This notice explains how Clenux Takarító Kft. (hereinafter: the “Controller”) processes the personal data of visitors to the website, its clients, job applicants and participants in its events in accordance with Regulation (EU) 2016/679 (GDPR), Act CXII of 2011 on the right to informational self-determination (Infotv.) and other applicable Hungarian legislation. The Controller processes personal data lawfully, fairly and transparently, only for specified purposes, to the extent and for the period necessary to achieve those purposes, accurately and securely.
1. The Data Controller
| Company name | Clenux Takarító Korlátolt Felelősségű Társaság (Clenux Takarító Kft.) |
| Registered office, postal address | 8600 Siófok, Kandó Kálmán utca 3. 2. em. 7. ajtó |
| Company registration number | Co. reg. no. 14-09-322146 |
| Tax number | 33045814-2-14 |
| Representative | Fodor Márton and Kocsis Dániel, managing directors (each with sole signing authority) |
| Data protection contact | info@clenux.hu, +36 30 926 4603 |
The Controller is not required to appoint a data protection officer (Article 37 GDPR) and has therefore not appointed one; for data protection queries, you can reach us using the contact details above.
2. Data processing activities
The data marked as required on the forms must be provided for us to fulfil your request; without it we cannot provide a quote, reply or accept an entry. Providing any other data is voluntary.
| Purpose and data processed | Legal basis | Duration |
|---|---|---|
| Quote requests: name, e-mail address, phone number, company name (if any), the town and address of the site, floor area, requested service, frequency, preferred date, comments. Purpose: preparing the quote and keeping in contact. | Steps prior to entering into a contract (Article 6(1)(b) GDPR) | If no contract is concluded: 1 year from the date the quote is sent |
| Contact enquiries, messages, callback requests, email correspondence: name, e-mail address, phone number, company name, subject and content of the message. Purpose: responding to the enquiry. | For enquiries aimed at concluding a contract, Article 6(1)(b) GDPR; otherwise legitimate interest (Article 6(1)(f)): responding to the enquiry of the person contacting us | 1 year from the closure of the matter (for correspondence relating to a contract: for the retention period of the contract) |
| Performance of the service (including online booking): name, contact details, address of the site, means of access (for example key or gate code — only for the duration of the service), details of the cleaning, date and time, fee and payment method. | Performance of a contract (Article 6(1)(b) GDPR) | 5 years from the termination of the contract (Civil Code, Section 6:22 — general limitation period); access details are deleted at the end of the engagement |
| Photo documentation of the site: photos of the work performed and of the site (we deliberately do not photograph personal belongings or people). Purpose: proof of performance, quality control and handling of complaints. | Performance of a contract and legitimate interest (Article 6(1)(b) and (f) GDPR): proof of performance. Use as a reference only with separate written consent (Article 6(1)(a)) | 1 year from completion; in the event of a dispute, until it is resolved. As a reference, until consent is withdrawn |
| Invoicing and accounting: name or company name, billing address, tax number (for businesses), invoice details. | Legal obligation (GDPR Article 6(1)(c); Section 169 of the Accounting Act; VAT Act) | 8 years |
| Complaint handling: name, contact details, subject and description of the complaint, the written record taken and the response. | Legal obligation (GDPR Article 6(1)(c); Section 17/A of the Consumer Protection Act) | For the period prescribed by Section 17/A(7) of the Fgytv. |
| Job applications: name, e-mail address, phone number, town of residence, the position applied for, a personal introduction and — if attached — a CV. | At the applicant's request, as a step prior to entering into an employment contract (GDPR Article 6(1)(b)); retention for future positions: consent (Article 6(1)(a)) | Until the selection process is concluded; if the applicant separately consents to being contacted about future positions: up to 1 year |
| Event registration: the entrant's name, e-mail address, phone number, playing level (ATR points, if any), the doubles partner's name and — if provided — their contact details and level, the pair's name, and any comments. The partner's details are provided by the entrant; the entrant declares that the partner has consented to this. Purpose: managing entries and sending notifications (approval, waiting list, draw). Tournament centre: for the doubles tournament — as part of the conditions of participation — the players' names, the pair name, seeding, group, order of play and results are published — never e-mail addresses or phone numbers. | Fulfilment of the conditions of participation, including the public announcement of results (Article 6(1)(b) GDPR) | For 1 year after the event; public results for no more than 1 year |
| Event photos and videos: recordings made at the event. Purpose: showcasing the event on the website and on social media. | For crowd shots, legitimate interest (GDPR Article 6(1)(f); Hungarian Civil Code Section 2:48(2)); for footage featuring an individual, consent (Article 6(1)(a)) | For as long as the recording serves to present the event, for a maximum of 3 years, or until you object / withdraw your consent |
