+36 1 317 8570
info@helpers.hu
Monday - Friday
9am - 5pm CET
Helpers Hungary Kft
Budapart Gate
Dombóvári út 27
Budapest 1117, Hungary
If you’re visiting us, please use entrance A and come to the 2nd floor.
Monday - Friday
9am - 5pm CET
Helpers Hungary Kft
Budapart Gate
Dombóvári út 27
Budapest 1117, Hungary
If you’re visiting us, please use entrance A and come to the 2nd floor.
This summary briefly explains how Helpers Hungary Kft. processes personal data relating to prospective and current clients, website visitors, newsletter subscribers, corporate contact persons and other individuals connected with the services described below. The Full Customer and Online Privacy Notice follows this summary.
The controller is Helpers Hungary Kft. (registered office: 1094 Budapest, Tompa utca 9, 5th floor, door 3; company registration number: 01-09-869492; tax number: 13715065-2-43; “Helpers Hungary”, the “Company” or “we”). For Facebook Page Insights and LinkedIn Page Insights, the Company acts as joint controller, respectively, with Meta Platforms Ireland Limited and LinkedIn Ireland Unlimited Company under the providers’ applicable Page Insights joint-controller terms. Meta and LinkedIn take primary responsibility under those terms for providing information about Page Insights processing and facilitating data-subject rights. You may nevertheless exercise your rights against either joint controller. Privacy questions and requests may be sent to privacy@helpers.hu.
We process your personal data for the following main purposes:
Data required to assess an enquiry, conclude or perform a requested service, comply with law or make a payment must be provided where indicated. Newsletter subscription, optional website technologies and meeting recording or transcription are voluntary.
Access within the Company is limited on a need-to-know basis. Depending on the service, recipients may include approved technology, communications and payment providers, Helpers Finance Kft., external lawyers, registered-office and postal providers, banks, translators, genealogists, insurers, corporate clients, agents and competent Hungarian or foreign authorities. For Facebook and LinkedIn Page Insights, the Company acts as joint controller with the relevant platform provider. Meta, LinkedIn and X also process personal data independently for their own platform purposes. Their global operations and those of other providers or case-specific recipients may involve transfers outside the European Economic Area. Transfers rely on an adequacy decision, the EU-US Data Privacy Framework where applicable, or an Article 46 GDPR safeguard, normally the European Commission Standard Contractual Clauses together with a transfer assessment and supplementary measures. Article 49 GDPR derogations are used only exceptionally. The Full Notice identifies the principal arrangements.
Where processing is based on consent, you may withdraw your consent freely at any time; withdrawal does not affect the lawfulness of processing carried out before withdrawal. You may request access to and rectification of your personal data and, within the applicable limits, erasure, restriction and data portability. For Facebook and LinkedIn Page Insights, you may exercise your rights against either the Company or the relevant joint-controller provider; requests sent to the Company will be forwarded in accordance with the applicable arrangement. The exercise of these rights is free of charge.
YOU HAVE THE RIGHT, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO OBJECT AT ANY TIME TO PROCESSING BASED ON THE COMPANY’S LEGITIMATE INTERESTS. WHERE YOU VALIDLY OBJECT, WE WILL STOP THE PROCESSING UNLESS WE DEMONSTRATE COMPELLING LEGITIMATE GROUNDS OR THE PROCESSING IS NECESSARY FOR LEGAL CLAIMS.
You may seek judicial remedy and lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH; address: 1055 Budapest, Falk Miksa utca 9-11.; email: ugyfelszolgalat@naih.hu; website: www.naih.hu).
For further information, please read the Full Customer and Online Privacy Notice below. Last updated: v2.0, October 6, 2026.
Last updated: v2.0, October 6, 2026.
This Customer and Online Privacy Notice explains how Helpers Hungary Kft. processes personal data relating to prospective and current clients, former clients, corporate contact persons, agents, representatives, family members and other persons whose information is supplied for a requested service, as well as visitors to websites operated by Helpers Hungary, newsletter subscribers and users of the Company’s social-media pages. It covers helpers.hu, hungariancitizenship.eu, companyformation.hu and goldenvisa.hu, together with forms, booking tools, payment links and other online features made available through those websites, unless a service-specific notice states otherwise. This Notice covers Helpers Hungary’s own client-contact, contracting, billing, security and compliance processing and its participation in the Page Insights joint processing described below.
The controller is Helpers Hungary Kft. (registered office: 1094 Budapest, Tompa utca 9, 5th floor, door 3; company registration number: 01-09-869492; tax number: 13715065-2-43; “Helpers Hungary”, the “Company” or “we”). Questions, requests and complaints concerning personal-data processing may be sent to privacy@helpers.hu.
