PRIVACY NOTICE
on the processing of personal data in connection with the electromobility service of Smart Digital Kft.
Effective from 1 January 2026 until withdrawn or replaced.
This Privacy Notice provides information to customers and users of the electromobility service operated by Smart Digital Kft. in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, "GDPR") and the applicable Hungarian data protection legislation. By using the Service, the data subject becomes involved in the processing operations described in this Privacy Notice.
1. Controller
For the processing activities covered by this Privacy Notice, the controller is:
| Company name | Smart Digital Korlátolt Felelősségű Társaság ("Smart Digital Kft." or "Smart Digital") |
|---|---|
| Registered seat | 5350 Tiszafüred, Örvényi út 19., Hungary |
| Website | www.smartdigital.eu |
| General e-mail address | info@smartdigital.hu |
| Privacy / data subject requests | info@smartdigital.eu |
| Central telephone number | +36 1 447 7585 |
2. Data Protection Officer
Smart Digital Kft. has assessed whether it is required to appoint a data protection officer under Article 37 of the GDPR. Based on this assessment, Smart Digital Kft. has concluded that its activities do not constitute processing operations that would make the appointment of a data protection officer mandatory. Accordingly, Smart Digital Kft. has not appointed a data protection officer.
3. General rules of data processing
Smart Digital Kft., as an electromobility operator and service provider, processes personal data in accordance with this Privacy Notice.
The material scope of this Privacy Notice covers all processing operations carried out by Smart Digital Kft. using data collected through the Mobile Application and the Website, where such operations involve personal data within the meaning of Article 4(1) of the GDPR.
"Personal data" means any information relating to an identified or identifiable natural person ("data subject"). An identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to that person's physical, physiological, genetic, mental, economic, cultural or social identity.
The terms used in this Privacy Notice have the meanings set out in Article 4 of the GDPR and, where applicable, in the General Terms and Conditions ("GTC") of Smart Digital.
Smart Digital Kft. processes personal data only in accordance with applicable laws and only where a valid legal basis under Article 6 of the GDPR applies. Personal data retain their character as personal data for as long as the data subject can be identified, directly or indirectly, from the data.
Smart Digital conducts processing in a manner that is appropriate, relevant and limited to the purposes for which the data are processed. Through this Privacy Notice, Smart Digital informs data subjects of the purposes and legal bases of processing and of the information required under Articles 13 and 14 of the GDPR.
Smart Digital uses organisational, physical, IT and access-management measures to protect personal data against unauthorised access. Employees and persons acting under the authority of Smart Digital are required to keep confidential any personal data that come to their knowledge in the course of processing.
Smart Digital does not carry out automated decision-making or profiling in connection with the data processed for the Service. Smart Digital applies appropriate technical and organisational measures, including in particular and to the extent applicable to the relevant system:
encrypted data transmission (HTTPS);
access control;
logging;
backup procedures.
4. Exercise of data subject rights
Under the GDPR, after verifying the data subject's identity where necessary, Smart Digital ensures the exercise of the following rights:
the right to receive information about the processing of personal data (Articles 13 and 14 GDPR);
the right of access to personal data (Article 15 GDPR);
the right to rectification of inaccurate personal data (Article 16 GDPR);
the right to withdraw consent where processing is based on consent (Article 7 GDPR);
the right to erasure where the conditions of Article 17 GDPR are met;
the right to restriction of processing under Article 18 GDPR;
the right to data portability under Article 20 GDPR;
the right to object, on grounds relating to the data subject's particular situation, to processing based on Article 6(1)(f) GDPR.
4.1. Right to information and access
The data subject may request information about the processing of his or her personal data and may request access to such data. In such case Smart Digital will inform the data subject whether it processes personal data concerning him or her and, if so, will provide information on the purpose and legal basis of processing, the categories of data processed and the main rules governing the processing as set out in this Privacy Notice. Upon request, Smart Digital may provide a copy of the personal data being processed.
Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, Smart Digital may, taking into account the administrative costs of providing the requested information or taking the requested action:
a) charge a reasonable fee
b) refuse to act on the request
Smart Digital bears the burden of demonstrating that a request is manifestly unfounded or excessive.
4.2. Right to rectification
The data subject may request the rectification of inaccurate personal data concerning him or her and the completion of incomplete personal data.
4.3. Right to erasure
The data subject may request the erasure of personal data, meaning the irreversible removal or anonymisation of the data in such a way that restoration is no longer possible. A request for erasure may be granted where one of the following grounds applies:
a) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed
b) the data subject withdraws the consent on which the processing is based and there is no other legal basis for the processing
c) the data subject objects to the processing and there are no overriding legitimate grounds for the processing, or the data subject objects to processing for direct marketing purposes
d) the personal data have been processed unlawfully
e) the personal data must be erased for compliance with a legal obligation under Union or Member State law applicable to Smart Digital
f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1) GDPR
Consent may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
Erasure cannot be carried out where processing is necessary for the establishment, exercise or defence of legal claims by Smart Digital Kft. or where retention is required by law.
4.4. Right to restriction of processing
At the request of the data subject, Smart Digital restricts processing where one of the following conditions is met:
a) the data subject contests the accuracy of the personal data, in which case restriction applies for the period enabling Smart Digital to verify the accuracy of the data
b) the processing is unlawful and the data subject opposes erasure and requests the restriction of use instead
c) Smart Digital no longer needs the personal data for the purposes of processing, but the data subject requires them for the establishment, exercise or defence of legal claims
Where processing has been restricted, such personal data may, except for storage, be processed only with the data subject's consent, or for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State.
Smart Digital will inform the data subject before the restriction of processing is lifted, in accordance with applicable rules.
Restriction may also be applied regardless of a specific request, in particular where:
a) the supervisory authority, the Hungarian National Authority for Data Protection and Freedom of Information, orders the restriction
b) Smart Digital is required by a competent authority or court to restrict processing
c) Smart Digital considers that erasure would adversely affect the legitimate interests of the data subject or of a third party, including where retention of the data as evidence is necessary until the completion of an investigation or procedure
4.5. Personal data breaches and data transfers
In the event of a personal data breach, Smart Digital provides information at the request of the data subject on the circumstances and effects of the breach and on the measures taken to address it, subject to the applicable statutory rules.
Where personal data are transferred, Smart Digital provides information, upon request and except where an exemption under law applies, on the legal basis and recipient of the transfer.
4.6. Submission and handling of requests
Smart Digital aims to provide information in a concise, transparent, intelligible and easily accessible form, using clear and plain language, while complying with the requirements of the GDPR.
Requests should primarily be submitted in writing to info@smartdigital.eu. Where the data subject requests oral information, Smart Digital may provide such information orally after verification of the data subject's identity, provided that the information required for the response is available to the authorised employee. In all other cases, the request will be recorded and Smart Digital will inform the data subject of the measures taken within one month of receipt of the request.
This period may be extended by up to two further months where necessary, taking into account the complexity and number of requests. Smart Digital will inform the data subject of any such extension within one month of receipt of the request, where possible by electronic means.
4.7. Remedies
If Smart Digital does not act on a request, or if the data subject does not accept the measure taken by Smart Digital, the data subject may seek a remedy against Smart Digital.
The data subject may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, "NAIH") or may bring an action before the competent court of the data subject's place of residence or habitual residence.
| Authority | Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) |
|---|---|
| Address | 1055 Budapest, Falk Miksa u. 9-11., Hungary |
| Postal address | 1363 Budapest, Pf. 9., Hungary |
| Telephone | +36 (1) 391-1400 |
| ugyfelszolgalat@naih.hu | |
| Website | www.naih.hu |
Smart Digital notes that, according to the practice of the NAIH, complaints are generally admitted where the data subject has first contacted the controller, in this case Smart Digital, and the controller has failed to act on the request or the data subject does not accept the measure taken. For this reason, Smart Digital recommends that data subjects first contact Smart Digital directly.
