When using our services (e.g., participating in a training or receiving our newsletter), it is necessary for us to record and process certain personal data. In this Privacy Notice, we provide detailed information on:

the purposes for which we process personal data, how long we store it, and to whom we transfer it;

what rights and legal remedies you have in connection with all of this.

Please read this Notice carefully, and if you have any questions, write to us at info@develor.com before accepting the Notice!

We draw your attention in advance to the fact that you have the right to object at any time to the processing of your personal data if such processing is based on our legitimate interest, as explained below, is carried out for profiling purposes, or for advertising purposes.

The “data controller” is the natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

2.1. Who will process your personal data?

Your data will be processed by DEVELOR International Tanácsadó “Zártkörűen Működő” Részvénytársaság as the data controller.

2.2. Our contact details:

• Registered office / mailing address: H-1074 Budapest, Rákóczi út 70-72.
• E-mail: info@develor.com
• Telephone: +36 1 413 7990
• Fax: +36 1 321 0413
• Website: https://develor.com
• Represented by: Zsolt Pozvai, Chief Executive Officer

2.3. Terms used in this Notice

• Develor International: DEVELOR International Tanácsadó “Zártkörűen Működő” Részvénytársaság as data controller.
• Develor Group: the group of undertakings led by Develor International Zrt. (H-1074 Budapest, Rákóczi út 70-72.), comprising all Develor companies that are members of the Develor international network.
• Website: the website operated by Develor International and available at https://develor.com/. Website operator: Kešu Advertising s.r.o. (Lermontovova 911/3, 811 05, Bratislava).
• Sherlog: the CRM system used by the Develor Group. CRM system operator: SystemInSync Kft. (2131 Göd, Termál fürdő körút 35/b).
• Participant: a natural person participating in a training or adult education organised by Develor International.

2.4. Abbreviations of legislation

• Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services;
• Act LXXVII of 2013 on Adult Education;
• Regulation (EU) 2016/679 of the European Union (General Data Protection Regulation);
• Act CXII of 2011 on the Right to Informational Self-Determination and on Freedom of Information;
• Government Decree 393/2013 (XI. 12.) on the licensing procedure and requirements for carrying out adult education activities, on keeping records of institutions engaged in adult education, and on detailed rules for the inspection of such institutions;
• Act V of 2013 on the Civil Code;
• Act C of 2000 on Accounting;
• Act CXXXIII of 2005 on the Rules of Personal and Property Protection and Private Investigation.

2.5. Basic concepts of data processing

Below we present the most important concepts used in our data processing, with the help of the following icons.

2.6. Purpose of data processing:

We process all personal data for a specific purpose, and we do not link these purposes together (e.g. we will only send you a newsletter if, at the time of concluding the contract, you have separately consented to this).

The processing of personal data may be necessary for the protection of the vital interests of the data subject or another natural person. Furthermore, data processing may be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

If we wish to process your personal data for a purpose other than that previously stated, we will inform you of the details in advance.

2.7. Legal basis for data processing:

Depending on the purpose of data processing, each processing operation may have a different legal basis: it may take place due to a legal obligation (e.g. invoicing), the performance of a contract concluded with you, the enforcement of our legitimate interests (e.g. settlement of legal disputes), or even based on your consent. How do these legal bases differ from each other?

• In the case of a legal obligation, processing is mandatory for us regardless of your approval or objection.
• In the case of concluding/performing a contract, the provision of the requested personal data is not mandatory, but if you fail to provide them, the contract will not be concluded, and you will not be able to use the requested service.
• In the case of a legitimate interest, based on our business relationship with you, we may contact you for the purpose of establishing future business relations, and we may process your personal data in order to enforce any legal claims arising from the existing contract (e.g. settlement of outstanding invoices, resolution of damage incidents, provision of evidence in administrative/judicial proceedings). In addition, the use of security cameras for personal and property protection at our training venues is also based on this legal basis.
• In the case of consent, we do not otherwise need to process your data for the purposes listed above, but certain convenience services (e.g. subscribing to the newsletter) can only be provided if, after reading this Notice, you give your prior consent to the processing of the requested personal data. If you do not give your consent in such cases, you will not suffer any disadvantage.

2.8. Definition of personal data:

Personal data: any information relating to an identified or identifiable natural person (“Data Subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

In the course of our cooperation with our clients, we always process the following data provided in the contract related to the given service or in an (online) form (or requested during coordination):

• in the case of a company representative, contact person, or sole trader: name, e-mail, telephone number, fax number, other provided contact details, position, signature, sales information related to the contact;
• in the case of a sole trader: additionally, billing name and address, tax number, registration number;
• in the case of private individual clients: name, billing name and address, e-mail, other provided contact details, signature.

