Capitalis Europe

Privacy notice

Information on the data processing activities of Capitalis Europe Kft.

This is an English translation of the Hungarian privacy notice, provided for convenience. In case of any discrepancy, the Hungarian version (/hu/adatkezeles/) prevails.

Capitalis Europe Kft. (registered office: 2040 Budaörs, Domb u. 31. F. ép. 2. em. 9., company registration number: 13-09-218250, represented individually by Sára Nagy, Managing Director), as data controller (hereinafter: Controller), considers it important to respect and enforce the data protection rights of its clients and of all other natural persons concerned (hereinafter: data subjects). This policy sets out the rules applicable to natural persons with regard to the processing of personal data. The purpose of this Privacy Notice is to inform data subjects about certain data processing activities of the Controller and the relevant rules, and to fulfil the information obligation laid down in Articles 13–14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: GDPR).

The Controller is primarily engaged in the distribution, purchase and sale of new and used motor vehicles and in the rental of motor vehicles. The efficient provision of these activities and the service of clients occasionally require the processing of personal data, which is considered a legitimate interest of the Controller. Clients can find information about the activities of Capitalis Europe Kft. on the https://capitalis.hu/ website.

In the course of its activities, the Controller intends to comply with the legal requirements on the processing of personal data, in particular the provisions of the GDPR. A further important purpose of issuing this policy is to enable the organisation’s employees, by knowing and observing it, to process the data of natural persons lawfully. Processing: any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. Controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

In view of the above, a data subject is any natural person who is identified or – directly or indirectly – identifiable on the basis of personal data, and whose data is processed by the Controller. Data subjects are therefore primarily prospective clients, clients who are natural persons, the Controller’s own staff, and the representatives, contact persons and possibly other employees of clients who are not natural persons. Personal data: any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Who processes my data?

The data may be processed by the Controller’s employees and agents only to the extent strictly necessary for the performance of their tasks. The Controller processes the data only for as long and in such a manner as necessary, since it attaches great importance to respecting its clients' privacy and their right to informational self-determination. To keep the data secure, the Controller takes all necessary and available security measures, both technical and in terms of the procedures and activities of the persons involved in the processing.

Personal data is in principle processed by the Controller itself or, if the task is outsourced, by designated processor(s). In that case the Controller transfers data to the processors and is responsible for their activities. The Controller may transfer data specified by the data subject to its Partners if the legal basis of the processing is established (e.g. the data subject has given prior and voluntary consent) and the data is necessary for the processing.

The controller and its contact details

If you have any questions regarding the processing of your personal data, or wish to exercise your rights in connection with our processing, please contact Capitalis Europe Kft. as the controller.

The controller of the processing is Capitalis Europe Kft.

registered office and postal address: 2040 Budaörs, Domb utca 31. F. ép. 2. em. 9. ajtó website: https://capitalis.hu/ e-mail: info@capitalis.hu phone: +36 70 630 5770 Capitalis Europe Kft. is represented by Sára Nagy, Managing Director.

representative’s e-mail address: sara.nagy@capitalis.hu

Rights of data subjects

Under Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Hungarian: Infotv.) and the GDPR, the rights of the data subject are as follows: the right to information, the right to rectification, the right to erasure, the “right to be forgotten”, the right to blocking/restriction of data, the right to object, the right to judicial remedy and the right to lodge a complaint with an authority.

The Controller draws the attention of data subjects to the fact that they may request information and exercise their other rights – unless excluded by law – by a statement sent to the e-mail address info@capitalis.hu or to another contact of the Controller. The Controller examines and answers the statement within the shortest possible time after receipt and takes the necessary steps on the basis of the statement, this Policy and the law. In the case of joint processing, the data subject may exercise their rights with any of the controllers.

Expected impact of the processing on clients (data subjects)

The processing does not have any particular effect on the client and does not involve any significant risk. The processing is necessary for the efficient provision of the activities carried out by Capitalis Europe Kft. and for serving its clients.

Where does the Controller store my personal data?

The Controller stores personal data on its own IT equipment and in the Microsoft 365 cloud service (e-mail and document storage). Microsoft 365 is provided by Microsoft Ireland Operations Limited.

