Privacy Policy

Introduction

This Privacy and Data Protection Policy outlines the rules governing the processing of personal data by Netpromotion Invest Kft., the operator of the website and services available at https://bestgoulashbudapest.com/, as well as detailed information regarding data protection and data processing.

The Service Provider/Data Controller processes the data of visitors to the website to provide them with appropriate services. By using the website's services, you provide certain personal data, some of which is collected automatically (e.g., IP address, browser type), while other data is recorded with your consent (e.g., by filling out forms).

The Service Provider is fully committed to complying with legal requirements for personal data processing, particularly those outlined in Regulation (EU) 2016/679 of the European Parliament and of the Council. Your personal data is processed lawfully and fairly by the website owner, in accordance with applicable legal regulations and adhering to both written and unwritten international data protection standards.

This Privacy Policy is based on Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as well as Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (hereinafter: Infotv.).

By starting to use https://bestgoulashbudapest.com/, users accept the terms of this Privacy Policy and Statement. This Privacy Statement is continuously available at https://bestgoulashbudapest.com/.

Netpromotion Invest Kft., located at 1056 Budapest, Duna utca 3., ground floor 1, tax number: 10907850-2-41 (hereinafter: Service Provider, Data Controller), adheres to the following policy:

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (27 April 2016) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), we provide the following information.

This Privacy Policy governs the data processing of the following website/mobile applications: https://bestgoulashbudapest.com/

The Privacy Policy is accessible at: https://bestgoulashbudapest.com/privacy-policy/

Changes to the policy take effect upon publication at the above address.

Data Controller and Contact Details

Name: Netpromotion Invest Kft.
Registered Office: 1056 Budapest, Duna utca 3., ground floor 1
Email: info.netpromotioninvest@gmail.com
Phone: +36 70 425 0080

Definitions

• Personal Data: Any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
• Data Processing: Any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
• Data Controller: The natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
• Data Processor: A natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller.
• Recipient: A natural or legal person, public authority, agency, or another body to which the personal data are disclosed, whether a third party or not. Public authorities that may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall comply with the applicable data protection rules according to the purposes of the processing.
• Consent of the Data Subject: Any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.
• Data Breach: A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

Principles of Personal Data Processing

Personal data shall be:

• Processed lawfully, fairly, and in a transparent manner in relation to the data subject ("lawfulness, fairness, and transparency");
• Collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes shall not be considered incompatible with the original purpose ("purpose limitation");
• Adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed ("data minimization");
• Accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay ("accuracy");
• Kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, subject to the implementation of appropriate technical and organizational measures required by this Regulation to safeguard the rights and freedoms of the data subject ("storage limitation");
• Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures ("integrity and confidentiality").

The Data Controller is responsible for compliance with the above principles and must be able to demonstrate such compliance ("accountability").

The Data Controller declares that its data processing complies with the principles outlined in this section.

Contact, Messaging, and Quote Requests

Data Collection, Scope of Processed Data, and Purpose of Processing

The email address does not need to contain personal data.

Affected Individuals: All individuals sending messages and/or requesting quotes via the contact form on the website.

Duration of Data Processing and Deletion Deadline: Data is retained until the data subject requests deletion, in accordance with Article 17(1) GDPR.

Authorized Data Processors and Recipients: Personal data may be processed by authorized employees of the Data Controller.

Rights of Data Subjects:

• The data subject may request access to, rectification, erasure, or restriction of processing of their personal data, as well as data portability and the withdrawal of consent at any time.
• Requests for access, erasure, modification, restriction of processing, or data portability can be made:
  • By mail: 1056 Budapest, Duna utca 3., ground floor 1
  • By email: info.netpromotioninvest@gmail.com
  • By phone: +36 70 425 0080

Legal Basis for Processing: Consent of the data subject, Article 6(1)(a) and (b) GDPR. By contacting us, you consent to the processing of your personal data (name, phone number, email address) in accordance with this policy.

Information:

• The processing is based on your consent and is necessary for providing offers.
• You are required to provide personal data to enable contact.
• Failure to provide data will result in the inability to contact the Data Controller.
• Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Customer Relations

Data Collection, Scope of Processed Data, and Purpose of Processing

Affected Individuals: All individuals contacting the Data Controller by phone, email, or in person, or those in a contractual relationship with the Data Controller.

Duration of Data Processing and Deletion Deadline: Inquiries are retained until the data subject requests deletion, up to a maximum of 2 years.

Authorized Data Processors and Recipients: Personal data may be processed by authorized employees of the Data Controller, in compliance with the above principles.

