Privacy Notice

Parkl Digital Technologies Kft. Effective from: 12 August 2026 Version: 1.0 This Privacy Notice explains how Parkl Digital Technologies Kft. processes personal data in connection with the website available at https://parkl.eu (the "Website"), in accordance with Regulation (EU) 2016/679 (the "GDPR") and Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information ("Infotv."). Scope. This Notice covers the Website only. The Parkl mobile application, the Parkl system and the parking and e-mobility services provided through them are governed by a separate privacy policy available at https://parkl.net/en/policy, together with the General Terms and Conditions ("GTC") and the Corporate Terms and Conditions ("CTC"). 1. Who we are Controller Parkl Digital Technologies Kft. Registered seat 1051 Budapest, Arany János utca 15., 1st floor, door 6, Hungary Company registration number 01 09 712422 Tax number 12967726241 Registering authority Metropolitan Court of Budapest as Court of Registration (Fővárosi Törvényszék Cégbírósága) E-mail info@parkl.net Telephone +36 1 8555 777 Website https://parkl.eu In this Notice, "we", "us" and "our" refer to the Controller. We have not appointed a Data Protection Officer. Our core activities do not consist of processing operations that require regular and systematic monitoring of data subjects on a large scale, and we do not process special categories of personal data or data relating to criminal convictions. 2. What we do - and do not do - on this Website We consider it important to state plainly what the Website does, because it is unusually restrained compared to most commercial websites. We do not use: • Google Analytics, Google Tag Manager or any other web analytics tool • the Meta (Facebook) pixel, the LinkedIn Insight Tag or any other advertising pixel • remarketing or retargeting technologies • visitor identification or IP-to-company lookup services • a consent management platform or a cookie banner - because nothing on the Website requires consent under Article 5(3) of Directive 2002/58/EC We do process: • the information you type into a form and deliberately submit to us • the campaign parameters present in the address of the page you arrived on, attached to that submission • the technical log data that any web server necessarily generates in order to deliver a page 3. Processing activities 3.0 Two things that apply to everything below Giving us your data is voluntary. Nobody is obliged to complete a form on this Website. You decide whether to write to us, what to write, and how much to tell us about yourself. Filling in a form and pressing the submit button is a deliberate act on your part, and it is the only way personal data about you reaches us from this Website - we do not collect it in the background, and we do not obtain it from anyone else. Because you contact us in order to receive something from us - an answer, a quotation, a demonstration, a corporate account - the law treats that as a request by you to take steps towards a contract, and that is the legal basis on which we act (Article 6(1)(b) GDPR). We deliberately do *not* dress this up as "consent", because consent that you cannot refuse without losing the service is not valid consent under Article 7(4) GDPR. The one thing we genuinely ask your consent for is marketing e-mail, and that is a separate, optional, nonpre-ticked box which you may leave empty and still register (Section 3.3). How long we keep it: five years, as a rule. We retain the data you submit through a form for 5 years, counted from your submission or, where a business relationship develops, from the end of that relationship. Five years is the general limitation period for civil claims under Section 6:22 of Act V of 2013 on the Civil Code, and it is the period during which a claim connected with our dealings could still be brought by either side. There is one exception, and it is longer, not shorter: data that appears on an accounting document - typically an invoice and the company and contact details on it - must be retained for 8 years under Section 169 of Act C of 2000 on Accounting. This is a legal obligation on us (Article 6(1)(c) GDPR); we cannot shorten it, and we cannot delete such data on request before it expires. Two categories sit outside this rule, both of them shorter: technical server logs, which are generated and held by our infrastructure providers rather than submitted by you (Section 3.5), and the records of our own staff's administrator accounts (Section 3.6). Marketing consent works differently again - it lasts until you withdraw it, and not a day longer (Section 3.3). 3.1 Business enquiries submitted through the contact form Categories of data Name; company name; job title (optional); e-mail address; telephone number (optional); number/location of sites (optional); area of interest; free-text message (optional) Purpose Receiving, assessing and answering your enquiry; taking steps at your request prior to entering into a contract; where relevant, preparing a quotation or arranging a demonstration Legal basis Article 6(1)(b) GDPR - steps taken at the request of the data subject prior to entering into a contract. Where you contact us on behalf of an organisation and are not personally a party to the prospective contract, Article 6(1)(f) GDPR - our legitimate interest in responding to business enquiries addressed to us Retention 5 years from your submission, or, where a business relationship develops from it, 5 years from the end of that relationship Consequence of not providing Completing the form is voluntary. If you do complete it, name, company, e-mail address and area of interest are required in order for us to be able to answer you; the remaining fields are optional and may be left empty Your submission is stored in our database and a notification message is sent to our sales team at sales@parkl.net. 3.2 Parkl Fleet registration Categories of data Contact person's first and last name, e-mail address, telephone number; company name, company registration number, tax number, country, postcode, city and street address; number of users to be managed; selected payment mode; selected functions; how you heard about us; discount code, if any Purpose Processing your application for the Parkl Fleet corporate service, verifying eligibility, setting up the corporate account, and contacting you in order to conclude the contract Legal basis Article 6(1)(b) GDPR - steps taken at the request of the data subject prior to entering into a contract, and performance of that contract once concluded Retention 5 years from your submission, or, where a contract is concluded, 5 years from the end of the contract (Section 6:22 of Act V of 2013 on the Civil Code). Data appearing on accounting documents is retained for 8 years, as required by Section 169 of Act C of 2000 on Accounting Consequence of not providing Registration is voluntary. The fields marked as required in the form are needed in order to set up a corporate account and to invoice correctly; without them the application cannot be processed Company identifiers such as the company registration number and tax number are not personal data in themselves; the name, e-mail address and telephone number of the contact person are. Registration data is transmitted to HubSpot, which we use as our customer relationship management system, and a confirmation message is sent to the e-mail address you provide. See Section 5. 