White Hawk Kft. registered office: 2220 Vecsés, Szondi u. 79/b., Hungary Company registration number: 13-09-230637 e-mail: akos.nh@whitehawk.hu activity: development and operation of the website and of the internal business system; has access to the partner and deal data stored in that system in the course of development and operation

The https://capitalis.hu/ website is served by Cloudflare, Inc. The website does not store the data entered in its contact form: the data passes through Cloudflare’s systems and arrives as an e-mail in the Controller’s Microsoft 365 mailbox, where it is handled like any other enquiry received by e-mail.

How does the Controller ensure the security of my data?

The Controller ensures the security of the data. To this end, it takes the technical and organisational measures and establishes the procedural rules necessary to enforce the applicable laws and data protection and confidentiality rules. The Controller protects the data with appropriate measures against unauthorised access, alteration, transmission, disclosure, erasure or destruction, as well as against accidental destruction and damage and against becoming inaccessible due to changes in the technology used.

When determining and applying the measures to ensure data security, the Controller takes into account the state of the art and, among several possible processing solutions, chooses the one that ensures a higher level of protection of personal data, unless this would involve disproportionate difficulty.

Within its IT protection tasks, the Controller ensures in particular:

  • measures protecting against unauthorised access, including the protection of software and hardware and physical protection (access control, network protection);
  • measures enabling the restoration of data files, including regular backups and the separate, secure handling of copies (mirroring, backup);
  • the protection of data files against viruses (virus protection);
  • the physical protection of data files and the devices carrying them, including protection against fire, water damage, lightning and other natural damage, and the recoverability of damage resulting from such events (archiving, fire protection).

Lawful processing

The processing of personal data is lawful if at least one of the following applies:

  • the data subject has given consent to the processing of their personal data for one or more specific purposes;
  • processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
  • processing is necessary for compliance with a legal obligation to which the controller is subject;
  • processing is necessary in order to protect the vital interests of the data subject or of another natural person;
  • processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
  • processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. (GDPR Article 6)

Consent of the data subject, conditions

  • Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to the processing of their personal data.
  • If the data subject’s consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters.
  • The data subject has the right to withdraw their consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.
  • When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. (GDPR Article 7)

As a general rule, every data subject may request from the controller concerned:

  • information about their personal data,
  • access to their personal data,
  • rectification of their personal data,
  • erasure of their personal data,
  • restriction of the processing,
  • portability of their personal data,
  • they may object to the processing of their personal data,
  • they may withdraw consent already given,
  • and they have the right to lodge a complaint and to a judicial remedy.

The right to information about your personal data

Whatever the request to exercise a data subject’s right, the controller shall inform the data subject of the action taken on the request without undue delay and in any event within one month of receipt of the request. Where necessary – taking into account the complexity and number of the requests – this period may be extended by two further months. The controller shall, however, inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. If the controller does not take action on your request, it shall inform you without delay and at the latest within one month of receipt of the request of the reasons for not taking action and of the possibility of lodging a complaint with the Authority and seeking a judicial remedy before the regional court competent for your place of residence or stay.

Where the controller has reasonable doubts concerning your identity when you submit a request to exercise a data subject’s right, it may request the provision of additional information necessary to confirm your identity. If the controller demonstrates that it is not in a position to identify you, it may refuse to act on the request. Information and action on data subject requests are, as a general rule, free of charge. However, where a request is manifestly unfounded or excessive – in particular because of its repetitive character – the controller may charge a reasonable fee taking into account the administrative costs of providing the information or taking the action requested, or refuse to act on the request. The controller bears the burden of demonstrating the manifestly unfounded or excessive character of the request. If the controller demonstrably fails to fulfil any of your requests within the above time limits, the Authority will – upon complaint – investigate the matter.

The right of access to your personal data

Under this right, you are entitled to obtain confirmation from the controller as to whether or not your personal data are being processed and, where that is the case, to access your personal data and the information listed in the General Data Protection Regulation (for example the purpose and legal basis of the processing, the recipients or categories of recipients of the personal data, information on transfers to a third country or international organisation, the period of processing or the criteria used to determine it, the data subject’s rights and remedies, and the consequences of failing to provide the data).

The controller shall provide you with a copy of the personal data undergoing processing. For any further copies requested, the controller may charge a reasonable fee based on administrative costs, and the exercise of the right to obtain a copy shall not adversely affect the rights and freedoms of others.