| Offers and news by email (marketing): name, e-mail address, and which form you used and which service you enquired about (client type, town) — so that we can send you relevant offers. This applies only to those who have separately and voluntarily ticked the relevant box on the form; accepting the privacy notice is not sufficient for this. We do not use the details of a partner entered for the doubles tournament for marketing purposes. | Consent (Article 6(1)(a) GDPR; Section 6 of the Advertising Act (Grt.)) | Until consent is withdrawn (via the unsubscribe link in every e-mail, or by replying to an e-mail) |
| Record of submissions: the time of submission, reference number, the form and page, where the visitor came to the website from (campaign tag, referring site's domain, first page opened — without cookies, attached only to the submitted form), and the consents given (with the exact wording of the marketing consent). Purpose: to evidence consents, to track enquiries, and to see which of our advertisements and appearances generate enquiries. | Legal obligation and legitimate interest (GDPR Article 7(1), Article 6(1)(c) and (f)) | Until the end of the retention period for the given purpose; for marketing consent, 5 years after withdrawal (as proof) |
| Web analytics (Google Analytics 4): a random online identifier (cookie), the pages viewed, the source of the visit, the device and browser type, the approximate geographical location (at town or city level; Google Analytics does not store the IP address), and actions taken on the website (for example, submitting a quote request — without its content). No name, e-mail address or phone number is passed to Google. Purpose: to measure and improve the use of the website. | Consent (Article 6(1)(a) GDPR; Section 155(4) of the Electronic Communications Act (Eht.)) — only if you accept the ‘Analytics’ category in the cookie banner; without consent, no data whatsoever is sent to Google | The cookie expires after 13 months; Google Analytics retains the data for 14 months. You can withdraw your consent at any time using the “Cookie settings” link |
| Cookie-free visitor analytics (Vercel Web Analytics): the title of the page viewed, the referring page, the device and browser type, and the country. It does not use cookies and stores nothing in the browser; visitors are distinguished by a check code derived from the request and discarded daily, so the data is only visible in aggregate and cannot be linked to any individual. Internal interfaces are not measured, and the identifier in the booking management link is not included. Purpose: measuring site traffic and verifying Google Analytics data. | Legitimate interest (Article 6(1)(f) GDPR): measuring how the website performs, using the minimum possible data about the visitor | The check code is retained for a maximum of 24 hours; after that, only the aggregate statistics remain |
| Website usage analytics (Microsoft Clarity): a random online identifier (cookie), clicks, scrolling and mouse movement, the pages viewed, the device and browser type, and the approximate geographical location; these are used to produce heatmaps and anonymous replays of page usage. Data entered into forms is not recorded (it is masked), and no recording takes place on the thank-you and booking management pages. Purpose: to understand where visitors get stuck and to improve the website. | Consent (Article 6(1)(a) GDPR; Section 155(4) of the Electronic Communications Act (Eht.)) — only if you accept the ‘Analytics’ category in the cookie banner | The cookies expire after up to 1 years; Clarity retains recordings for 30 days and aggregated data for up to 13 months. You can withdraw your consent at any time using the “Cookie settings” link |
| Security log: alongside the pages opened on the website and form submissions, we record the IP address, the time, the address of the page opened, the name of the referring page, the browser and device type, the approximate geographical location (country, town — provided by the hosting provider from the IP address) and the provider name associated with the IP address (reverse DNS); for forms, the submission reference number as well. Names, e-mail addresses and phone numbers are not included; it uses no cookies and stores nothing in the browser. Purpose: the security of the website and forms, and the detection and filtering of abuse — enquiries made in bulk, automatically or with deceptive intent (for example with false details, or to gather business information); to this end, in the event of abuse we may restrict access to the website from the IP address concerned. We do not use it for marketing or for tracking visitors. | Legitimate interest (GDPR Article 6(1)(f) and Recitals (47) and (49)): the security of the service and the network, and the prevention of misuse. The outcome of the balancing test is available on request; you may object to the processing (Section 9) | 30 days, after which it is deleted automatically; where an entry is evidence of abuse, until the matter is closed. The submission counter is held in memory only, for no more than 15 minutes |
Where processing is based on legitimate interest, we have carried out a balancing test; it is available on request. We do not sell data and use it only for the stated purpose. For information on data stored in your browser and on cookies, see the Cookie notice .
3. Our social media pages
Our Facebook, Instagram, TikTok and LinkedIn pages are subject to each platform's own data protection rules. The platform provides us with aggregated statistics on interactions with our page (for example, follows, comments and messages); in this context, we may qualify as joint controllers with certain platforms (for example, Meta Platforms Ireland Ltd.). Data received in messages is processed as contact under Section 2.
