Data processing terms

This English version is a translation provided for information. Only the Hungarian text is legally binding: the Hungarian original.

An annex to the Terms of service. These terms apply to you if, through the API, you send an address or coordinates relating to another natural person — for example, the addresses of your customers, clients or users. In this relationship, you are the controller and we are the processor (Article 28 GDPR).

1. The parties and the scope of these terms

Controller: you — the natural or legal person or organisation that uses the API under the Terms of service and sends data relating to another natural person in the requests. If you have received an API key: the client to whom we issued the key.

Processor: the operator of adatka.hu (hereinafter: we). The operator is currently a private individual; we do not publish the operator's name and place of residence on the site, but we provide them in the manner described in section 9 of the Terms of service. If, as a client with an API key, you need them for selecting the processor (Article 28(1) GDPR) or for the records of processing activities (Article 30 GDPR), you can request them at info@adatka.hu, and we will provide them by email within 8 days; you may use them only for these purposes and for the enforcement of legal claims.

From 2 November 2026, these terms form part of the Terms of service and, together with them, become part of the contract — at the latest upon your first use of the API on or after that date in which you send data relating to another natural person. When an API key is issued, we also ask for your acceptance by email; the written (electronic) form under Article 28(9) GDPR is provided by this document and your email of acceptance. If the Terms of service and these terms differ with regard to the processing of personal data, these terms prevail.

2. Subject matter, nature, purpose and duration of the processing

3. Types of personal data and the data subjects

Data: postal code, settlement, city district (kerület), name and type of the street, house number, building, staircase, floor, door and other elements of the address — as much as the address sent contains; geographic coordinates (GET /reverse); the other parameters of the request. Special categories of personal data and personal data relating to criminal convictions and offences under Articles 9 and 10 GDPR are not within the subject matter of the processing; do not send such data.

Data subjects: your customers, clients, users and staff, the recipients of consignments and anyone else whose address you send; in the case of a browser key, the visitors to your website who type an address into the form.

An address in itself is not always personal data, but in your records it can be linked to a natural person. Therefore, we apply these terms to every address that you send.

4. Your obligations and rights

• You are responsible for ensuring that there is a legal basis for processing the addresses — and for passing them to us for processing (Article 6 GDPR).
• You inform the data subjects (Articles 13 and 14 GDPR) — including of the fact that the address is checked by a processor.
• You send only the data necessary for the processing (Article 5(1)(c) GDPR, Terms of service, section 5): no name, email address, phone number, client or order ID, birth details, ID document number, and no special-category or criminal personal data referred to in section 3.
• You fulfil the data subjects' requests; we help you with this (section 8).
• You are entitled to give instructions (section 5), to request information and to carry out audits (section 11), to object to a sub-processor (section 7), and to terminate the contract at any time by no longer using the service.
• If you carry out a data protection impact assessment or consult the supervisory authority (Articles 35–36 GDPR), we provide the information needed for this that is available to us.

5. Instructions

We process the data only on your written instructions; electronic form also counts as written. The following count as instructions: (a) this document; (b) every API request, which calls for the processing of the data sent in it and the sending back of the response; (c) any further instruction you give by email to info@adatka.hu, if we have accepted it by email.

If, in our opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions, we inform you of this without delay and may suspend its execution until the matter is clarified (Article 28(3) GDPR, last subparagraph).

If Union or Hungarian law requires us to process data beyond the instructions, we notify you of this before the processing, unless the law prohibits this on important grounds of public interest (Article 28(3)(a) GDPR). We disclose data to an authority only on the basis of a legal obligation and — unless this is prohibited — we notify you of it.

We do not use the data for our own purposes: we do not use them to expand our own address dataset, we do not serve other clients with them, we do not compile statistics or profiles from them, we do not sell them, and we neither use them for nor pass them on for training artificial intelligence. No address appears in the log; we use a log line only within its retention period, to find the cause of an error. We do not keep the submitted address as a test case, as an example or in any other form.

6. Confidentiality and security

Currently only the operator has access to the data. Later, too, another person may be given access only after a written confidentiality undertaking, and only to the extent necessary for their task (Article 28(3)(b) and Article 29 GDPR).

The most important of the measures under Article 32 GDPR:

• the connection is encrypted (HTTPS);
• the application accepts requests only on the server's internal address; from outside, it can be reached only through the web server, which keeps no access log;
• neither the IP address, nor the API key, nor the submitted address or coordinates go into the application log — only the request's path, the names of the parameters and the length of their values, and the response code; the log is kept for at most 14 days;
• the body of a POST /clean request is not written to the log; we do not write the addresses to a database, and the search engine does not log them either;
• we store the API key only as a SHA-256 hash; the client database file can be read only by the operator's user account;
• a firewall runs on the server;
• when an API key is used, we limit the number of requests;
• the backups reach the backup storage over an encrypted (SSH) connection, and they do not contain the addresses that you send.

