1.2. Areas affected by data processing:
– websites: www.bubbles.hu and www.my.bubbles.hu
– Bubbles laundry mobile application developed for Android and IOS operating systems
– Payment machines operating in Bubbles self-service laundry chain stores

free movement of such data, and repealing Directive 95/46/EC (GDPR, General Data
Protection Regulation)
– Act CXII of 2011 on the right to self-determination in relation to information and freedom of
information
Act on the right to informational self-determination and freedom of information (Infotv.),
– Act CVIII of 2001 on certain issues of electronic commerce services and information society
services (Ekertv.),
Act LXXXVII of 2011 on the processing of personal data
– Act CXIX of 1995 on the processing of name and address data for research and direct
marketing purposes
Act CXIX of 1995 on the processing of name and address data for research and direct
marketing purposes (DMtv.),
Act LXXXVII of 2008 on the fundamental conditions and certain restrictions of economic
advertising a
– and Act XLVIII of 2008 on the basic conditions and certain restrictions of economic advertising
activities (Grt.)
– and Act XLVIII of 2008 on the basic conditions and certain restrictions of economic
advertising ac
.
2.2. The scope of this information notice applies to the use of the interfaces listed above that
are involved in data processing and to the data processing carried out during the use of the
services made available there.
2.3. For the purposes of this notice, a User is defined as a natural person who browses the
interfaces involved in data processing and/or downloads interfaces and/or accesses
interfaces, regardless of which services they use or do not use on the interfaces concerned.

Legal basis for data processing: the consent of the data subject
3.1. The legal basis for data processing by the Data Controller is Article 6(1)(a) of the GDPR
and Section 5(1)(b) of Act CXII of 2011 on the right to self-determination and freedom of
information (hereinafter: Infotv.). Section 5 (1) (b) of the Act on the Right of Informational Self-
Determination and Freedom of Information (hereinafter: Infotv.).
3.2. The User gives their consent by ticking the box in front of the data processing statement.

Data processing without the further separate consent of the data subject or after the withdrawal of consent
4.1. Data collected with the consent of the data subject may be processed without the data
subject’s 
4.1. Data collected with the consent of the User concerned may be processed by the Data
Controller without the further separate consent of the User concerned or after the withdrawal
of consent, in accordance with Section 6(5) of the Infotv.
4.2. If the personal data was recorded with the consent of the User concerned, the Data
Controller may process the recorded data without the further separate consent of the User
concerned at and after the withdrawal of the consent of the User concerned, in the absence
of any provision to the contrary in the law, in the following cases:
– for the purpose of complying with a legal obligation applicable to the Data Controller, or
– for the purpose of enforcing the legitimate interests of the Data Controller or a third party, if
the enforcement of such interests is proportionate to the restriction of the right to the
protection of personal data.
4.3. Before commencing data processing based on the above legitimate interest,
the Data Controller shall in all cases perform a mandatory balancing test. The
balancing test is a three-step process in which the Data Controller identifies its
legitimate interest, as well as the countervailing interest of the User concerned and
their fundamental right affected by the planned data processing. Finally, based on the
weighting, the Data Controller determines whether the personal data can be processed
in accordance with Section 6(5) of the Infotv.
4.4. The Data Controller shall inform the User concerned of the outcome of the
balancing test in such a way that the User can clearly determine on the basis of the
information provided on what legitimate interest and why it can be considered a
proportionate restriction for the Data Controller to process their personal data without
their consent.
4. 5. When performing the balancing test, the Data Controller shall act in accordance with the
relevant findings of the European Union Council’s Data Protection Working Party contained in
Opinion 6/2014. The Opinion can be read at the following link:
http://ec.europa.eu/justice/data-protection/article-29/documentation/opinionrecommendation/files/2014/wp217_hu.pdf#h2-2