3.3 Marketing communications Categories of data Name; e-mail address; the exact wording of the consent statement displayed to you and the fact and time of your consent Purpose Sending you information about Parkl's services, offers, product developments and events by electronic mail Legal basis Article 6(1)(a) GDPR - your consent, given by ticking the dedicated, separate and non-pre-ticked box during Fleet registration. Consent is never a condition of registration or of any service Retention Until you withdraw your consent, and thereafter only the record of the consent and its withdrawal, for as long as needed to demonstrate compliance You may withdraw your consent at any time, without giving reasons and free of charge, by using the unsubscribe link in any message or by writing to info@parkl.net. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. 3.4 Campaign attribution Categories of data The utm_source, utm_medium, utm_campaign, utm_term and utm_content parameters present in the address of the page through which you reached the Website; the full address of that page; the address of the referring page reported by your browser Purpose Understanding which campaign, channel or referring site produced a given enquiry, so that we can allocate our marketing budget sensibly Legal basis Article 6(1)(f) GDPR - our legitimate interest in measuring the effectiveness of our own marketing. We have carried out a balancing test and concluded that the processing is limited, foreseeable and low-impact: these values are recorded only if and when you decide to submit a form, they are stored alongside the submission you have chosen to send us, and they are not used to build a profile or to track you across other websites. The documentation of the balancing test is available on request Retention Together with, and for the same period as, the submission to which they relate This does not involve storing anything on your device for ordinary form submissions. The parameters are read from the address of the page in your browser's memory and are transmitted only at the moment you submit a form. Nothing is written to a cookie or to local storage for this purpose. For the Parkl Fleet registration form, the first-touch campaign parameters (utm_source, utm_medium, utm_campaign, utm_term and utm_content) are captured in browser sessionStorage when you first land on the Website and are transmitted to HubSpot together with your registration data. This allows us to attribute a completed fleet registration to the campaign that first brought you to the site, even if you browse several pages before submitting the form. The values are held only for the duration of the browser session and are not used to track you across other websites or to build a profile. This is why the Website does not display a cookie banner. We do not collect Google Ads click identifiers (gclid), Meta click identifiers (fbclid) or any equivalent advertising click identifier. 3.5 Server logs and security Categories of data IP address; date and time of the request; the address requested; HTTP status; browser and operating system identification string (user agent) Purpose Delivering the Website, maintaining its availability and integrity, diagnosing faults, and detecting and preventing abuse and attacks Legal basis Article 6(1)(f) GDPR - our legitimate interest in operating a secure and functioning website, and the legitimate interest of our hosting and content delivery providers in the same Retention For the period applied by the relevant infrastructure provider, in each case not exceeding 12 months 3.6 Administrator accounts Access to the Website's editorial interface is restricted to Parkl personnel and authorised contributors, who log in with an individual account. We process their name, e-mail address, authentication data and activity records on the basis of Article 6(1)(b) and Article 6(1)(f) GDPR, for the term of the authorisation and 1 year thereafter. 3.7 What we do not do We do not carry out automated decision-making producing legal effects or similarly significant effects, and we do not carry out profiling, in connection with this Website. We do not process special categories of personal data. We do not knowingly process the personal data of children - the Website is addressed exclusively to businesses. 4. Where the data comes from All personal data we process in connection with the Website is provided directly by you. We do not purchase contact lists, and we do not enrich your submission with data obtained from third-party data brokers. If you submit the details of another person - for example a colleague as the designated contact - you are responsible for having a lawful basis for doing so and for informing that person of this Notice. 5. Recipients and processors Your data is used by Parkl and by nobody else. We do not sell personal data. We do not rent, exchange or share it with any third party for that party's own purposes. We do not pass it to advertising networks, data brokers or list vendors. No one outside Parkl decides what happens to it. What we do have - as any company running a website does - is a small number of IT service providers whose systems the data physically passes through or sits in. They are processors in the sense of Article 28 GDPR: they act only on our documented written instructions, they may not use the data for their own purposes, they are bound by confidentiality, and they must delete or return it when our contract with them ends. Article 13(1)(e) GDPR requires us to tell you who they are, so we do. Recipient Role Data concerned Location of processing Lovable (application platform) Hosting of the Website application and delivery of transactional e-mail All data submitted through the Website EU Supabase Database