Monfils International Kft. Privacy Notice

1. The Data Controller and the scope of this Notice

Data Controller: Monfils International Kft.

Email: [email protected]

Effective date: This Privacy Notice (Notice) enters into force on January 1, 2026.

Purpose and legal basis of data processing, transfer of personal data and the rights of data subjects:

Purposes of data processing:

Maintaining contact with the data subject
Providing sustainability and HR consulting services to the Data Controller's Clients
Website maintenance, ensuring data security, troubleshooting and operation
Handling possible complaints and requests

Legal basis of data processing:

The data subject's consent
The legitimate interests of the Data Controller

Recipients of the data: The Data Controller may disclose information to its Clients, subcontractors participating in consulting projects, IT service providers, legal advisers (where necessary), and companies providing assessment tests.

Rights of the data subject: Information and access to personal data; rectification and erasure of data; objection to or restriction of data processing; data portability; lodging a complaint with the supervisory authority; and withdrawal of consent with respect to future data processing.

2. Source of the data

The processed data are provided by the data subject, supplied by the Data Controller's contractual partners, or obtained from databases and websites to which the Data Controller, its employees or subcontractors have access in accordance with the terms applicable to the relevant database.

The Data Controller asks data subjects to provide only accurate and truthful information and to report any changes without delay. The Data Controller may periodically request, and remind data subjects by email, to update their data if any changes have occurred.

3. Data processing activities

Contact and cooperation

Purpose of data processing: Maintaining contact and communicating with Clients, agents, subcontractors or other partners (collectively: partners).
Categories of personal data processed: Business contact details: name, email address, telephone number, message, job title or position.
Legal basis of data processing: The Data Controller's legitimate business interest in maintaining contact with the contact persons of its partners in order to respond flexibly through multiple channels to questions and requests, facilitate the conclusion of contracts and perform concluded contracts. The job title/position of contact persons makes it possible to coordinate with the competent employee, so the Data Controller contacts and maintains contact only with an employee whose duties and competence cover the relevant matter. (Article 6(1)(f) GDPR).
Retention period: For as long as the Data Controller's legitimate interest exists, typically until notification by the organization or the data subject that the person's status as a contact has ended.

Marketing and advertising

Purpose of data processing: Sending marketing materials and advertisements and promoting the Data Controller's activities.
Categories of personal data processed: Name, email address.
Legal basis of data processing: The data subject's consent (Article 6(1)(a) GDPR).
Retention period: Until consent is withdrawn.

7. Feedback on performance effectiveness

Purpose of data processing: Obtaining feedback on the effectiveness of the Data Controller's performance.
Legal basis of data processing: The Data Controller's legitimate interest in receiving information about the Client's decision for the purpose of evaluating the effectiveness of its activities and business development (Article 6(1)(f) GDPR).

Other purposes of data processing

Proof of performance of contractual obligations

Purpose: Retaining the candidate's name and position shown on the certificate of performance in order to comply with retention obligations under accounting and tax legislation.
Legal basis: Compliance with a legal obligation (Article 6(1)(c) GDPR).
Period: 8 years pursuant to Act C of 2000 on Accounting.

Satisfaction measurement

Purpose: Improving service quality and measuring satisfaction.
Legal basis: The Data Controller's legitimate interest (Article 6(1)(f) GDPR).
Period: Up to 1 year from completion of the evaluation.

Complaint handling and legal disputes

Purpose: Handling complaints from data subjects and defending against claims in legal disputes and legal proceedings.
Legal basis: The Data Controller's legitimate interest (Article 6(1)(f) GDPR).
Period: 1 year if no legal proceedings are pending. In the event of a complaint, until the process is concluded (including the duration of any related proceedings).

Website maintenance and data security

Purpose: Secure operation and development of the website and troubleshooting.
Data processed: IP address, access logs, error logs, browser identifier, backups.
Legal basis: The Data Controller's legitimate interest (Article 6(1)(f) GDPR).
Period: The system stores logs and statistics for 30 days.

Hosting provider details:

Name: ErdSoft DOO.

Registered office: Serbia, Subotica, Somborski put 33a

Contact: [email protected]

Website: sellvio.com/hu

(Detailed information concerning cookies is available in the Cookie Policy on the Data Controller's website.)

4. Joint controllers

4.1 Subcontractors

Where the Data Controller uses a subcontractor to support its activities and the subcontractor qualifies as a joint controller with the Data Controller:

The parties jointly determine the purposes.
The parties inform the data subject, on a case-by-case basis, of the other controller's details.
Data subjects may exercise their rights independently against either controller.

4.2 Clients

Where the Client and the Data Controller qualify as joint controllers:

Joint controllership lasts until information relating to the consulting project is transferred to the Client.
Each party independently ensures the necessary technical and organizational security measures.

5. Data transfers, recipients and processors

Employees of the Data Controller may access only the data strictly necessary for the performance of their duties (need-to-know principle).

Recipients to whom the Data Controller may transfer data:

Clients
Sustainability experts and HR consulting subcontractors
IT service providers and web developers
Cloud service providers (SaaS) (e.g. Microsoft, WIX, IkiruPeople, etc.)
Accounting and payroll service providers
Legal and professional advisers

Transfers to third countries

If the Data Controller transfers data to a third country outside the EU/EEA, the European Union Standard Contractual Clauses (EU SCCs) shall apply.

6. Rights of data subjects

Right of access: The data subject has the right to obtain confirmation as to whether personal data concerning them are being processed and to access the data being processed.
Right to rectification: The data subject may request correction of inaccurate data or completion of incomplete data.
Right to erasure ("right to be forgotten"): The data subject may request erasure of their data if the data are no longer necessary, consent has been withdrawn, the data subject objects to the processing, or the processing was unlawful.
Right to object: The data subject may object at any time to processing based on legitimate interests. In such a case, the Data Controller may no longer process the data unless it demonstrates compelling legitimate grounds for the processing that override the interests, rights and freedoms of the data subject.
Right to restriction of processing: The data subject may request restriction of processing (for example, where they contest the accuracy of the data or the processing is unlawful).
Right to data portability: In the case of automated processing based on consent or a contract, the data subject may request that their data be provided in a machine-readable format.
Withdrawal of consent: Where processing is based on consent, consent may be withdrawn at any time without restriction.

7. Automated decision-making and profiling

The Data Controller does not use automated decision-making or profiling that would produce legal effects concerning the data subject or similarly significantly affect them. Meaningful human intervention takes place in all cases.

8. Complaints and legal remedies

Questions, requests and complaints concerning data processing may be sent to the Data Controller using the contact details provided above.

The data subject also has the right to lodge a complaint with the supervisory authority:

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9-11.
Postal address: 1363 Budapest, P.O. Box 9.
Web: naih.hu

The data subject may also bring proceedings before a court if their rights have been infringed.

9. Data security

Monfils International Kft. ensures the security and confidentiality of data through appropriate technical and organizational measures.

10. Legal notice

The information and content available on the website are provided without any express or implied warranty. Monfils International Kft. makes every effort to ensure the accuracy of the content but accepts no liability for direct or indirect damages arising from its use.

The content of the website is the property of Monfils International Kft. or its partners and is protected by copyright.

Monfils International Kft. is committed to equal opportunities and rejects all forms of discrimination in its recruitment processes.

Service provider and company details:

Service provider: Monfils International Kft.

Registered office: 1138 Budapest, Hajdú utca 48, Building C

Legal representative: Varga Zsófia Éva

Company registration number: 01-09-305928

Tax number: 26174107-2-41