5. Common rules applicable to the processing
Providing personal data is a condition for concluding and performing the contract, except for data that are expressly indicated as optional. Without the mandatory data, the Service cannot be used.
Smart Digital Kft. engages processors in the processing and, as a general rule, does not disclose personal data to third parties except where required by law or as set out in this Privacy Notice.
Smart Digital draws attention to the fact that the disclosure of personal data to courts or authorities may be required by law. If a court or authority requires Smart Digital to disclose personal data in the course of a statutory procedure, Smart Digital is obliged to comply with its legal obligation and provide the requested data to the competent court or authority.
The data subject has the rights and remedies set out in Section 4 in relation to all processing activities described in this Privacy Notice.
5.1. Key legislation
The main legislation governing the processing described in this Privacy Notice includes:
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, GDPR);
Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information ("Info Act");
Act CVIII of 2001 on certain aspects of electronic commerce services and information society services;
Act XLVIII of 2008 on the basic requirements and certain restrictions of commercial advertising activities.
6. Specific processing operations related to the Service
Smart Digital's electromobility services may be used through the Mobile Application and the Website as defined in the GTC.
6.1. Processing related to the Mobile Application
Smart Digital Kft. carries out several separate processing activities for the operation of the Mobile Application and for providing the Service through it. The main features of these processing operations are described below in accordance with Article 13 of the GDPR.
6.1.1. User registration and account management
| Purpose of processing | Creating the user account required for using the Mobile Application; enabling identification; managing user authorisations; ensuring the secure operation of the application; handling errors; system monitoring; and preventing abuse. |
|---|---|
| Legal basis | Article 6(1)(b) GDPR: processing is necessary for the performance of a contract to which the data subject is party. |
| Categories of personal data | Identification data (name, password); contact details (e-mail address, telephone number); billing data (residential/billing address; in the case of legal entities, company name, registered seat and tax number). |
| Retention period | Personal data processed for user registration and account management are processed for as long as the user account exists. After deletion of the account, Smart Digital may store the personal data in a restricted manner for the period necessary for the establishment, exercise or defence of legal claims, but no longer than the civil-law limitation period, currently five years. Thereafter, the personal data are erased or anonymised. Where statutory retention is required, for example accounting obligations, Smart Digital retains the relevant data for the period prescribed by law, currently eight years. |
6.1.2. Provision of the electromobility service
| Purpose of processing | Providing the Service, carrying out the charging process, measuring consumption and settlement. The Mobile Application may be used after user registration. By registering, the data subject accepts the GTC published in the Mobile Application, as a result of which a contract is concluded between Smart Digital Kft., as operator of the Mobile Application, and the user. |
|---|---|
| Legal basis | Article 6(1)(b) GDPR: processing is necessary for the performance of a contract to which the data subject is party. For data provided optionally at the decision of the data subject, the legal basis is the data subject's prior, voluntary consent under Article 6(1)(a) GDPR. |
| Categories of personal data | Identification data; charging data (time, location and amount of energy consumed); transaction data; payment-card related data where applicable and only to the extent necessary for payment, with payment processing carried out through the independent payment service provider. |
| Retention period | Personal data processed for providing the Service are processed during the term of the contract and, thereafter, may be stored in a restricted manner for the period necessary for the establishment, exercise or defence of legal claims, but no longer than the civil-law limitation period, currently five years. Thereafter, the personal data are erased or anonymised. Accounting records related to charging transactions, including transaction data, voucher/invoice-related data, user identifiers and other data connected with the economic event, are retained for the statutory period, currently eight years, on the basis of Section 169 of Act C of 2000 on Accounting. |
6.1.3. Processing related to the secure operation of the Mobile Application
| Purpose of processing | Ensuring the secure operation of the Mobile Application; handling errors; system monitoring; and preventing abuse. |
