for customers, contact persons, prospects and users – Articles 13–14 GDPR
1. Controller
AB Telecom Ipari, Kereskedelmi és Szolgáltató Korlátolt Felelősségű Társaság (AB TELECOM Kft.), registered office: Senyei-Oláh u. 39., 4029 Debrecen, Hungary; company registration number: 09-09-001481; tax number: 10724480-2-09; represented by Balázs Radák, managing director; e-mail: info@abtelecom.hu; phone: +36 70 391 2505; websites: www.abtelecom.hu, vocalx.eu (the Provider or Controller). Data protection contact: dpo@abtelecom.hu.
This notice explains to our customers, their representatives and contact persons, to prospects interested in our services and to users of the VocalX Platform which personal data we process, for what purpose, on what legal basis and for how long, to whom we disclose it, and what rights data subjects have. It is based on Regulation (EU) 2016/679 (GDPR), the Hungarian Act CXII of 2011 on informational self-determination (Infotv.) and the Hungarian Act C of 2003 on electronic communications (Eht.).
Important distinction: for the data that our customers process through the VocalX Platform and the telephone service (e.g. their callers, call recordings, customer records), our customer is the controller and the Provider is a processor. That processing is governed by the Data Processing Terms; data subjects can exercise their rights with our customer. This notice covers the Provider’s own processing.
2. Data processed, purposes, legal bases, retention
| Processing | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Concluding and performing contracts | name, position, e-mail address and phone number of the customer’s representative and contact persons; for sole traders: name, registered office, tax number, registration number | quotation, contract, service provision, contact, troubleshooting | Art. 6(1)(b) GDPR – contract (sole traders); Art. 6(1)(f) – legitimate interest (contact persons of legal entities) | 5 years after the contract ends (general limitation period, Hungarian Civil Code) |
| Invoicing, accounting | billing name, address, tax number, bank account number, payment data | invoicing, collection of fees, accounting obligations | Art. 6(1)(c) GDPR – legal obligation (Hungarian Accounting Act s. 169, VAT Act s. 179) | 8 years from the date of the invoice |
| Subscriber data (Eht.) | subscriber’s name, registered office, registration number, tax number, contact data, telephone numbers, location of use for emergency calls | concluding and performing the subscriber contract, reporting to authorities | Art. 6(1)(c) GDPR – Eht. ss. 154 and 157 | 1 year after the contract ends, or until the fee claim becomes time-barred |
| Traffic data (call detail records) | calling and called number, start, duration, direction and charge of calls; SMS metadata | invoicing, settling billing disputes, network security, fraud prevention | Art. 6(1)(c) GDPR – Eht. s. 157; Art. 6(1)(f) – legitimate interest (fraud prevention) | 1 year from the due date of the invoice, or until a billing dispute is closed |
| Data retention for law enforcement | the data specified in Eht. s. 159/A | providing data to the authorities designated by law | Art. 6(1)(c) GDPR – Eht. s. 159/A | 1 year; unsuccessful calls: 6 months |
| Customer service requests, complaints, fault reports | name and contact data of the reporting person, content of the request, case number; recording of calls to the customer service line | investigating complaints and faults, statutory record keeping, quality assurance | Art. 6(1)(c) GDPR – Eht. s. 141, Consumer Protection Act s. 17/A; Art. 6(1)(f) – legitimate interest | complaints: 3 years; fault reports: 1 year; call recordings: 1 year |
| Prospects, requests for quotes and demos (including the website form) | name, company, e-mail address, phone number, content of the request | preparing an offer, getting in touch | Art. 6(1)(b) GDPR – steps prior to a contract; Art. 6(1)(f) – legitimate interest | without a contract: 6 months from the last contact |
| VocalX Platform user accounts | name, e-mail address, user name, password (hash), IP address, login logs, session data | providing access, security, preventing misuse | Art. 6(1)(b) and (f) GDPR | 30 days after the account is deleted; security logs 90 days |
| Newsletter, business information | name, e-mail address, company | information on products, developments and maintenance | Art. 6(1)(a) GDPR – consent (until unsubscribing); existing customers: Art. 6(1)(f) – legitimate interest | until consent is withdrawn / unsubscribing |
| Enforcing and defending legal claims | the data above, if a dispute arises | collecting receivables, settling disputes | Art. 6(1)(f) GDPR – legitimate interest | until the claim becomes time-barred or the proceedings are finally closed |
Providing the data required for the contract and for legal obligations is a precondition of concluding the contract; without them the Provider cannot provide the service. Subscribing to the newsletter is voluntary.