2.9. Duration of data processing:

We process your personal data only for the shortest period necessary for the given service. Once the data processing period has expired, we permanently delete digitally stored personal data and destroy personal data stored on paper.

We are obliged to retain documents and records serving the fulfilment of tax and accounting obligations for the period prescribed by the applicable legislation (accounting records for at least 8 years in accordance with Section 169 (2) of the Accounting Act, tax and VAT-related documents for at least until the expiry of the limitation period for establishing the tax liability).

For each data processing purpose listed below, we are entitled to process personal data (on the basis of legitimate interest and if circumstances justify) until the end of the enforceability of our legal claim (this generally means a 5-year limitation period). Data proving the granting of consent may be processed for 5 years after the end of the consent-based processing, based on this legitimate interest.

2.10. Data transfers:

In certain cases, we transfer your personal data to so-called data processors (in some cases to other data controllers). Such data transfers usually occur for the performance of the services used or for service development within the Develor Group (e.g. customer satisfaction measurement). Personal data are generally stored digitally, which means that the data processors operating our administrative and IT systems necessarily have access to them:

• Isolutions Informatikai Kft. (2040 Budaörs, Baross utca 89.) – operation of IT and security systems
• SystemInSync Kft. (2131 Göd, Termál fürdő körút 35/b) – operator of Sherlog
• Kešu Advertising s.r.o. (Lermontovova 911/3, 811 05, Bratislava) – operator of the Website
  

3.1. Purpose of data processing:

• Newsletter sending: sending advertising relating to the services of Develor International to the contact details (e-mail, telephone, postal address) you have provided and selected for this purpose.
• Event organisation: sending invitations to Develor International events, managing registration, and processing feedback.
• Contact via the Website: processing and responding to messages received through the contact form provided for this purpose.

3.2. Legal basis for data processing:

The voluntary, specific, informed, and unambiguous indication of the Data Subject’s wishes, by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them (e.g. by filling in the relevant form).

3.3. Definition of personal data:

• Newsletter sending: name, e-mail; in the case of paper-based subscription, additionally: position, telephone number, signature.
• Event organisation: name, e-mail, position, telephone number, photo/video taken at the event, feedback provided on the event. A photo/video taken at the event (with separate consent for this purpose) will be uploaded to the Website.
• Contact via the Website: name, e-mail, telephone number, message text.

3.4. Duration of data processing:

Until the withdrawal of consent (in the case of newsletters: until unsubscribing). In the absence of withdrawal, for 5 years from the granting of consent (with the exception of photos/videos taken at events, which we process until consent is withdrawn). For newsletter sending, until the newsletter service is discontinued.

3.5. Data transfers:

• Newsletter sending: MailChimp (The Rocket Science Group, LLC; 675 Ponce de Leon Ave NE, Suite 5000 Atlanta, GA 30308, USA): operation of newsletter sending system. System administrators.
• Contact via the Website:
  • Website operator: Kešu Advertising s.r.o. (Lermontovova 911/3, 811 05, Bratislava)
  • Sherlog operator: SystemInSync Kft. (2131 Göd, Termál fürdő körút 35/b)
• In all cases: the Develor Group (transferred data: name, provided contact details)

4.1. Purpose of data processing:

Performance of the service specified in the consultancy agreement concluded between the client (company, sole trader, private individual) and Develor International (e.g. human services, business consultancy).

4.2. Legal basis for data processing:

• Performance of a contract: in relation to the data of the client’s representative and contact person.
• Legitimate interest: in relation to the participant employed/contracted by the client. In this case, the enforcement of the client’s legitimate interest (providing training for the participant) takes precedence over the participant’s right to dispose over their personal data, since it constitutes a necessary and proportionate restriction required for the participant to perform their job/tasks.

4.3. Definition of personal data:

• In relation to the client: see the section “Definition of personal data”.
• In relation to the participant: name, e-mail, signature on attendance sheet;
• Depending on the subject of the consultancy: photo/video of an exercise related to the training;
• For the “Insights Discovery” service (profiling): telephone number, personality and behavioural traits, competencies;
• For the “360° Leadership Feedback” service (profiling): personal and leadership competencies, and the names and e-mail addresses of those providing the evaluation.

4.4. Duration of data processing:

• The consultancy agreement, the related attendance sheet, and the issued invoice: 8 years in accordance with the Accounting Act.
• Photo/video taken at the training: until the end of the training (the recording is handed over to the participant, at which time Develor International deletes it).

