Privacy notice

https://kotelezo.biz/

I. Basic information

The temporal scope of this privacy notice runs from 16 September 2026 until revocation.

Controllers:

Controller #1

Name of the Controller: Eurorisk Biztosítási Alkusz Korlátolt Felelősségű Társaság (a Hungarian limited liability company)

Company registration number of the Controller: 01-09-266695

Registered office of the Controller: 1133 Budapest, Árbóc utca 6.

Representative of the Controller: Papp Lajos, managing director

Licence number issued by the Magyar Nemzeti Bank (MNB, the central bank of Hungary): 332/1993 ÁBIF

MNB registration number: 10870055

Controller #2

Name of the Controller: Sometimes Five Korlátolt Felelősségű Társaság (a Hungarian limited liability company)

Company registration number of the Controller: 20-09-079089

Registered office of the Controller: 8900 Zalaegerszeg, Nefelejcs utca 2/A.

Representative of the Controller: Tukacs Emánuel Dávid, managing director

MNB registration number: 114063010758

Contact person

Name: Tukacs Emánuel Dávid

Position: managing director

Company name: Sometimes Five Kft.

Telephone number: +36 20 362 6835

E-mail address: info@tukacs.com

Postal address: 8900 Zalaegerszeg, Nefelejcs utca 2/A.

Joint data protection officer

Name: Révi Béla

E-mail address: dpo@eurorisk.hu

Postal address: 1133 Budapest, Árbóc utca 6.

Eurorisk Kft. pursues the insurance broker activity specified in Act LXXXVIII of 2014 on Insurance Activities (hereinafter: Bit.), which is aimed at the intermediation of insurance contracts. In the course of the conclusion and the performance of contracts, the work of Eurorisk Kft. is assisted by Sometimes Five Kft. as subcontractor.

In the course of this activity, the purpose of the processing carried out by Eurorisk Kft. and Sometimes Five Kft. is, in summary, the pursuit of insurance broker activity, in the course of which it prepares the conclusion of the insurance contract or the client’s accession to a group insurance contract. Its activity may extend – on behalf of the client – to the conclusion of the contract and to participation in the enforcement of the principal’s claims. This activity may furthermore extend – on the basis of the insurer’s consent or the client’s authorisation – to participation in the assessment of the risk and in the performance and handling of the rights and obligations arising from the contract. In the course of its activity, Eurorisk Kft. keeps the records prescribed by law.

This Privacy Notice specifies for each sub-activity, and highlights in bold, when Eurorisk Kft. and Sometimes Five Kft. act as sole controllers and when they act as joint controllers pursuant to Article 26 of the GDPR.

The terms used in this notice shall be applied in accordance with REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: GDPR), supplemented, in cases falling within its material scope, by the provisions of Act CXII of 2011 on the Right to Informational Self-Determination and on Freedom of Information (hereinafter: Infotv.).

Key definitions:

personal data: any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

consent: any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may also be provided for by Union or Member State law;

processing: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

recipient: a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not.

Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject, in accordance with the rules of the GDPR.

Sometimes Five Kft. makes this notice continuously accessible on the website operated by it at https://kotelezo.biz/ (hereinafter: the Website).

Personal data collected by the Controllers may be processed only for specified, explicit and legitimate purposes and may not be processed in a manner that is incompatible with those purposes; furthermore, they must be stored in a form which permits the identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.

In the course of their work, the staff of the Controllers ensure that unauthorised persons cannot gain access to personal data and, furthermore, that the storage and placement of personal data are arranged in such a way that the data cannot be accessed, viewed, altered or destroyed by any unauthorised person.

II. Processing operations carried out in the course of the operation of the Website

1. Making contact on the Website, by e-mail or by telephone

Joint controllers: Sometimes Five Kft. and Eurorisk Kft.