For personal data processed to generate Facebook Page Insights, Helpers Hungary and Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland) act as joint controllers under Meta’s Page Insights Controller Addendum. Meta takes primary responsibility for the GDPR obligations allocated to it under that arrangement, including providing information about the processing and enabling data-subject rights. For personal data processed to generate LinkedIn Page Insights relating to members in the EEA or Switzerland, Helpers Hungary and LinkedIn Ireland Unlimited Company (Wilton Plaza, Wilton Place, Dublin 2, Ireland) act as joint controllers under LinkedIn’s Page Insights Joint Controller Addendum. LinkedIn takes responsibility for the provision of Page Insights and the GDPR obligations allocated to it under that arrangement, including information and support for data-subject rights. You may exercise your rights against either joint controller. Requests received by Helpers Hungary in relation to Page Insights will be forwarded promptly to the relevant provider and Helpers Hungary will cooperate as required by the applicable arrangement. Meta and LinkedIn remain independent controllers for their own further platform processing outside the relevant Page Insights joint processing.
We generally obtain personal data directly from you through the Company’s websites and communication channels, including forms, email, telephone and WhatsApp Business, as well as through meetings, documents and service interactions. We may also receive data from a corporate client or employer, agent, affiliate partner, authorized representative, family member, lawyer, genealogy researcher, registered-office provider, bank, translator, public register, archive, authority or other person involved in the requested service. Depending on the service, we process the following categories:
Where data are required by law, necessary to enter into or perform the requested service, or needed to make a payment, failure to provide them may prevent or delay the relevant assessment, contract, application or transaction. Optional marketing, non-essential website technologies and meeting recording or transcription may be refused without affecting the underlying service.
We process personal data only for a defined purpose and on the legal basis identified for that purpose. Depending on the processing, the legal basis is steps taken at your request before entering into a contract or performance of the contract (Article 6(1)(b) GDPR), compliance with a legal obligation (Article 6(1)(c) GDPR), the Company’s legitimate interests (Article 6(1)(f) GDPR) or your freely given consent (Article 6(1)(a) GDPR). Personal data technically indispensable for providing a website function requested by the visitor are processed under Section 13/A(3) of Act CVIII of 2001, only to the extent and for the period strictly necessary; that strictly necessary processing is not based on the Company’s legitimate interests. Special-category and criminal-offence data are processed only where the additional conditions of Articles 9 or 10 GDPR and applicable law are met.
The table links each purpose to the relevant data subjects and data categories, legal basis, retention rule and recipients. Where the Company relies on legitimate interests, the specific interest is named in the table and explained in the following section.
| Purpose and processing | Data subjects and personal data | Legal basis and specific legitimate interest | Retention | Internal access and external recipients |
| Enquiries and pre-contractual communication | – Prospective clients – Corporate contact persons, agents and authorized representatives – Name, email address, telephone number and organization – Nationality, residence or current location where relevant – Service interest, enquiry content and communications – Source, channel, timing and follow-up status | – Article 6(1)(b) GDPR: steps taken at the request of a prospective natural-person client before entering into a service contract. – Article 6(1)(f) GDPR: legitimate interest in receiving, routing and answering enquiries submitted by corporate contacts, agents, agents or other third parties and in keeping an accurate record of the enquiry. | If the enquiry does not lead to an engagement, until it is answered and closed, followed by a short follow-up period normally not exceeding six months from the last substantive contact. If an engagement begins, necessary information is transferred to the relevant service record. | – Relevant Sales or service-team personnel – Operations personnel where a central customer-contact or reception channel is used – WhatsApp Ireland Limited, where WhatsApp Business is used – Microsoft Ireland Operations Limited – Salesforce group and Salesforce CRM providers – FormAssembly, where a website or onboarding form is used – The referring agent or representative where applicable |
| Online eligibility, booking and consultations | – Prospective citizenship, immigration and business-establishment clients – Email address, name and telephone number – Nationality, residence and high-level eligibility information – Family-background and ancestor information – Language-learning willingness and service preferences – Booking, appointment, attendance and consultation notes – Family tree or supporting documents provided before a consultation | – Article 6(1)(b) GDPR: the requested preliminary assessment, booking or consultation is a pre-contractual step initiated by the data subject. – Any automated result is a preliminary informational indication only and is not a decision producing legal or similarly significant effects. | If no engagement follows, questionnaire, booking and consultation data are retained for no longer than six months after the assessment or last substantive communication. If the person proceeds, the necessary information becomes part of the relevant client file. | – Citizenship, Immigration or Business Sales personnel – Typeform S.L. where the online eligibility questionnaire is used – Microsoft Ireland Operations Limited for Bookings, Teams and email – Salesforce CRM providers – FormAssembly where follow-up or registration forms are used |