Rights of Data Subjects:

• The data subject may request access to, rectification, erasure, or restriction of processing of their personal data, as well as data portability and the withdrawal of consent at any time.
• Requests for access, erasure, modification, restriction of processing, or data portability can be made:
  • By mail: 1056 Budapest, Duna utca 3., ground floor 1
  • By email: info.netpromotioninvest@gmail.com
  • By phone: +36 70 425 0080

Legal Basis for Processing:

• The processing is necessary for contract fulfillment and providing offers.
• You are required to provide personal data to enable contract fulfillment or request processing.
• Failure to provide data will result in the inability to fulfill the contract or process the request.

Newsletter and Direct Marketing Activities

Under Section 6 of Act XLVIII of 2008 on the Basic Conditions and Certain Restrictions of Commercial Advertising Activities, users may explicitly and voluntarily consent to being contacted by the Service Provider with advertising offers and other communications using the contact details provided during registration. Furthermore, in accordance with this policy, the customer may consent to the Service Provider processing their personal data necessary for sending advertising offers.

The Service Provider does not send unsolicited advertising messages, and users can unsubscribe from such offers free of charge, without restriction or justification. Upon unsubscribing, the Service Provider will delete all personal data necessary for sending advertising messages from its records and will no longer contact the user with advertising offers. Users can unsubscribe by clicking the link provided in the messages.

Data Collection, Scope of Processed Data, and Purpose of Processing

Affected Individuals: All individuals subscribing to the newsletter.

Purpose of Processing: Sending electronic messages (email, SMS, push notifications) containing advertisements, providing information about current updates, products, promotions, new features, etc.

Duration of Data Processing and Deletion Deadline: Data is processed until the consent is withdrawn, i.e., until unsubscription.

Authorized Data Processors and Recipients: Personal data may be processed by the Data Controller and its sales and marketing employees, in compliance with the above principles.

Rights of Data Subjects:

• The data subject may request access to, rectification, erasure, or restriction of processing of their personal data, object to the processing, and request data portability, as well as withdraw consent at any time.
• Requests for access, erasure, modification, restriction of processing, data portability, or objection can be made:
  • By mail: 1056 Budapest, Duna utca 3., ground floor 1
  • By email: info.netpromotioninvest@gmail.com
  • By phone: +36 70 425 0080
• The data subject can unsubscribe from the newsletter free of charge at any time.

Information:

• The processing is based on your consent and the legitimate interests of the Service Provider.
• You are required to provide personal data to receive newsletters.
• Failure to provide data will result in the inability to send newsletters.
• You can withdraw your consent at any time by unsubscribing.
• Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Recipients of Personal Data

Recipient: A natural or legal person, public authority, agency, or other body to which personal data is disclosed, whether a third party or not.

Data Processors (Processing Data on Behalf of the Data Controller)

The Data Controller engages data processors to facilitate its data processing activities and to fulfill contractual or legal obligations. The Data Controller ensures that only data processors providing sufficient guarantees for GDPR compliance and the protection of data subjects' rights are engaged, implementing appropriate technical and organizational measures.

Personal data processed under this policy is handled only in accordance with the Data Controller's instructions. The Data Controller is legally responsible for the activities of the data processor. The data processor is liable for damages caused by processing only if it fails to comply with GDPR obligations specific to processors or acts contrary to the Data Controller's lawful instructions. The data processor has no substantive decision-making authority regarding data processing.

The Data Controller may engage hosting providers for IT infrastructure and courier services for product delivery as data processors.

Selected Data Processors

Cookie Management

Cookies such as those used for password-protected sessions, shopping carts, security, essential functions, functional purposes, or website statistics do not require prior consent from data subjects.

Data Collection and Scope of Processed Data: Unique identifier, dates, times.

Affected Individuals: All individuals visiting the website.

Purpose of Processing: User identification, tracking visitors, ensuring customized functionality.

Duration of Data Processing and Deletion Deadline:

Authorized Data Processors: Personal data may be accessed by the Data Controller.

Rights of Data Subjects: Data subjects can delete cookies via their browser's Tools/Settings menu, typically under Privacy settings. Most browsers allow users to configure which cookies to save or delete. Restricting cookies or disabling third-party cookies may limit the website's full functionality. Instructions for customizing cookie settings in common browsers:

• Google Chrome: support.google.com/chrome/answer/95647
• Internet Explorer: support.microsoft.com: delete manage cookies
• Firefox: support.mozilla.org: cookie settings
• Safari: support.apple.com/guide/safari/sfri11471

Google Ads Conversion Tracking

The Data Controller uses the "Google Ads" online advertising program and its conversion tracking service, provided by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google"). When a user accesses a website via a Google ad, a conversion tracking cookie is placed on their computer. These cookies have limited validity and do not contain personal data, so the user cannot be identified.