4.5. Data transfers:

• In relation to the client: System administrators, the Develor Group.

In relation to the participant: System administrators, the Develor Group (name, e-mail, signature on attendance sheet), the trainer employed or contracted by Develor International and responsible for delivering the given service.

5.1. Data processing until the conclusion of the adult education contract

• Purpose of data processing: Enrolment in a training falling under the scope of the Adult Education Act.
• Legal basis for data processing: The trainer’s legitimate interest.
• Duration of data processing: From the date of filling in the application form / indicating training need until the date of conclusion of the adult education contract, or until withdrawal.
• Scope of data: Data on the application form, in the message indicating training need, and any data possibly related to the training concerning the participant’s highest level of education, vocational qualification, professional skills, and foreign language knowledge, and data related to entry into the training.

5.2. Data processing from the date of conclusion of the adult education contract (from the generation of the data) until the last day of the 8th year thereafter

• Purpose of data processing: Participation in and follow-up of a training falling under the scope of the Adult Education Act.
• Legal basis for data processing: Statutory authorisation (Act LXXVII of 2013 on Adult Education, Section 21).
• Duration of data processing: From the date of conclusion of the adult education contract (from the generation of the data) until the last day of the 8th year thereafter.
• Scope of data: Data on the application form, in the message indicating training need, in this document, and any data possibly related to the training concerning the participant’s vocational qualification, professional skills, and foreign language knowledge, data related to entry into and completion of the training, or, if the training is not completed, data related to withdrawal from the training, the participant’s evaluation and grading during the training, the participant’s payment obligations in relation to the training, and any training loans used.

The data may be used for statistical purposes and may be transferred for statistical purposes in a form that does not permit personal identification, and may also be transferred to the Central Statistical Office for statistical purposes in a form that permits personal identification, free of charge, and may be used for such purposes.

Note: Data processing is a statutory obligation; if you do not consent to the processing of your data, you cannot enrol in the training.

5.3. Data processing after the last day of the 8th year from the date of conclusion of the adult education contract and the generation of the data

• Purpose of data processing: Follow-up of training falling under the scope of the Adult Education Act, sending new training offers, “guarantee” administration for participants in training.
• Legal basis for data processing: The adult education provider’s legitimate interest.
• Duration of data processing: From the last day of the 8th year following the date of conclusion of the adult education contract (and generation of the data) until withdrawal.
• Scope of data: Personal data listed in points 5.1 and 5.2 above.

We draw your attention to the fact that Develor International assumes no responsibility whatsoever for the processing of data on other websites visited as a result of navigating away from our Website (e.g. social networking sites: Facebook, LinkedIn, YouTube, Instagram).

Our website uses the service of CookieYes Ltd. (“CookieYes”) to manage cookies and record and manage visitors’ consent. Through the CookieYes cookie banner, we provide our visitors with the opportunity to decide which cookies they consent to the use of. The system ensures compliance with the relevant data protection regulations (e.g. GDPR) and logs users’ decisions.

6.1. Purpose of data processing:

To ensure the better functioning of the Website and to provide convenient, personalised service. When visiting the Website, small data files, called cookies, are placed on the visitor’s computer. A cookie is a data file that, by recognising the visitor’s browser, helps identify the visitor, thus enabling the Website to provide more user-friendly services (e.g. offering the data previously entered in a form already completed). By processing statistical data obtained through the use of cookies, we can improve the operation of the Website.

The Website uses the following cookies (where indicated in brackets, the cookie belongs to an external service provider and operates independently of the Website’s server):

6.2. Legal basis for data processing:

• Performance of a contract: in respect of cookies that are technically indispensable for providing the service available via the Website (pursuant to Section 13/A (4) of the Ekertv.).
• Legitimate interest: the application of cookies indispensable for the functioning of the Website, as well as ensuring the secure operation of the Website and preventing attempted misuse.
• Consent: the application of cookies that are not indispensable for the functioning of the Website but provide convenience or marketing functions (consent can be given via the pop-up window provided for this purpose).

6.3. Definition of personal data:

Data recorded by the visitor, as well as log files recorded by the web server (date, time), IP address, subpages visited on the Website, and the time spent on those subpages (cookies placed by Google Analytics also record the browser type and version number). These personal data are not linked to other personal data of the visitor processed by us.

6.4. Duration of data processing:

Cookies store data for the periods listed in the cookie table (see above).