| Optional recording, transcription and AI notes | – Meeting participants who give consent – Name and contact details – Audio, video, transcript and meeting chat where enabled – AI-generated notes or summary – Meeting and device metadata | – Article 6(1)(a) GDPR: separate consent before the feature is activated. – Article 9(2)(a) GDPR where the participant knowingly discusses special-category data and gives explicit consent to its processing in the recording or transcript. | Raw recordings and transcripts are deleted after the meeting notes have been checked and finalized, normally within 30 days. Approved notes that are necessary for the requested service follow the retention period of the relevant matter. Refusal or withdrawal does not affect the consultation without recording or transcription. | – Authorized personnel participating in or documenting the meeting – Microsoft Teams or Zoom where the meeting takes place – The approved AI-assisted note-taking provider identified to participants before activation |
| Newsletter subscription and service marketing | – Newsletter subscribers – Name and email address – Country or residence and service interest where collected – Consent, subscription, delivery, open or click information where enabled – Unsubscribe and preference data | – Article 6(1)(a) GDPR: freely given consent. – Section 6 of Act XLVIII of 2008 on Business Advertising Activity and applicable electronic marketing rules. | Until consent is withdrawn or the subscription is otherwise terminated. A minimal suppression record, normally the email address and unsubscribe date, may be retained as long as necessary to prevent further marketing. Evidence of consent is retained while consent is relied on and afterwards only where a concrete complaint or claim requires it. | – Authorized Marketing and customer-contact personnel – Mailchimp / Intuit group and relevant subprocessors – Microsoft Ireland Operations Limited where messages or lists are administered through Microsoft 365 |
| Client onboarding and service management | – Prospective, current and former clients – Corporate contact persons and authorized representatives – Identification and contact data – Address, billing, tax and payment-reference data – Signature and electronic-signature audit data – Contract, power of attorney, instruction and communication data – Case-initiation, allocation, status and closure information | – Article 6(1)(b) GDPR: steps requested before contract and performance of the service agreement with a natural-person client. – Article 6(1)(f) GDPR: legitimate interest in managing the engagement and dealing with corporate contacts, agents and other non-contracting persons. – Article 6(1)(c) GDPR where specific identification, invoicing, tax, sanctions or other statutory duties apply. | Operational onboarding copies are kept only while needed for service setup and closure. Core signed contracts, powers of attorney, key instructions, deliverables and performance evidence may be retained for five years after the engagement ends where necessary to document the contractual relationship. Accounting documents follow the separate statutory period below. | – Relevant Sales, Operations and service-team personnel – Managing Director and authorized Finance personnel on a need-to-know basis – Microsoft Ireland Operations Limited – Salesforce CRM providers – FormAssembly, DocuSign and approved form or signature providers – Helpers Finance Kft. where billing, accounting or financial administration is required – Authorized agent or representative where applicable |
| Company formation and business support | – Clients, shareholders, beneficial owners, managing directors and proposed officers – Agents, representatives and corporate contact persons – Passport and identification data or copies – Birth details, mother’s name, address and nationality – Tax number, social-security number and Hungarian identification data – Ownership, management, business activity, company-name and registered-seat data – Business-plan, banking, financial and source-of-funds information where relevant – Corporate documents, declarations, powers of attorney and case status | – Article 6(1)(b) GDPR for services requested by a natural-person client. – Article 6(1)(f) GDPR: legitimate interest in delivering the corporate service and processing the necessary data of agents, owners, officers and contacts. – Article 6(1)(c) GDPR where company-registration, identification, tax, sanctions or other mandatory rules require the processing. | Working files are retained for the duration of implementation and orderly closure. The core company-formation and corporate-support file is normally retained for five years after the service ends. Accounting and tax records are retained for the statutory periods stated below. Original documents are returned when no longer required. | – Business Sales and Business Services personnel – External lawyer handling company registration – Company registration court and other competent registries – NAV, KSH, BKIK and other competent public bodies – Banks and financial institutions where introduction or onboarding support is requested – Registered-seat, postal and courier providers – Helpers Finance Kft. and external tax or accounting advisers where requested – Microsoft, Salesforce, FormAssembly, DocuSign and monday.com providers |
| Immigration and relocation services | – Applicants, clients, employees of corporate clients and family members – Corporate HR and other authorized contact persons – Passport, visa, residence-permit and identification data – Birth, marital-status, family and civil-status data – Employment, position, salary, education and qualification data – Address, accommodation, travel and appointment data – Income, bank-statement and financial-support evidence – Health-insurance and limited health-related information required for the procedure – Application forms, authority communications, decisions and permits | – Article 6(1)(b) GDPR for the requested service and steps taken before contracting with the individual client. – Article 6(1)(f) GDPR: legitimate interest in providing the service and dealing with the corporate client and its authorized contacts where the individual is not the contracting party. – Article 6(1)(c) GDPR where the Company must comply with a specific legal duty. – Article 9(2)(a) GDPR: explicit consent where special-category data are necessary for the requested service and no other Article 9 condition applies. | Active case data are retained throughout the application and follow-up process. Working copies in operational platforms and shared folders are deleted or minimized after completion, normally within six months, unless the client requests a related follow-up service or a legal requirement, authority process or concrete dispute requires continued retention. Original documents are returned as soon as operationally possible. | – Immigration and Relocation personnel – National Directorate-General for Aliens Policing, Enter Hungary and competent consulates – NEAK, NAV, government offices and other competent authorities – Corporate client or authorized HR contact where applicable – Translators, insurers, banks, landlords, real-estate agents and other requested service partners – ReloTalent / Equus Software group – Microsoft, Salesforce and monday.com providers – External lawyer where a legal issue requires involvement |