When a user browses certain pages of the website and the cookie is still active, both Google and the Data Controller can see that the user clicked on the ad. Each Google Ads client receives a unique cookie, preventing tracking across other clients' websites.

The information collected via conversion tracking cookies is used to generate conversion statistics for Ads clients who opt for conversion tracking. Clients learn the number of users who clicked on their ads and were redirected to a page with a conversion tracking tag, but they do not receive information that could identify users.

To opt out of conversion tracking, users can disable cookies in their browser settings, preventing their inclusion in conversion tracking statistics.

Based on Google Consent Mode v2, two new cookie types are used: ad_user_data (for consenting to data sharing with Google for advertising purposes) and ad_personalization (for regulating data use for personalized ads, e.g., remarketing). The Data Controller ensures proper consent collection and withdrawal through its cookie banner/panel. Withdrawal of consent does not affect the lawfulness of prior processing.

Further information and Google's Privacy Policy: policies.google.com/privacy

Third-Party Content Loaded by This Website

Google Analytics runs only on the direction pages under /go/, and only after you accept it there (see "Google Analytics and the TikTok Pixel on the Direction Pages (/go/)" below); no other page of this website uses an analytics service. Analytics and advertising cookies are set only after you accept them, in the cookie banner or, on the direction pages, in their own consent bar.

The website does load the following third-party content, which requires your browser to connect to servers operated by the providers below. In each case your IP address, and technical data such as your browser type and the page you are viewing, are transmitted to that provider. Where consent is required it is obtained through the cookie banner, and it may be withdrawn at any time with effect for the future.

Google Maps. Our location pages embed a map provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. The map loads when the page is displayed. Google may set cookies and may transfer data to servers outside the European Economic Area. Google’s Privacy Policy: policies.google.com/privacy

Google Fonts. The typefaces used on this website are loaded from Google servers (fonts.googleapis.com and fonts.gstatic.com), operated by Google Ireland Ltd. Google’s Privacy Policy: policies.google.com/privacy

Content delivery networks. Two display libraries used for animation and scrolling are loaded from Cloudflare, Inc. (cdnjs.cloudflare.com) and jsDelivr (cdn.jsdelivr.net). Their privacy policies: cloudflare.com/privacypolicy and jsdelivr.com/privacy

Google Analytics and the TikTok Pixel on the Direction Pages (/go/)

The pages https://bestgoulashbudapest.com/go/vino/, /go/bonnie/, /go/terv/, /go/bazilika/, /go/mp/, /go/fiamma/ and /go/rsh/ are short direction pages for single restaurants, which advertisements link to. They do not show the cookie banner of the other pages: each has a consent bar of its own, which reads: "With your permission, the OpenAI Ads pixel, Google Analytics and the TikTok Pixel set cookies to measure our ads and this page: visits and button clicks. Nothing loads before you accept, and you can change your choice with Cookie settings below. Anonymous, cookie-free click counts are always collected." Its two buttons, "Accept" and "Decline", have the same size.

Before you click "Accept", nothing is loaded from Google, TikTok or OpenAI and none of the cookies below is set; after "Decline" nothing is loaded at all. Your answer is stored in your browser (gl_go_consent_v2, in local storage) until you delete it. You can change it at any time with the "Cookie settings" link at the bottom of these pages: choosing "Decline" after an earlier "Accept" deletes the cookies and browser entries these tools keep on this website and reloads the page without them. Withdrawal of consent does not affect the lawfulness of prior processing.

After "Accept" the page loads:

