Privacy Notice

Purpose and scope of this Notice

Dmlab Kft. (hereinafter: the Controller or Dmlab) is committed to protecting personal data. The purpose of this Notice is to explain, in a concise, transparent and easily understandable manner, what personal data we process through the dmlab.hu website (hereinafter: the Website), for what purposes and on what legal bases, for how long, to whom we disclose such data, and what rights you may exercise.

This Notice covers the processing carried out through the three forms available on the Website, job applications received at job@dmlab.hu, and the cookies used on the Website.

This Notice does not cover processing related to client relationships, the performance of concluded contracts, invoicing or employment relationships; the Controller provides separate notices for these activities. The Controller provides its open training activities through dataskool.hu; information on processing related to enrolment in training courses and adult education reporting is available in the privacy notice published there.

This Notice has been prepared in accordance with the legislation in force from time to time, primarily Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, hereinafter: GDPR).

The Controller and its contact details

The controller of the personal data provided on the Website is:

• Name: Dmlab Informatikai Tanácsadó, Kutató, Fejlesztő és Szolgáltató Korlátolt Felelősségű Társaság (abbreviated name: Dmlab Kft.)
• Registered office: 1062 Budapest, Andrássy út 97, 3rd floor, door 22, Hungary
• Company registration number: 01-09-935865 * Tax number: 22614175-2-42
• Registration court: Company Registration Court of the Budapest-Capital Regional Court
• E-mail: info@dmlab.hu
• Website: https://dmlab.hu

Data Protection Officer: under Article 37 of the GDPR, the Controller is not required to designate a data protection officer. Questions and requests concerning data processing may be sent to info@dmlab.hu or by post to the Controller’s registered office.

Main legislation governing the processing

• Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR);
• Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Infotv.);
• Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities (Grt.);
• Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services (Ekertv.); * Act C of 2003 on Electronic Communications (Eht.), Section 155; * Act V of 2013 on the Civil Code (Ptk.); * Regulation (EU) 2024/1689 on artificial intelligence (AI Act), together with the applicable transitional provisions, as amended by Regulation (EU) 2026/1744.

Individual processing activities

Below, we describe by activity what data we process, for what purpose and on what legal basis. Personal data means any information relating to you as an identified or identifiable person.

Newsletter subscription

You can subscribe to the Controller’s newsletter on the Website’s home page, Case Studies page and Blog page. Subscription is voluntary and is not required in order to use any other services of the Website.

Consent under Section 6(1)–(2) of the Grt. is required only where you, as a natural person, are the recipient of the newsletter.

Processing period: until consent is withdrawn (unsubscribe). If you unsubscribe, the Controller will immediately delete you from the newsletter database. Data used to demonstrate the giving and withdrawal of consent will be retained by the Controller for 5 years after unsubscribing, until the end of the general limitation period.

Source of the data: directly from you.

Withdrawal of consent: you may withdraw your consent at any time, without giving reasons and free of charge, by clicking the unsubscribe link at the bottom of any newsletter or by sending a message to the Controller’s e-mail address. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Consequences of not providing the data: without providing the data, you cannot subscribe to the newsletter.

Contact form

Through the form available on the Contact page of the Website, you may ask a question or initiate a project or cooperation. We process the data provided in the form for two separate purposes: to respond to your enquiry and, only where you have given separate consent, to contact you for marketing purposes.

Responding to enquiries and keeping in contact

Please do not provide personal data in the free-text fields that is not necessary for responding to your enquiry – in particular, special categories of personal data under Article 9 of the GDPR (e.g. health information, religious or philosophical beliefs, political opinions, trade union membership).

Processing period: 2 years after the enquiry has been closed, taking into account the enforcement of claims under the Ptk. If the enquiry results in a contractual relationship, the data will thereafter be processed in accordance with the privacy notice applicable to client relationships.

Follow-up relating to the matter: responding to an enquiry also includes the Controller contacting you again at a later stage in connection with the same matter – for example, by sending an offer for the service you asked about, providing information on its terms, or asking whether the need is still current. This processing is based on the Controller’s legitimate interest (Article 6(1)(f) GDPR) and does not require separate consent. You may object to this at any time and ask the Controller not to contact you in the future; in that case, the Controller will discontinue the contact.

This follow-up does not include adding you to a marketing list or sending you professional communications, news or offers of identical content addressed to a group of interested persons. Under Section 6. of the Grt., such advertising sent by electronic mail requires your prior, unambiguous and explicit consent, which you may give by ticking the optional checkbox referred to in Section Marketing communications. You may unsubscribe from such messages at any time with one click.