| Citizenship, genealogy and application support | – Prospective and current clients and family members – Ancestors and other relatives appearing in family records – Email, telephone and booking data – Family tree, birth, marriage, death and other civil-status information – Passport, citizenship, residence and identity documents – Historic archive, church-register and genealogy information – Income, tax, health-insurance and other supporting information where required – Certificate of no criminal record where required by the applicable route – Application forms, powers of attorney, submissions, authority correspondence and decisions | – Article 6(1)(b) GDPR for the requested eligibility assessment, genealogy or citizenship service. – Article 9(2)(a) GDPR for special-category data supplied for the service; Article 9(2)(e) GDPR where the relevant information has manifestly been made public in a lawful public source. – Article 10 GDPR and applicable Hungarian law where a criminal-record certificate is required and lawfully handled for the procedure. | Temporary SharePoint working folders are reviewed and deleted or minimized within six months after the relevant stage closes. The core application package, research result, authority correspondence and necessary service record are normally retained for five years after completion. Original documents are returned; unclaimed physical documents may be retained securely for up to five years before confidential destruction. | – Citizenship personnel – Genealogists, archives, church or civil registries and notaries – Translators and document-copying providers – Government offices, citizenship and civil-status authorities, and consulates – Microsoft, Salesforce, Typeform, FormAssembly, DocuSign and monday.com providers – A Hungarian language-school partner only where the client separately consents to the referral |
| Registered office, mail forwarding and delivery agents | – Corporate clients and their contact persons, officers and owners – Senders, recipients and persons named in received correspondence – Company and delivery-agent details – Mail metadata, delivery and forwarding records – Content of scanned or forwarded letters, which may contain additional personal data – Authority, banking or company-register communications | – Article 6(1)(b) GDPR where the individual is party to the selected service. – Article 6(1)(f) GDPR: legitimate interest in performing the service for a corporate client and processing the necessary data of its representatives and persons named in correspondence. – Article 6(1)(c) GDPR where a specific delivery-agent, registered-office or official-document duty applies. | Delivery and forwarding logs are normally retained for five years after the relevant service or entry. Digital working copies are deleted after confirmed forwarding and a short administrative period, normally within 90 days, unless the contract, an authority process or a concrete issue requires longer retention. Physical originals are forwarded, returned or stored under the service terms and normally no longer than five years. | – Operations and Accountancy personnel – Registered-office and mail-handling partners – Postal and courier providers – Client, authorized agent, accountant or lawyer – Public authorities or courts where the correspondence or a binding request requires disclosure – Microsoft 365 and approved document-storage providers |
| Compliance and customer due diligence | – Prospective and current clients – Beneficial owners, officers, representatives and related persons – Name, birth date, nationality and passport data – Ownership and control information – Sanctions, politically exposed person, adverse-media and risk indicators – Potential criminal-offence information where lawfully included in the source – Screening query, result, reviewer assessment and onboarding decision | – Article 6(1)(c) GDPR where applicable sanctions, anti-money-laundering or other compliance law requires the check or record. – Article 6(1)(f) GDPR: legitimate interest in preventing unlawful, fraudulent or unacceptably risky engagements, protecting the Company and its clients and documenting the onboarding decision where no specific legal obligation applies. – Article 10 GDPR: criminal-offence information is processed only where authorized by Union or Member State law and subject to appropriate safeguards. | Where screening is required by law, records are retained for the applicable statutory period. Where screening is based only on legitimate interests, a no-match result is retained until the onboarding decision and normally no longer than 90 days afterwards; a material match, risk assessment or decision record is retained only for as long as necessary for the relationship, compliance follow-up or a concrete dispute. | – Authorized finance, risk and management personnel – World-Check / London Stock Exchange Group and relevant subprocessors – External lawyer or compliance adviser where a material issue requires advice – Competent authority where disclosure is legally required |
| HR and labor-law consultation | – Client contact persons – Client employees whose documents or cases are supplied for review – Name, contact details, company and position – Enquiry, order, appointment and communication data – Labor-law or HR documents provided for the consultation – Special-category information only where necessary and lawfully supplied | – Article 6(1)(b) GDPR for pre-contractual steps and performance where the individual is the client. – Article 6(1)(f) GDPR: legitimate interest in handling the corporate client’s request and dealing with its contact person. – Where Helpers Hungary processes client-employee data solely on the corporate client’s documented instructions, Helpers Hungary acts as processor under Article 28 GDPR and the corporate client determines the legal basis. | Unsuccessful or general enquiries: no longer than six months after closure. Consultation working documents and organizational communications: for the matter and a short closure period, normally six months. Contract and invoice records follow their separate periods. Processor-held employee data are returned or deleted according to the client’s instructions and the applicable data-processing agreement. | – Authorized HR Services personnel – External labor-law lawyer where the client requests or the matter requires referral – Microsoft Ireland Operations Limited for email, Teams and related collaboration – Zoom where used for a consultation – The corporate client that controls any employee-data processing |
