Privacy Policy

VWCloudMobil mobile application · Effective: 30 September 2026 · Version 2.1

This policy describes the data processing practices of the VWCloudMobil mobile application. The application is a mobile extension of Visual Window Kft.’s software: it cannot be licensed on its own and may be used only by partner companies holding a valid software licence and the employees they designate, as well as by the company’s own employees, to support procurement, logistics and customer management processes.

Data processing is carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, hereinafter: GDPR) and Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.).

1. The data controller

Company name	Visual Window Support Hungary Korlátolt Felelősségű Társaság
Short name	Visual Window Kft. (hereinafter: Visual Window)
Registered office	1125 Budapest, Zirzen Janka u. 38., Hungary
Company registration number	01-09-922684 (Company Registry Court of the Budapest-Capital Regional Court)
Tax number	14845488-2-43
Phone	+36 30 310 5555
E-mail	support@visualwindow.hu

With regard to the personal data processed in the application, Visual Window Kft. qualifies as the data controller, meaning that it independently determines the purposes and means of the processing.

2. Who this policy applies to

Partners in a contractual relationship with Visual Window Kft. who have obtained the right to use the application, and the natural persons designated by them who hold a user account.
Visual Window Kft.’s own employees who use the application to perform their duties.
Natural persons (e.g. customers, supplier contacts) whose data appear in the business records managed in the application.

The application is intended exclusively for business use and is not available to consumers or persons under 18 years of age. We do not knowingly collect personal data relating to minors. If we become aware that such data has entered our system, we will delete it without delay.

3. What data we process

3.1 Login and account data

Username and password, the permission level assigned to the account, the identifier of the partner company employing the user and – if provided – the user’s name and e-mail address. Passwords are stored exclusively in encrypted (hashed) form and cannot be decrypted by us.

3.2 Push notification identifier

The device’s push token (Firebase Cloud Messaging on Android, Apple Push Notification Service on iOS), which makes it possible to send notifications (e.g. delivery reminders, status changes).

3.3 Camera access

The application requests camera access to scan QR codes. The camera image is not stored, recorded or transmitted; only the content of the scanned code is processed on the device. Camera access can be revoked at any time in the settings of the device’s operating system; in that case the QR code scanning function cannot be used.

3.4 Log and technical data

Data generated automatically during the operation of the application and the server system:

IP address, device type, name and version of the operating system, application version number;
login and logout timestamps, failed login attempts;
an audit log of operations performed in the application (which user created, modified or deleted which record, and when);
error and operational logs for the purpose of troubleshooting malfunctions.

3.5 Business data

Project, order, delivery, customer and supplier records that the user can access within their own permission scope. These records may also contain data of natural persons, typically in their capacity as contact persons: name, position, phone number, e-mail address, delivery or site address.

3.6 Contact data

Data provided in the course of support or data protection enquiries (name, e-mail address, phone number, content of the enquiry).

3.7 Usage statistics

In order to develop the application, we record how users use the application’s features. In doing so, we process the following data: user identifier, identifier of the partner company employing the user, device identifier [an installation identifier generated by the application], session identifier, name of the main screen opened, time spent there, time of the event, application version number and platform (Android/iOS).
We do not record details of jobs, purchases or customers, text entered in the search field, or any other business data.
This data collection is not anonymous: the data can be linked to your user account. We use the data exclusively for product development. We do not use it to evaluate the work of individual users, and we do not provide individual-level usage data to the partner company (employer).

3.8 Source of the data

We receive most of the above data directly from you or from your device. In two cases the data does not originate from you:

Account data: if your user account was created by your partner company’s administrator, the basic account data (username, name, e-mail address, permission level) was received from the partner company.
Contact person data: the data of contact persons appearing in business records was provided to us by the partner, customer or supplier company designating them, typically when concluding a contract or placing an order. We may also supplement this data from publicly available sources (e.g. the company register, the company’s website).

In these cases, this policy serves to inform you pursuant to Article 14 GDPR; you may obtain information about the specific data processed at any time by submitting an access request under Section 11.