|---|---|
| Legal basis | Article 6(1)(f) GDPR: the legitimate interest of Smart Digital Kft. in ensuring the secure and continuous operation of the Mobile Application and in preventing abuse. |
| Categories of personal data | Data relating to the device and application version; log and event data; network and device identifiers; session identifiers; and other technical information necessary for system operation and error identification. |
| Retention period | Log and technical data processed for ensuring the secure operation of the system are retained for no longer than three months. Where the use of log data is necessary for investigating a security incident or for the establishment, exercise or defence of legal claims, Smart Digital processes the relevant data until the relevant procedure is closed, but no longer than until the end of the applicable limitation period. After expiry of the retention period, log data are erased or anonymised. |
6.1.4. Electronic marketing communications
| Purpose of processing | Informing data subjects about discounts, promotions and other offers related to Smart Digital's electromobility services. |
|---|---|
| Legal basis | The data subject's consent under Article 6(1)(a) GDPR and Section 6 of Act XLVIII of 2008 on commercial advertising. For existing customers, Smart Digital may use the customer's e-mail address to send offers concerning its own similar services, provided that the customer did not object at the time of collection and that the possibility to unsubscribe is ensured in each communication. |
| Categories of personal data | E-mail address; name. |
| Retention period | Personal data are processed until withdrawal of consent or unsubscribing. |
6.2. Processing related to the Website
Smart Digital Kft. carries out several separate processing activities for the operation of the Website and for providing the Service through it. The main features of these processing operations are described below in accordance with Articles 13 and 14 of the GDPR.
6.2.1. Provision of the electromobility service
| Purpose of processing | Providing the Service, carrying out the charging process, measuring consumption and settlement. The Website may be used without registration of a user account. By accepting the GTC for ad hoc charging published on the Website, a contract is concluded between Smart Digital Kft., as operator of the Website, and the user. |
|---|---|
| Legal basis | Article 6(1)(b) GDPR: processing is necessary for the performance of a contract to which the data subject is party. |
| Categories of personal data | Identification data; charging data (time, location and amount of energy consumed); transaction data. |
| Retention period | Personal data processed for providing the Service are processed during the term of the contract and, thereafter, may be stored in a restricted manner for the period necessary for the establishment, exercise or defence of legal claims, but no longer than the civil-law limitation period, currently five years. Thereafter, the personal data are erased or anonymised. Accounting records related to charging transactions, including transaction data, voucher/invoice-related data, user identifiers and other data connected with the economic event, are retained for the statutory period, currently eight years, on the basis of Section 169 of Act C of 2000 on Accounting. |
6.2.2. Processing related to the secure operation of the Website
| Purpose of processing | Ensuring the secure operation of the Website; handling errors; system monitoring; and preventing abuse. |
|---|---|
| Legal basis | Article 6(1)(f) GDPR: the legitimate interest of Smart Digital Kft. in ensuring the secure and continuous operation of the Website and in preventing abuse. |
| Categories of personal data | Data relating to the device and application/browser version; log and event data; network and device identifiers; session identifiers; and other technical information necessary for system operation and error identification. |
| Retention period | Log and technical data processed for ensuring the secure operation of the Website are retained for no longer than three months. Where the use of log data is necessary for investigating a security incident or for the establishment, exercise or defence of legal claims, Smart Digital processes the relevant data until the relevant procedure is closed, but no longer than until the end of the applicable limitation period. After expiry of the retention period, log data are erased or anonymised. |
6.2.3. Cookie processing
Smart Digital uses cookies on the Website to ensure the proper functioning of the Website, improve the user experience, and for statistical and marketing purposes.
Cookies are small data files placed on the user's device that enable the Website to store and recognise certain information.
The Website may use the following types of cookies:
Strictly necessary cookies: these cookies are essential for providing the basic functions of the Website and do not require the user's consent.
Statistical cookies: these cookies are used to analyse Website usage and help the Controller improve the Service.