Other possible legal bases for data processing based on legislation
The legal basis for data processing is also mandatory data processing in accordance with
Section
5. 1. The legal basis for data processing is also mandatory data processing pursuant to
Section 5(1)(b) of the Infotv. in relevant cases. In certain cases, the Data Controller may be required to perform mandatory data processing as prescribed by law or other legislation. In addition, the Data Controller is obliged to comply with any requests from authorities, which
may also involve the processing and transfer of personal data, which is also an obligation
imposed on the Data Controller by law.
5.2. Pursuant to Article 6(1)(f) of the GDPR, we also inform you that the Data Controller may
process the
may process the User’s personal data if the processing is necessary for the purposes of the
legitimate interests pursued by the Data Controller or a third party, except where such interests
are overridden by the interests or fundamental rights and freedoms of the User which require
protection of personal data, in particular where the data subject is a child.
Before commencing data processing on the basis of the above legitimate interest, the Data
Controller shall in all cases carry out a mandatory balancing test in accordance with sections 4.3 to 4.5 of this policy.
5.3. The Data Controller’s service qualifies as an “other commercial service” within the
meaning of the Ektv. The Data Controller may process the natural identification data and address necessary for the
identification of the user (User), as well as data relating to the date, duration and place of use
of the service, for the purpose of monitoring the performance of its service, invoicing the fees
arising therefrom and enforcing the related claims.
The Data Controller may process personal data that is technically necessary for the provision
of the service. If other conditions are the same, the Data Controller shall select and, in all
cases, operate the tools used in the provision of the service in such a way that personal data
are only processed if this is absolutely necessary for the provision of the service and the
fulfilment of other purposes specified in this Act, but even in this case only to the extent and
for the period necessary. (Further rules on technically necessary data processing are set out
in the document entitled “Information “Cookies” and Chapter 6 of this notice.
The data controller may process data related to the use of the service for any purpose other
than those specified above, in particular to increase the efficiency of its services, to send
electronic advertisements or other targeted content to the user, for market research purposes
– only after the purpose of data processing has been determined in advance and with the
consent of the user.

Data processing related to ensuring the operation of information technology services
6.1. Scope of data subjects: The websites www.bubbles.hu and www.my.bubbles.hu, as well
as the Bubbles
6.1. Data subjects: All users visiting the www.bubbles.hu and www.my.bubbles.hu websites
and the Bubbles laundry mobile application developed for the iOS and Android operating
systems, regardless of whether they use the services available on the given interface.
6.2. Legal basis for data processing: the User’s consent pursuant to Article 6(1)(a) of the GDPR
and Section 5(1)(a) of the Infotv. By accepting the pop-up information and statement when
starting to browse the website, or by continuing to browse, the User gives their voluntary
consent to data processing. Otherwise, the Data Controller may restrict the use of the given
website or application in whole or in part until the relevant statements are accepted.
6.3. Determination of the scope of data processed: Information technology data processing
concerns the scope of data necessary for the operation of cookies used to operate the website
and the use of log files applied by the web hosting provider.
Data processed to enable user-friendly browsing:
– web pages visited during the visit to the website and the order in which they were opened
the IP address of the device used by the user.
– IP address of the device used by the user.
The scope of data processed for measuring website traffic:
– the web pages visited during your visit to the website and the order in which they were opened
– the frequency with which individual pages on the website are viewed
– which other website the User came to this website from (only in the case of websites that
have a link to this website)
– determination of the geographical location of the User visiting the website (based on the data
provided by the internet service provider, only approximate data regarding the location of the
device used for browsing)
– the time when browsing of the website began
– the time of leaving the website (end of browsing)
– the duration of browsing the website.
Data processed for the purpose of verifying access rights to the website:
– username password, for older users, monogram and PIN code (may be stored at the user’s
discretion)
– User e-mail address
– IP address of the device used by the user.

6.4. Purpose of data processing: The use of cookies and log files is necessary for the user-friendly and secure operation of the website. The purpose of data processing using these is to ensure the user-friendly operation of the website for the User concerned and to collect
anonymous data on the use of the website. 
Within this:
– Identification of the device used by the User for browsing, recording of identification
data for the duration of browsing: based on the IP address. This makes browsing smoother,
as without it, the User would have to identify themselves on each page visited or repeat
processes.
The data required for the following purposes is recorded anonymously and cannot be linked to
a specific person:
– Measuring website traffic, measuring the frequency of visits to individual pages of the
website, and measuring the browsing time of individual pages of the website in order to enable
the Data Controller to tailor the website to the needs of Users as much as possible.
– Determining the location of the User (the device used for browsing), mapping the level
of interest in the Data Controller’s services by region.
– Identifying the website from which the User arrived at this website in order to learn
about other topics of interest to Users interested in the Data Controller’s services and to
measure the effectiveness of the Data Controller’s promotional activities.
The Data Controller’s IT system uses Google Analytics (Alphabet Inc.) tools to measure this
data. When viewing pages that use Google Analytics tools, Google cookies record the
preferences and information specified by the user, which also means that anonymous data
processed for the purpose of measuring website traffic and mapping browsing habits is
collected.