Right to object: where processing is based on legitimate interest, you may object to the processing at any time (see Section Your rights). The Controller will provide the result of the legitimate interest assessment upon request.

Marketing communications (optional)

If you give separate, voluntary consent for this in the form, the Controller may use the contact details you provide to send you business communications and offers concerning its products and services.

Processing period: until consent is withdrawn. Consent may be withdrawn at any time, without giving reasons and free of charge. Consequences of not providing the data: giving this consent is not a condition for receiving a response to your enquiry; we will respond even without such consent, but we will not send marketing communications.

Application for an advertised position

You may apply for vacancies advertised on the Open Positions page of the Website using the related application form.

Application handling process: incoming applications are recorded by the Controller in the system it uses to support recruitment. The system automatically acknowledges receipt of the application, records the application status and sends reminders to staff members involved in the selection process. The substantive evaluation of applications and all selection decisions are made by the Controller’s staff; no automated decision-making, profiling, or AI-based screening, scoring or ranking is carried out (see Section Automated decision-making, profiling and artificial intelligence).

Special categories of data: please do not include in your CV or free-text fields any special category personal data under Article 9 of the GDPR (e.g. health information, religious beliefs, political opinions), nor a photograph, information on marital status or the number of children, as these are not necessary for the selection process. If you nevertheless provide such data, the Controller will not take it into account during selection. If you submit additional documents that are not necessary for assessing the application, the unnecessary documents will be deleted immediately and will not be retained.

Retention of application materials after the selection process has closed: the Controller retains the application materials – including the CV, its contents and the completed form – for 12 months after the selection process is closed, even if the application was unsuccessful. The purpose is, on the one hand, to document the selection process and to defend against any legal claims that may arise in connection with the decision. The legal basis is the Controller’s legitimate interest under Article 6(1)(f) GDPR.

On the other hand, based on your consent, the Controller may also retain the application materials for 12 months after the selection process is closed so that it can contact you regarding positions that may become available later. The legal basis is your consent under Article 6(1)(a) GDPR.

Objection and erasure: you may object to this retention at any time without giving reasons and request erasure of your data at job@dmlab.hu. In such a case, the Controller will delete the data immediately. At the end of the 12-month retention period, the Controller automatically deletes the complete application materials without a separate request. Contact regarding positions that may become available later is based on your voluntary consent, which may be withdrawn at any time; however, withdrawal of consent does not affect processing carried out on the basis of the Controller’s legitimate interest under Article 6(1)(f) GDPR.

Storage of the CV: the uploaded CV is stored by the Controller on the hosting infrastructure serving the Website, in a manner not accessible to the public. At the end of the 12-month retention period, the file and the related registry entry are automatically deleted, and the Controller ensures that any copies created during the application process are also deleted.

Where an erasure request is fulfilled, the Controller retains only your e-mail address and the fact and date of the request, solely in order to demonstrate the request and to ensure that you are not contacted in the future; at the same time, all other data and documents, including your application materials, are deleted. The Controller bases this processing on Article 6(1)(c) and (f) GDPR and uses the data exclusively for this purpose.

Consequences of not providing the data: without the data, the application cannot be submitted or assessed.

If you do not consent to being contacted about positions that may become available later, we will not contact you for that purpose. The absence or withdrawal of consent does not affect the Controller’s processing based on any other legal basis and does not result in any adverse legal consequence for you.

Unsolicited application

If there is no advertised position suitable for you, or if you apply for a specific position by means of an unsolicited application, you may also send your application to job@dmlab.hu. In this case, the Controller processes the data you send (typically your name, e-mail address, CV and any additional information voluntarily provided in your message).

After receiving the application, the Controller sends an acknowledgement e-mail containing a link to this Notice and information on the retention period and on the possibility of objecting and requesting erasure.

If you would like us to inform you about positions that may become available later, you must give your consent via the link in the acknowledgement e-mail so that we may contact you. Without consent, we will not be able to contact you about future vacancies. If there is no advertised position suitable for you and you do not give consent via the link in the acknowledgement e-mail to being contacted regarding future vacancies, your submitted application will be automatically deleted within 7 working days of receipt. Processing period: 12 months from receipt of the application or, where you apply for a specific position by means of an unsolicited application, 12 months from the close of the selection process, in the same manner as described in Section Application for an advertised position. You may object to retention at any time and request erasure of your data at job@dmlab.hu; in such a case, the data will be deleted immediately. At the end of the 12-month period, the Controller will delete the data without a separate request.