The right to rectification of your personal data

Under the right to rectification, you are entitled, on the one hand, to have the controller rectify inaccurate personal data concerning you without undue delay at your request and, on the other hand, to have incomplete personal data completed.

The right to erasure of your personal data and the “right to be forgotten”

As a general rule, under the right to erasure, you are entitled to have the controller erase your personal data without undue delay at your request, and the controller is obliged to erase them without undue delay where certain conditions apply. The “right to be forgotten” extends the right to erasure to the online environment: where the controller has made your personal data public and is obliged to erase them, it shall take reasonable steps to inform the controllers processing your personal data that you have requested the erasure of any links to, or copies or replications of, those personal data.

It is important to note, however, that the erasure and “forgetting” of personal data is not possible where any of the cases set out in Article 17(3) of the General Data Protection Regulation applies.

The right to restriction of processing of your personal data

You are entitled to have the controller restrict – more commonly known as block – the processing at your request where one of the following applies:

  • you contest the accuracy of your personal data; in this case the restriction applies for a period enabling the controller to verify the accuracy of the personal data;
  • the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
  • the controller no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims;
  • you have objected to the processing; in this case the restriction applies pending the verification whether the legitimate grounds of the controller override yours.

The right to data portability

Under this right, you are entitled to receive the personal data concerning you, which you have provided to a controller, in a structured, commonly used and machine-readable format, and you have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided. You may exercise this right where the processing is based on consent or on a contract and is carried out by automated means.

The right to object to the processing of your personal data

You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data where the processing is based on the legitimate interest of the controller or on the exercise of official authority. Where personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to direct marketing. Where you object to processing for direct marketing purposes, your personal data shall no longer be processed for such purposes.

The right to withdraw consent

Where the legal basis of the processing is your consent (e.g. sending a marketing newsletter), you have the right to withdraw your consent to the processing at any time. The withdrawal of consent does not, however, make the processing carried out before the withdrawal unlawful.

The right to lodge a complaint and to a judicial remedy

As a data subject, you have the right to lodge a complaint with a supervisory authority – in particular in the Member State of your habitual residence, place of work or place of the alleged infringement – if you consider that the processing of personal data relating to you infringes the law. In Hungary, the competent supervisory authority is the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH).

Exercising the right to lodge a complaint does not preclude you, as a data subject, from seeking other administrative or judicial remedies if you consider that your personal data are being processed unlawfully. You may therefore initiate an administrative or judicial remedy at the same time as lodging a complaint.

Complaints may be lodged with the Hungarian National Authority for Data Protection and Freedom of Information, whose contact details are as follows:

Name: Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian National Authority for Data Protection and Freedom of Information) Registered office: 1125 Budapest, Szilágyi Erzsébet fasor 22/C. Postal address: 1530 Budapest, Pf.: 5. Phone: +36 1 391 1400 Fax: +36 1 391 1410 Website: http://www.naih.hu E-mail: ugyfelszolgalat@naih.hu

The right to a judicial remedy against a decision of the NAIH or another supervisory authority

If you have turned to the supervisory authority (NAIH) concerning processing and the authority has taken a decision in your case, you, as a data subject, are entitled to seek a judicial remedy against that decision, i.e. to challenge the decision before a court. You are also entitled to this judicial remedy if the competent supervisory authority (NAIH) does not handle the complaint or does not inform the data subject within three months of the progress or outcome of the complaint.

Proceedings against the supervisory authority (NAIH) shall be brought before the courts of the Member State where the supervisory authority is established.

The right to a judicial remedy against the controller or the processor

As a data subject, you are entitled to an effective judicial remedy if you consider that your rights in relation to processing have been infringed as a result of the unlawful processing of your personal data. Exercising the right to a judicial remedy does not preclude you, as a data subject, from seeking other administrative or judicial remedies, or from exercising your right to lodge a complaint, if you consider that your personal data are being processed unlawfully.

Proceedings against the controller or the processor shall be brought before the courts of the Member State where the controller or processor has an establishment. In the case of Capitalis Europe Kft., the courts of the place of establishment are the Hungarian courts, while the courts competent according to the registered office of Capitalis Europe Kft. are the Budaörs District Court (Budaörsi Járásbíróság) and the Budapest Environs Regional Court (Budapest Környéki Törvényszék).

Judicial proceedings may also be brought before the courts of the Member State where the data subject has their habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers.

