Privacy Policy

1. Details of the Data Controller

​

• Name of the Data Controller: Safety For All Munka- és Környezetvédelmi Szakértő Mérnök Iroda Kft. (Safety For All Occupational Health and Environmental Expert Engineering Office Ltd.)

• Registered Office: 2100 Gödöllő, Szent János utca 12. Bldg. A, Entrance 1, 4th floor, Apt. 12, Hungary

• Company Registration Number: 13-09-230524

• Tax Number: 32414086-2-13

• E-mail address: s4a@s4a.hu

• Phone number: +36 30 382 9849

• Website: s4a.hu

• Representative: István Fodor

• Data Protection Contact Person: István Fodor (s4a@s4a.hu)

 

1.1. Scope of the Policy

​

This Privacy Policy relates to the s4a.hu website operated by Safety For All Kft. and the processing of personal data occurring on and related to the use of the website. The policy covers, in particular, contact establishment through the website; requesting quotes; handling e-mail and telephone inquiries; managing contractual prospects and business relationships; social media presence; embedded external content; and data processing related to cookies and similar technologies.

 

To ensure the principles of transparency and clarity, the Data Controller endeavors, alongside this detailed policy, to make key data protection information available to data subjects on the website in a multi-layered format—using short, attention-grabbing notices and links placed at points where data is requested.

 

1.2. Key Definitions in Brief

​

In this policy:

• personal data: any information relating to an identified or identifiable natural person;

• data processing (material operations): any operation performed on personal data;

• data controller: the entity that determines the purposes and means of the processing of personal data;

• data processor: the entity that processes personal data on behalf of the data controller;

• data subject: the natural person to whom the personal data relates;

• recipient: the entity to whom the personal data is disclosed;

• third country: a country outside the European Economic Area (EEA).

 

2. Detailed Description of Individual Data Processing Activities

 

2.1. Contact Form

​

In the case of the contact form located on the website, the purpose of data processing is to receive and answer inquiries, manage requests for quotes, and administratively track contact requests.

​

• Purpose of data processing: Handling contact requests, responding, providing quotes, and related professional communication.

• Scope of data subjects: Website visitors, interested parties, potential partners.

• Scope of processed data: Surname, first name, e-mail address, phone number, company name, selected topic, content of the message, time of submission, technical log data.

• Legal basis for data processing: Article 6(1)(b) of the GDPR if the inquiry is a step prior to entering into a contract; in other cases, Article 6(1)(f) of the GDPR, the legitimate interest of the data controller in handling inquiries.

• Retention period: As a general rule, 1 year from the resolution of the inquiry, unless a contractual or legal claim arises from it.

• Recipients: Hosting provider (Wix.com Ltd.), e-mail service provider.

 

The use of the contact form is voluntary. However, the data subject acknowledges that without providing the data marked as mandatory, responding or providing a quote is not possible, or can only be done partially. The data controller explicitly requests that data subjects do not provide special categories of personal data (e.g., health data, trade union membership, personal details of accident reports) under Article 9 of the GDPR in the form. If such data is received, the data controller will delete it without delay.

 

2.2. Request for Quote

​

The purpose of data processing is to process the request for a quote initiated by the interested party, to conduct the necessary professional consultations, to prepare a customized offer, and to facilitate potential contract preparations.

​

• Purpose of data processing: Providing quotes, preliminary needs assessment, business consultations.

• Scope of data subjects: Potential clients, their contact persons.

• Scope of processed data: Name, e-mail address, phone number, company name, job title, data concerning business sites and employee headcount, line of business, description of needs.

• Legal basis for data processing: Article 6(1)(b) of the GDPR, taking steps at the request of the data subject prior to entering into a contract.

• Retention period: 1 year from the closing or completion of the quote, unless a legal claim or accounting/contractual obligation justifies a longer period.

• Recipients: E-mail service provider, hosting provider (Wix.com Ltd.).

 

The data controller reserves the right to request additional professional details required for preparing the quote (e.g., existence of current regulations, regulatory involvement, compliance history) if the offer cannot be professionally or commercially compiled without them. During the request for a quote, the prohibition on providing special categories of data (Article 9 of the GDPR) also applies, unless it is specifically necessary for the provision of the service based on a statutory obligation.

 

2.3. Contact via E-mail and Telephone

​

If the data subject contacts the data controller directly via e-mail or telephone, the data controller processes the provided personal data for the purposes of conducting communication, answering the inquiry, and preparing the business relationship.

​

• Purpose of data processing: Communication, responding, keeping in touch.

• Scope of processed data: Name, e-mail address, phone number, company name, content of the inquiry, communication history.

• Legal basis: Article 6(1)(b) or (f) of the GDPR, depending on the nature of the matter.

• Retention period: 1 year from the closing of the contact, unless further legal or contractual relevance applies.

 

Note: The data controller does not record incoming and outgoing telephone calls.

