Privacy Notice
Parkl Digital Technologies Kft.
Effective from: 17 August 2026
Version: 1.1
This Privacy Notice explains how Parkl Digital Technologies Kft. (registered seat: 1051 Budapest, Arany János utca 15. 1/6. 1st floor, Hungary) processes personal data in connection with the website available at https://parkl.eu (the "Website"), in accordance with Regulation (EU) 2016/679 (the "GDPR") and Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information ("Infotv.").
Scope. This Notice covers the Website only. The Parkl mobile application, the Parkl system and the parking and e-mobility services provided through them are governed by a separate privacy policy available at https://parkl.net/en/policy, together with the General Terms and Conditions ("GTC") and the Corporate Terms and Conditions ("CTC").
1. Who we are
| Controller | Parkl Digital Technologies Kft. |
| Registered seat | 1051 Budapest, Arany János utca 15., 1st floor, door 6, Hungary |
| Company registration number | 01 09 712422 |
| Tax number | 12967726241 |
| Registering authority | Metropolitan Court of Budapest as Court of Registration (Fővárosi Törvényszék Cégbírósága) |
| info@parkl.net | |
| Telephone | +36 1 8555 777 |
| Website | https://parkl.eu |
In this Notice, "we", "us" and "our" refer to the Controller.
We have not appointed a Data Protection Officer. Our core activities do not consist of processing operations that require regular and systematic monitoring of data subjects on a large scale, and we do not process special categories of personal data or data relating to criminal convictions.
2. What we do - and do not do - on this Website
We consider it important to state plainly what the Website does, because it is unusually restrained compared to most commercial websites.
We do not use:
- Google Analytics, Google Tag Manager or any other web analytics tool
- the Meta (Facebook) pixel, the LinkedIn Insight Tag or any other advertising pixel
- remarketing or retargeting technologies
- visitor identification or IP-to-company lookup services
- a consent management platform or a cookie banner - because nothing on the Website requires consent under Article 5(3) of Directive 2002/58/EC
We do process:
- the information you type into a form and deliberately submit to us
- the campaign parameters present in the address of the page you arrived on, attached to that submission
- the technical log data that any web server necessarily generates in order to deliver a page
3. Processing activities
3.0 Two things that apply to everything below
Giving us your data is voluntary. Nobody is obliged to complete a form on this Website. You decide whether to write to us, what to write, and how much to tell us about yourself.
Filling in a form and pressing the submit button is a deliberate act on your part, and it is the only way personal data about you reaches us from this Website - we do not collect it in the background, and we do not obtain it from anyone else.
Because you contact us in order to receive something from us - an answer, a quotation, a demonstration, a corporate account - the law treats that as a request by you to take steps towards a contract, and that is the legal basis on which we act (Article 6(1)(b) GDPR). We deliberately do *not* dress this up as "consent", because consent that you cannot refuse without losing the service is not valid consent under Article 7(4) GDPR. The one thing we genuinely ask your consent for is marketing e-mail, and that is a separate, optional, non-pre-ticked box which you may leave empty and still register or send your enquiry (Section 3.3).
How long we keep it: five years, as a rule. We retain the data you submit through a form for 5 years, counted from your submission or, where a business relationship develops, from the end of that relationship. Five years is the general limitation period for civil claims under Section 6:22 of Act V of 2013 on the Civil Code, and it is the period during which a claim connected with our dealings could still be brought by either side.
There is one exception, and it is longer, not shorter: data that appears on an accounting document - typically an invoice and the company and contact details on it - must be retained for 8 years under Section 169 of Act C of 2000 on Accounting. This is a legal obligation on us (Article 6(1)(c) GDPR); we cannot shorten it, and we cannot delete such data on request before it expires.
Two categories sit outside this rule, both of them shorter: technical server logs, which are generated and held by our infrastructure providers rather than submitted by you (Section 3.5), and the records of our own staff's administrator accounts (Section 3.6). Marketing consent works differently again - it lasts until you withdraw it, and not a day longer (Section 3.3).