Liability for damages and compensation for non-material damage

That is, how is the controller or processor liable towards the data subject in the event of damage?

If improper processing has caused you, as the data subject, damage, the controller is liable for compensation. Damage arises where the processing was unlawful or in breach of contract and the data subject suffered financial loss as a result. In the case of unlawful processing, the data subject may also claim compensation for non-material damage (Hungarian: sérelemdíj).

You may assert a claim for damages or for non-material damage primarily against the controller. The processor is liable for damages only where it has not complied with the obligations specifically directed to processors or has acted outside or contrary to the lawful instructions of the controller. In other words, the processor is not liable for errors committed by the controller.

Types of processing by the Controller according to their legal basis

Processing related to the preparation and performance of a contract

Requests for quotation and general enquiries about vehicles or services

Where the data subject contacts the Controller in any form (by phone, e-mail, by filling in an online form or in person) to request a quotation or information, the Controller processes the data provided for the purpose of responding to the enquiry. Retention period: the period necessary to fulfil the purpose of the processing, unless the Controller is entitled to process the data on another legal basis and for another purpose.

Enquiries through the website contact form

The contact form asks for: name, company name, country, e-mail address or phone number, the message and the chosen topic (buying, selling, transport or insurance). A name and one contact detail are required; everything else is optional.

The purpose of the processing is to answer the enquiry and prepare the requested offer. The legal basis is taking steps at the request of the data subject prior to entering into a contract (GDPR Article 6(1)(b)), or – where the data subject writes on behalf of a company – the Controller’s legitimate interest in answering business enquiries (GDPR Article 6(1)(f)).

The message is delivered by e-mail to the colleague responsible for the chosen topic. Retention period: until the enquiry is closed; if a contract results from the enquiry, according to the rules on processing related to the contract.

Sale and purchase of motor vehicles

In the case of the purchase or sale of new and used motor vehicles, the Controller processes the data provided by the data subject in the vehicle sale and purchase contract and the data of the vehicle purchased. In the case of the purchase of a used vehicle, the identity of the signatories of the vehicle sale and purchase contract is certified by two witnesses. The contract records or may record the witnesses' names, addresses, identity card numbers and signatures. The purpose of the processing is the conclusion and performance of the contract and the issuing of an invoice. Retention period: the Controller stores the documents serving the fulfilment of tax and accounting obligations for the period prescribed by the applicable tax and accounting laws, unless the processing has a different purpose and legal basis (for example the enforcement of a legal claim).

Short- or long-term rental of motor vehicles

Where a vehicle has been rented or let, we process the data provided in the vehicle rental contract (name, address, identity card/passport number, phone number, e-mail address) and the data of the rented vehicle. The purpose of the processing is the performance of the contract concluded and invoicing. Retention period: the Controller stores the documents serving the fulfilment of tax and accounting obligations for the period prescribed by the applicable tax and accounting laws, unless the processing has a different purpose and legal basis (for example the enforcement of a legal claim).

Processing based on the legitimate interest of the controller

Enforcement of legal claims

Where the enforcement of a legal claim becomes necessary in connection with a service provided by the Controller, the company processes the personal data necessary for enforcing the claim at most until the end of the proceedings required for that purpose.

Processing based on explicit consent

Business acquisition

The Controller may also process personal data (name, address, place and date of birth, phone number, e-mail address) for business acquisition purposes. On the basis of the consent, the Controller contacts the data subject only through the channels covered by the consent and for the specified purposes. The purpose of the processing is business acquisition. Retention period: until the consent is withdrawn.

Transfer of personal data

Transfer to authorities

On the basis of a legal obligation, the controller may be required, regularly or upon an individual request from an authority, to transfer certain data to the authorities entitled to receive them (for example the police or the transport authority).

Transfer of data to processors

In the course of processing personal data, we use professional partners, so-called processors, which act on behalf of the Controller. The processor is obliged to carry out its activities in accordance with the mandate and the applicable legal requirements. The controller is liable towards the data subject for any damage caused by the processor. The partners may not use the personal data transferred to them for their own business purposes and may not transfer the data to third parties.