We review the measures as the risks and technology change. We keep records under Article 30(2) GDPR of the processing carried out on your behalf.

7. Sub-processors

You give general written authorisation for us to engage the sub-processors listed below (Article 28(2) GDPR):

We have concluded contracts with them that impose on them, too, the data protection obligations set out in Article 28(3) GDPR (Article 28(4) GDPR). If any of them fails to fulfil its data protection obligations, we remain fully liable to you for that.

At least 30 days before engaging a new sub-processor or replacing one of the sub-processors, we notify the clients who have an API key by email, and we also publish the change on this page and on the home page. You may object, giving reasons, within 15 days of the notification. If we cannot remove the reason for the objection, you may stop using the service. If the replacement cannot wait because the hosting provider or the email provider suddenly drops out, we may also make the replacement at shorter notice; we notify you of this, together with the reason, without delay.

8. Assistance in fulfilling data subject requests

If a data subject contacts us about data that you sent, we forward the request to you within 5 working days — provided that we can establish which client it belongs to — and we inform the data subject of this; we do not fulfil the request ourselves. The log contains no IP address, no API key and no address, so we usually cannot link a log line either to a client or to a data subject.

At your request, we provide all the information available to us that is needed to fulfil a data subject request (Article 28(3)(e) GDPR). We do not delete individual lines from the log separately; the entire log is deleted automatically after at most 14 days.

9. Personal data breach

If we become aware of a personal data breach affecting the data that you sent, we notify you by email without undue delay, within 48 hours at the latest (Article 33(2) GDPR); in the case of use without a key, the notification is made on this page. The notification contains — insofar as these are already known — the nature of the breach, the categories and approximate number of the data subjects and of the data affected by the breach, the likely consequences, the measures taken or planned, and whom you can ask for further information (Article 33(3) GDPR). Whatever is not yet known, we provide in phases. We keep a record of the breach, and we help you with the notification to the supervisory authority and with informing the data subjects (Articles 33–34 GDPR).

10. End of the processing

When the contract ends, of the addresses that you sent, only those that you sent us in a message remain with us; no address appears in the log, the log lines are deleted automatically after at most 14 days, and we keep the messages for the period set out in the Privacy notice. There is no data to be returned: you received the result of the processing immediately for every request. At your request, we confirm the erasure by email (Article 28(3)(g) GDPR).

11. Information and audits

We make available to you all the information necessary to demonstrate compliance with these terms, and we allow you, or an auditor mandated by you and bound by confidentiality, to conduct an audit (Article 28(3)(h) GDPR). We reply to your written questions within 30 days. The data are in the hosting provider's data centre, which we ourselves have no right to enter; therefore, the audit is carried out primarily by our showing you on screen, at a time agreed at least 30 days in advance, the settings, the way logging is done and the measures — without disclosing other clients' data. If this is not sufficient, we agree the place and method of the on-site inspection in advance. You may request such an audit once a year, at your own expense — and more often in the event of a personal data breach or a request from an authority. The certificates and reports published by the hosting provider are used to audit the hosting provider.

12. Transfers to third countries

We do not transfer the data outside the European Economic Area. Such a transfer could take place only on the basis of your prior written instruction and with the safeguards required by Chapter V GDPR (Article 28(3)(a) and Article 44 GDPR).

13. Liability

Liability towards data subjects is governed by Article 82 GDPR; section 7 of the Terms of service does not limit it, nor does it limit the claim for reimbursement under Article 82(5) GDPR. Liability for intentional breach of contract cannot be excluded by the Terms of service either (Section 6:152 of the Ptk., Act V of 2013 on the Civil Code).

14. Amendment

Since these terms form part of the Terms of service, we amend them in accordance with section 8 of the Terms of service: we publish the amendment on this page, with its date, at least 30 days before it takes effect, indicate it on the home page, and also send it directly by email to the clients who have an API key. If you do not accept it, you may say so before it takes effect and stop using the service; if you continue to use the service after it takes effect, you thereby accept the amendment. Only an amendment made mandatory by a change in legislation, or the urgent replacement described in section 7, may take effect at shorter notice. We keep the earlier versions; if you need one of them, write to info@adatka.hu stating the date for which you want the text that was in force, and we will send it to you by email within 8 days.

15. Applicable law, contact

These terms are governed by Hungarian law and section 9 of the Terms of service. Contact: info@adatka.hu. Please tell us to whom we should send the notifications under these terms.

Annex: where to find what Article 28(3) GDPR requires

In force: from 2 November 2026 · Published: 3 October 2026 · Amended: 3 October 2026 (the log without the submitted address and the coordinates)