Privacy Policy — ledfalszaki.hu

Data controller: Toma Family Mobil Kft.

Effective from: 24 August 2026 · Version: 1.0

This policy describes what personal data we process when you use the www.ledfalszaki.hu website and the related services (requesting a quote, ordering online, concluding a contract electronically, invoicing, the newsletter, the prize game, the AI assistant, web analytics), for what purpose, on what legal basis and for how long, who has access to it, and what rights you have. This policy has been prepared on the basis of Articles 13–14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: GDPR) and Act CXII of 2011 on informational self-determination and freedom of information (Infotv., the Hungarian Information Act).

The site offers LED walls primarily to businesses and institutions, but the name, e-mail address and telephone number of the contact persons (managing directors, buyers, employees) constitute personal data even where they act on behalf of a company — this policy therefore applies to them as well.

I. The data controller and its contact details

Data protection officer: under Article 37 GDPR the controller is not obliged to designate a data protection officer and has therefore not designated one. You may contact us with data protection questions and requests at info@ledfalszaki.hu, or by post in a letter addressed to the registered office (marked "Adatvédelem" / Data protection); requests are handled by the managing director.

II. Key terms in brief

• Personal data: any information relating to an identified or identifiable natural person (name, e-mail address, telephone number, IP address, online identifier, etc.).
• Processing: any operation performed on personal data (collection, recording, storage, transfer, erasure, etc.).
• Controller: the party that determines the purposes and means of the processing — in this case Toma Family Mobil Kft.
• Processor: the party that processes personal data on behalf of and on the instructions of the controller (e.g. the hosting provider).
• Recipient: the party to which we disclose the personal data — it may also be a controller in its own right (e.g. NAV, the manufacturing partner, the courier service).
• Data subject: you, whose data we process.
• Consent: your freely given, specific, informed and unambiguous indication of wishes, which you may withdraw at any time.

III. Principles

We process personal data lawfully, fairly and transparently, for specified purposes, limited to what is necessary for the purpose, accurately, only for as long as necessary and with appropriate security (Article 5 GDPR). We only ask for data that is needed to achieve the specific purpose. We do not request or process special categories of data (health, political, religious data, etc.) — please do not provide such data on the forms or to the AI assistant either.

IV. The individual processing activities

4.1 Quote request forms (call-back request, detailed quote request, product-page quote request)

4.2 Customer relationship management (CRM) system and logging of quote openings

4.3 Online ordering and conclusion of contracts electronically

4.4 Invoicing and NAV online invoice data reporting

4.5 Sending e-mails (quote, reminders, contract, invoice, notifications) and open tracking

4.6 Newsletter subscription

4.7 Prize wheel game (discount code in exchange for an e-mail address)

The prize wheel is currently switched off; this point takes effect when the controller activates it. [TOMI: élesítéskor dátum + külön játékszabályzat-oldal.]

4.8 AI assistant ("Ádám" chatbot)

4.9 Web analytics

A) Google Analytics 4 (measurement ID: G-K602W94NYX) and Google Search Console

B) Own, cookie-free visit counter (the feature exists and is operational: server/lib/latogatas.mjs)

C) Cookie-free event measurement

4.10 Server logs

4.11 Cookies and browser storage

The cookies and local storage keys (localStorage/sessionStorage) used by the website — by name, purpose, expiry and provider — are set out in the separate Cookie Policy: /en/cookie-policy. Non-necessary (statistical) cookies are only placed on your device with your consent (Section 13/A(4) of the Hungarian E-Commerce Act, Ektv.).

4.12 Contacting us by e-mail or telephone

If you write directly to info@ledfalszaki.hu or call us, we process the data you provide (name, contact details, the content of the message) for the purpose of answering your enquiry, on the basis of Article 6(1)(b) or (f) GDPR; we keep the correspondence for [TOMI: javaslat 5 év] from the closure of the matter, or, where a contract is concluded, as set out in point 4.3.

V. Transfers to third countries (outside the EU/EEA)

We do not transfer data to any other third country. On request we will make available a copy of the relevant safeguards (contracts).

VI. Processors and recipients

We conclude data processing agreements with the processors in accordance with Article 28(3) GDPR, or accept the provider's general data processing terms; they may process the data solely on our instructions and for the stated purpose. Upon request from a court or an authority, we disclose the data prescribed by law.