Cookies

A cookie is a small data file that the Website places in your browser or on your terminal device. Cookies allow the Website to recognise returning visitors, remember their settings, and collect statistical data and – where consent is given – data for marketing purposes. Strictly necessary cookies do not require your consent; without them, the Website would not function properly. All other cookies – including statistical, functional and marketing cookies – are placed only on the basis of your prior, voluntary and unambiguous consent (your consent under Article 6(1)(a) GDPR), which you may provide through the cookie banner displayed on the Website. Consent may be withdrawn at any time and free of charge by changing the cookie settings; cookies may also be disabled or deleted in your browser settings, although this may limit the operation of certain functions of the Website.

A detailed list of the individual cookies – including their names, categories, purposes, lifetimes, and the providers behind them – is contained in the continuously updated cookie declaration available below, generated based on an automated scan by the consent-management solution used on the Website.

Automated decision-making, profiling and artificial intelligence

Within the scope of the processing covered by this Notice, the Controller does not carry out decision-making based solely on automated processing that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR, and it does not carry out profiling.

When handling job applications, the Controller does not use artificial intelligence- or machine learning-based solutions to analyse, screen, score or rank CVs. The automations used in the application process are purely administrative: sending acknowledgement and information e-mails, recording the application status and sending internal reminders. The substantive evaluation of applications and all selection decisions are always carried out by the Controller’s staff.

If, in the future, the Controller were to introduce an artificial intelligence-based solution for screening, scoring or ranking job applications, it could qualify as a high-risk application under Annex III to Regulation (EU) 2024/1689 (AI Act). In such a case, the Controller would amend this Notice in advance, provide specific information on the logic used, the significance of the processing and its expected consequences, and ensure the right to request human intervention.

Processors and recipients of personal data

The Controller uses processors to perform certain technical operations. The processors do not make independent decisions; they act solely on the Controller’s instructions, and the Controller has concluded data processing agreements with them in accordance with Article 28 GDPR.

Apart from the above, the Controller discloses personal data to third parties only in the cases and to the extent required by law – in particular, in response to requests from courts, public prosecutors, investigative authorities, minor-offence or administrative authorities, or the Hungarian National Authority for Data Protection and Freedom of Information. The Controller discloses to such authorities only the personal data that is strictly necessary to fulfil the purpose of the request.

Transfers to third countries

The Controller seeks to process personal data within the European Economic Area (EEA). Where the use of certain service providers results in data being transferred outside the EEA, the Controller ensures that the transfer takes place subject to safeguards compliant with Chapter V of the GDPR, in particular:

• on the basis of an adequacy decision of the European Commission – including, with respect to the United States of America, service providers certified under the EU–US Data Privacy Framework;
• by using the Standard Contractual Clauses (SCCs) adopted by the European Commission, supplemented where necessary by additional technical and organisational measures.

Of the service providers listed in Section Processors and recipients of personal data, transfers outside the EEA take place in the case of Intuit Inc. (Mailchimp) and Zapier Inc., which are established in the United States. In the case of Microsoft, Google and Meta, the contractual partner is a company established in the European Union; however, further transfers outside the EEA may occur within the subprocessor chain.

Data security

In accordance with Article 32 GDPR, the Controller implements all technical and organisational measures necessary to ensure a level of security appropriate to the risk of the personal data processed, including protection against unauthorised access, alteration, transmission, disclosure, erasure or destruction, and against accidental loss or damage.

In the course of processing, the Controller ensures:

• confidentiality: information may be accessed only by authorised persons; * integrity: the accuracy and completeness of the information and the processing methods;
• availability: authorised users can access the data when necessary.

In particular, the Controller applies the following measures:

• Access restriction: access to systems containing personal data – including the Website’s administration interface – is limited to staff members who need such access to perform their duties, and only to the minimum scope of permissions necessary.
• Encrypted data transmission: data traffic between the Website and the systems used by the Controller is always transmitted over encrypted channels (HTTPS/TLS).
• Two-factor authentication: the Controller uses two-factor authentication for every system that supports it.
• Password management: passwords are generated, stored and shared among staff exclusively through a central password-management system.
• Logging: the systems used by the Controller log access to personal data and significant system events; log data are available for retrospective verification.
• Backups: the Controller makes regular backups. * Confidentiality: the Controller enters into confidentiality undertakings with its staff and the subcontractors it engages. * Training: the Controller’s staff receive regular data protection training, which also covers the rules for processing personal data and the responsible use of artificial intelligence-based tools.
• Incident management: the Controller has a documented internal procedure for identifying, investigating, recording and reporting personal data breaches.