and authentication service storing form submissions and administrator accounts All data submitted through the Website EU region; parent company established in the USA Cloudflare Edge delivery, DNS and protection Technical connection data, IP address Global edge network; parent company Recipient Role Data concerned against denial-ofservice attacks Location of processing established in the USA HubSpot Customer relationship management; receipt of Fleet registrations and sending of confirmation messages Fleet registration data and marketing consent records EU (EU1 data region); parent company established in the USA Our personnel Assessment of and response to enquiries As necessary for the purpose Hungary Advisers and authorities Legal, accounting and audit advisers; courts and public authorities where we are under a legal obligation to disclose As necessary or as required by law EU To be confirmed before publication. The exact corporate names, registered addresses and applicable transfer mechanisms of the above providers must be taken from the data processing agreements actually in force between Parkl and each provider, and inserted here. Do not publish this table with generic descriptions. Transfers outside the European Economic Area. Our providers store the data relating to the Website inside the European Economic Area. Some of them are, however, part of corporate groups established in the United States, and remote access from outside the EEA cannot be excluded, for example for support purposes. Where such a transfer occurs, it takes place on the basis of the European Commission's adequacy decision on the EU-US Data Privacy Framework, where the recipient is certified under it, or on the basis of the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, supplemented where necessary by additional safeguards. You may request a copy of the relevant safeguards from us. 6. Security We apply technical and organisational measures appropriate to the risk, including transport encryption for all traffic to and from the Website, encryption of data at rest, rowlevel access control in the database, individual accounts with role-based permissions for administrative access, and restriction of access to personal data to those personnel who need it for a defined purpose. No measure eliminates risk entirely. If a personal data breach occurs, we notify the competent supervisory authority within 72 hours of becoming aware of it, we keep a record of the breach, and we inform affected data subjects where the law requires it. 7. Your rights Under Articles 15 to 22 GDPR you have the right: • of access - to obtain confirmation as to whether we process personal data concerning you, and a copy of that data; to rectification - to have inaccurate data corrected and incomplete data completed; • to erasure - to have your data deleted where one of the grounds in Article 17 applies; • to restriction of processing - in the cases listed in Article 18; • to data portability - to receive the data you provided to us in a structured, • commonly used, machine-readable format, and to have it transmitted to another controller, where the processing is based on consent or on a contract and is carried out by automated means; • to object - at any time, on grounds relating to your particular situation, to processing • to withdraw consent - at any time, where the processing is based on your consent based on our legitimate interest (Sections 3.4, 3.5 and 3.6 above). If you object, we will cease the processing unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms; (Section 3.3). How to exercise them. Write to info@parkl.net, or to Parkl Digital Technologies Kft., 1051 Budapest, Arany János utca 15., 1st floor, door 6, Hungary. We may ask you for information reasonably necessary to confirm your identity. We respond without undue delay and in any event within one month of receipt of the request; this period may be extended by two further months where necessary, taking into account the complexity and number of requests, in which case we inform you of the extension and its reasons within one month. Exercising these rights is free of charge. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, we may charge a reasonable fee or refuse to act, giving reasons. If we do not act on your request, we inform you within one month of the reasons, and of your right to lodge a complaint with a supervisory authority and to seek a judicial remedy. 8. Complaints and remedies If you believe that our processing of your personal data infringes the law, please contact us first at info@parkl.net - most issues are resolved fastest that way. You also have the right to lodge a complaint with a supervisory authority. As our seat is in Hungary, our lead supervisory authority is: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) Postal address: 1363 Budapest, Pf. 9, Hungary Website: https://naih.hu E-mail: ugyfelszolgalat@naih.hu Telephone: +36 1 391 1400 You may equally lodge a complaint with the supervisory authority of the Member State of your habitual residence or place of work, for example: • Poland - Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 • Czech Republic - Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 • Austria - Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Wien, • Germany - the data protection authority of the relevant federal state; a list is Warszawa, https://uodo.gov.pl Praha 7, https://uoou.gov.cz https://dsb.gv.at maintained at https://www.bfdi.bund.de You may also bring proceedings before the courts. In Hungary, proceedings may be brought before the Metropolitan Court of Budapest (Fővárosi Törvényszék) or before the court having jurisdiction over your place of residence. 9. Changes to this Notice We may amend this Notice, in particular if our processing activities change or if a new service is added to the Website. The current version is always available at https://parkl.eu/privacy/en, and the date of entry into force is shown at the top. Where an amendment materially affects data subjects whose contact details we hold, we notify them by e-mail at least 30 days before the amendment takes effect. 10. Applicable law This Notice and the processing described in it are governed by the GDPR, by Hungarian Act CXII of 2011 (Infotv.), by Hungarian Act CVIII of 2001 on electronic commerce services ("Elkertv."), by Hungarian Act XLVIII of 2008 on the basic conditions of and certain restrictions on commercial advertising activity ("Grt."), and by the applicable national implementations of Directive 2002/58/EC where they apply to the visitor's terminal equipment.