Marketing cookies: these cookies are used to display content and advertisements tailored to the user's interests.
Cookies that are not strictly necessary for the operation of the Website, in particular statistical and marketing cookies, are used only on the basis of the user's prior, voluntary and express consent.
On the first visit to the Website, the user receives detailed information about the use of cookies through the cookie management interface (cookie banner) and may consent to or refuse the use of cookies that are not strictly necessary.
The user may withdraw or modify consent at any time through the cookie settings available on the Website.
The lifetime of cookies varies depending on their type. Smart Digital provides detailed information about cookie lifetimes through the cookie management interface.
6.2.4. How to control and disable cookies
All modern browsers allow users to change cookie settings. Most browsers automatically accept cookies by default; however, these settings can usually be changed so that the browser prevents automatic acceptance and offers the choice each time whether to allow cookies.
7. Processors and recipients
7.1. Processors
Smart Digital uses processors in the provision of the Service. These processors process personal data on behalf of Smart Digital and in accordance with its documented instructions, pursuant to Article 28 of the GDPR.
| Microsoft Ireland Operations Ltd. (Microsoft Azure) | Cloud infrastructure and hosting provider. Task: providing server and hosting services necessary for operating systems containing personal data. |
|---|---|
| Smart Charging Korlátolt Felelősségű Társaság (3200 Gyöngyös, Rigó utca 7., Hungary) | Operator of the Mobile Application and Website and developer of the Mobile Application. Task: operation and maintenance of the Mobile Application and Website, development of the Mobile Application, and related technical IT support. |
| Billingo Technologies Zártkörűen Működő Részvénytársaság (1133 Budapest, Árbóc utca 6., Hungary) | Billing service provider. Task: carrying out billing processes and related administration on behalf of Smart Digital. |
Processors process personal data only on the basis of Smart Digital's documented instructions, do not make independent decisions regarding the processing, and ensure the protection of personal data through appropriate technical and organisational measures.
Smart Digital ensures that its contracts with processors meet the requirements of Article 28 of the GDPR.
7.2. Recipient / independent controller for online payments
| OTP SimplePay Zártkörűen Működő Részvénytársaság | Registered seat: 1138 Budapest, Váci út 135-139., Building B, 5th floor, Hungary. Online payments made through the Mobile Application and the Website are carried out on the payment service provider's website or payment interface. In respect of data provided on the payment service provider's side, the operator of SimplePay acts independently as a controller, and Smart Digital does not have access to full payment-card data. |
|---|
By accepting the GTC, the data subject acknowledges that certain personal data collected and processed by Smart Digital in connection with the Service, in particular identification data and e-mail address, may be transmitted to OTP SimplePay Zrt. as an independent controller to the extent necessary for payment processing.
8. Information on transfers to third countries
In operating the Mobile Application and the Website, Smart Digital may use processors and sub-processors whose registered seat or data-processing infrastructure is located in the United States of America. As a result, certain personal data may be transferred to a third country.
Such transfers may take place on the basis of an adequacy decision of the European Commission. At present, the EU-U.S. Data Privacy Framework provides a legal basis for transfers of personal data from the European Union to organisations in the United States that are certified under the framework.
Where a given service provider is not certified under the EU-U.S. Data Privacy Framework, the transfer may take place only subject to appropriate safeguards under Article 46 of the GDPR, such as standard contractual clauses, and any additional measures required by applicable law.
9. Amendments to this Privacy Notice
Smart Digital reserves the right to amend this Privacy Notice unilaterally, in particular where changes in legislation concerning the Service or data processing, or positions, decisions or recommendations issued by the Hungarian National Authority for Data Protection and Freedom of Information in order to promote lawful data processing practices, make such amendment necessary.
In the event of an amendment to this Privacy Notice, Smart Digital will ensure that data subjects are informed before the amendment enters into force, where required by applicable law.
Budapest, 2026
Smart Digital Kft.