| Payments, invoicing, accounting and tax | – Clients and payer or billing contact persons – Billing name, address, company and tax number – Service, invoice, amount, currency and due-date information – Payment status, transaction reference and bank-account or refund details – Accounting, tax and financial-administration records | – Article 6(1)(b) GDPR: collection of fees and performance of the service contract. – Article 6(1)(c) GDPR: compliance with accounting, tax, invoicing and related statutory duties, including Section 169 of Act C of 2000 on Accounting and the applicable tax-law retention rules. – Article 6(1)(f) GDPR for necessary corporate contact-person and payment-follow-up data. | Accounting documents are retained for eight years. Tax records are retained until the applicable tax-assessment limitation period expires, ordinarily five years from the end of the relevant calendar year. Operational payment reminders and refund records are retained only as long as needed for settlement and any concrete issue. | – Authorized Finance and Operations personnel – Helpers Finance Kft. and duly engaged accounting or tax providers – Stripe and Revolut entities for payment-link or payment processing – Banks and financial institutions – NAV and other legally entitled authorities – Microsoft, Salesforce and Számlázz.hu providers where used |
| Social-media messages and public interactions | – Social-media users and followers – Public profile name, username and profile image – Comments, reactions, shares and public posts – Private messages and enquiry content | – Article 6(1)(f) GDPR: legitimate interest in operating the Company’s public pages, answering messages, moderating interactions and providing service information. – Article 6(1)(a) GDPR where a specific campaign, testimonial, competition or marketing use requires separate consent. | Public interactions remain available until the user or platform removes them or the Company removes them for moderation or page-management reasons. Private messages are retained only until the enquiry is resolved and normally no longer than six months afterwards, unless they become part of a client matter. | – Authorized Marketing and customer-support personnel – Meta Platforms Ireland Limited, LinkedIn Ireland Unlimited Company and X Internet Unlimited Company, each acting as an independent controller for its separate platform operation and further processing, except for the Page Insights joint processing described below – Other users according to the public or selected platform settings |
| Social-media Page Insights and audience statistics | – Visitors to and users of the Company’s Facebook and LinkedIn Pages – Page or member identifiers and interaction events used by the platform to generate statistics – Aggregated page, audience, reach and engagement statistics provided to the Company – The Company does not receive the underlying event-level data used by the providers to generate Page Insights | – Article 6(1)(f) GDPR: the Company’s legitimate interest in evaluating the performance of its public pages and improving page administration and service information. – Article 26 GDPR: joint controllership with Meta Platforms Ireland Limited for Facebook Page Insights and with LinkedIn Ireland Unlimited Company for LinkedIn Page Insights, in each case only within the scope of the applicable provider addendum. – Instagram account insights are included in joint processing only where Meta’s applicable terms expressly bring the relevant processing within a joint-controller arrangement; otherwise Meta and the Company act as independent controllers for their respective processing. | Page Insights are made available and retained by the platform according to its settings and retention rules. The Company does not receive the underlying event-level data and does not ordinarily export them. Any exported aggregated report is retained only for the relevant reporting and comparison period and is then deleted or further aggregated. | – Authorized Marketing personnel – Meta Platforms Ireland Limited, joint controller for Facebook Page Insights and any other Meta Page Insights processing expressly covered by its Page Insights Controller Addendum – LinkedIn Ireland Unlimited Company, joint controller for LinkedIn Page Insights under its Page Insights Joint Controller Addendum |
| Customer support, complaints and service quality | – Prospective, current and former clients and representatives – Identification and contact data – Matter, service and payment references – Question, complaint or service issue – Communications, evidence, investigation steps and outcome | – Article 6(1)(b) GDPR for support needed to perform or close the service. – Article 6(1)(c) GDPR for consumer-complaint and other mandatory complaint-handling duties. – Article 6(1)(f) GDPR: legitimate interest in resolving non-statutory complaints, correcting service issues and improving customer administration. | Consumer complaints and responses are retained for the applicable statutory period, normally three years. Other support records are kept until the issue is resolved and normally no longer than six months afterwards, unless the record is required for a concrete dispute or becomes part of the service file. | – Relevant service-team and Operations personnel – Managing Director and authorized management where escalation is required – Helpers Finance Kft. where the issue concerns billing or payment – External lawyer, insurer or expert where necessary – Competent consumer-protection or other authority where required |