4. Recipients and data processors
Of the Controller's staff, only those who need the data to handle the matter have access to it. Our data processors:
- Hosting and data storage: Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA) — hosting of the website, form processing, and storage of competition data and submission records in the European Union (Frankfurt); cookie-free visitor analytics (Vercel Web Analytics).
- Email delivery: Resend, Inc. (United States of America) — delivery of notification and confirmation e-mails; processes the content of e-mails for the purpose of delivery.
- Email hosting and domain: Rackhost Zrt. (6722 Szeged, Tisza Lajos krt. 41.) — hosting of the info@clenux.hu mailbox and the domain; storage of incoming e-mails.
- Web analytics: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) — Google Analytics 4, only with your consent. Privacy policy: policies.google.com/privacy.
- Website usage analytics: Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) — Microsoft Clarity, only with your consent. Privacy notice: privacy.microsoft.com.
- Invoicing and accounting: service providers that issue invoices and fulfil accounting obligations; we will provide their names and contact details on request.
At the request of an authority, court or other competent body — on the basis of a legal obligation — we may disclose the necessary data.
5. Transfers of data to third countries
Some of our data processors (our hosting, email delivery and analytics providers) have parent companies in the United States of America, so data may also be transferred outside the European Economic Area. In such cases, the transfer is made with safeguards under Chapter V of the GDPR: where the recipient is certified under the EU–US Data Privacy Framework, on the basis of the European Commission's adequacy decision; otherwise, on the basis of the European Commission's standard contractual clauses (2021/914).
6. Data security
We receive data over an encrypted (HTTPS/TLS) connection and store it in systems protected by access restrictions, passwords and logging; only those who need it for their tasks have access. In the event of a personal data breach, we will notify the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság) within 72 hours of becoming aware of it, and, where the breach is likely to result in a high risk, we will also inform the data subjects without undue delay.
7. Automated decision-making and profiling
We do not use automated decision-making, including profiling. Simple grouping of those who have given marketing consent (for example by area of interest) has no legal effect on the data subject. In the security log, the software only flags unusual patterns (for example many pages opened in a short time); whether abuse has occurred, and whether to restrict access from an IP address, is always decided by a person.
8. Children
Our services are intended for adults. We process the personal data of persons under the age of 16 — for example, when registering for an event — only with the consent of their legal representative.
9. Rights of the data subject
- Right of access (Article 15): you may request information on whether we process personal data about you and, if so, what data, for what purpose, to whom we transfer it and how long we retain it; you may request a copy.
- Rectification (Article 16): you may request the rectification of inaccurate data or the completion of incomplete data.
- Erasure (Article 17): you may request the erasure of your data if the purpose of the processing no longer applies, you have withdrawn your consent, or the processing is unlawful — unless the law requires the data to be retained (for example, invoices).
- Restriction (Article 18): you may request that we only store your data until the disputed matter has been resolved.
- Data portability (Article 20): you may request the data you have provided, processed on the basis of consent or a contract, in a structured, machine-readable format, or ask for it to be transmitted to another controller.
- Right to object (Article 21): you may object to processing based on legitimate interest, and to direct marketing at any time, without giving reasons.
- Withdrawal of consent: at any time, as easily as it was given (for marketing, by unsubscribing; for cookies, via the “Cookie settings” link); withdrawal does not affect the lawfulness of processing carried out before it.
You may submit your request by email to info@clenux.hu or by post. We will respond to your request without undue delay and in any event within one month; where justified (for example, owing to the complexity of the requests), this period may be extended by a further two months, of which we will inform you within one month. Information and action are provided free of charge. If there is doubt about the identity of the person making the request, we may ask for additional information to confirm their identity.
10. Legal remedies
If you consider that the processing of your data is unlawful, you may lodge a complaint with the supervisory authority:
- Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
- Registered office: 1055 Budapest, Falk Miksa utca 9–11; postal address: 1363 Budapest, Pf. 9.
- Phone: +36 1 391 1400
- Email: ugyfelszolgalat@naih.hu; web: naih.hu
If your rights are infringed, you may also take legal action (Article 79 GDPR, Section 23 of the Info Act); at your choice, proceedings may also be brought before the regional court competent for your place of residence or stay. We recommend that you contact us with your complaint first, so that we can resolve the matter quickly.
11. Amendments to this notice
We update this notice whenever our data processing or the relevant legislation changes; the current version is always available on this page. In the event of a material change, such as a new processing purpose, we will ask for fresh consent for data processed on the basis of consent. The terms of the service are set out in the Terms and Conditions .