• Google Tag Manager (www.googletagmanager.com), a tag management service of Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). It loads Google Analytics and the TikTok Pixel and sets no cookie of its own.
• Google Analytics (Google). It records the visit, how the page is used (with Google's standard settings also scrolling and clicks on links to other websites) and every click on the page's directions, phone, reviews and venue page or menu buttons, each with the page's name (for example "vino"), together with the page address, the referring page, the time and data about the browser and the device; Google receives the IP address, from which it derives an approximate location. It sets the cookies _ga (to recognise the browser) and _ga_M3Q2W3WFNY (to follow the visit) on this website, which Google says last two years. The page tells Google's consent mode that Google Analytics may use its cookies, while storage for advertising and for personalised advertising stays switched off. Google's Privacy Policy: policies.google.com/privacy
• The TikTok Pixel of TikTok, which for the European Economic Area names TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. It reports the visit, the same button clicks with the page's name, and events the pixel records on its own about the visit (such as an engaged visit), to TikTok, so that the Data Controller can measure its advertisements on TikTok; TikTok also receives the IP address and data about the browser and the device. It sets cookies on this website (such as _ttp, _tt_enable_cookie, ttcsid and ttcsid_ followed by the pixel's code, and ttclid when you arrive through a TikTok advertisement), may set or read its own cookies on tiktok.com, and keeps short entries in the browser's session storage. TikTok says these cookies last up to 13 months from their last use and serve to measure and improve the performance of advertising campaigns and to personalise the experience, including ads, on TikTok. TikTok's Privacy Policy: tiktok.com/legal/page/eea/privacy-policy/en
• The OpenAI Ads pixel (bzrcdn.openai.com) of OpenAI. It reports the visit and the button clicks to OpenAI to measure the Data Controller's advertisements in ChatGPT. According to its code it sets the cookie __obref (one year) and, when you arrive through an OpenAI advertisement, __oppref (30 days).

Social Media

Data Collection and Scope of Processed Data: Registered names on social media platforms (Meta/Twitter/Pinterest/YouTube/Instagram, etc.) and the user's public profile picture.

Affected Individuals: All individuals registered on Meta/Twitter/Pinterest/YouTube/Instagram, etc., who have liked the Service Provider's social media page or contacted the Data Controller via social media.

Purpose of Data Collection: Sharing, liking, following, or promoting specific website content, products, promotions, or the website itself on social media.

Duration of Data Processing, Deletion Deadline, Authorized Data Processors, and Rights of Data Subjects: Information about data sources, processing, transfer methods, and legal bases is available on the respective social media platforms. Data processing occurs on these platforms, and their regulations govern processing duration, methods, and options for data deletion or modification.

Legal Basis for Processing: The data subject's voluntary consent to the processing of their personal data on social media platforms.

Customer Relations and Other Data Processing

If questions or issues arise during the use of our services, the data subject may contact the Data Controller via the methods provided on the website (phone, email, social media, etc.). The Data Controller deletes received emails, messages, and data provided via phone or Meta, along with the inquirer's name, email address, and other voluntarily provided personal data, no later than 2 years after the data was provided.

Information about data processing not covered in this policy will be provided at the time of data collection.

In response to exceptional official requests or requests from other authorities authorized by law, the Service Provider is obliged to provide information, disclose data, transfer data, or make documents available. In such cases, the Service Provider discloses only the personal data strictly necessary to achieve the purpose of the request, provided the requesting party specifies the exact purpose and scope of the data.

Rights of Data Subjects

Right of Access: You have the right to obtain confirmation from the Data Controller as to whether your personal data is being processed and, if so, to access the personal data and information specified in the GDPR.

Right to Rectification: You have the right to request the Data Controller to correct inaccurate personal data concerning you without undue delay. You may also request the completion of incomplete personal data, including by means of a supplementary statement.

Right to Erasure: You have the right to request the Data Controller to erase your personal data without undue delay under certain conditions.

Right to Be Forgotten: If the Data Controller has made your personal data public and is obliged to erase it, the Data Controller will take reasonable steps, including technical measures, to inform other data controllers processing the data that you have requested the erasure of links to, or copies of, your personal data.

Right to Restriction of Processing: You have the right to request the Data Controller to restrict processing if one of the following applies:

• You contest the accuracy of the personal data, for a period enabling the Data Controller to verify the accuracy;
• The processing is unlawful, and you oppose erasure and request restriction instead;
• The Data Controller no longer needs the personal data for processing, but you require them for the establishment, exercise, or defense of legal claims;
• You have objected to processing, pending verification of whether the Data Controller's legitimate grounds override yours.

Right to Data Portability: You have the right to receive your personal data, which you provided to a Data Controller, in a structured, commonly used, and machine-readable format, and to transmit those data to another controller without hindrance from the original Data Controller.

Right to Object: In cases of processing based on legitimate interests or public authority, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data, including profiling based on those provisions.

Right to Object to Direct Marketing: If personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such purposes, including profiling related to direct marketing. If you object, the personal data will no longer be processed for such purposes.

Right to Not Be Subject to Automated Decision-Making, Including Profiling: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision is necessary for entering into or performing a contract, is authorized by applicable law with appropriate safeguards, or is based on your explicit consent.