1. Purpose of the processing: answering enquiries, preparing the request for a quotation, ensuring communication with the customer in order to provide the service to a high standard.
2. Scope of data subjects: potential clients, persons interested in the service (private individuals, legal persons, business associations without legal personality).
3. Scope of data processed: name, e-mail address, telephone number, the content of the message.
4. Legal basis: the consent of the data subject (Article 6(1)(a) of the GDPR); in the case of the preparation of a contract, point (b) of Article 6(1) of the GDPR.
5. Time limit for data storage: in the absence of the conclusion of a contract, 6 months from the making of contact; in the case of the conclusion of a contract, 5 years following the termination of the mandate agreement.
6. Method of data storage: electronic.
7. Recipients: hosting provider: Webgarden IT and Design Services Kft. (webgarden.eu; registered office: 1142 Budapest, Szőnyi út 33/A; company registration number: 01-09-448393; tax number: 32897560-2-42); e-mail service provider: Google Ireland Ltd. (Gmail/Google Workspace mail system – enquiries are received at the address info@tukacs.com).

2. Booking an appointment (online calendar) via the Website

Joint controllers: Sometimes Five Kft. and Eurorisk Kft.

1. Purpose of the processing: arranging an appointment for a free consultation.
2. Scope of data subjects: potential clients, persons interested in the service (private individuals, legal persons, business associations without legal personality).
3. Scope of data processed: name, e-mail address, the appointment time chosen, any comment provided voluntarily by the data subject.
4. Legal basis: the consent of the data subject and the preparation of a contract (Article 6(1)(a) and (b) of the GDPR).
5. Time limit for data storage: 6 months from the consultation.
6. Method of data storage: electronic.
7. Recipients: Google Ireland Ltd. (processor: provision of appointment booking through Google Calendar and of video calls through Google Meet).

3. Cookies and visitor statistics on the Website

Joint controllers: Sometimes Five Kft. and Eurorisk Kft.

1. Purpose of the processing: operation of the Website, preparation of visitor statistics
2. Scope of data subjects: potential clients, persons interested in the service (private individuals, legal persons, business associations without legal personality).
3. Scope of data processed: the visitor’s IP address, the time of the visit, the pages viewed, the data of the browser (in anonymised form in the case of statistics).
4. Legal basis: cookies strictly necessary for operation: statistical cookies (Google Analytics 4): the consent of the data subject (Article 6(1)(a) of the GDPR), which may be given on the cookie banner of the Website and may be modified at any time by means of the ‘reopen cookie settings’ function
5. Time limit for data storage: the GA4 event data for a maximum of 14 months
6. Method of data storage: electronic
7. Recipients: Google Ireland Ltd. (processor: Google Analytics 4). The mini-game available on the Website neither processes nor stores personal data.

Reopen cookie settings

4. Conclusion of the broker mandate agreement

Sole controller: Eurorisk Kft.

Its processor: Sometimes Five Kft.

The Controller stores the broker mandate agreements concluded by it partly in electronic form and partly on paper-based physical media. Where the client is not a natural person, the Controller also processes the data of the contact person (name, telephone, mobile, fax, e-mail address) in order to perform the contract. In such a case, the data of the contact person are provided by the non-natural person, which is responsible for having an appropriate legal basis for the transfer of the data provided by it and for having duly informed the data subject about the processing.

1. Purpose of the processing: conclusion of the contract
2. Scope of data subjects: contracting partners (private individuals, legal persons, business associations without legal personality).
3. Scope of data processed: the data subject’s name, residential address, contact details (telephone number, e-mail address), as well as, depending on the nature of the insurance contract to be concluded and on the specific product, those personal data which the insurer concerned requires for the conclusion of the insurance contract.
4. Legal basis of the processing: performance of a contract on the basis of point (b) of Article 6(1) of the GDPR.
5. Time limit for data storage: 5 years following the termination of the mandate agreement
6. Method of data storage: electronic and/or paper-based
7. Recipients: Sometimes Five Kft. (processor: insurance intermediary subcontractor), SK Trend Kft. (processor: IT services and data storage), Prioris Kft. (processor: IT services and data storage), Hetzner Online GmbH (processor: data storage).