3.1 Business enquiries submitted through the contact form
| Categories of data | First name and last name; company name; job title (optional); e-mail address; telephone number (optional); number/location of sites (optional); area of interest; free-text message (optional) |
| Purpose | Receiving, assessing and answering your enquiry; taking steps at your request prior to entering into a contract; where relevant, preparing a quotation or arranging a demonstration |
| Legal basis | Article 6(1)(b) GDPR - steps taken at the request of the data subject prior to entering into a contract. Where you contact us on behalf of an organisation and are not personally a party to the prospective contract, Article 6(1)(f) GDPR - our legitimate interest in responding to business enquiries addressed to us |
| Retention | 5 years from your submission, or, where a business relationship develops from it, 5 years from the end of that relationship |
| Consequence of not providing | Completing the form is voluntary. If you do complete it, first name, last name, company, e-mail address and area of interest are required in order for us to be able to answer you; the remaining fields are optional and may be left empty |
Your enquiry is transmitted from your browser directly to HubSpot, which we use as our customer relationship management system; HubSpot then notifies our sales team of the submission. The data does not pass through, and is not stored in, the Website's own database. See Section 5.
3.2 Parkl Fleet registration
| Categories of data | Contact person's first and last name, e-mail address, telephone number; company name, company registration number, tax number, country, postcode, city and street address; number of users to be managed; selected payment mode; selected functions; how you heard about us; discount code, if any |
| Purpose | Processing your application for the Parkl Fleet corporate service, verifying eligibility, setting up the corporate account, and contacting you in order to conclude the contract |
| Legal basis | Article 6(1)(b) GDPR - steps taken at the request of the data subject prior to entering into a contract, and performance of that contract once concluded |
| Retention | 5 years from your submission, or, where a contract is concluded, 5 years from the end of the contract (Section 6:22 of Act V of 2013 on the Civil Code). Data appearing on accounting documents is retained for 8 years, as required by Section 169 of Act C of 2000 on Accounting |
| Consequence of not providing | Registration is voluntary. The fields marked as required in the form are needed in order to set up a corporate account and to invoice correctly; without them the application cannot be processed |
Company identifiers such as the company registration number and tax number are not personal data in themselves; the name, e-mail address and telephone number of the contact person are.
Registration data is transmitted to HubSpot, which we use as our customer relationship management system, and a confirmation message is sent to the e-mail address you provide. See Section 5.
3.2.1 Parkl Fleet follow-up questionnaire
| Categories of data | Contact person's name and e-mail address; company name; average monthly parking spend; number of vehicles in the fleet; expected number of users; vehicle types in the fleet (internal combustion, electric and plug-in hybrid cars, internal combustion and electric trucks); whether on-site charging is possible at the premises; intention to expand the electric fleet; plans to install or extend charging infrastructure; the office building where the company is headquartered; the services requested; acceptance of the Corporate Terms and Conditions (VSZF) and whether an acceptance declaration was requested; ability to receive electronic invoices and, if not, acceptance of PDF invoices; the e-mail address for invoicing; acceptance of the 15-day payment term; the e-mail address for the administrator invitation |
| Purpose | Assessing the corporate requirement in detail, preparing the corporate account and its permissions, and agreeing the billing and contractual arrangements |
| Legal basis | Article 6(1)(b) GDPR - steps taken at the request of the data subject prior to entering into a contract, and performance of that contract once concluded |
| Retention | 5 years from your submission, or, where a contract is concluded, 5 years from the end of the contract (Section 6:22 of Act V of 2013 on the Civil Code). Data appearing on accounting documents is retained for 8 years, as required by Section 169 of Act C of 2000 on Accounting |
| Consequence of not providing | Completing the questionnaire is voluntary. The fields marked as required are needed in order to configure the corporate account and to invoice correctly |
The questionnaire responses are transmitted to HubSpot and recorded against the company's record there. See Section 5.
3.3 Marketing communications
| Categories of data | Name; e-mail address; the exact wording of the consent statement displayed to you and the fact and time of your consent |
| Purpose | Sending you information about Parkl's services, offers, product developments and events by electronic mail |
| Legal basis | Article 6(1)(a) GDPR - your consent, given by ticking the dedicated, separate, optional and non-pre-ticked box during Parkl Fleet registration or on the contact form. Consent is never a condition of registration, of sending an enquiry, or of any service |
| Retention | Until you withdraw your consent, and thereafter only the record of the consent and its withdrawal, for as long as needed to demonstrate compliance |
You may withdraw your consent at any time, without giving reasons and free of charge, by using the unsubscribe link in any message or by writing to info@parkl.net. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
3.4 Campaign attribution
| Categories of data | The utm_source, utm_medium, utm_campaign, utm_term and utm_content parameters present in the address of the page through which you reached the Website; the full address of that page; the address of the referring page reported by your browser |
| Purpose | Understanding which campaign, channel or referring site produced a given enquiry, so that we can allocate our marketing budget sensibly |
| Legal basis | Article 6(1)(f) GDPR - our legitimate interest in measuring the effectiveness of our own marketing. We have carried out a balancing test and concluded that the processing is limited, foreseeable and low-impact: these values are recorded only if and when you decide to submit a form, they are stored alongside the submission you have chosen to send us, and they are not used to build a profile or to track you across other websites. The documentation of the balancing test is available on request |
| Retention | Together with, and for the same period as, the submission to which they relate |
The first-touch campaign parameters are held only in the browser's memory, for the lifetime of the page's JavaScript context. They survive navigation between pages of the Website, but are lost on a full page reload or in a new tab. The values are transmitted only at the moment a form is submitted, together with the data you submit, to HubSpot. Nothing is stored on your device for this purpose - no cookie, no sessionStorage, no localStorage and no IndexedDB. This applies equally to the contact form and to the Parkl Fleet registration form.
