In short: we only ask for the data needed for the rental, the payment and the receipt: for the rental, only your phone number. We never see or store your card number. We don't sell your data or use it for advertising, and venues get no individual data about you. Our server is in Hungary, and the website's traffic is protected by Cloudflare (see below).
Controller
- Name
- Illés Dániel e.v. (sole trader, trading as PLUG)
- Registered and postal address
- 1112 Budapest, Kányakapu utca 17.
- Sole trader registration no.
- [nyilvántartási szám] (Hungarian register of sole traders)
- Tax number
- [adószám]
- [email protected]
- Phone
- +36 70 225 8783
- Website
- https://www.plughungary.com
Contact us about data protection at the email or postal address above. We are not required to appoint a data protection officer.
What data we process, why and for how long
a) Visiting the website
| Data | IP address, time of visit, page address, browser and operating system type (server log). |
|---|---|
| Purpose | Running the website securely, detecting errors and attacks. |
| Legal basis | Legitimate interest (Article 6(1)(f) GDPR): security of the service. |
| Retention | 30 days, then deleted automatically. |
The website uses no analytics or advertising cookies and loads no fonts or other content from third parties. See the Cookie Notice. The website's traffic passes through the network of Cloudflare, Inc. (content delivery, protection against overload and other attacks); Cloudflare processes the IP address and technical request data for this as our processor.
If you scan the QR code with the camera in the browser on the Rental page, your phone processes the camera image locally: it never reaches us and we don't store it.
b) Rentals
| Data | Mobile number; Rental ID; rental data (Station, Powerbank ID, release and return time, fees paid, surcharge, refunds); transaction and card token from the payment provider, card type and last four digits; IP address and device type when opening the Rental page. |
|---|---|
| Purpose | Concluding and performing the rental contract, charging fees and the surcharge after 5 days, refunds, texting the Rental ID and notifications about the rental, closing the rental automatically on return, showing the rental status. |
| Legal basis | Performance of a contract (Article 6(1)(b) GDPR). |
| Retention | 5 years from the end of the rental (general limitation period under the Hungarian Civil Code); for accounting records see c). |
c) Receipts, invoices, accounting
| Data | Phone number (to deliver the receipt by text message), receipt data (amount, time, ID); for invoices, billing name and address. |
|---|---|
| Purpose | Issuing receipts and invoices, reporting to the tax authority, accounting. |
| Legal basis | Legal obligation (Article 6(1)(c) GDPR): Hungarian VAT Act (Act CXXVII of 2007) and Accounting Act (Act C of 2000, section 169). |
| Retention | 8 years from issuing the document. |
d) Fraud prevention
| Data | Type of payment method (e.g. disposable or virtual card), failed payments and rental attempts, IP address, rental history; technical data collected on the website by the fraud-prevention code of Barion Payment Inc. (Base Barion Pixel). |
|---|---|
| Purpose | Preventing theft of Powerbanks, payment fraud, mass automated (bot) rental attempts and abuse of text messaging. |
| Legal basis | Legitimate interest (Article 6(1)(f) GDPR): protecting our property and secure card payments. |
| Retention | Up to 1 year from the end of the rental; if misuse is suspected, until the case is closed. |
The system may automatically refuse certain payment methods. If you think this was a mistake, you can ask customer service for human review of the decision and express your point of view.
e) Contacting us
| Data | Name (if given), email address, phone number, content of the message, related rental data. |
|---|---|
| Purpose | Answering questions, handling enquiries from venues. |
| Legal basis | Legitimate interest (Article 6(1)(f) GDPR) or steps prior to a contract (Article 6(1)(b)). |
| Retention | 1 year after the matter is closed. |
f) Complaints
| Data | Name, contact details, content of the complaint, the complaint record and our reply. |
|---|---|
| Purpose | Investigating and answering consumer complaints. |
| Legal basis | Legal obligation (Article 6(1)(c) GDPR): section 17/A of Hungarian Act CLV of 1997 on consumer protection. |
| Retention | The period required by section 17/A of that Act. |
g) Withdrawal from the contract (online function)
| Data | Name, Rental ID, the phone number given for the acknowledgement, your note (if any), the content of the notice and the date and time it was received. |
|---|---|
| Purpose | Receiving the withdrawal or termination notice, closing the rental, sending the acknowledgement of receipt and settling the account. |
| Legal basis | Legal obligation (Article 6(1)(c) GDPR): section 22 of Hungarian Government Decree 45/2014 (II.26.). |
| Retention | 5 years from receipt of the notice (general limitation period under the Hungarian Civil Code). |
h) Newsletters, marketing
We currently send no newsletters or marketing messages. If we introduce them, we will only do so with your prior, express consent, which you can withdraw at any time.