5. Conclusion and administration of the insurance contract

Sole controller: Eurorisk Kft.

Its processor: Sometimes Five Kft.

On the basis of the broker mandate agreement concluded with the clients, the Controller concludes an insurance contract on behalf of the clients with the insurance company selected by them, and thereafter, as an insurance intermediary, participates in the administration of the contracts (which means participation in the enforcement of the principal’s claims in accordance with the rules of the Bit.). The Controller stores the insurance contracts concluded by it on behalf of the client partly in electronic form and partly on paper-based physical media.

1. Purpose of the processing: conclusion of contracts and administration of contracts
2. Scope of data subjects: contracting partners (private individuals, legal persons, business associations without legal personality).
3. Scope of data processed: the types of personal data processed are determined by the data content of the insurance contracts – as determined by the insurers – and accordingly the Company processes those data which are necessary in order for the client’s insurance needs to be assessed accurately, for the insurance analysis (premium calculation, ‘tarifálás’) to be carried out for the client and for the insurance contract to be concluded. These may typically be the following categories of data: the client’s name data, birth data, unique identification data, address data, contact data, data relating to employment, family data, health data, data relating to the use of motor vehicles, data relating to the causing of damage, data of earlier insurance contracts, data of financing contracts, the name and contact data of the contact person.
4. Legal basis of the processing: performance of a contract on the basis of point (b) of Article 6(1) of the GDPR.
5. time limit for data storage: 5 years following the termination of the insurance contract
6. Method of data storage: electronic and/or paper-based.
7. Recipients: Sometimes Five Kft. (processor: insurance intermediary subcontractor), SK Trend Kft. (processor: IT services and data storage), Prioris Kft. (processor: IT services and data storage), Hetzner Online GmbH (processor: data storage), and furthermore the insurance company providing the insurance cover.

6. Accession to a group insurance contract

Sole controller: Eurorisk Kft.

Its processor: Sometimes Five Kft.

In such a case, the client does not conclude an individual insurance contract but accedes to a group insurance contract concluded earlier (and thus becomes subject to its personal scope as an insured person).

The provisions set out in the previous two points shall apply mutatis mutandis to the related processing by the Company, with the difference that the purpose of the processing is not the conclusion of a new contract but accession to a contract already concluded and – as specified in the agreements of the parties – participation in the enforcement of the claims of the data subject as insured person.

7. Personal folder

Sole controller: Eurorisk Kft.

Its processor: Sometimes Five Kft.

In order to serve its clients as directly and as quickly as possible and in a manner meeting the requirements of the times, the Controller creates a so-called personal folder, which its clients may access on the Controller’s own website (https://www.eurorisk.hu/) by entering a user name and the password belonging to it. In the personal folder they may check the data of the contracts already concluded and may send their messages to the Controller, and the Controller may likewise send messages to the data subject.

1. Purpose of the processing: facilitating the conclusion of the insurance contract, administering the contract
2. Scope of data subjects: contracting partners (private individuals, legal persons, business associations without legal personality).
3. Scope of data processed: in respect of the insurance contracts available in the personal folder: the client’s name, address, tax identification number, telephone number, mobile number, e-mail address, and in the case of a contact person, that person’s name, e-mail address and telephone number.
4. Legal basis of the processing: the consent of the data subject on the basis of point (a) of Article 6(1) of the GDPR.
5. Time limit for data storage: until the termination of the personal folder (for as long as the insurance contracts administered for the data subject subsist, and, in the case of a personal folder created without the conclusion of an insurance contract, 1 year).
6. Method of data storage: electronic
7. Recipients: Sometimes Five Kft. (processor: insurance intermediary subcontractor), SK Trend Kft. (processor: IT services and data storage)

8. Profiling and decision-making based on profiling

Sole controller: Eurorisk Kft.