4. Purposes and legal bases of processing

Purpose	Data processed	Legal basis	Note
Creating the user account, identifying the user, providing access	3.1	Article 6(1)(b) GDPR – performance of a contract	Providing the data is a condition of using the service; without it the account cannot be created.
Sending push notifications related to the operation of the service	3.2	Article 6(1)(b) GDPR	Notifications relate exclusively to operational and business processes. We do not send marketing notifications.
Supporting business processes (procurement, delivery tracking, customer relations)	3.5	Article 6(1)(b) GDPR	Performance of the contract concluded with the partner.
Scanning QR codes with the device camera	3.3	No processing of personal data takes place	The camera image is not recorded or transmitted. Device-level camera access is based on the permission granted in the operating system, which can be revoked at any time.
Processing contact person data in business records	3.5	Article 6(1)(f) GDPR – legitimate interest	Legitimate interest: the practical conduct of the contractual relationship.
System security, prevention and detection of abuse, troubleshooting, traceability of operations	3.4	Article 6(1)(f) GDPR – legitimate interest	Legitimate interest: protecting the integrity of the data and the system, ensuring accountability.
Measuring the use of the application’s features for product development	3.7	Article 6(1)(f) GDPR – legitimate interest	Legitimate interest: developing the application based on actual usage. Information on the result of the legitimate interest assessment is available on request. You may object to this processing as described in Section 11.
Invoicing, retention of accounting records	3.1, 3.6	Article 6(1)(c) GDPR – legal obligation	Act C of 2000 on Accounting, Act CXXVII of 2007 on Value Added Tax.
Receiving, fulfilling and documenting data subject requests	3.6	Article 6(1)(c) GDPR	Fulfilment of obligations under Articles 12–22 GDPR.
Establishment, exercise and defence of legal claims	3.1, 3.4, 3.5	Article 6(1)(f) GDPR – legitimate interest	Legitimate interest: protecting the company’s rights in the event of a legal dispute.

5. Data storage and data security

The data is stored in PostgreSQL and SQL Server databases on a server owned and operated by Visual Window Kft. and located in Hungary. We do not use any external hosting or cloud provider to store the data, so the data does not leave the European Economic Area – with the exception of the push notification case described in Section 6.1.

To protect the data, we apply the following technical measures:

communication between the application and the server takes place over an encrypted channel (TLS);
passwords are stored exclusively as one-way, salted hashes;
role-based access control: every user can access only the data required for their work;
logging of access and of significant data operations;
regular, encrypted backups and periodic testing of recoverability;
firewall and network segmentation, restricted access to the server from public networks;
continuous installation of security updates for the servers, the databases and the application.

As we operate the server ourselves, we also take direct care of its physical protection:

the server runs in a locked room with access control, which only designated employees may enter;
uninterruptible power supply, as well as protection against fire and overheating;
the contents of data carriers to be disposed of are irreversibly destroyed before disposal.

On the organisational side, our employees who have access to personal data are bound by confidentiality obligations, their access is limited to the extent necessary for their role, and it is revoked without delay when their employment ends.

6. Processors and third parties

To deliver notifications, the application uses the following services:

Provider	Service	Data transferred
Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and its parent company, Google LLC	Firebase Cloud Messaging – Android push notifications	push token, content of the notification
Apple Distribution International Ltd. (Hollyhill Industrial Estate, Hollyhill, Cork, Ireland) and its parent company, Apple Inc.	Apple Push Notification Service – iOS push notifications	push token, content of the notification

These providers receive only the technical identifier required to deliver the notification and the content of the notification; they have no access to account data or business databases.

The application does not contain any third-party analytics or crash reporting component. We do not use Google Analytics for Firebase, Firebase Crashlytics or any similar solution. The usage statistics described in Section 3.7 are recorded with our own solution on our own server. Only the internal development team has access to them, and they are not transferred to third parties. We do not share data for advertising purposes, and we do not sell personal data to third parties.

6.1 Transfers to third countries

Due to the infrastructure of the above providers, push tokens may also be processed partly outside the European Economic Area, in the United States of America. Safeguards for the transfer:

the European Commission’s adequacy decision of 10 July 2023 on the EU–U.S. Data Privacy Framework, under which Google LLC and Apple Inc. are certified organisations;
additionally, the Standard Contractual Clauses pursuant to Commission Implementing Decision (EU) 2021/914, as well as the supplementary technical and organisational measures undertaken in the data processing agreements of the providers concerned.

6.2 Other cases

Beyond the above, we disclose personal data only on the basis of a legal obligation, at the request of a court or authority, and to the extent specified therein. We examine every such request and fulfil only lawful requests limited to what is necessary.