6.5. The above anonymous data is also accessed by Alphabet Inc. (1600 Amphitheatre Parkway,
Mountain View, CA 94043, USA), the owner and operator of Google Analytics tools. Alphabet Inc. uses the above
data not only to perform the aforementioned analyses, but also to deliver targeted
advertisements to browser users. In doing so, Alphabet Inc. determines the interests that can
be inferred from the browsing habits of the device in question by linking the anonymous data
to the IP address of the device used for browsing, and then delivers targeted advertisements
to that device. Alphabet Inc. does not have access to any data other than the anonymous data
described in this section. Cookies that facilitate visiting the data controller’s Facebook page and sharing and liking this
website on the social networking site (Facebook button, Facebook share button, Facebook like
button) are provided by Meta Platforms Inc. Therefore, Meta Platforms Inc. (1601 Willow Road,
Menlo Park, CA 94025, USA) also has access to the anonymous data processed by these cookies.
Cookies that facilitate visits to the Data Controller’s Instagram social media page (Instagram
button) are provided by Instagram LLC. Therefore, Instagram LLC. (1 Hacker Way, Menlo Park,
CA 94025, USA) also has access to the anonymous data processed by these cookies.
Instagram LLC. is owned by Meta Platforms Inc., and the Instagram service is operated by
Meta Platforms Inc., so data processing during the use of the service is carried out jointly by
Meta Platforms Inc. and Instagram LLC.
Through these services, Meta Platforms Inc. and Instagram LLC. therefore have access to the
anonymous data described above, which is used to measure website traffic and map browsing
habits. Meta Platforms Inc. and Instagram LLC. use the above data not only to perform the
aforementioned analyses, but also to deliver targeted advertisements to browser users. In
doing so, Meta Platforms Inc. and Instagram LLC. determine the interests that can be identified
based on the browsing habits of the device in question by linking the anonymous data to the
IP address of the device used for browsing, and then deliver targeted advertisements to that
device. Meta Platforms Inc. and Instagram LLC. do not have access to any data other than the
anonymous data described in this section.
Data assigned to the following purposes is recorded in a manner that can be linked to the
user’s identity, but only the Data Controller has access to it:
– storage of username and password for easier access (at the User’s discretion)
– verification of the User’s access rights (username, email address, password).

Data necessary to ensure the user-friendly operation of the website (IP address, sequence of
pages visited on the website during browsing) are recorded for the duration of the browsing
session (i.e. for the duration of browsing the website) and are deleted upon completion. Such
data is processed by the Data Controller’s IT system using its own tools and is not accessible
to third parties, except in the case of IT data processing
(see below in the section entitled “Use of data processors”).
The data necessary for checking access rights and ensuring usage rights are recorded for the
duration of the browsing session (i.e. for the duration of browsing the website) and are deleted
upon completion. Such data is processed by the Data Controller’s IT system using its own tools
and is not accessible to third parties, except in the case of IT data processing (see below in
the section entitled “Use of data processors”).
The username and password may be stored permanently at the User’s discretion, stored in
cookies recorded on the User’s device, and the User may delete them in their browser settings,
thus controlling the data storage period.
The data used to measure traffic and map website usage habits is recorded anonymously by
the Data Controller’s IT system from the outset and cannot be linked to any individual. The
Data Controller’s IT system uses Google Analytics tools to measure this data. The Data
Controller stores this data permanently, but for a maximum of 2 years, using cookies that are
stored on the device used by the User for browsing. The User can delete these cookies at any
time in their browser settings.
Anonymous data processed by Meta Platforms Inc. to measure website traffic and map
browsing habits, which is also accessible to Meta Platforms Inc., which provides cookies that
facilitate visits to the Data Controller’s social media pages and sharing and liking this website
on social media, is stored permanently using Meta Platforms Inc. tools, but for a maximum of
2 years using cookies that are stored on the device used by the User for browsing. The User
can delete these cookies at any time in their browser settings.

6.6. Method of data storage: In separate data processing lists in the Data Controller’s IT
system, anonymously. Data necessary to ensure the user-friendly operation of the website (IP
address, the order of pages visited on the website during browsing) are not stored. Cookies
providing data are stored locally on the User’s device. Log files used by the web hosting
provider are stored on the hosting provider’s server.

6.7. Users can find more information about the process of information technology data
management and the use of Google Analytics and Meta Platforms Inc. tools by clicking on the
pop-up warning bar that appears when they start browsing the website, as well as in the
information available on the website by clicking on the “Information on the use of cookies” link. “, as well as on the Google Analytics https://www.google.com/intl/hu_ALL/analytics/support and Meta Platforms Inc. https://developers.facebook.com/products websites. The Data
Controller only uses the functions recommended by Google Analytics and Meta Platforms Inc.

Data processing related to receiving and responding to messages
Determination of the scope of data processed when using the messaging interface for registering

7.1. Determination of the scope of data processed when using the messaging interface for
expressing interest in franchise business opportunities. Data subjects: Users who send messages to the Data Controller using the messaging interface
available under the “We look forward to your application” menu item on the www.bubbles.hu/franchise subpage, or by email using the email address(es) provided on the website.

7.2. Legal basis for data processing: the User’s consent pursuant to Article 6(1)(a) of the GDPR and Section 5(1)(a) of the Infotv. By voluntarily providing the data requested on the message sending interface, ticking the box in front of the data processing statement found there and voluntarily sending the message, in the case of messages sent by e-mail, by voluntarily sending the e-mail, the User consents to the processing of the data provided and any other data indicated in the message.

