Privacy Policy
Data processing activities relating to the website and the vehicle recovery service
| Data controller / service provider | D-Car Trans Ltd. |
|---|---|
| Website | https://david-automento.hu |
| Version | 6 August 2026. |
1. Details of the data controller
| Name of the data controller | D-Car Trans Limited Liability Company |
|---|---|
| Abbreviated name | D-Car Trans Ltd. |
| Brand name | Dávid Towing Service |
| Registered office | 48 Paskom Street, Nyergesújfalu 2536. |
| Company registration number | 11-09-031190 |
| Tax number | 32635845-2-11 |
| Member of Parliament | Dávid Pathó, Managing Director |
| pathodavid17@gmail.com | |
| Telephone | +36 20 245 6698 |
| Website | https://david-automento.hu |
2. Purpose and scope of this prospectus
This privacy notice explains what personal data the data controller processes when you visit the website, contact us by telephone, email or via a messaging app, request a quote, use our vehicle recovery or vehicle transport services, receive an invoice, displaying customer reviews, and analysing website statistics and advertising.
3. The fundamental principles of data processing
- Legality, due process and transparency.
- Purpose limitation: we use data only for specified and communicated purposes.
- Data minimisation: we only request the data necessary for the organisation and provision of the service.
- Accuracy: incorrect or out-of-date data can be corrected.
- Limited retention period: we retain data only for as long as is necessary or required by law.
- Confidentiality and integrity: we protect data through appropriate technical and organisational measures.
4. Data processing activities
| Data processing | Data | Objective | Legal basis | Preservation | Recipients |
|---|---|---|---|---|---|
| Website technical logs | IP address, date and time, URLs visited, browser and device details, referring page, technical errors. | Website security, debugging and prevention of misuse. | Article 6(1)(f) of the GDPR – legitimate interests; the technical provision of the service. | Up to 30 days, except in the event of a security incident or a legal claim. | Web hosting provider [TO BE COMPLETED]. |
| Contact by telephone | Caller’s telephone number, name, location, vehicle details, fault or damage, destination, number of passengers, agreed price and time. | Organising immediate assistance, submitting quotations, and preparing and fulfilling contracts. | Article 6(1)(b) of the GDPR – a contract or pre-contractual measures taken at the data subject’s request. | Unfulfilled enquiry: 6 months. Service provided: 5 years, or as required by law. | Calls are not recorded. The data may be accessed by customer service representatives and colleagues involved in the rescue operation. |
| Email and messaging apps | Name, email address or user ID, telephone number, message, GPS location, vehicle data, photo, date and time. | Communication, needs assessment, quotations and service organisation. | Article 6(1)(b) of the GDPR; in the case of a general enquiry, Article 6(1)(f) of the GDPR – legitimate interest in responding. | Unfulfilled enquiries: 6 months. Services provided: 5 years. We delete location and photo data that is no longer required within 30 days where possible. | Google/Gmail, WhatsApp, Messenger/Facebook, Viber – depending on the channel you choose. |
| Quotation and provision of services | Customer’s name, contact details, location, vehicle registration number and technical specifications, circumstances of the recovery, destination, order and fulfilment details. | Car recovery, vehicle transport, on-site assistance, passenger transport, storage or the provision of any related services. | Article 6(1)(b) of the GDPR – performance of a contract. | For a period of 5 years from the date of performance of the contract, or until any legal claim ceases to exist. | Staff or contractors involved in rescue operations, and, where necessary, assistance, breakdown, accommodation or car-hire partners. |
| Invoicing and bookkeeping | Name or company name, address/registered office, tax number, details of delivery and services, invoice total. | Invoicing, bookkeeping, tax and accounting obligations. | Article 6(1)(c) of the GDPR – legal obligation. | We retain accounting documents for 8 years. | Invoicing software provider [TO BE COMPLETED], accountant [TO BE COMPLETED], NAV. |
| Complaints and legal claims | Name, contact details, details of the complaint, service and evidence-related data, correspondence. | Investigating a complaint; bringing, enforcing or defending a legal claim. | Article 6(1)(c) and (f) of the GDPR – legal obligation and legitimate interests relating to legal claims. | The period specified in the legislation on complaint handling, or, as a general rule, 5 years. | Legal representative, insurer, regulatory authority or court – where necessary. |
| Customer reviews | Name or username used in the review, text of the review, star rating, and any profile picture. | A presentation of the service’s credibility and customer experiences. | For our own recommendations: Article 6(1)(a) of the GDPR – consent. When embedding Google reviews, consent to the use of cookies is required in order for the external module to load. | Until consent is withdrawn; in the case of Google reviews, until the review is no longer available on the source page and the objection has been assessed. | Google Ireland Limited, if a Google review module appears. |
| Google Analytics 4 | Online identifiers, device and browser data, website usage and event data, approximate geographical data. | Statistics, usability and content development. | Article 6(1)(a) of the GDPR – consent. | Cookies: typically up to 2 years; it is recommended that the retention period for GA4 event data be set to 14 months. | Google Ireland Limited and Google’s affiliated data processors. |
| Google Ads conversion tracking | Online identifiers, ad clicks, conversion events, device and browser data. | Measuring the effectiveness of advertising campaigns. | Article 6(1)(a) of the GDPR – consent. | The duration depends on the settings of the cookie and advertising system used; typically, this is up to 90 days for a basic conversion cookie. | Google Ireland Limited and Google’s affiliated service providers. |
| Google Maps and external media | IP address, device data, interaction with the map or review module, and Google Account details if the visitor is logged in. | Displaying business premises, areas of operation and public reviews. | Article 6(1)(a) of the GDPR – consent to the loading of external content. | In accordance with Google’s own settings and data retention policies. | Google Ireland Limited. |
| Record of cookie consent | Consent ID, selected categories, date and time, technical device data. | A record of the visitor’s choice and confirmation of consent. | Article 6(1)(c) of the GDPR – compliance with the obligation of accountability. | 6 months, followed by a request for a new decision; in the event of a legal dispute, for as long as necessary. | [CONSENT FORM – TO BE COMPLETED]. |
5. The consequences of providing data
Providing the details required to contact you and arrange a rescue is voluntary; however, without the exact location, the condition of the vehicle, your contact details and the destination, the service may not be able to be arranged, or may be delayed. Providing billing details is necessary to comply with legal obligations.