| IT operation, support, security and incidents | – Clients, contact persons and other persons whose data are stored in Company business systems – Account, device, access and authentication data – System, application, access and security logs – Support tickets, incident records and technical metadata – Business communications or documents only where targeted access is necessary and proportionate – Data in authorized backups where restoration is required | Article 6(1)(f) GDPR: legitimate interest in operating, maintaining and protecting systems, preserving confidentiality, integrity and availability, detecting and responding to incidents, providing business continuity and restoring data. | Routine security and application logs are retained according to documented system settings and normally no longer than 90 days unless a longer period is justified for the relevant system. Backups follow the documented rotation schedule. Incident and support records are retained until investigation and remediation are complete and, where a concrete claim exists, for the related claim period. | – Authorized IT/Marketing personnel – Tímár Dávid E.V. and approved external IT operators – Microsoft, Salesforce, Slack, monday.com, FormAssembly, Typeform, Google, Zoom, DocuSign and ReloTalent providers where affected – Authorized management only where escalation is required |
| Establishment, exercise or defense of legal claims | – Only the personal data relevant and necessary to the concrete complaint, dispute, investigation or claim – Special-category data only where strictly necessary for legal claims – Criminal-offence data only where lawfully relevant and permitted | – Article 6(1)(f) GDPR: legitimate interest in protecting and enforcing legal rights and defending the Company against a concrete or reasonably foreseeable claim. – Article 9(2)(f) GDPR where special-category data are necessary for legal claims. – Article 10 GDPR and applicable law where criminal-offence data are necessary and permitted. | Only where a concrete claim, complaint, dispute or proceeding exists or is reasonably foreseeable, until the applicable limitation period expires and, if proceedings begin, until their final conclusion and completion of any related enforcement. Data are not retained solely because a future dispute is abstractly possible. | – Managing Director and authorized personnel – External lawyers, insurers, auditors and experts – Courts, authorities and other parties to the proceeding |
| Binding official requests and statutory disclosures | Only the personal data required by the applicable law, binding request, order or measure | – Article 6(1)(c) GDPR: compliance with the specific statutory disclosure duty, binding authority request, court order or other legally binding measure. – Article 9 GDPR or Article 10 GDPR: the specifically applicable condition where special-category or criminal-offence data must lawfully be disclosed. | For the statutory retention period linked to the disclosure and, where necessary, for the duration of the related authority or court procedure. | – Authorized personnel handling the request – Courts, supervisory authorities, immigration, tax, police and other legally entitled public bodies |
| Website operation and language settings | – Website visitors – IP address and request metadata technically necessary to deliver requested pages or forms – Browser, device, operating-system and language data necessary for compatibility and language selection – Requested URL and session-related technical data – Language and consent-preference identifiers | Section 13/A(3) of Act CVIII of 2001: processing of personal data technically indispensable for providing the information-society service requested by the visitor, limited to what is strictly necessary and for no longer than necessary. | Request and session data are retained only for the time technically necessary to provide the requested function. The language cookie is session-based. Consent-preference identifiers are retained for the period stated in the separate Cookie Notice. | – Authorized IT/Marketing personnel – Netmarker Kft. and approved EEA hosting providers – Pshenichnyy Andrey E.V. and other authorized website-support providers where technical access is necessary |
| Website and information security | – Website visitors and persons using website forms – IP address, request and security metadata – Browser, device and operating-system data where relevant to security – Timestamps, error logs, security events and misuse indicators – Incident investigation and remediation records | Article 6(1)(f) GDPR: legitimate interest in protecting the Company’s websites, forms and systems, preventing and detecting misuse, maintaining availability, resolving technical errors and responding to security incidents. | Routine web and security logs are normally retained for no longer than 90 days. Logs and records connected with a specific security incident are retained until investigation and remediation are complete and, where a concrete claim exists, for the related claim period. | – Authorized IT/Marketing personnel – Netmarker Kft. and approved EEA hosting providers – Pshenichnyy Andrey E.V. and other authorized website-support providers where technical access is necessary |
| Website analytics, conversion measurement and optional third-party features | – Website visitors who give consent – Cookie and local-storage identifiers – IP address and approximate location – Browser, device, referrer and page-view data – Interaction, campaign, ad-click and conversion events – Form-protection risk and interaction data – Data transmitted when embedded maps, reviews or externally hosted content load | – Article 6(1)(a) GDPR: consent given through the website consent panel. – Section 13/A(4) of Act CVIII of 2001 for non-essential storage or access to terminal-equipment information. | Cookie- and technology-specific periods are stated in the separate Cookie Notice. Google Analytics user- and event-level data are retained for the period configured by the Company, normally no longer than 14 months; aggregated reports may be retained longer without directly identifying the visitor. | – Authorized IT/Marketing personnel – Google Ireland Limited, Google LLC and relevant subprocessors – Trustindex and other approved embedded-content providers – Authorized website developer and hosting providers |
Before relying on Article 6(1)(f) GDPR, the Company assesses the interest pursued, whether the processing is necessary, the individual’s reasonable expectations and the impact on the individual’s rights. The principal legitimate interests are:
Further information about the relevant balancing assessment may be requested at privacy@helpers.hu.
Personal data are retained only for the period linked to the relevant purpose and data category, as specified in the detailed table. In particular:
After the applicable period ends, personal data are securely deleted, destroyed or anonymiszed, unless continued retention is required by law. The Company maintains version and publication records for its privacy notices and consent information so that it can demonstrate which information was available at a particular time.