7. Retention periods

Data category	Retention period	Basis
Account data (username, password hash, permissions)	Deleted within 30 days of the termination of the software licence or of the deletion request	Purpose no longer applies, Article 5(1)(e) GDPR
Push token	Until the account is closed, the application is uninstalled or notifications are turned off; tokens that have become invalid are deleted without delay	Purpose no longer applies
Camera image	Not stored	–
Login, security and error logs	6 months; in the case of an ongoing incident investigation or legal dispute, until its final conclusion	Legitimate interest, data minimisation
Audit log of business operations	5 years	Section 6:22 of the Hungarian Civil Code, accountability
Business data (projects, orders, contact persons)	5 years from the termination of the contractual relationship	Section 6:22 of the Hungarian Civil Code
Accounting records, invoices and supporting data	8 years	Section 169(2) of Act C of 2000 on Accounting
Contact and support correspondence	5 years	Section 6:22 of the Hungarian Civil Code
Documentation of data subject requests and our responses	5 years	Article 5(2) GDPR – accountability
Register of personal data breaches	5 years	Article 33(5) GDPR
Usage statistics (3.7)	12 months from recording, after which they are deleted or converted into anonymous, aggregated form	Legitimate interest, Article 5(1)(e) GDPR

After the retention period expires, the data is irreversibly deleted or permanently anonymised. Deletion from backups takes place at the end of the backup cycle, but no later than 30 days from the deletion request; data still temporarily present in backups is not actively processed during this time.

8. Automated decision-making and profiling

The application does not perform profiling and does not use decision-making based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). The evaluation of data displayed in the application and all decisions are always made with human involvement. We do not use the usage statistics described in Section 3.7 to evaluate the performance of individual users, nor do we make decisions concerning them on that basis.

9. Account closure and data deletion

The VWCloudMobil application cannot be licensed on its own: it is available only as an extension of Visual Window Kft.’s desktop software, as part of the corresponding software licence. The user account is therefore always linked to a valid software licence.

9.1 Automatic deletion upon termination of the licence

If the partner company terminates the software licence or it ends in any other way, the associated user accounts are closed automatically, without a separate request. In this case, the personal data associated with the account is deleted as described in Section 9.3, and no further action is required on your part.

9.2 Deletion on request

Even while the licence is in effect, you may request at any time the closure of your own user account and the deletion of the associated personal data:

By e-mail: support@visualwindow.hu, with the subject line “Account deletion”.
By phone: +36 30 310 5555.

You do not need to log in or open the application to submit a request: the above contact details are available to anyone on this public page. Since accounts are created on the basis of the partner company’s licence, deletion can also be initiated through the partner company’s administrator.

9.3 What we delete and when

We confirm receipt of the request and, after verifying your identity, delete the following within 30 days at the latest:

the username and the password hash;
the permissions and profile data assigned to the account;
the push token;
log entries linked to the account that are not subject to a statutory retention obligation.

Even after deletion, we retain all data that we are required by law to retain (in particular accounting records) or that is necessary for the establishment, exercise or defence of legal claims – we continue to process such data exclusively for that purpose and for the period specified in Section 7. Records in the business registers that belong to the partner company’s contractual activities are not deleted together with the account, as they belong not to the user account but to the partner company’s business documentation.

Uninstalling the application from the device does not by itself close the user account – this requires the termination of the licence or a request under Section 9.2. However, when the application is uninstalled, the push token becomes invalid and is automatically deleted from our system.

10. Handling of personal data breaches

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, the personal data processed.

In the event of a breach, we follow the procedure below:

Reporting and recording: every detected or suspected breach is recorded in the breach register without delay.
Containment: we immediately take the measures necessary to limit the damage and restore the security of the affected systems.
Risk assessment: we assess the nature of the breach, the categories of data subjects and data concerned, and the likely consequences.
Notification of the authority: we notify the breach to the Hungarian National Authority for Data Protection and Freedom of Information within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to the rights and freedoms of natural persons (Article 33 GDPR).
Informing data subjects: if the breach is likely to result in a high risk, we inform the data subjects without undue delay, in a clear and plain manner, of the nature of the breach, its likely consequences and the measures taken (Article 34 GDPR).
Documentation and review: we record the circumstances and effects of the breach and the remedial measures taken, and review our security measures based on the lessons learned.