Response Deadline

The Data Controller will inform you of actions taken in response to your requests without undue delay and, in any event, within one month of receiving the request. This period may be extended by two months if necessary. The Data Controller will inform you of any extension, stating the reasons for the delay, within one month of receiving the request.

If the Data Controller does not take action on your request, it will inform you without delay, and at the latest within one month of receiving the request, of the reasons for not taking action and of your right to lodge a complaint with a supervisory authority and seek judicial remedy.

Data Security

The Data Controller and Data Processor implement appropriate technical and organizational measures to ensure a level of data security appropriate to the risk, considering the state of the art, implementation costs, and the nature, scope, context, and purposes of processing, as well as the varying likelihood and severity of risks to individuals' rights and freedoms. These measures include, where applicable:

• Pseudonymization and encryption of personal data;
• Ensuring the ongoing confidentiality, integrity, availability, and resilience of processing systems and services;
• The ability to restore access to and availability of personal data in a timely manner in the event of a physical or technical incident;
• A process for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures for ensuring data security.

Data must be stored in a way that prevents unauthorized access. For paper-based data, this involves secure physical storage and archiving systems. For electronically processed data, centralized access control systems are used.

Data storage methods must ensure that data can be deleted upon the expiration of the retention period or when otherwise required, with deletion being irreversible. Paper-based data is destroyed using shredders or specialized document destruction services. Electronic data is destroyed in accordance with rules for decommissioning electronic media, ensuring secure and irreversible deletion.

Specific Data Security Measures by the Data Controller

Physical Protection:

• Paper-based documents are stored in secure, lockable, dry premises.
• Digitized paper documents follow the rules for digital storage.
• Employees performing data processing must secure data carriers or lock the premises when leaving.
• Only authorized personnel may access personal data, and third parties are prevented from accessing them.
• The Data Controller's buildings and premises are equipped with fire and property protection systems.

IT Protection:

• Computers and mobile devices used for processing are owned by the Service Provider.
• Systems containing personal data are protected against viruses.
• Data backups and archiving are used to ensure the security of digitally stored data.
• Access to the central server is restricted to authorized personnel with appropriate credentials.
• Access to data on computers requires a username and password.

Notification of Data Breaches

If a data breach is likely to result in a high risk to the rights and freedoms of individuals, the Data Controller will inform the data subject without undue delay. The notification will clearly and plainly describe the nature of the breach, provide contact details of the data protection officer or another contact point, outline likely consequences, and describe measures taken or planned to address the breach and mitigate its effects.

Notification is not required if:

• The Data Controller has implemented appropriate technical and organizational measures, such as encryption, rendering the data unintelligible to unauthorized persons;
• Subsequent measures ensure that the high risk to individuals' rights and freedoms is unlikely to materialize;
• Notification would involve disproportionate effort, in which case public communication or similar effective measures will be used.

If the Data Controller has not notified the data subject, the supervisory authority may require notification after assessing the likelihood of high risk.

Reporting Data Breaches to the Authority

The Data Controller will report a data breach to the competent supervisory authority under Article 55 GDPR without undue delay, and where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to pose a risk to individuals' rights and freedoms. If the report is not made within 72 hours, the reasons for the delay must be provided.

Review of Mandatory Data Processing

If the duration or periodic review of mandatory data processing is not specified by law, local ordinance, or EU legal acts, the Data Controller will review at least every three years whether the processing of personal data by itself or its processors is necessary to achieve the processing purpose. The circumstances and results of this review are documented and retained for ten years, to be provided to the National Authority for Data Protection and Freedom of Information upon request.

Complaint Procedure

Complaints regarding potential violations by the Data Controller can be lodged with:

National Authority for Data Protection and Freedom of Information
Address: 1055 Budapest, Falk Miksa utca 9-11.
Postal Address: 1363 Budapest, Pf. 9.
Phone: +36 1 391 1400
Fax: +36 1 391 1410
Email: ugyfelszolgalat@naih.hu

Closing Remarks

This Privacy Policy was prepared in accordance with the following regulations:

• Regulation (EU) 2016/679 (GDPR);
• Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information;
• Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services;
• Act XLVII of 2008 on the Prohibition of Unfair Commercial Practices Against Consumers;
• Act XLVIII of 2008 on the Basic Conditions and Certain Restrictions of Commercial Advertising Activities;
• Act XC of 2005 on Electronic Freedom of Information;
• Act C of 2003 on Electronic Communications;
• Opinion 16/2011 on EASA/IAB Best Practice Recommendation on Online Behavioral Advertising;
• Recommendations of the National Authority for Data Protection and Freedom of Information on data protection requirements for prior information.