Its processor: Sometimes Five Kft.

In order to select, in accordance with the requirements of the Bit., the insurance product or products corresponding to the needs of the interested person, the Controller creates a profile by analysing the personal information of the interested person. In view of the profiling activity, the Controller pays increased attention to compliance with the principles laid down in Article 5 of the GDPR.

Profiling is necessary on the part of the Controller so that it may recommend the most suitable product to the interested person and may provide the client with accurate information in respect of that product. The identification of insurance products corresponding to the requirements and needs of the client based on the client’s individual characteristics, and, as part of this, the needs assessment which necessarily involves profiling, constitute an obligation of the Controller based on legislation (the Bit.), and the broker mandate agreement can be performed only in this way.

In the course of profiling, the Controller does not apply automated decision-making. The logic applied in the course of profiling is the following: as described above, in order to select the insurance product or products corresponding to the requirements and needs of the data subject, the following may, for example, be provided to the Controller: natural personal identification data, age, e-mail address, general position on financial plans, financial situation and ability to bear losses, investment and savings characteristics, willingness to take risks and risk tolerance, insurance policies held to date, the monthly amount of savings, net income, data relating to motor vehicles, data relating to real property, health data, data relating to the property to be insured. It depends on the type of insurance product requested by the data subject which categories of personal data are actually collected in a given case. The purpose of the analysis of the data is to establish which insurance products are suitable for the data subject.

1. Purpose of the processing: selection of the service suitable for the data subject on a personalised basis scope of data processed: see the categories of data specified in point II.5.c.
2. Data subjects: contracting partners (private individuals, legal persons, business associations without legal personality).
3. Scope of data processed: the types of personal data processed are determined by the data content of the insurance contracts – as determined by the insurers – and accordingly the Controller processes those data which are necessary in order for the client’s insurance needs to be assessed accurately, for the insurance analysis (premium calculation, ‘tarifálás’) to be carried out for the client and for the insurance contract to be concluded. These may typically be the following categories of data: the client’s name data, birth data, unique identification data, address data, contact data, data relating to employment, family data, health data, data relating to the use of motor vehicles, data relating to the causing of damage, data of earlier insurance contracts, data of financing contracts, the name and contact data of the contact person
4. Legal basis of the processing: necessary for the performance of the contract pursuant to point (b) of Article 6(1) of the GDPR.
5. Time limit for data storage: 5 years from the termination of the contract.
6. Method of data storage: electronic.
7. Recipients: Sometimes Five Kft. (processor: insurance intermediary subcontractor), SK Trend Kft. (processor: IT services and data storage), Prioris Kft. (processor: IT services and data storage), Hetzner Online GmbH (processor: data storage)

9. Complaints handling

Sole controller: Eurorisk Kft.

Its processor: Sometimes Five Kft.

On the basis of Section 382(1) of the Bit., Eurorisk Kft. is obliged to ensure that the client and consumer interest representation bodies may communicate their complaint concerning the conduct, activity or omission of Eurorisk and – in connection with a given product – of the person carrying out ancillary insurance intermediary activity mandated by them (Sometimes Five Kft.), either orally (in person or by telephone) or in writing (by means of a document handed over in person or by another person, by post, by fax or by electronic mail). On the basis of the complaint, the Company is obliged to conduct a complaints handling procedure in accordance with the rules laid down in the Bit. and in further legislation.

The detailed rules thereof are set out in the complaints handling policy of the Company, which is available on the website www.eurorisk.hu under the ‘Panaszkezelés’ (Complaints handling) menu item (https://www.eurorisk.hu/adatkezelesi-tajekoztato).