If you notice a personal data breach or a security weakness, please report it to support@visualwindow.hu.

11. Your rights

In connection with the processing, you have the following rights:

Access (Article 15 GDPR): you may ask whether we process your personal data and, if so, request a copy of the data processed and information on the circumstances of the processing.
Rectification (Article 16): you may request the correction of inaccurate data and the completion of incomplete data.
Erasure (Article 17): you may request the deletion of your data if it is no longer needed, if you have objected to the processing and there are no overriding legitimate grounds, or if the processing was unlawful.
Restriction of processing (Article 18): you may request the restriction of processing, for example where you contest the accuracy of the data, for the period needed to verify its accuracy.
Data portability (Article 20): you may request the data you provided and that is processed on the basis of a contract in a structured, commonly used, machine-readable format, or request its transfer to another controller.
Objection (Article 21): you may object at any time, on grounds relating to your particular situation, to processing based on legitimate interest. In that case we will stop the processing unless it is justified by compelling legitimate grounds that override your interests, or it is necessary for the establishment, exercise or defence of legal claims.
Withdrawal of consent (Article 7(3)): where processing is based on consent (for example device-level camera or notification permissions), you may withdraw it at any time, free of charge. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Right not to be subject to automated decision-making (Article 22): as stated in Section 8, we do not use such decision-making.
You may object to the collection of usage statistics under Section 3.7 [in the Settings menu of the application / at support@visualwindow.hu]. If you object, we will stop recording your usage data.

11.1 Submitting requests and response deadlines

You may submit your request through any of the contact details given in Section 13, preferably at support@visualwindow.hu.

We respond to requests without undue delay and in any event within 1 month of receipt.
This deadline may be extended by a further 2 months taking into account the complexity or number of requests. We will inform you of any extension and the reasons for it within 1 month of receipt of the request.
Information and action are provided free of charge. Where requests are manifestly unfounded or excessive – in particular because of their repetitive character – we may charge a reasonable fee or refuse to act on the request; we will always give reasons for any refusal.
Where we have reasonable doubts concerning the identity of the requester, we may request additional information necessary to confirm their identity.
If we do not take action on the request, we will inform you of this – stating the reasons and the available remedies – within the 1-month deadline above.
We respond in the same form in which the request was submitted, primarily by electronic means, unless you request otherwise.

12. Remedies

We kindly ask you to contact us directly with any complaint first – we will try to resolve any issue as quickly as possible. Regardless of this, you have the following remedies:

12.1 Complaint to the supervisory authority

If you believe your rights have been infringed, you may lodge a complaint with the Hungarian supervisory authority:

Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH)
Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary
Postal address: 1363 Budapest, Pf. 9., Hungary
Phone: +36 1 391 1400
E-mail: ugyfelszolgalat@naih.hu
Website: www.naih.hu

If your habitual residence or place of work is in another EU Member State, you may also lodge your complaint with the supervisory authority there (Article 77 GDPR).

12.2 Judicial remedy

Under Article 79 GDPR and Section 23 of the Infotv., you may also bring proceedings before a court. At your choice, the action may also be brought before the regional court competent for your place of residence or stay; for residents of Budapest, this is the Budapest-Capital Regional Court (Fővárosi Törvényszék, 1055 Budapest, Markó u. 27.). The court handles such cases as a matter of priority. Information on the jurisdiction of regional courts is available at birosag.hu.

12.3 Compensation and restitution for infringement of personality rights

If you have suffered damage as a result of the processing, or your personality rights have been infringed, you may claim compensation or restitution (sérelemdíj) under Article 82 GDPR and Section 2:52 of the Hungarian Civil Code.

13. Contact

Visual Window Kft.
Visual Window Support Hungary Korlátolt Felelősségű Társaság
1125 Budapest, Zirzen Janka u. 38., Hungary
Phone: +36 30 310 5555
General e-mail: support@visualwindow.hu

14. Applicable legislation

Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR)
Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.)
Act V of 2013 on the Civil Code (Ptk.)
Act C of 2000 on Accounting
Act CXXVII of 2007 on Value Added Tax
Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services

15. Changes to this policy

We review and update this policy from time to time. We inform users of changes through the application or on this page; in the case of material changes, also by direct notification within a reasonable time before they take effect. The version currently in force is always available on this page. Previous versions can be requested using the contact details given in Section 13.