7.3. Determination of the scope of data processed: In the case of users sending messages, data processing concerns the personal data and contact details to be filled in on the above- mentioned message sending interface, as well as any additional data provided by the User in
the message (including e-mail messages).
Scope of data:
– surname
– first name
– city – e-mail address
– telephone number.
With regard to any additional data provided by the User in the message (e-mail), the Data Controller shall only process the data necessary in connection with the content of the message sent upon receipt thereof, but the Data Controller shall not request the User to provide any
personal data that may be disclosed therein. In the event of such unexpected disclosure of personal data, the Data Controller shall not store the unexpected personal data, but shall immediately delete it from its IT system.

7.4.Purpose of data processing: To enable the User to exchange messages with the Data Controller. The purpose of processing the personal data and contact details voluntarily provided by Users visiting the website is to enable the User concerned to use the website’s
messaging services.

7.5. General complaints and other requests for information related to the service can be submitted via the email address indicated on the interfaces involved in data processing. Scope of data processed when submitting general complaints or requesting other information related
to the service: personal data provided by the User in the message (e-mail) and any additional
data provided.
Scope of data:
– surname
– first name
– e-mail address
With regard to any additional data provided by the User in the message (e-mail)
The Data Controller only processes data necessary for the content of the message sent upon receipt, but the Data Controller does not request the User to provide any personal data that may be included in the message. In the event of such unexpected personal data being
provided, the Data Controller will not store the unexpected personal data and will immediately delete it from its IT system.

Method of data storage: In a separate data processing list in the Data Controller’s IT system, until the end of the information exchange period.

Data processing related to marketing communications (newsletters, text messages, telephone calls, market research, etc.)

8.1. Data subject: the User who gives their consent by ticking the relevant box on one of the interfaces involved in data processing, thereby consenting to being contacted by the Data Controller for marketing purposes.

8.2. Legal basis for data processing: Article 6(1)(a) of the GDPR and Section 5(1)(a) of the Infotv. Legal basis for data processing: the User’s consent pursuant to Article 6(1)(a) of the GDPR, Section 5(1)(a) of the Infotv. and Sections 6(1) and (2) of the Grt. The User gives their voluntary consent by accepting this data processing information and ticking the box for consent to marketing communications. By doing so, the User declares that they consent to the processing of their data as specified in the data processing information and to its use for marketing purposes.
In addition to sending useful information, the newsletter service also aims to generate direct business for the Data Controller. Use of this service is voluntary and based on the User’s decision made after receiving appropriate information. If the User does not consent to data processing for marketing purposes, this will not disadvantage them in terms of using the interfaces involved in data processing and using other services. The Data Controller does not make the use of its direct marketing service a condition for the use of any other service.

8.3. Determination of the scope of data processed:
– surname
– first name
– e-mail address.

8.4. Purpose of data processing: messages sent by the Data Controller to the User
for marketing purposes (e-mail, text message, telephone, market research, etc.).

8.5. Method of data storage: In a separate data processing list in the Data
Controller’s IT system.

8.6 By registering, you acknowledge that we send system messages such as: balance top-up,
password reminder, balance reset, data update messages.

Data processing related to registration
9.1. Data subjects: Users who register on any of the interfaces involved in data processing.

9.2. Legal basis for data processing: the User’s consent pursuant to Article 6(1)(a) of the GDPR and Section 5(1)(a) of the Infotv. The User gives their voluntary consent by filling in the data sheet that appears during the registration process on the interfaces involved in data processing, ticking the box in front of the data processing statement, and finally submitting the registration.

9.3. Determination of the scope of data processed: In the case of registering users, data processing concerns the personal data and contact details provided during registration, or, if the registering party uses a third-party service to access , the personal data provided by the third party that is necessary for access.
Scope of data:
Data required for registration:
– surname and first name
– username
– telephone number
– e-mail address
– year of birth

9.4 Purpose of data processing: data processing related to the operation of the self-service laundry service. The purpose of processing the personal data and contact details voluntarily provided by Users who register on one of the interfaces involved in data processing is to enable
the Users concerned to use the self-service laundry services as registered users.

Related services:
– washing and drying at the registration price
– virtual balance usage and balance top-up
– advance booking of washing and drying services
– electronic bill payment option
– use of mobile application

9.5. Method of data storage: In a separate data table in the data controller’s IT system.

Data processing lists
10.1. Lists related to information technology data processing: anonymous lists containing data
referring to the browsing habits of Users listed in point 6, and a temporary list recording the IP
addresses of the devices of Users currently browsing during the browsing period, kept
exclusively in the Data Controller’s information system. Data processing on the latter list only
takes place until the end of the browsing session. (Other data is stored on the User’s device,
and the Data Controller does not keep a list of such data in its own possession.)

