Privacy and Data Processing Notice

Qard™ SaaS platform

Effective date:

Qard™ is a multi-tenant, cloud-based software-as-a-service (SaaS) platform operated and developed by Qilaq Solutions Kft. This notice explains the general data protection framework that applies at platform level.

Important: each organisation using Qard™ (a tenant) may independently determine the purposes and details of processing within its segregated environment. The tenant’s own privacy notice provides the specific information about that tenant’s processing activities. This platform-level notice does not replace it.

1. Platform operator

Qilaq Solutions Kft.
Registered office and postal address: 8623 Balatonföldvár, Móricz Zs. u. 26/b/3., Hungary
Email: info@qilaq.hu
Web: www.qilaq.hu

2. Controller and processor roles

  • The tenant generally acts as controller when it determines which personal data relating to its customers, members, employees, partners or other individuals is processed in Qard™, for what purposes, on which legal basis and for how long.
  • Qilaq Solutions Kft. generally acts as processor for processing determined by a tenant, operating the platform under the tenant’s documented instructions and the agreement concluded with that tenant.
  • Qilaq Solutions Kft. may act as an independent controller for limited activities whose purposes it determines itself, such as administering the service contract and tenant administrator accounts, providing support, maintaining information security, preventing abuse and complying with legal obligations.

3. Categories of data that may be processed

The actual data depends on the modules and settings selected by the tenant. In particular, Qard™ may process:

  • identity, contact, account and authorisation data;
  • membership, card, loyalty programme, ticketing, booking, purchase or transaction data connected with the tenant’s services;
  • content, messages and consent information submitted by an individual or the tenant;
  • technical data such as IP address, device and browser information, timestamps, session and authentication data, security logs and application logs;
  • business contact details and correspondence required for the service agreement, billing and support.

4. Purposes and legal bases

The tenant’s own privacy notice describes the purposes and legal bases determined by that tenant. Typical purposes and legal bases for Qilaq Solutions Kft.’s own processing are:

  • providing the SaaS service, administering user accounts and access, and supplying customer support – performance of a contract or a legitimate interest connected with the contractual relationship;
  • protecting the security, availability and reliable operation of the platform, including logging and the prevention of abuse and incidents – legitimate interests;
  • meeting accounting, regulatory and other statutory requirements – compliance with legal obligations;
  • establishing, exercising or defending legal claims – legitimate interests.

5. Sources and access

Data may be obtained directly from the individual, from the tenant, from an integration authorised by the tenant, or from technical logs generated during normal system operation. Tenant data may be accessed by authorised tenant users and by authorised personnel and contracted processors of Qilaq Solutions Kft., in each case only to the extent necessary for their duties.

6. Disclosures and subprocessors

Hosting, infrastructure, communications, support or other technical providers may be used to operate the service. The relevant agreements with the tenant and the tenant’s privacy notice identify the specific recipients and processors and the conditions of any transfer to a third country. Personal data may be transferred to a third country only under conditions permitted by applicable data protection law.

7. Retention

The tenant determines the retention period for tenant-controlled data according to its purposes, legal bases and statutory duties. Qilaq Solutions Kft. retains contractual, support, security and billing data processed for its own purposes for the duration of the service relationship and afterwards only for the period required by law or necessary for legal claims. The service agreement and applicable law govern the return, deletion or further retention of tenant data.

8. Cookies and similar technologies

Qard™ public and sign-in interfaces may use session, language, authentication and security cookies necessary for operation. A tenant’s cookie and privacy notices describe any additional technologies used on that tenant’s websites, such as analytics or marketing technologies, and the choices available to individuals.

9. Data security

Qilaq Solutions Kft. protects data processed on the platform through technical and organisational measures appropriate to the risks. These may include access controls, authorisation management, logging, backup and recovery procedures, and security-event and personal-data-breach management. Each tenant is responsible for appropriately configuring its own users, permissions, settings and processing activities.

10. Individual rights

Subject to the conditions of applicable data protection law, individuals may request access to, rectification or erasure of their personal data, restriction of processing or data portability, and may object to processing. Where processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

A request concerning processing determined by a tenant should first be sent to that tenant, because the tenant makes the relevant processing decisions and is responsible for responding. If the individual cannot identify the tenant, or the matter directly concerns processing for which Qilaq Solutions Kft. is the controller, assistance may be requested at info@qilaq.hu. When acting as processor, Qilaq Solutions Kft. will refer the request to the relevant tenant where appropriate.

11. Complaints and legal remedies

Individuals may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) and may seek a judicial remedy.

Hungarian National Authority for Data Protection and Freedom of Information
Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary
Postal address: 1363 Budapest, PO Box 9, Hungary
Web: www.naih.hu

12. Changes to this notice

Qilaq Solutions Kft. may update this notice when the service, processing circumstances or legal environment changes. The current version will remain available on this page together with its effective date.