6.5. Data transfers:

• Website operator: Kešu Advertising s.r.o. (Lermontovova 911/3, 811 05, Bratislava)
• Sherlog operator: SystemInSync Kft. (2131 Göd, Termál fürdő körút 35/b)

We draw your attention to the fact that when using the Wi-Fi network it is prohibited to disrupt Develor’s IT system or network (e.g. unauthorised data input, modification, or deletion; hacking; uploading, downloading, or sharing harmful, illegal, obscene, discriminatory, defamatory, harassing, violent, indecent, or otherwise unlawful or inappropriate content)!

7.1. Purpose of data processing:

Monitoring connection to the Wi-Fi network available to visitors at the registered office of Develor International.

7.2. Legal basis for data processing:

Consent: the visitor grants their consent by connecting to the password-protected Wi-Fi network (by entering the password).

7.3. Definition of personal data:

Data sent by the visitor’s device necessary for connecting to the Wi-Fi network.

7.4. Duration of data processing:

Data are stored for 3 working days from the time of disconnection from the Wi-Fi network.

7.5. Data transfers:

In the course of operating the IT system: Isolutions Informatikai Kft.

8.1. Purpose of data processing:

Monitoring of customer traffic and employees for personal and property protection purposes (e.g. in relation to technical equipment and assets located in lecture rooms).

Within this, the following sub-purposes can be identified:

• prevention, detection, and proof of infringements;
• identification of persons entering without authorisation, recording the fact, duration, and behaviour displayed during entry;
• documenting the activities of persons unlawfully remaining on the premises;
• investigating the circumstances of any workplace and other accidents that may occur;
• examining and handling complaints.

8.2. Legal basis for data processing:

Legitimate interest: having regard to the controller’s interest in personal and property protection. Considering the size and customer traffic of Develor International’s registered office/training locations, comprehensive personal and property protection cannot be achieved without the use of security cameras (e.g. solely by means of security personnel). Another argument in favour of camera use is assisting investigative authorities, as well as any private individuals who may have been victims or suffered damage.

The privacy of persons appearing on the recordings is protected by the following measures:

• the cameras do not record sound and only record in areas designated for customer traffic, marked with pictograms; under no circumstances may human dignity be violated;
• only a person designated within the organisation of Develor International may have access to the recordings (may view them and decide on their use);
• the private individual appearing on the recording may at any time request information on their rights and legal remedies in connection with the recordings in person or at the e-mail address info@develor.com, and within 3 working days from the recording may request that the recording not be deleted if it affects the rights/legitimate interests of the private individual appearing in the recording.

8.3. Definition of personal data:

The likeness, movements, and behaviour of persons present at Develor International’s registered office/training locations.

8.4. Duration of data processing:

In the absence of use, we store camera recordings for 3 working days (pursuant to Section 31 (2) of the Szvmt.). (For these purposes, “use” means that the video recording, together with other personal data, is used as evidence in court or other official proceedings.)

8.5. Data transfers:

Only persons designated within Develor or within Develor International Zrt. may have access to the recordings.

Below we present your rights and (in the case of a complaint or legal dispute) your legal remedies in relation to Develor International’s data processing.

9.1. Withdrawal of consent

You have the right to withdraw your consent at any time, free of charge, without conditions and without justification, if the legal basis for the given data processing is your consent. In the event of withdrawal of consent, we will delete your personal data (e.g. if you unsubscribe from our newsletter, we will delete all data provided during subscription, and you will no longer receive newsletters from us). In certain cases, even if you withdraw your consent, we may still process your personal data lawfully — in such cases we will inform you in detail.

It is important for you to know that withdrawal of your consent will not affect the lawfulness of data processing carried out prior to the withdrawal!

9.2. Access to your personal data

You may request information at any time on whether we process your personal data for any purpose. If so, we will send you (electronically or, at your request, on paper) a copy of each of our data processing activities concerning you and inform you of your related rights.

9.3. Rectification

You may notify us at any time if you find an error in any of your personal data processed by us, or request that we supplement or clarify them, or update our records with your new data (e.g. in case of change of e-mail address).

9.4. Erasure

You may request at any time that we delete some or all of your personal data processed by us. We will also delete your personal data if: you have withdrawn your consent; the data processing period has expired; deletion is required by law; or we no longer need the given personal data.

It is important to know that in some cases the law requires us to process your personal data for a specified period, or we need to retain them to enforce our legal claims. If there is any obstacle to erasure, we will inform you in detail.

9.5. Restriction of processing

It may occur that you do not consider it appropriate for us to continue processing, nor to delete, your personal data. In such cases, you may request restriction of processing: the restricted personal data will only be stored, and we will perform no other operations on them.