Who receives the data
Only the PLUG founders can access the data, to the extent their tasks require. We do not sell data. The following recipients receive part of it:
| Recipient | Role | Data |
|---|---|---|
| Barion Payment Inc. (H-1117 Budapest, Irinyi József utca 4–20. 2nd floor; reg. no. 01-10-048552; MNB licence H-EN-I-1064/2013) | Independent controller: payment provider | Amount, rental and transaction ID and, where needed for the card security check (3D Secure), the phone number; card data is collected by Barion directly from you. Technical data of the Base Barion Pixel on the website. See barion.com |
| KBOSS.hu Kft. (Számlázz.hu; H-1031 Budapest, Záhony utca 7.; reg. no. 01-09-303201) | Processor: receipts, invoices, tax authority reporting | Receipt/invoice data (it does not receive the phone number) |
| [SMS-szolgáltató neve] ([SMS-szolgáltató címe]) | Processor: text messaging | Phone number and message content (Rental ID, notifications, link to the receipt, withdrawal acknowledgement) |
| Hungarian Tax and Customs Administration (NAV) | Authority | Legally required receipt and invoice data |
| Google Ireland Limited (Gmail) (Gordon House, Barrow Street, Dublin 4, Írország) | Processor: email service | Our correspondence with you |
| Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA) | Processor: content delivery, attack protection | IP address, technical request data |
| Accountant (if engaged) | Processor: accounting | Accounting document data |
| Courts, authorities, legal representatives | Recipients where required by law or to enforce claims | Data needed for the case |
Venues only receive aggregated revenue data that cannot be linked to you. The Station manufacturer receives no personal data about you: the system runs on our own server.
Storage and security
- The website and rental system are stored on our own server located in Hungary. We do not transfer data outside the European Union, except to Cloudflare, Inc. (USA), which processes it under its EU–U.S. Data Privacy Framework certification and the standard contractual clauses adopted by the European Commission (Article 46 GDPR).
- Data is transmitted over encrypted (HTTPS) connections, server access requires a password and two-factor authentication, the system is updated regularly and backed up. The website runs with a strict content security policy (CSP), loads no third-party tracking code, and never stores your full phone number in your browser. The Rental ID is a random code that is hard to guess; the server limits and logs actions made with it.
- We report personal data breaches to the Hungarian supervisory authority within 72 hours, and notify you if the breach is likely to result in a high risk to you.
Your rights
- Access to your data and a copy of it (Article 15).
- Rectification of inaccurate data (Article 16).
- Erasure when we no longer need the data and no law requires us to keep it (Article 17).
- Restriction of processing (Article 18).
- Data portability for data processed under the contract (Article 20).
- Objection to processing based on legitimate interest (Article 21).
- Withdrawal of consent at any time, where processing is based on consent.
We reply within one month, which may be extended by two months where justified; we will tell you if so. Replies are free of charge. We may verify your identity first (for example with a code texted to the phone number used for the rental and the Rental ID).
Remedies
If you believe we process your data unlawfully, please contact us first. You can also complain to the Hungarian supervisory authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), H-1055 Budapest, Falk Miksa utca 9–11.; postal address: H-1363 Budapest, Pf. 9.; phone: +36 1 391 1400; email: [email protected]; naih.hu. If you live in another EU country, you can also complain to your own country's authority. You may also go to court; in Hungary the case can be brought before the regional court of your place of residence.
Changes
We may update this notice when the law or the service changes. The current version is always on this page; we also announce significant changes on the Rental page.