10.2. List for message exchange: a list containing the data of users sending messages using
the contact details available on the website, as listed in point 7, which contains the data of
those involved in the ongoing exchange of information at , exclusively for the duration of the
exchange of information. Once the exchange of information is complete, the data of the data
subject will be deleted from the list.

10.3. Newsletter list: data listed in Section 8, recorded for the purpose of sending newsletters,
messages, information materials and promotional offers by email.
The data will be processed by the Data Controller until the User withdraws their consent
(unsubscribes) or until the data is deleted at the User’s request.

10.4. Registration list: a list containing the registration data of registered users, as listed in
point 9. The data will remain on this list until the registration is deleted by the User or the Data
Controller, or until the User’s deletion request is processed.

10.5. Data transfer register: The Data Controller keeps a data transfer register for the purpose
of verifying the lawfulness of data transfers and informing the data subject, which contains the
date of transfer of the personal data processed by it, the legal basis and recipient of the data
transfer, the definition of the scope of the personal data transferred, and other data specified
in the legislation prescribing data processing.

10.6. Data protection incident register: a register of unlawful processing of personal data and measures taken to remedy such processing. It shall contain the scope of personal data affected by the incident, the scope and number of persons affected by the data protection incident, the date, circumstances and effects of the data protection incident and the measures taken to remedy it, as well as, in the case of data processing based on a legal obligation, other data specified in the legislation prescribing the data processing.

10.7. In order to achieve the purposes of data processing, the data controller stores the data in separate databases for each data processing purpose in the form of separate lists, as described above, in its IT system, and also stores the data processed for the purpose of sending newsletters by filing paper-based contracts/declarations.

Duration of data processing
11.1. Data processing in accordance with the specific data processing purposes shall continue
until the data processing purposes have been achieved, or until the User’s consent has been
withdrawn, or until the data has been deleted at the request of the User concerned.

11.2. Accordingly, data processing shall continue until the withdrawal of the consent, the
fulfilment of the request for erasure, the cancellation of the registration, the unsubscribing from
the newsletter, or the fulfilment of the obligation prescribed by law in the relevant cases. Users
may object to data processing at any time at , request the termination of data processing, the
termination of certain methods of data processing, or the deletion of data for specific purposes
or in full. In such cases, data processing shall continue until the receipt and processing of such
a request, which shall be carried out by the Data Controller without delay, but within a maximum
of 10 working days. Users may unsubscribe from the newsletter at any time by using the
unsubscribe link provided in the newsletters, or by sending a written request to
info@bubbles.hu. Users may also send their objections or requests as described above by
email. The Data Controller shall only consider requests sent by e-mail to be authentic if they
are sent from the e-mail address provided by the User to the Data Controller during registration or in connection with the use of the website, or provided during newsletter subscription and registered with the Data Controller. However, the use of another email address does not mean
that the request will be ignored.

Method of data storage

12.1. The Data Controller stores the data in separate databases for each data processing
purpose in the form of separate lists in its IT system.

12.2. The Data Controller stores its databases using the Amazon Cloud service. The
Amazon Cloud service is provided by Amazon Web Services Inc (410 Terry Avenue North Seattle,
WA 98109, USA), which does not have access to the data, but only records and stores it. The adequacy of data transfer is ensured by the standard data protection clauses pursuant to Article 46(2)(c) of the GDPR.

Deletion and blocking of data
13.1. Data processing shall cease in all respects and the data shall be deleted within 10
working days of receipt of the User’s request to that effect, including the deletion of data already
transferred to a new data controller (provided that the deletion is not precluded by law).

13.2. Instead of deletion, the Data Controller shall block the personal data if the User so
requests or if, based on the information available, it can be assumed that deletion would violate
the User’s legitimate interests. Blocked personal data may only be processed for as long as
the purpose of data processing that precluded the deletion of personal data exists.

13.3. Furthermore, the Data Controller shall delete personal data if
– its processing is unlawful,
– the processed data is incomplete or incorrect – and this situation cannot be
remedied lawfully – provided that the deletion is not excluded by law,
– the purpose of the data processing has ceased to exist or the statutory time limit
for storing the data has expired,
– it has been ordered by a court or the National Authority for Data Protection and
Freedom of Information.

Data transfer
14.1. Persons affected by data transfer: persons who top up their balance on the www.my.bubbles.hu website, top up their balance, book washing machines and/or dryers, and those who pay for washing machines and/or dryers, as well as Users who choose to pay by
bank card via the Bubbles payment machine, regardless of whether they use other services provided by the above-mentioned interfaces.

