Privacy policy
Information on the processing and protection of personal data by Unio Telecom Kft. in compliance with the GDPR.
Data protection and privacy notice
General Data Protection Regulation (GDPR) compliance statement
Before providing your personal data, please read this data management information carefully. It has been prepared in accordance with current European and Hungarian data protection legislation, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council ("GDPR"), Act CXII of 2011 on the right to informational self-determination and on freedom of information ("Infotv."), and Act XLVIII of 2008 on the basic conditions and certain limitations of economic advertising activities ("Grt.").
The purpose of this notice is to regulate the processing of your personal data during registration, shopping, inquiries, contract fulfillment, and newsletter services via the www.uniotelecom.com website, as well as electronic surveillance operations at the company premises.
1. Data controller information
- Company name: Unio Telecom Kft.
- Registered office: 2363 Felsőpakony, Iparterület, Major út 2., Hungary
- Company registry: 13-09-135187 (Court of Registration of the Pest County Court)
- Tax number: HU12426250 (12426250-2-13)
- Telephone: +36-30-914-9999
- Email: info@uniotelecom.hu
- Official website: www.uniotelecom.com
- Data processing location: 2363 Felsőpakony, Iparterület, Major út 2.
2. Principles and legal bases of data processing
2.1 Principles
In processing personal data, the Data Controller strictly adheres to the core principles laid down in Article 5 of the GDPR:
- Lawfulness, fairness, and transparency
- Purpose limitation
- Data minimisation
- Accuracy
- Storage limitation
- Integrity and confidentiality
- Accountability
2.2 Legal bases
Personal data is processed only when at least one of the following conditions applies under GDPR Article 6:
- a) Consent: The data subject has given consent to the processing of their personal data for one or more specific purposes.
- b) Performance of a contract: Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
- c) Compliance with a legal obligation: Processing is necessary for compliance with a statutory legal obligation to which the controller is subject.
- d) Vital interests: Processing is necessary in order to protect the vital interests of the data subject or of another natural person.
- e) Public interest: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
- f) Legitimate interests: Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.
3. Scope, purpose, and retention of specific data processing activities
3.1 & 3.2 Statutory billing and accounting obligations
Legal basis: GDPR Article 6(1)(c) – Compliance with legal obligations under Act CXXVII of 2007 on VAT (Chapter X) and Act C of 2000 on Accounting (§ 169).
Purpose: Issuing statutory tax invoices, revenue record keeping, and accounting audit trail.
Scope of data: Invoicing name, billing address, tax number / EU VAT number, payment details.
Retention period: Minimum 8 years following the close of the financial business year pursuant to Section 169 of Act C of 2000.
3.3 Customer account registration on the website
Legal basis: GDPR Article 6(1)(b) – Performance of contract / steps prior to contract conclusion.
Purpose: Managing customer account, order history, fast checkout, and personalized service delivery.
Scope of data: Full name / company name, email address, telephone number, billing and shipping address, password (encrypted).
Retention period: 5 years from the last active login or purchase (general civil statute of limitations), or until account deletion request.
3.4 Online shopping, order fulfillment, and delivery
Legal basis: GDPR Article 6(1)(b) – Performance of the sales and delivery contract.
Purpose: Processing orders, shipping products, communicating order statuses, and handling logistics.
Scope of data: Name, billing and delivery address, telephone number, email address, ordered items, delivery preferences.
Retention period: 5 years following order completion (contractual statute of limitations under the Hungarian Civil Code).
3.5 Inquiries via contact form, email, or telephone
Legal basis: GDPR Article 6(1)(a) – Voluntary consent of the sender.
Purpose: Answering commercial, technical, and general business inquiries and providing quotes.
Scope of data: Name, email address, telephone number, message subject, and inquiry content.
Retention period: Up to 1 year after the resolution of the inquiry, or until consent is revoked.
3.6 Handling warranty claims and consumer complaints
Legal basis: GDPR Article 6(1)(c) – Compliance with legal statutory obligations under Act CLV of 1997 on Consumer Protection.