This is why the Website does not display a cookie banner. We do not collect Google Ads click identifiers (gclid), Meta click identifiers (fbclid) or any equivalent advertising click identifier.
3.5 Server logs and security
| Categories of data | IP address; date and time of the request; the address requested; HTTP status; browser and operating system identification string (user agent) |
| Purpose | Delivering the Website, maintaining its availability and integrity, diagnosing faults, and detecting and preventing abuse and attacks |
| Legal basis | Article 6(1)(f) GDPR - our legitimate interest in operating a secure and functioning website, and the legitimate interest of our hosting and content delivery providers in the same |
| Retention | For the period applied by the relevant infrastructure provider, in each case not exceeding 12 months |
3.6 Administrator accounts
Access to the Website's editorial interface is restricted to Parkl personnel and authorised contributors, who log in with an individual account. We process their name, e-mail address, authentication data and activity records on the basis of Article 6(1)(b) and Article 6(1)(f) GDPR, for the term of the authorisation and 1 year thereafter. We keep a technical log of the delivery of authentication e-mails, containing the recipient's e-mail address, the message type and the delivery outcome; that log is deleted automatically after 12 months.
3.7 What we do not do
We do not carry out automated decision-making producing legal effects or similarly significant effects, and we do not carry out profiling, in connection with this Website. We do not process special categories of personal data. We do not knowingly process the personal data of children - the Website is addressed exclusively to businesses.
4. Where the data comes from
All personal data we process in connection with the Website is provided directly by you. We do not purchase contact lists, and we do not enrich your submission with data obtained from third-party data brokers.
If you submit the details of another person - for example a colleague as the designated contact - you are responsible for having a lawful basis for doing so and for informing that person of this Notice.
5. Recipients and processors
Your data is used by Parkl and by nobody else. We do not sell personal data. We do not rent, exchange or share it with any third party for that party's own purposes. We do not pass it to advertising networks, data brokers or list vendors. No one outside Parkl decides what happens to it.
What we do have - as any company running a website does - is a small number of IT service providers whose systems the data physically passes through or sits in. They are processors in the sense of Article 28 GDPR: they act only on our documented written instructions, they may not use the data for their own purposes, they are bound by confidentiality, and they must delete or return it when our contract with them ends. Article 13(1)(e) GDPR requires us to tell you who they are, so we do.
| Recipient | Role | Data concerned | Location of processing |
|---|---|---|---|
| Lovable Labs AB (Regeringsgatan 25, 111 53 Stockholm, Sweden) - application platform | Hosting of the Website application and delivery of administrator authentication e-mails | Technical connection data, IP address; administrator e-mail addresses | EU |
| SUPABASE PTE. LTD (65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513) | Database and authentication service storing administrator accounts and the delivery log of administrator authentication e-mails | Administrator accounts and the related e-mail delivery log | EU region for data storage; company established in Singapore |
| Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, United States) | Edge delivery, DNS and protection against denial-of-service attacks | Technical connection data, IP address | Global edge network; parent company established in the USA |
| HubSpot Ireland Limited (HubSpot House, 1 Sir John Rogerson's Quay, Dublin 2, D02 CR67, Ireland). Sub-processor: Amazon Web Services EMEA SARL (38 Avenue John F. Kennedy, L-1855, Luxembourg) - HubSpot's sub-processor, providing the EU (Frankfurt) hosting infrastructure. | Customer relationship management; receipt of contact-form enquiries and of Fleet registrations, and sending of confirmation and notification messages | Data submitted through the contact form and the Fleet registration, follow-up questionnaire answers, and marketing consent records | The contracting entity is established in Ireland, within the EEA; the data is hosted in the European Union, in the Frankfurt (Germany) region; the group's ultimate parent is established in the United States, so remote access from outside the EEA - for example for support purposes - cannot be excluded |
| Our personnel | Assessment of and response to enquiries | As necessary for the purpose | Hungary |
| Advisers and authorities | Legal, accounting and audit advisers; courts and public authorities where we are under a legal obligation to disclose | As necessary or as required by law | EU |
Sub-processors. The processors listed above may engage sub-processors in accordance with Article 28(2)-(4) GDPR; where they do so, they remain fully liable to us for the performance of those sub-processors' obligations. Amazon Web Services EMEA SARL is named explicitly above because it underpins the EU hosting assurance given for HubSpot; a current list of the sub-processors used by any given provider is available from us on request.