VII. Data security

In accordance with Article 32 GDPR we apply technical and organisational measures proportionate to the risk, in particular:

• the website and the API are accessible only over an encrypted (HTTPS/TLS) connection; e-mail traffic takes place over an encrypted channel;
• the administration and CRM interface is protected by a password or by personally attributable Google account log-in and is accessible only to the two authorised employees; permissions are withdrawn immediately when employment ends;
• quotes are accessible via a link with a unique, unguessable identifier, and openings are logged;
• the audit log of the electronic contract (IP, timestamp, browser, SMS authentication) supports the fact that the contract cannot subsequently be altered;
• regular backups are made of the server data [TOMI: a Railway Volume mentési gyakorisága rögzítendő]; passwords and API keys are not stored in the code but in environment variables;
• we took into account the security measures contractually undertaken by our processors when selecting them;
• employees receive data protection training and have access to the data only to the extent necessary for their tasks;
• the server stores the uploaded photographs in the form already reduced by the browser, in a separate directory, and they are not publicly accessible.

VIII. Handling personal data breaches

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Upon detecting a breach:

1. we begin the investigation and the remedial action without delay;
2. if the breach is likely to result in a risk to the rights of the data subjects, we notify NAIH within 72 hours of becoming aware of it (Article 33 GDPR);
3. if it is likely to result in a high risk, we also inform the data subjects without undue delay (Article 34 GDPR);
4. we keep an internal record of every breach — irrespective of the notification obligation (Article 33(5) GDPR): the circumstances of the breach, its effects and the measures taken.

Our processors are obliged to notify us without undue delay of any breach they detect.

IX. Automated decision-making, profiling

The controller does not apply decision-making based solely on automated processing which produces legal effects concerning the data subject or similarly significantly affects them within the meaning of Article 22 GDPR, and does not carry out profiling. The interest tags used in the CRM serve internal organisation, and no automatic decision concerning you is made on their basis. The draw of the prize wheel is a weighted random one and is not based on your personal characteristics. The answers of the AI assistant are for information only and have no contractual legal consequences.

X. Your rights

Under Articles 15–22 GDPR you have the following rights. You may send your request to info@ledfalszaki.hu or by post to the registered office. We reply to the request without undue delay and at the latest within one month; this period may be extended by up to two further months in view of the complexity of the request, of which we inform you within one month (Article 12(3) GDPR). The information and the action are free of charge, except for manifestly unfounded or excessive requests, in particular because of their repetitive character (Article 12(5)). In case of doubt we may request confirmation of your identity (Article 12(6)).

We inform every recipient to whom the data has been disclosed of any rectification, erasure or restriction, unless this proves impossible or involves disproportionate effort (Article 19).

XI. Legal remedies

1. Complaint to us. Please turn to us first with any complaint about data processing (info@ledfalszaki.hu) — we do our best to resolve it as quickly as possible.

2. Supervisory authority. You have the right to lodge a complaint with the supervisory authority (Article 77 GDPR; investigation under Section 52 of the Hungarian Information Act), in particular in the Member State of your habitual residence:

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH — the Hungarian National Authority for Data Protection and Freedom of Information)
Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary
Postal address: 1363 Budapest, Pf. 9., Hungary
Telephone: +36 1 391 1400 · Fax: +36 1 391 1410
E-mail: ugyfelszolgalat@naih.hu · Web: https://www.naih.hu

3. Court. If in your view we have processed your data contrary to the GDPR, you may bring proceedings before a court (Article 79 GDPR). At your choice, the action may also be brought before the regional court (törvényszék) of your domicile or place of residence (Section 23(3) of the Hungarian Information Act); adjudication of the case falls within the competence of the regional court. The court deals with the case as a matter of priority. In the event of damage you may claim compensation, and in the event of a violation of your personality rights you may claim a grievance award (Article 82 GDPR; Section 2:52 of the Hungarian Civil Code).

XII. Children

Our services are not addressed to persons under the age of 16. For the use of an information society service, the consent of a child under the age of 16 is valid only with the authorisation of the holder of parental responsibility (Article 8(1) GDPR). If we become aware that a person under the age of 16 has provided their data without such authorisation, we delete it.

XIII. Amendment of this policy

The controller may amend this policy unilaterally, in particular in the event of a change in legislation, a new service or a new processor. The version in force at any given time is available at https://www.ledfalszaki.hu/en/privacy-policy; we also notify newsletter subscribers and customers of any material change by e-mail. Earlier versions are made available on request.