1. Purpose of the processing: investigation and handling of complaints
2. Data subjects: complainants (private individuals, legal persons, business associations without legal personality).
3. Scope of data processed: the data subject’s name, residential address, e-mail address, and other data relating to the specific complaint.
4. Legal basis of the processing: compliance with a legal obligation pursuant to point (c) of Article 6(1) of the GDPR.
5. Time limit for data storage: for 5 years following the completion of the complaints handling procedure; where telephone communication takes place in the course of the procedure, the Company retains the conversation recorded on a mandatory basis for 5 years.
6. Method of data storage: electronic and/or paper-based.
7. Recipients: Sometimes Five Kft. (processor: insurance intermediary subcontractor), SK Trend Kft. (processor: IT services), dr. Gyenes-Kovács Zoltán Ügyvédi Iroda (a Hungarian law firm; processor: legal services), Arenim Technologies Kft. (processor: data storage)

10. Customer service activity

Sole controller: Eurorisk Kft.

Its processor: Sometimes Five Kft.

Eurorisk Kft. – within the framework of its insurance intermediary activity – provides a general customer service to its clients. The subject matter of customer service administration may be a request for information, the making of a declaration, the submission of an application, the handing over of a document, the lodging of a complaint or access to documents.

In the case of telephone customer service activity, incoming calls are routed to the available operator(s) by means of the call routing system. The operator identifies himself or herself – by stating his or her name in an intelligible and well-articulated manner – and then identifies the caller (on the basis of name, date of birth and mother’s maiden name).

The conversations are voice-recorded. In the case of an incoming call, the caller is informed of this by the automatic call routing system, while in the case of an outgoing call the operator informs the called party of this at the beginning of the conversation. Where the telephone enquiry does not relate to a complaint, the legal basis for the processing is the consent of the data subject. If the data subject does not consent to the processing, he or she is entitled to terminate the call and to contact Eurorisk Kft. through the other contact details of Eurorisk Kft (e-mail, letter).

1. Purpose of the processing: customer service activity.
2. Data subjects: clients (private individuals, legal persons, business associations without legal personality).
3. Scope of data processed: the data necessary for identifying the person of the data subject, as well as other data necessary for dealing with the specific customer service task
4. Legal basis of the processing: performance of a contract on the basis of point (b) of Article 6(1) of the GDPR; in the case of the making of a voice recording, the consent of the data subject pursuant to point (b) of Article 6(1) of the GDPR.
5. Time limit for data storage: for 5 years following the termination of the broker mandate agreement.
6. Method of data storage: electronic and/or paper-based.
7. Recipients: Sometimes Five Kft. (processor: insurance intermediary subcontractor), SK Trend Kft. (processor: IT services), MiniCRM Zrt. (processor).

11. Processing by Eurorisk Kft. in connection with direct marketing

Sole controller: Eurorisk Kft.

Its processor: Sometimes Five Kft.

In order to serve the needs of clients as fully as possible, the Controller may, on the basis of the prior unambiguous and express consent of the data subject, send e-mails and newsletters to the data subject for the purpose of making direct offers and for informal purposes. The Company ensures that the data subject may unsubscribe from the marketing e-mails at any time free of charge.

1. Purpose of the processing: informing data subjects of the most important news of the Controller, direct marketing
2. Data subjects: subscribers
3. Scope of data processed: the data subject’s name and e-mail address
4. Legal basis of the processing: the consent of the data subject pursuant to point (a) of Article 6(1) of the GDPR
5. Time limit for data storage: until the termination of the processing for marketing purposes, but if the data subject requests the erasure of his or her data (unsubscribes from the newsletter), immediately following his or her request for erasure.
6. Method of data storage: electronic.
7. Recipients: MiniCRM Zrt. (processor: sending of newsletters)

12. Synchronisation of databases

Sole controller: Eurorisk Kft.

Its processor: Sometimes Five Kft.

Where the data subject communicates to the Controller new data falling within the same category of data (for example, gives the Controller a mandate to conclude a further insurance contract and, in the course of this, provides contact details that differ from those given in earlier mandates), the Controller records the change in all databases relating to the data subject in order to ensure that in every case (including, for example, in connection with the broker mandates given earlier) the new, accurate data are available for the performance of any broker task.