Your rights

Under the GDPR, you may exercise the rights set out below. You can exercise your rights by sending a request to info@dmlab.hu or to the Controller’s postal address.

Right of access (Article 15 GDPR)

You may request information as to whether the Controller processes your personal data and, if so, which data, for what purposes, on what legal basis, from what source, for how long and to whom it is disclosed, and you may request a copy of the personal data being processed. The Controller provides the first copy free of charge.

Right to rectification and completion (Article 16 GDPR)

You may request the rectification of inaccurate personal data and the completion of incomplete data.

Right to erasure (“right to be forgotten”) (Article 17 GDPR)

You may request the erasure of your personal data where the data is no longer necessary for the purpose of processing, where you have withdrawn your consent and there is no other legal basis for processing, where you have objected to processing based on legitimate interest and there are no overriding legitimate grounds, or where the data has been unlawfully processed. Erasure may not be requested to the extent that processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims.

Right to restriction of processing (Article 18 GDPR)

You may request restriction of processing if you contest the accuracy of the data, if the processing is unlawful but you oppose erasure, if the Controller no longer needs the data but you require it for the establishment, exercise or defence of legal claims, or if you have objected to processing and the balancing assessment is pending.

Right to object (Article 21 GDPR)

You may object at any time to processing based on legitimate interest. Where personal data is processed for direct marketing purposes, you may object at any time and without restriction, and in such a case your data may no longer be processed for that purpose.

Right to data portability (Article 20 GDPR)

Where processing is based on consent or a contract and is carried out by automated means, you may request to receive the data you have provided in a structured, commonly used and machine-readable format (e.g. CSV, JSON, XML), and – where technically feasible – to have the Controller transmit those data directly to another controller.

Right to withdraw consent (Article 7(3) GDPR)

Where processing is based on your consent, you may withdraw it at any time without giving reasons. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Exercise of rights relating to a deceased person

Under Section 25 of the Infotv., within five years following the death of a data subject, the rights that the deceased was entitled to exercise during their lifetime may be exercised by a person authorised by the deceased or, in the absence of such a declaration, by a close relative within the meaning of the Ptk., subject to the evidence required by law.

Procedure for handling requests

The Controller will inform you of the action taken on your request within one month of receipt. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests; the Controller will inform you of such extension within one month of receipt of the request, together with the reasons for the delay.

In order to fulfil a request, the Controller must verify that the request was submitted by the entitled data subject and may therefore request additional information necessary to confirm identity. If a request is manifestly unfounded or excessive – in particular because of its repetitive character – the Controller may charge a reasonable fee or refuse to act on the request; the burden of demonstrating this rests with the Controller.

The Controller informs each recipient to whom the personal data has been disclosed of any rectification, erasure or restriction carried out, unless this proves impossible or involves disproportionate effort.

Personal data breach

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data processed.

The Controller keeps a record of personal data breaches. If a breach is likely to result in a risk to the rights and freedoms of natural persons, the Controller will notify the Hungarian National Authority for Data Protection and Freedom of Information without undue delay and, where feasible, no later than 72 hours after becoming aware of it. If the breach is likely to result in a high risk, the Controller will also inform the affected data subjects directly.

Remedies

If you believe that the Controller has infringed your rights relating to the protection of personal data, please contact us directly as a first step – we aim to resolve any issues quickly and fairly. In addition, you may lodge a complaint with the supervisory authority or bring proceedings before a court:

• Hungarian National Authority for Data Protection and Freedom of Information (NAIH) – registered office: 1055 Budapest, Falk Miksa utca 9–11, Hungary; postal address: 1363 Budapest, PO Box 9, Hungary; telephone: +36 (1) 391-1400; e-mail: ugyfelszolgalat@naih.hu; website: www.naih.hu
• Court – proceedings may be brought before the court having jurisdiction over the Controller’s registered office or, at your choice, before the court having jurisdiction over your place of residence or stay. Contact details for the courts are available at birosag.hu.

Under Article 82 GDPR, if you have suffered material or non-material damage as a result of an infringement of the Regulation, you are entitled to compensation from the Controller or the processor.

Amendments to this Notice and language versions

The Controller reserves the right to amend this Notice unilaterally, in particular in the event of changes in legislation, supervisory practice or processing operations. The version of the Notice in force from time to time is available on the Website. If an amendment materially affects your rights, the Controller will provide prior notice of the amendment on the Website or – where contact details are processed on the basis of consent – by e-mail.

This Notice is available in Hungarian and English. In the event of any discrepancy, the Hungarian-language version shall prevail.

Effective date of this Notice: 11th September 2026. Version: v1.0.