6. Special data and emergency information
As a general rule, the data controller does not request health-related or other special categories of personal data. If a customer voluntarily discloses an urgent circumstance – such as reduced mobility, the presence of a child or another passenger requiring assistance – in order to organise a safe rescue, we shall use this information solely for the purpose of organising the necessary assistance and shall not retain it once the need has ceased, except in the event of a legal claim or a statutory obligation.
7. Data processors and recipients
| Web hosting provider | [NAME, REGISTERED OFFICE, CONTACT DETAILS – TO BE COMPLETED] |
|---|---|
| Web developer / maintenance specialist | [NAME AND CONTACT DETAILS – TO BE COMPLETED IF YOU HAVE ACCESS TO THE DATA] |
| Email provider | Google Ireland Limited / Gmail service |
| Statistics and advertising | Google Ireland Limited – Google Analytics 4, Google Ads |
| Map and reviews | Google Ireland Limited – Google Maps and Google Reviews |
| Send a message | SMS |
8. International data transfers
When using Google, Meta, WhatsApp or other international technology service providers, personal data may be processed outside the European Economic Area, in particular in the United States of America. Data transfers may take place on the basis of the applicable legal mechanisms, in particular an adequacy decision, the EU–US data protection framework or the standard contractual clauses adopted by the European Commission. The service providers’ own privacy notices set out these safeguards in detail.
9. Automated decision-making and profiling
The data controller does not make any decisions regarding the ordering or fulfilment of the service that are based solely on automated processing and that have legal effects or similarly significant effects on the data subject. Google’s advertising services may, subject to consent, carry out measurement or advertising profiling in accordance with their own terms and conditions; this can be disabled in the cookie settings.
10. Data security
- The website uses HTTPS encryption.
- Administrative access must be protected by a strong password and, where possible, multi-factor authentication.
- The data controller implements regular security updates, backups and access controls.
- Personal data may only be accessed by those staff members and partners who need it to carry out their specific tasks.
- Photographs, GPS locations and other emergency data must be deleted once the required period has elapsed.
11. The rights of the data subject
| Law | Contents |
|---|---|
| Information and access | You may request information as to whether we are processing your personal data, and you may request a copy of the data we hold. |
| Correction | You may request that inaccurate data be corrected or that missing data be provided. |
| Delete | You may request the erasure of your personal data if there is no further legal basis or statutory obligation to retain it. |
| Restriction | In certain cases, you may request that we simply store the data but do not use it in any other way. |
| Data portability | Data processed automatically on the basis of consent or a contract may be requested in a machine-readable format. |
| Protest | The data subject may object to data processing based on a legitimate interest on grounds relating to their particular situation. |
| Withdrawal of consent | Consent may be withdrawn at any time; this does not affect the lawfulness of any data processing carried out previously. |
| Complaints and legal remedies | The data subject may lodge a complaint with the NAIH or, in the event of a breach of their rights, may bring legal proceedings. |
12. Method of exercising rights
Requests from data subjects are pathodavid17@gmail.com They may be sent to the email address or to the postal address: 2536 Nyergesújfalu, Paskom utca 48. As a general rule, the data controller will respond within one month of receiving the request. In the case of complex requests or a large number of requests, the deadline may be extended by a further two months, in which case the data subject must be informed.
13. Supervisory authority
| Authority | National Authority for Data Protection and Freedom of Information – NAIH |
|---|---|
| Title | 9–11 Falk Miksa Street, 1055 Budapest. |
| Postal address | 1363 Budapest, PO Box 9. |
| ugyfelszolgalat@naih.hu | |
| Website | naih.hu |
| Online services | online.naih.hu |
14. Data breach
If personal data is accidentally or unlawfully destroyed, lost, altered, made accessible without authorisation or disclosed, the data controller shall assess the risk, document the incident and, where necessary, notify the NAIH within the timeframe specified by the GDPR and inform the data subjects.
15. Amendments to the prospectus
The data controller is entitled to amend this privacy notice, in particular in the event of changes to the website’s functions, data processors, services or legislation. Any significant changes will be clearly displayed on the website. The current version is available on the website.
16. Legal framework
- Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).
- Act CXII of 2011 on the right to informational self-determination and freedom of information.
- Act CVIII of 2001 on electronic commerce services and information society services.
- Act V of 2013 on the Civil Code, in particular the rules concerning the general limitation period for claims.
- Act C of 2000 on Accounting, in particular the provisions relating to the retention of accounting documents.