14.2. Recipient of the data transfer:
OTP Bank Public Limited Company
Abbreviated name: OTP Bank Nyrt.
Company registration number: 01-10-041585
Tax number: 10537914-4-44
Registered office: 1051 Budapest, Nádor u.16.
Postal address: 1132 Budapest, Váci út 4. 1.
Website: https://www.otpbank.hu
14.3. Recipient of data transfer:
OTP Mobil Szolgáltató Kft.
Company registration number: 01-09-174466
Tax number: 24386106-2-42
Registered office: 1143 Budapest, Hungária krt. 17-19.
Postal address: 1143 Budapest, Hungária krt. 17-19.
Email address: ugyfelszolgalat@simple.hu
Telephone number: 06 1 3666 611; 06 70 3666 611; 06 30 3666 611; 06 20 3666 611
Website: www.otpmobil.hu/
Online credit card payments and balance top-ups are processed through the Simple Pay system. Credit card details are not disclosed to the merchant. The service provider, OTP Mobil Kft., is an institution supervised by the Hungarian National Bank.
By accepting the data processing statement, the user also makes the following data transfer statement:
– I acknowledge that Bubbles International Zrt. (9027 Győr, Kandó Kálmán u. 11-13.), as data controller, will transfer my personal data stored in the user database of www.bubbles.hu to OTP Mobil Kft. as data processor. The data transferred by the data controller includes the following:
– username
– surname
– first name
– country
– telephone number
– e-mail
The nature and purpose of the data processing activities carried out by the data processor can
be viewed in the SimplePay Data Processing Notice at the following link:
http://simplepay.hu/vasarlo-aff

14.4. Legal basis for data transfer: the User’s consent pursuant to Article 6(1)(a) of the
GDPR and Section 5(1)(a) of the Infotv. After reading the Data Processing Notice,
the User voluntarily consents to the transfer of data necessary for the secure
processing of online payments by selecting the online balance top-up or credit
card payment method.

14.5. Scope of data transferred:
– username
– surname
– first name
– country
– telephone
– e-mail

14.6. Purpose of data transfer: Proper operation of the payment service and technical
execution of payments, confirmation of transactions, fraud monitoring in the
interests of protecting users – operation of a fraud detection system ( ) that
supports the control of bank transactions initiated electronically – and the
provision of customer service assistance to the User.

14.7. Data is transferred solely for the purposes described above.

14.8. Furthermore, the Data Controller shall only transfer data to authorities if required
to do so by law.

14.9. The data controller does not transfer data to third parties for business or
marketing purposes.

14.10. The Data Controller keeps a record of data transfers as specified in the Infotv.

Use of data processors

The data controller uses the following business organisations as data processors.

15.1. IT data processing

15.1.1. Persons involved in data processing: Users visiting the website, regardless of
whether they

15.1.1. Data subjects affected by data processing: Users visiting the website, regardless of
whether they use the services provided by the website.

15.1.2. The Data Controller uses the following data processor
Rackhost Zrt.
Company registration number: 06-10-000489
Tax number: 25333572-2-06
Registered office: 6722 Szeged, Tisza Lajos körút 41
as a web hosting provider, website developer and maintainer (hereinafter: Data Processor).

15.1.3. The Data Controller uses the following as data processors Litbase Kft.
Litbase Kft.
Company registration number: 13-09-225471
Tax number: 23386165-2-13
Registered office: 2316 Tököl, Nefelejcs x utca 22. 1.a. ajtó
business association, as the developer and maintainer of the payment terminal and the
Bubbles mobile application involved in data processing (hereinafter: Data Processor).
15.2. Data processing related to sending newsletters
15.2.1. Data subjects: Users who subscribe to the newsletter on the website, regardless of
whether they use other services provided by the website.
15.2.2. The data controller uses a data processor

MAILCHIMP
Company name: The Rocket Science Group LLC
Abbreviated name: MAILCHIMP
Tax number: EU 826477914
Headquarters: 675 Ponce de Leon Suite 5000, Atlanta, 30308, USA
Email: info@mailchimp.com
Website: https://www.mailchimp.com
business association as the developer and maintainer of the newsletter sending software
used by the Data Controller (hereinafter: Data Processor).
15.3. Data processing related to the Data Controller’s statements

15.3.1. The Data Controller uses the Data Processor as a data processor to process the data containe
The Data Controller uses the following as data processors

KBMINFO Kft.
Tax number: 32266900-2-42
Registered office: 1149 Budapest, Kövér Lajos utca 45-47. B. ép. 3. em. 12. ajtó
as the developer and maintainer of the Data Controller’s performance indicator software
(hereinafter: Data Processor).

 15.4. Data processing related to the Data Controller’s accounting.

15.4.1. The Data Controller uses the Data Processor as a data processor for the following
purposes
The Data Controller uses the Data Processor as a data processor.
Benefit Consulting Kft.
Benefit Consulting Kft.
Tax number: 12832583-2-42
Registered office: 1064 Budapest, Vörösmarty u. 67. 5. em.
as the Data Controller’s accountant (hereinafter: Data Processor).