1. Purpose of the processing: establishing the accuracy and the consistency of the databases relating to the data subject.
2. Data subjects: contracting partners (private individuals, legal persons, business associations without legal personality).
3. Scope of data processed: the data contained in the data subject’s insurance contracts, principally the data subject’s contact details (residential address, postal address, electronic mail address, telephone number).
4. Legal basis of the processing: compliance with a legal obligation pursuant to point (c) of Article 6(1) of the GDPR (the relevant legal obligation being the requirement of accuracy laid down in point (d) of Article 5(1) of the GDPR)
5. Time limit for data storage: for 5 years following the termination of the broker mandate agreement.
6. Method of data storage: electronic.
7. Recipients: Sometimes Five Kft. (processor: insurance intermediary subcontractor), SK Trend Kft. (processor: IT services), Prioris Kft. (processor: IT services).

III. Exercise of the rights of data subjects

Contact person:

Tukacs Emánuel Dávid

Telephone number: +36 20 362 6835

E-mail address: info@tukacs.com

Postal address: 8900 Zalaegerszeg, Nefelejcs utca 2/A.

The data subject may at any time request information at the above contact details concerning the processing of his or her personal data, and may request:

• access to his or her personal data (Article 15 of the GDPR),
• the rectification of his or her personal data (Article 16),
• the erasure of his or her personal data (‘right to be forgotten’, Article 17),
• the restriction of processing (Article 18),
• he or she may exercise the right to data portability (Article 20), and
• in the case of processing based on legitimate interest and of profiling, he or she may object to the processing (Article 21).

In the case of processing based on consent, the consent may be withdrawn at any time; the withdrawal does not affect the lawfulness of the processing carried out previously.

The Controller(s) shall comply with or answer the request without undue delay, but at the latest within one month of its receipt; that time limit may be extended by two months having regard to the complexity of the request.

The Controller(s) shall communicate any rectification, erasure or restriction to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.

The data subject may also address his or her request directly to the joint data protection officer of the Controller(s).

IV. Legal remedies

The Controller(s) shall compensate any damage caused by the unlawful processing of the data subject’s data or by the infringement of the requirements of data security, as well as pay the grievance award (sérelemdíj) due in the event of a violation of personality rights caused by it or by the processor engaged by it; it shall be exempt from liability if it proves that it is not responsible for the event giving rise to the damage.

• The data subject may lodge a complaint with the supervisory authority: Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH) · head office: 1055 Budapest, Falk Miksa utca 9–11. · postal address: 1363 Budapest, Pf. 9. · e-mail: ugyfelszolgalat@naih.hu · website: www.naih.hu
• The data subject may – at his or her choice – also enforce his or her claim before the courts; the action falls within the competence of the regional court (törvényszék) and may be brought before the regional court of the data subject’s place of residence or place of stay or before the regional court of the registered office of the controllers.
• In respect of consumer complaints connected with insurance intermediary activity, the consumer protection procedure of the Magyar Nemzeti Bank (MNB) is also available.

You may submit your request as follows:

• by post (to the address Magyar Nemzeti Bank 1534 Budapest BKKP Pf. 777);
• in person at the customer service of the MNB (1122 Budapest, Krisztina krt. 6.);
• at any Kormányablak (government one-stop-shop customer service office);
• in electronic form, through the MNB’s electronic system for receiving authenticated data (ERA), about which you will find detailed information on the Elektronikus ügyintézés (Electronic administration) page. Logging in to the ERA interface may take place with the help of the Central Identification Agent (Központi Azonosítási Ügynök, KAÜ), about which you will find detailed information on the KAÜ website.

Detailed information in connection with the financial consumer protection procedure of the MNB: www.mnb.hu/fogyasztovedelem/penzugyi-panasz (in Hungarian)

We look after your data, too.