Privacy Policy
PRIVACY POLICY & DATA PROTECTION NOTICE
Effective Date: September 16, 2026
Data Controller: Workplus Hungary Kft.
Registered Seat: Hungary
Website: https://www.workplusglobal.com
Contact Email: info@workplus.consulting
1. GENERAL PROVISIONS AND PURPOSE OF THIS NOTICE
Workplus Hungary Kft. (hereinafter: "Data Controller" or "Workplus") is committed to protecting the fundamental rights and freedoms of natural persons, particularly their right to privacy with regard to the processing of personal data.
This Privacy Policy explains how Workplus collects, processes, stores, and protects personal data when visitors use the website https://www.workplusglobal.com, its subdomains (including kepzes.workplusglobal.com), its digital services, and its NIS2 Online Cybersecurity Training Platform.
This notice has been prepared in compliance with:
Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation / GDPR).
Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (Hungarian Information Act).
Act C of 2000 on Accounting (Hungarian Accounting Act).
Act LXIX of 2024 on Cybersecurity (Hungarian NIS2 Implementation Act).
2. PRINCIPLES OF DATA PROCESSING
The Data Controller strictly adheres to the core principles of GDPR:
Lawfulness, Fairness, and Transparency: Data is processed lawfully, fairly, and in a transparent manner.
Purpose Limitation: Data is collected for specified, explicit, and legitimate purposes.
Data Minimization & Pseudonymization: Data collection is limited to what is necessary. For educational activity tracking, direct personal identification is eliminated using pseudonymous single-use tokens.
Accuracy: Reasonable steps are taken to ensure inaccurate data is erased or rectified without delay.
Storage Limitation: Data is kept in a form which permits identification of data subjects for no longer than is necessary.
Integrity and Confidentiality: Appropriate technical and organizational measures (TLS encryption, restricted media streaming) are implemented to protect against unauthorized or unlawful processing, accidental loss, or destruction.
3. SCOPE OF DATA PROCESSING ACTIVITIES
3.1. Website Visiting Data (Cookies & Log Files)
Scope of data: IP address, browser type, operating system, timestamp of access, referral URL.
Purpose: Ensuring IT security, system monitoring, session management, and load balancing (NF-03).
Legal basis: Article 6(1)(f) GDPR (Legitimate interest of the Data Controller to operate a secure website).
Retention period: Server log files are automatically purged after 30 days.
3.2. Purchasing, Invoicing, and Payment Data (NIS2 Training Platform)
Scope of data: Purchaser/Company Name, Billing Address, Tax Identification Number (VAT ID), Contact E-mail Address, Transaction Amount, and Timestamp.
Purpose: Processing course orders, executing credit card transactions, fulfilling B2B contract terms, and issuing legally required accounting invoices.
Legal basis: Article 6(1)(b) GDPR (Performance of a contract) and Article 6(1)(c) GDPR (Compliance with a legal obligation under Section 169 (2) of the Hungarian Accounting Act).
Retention period: Billing and accounting data is retained for 8 (eight) years pursuant to statutory accounting obligations.
Data Processors (Payment Providers & Invoicing):
Payment Gateways: Barion Payment Zrt. / Stripe Inc. (acting as independent data controllers/processors for payment processing).
Automated Invoicing: KBOSS.hu Kft. (Számlázz.hu) / Billingo Technologies Zrt.
3.3. Pseudonymous (Anonymized) Educational & Examination Data
During the operation of the NIS2 online training platform (WordPress LMS), Workplus does NOT store direct personal data (such as natural persons' personal names or personal email addresses) within the learning environment.
Scope of data: Unique Technical Identifier (Token), Assigned Course Type (8-Hour Executive / 20-Hour IBF), Time Spent per Module, Access Timestamps, and Exam Scores.
Purpose: Enforcing mandatory completion times, progress tracking (F-04), randomized exam verification (F-05), and generating audit logs (NF-05).
Legal basis: Article 6(1)(f) GDPR (Legitimate interest of the Data Controller and eNET Magyarország Kft. to verify statutory training compliance under Act LXIX of 2024).
Retention period: Pseudonymous activity logs are retained for the duration required for regulatory audit verification (until December 31, 2026, or as required by statutory audit cycles).
4. THIRD-PARTY DATA TRANSFERS & PROCESSORS
Workplus does not sell or rent personal data to third parties. Data is transferred strictly to third parties under the following conditions:
Transfer to eNET Magyarország Kft. (Joint Operational Partner):
Upon successful completion of an examination, Workplus automatically transmits ONLY the Token, completion timestamp, verified study hours, and exam score to eNET Magyarország Kft. via a secure API/Webhook channel.
This data is transferred solely for eNET to complete adult education registry reporting (FAR) and issue official certificates.
The linkage between the Token and the actual natural person is managed exclusively within eNET's isolated database.
Infrastructure & Hosting Processors:
Web Hosting: Hostinger International Ltd. (Data hosted strictly in EU-based data centers).
Secure Media Streaming: BunnyWay d.o.o. (Bunny.net - EU-based encrypted video stream delivery).
5. DATA SECURITY MEASURES (NF-03)
Workplus implements technical and organizational security measures to protect data against accidental or unlawful destruction, loss, alteration, or unauthorized disclosure:
Encryption in Transit: All connections utilize TLS 1.2+ / HTTPS encryption.
Session Security: Secure session handling using HttpOnly, Secure, and SameSite cookie flags with absolute idle timeouts.
Media Protection: Video content is encrypted using HLS encryption and restricted to domain-locked embedding to prevent unauthorized extraction.
Data Isolation: Complete separation between financial billing databases and pseudonymous LMS training activity.
6. RIGHTS OF THE DATA SUBJECT
Under the GDPR, data subjects possess the following rights:
Right of Access (Article 15 GDPR): Request information on whether your personal data is being processed.
Right to Rectification (Article 16 GDPR): Request the correction of inaccurate billing or purchase data.
Right to Erasure / "Right to be Forgotten" (Article 17 GDPR): Request the deletion of personal data (excluding data required to be kept by statutory accounting laws).
Right to Restriction of Processing (Article 18 GDPR): Request the restriction of processing under specific legal scenarios.
Right to Object (Article 21 GDPR): Right to object to processing based on legitimate interest.
Note regarding Pseudonymous LMS Data: Because Workplus does not store direct personal identifiers alongside learning tokens, requesting access or erasure for training data requires providing the specific Token issued to you by eNET.
To exercise any of these rights, please send your request to info@workplus.consulting.
7. LEGAL REMEDIES AND COMPLAINTS
If you believe that your personal data rights have been infringed by Workplus, you have the right to lodge a complaint with the supervisory authority:
National Authority for Data Protection and Freedom of Information (NAIH)
Address: H-1055 Budapest, Falk Miksa utca 9-11., Hungary
Mailing Address: H-1363 Budapest, Pf. 9.
Phone: +36 (1) 391-1400
Email: ugyfelszolgalat@naih.hu
Website: https://www.naih.hu
You also have the right to seek judicial remedy before the competent regional court (in Hungary, the Törvényszék) where you reside or where the Data Controller is established.
8. AMENDMENTS TO THIS PRIVACY POLICY
Workplus reserves the right to update this Privacy Policy to reflect changes in legal requirements, technical infrastructure, or operational practices. Any updates will be published immediately at https://www.workplusglobal.com/adatvedelem with a revised effective date.