15.4.2. The Data Controller uses the following as data processors
MOBILCONSULT Auditing and Economic Consulting Limited Liability Company
Abbreviated name: Mobilconsult Auditing and Economic Consulting Limited Liability Company
Company registration number: 01-09-079760
Tax number: 10616008-2-42
Registered office: 1148 Budapest, Nagy Lajos király útja 37/B. 1st floor, 6.
Postal address: 1148 Budapest, Nagy Lajos király útja 37/B. 1st floor, 6.
Telephone: +36 1 999 0369
Email: mobilconsult@mobilconsult.hu
Website: http://www.mobilconsult.hu economic company, as the Data
Controller’s auditor (hereinafter: Data Processor).

15.4.3. The Data Controller uses the following as data processors
Kboss.hu Kereskedelmi és Szolgáltató Korlátolt Felelősségű Társaság
Abbreviated name: Kboss.hu Kereskedelmi és Szolgáltató Kft.
Company registration number: 01-09-303201
Tax number: 13421739-2-41
Registered office: 1031 Budapest, Záhony utca 7.
Postal address: 1031 Budapest, Záhony utca 7.
E-mail: kboss@kboss.hu
business association as the developer of the invoicing programme used by the Data Controller
(hereinafter: Data Processor).

15.5. Data processing related to the operation of the Data Controller’s Call Centre15.5.1 The Data Controller uses the services of a data processor for the operation of its Call Center

15.5.1 The Data Controller uses the following as data processors
MULTICOM CONTACT Service Provider and Consulting Limited Liability Company
Abbreviated name: Multicom Contact Kft.

Company registration number: 01 09 686596Tax number: 11985750-2-43
Headquarters: 1121 Budapest, Zsigmondy Vilmos u 8/b.
Email: bubbles@multicom.hu, attila.rosta@multicom.hu
business association as the operator of the call centre used by the Data Controller (hereinafter: Data Processor).

15.6. Data processing related to the management of the Data Controller’s Google and
Facebook accounts
15.6.1. The Data Controller uses it as a data processor.
Profelis Kereskedelmi és Szolgáltató Korlátolt Felelősségű Társaság
Abbreviated name: Profelis Kft.
Company registration number: 01-09-866849
Tax number: 13664316-2-43
Registered office: 1125 Budapest, Rőzse utca 16. 4th floor, door 1
Telephone: +36-20-460-1537
Email: info@profelis.hu
Website: www.profelis.hu business association used by the Data Controller as a partner managing the Data Controller’s
Google and Facebook accounts (hereinafter: Data Processor).

15.7. The Data Controller uses the following as data processors
CONTROLL LUDOVIKA Kereskedelmi és Szolgáltató Korlátolt Felelősségű Társaság
Abbreviated name: CONTROLL LUDOVIKA Kereskedelmi és Szolgáltató Kft.
Company registration number: 01-09-360387
Tax number: 10727139-2-43
Registered office: 1033 Budapest, Szőlőkert utca 4/A.
Business premises: 1033 Budapest, Szőlőkert utca 4/A.
Postal address: 1033 Budapest, Szőlőkert utca 4/A.
Email: megyeriistvan@me.com
business association that performs maintenance on the Data Controller’s self-service laundries
(hereinafter: Data Processor).

15.8. The Data Controller uses the following as a data processor in the development of an access control system for night-time entry to the laundries:
LINK Mobility Hungary Kft.,
company registration number: 01-09-694287
tax number: 12598582-2-42
registered office: 1062 Budapest, Andrássy út 68.
fszt. C11.
www.seemee.hu
The telephone number provided for entry is used exclusively for sending entry codes via text
message, is not linked to any other personal data, and will be automatically deleted from the
system 30 days after the text message is sent.

15.9. Data processing for other purposes does not take place.

15.10. Data Processors have no interest in the Data Controller’s business activities.

15.11. The Data Controller does not use any data processors other than those specified above.

User rights relating to data processing
16.1. The User has the following rights in relation to data processing:
16.1. At the User’s request, the Data Controller shall provide information on the data processed
by it or by a Data Processor commissioned by it or at its disposal, the source of such data, the
purpose, legal basis and duration of data processing, the name and address of the Data