Processors used:

HATMEHIT Korlátolt Felelősségű Társaság registered office: 2161 Csomád, Kossuth Lajos utca 89. Company registration number: 13-09-132604 e-mail: gaspar.gyorgy@agmamas.hu

Cloudflare, Inc. registered office: 101 Townsend St, San Francisco, CA 94107, United States activity: serving the website and forwarding the contact form Data transfers to the United States take place on the basis of certification under the EU–US Data Privacy Framework.

Microsoft Ireland Operations Limited registered office: One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland activity: e-mail and document storage (Microsoft 365)

Cookies and analytics

The https://capitalis.hu/ website does not use cookies and does not track visitors across pages or visits. Visits are measured with Cloudflare Web Analytics, without cookies or unique identifiers and only in aggregate (such as page views, country, browser type and load time); no individual can be identified from this. Cloudflare, Inc. may process technical log data (such as IP address and request time) to serve the website securely, under its own privacy rules.

General provisions on individual processing activities and the use of the services provided by the Controller

  1. As a general rule, within the processing activities and services carried out by the Controller, the processing of all data relating to the data subject is necessary for the performance of a contract or is based on voluntary consent, and its general purpose is to ensure the provision of the service and to maintain contact.
  2. The above general rule is supplemented by processing on other legal bases, for example processing required by law, about which the Controller informs data subjects when defining the individual processing activities.
  3. As a general rule,
  4. for certain services it is possible to provide additional data that help to fully understand the data subject’s needs; these are, however, not a condition for using the services provided by the Controller.
  5. the Controller stores personal data provided in the course of any processing activity in separate data files, separately from other data provided. These data files may be accessed only by the Controller’s authorised employee(s), if the Controller employs staff.
  6. in the absence of the data subject’s prior consent, the Controller does not transmit or transfer individual data or the data files as a whole to third parties, except for mandatory transfers required by law, and takes all security measures to prevent unauthorised persons from accessing the data.
  7. the modification, erasure and/or blocking of data recorded and stored in the course of any processing activity, as well as detailed information about the processing, may be requested by the data subject,
  8. the provision by the data subject of the data to be provided in the course of each processing activity is a condition for using the services provided by the Controller.

Specific rules on processing related to the performance of contracts and processing based on a declaration of consent

  1. The Controller keeps electronic and/or paper-based records of its clients and partners who are natural persons, and of the representatives and contact persons of its clients and partners who are not natural persons, into which the processed data are entered manually.
  2. Legal basis of the processing: the administrative step of becoming a partner, the second limb of Article 6(1)(a) and (b) GDPR (processing is necessary in order to take steps at the request of the data subject prior to entering into a contract). The declaration of consent is based on voluntary consent; the legal basis for concluding the agreement is the agreement itself.
  3. Data subjects concerned: all natural persons, and the representatives of persons other than natural persons, who are or wish to become clients or Partners of the Controller.
  4. Data processed: name for identification, phone number for contact, e-mail address for contact, data of the represented organisation for identification.
  5. Purpose of the processing: the performance of the contract and the keeping of records of the Controller’s clients,
  6. The activity and process concerned by the processing is as follows:
  7. The Controller obtains the data in the manner described above (see Chapter 2) and records them.
  8. Duration of the processing:
  9. until the expiry of the general limitation period (5 years) following the termination of the legal relationship.
  10. where an accounting document containing the data subject’s data has been issued, the processing of the data recorded on that document lasts for the period specified in the Accounting Act.
  11. Method of processing: electronically and/or on paper, manually.
  12. Source of the data: directly from the data subject.
  13. Disclosure: the data are not disclosed to third parties.
  14. Organisational and technical measures to protect the data processed: as set out above.
  15. Automated decision-making, profiling: none takes place in connection with the processing.

Personal data breaches and their handling

Under the General Data Protection Regulation (GDPR), a personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed. In other words, any event or situation in which your personal data may fall into the wrong hands is to be considered a personal data breach.

In the event of a personal data breach, we notify the competent supervisory authority without undue delay and at the latest 72 hours after becoming aware of it, and we also inform you, as the data subject, if the breach is likely to result in a risk to the rights and freedoms of natural persons.

We reserve the right to amend or update this Notice at any time without prior notice. Any amendment applies only to personal data collected after the publication of the amended version.

Please check this Notice regularly to keep track of changes and to find out how they affect you.

Effective from 8 October 2026. (Previous version dated 1 April 2024.) Capitalis Europe Kft. Sára Nagy, Managing Director