You may request restriction of processing if:

• you believe that your personal data is inaccurate in our database (in this case, we will investigate: the restriction will last until the investigation is complete); or
• you believe we are processing your data unlawfully, but you oppose their deletion; or
• we no longer need your personal data for processing purposes, but you request that we do not delete them because you will need them for the enforcement of your future legal claims; or
• you object to the processing (see below; in such case, we will investigate: the restriction will last until the investigation is complete).

It is important to know that we are entitled to lift a restriction ordered at your request and continue data processing if you expressly consent to this, or if this is necessary for the enforcement of our legal claims, or for important public interest prescribed by law — in such cases we will inform you in advance.

9.6. Objection to the processing of your personal data

You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data if they are used for sending advertisements or if the legal basis for the processing has been indicated as legitimate interest. In such cases, we will delete your personal data.

However, it is important for you to know that if legitimate interest is indicated as the legal basis for data processing, we may continue to process your personal data despite your objection if we can prove that processing is unavoidably necessary, or is indispensable for the enforcement of our legal claims — in such cases we will inform you in advance.

9.7. Data portability

You also have the right to receive the personal data you have provided to us in an electronic, editable format and to send them to another controller, or to request us to send the data on your behalf.

(Data portability differs from the right of access mentioned above in that, in the former case, we only provide you with those personal data you have provided to us, as well as those we have recorded based on your activities. We do not provide data we have derived or inferred from the above.)

You can only exercise this right to data portability if the legal basis for processing your personal data is consent or performance of a contract. Another condition is that we process these personal data by automated means. In all other cases, you cannot exercise the right to data portability.

We draw your attention to the fact that we can only send your personal data directly to another controller on your behalf if this is technically feasible in the specific case — in such cases we will inform you in advance.

9.8. Right to lodge a complaint

If you believe that we have infringed statutory provisions on the processing of personal data, you may lodge a complaint with the National Authority for Data Protection and Freedom of Information (NAIH) at the following contact details:

• Registered office: 1055 Budapest, Falk M. u. 9-11.
• Mailing address: 1363 Budapest, Pf.: 9.
• E-mail: ugyfelszolgalat@naih.hu
• Website: http://www.naih.hu/

We would be pleased if you first contacted us with your complaint so that we can investigate and remedy it as soon as possible!

9.9. Right to turn to the courts

If you believe that we have infringed your rights during data processing, you may (at your choice) turn to the competent regional court according to your place of residence or stay. You can find more information about court proceedings on the birosag.hu website.

10.1. Handling of requests

You may exercise the rights detailed above at any time by simply sending us an e-mail to info@develor.com.
(Of course, you may also initiate lodging a complaint or court proceedings directly with the NAIH or the competent regional court.)

Following your request (particularly in the case of data rectification), we will endeavour to act without delay, but within no more than 1 month. In the case of a particularly complex or extensive request, this period may be extended by up to 2 months.

We draw your attention to the fact that before fulfilling your request, we are entitled to identify you in order to prevent the provision of data to unauthorised persons and the fulfilment of unauthorised (e.g. data erasure) requests.

We also draw your attention to the fact that if your request is clearly unfounded, excessive, or abusive, or if we were unable to identify you, we will refuse to act on it.

10.2. Data security

We store your personal data on our own servers (protected by antivirus, firewall, and strong passwords) guarded by a security service, and paper-based documents in lockable, fireproof cabinets. We also carry out regular backups on our servers.

Even within the controller’s organisation, only authorised employees may access personal data, and we always transmit data to processors in encrypted form. The same strict data security requirements apply to our processors.

10.3. Your responsibility

To ensure the accuracy and protection of the personal data we process, please take all reasonable measures to ensure that your personal data are kept up to date in our databases. Please notify us of any changes to your provided data preferably within 3 days.

We do not verify the accuracy of data; therefore, please always and exclusively provide your own personal data (in the case of company contact persons, your company data). We accept no liability for damage or injury resulting from the processing of personal data provided inaccurately on behalf of, or by, another person, or provided inaccurately in your own name.

Please use secure technical devices, software, network connections, and strong passwords to prevent unauthorised persons from misusing your personal data (e.g. logging into your account and making unauthorised requests on your behalf). Please notify us immediately if you detect any suspicious circumstances regarding the data we process about you.

10.4. Amendment of the Notice

We may amend this Notice unilaterally at any time: in such cases, we will notify you in advance by e-mail of the fact and substance of the amendment, as well as the date on which it enters into force. The version of the Notice in force at any time is continuously available on our website.

10.5. Governing law

This Notice is governed by Hungarian law. For matters not regulated in the Notice, primarily the legislation listed in the section “Abbreviations of legislation” shall apply.

Budapest, September 05, 2025