Transfers outside the European Economic Area. Our providers store the data relating to the Website inside the European Economic Area. Some of them are, however, established in third countries outside the EEA, including the United States and Singapore, and remote access from outside the EEA cannot be excluded, for example for support purposes. Where such a transfer occurs, it takes place on the basis of the European Commission's adequacy decision on the EU-US Data Privacy Framework, where the recipient is certified under it, or on the basis of the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, supplemented where necessary by additional safeguards. You may request a copy of the relevant safeguards from us.
6. Security
We apply technical and organisational measures appropriate to the risk, including transport encryption for all traffic to and from the Website, encryption of data at rest, row-level access control in the database, individual accounts with role-based permissions for administrative access, and restriction of access to personal data to those personnel who need it for a defined purpose.
No measure eliminates risk entirely. If a personal data breach occurs, we notify the competent supervisory authority within 72 hours of becoming aware of it, we keep a record of the breach, and we inform affected data subjects where the law requires it.
7. Your rights
Under Articles 15 to 22 GDPR you have the right:
- of access - to obtain confirmation as to whether we process personal data concerning you, and a copy of that data;
- to rectification - to have inaccurate data corrected and incomplete data completed;
- to erasure - to have your data deleted where one of the grounds in Article 17 applies;
- to restriction of processing - in the cases listed in Article 18;
- to data portability - to receive the data you provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller, where the processing is based on consent or on a contract and is carried out by automated means;
- to object - at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Sections 3.4, 3.5 and 3.6 above). If you object, we will cease the processing unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms;
- to withdraw consent - at any time, where the processing is based on your consent (Section 3.3).
How to exercise them. Write to info@parkl.net, or to Parkl Digital Technologies Kft., 1051 Budapest, Arany János utca 15., 1st floor, door 6, Hungary. We may ask you for information reasonably necessary to confirm your identity. We respond without undue delay and in any event within one month of receipt of the request; this period may be extended by two further months where necessary, taking into account the complexity and number of requests, in which case we inform you of the extension and its reasons within one month.
Exercising these rights is free of charge. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, we may charge a reasonable fee or refuse to act, giving reasons.
If we do not act on your request, we inform you within one month of the reasons, and of your right to lodge a complaint with a supervisory authority and to seek a judicial remedy.
8. Complaints and remedies
If you believe that our processing of your personal data infringes the law, please contact us first at info@parkl.net - most issues are resolved fastest that way.
You also have the right to lodge a complaint with a supervisory authority. As our seat is in Hungary, our lead supervisory authority is:
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) Postal address: 1363 Budapest, Pf. 9, Hungary Website: https://naih.hu E-mail: ugyfelszolgalat@naih.hu Telephone: +36 1 391 1400
You may equally lodge a complaint with the supervisory authority of the Member State of your habitual residence or place of work, for example:
- Poland - Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, https://uodo.gov.pl
- Czech Republic - Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, https://uoou.gov.cz
- Austria - Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Wien, https://dsb.gv.at
- Germany - the data protection authority of the relevant federal state; a list is maintained at https://www.bfdi.bund.de
You may also bring proceedings before the courts. In Hungary, proceedings may be brought before the Metropolitan Court of Budapest (Fővárosi Törvényszék) or before the court having jurisdiction over your place of residence.
9. Changes to this Notice
We may amend this Notice, in particular if our processing activities change or if a new service is added to the Website. The current version is always available at https://parkl.eu/privacy/en, and the date of entry into force is shown at the top.
Where an amendment materially affects data subjects whose contact details we hold, we notify them by e-mail at least 30 days before the amendment takes effect.
10. Applicable law
This Notice and the processing described in it are governed by the GDPR, by Hungarian Act CXII of 2011 (Infotv.), by Hungarian Act CVIII of 2001 on electronic commerce services ("Elkertv."), by Hungarian Act XLVIII of 2008 on the basic conditions of and certain restrictions on commercial advertising activity ("Grt."), and by the applicable national implementations of Directive 2002/58/EC where they apply to the visitor's terminal equipment.