Internal access is limited on a need-to-know basis to authorized Sales, Citizenship, Immigration, Business Services, Accountancy, Operations, HR Services, Finance, IT/Marketing, management and other personnel involved in the relevant purpose. The detailed processing table links external recipients to each purpose. Depending on the requested service, external recipients may include:
Because the Company provides international services, personal data may be communicated to authorities, professional partners, agents or clients in countries worldwide where this is necessary for the requested matter. Only the information necessary for the specific service or disclosure is shared.
| Recipient or service | Destination / access location | Customer or website data and purpose | Transfer mechanism or safeguard |
| Microsoft Ireland Operations Limited; Microsoft group companies and subprocessors | EU/EFTA for in-scope Microsoft 365 data under the EU Data Boundary, subject to documented continuing transfers and remote access, including from the United States and other locations | Customer identity and contact data, emails, Teams/Bookings meeting data, SharePoint documents, forms, account information and security or service logs | Adequacy decision where applicable. For non-adequate countries, the Microsoft Products and Services DPA incorporates the European Commission Standard Contractual Clauses, together with contractual, encryption and access-control safeguards. |
| Salesforce group and Salesforce CRM providers | EEA, United Kingdom, United States and other group or subprocessor locations | Prospect and client contact data, enquiries, case status, service and payment follow-up information, communications and technical data | Adequacy decision where applicable. Salesforce’s DPA provides Processor Binding Corporate Rules and/or the European Commission Standard Contractual Clauses depending on the service and transfer. |
| FormAssembly, Inc. and subprocessors | Selected EEA or United Kingdom hosting region, or the United States and other subprocessor locations, depending on the subscribed configuration | Form responses, passport or onboarding data, case-initiation information, workflow, integration and technical data | EEA hosting does not require a Chapter V mechanism. For covered US transfers the EU-US Data Privacy Framework may apply; otherwise the applicable DPA and European Commission Standard Contractual Clauses govern the transfer. |
| Typeform S.L., group companies and subprocessors | Spain and Germany; United Kingdom, United States and other published subprocessor locations | Eligibility-questionnaire responses, email address, professional or family-background information and technical data | No Chapter V mechanism is required for EEA processing. Typeform’s DPA incorporates the European Commission Standard Contractual Clauses for restricted transfers and corresponding safeguards for non-EEA subprocessors. |
| monday.com Ltd. and subprocessors | Israel, United Kingdom, United States and other published subprocessor locations | Client name, matter status, tasks, workflow, communications, referral and technical data; detailed documents are not ordinarily uploaded unless required | European Commission adequacy decisions for Israel and the United Kingdom. The European Commission Standard Contractual Clauses apply to non-adequate countries; the EU-US Data Privacy Framework may apply where the relevant US recipient is certified. |
| Slack Technologies / Salesforce group | EEA, United States and other published global locations | Limited internal communications, customer or matter references, files where necessary, workspace activity and technical or security data | Adequacy decision where applicable; the Standard Contractual Clauses incorporated into Slack’s DPA for non-adequate transfers; and the EU-US Data Privacy Framework for eligible certified US recipients and covered processing. |
| DocuSign group and subprocessors | EEA, United States and other global group or subprocessor locations | Name, email, signature-envelope data, audit trail, authentication information and documents submitted for electronic signature | DocuSign’s approved Processor Binding Corporate Rules, the European Commission Standard Contractual Clauses and adequacy decisions where relevant. |
| Zoom Communications, Microsoft Teams and approved meeting-note providers | EEA, United States and other published service or support locations | Meeting-account and scheduling data, IP address, device information, audio, video, chat, transcript, summary or files where the relevant feature is used | Adequacy decision where applicable; the European Commission Standard Contractual Clauses for non-adequate transfers; and the EU-US Data Privacy Framework for eligible covered transfers to certified US entities. Optional recording or transcription is activated only after separate consent. |
| ReloTalent Pte Ltd / Equus Software group | Customer data is stated to be hosted in Frankfurt, Germany. Group or support personnel may operate from Singapore, Vietnam, Portugal or other contracted locations | Immigration and relocation identity, contact, family, employment, application, document, task and communication data | EEA hosting does not require a Chapter V mechanism. Access from Singapore, Vietnam or another non-adequate country is covered by the applicable Article 46 GDPR safeguard under the signed DPA, normally the European Commission Standard Contractual Clauses. |
| Google Ireland Limited, Google LLC and subprocessors | EEA, United States and other countries in which Google or its subprocessors maintain facilities | Cookie identifiers, IP and device/browser data, page and interaction events, ad-click and conversion data, map or font requests and reCAPTCHA risk-analysis data | Consent is required before non-essential Google technologies are activated. Adequacy decisions and the EU-US Data Privacy Framework apply where available; otherwise Google’s applicable data-processing terms incorporate the European Commission Standard Contractual Clauses and supplementary safeguards. |
| Mailchimp / Intuit group and subprocessors | United States and other published group or subprocessor locations | Subscriber name, email, service preference, consent, delivery and engagement data where enabled | The EU-US Data Privacy Framework may apply for covered transfers to certified US recipients. Otherwise the applicable data-processing terms and European Commission Standard Contractual Clauses govern the transfer. |