3. Disclosure, processors
3.1 Processors. For the processing above the Provider uses the following processors: cloud infrastructure and hosting: Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany; data centre: Nuremberg, Germany); wholesale telecommunications partner: I-Telecom Hungary Kft. (Mázoló u. 55., 2030 Érd, Hungary); accounting: Oda Az adó Kft.; invoicing software: KBOSS.hu Kft. (szamlazz.hu); e-mail and office systems: Google Cloud EMEA Limited (Google Workspace; Dublin, Ireland); delivery of system messages (login links, notifications) and of the website contact form e-mails: Resend, Inc. (San Francisco, USA; EU–US Data Privacy Framework and standard contractual clauses). The current list of processors is available at vocalx.eu/legal.
3.2 Authorities. Under the Eht., the Provider is obliged to disclose subscriber and traffic data to the authorities designated by law (courts, prosecution, investigating authorities, national security services, the National Media and Infocommunications Authority – NMHH) under the conditions set out there, and to transmit to emergency services the data necessary to identify and locate the caller.
3.3 Transfers to third countries. The Provider transfers personal data outside the EEA only on the basis of the safeguards of Chapter V GDPR (adequacy decision, EU–US Data Privacy Framework, standard contractual clauses). The processors primarily use data centres within the EEA.
3.4 Other recipients. When enforcing legal claims, the Provider may disclose data to its legal representative and to debt collectors, and, under a legal obligation, to the tax authority and other authorities. N-System Távközlési Kft., which provides the telephone numbers, processes the subscriber data needed for number porting, for recording the emergency-call location and – at the subscriber’s request – for directory enquiry services (name, address, tax number, telephone number, location of use) as an independent controller; the subscriber gives these data to it directly in the number porting declaration, or the Provider forwards them.
4. Data security
The Provider processes personal data over encrypted connections and protects it with access control, logging, regular backups and the technical and organisational measures detailed in Part B of the Data Processing Terms. Employees are bound by confidentiality. In the event of a personal data breach, the Provider acts in accordance with Articles 33–34 GDPR.
5. Your rights
You may request from the Provider:
- Access (Art. 15 GDPR): information on whether we process your personal data and, if so, a copy of the data and of the circumstances of the processing.
- Rectification (Art. 16): correction of inaccurate data and completion of incomplete data.
- Erasure (Art. 17): erasure of your data if it is no longer needed, you have withdrawn your consent, you have objected, or the processing is unlawful – unless a legal obligation or the enforcement of legal claims justifies further processing.
- Restriction (Art. 18): restriction of processing if you contest the accuracy of the data, the processing is unlawful, or you have objected.
- Data portability (Art. 20): receiving the data processed by automated means on the basis of consent or contract in a structured, machine-readable format.
- Objection (Art. 21): you may object at any time to processing based on legitimate interest; the Provider then continues processing only if there are compelling legitimate grounds. You may object to direct marketing without giving reasons.
- Withdrawal of consent (Art. 7): at any time for processing based on consent, without affecting the lawfulness of processing before the withdrawal.
Requests can be sent to info@abtelecom.hu or dpo@abtelecom.hu, or by post to Senyei-Oláh u. 39., 4029 Debrecen, Hungary. The Provider responds without undue delay and within one month at the latest; this period may be extended by two further months where necessary, in which case we will inform you. The Provider may request additional information to identify you. The information is free of charge; a reasonable fee may be charged for manifestly unfounded or repetitive requests.
6. Remedies
If you consider that the processing of your personal data infringes the GDPR, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH; Falk Miksa u. 9–11., 1055 Budapest; postal address: 1363 Budapest, Pf. 9.; phone: +36 1 391 1400; e-mail: ugyfelszolgalat@naih.hu; www.naih.hu) or with the supervisory authority of your habitual residence, or bring an action before the competent court of your place of residence or of the Provider’s registered office. We recommend that you first contact the Provider so that we can resolve the matter directly.
7. Automated decision-making, profiling
The Provider does not carry out automated decision-making or profiling in its own processing. After repeated failed login or authentication attempts the system automatically blocks the IP address or user name concerned for a limited time; the block can be lifted by the Provider or the customer’s administrator, and the data subject may contest it.
8. Changes to this notice
The Provider may amend this notice if the law or its processing practice changes; the current version is available at vocalx.eu/legal. The Provider informs customers of material changes by e-mail.