 

2.4. Contractual Prospects, Business Relationships, and Customer Relations

​

The data controller processes the data of business prospects applying through the website or other channels, as well as the data of natural person contact representatives involved in establishing contractual relationships, for the purpose of establishing, maintaining, performing, documenting, and protecting business relations.

​

• Purpose of data processing: Establishing and maintaining business relationships, contract preparation, and performance.

• Scope of data subjects: Contact persons, representatives, and employees of contracting partners.

• Scope of processed data: Name, job title, e-mail address, phone number, corporate identifiers, communication history.

• Legal basis: Article 6(1)(b) and/or (f) of the GDPR.

• Retention period: Following the termination of the contract, for the general civil law limitation period (5 years), or for the mandatory period prescribed by accounting and tax laws (8 years).

 

The legitimate interest of the data controller is, in particular, maintaining contact, documenting business communication, handling disputes, and the administrative tracking of contractual processes.

 

Based on the GDPR and the practice of the NAIH (National Authority for Data Protection and Freedom of Information), the processing of data relating solely to legal entities (such as a company's official name, registered office, tax number, central e-mail address) does not fall under the scope of the GDPR.

Therefore, the provisions of this policy—with the exception of the personal data of natural person contact representatives—do not apply to the processing of such company data.

 

2.5. Social Media Presence

​

The data controller may be present on social media platforms, in particular on LinkedIn and Facebook. During the operation of social media pages, the operator of the respective platform may participate in data processing as an independent controller or in another role depending on the nature of the specific function.

​

• Purpose of data processing: Brand building, provision of information, keeping in touch, content sharing.

• Scope of data subjects: Persons visiting or interacting with the social media pages.

• Scope of processed data: Public profile data, reactions, messages, comments, statistical data.

• Legal basis: Article 6(1)(f) of the GDPR, legitimate interest in maintaining the business's online presence; for certain platform functions, the platform's own legal basis may also be relevant.

• Retention period: The duration of the connection on the given platform or the availability of the content, or a period aligned with the internal practice of the data controller.

 

The data controller draws attention to the fact that joint controllership (Article 26 of the GDPR) may arise with social media providers (e.g., Meta Platforms Ireland Ltd., LinkedIn Ireland Unlimited Company) during the operation of the page and the processing of statistical data (Insights). The social media providers' own privacy policies and practices apply independently to the data subject's page visits and platform use.

 

2.6. Embedded Content

​

The website may contain embedded content from third parties (such as maps or social media add-ons). These embeds may technically involve the external provider collecting data about the visitor or placing cookies.

​

• Purpose of data processing: Displaying content, expanding website functionalities.

• Scope of processed data: IP address, browser and device data, usage data, and possibly identifiers associated with cookies.

• Legal basis: Depending on the nature of the embed, the legitimate interest of the data controller or the consent of the data subject.

• Recipients: The respective external service provider.

 

The activation of non-essential external content is subject to the data controller's appropriate consent management solution (cookie notice and preference panel).

 

3. Cookies and Similar Technologies

​

The website uses cookies and other similar technologies to ensure the secure operation of the website, improve user experience, perform statistical analyses, and, where applicable, achieve marketing objectives.

 

Under current electronic communications regulations and data protection authority practice, storing data on a user's terminal equipment or gaining access to data stored there—with the exception of technical cookies strictly necessary for the basic operation of the website—may only take place following appropriate information and on the basis of the data subject's explicit and voluntary consent.

 

The data controller provides detailed information to data subjects regarding the exact categories of cookies used on the website, the purpose of data processing, third-party providers, and retention periods in a separate Cookie Policy.

 

3.1. Main Categories of Cookies

​

Based on their purpose and function, the cookies used on the website can be classified into the following main categories:

​

• Strictly necessary cookies: Cookies essential for the basic operation of the website, navigation, and IT security functions. Legal basis: Legitimate interest of the data controller and technical necessity.

• Preference cookies: Technologies used to remember user settings (such as language or display preferences). Legal basis: Voluntary consent of the data subject.

• Statistical / analytical cookies: Analysis of visitor data and user usage patterns to improve website performance and ergonomics. Legal basis: Voluntary consent of the data subject.

• Marketing cookies: Cookies used for advertising, remarketing, and profiling purposes to track the user's browsing behavior. Legal basis: Voluntary consent of the data subject.

 

3.2. Detailed Table of Cookies

​

An up-to-date and detailed list of cookies actually used on the website (cookie name, name of external service provider, precise purpose of data processing, expiry period, type of cookie, and applicable legal basis) is made available by the data controller on the consent management interface operating on the website (Cookie panel), as well as in the separate Cookie Policy available on the website.

 

4. Categories of Data Processors and Technological Partners

​

The data controller may utilize data processors during its operations. The legal relationship between the data controller and the data processor is regulated by a contract concluded in accordance with the provisions of the GDPR and the Hungarian Info Act (Infotv.). Typical categories of data processors and technological partners utilized by the data controller: