to data processing | Article 7(1) GDPR — the controller’s obligation to demonstrate consent | Until consent is withdrawn, or 5 years |
2.2. Contractual relationship, provision of services
For contracted clients and business partners, the Controller processes data for the following purposes.
| Data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Name, phone number, email address and home address of the client/contact person or, for companies, registered office, company registration number, tax number, billing details | Performance of the service (chauffeur service, fleet management, pick-up & drop-off), communication, performance of the contract | Article 6(1)(b) GDPR — performance of a contract | 5 years from termination of the contract (Section 6:22 of the Hungarian Civil Code) |
| Billing and accounting data (name, address, tax number, subject of performance, consideration) | Issuing and retaining accounting documents | Article 6(1)(c) GDPR — legal obligation (Hungarian Act C of 2000 on Accounting, Act CXXVII of 2007 on VAT) | 8 years from issuing the accounting document (Section 169 of the Accounting Act) |
| Technical data provided for performing an order (e.g. pick-up point, route, vehicle details) | Carrying out the order, preparing the handover/acceptance record | Article 6(1)(b) GDPR — performance of a contract | 5 years from closing the order |
| Photographs of the vehicle (for the pick-up and delivery service, before and after every movement, e.g. exterior and interior condition, odometer reading, licence plate) | Documenting the handover/acceptance, recording the condition of the vehicle, clarifying any damage claims and protecting the Controller’s legal claims | Article 6(1)(f) GDPR — legitimate interest (the Controller’s and the client’s interest in reliable documentation of the vehicle’s condition) | 30 days; in the event of a dispute or damage claim, until it is resolved |
FleetMate Solutions Kft. retains photographs for 30 days for the purpose of documenting the handover/acceptance. As part of the pick-up and delivery service, the Controller takes photographs of the vehicle’s condition before and after every vehicle movement, so that the condition of the vehicle at pick-up and at delivery can be clearly verified. If a damage claim or dispute arises within the 30-day period, the Controller retains the relevant photographs until it is resolved. The Controller has carried out a legitimate interest assessment for this processing, which is available to data subjects on request.
2.3. Website visits and cookies
The Controller uses cookies and technical log data to operate the website, keep it secure and improve its quality. A detailed description of the cookies and the option to change your settings are available in the cookie banner displayed on the website.
| Cookie type | Purpose | Legal basis | Duration |
|---|---|---|---|
| Necessary (technical) cookies | Essential for the website to function (e.g. session management, security identification, storing cookie preferences) | Article 6(1)(f) GDPR — legitimate interest (functioning of the website) | Until the end of the session, no more than 12 months |
| Statistics / performance cookies | Anonymised measurement of traffic and user interactions | Article 6(1)(a) GDPR — consent of the data subject (via the cookie banner) | No more than 24 months, or until consent is withdrawn |
| Server log data (IP address, timestamp, User-Agent) | Operation, security, prevention of abuse | Article 6(1)(f) GDPR — legitimate interest | No more than 6 months |
The Controller only places cookies that require consent after you have accepted the relevant category in the cookie banner. You can withdraw your consent at any time via the same interface.
Analytics tools we use (only loaded if you accept the “Analytics” category):
| Tool | Provider | Purpose | Cookies and retention |
|---|---|---|---|
| Google Analytics 4 | Google Ireland Ltd. (Ireland) | Visitor statistics: which pages are viewed, where visitors come from, what devices they use. | _ga, _ga_* – 2 years |
| Microsoft Clarity | Microsoft Ireland Operations Ltd. (Ireland) | Recording clicks, scrolling and mouse movement, heatmaps and session replays to improve the usability of the website. Text typed into form fields is masked and not recorded. | _clck – 1 year, _clsk – 1 day; on Microsoft’s own domain: MUID, CLID – up to 1 year |
Google and Microsoft may also process data in the United States. Their parent companies (Google LLC, Microsoft Corporation) participate in the EU–U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission. More information: Google Privacy Policy, Microsoft Privacy Statement.
3. Data transfers and processors
To the extent necessary for providing its services, the Controller transfers personal data to the following processors and contributors, under a data processing agreement pursuant to Article 28 GDPR.
- Hosting and email provider: Rackhost Zrt. (registered office: Tisza Lajos krt. 41., 6722 Szeged, Hungary) — operation of the website and company email.
- Cookie management service: CookieYes Limited — management of cookie consents on the website.
- Web analytics: Google Ireland Ltd. (Google Analytics) and Microsoft Ireland Operations Ltd. (Microsoft Clarity) — measuring website traffic, only with your consent (see section 2.3).
- Accountant: the Controller’s contracted accounting partner — accounting and payroll tasks.
- Lawyer / legal adviser: in contractual matters and legal representation.
- Contractual partners, subcontractors: to the extent necessary to perform an order (e.g. name, business email, pick-up point) — solely for carrying out the specific order.
Processors act solely on the Controller’s written instructions and in compliance with the GDPR. The Controller does not transfer personal data to third countries (outside the EEA).
4. Data security measures
The Controller applies organisational and technical measures in line with the current state of the art to protect personal data. These include, among others: HTTPS encryption on the website, strong passwords and password-based access restriction, regular backups, role-based access control, and binding contractual partners to confidentiality and data protection obligations.
5. Rights of data subjects
Under the GDPR, data subjects have the following rights:
- Right of access (Article 15 GDPR): you may request information about what personal data we process about you.
- Right to rectification (Article 16 GDPR): you may request the correction of inaccurate data.
- Right to erasure / “right to be forgotten” (Article 17 GDPR): you may request the deletion of your data in the cases defined by law.
- Right to restriction of processing (Article 18 GDPR): in certain cases you may request that processing be “frozen”.
- Right to data portability (Article 20 GDPR): where processing is automated and based on consent or a contract, your data can be provided to you, or to another controller, in a machine-readable format.
- Right to object (Article 21 GDPR): you may object at any time to processing based on legitimate interest.
- Withdrawal of consent: where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
To exercise your rights, you can contact us using any of the Controller’s contact details. The Controller will examine your request and take the necessary action within no more than 1 month of receipt. Where justified, this deadline may be extended by a further 2 months, in which case you will be notified in advance.
6. Legal remedies — supervisory authority
If you believe that the Controller has infringed the GDPR or the applicable Hungarian legislation when processing your personal data, you may lodge a complaint with the supervisory authority:
You also have the right to an effective judicial remedy and may bring the matter before the regional court (törvényszék) competent for your place of residence or stay.
7. Amendments to this Policy
The Controller reserves the right to amend this Policy unilaterally. The amended Policy enters into force upon publication on the website; the Controller will inform visitors of any material changes in a clearly visible manner on the website.
Last updated: 29 September 2026