Processor and its activities related to data processing, the circumstances and effects of any
data protection incidents that may have occurred and the measures taken to remedy them,
and, in the case of the transfer of the data subject’s personal data, the legal basis and recipient
of the data transfer. The Data Controller shall provide the information in writing within 25 days
of the submission of the request. The first such request submitted in the current year for a
given data set is free of charge, in other cases it is subject to a fee of HUF 1,000 (except in
cases of unlawful data processing or if the request leads to a correction). The User may also
request the correction of their processed data, which the Data Controller shall perform
immediately, but within a maximum of 25 days. The User’s rights specified in this section may
be restricted by law.
16.2. All Users have the right to refuse or prohibit the inclusion of their name and address
details and contact details on a business acquisition list, their use for direct business
acquisition purposes or for specific purposes within that, their use for sending newsletters, or
their transfer to third parties, and to request the blocking of their personal data and the
termination of its processing on all or specific lists held by the Data Controller, including data
transferred to third parties. The Data Controller shall carry out the deletion within 10 working
days of receiving the request and shall inform the User concerned in writing within a further 15
days that their request has been fulfilled.
16.3. The User may send their comments and requests by post to the address of the Data
Controller indicated in point 1.1, or by email to info@bubbles.hu. Requests sent by e-mail shall
only be considered authentic by the Data Controller if they are sent from the e-mail address
provided by the User to the Data Controller at the time of registration and recorded there. In
the case of e-mails, the date of receipt shall be deemed to be the first working day following
the date of dispatch.
16.4. The Data Controller shall mark the personal data processed by it if the User disputes its
correctness or accuracy, but the incorrectness or inaccuracy of the disputed personal data
cannot be clearly established. The Data Controller shall notify the User concerned, as well as
all those to whom the data has been previously transferred for data processing purposes, of
the correction, blocking, marking and deletion. The notification may be omitted if it does not
prejudice the legitimate interests of the User concerned in view of the purpose of the data
processing.

16.5. The Data Controller shall delete personal data if its processing is unlawful, if the User
concerned so requests, if the purpose of the data processing has ceased to exist, or if the
statutory time limit for the storage of the data has expired, or if ordered by a court or the data
protection authority.
16.6. If the Data Controller does not comply with the User’s request for rectification, blocking
or erasure, it shall communicate in writing the factual and legal reasons for the refusal of the
request for rectification, blocking or erasure within 25 days of receipt of the request. In the

event of rejection of the request for correction, deletion or blocking, the Data Controller shall
inform the User concerned of the following:
The User may appeal against the Data Controller’s decision to the Authority (National Data
Protection and
Freedom of Information Authority, 1055 Budapest, Falk Miksa utca 9-11., Postal address: 1363
Budapest, Pf.: 9., Telephone: +36 1 391 1400, Fax: +36 1 391 1410, Email:
ugyfelszolgalat@naih.hu). Furthermore, in the event of a violation of their rights, and if the Data
Controller does not comply with their objection to the processing of their personal data, the
User concerned may appeal to the court within 30 days of the notification of the decision or
the last day of the above deadline. The court shall have jurisdiction to hear the case. The case
may also be brought before the court of the place of residence or domicile of the User
concerned, at the User’s discretion.

Data protection, data security
17.1. The Data Controller shall ensure the security of data in the course of its data
processing and
17.1. The Data Controller shall ensure the security of data in the course of its data management
and data processing activities, and shall ensure compliance with the law and other data and
confidentiality rules through technical and organisational measures and internal procedural
rules. In particular, it shall take appropriate measures to protect the data processed against
unauthorised access, alteration, transmission, disclosure, erasure or destruction, as well as
accidental destruction and damage, and against becoming inaccessible as a result of changes
in the technology used.
17.2. To this end, the Data Controller uses the “https” scheme http protocol to access the
website,
17.2. To this end, the Data Controller uses the “https” http protocol to access the website, which
allows web communication to be encrypted and uniquely identified. In addition, in accordance
with the above, the Data Controller stores the processed data in encrypted data files,
separated by data processing purpose, to which the Data Controller’s designated – employees
performing tasks in the course of their activities on this website – whose job responsibilities
include data protection and responsible management in accordance with this information
notice and the relevant legislation.
17.3. The data used to measure visitor numbers and map website usage habits are recorded
anonymously by the Data Controller’s IT system from the outset and cannot be linked to any
individual.
17.4. Data processing is carried out only for the purposes specified in this notice and for the
achievement of legitimate objectives, to the extent necessary and proportionate, in accordance
with the relevant legislation and recommendations, and with appropriate security measures in
place.

Enforcement of rights
18.1. Data subjects may exercise their legal enforcement options before the courts on the basis
of Act V of 2013 on the Civil Code and Act CXII of 2011 on the right to self-determination in
relation to information and freedom of information, and may also contact the National Dat Protection and Freedom of Information Authority:
National Authority for Data Protection and Freedom of Information
Address: 1055 Budapest, Falk Miksa utca 9-11.
Postal address: 1363 Budapest, Pf.: 9.
Telephone: +36 1 391 1400
Fax: +36 1 391 1410
Email: ugyfelszolgalat@naih.hu
Website: http://www.naih.hu/
If legal action is taken, the case may be brought before the court of the place of residence or
domicile of the User concerned, at the User’s discretion, as the court has jurisdiction to hear
the case.
Dated: Győr, 9 February 2026.
BUBBLES International Zrt.

DOWNLOADABLE VERSION