Purpose: Recording and resolving warranty, defect, or quality complaints, keeping mandatory complaint protocols.
Scope of data: Consumer name, contact details, description of complaint, product serial number, resolution protocol.
Retention period: 3 years from recording the protocol pursuant to Section 17/A of Act CLV of 1997.
3.7 Newsletter subscription and commercial updates
Legal basis: GDPR Article 6(1)(a) – Voluntary consent pursuant to Section 6 of Act XLVIII of 2008 (Grt.).
Purpose: Sending electronic commercial announcements, discounts, and product releases.
Scope of data: Name and email address.
Retention period: Until consent is withdrawn. Unsubscription is accessible via the direct link in every email or by contacting info@uniotelecom.hu.
3.8 Electronic surveillance system (CCTV) at company premises
Legal basis: GDPR Article 6(1)(f) – Legitimate interest of the Data Controller, in harmony with the provisions of the Labor Code (Mt. § 9(2) and § 11/A(1)) regarding workplace and property security.
Purpose: Asset protection at 2363 Felsőpakony, Iparterület, Major út 2., prevention and detection of unlawful acts, safety of personnel and visitors.
Placement: Fixed cameras directed exclusively at access points, private company roads, loading bays, and high-value equipment storage. Public spaces and non-work private areas (restrooms, dressing rooms) are strictly excluded.
Warning signs: Visual pictograms and warning notices are placed prominently at all entrances.
Retention period: Unless required for official police or judicial proceedings, camera recordings are automatically deleted after a maximum of 14 calendar days.
4. Data processors and recipients
To fulfill contractual commitments and provide our services, the Data Controller engages trusted third-party data processors under strict data processing agreements guaranteeing GDPR compliance:
DPD, GLS, and freight logistics partners – strictly for package dispatch, address label printing, and delivery notifications.
Certified chartered accountants and statutory tax advisors managing invoice bookkeeping and tax reports.
Secure web hosting, database providers, and electronic communications service providers within the EU.
The Data Controller does not transfer personal data to third countries outside the European Economic Area (EEA).
5. Cookies and online tracking
The www.uniotelecom.com website uses cookies to ensure proper website functionality, provide security, and analyze anonymous traffic statistics. Cookies are small text files stored locally on your device by your web browser.
For comprehensive information regarding specific cookie types, durations, and management instructions across different web browsers, please consult our dedicated Cookie policy page.
6. Data security measures and incident management
The Data Controller implements all required technical and organisational security measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access:
- Encrypted data transfer: Web communications are encrypted via SSL/TLS (HTTPS).
- Access control: Access to personal records is restricted exclusively to authorized staff on a need-to-know basis.
- Physical security: Storage servers and recording devices are kept in locked, climate-controlled, surveillance-protected facilities.
- Incident notification: In the event of a personal data breach posing a risk to rights and freedoms, the Data Controller notifies the competent authority without undue delay and at the latest within 72 hours, in accordance with Article 33 of the GDPR.
7. Rights of data subjects and legal remedies
Under GDPR Articles 15 to 22, you are entitled to exercise the following statutory rights regarding your personal data:
You may request confirmation as to whether your personal data is being processed, and obtain a copy along with details on processing purposes and retention.
You have the right to obtain without undue delay the rectification of inaccurate personal data or completion of incomplete records.
You may request the deletion of your personal data where it is no longer necessary, consent has been withdrawn, or processing lacks a lawful basis.
You can request restriction of processing while accuracy is contested or in the case of an unlawful processing objection.
You have the right to receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
You have the right to object at any time to processing based on legitimate interests or direct marketing.
Lodging a complaint with a supervisory authority
If you consider that the processing of personal data relating to you infringes the GDPR, you have the right to lodge a complaint with the national supervisory authority or initiate court proceedings before the competent regional court:
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
1055 Budapest, Falk Miksa utca 9-11., Hungary
Mailing address: 1363 Budapest, Pf. 9.
Phone: +36-1-391-1400
Email: ugyfelszolgalat@naih.hu
Website: www.naih.hu