| Stripe entities and subprocessors | EEA, United Kingdom, United States and other published locations | Payer, transaction, amount, currency, payment-status, fraud-prevention and technical data; full card details are processed by Stripe | Adequacy decision where applicable; European Commission Standard Contractual Clauses and, for eligible covered transfers, the EU-US Data Privacy Framework. Stripe may act as an independent controller for certain payment, fraud-prevention and legal-compliance processing. |
| Revolut entities and subprocessors | Lithuania / EEA, United Kingdom and other published locations | Payer, account, transaction, amount, currency, payment-status, fraud-prevention and technical data | EEA processing does not require a Chapter V mechanism; the United Kingdom adequacy decision applies where relevant. European Commission Standard Contractual Clauses are used for non-adequate countries. Revolut acts as an independent controller for its regulated payment processing. |
| WhatsApp Ireland Limited; WhatsApp LLC, Meta Platforms, Inc. and WhatsApp subprocessors | Ireland / EEA, United States and other countries in which WhatsApp or its subprocessors operate | Customer contact information, principally telephone numbers, provided by the Company to enable communication through WhatsApp Business; business-account, usage, log, diagnostics and support information collected by WhatsApp under its own terms | For Customer Data processed on behalf of the Company, WhatsApp Ireland acts as processor under the WhatsApp Business Data Processing Terms. Transfers to WhatsApp LLC and Meta Platforms, Inc. rely on the EU-US Data Privacy Framework; WhatsApp may alternatively use processor-to-processor Standard Contractual Clauses or another recognized transfer mechanism. Onward transfers to subprocessors are made under the applicable transfer mechanism. WhatsApp’s independent processing is governed by its own terms and privacy information. |
| World-Check / London Stock Exchange Group and subprocessors | United Kingdom, EEA, United States and other published service or support locations | Identity, ownership, sanctions, PEP, adverse-media and risk-screening data and results | United Kingdom adequacy decision where applicable. For transfers to non-adequate countries, the provider’s applicable data-processing terms and European Commission Standard Contractual Clauses apply. Criminal-offence information is processed only where Article 10 GDPR and applicable law permit. |
| Netmarker Kft., Tímár Dávid E.V., Pshenichnyy Andrey E.V. and other EEA-based hosting, IT or development providers | Hungary, Germany, Italy or another confirmed EEA location, depending on provider and service | Website, account, device, support, log and technical data and limited customer content where targeted technical access is necessary | No Chapter V mechanism is required for EEA-only processing. Any non-EEA access requires an applicable Chapter V mechanism and assessment. |
| Meta Platforms Ireland Limited; Meta Platforms, Inc. and relevant Meta group companies and service providers | Ireland / EEA, United States and other countries in which Meta or its service providers operate | Public profile and page-interaction data, Facebook Page Insights event data and aggregated statistics, messages or comments, page-administration and technical data for Facebook and Instagram page operation | For Facebook Page Insights and any other processing expressly covered by Meta’s Page Insights Controller Addendum, Meta Ireland and the Company are joint controllers; Meta assumes primary responsibility for the GDPR obligations allocated by the addendum. Meta’s international transfers for its platform processing are governed by its privacy and transfer terms, using adequacy decisions and the EU-US Data Privacy Framework where applicable, or the European Commission Standard Contractual Clauses with supplementary measures. Meta remains independently responsible for its own further processing and onward transfers outside the joint processing. |
| LinkedIn Ireland Unlimited Company; LinkedIn Corporation and relevant group companies and service providers | Ireland / EEA, United States and other published service or support locations | Member and public-profile data, Page interactions, Page Insights data and aggregated statistics, messages, comments and page-administration or technical data | For LinkedIn Page Insights relating to EEA or Swiss members, LinkedIn Ireland and the Company are joint controllers under the Page Insights Joint Controller Addendum; LinkedIn is responsible for the provision of Page Insights and the GDPR obligations allocated by the addendum. LinkedIn’s international transfers are based on adequacy decisions, the EU-US Data Privacy Framework and/or the European Commission Standard Contractual Clauses, as applicable. LinkedIn remains independently responsible for its further platform processing and onward transfers. |
| X Internet Unlimited Company; X Corp. and relevant affiliates and service providers | Ireland, United States and other countries in which X or its service providers operate | Public profile, post and interaction data, direct messages sent to the Company’s account, account-administration, audience and technical data | X and the Company act as independent controllers for their respective processing. X states that international transfers rely, as applicable, on the EU-US Data Privacy Framework, the European Commission Standard Contractual Clauses and other lawful transfer mechanisms. |
| Foreign clients, agents, professional partners, genealogists, translators, banks, consular or immigration authorities and other case-specific recipients | Worldwide, depending on the client, authority, partner and requested service | Only the identity, contact, document, application, family, corporate, financial or other matter-related data necessary for the specific service or disclosure | Adequacy decision where available. For structured or recurring transfers to a non-adequate country, an Article 46 GDPR safeguard, normally the European Commission Standard Contractual Clauses, together with a transfer assessment and supplementary measures where required. Article 49 GDPR derogations are used only exceptionally and case by case. Disclosures to foreign public authorities are subject to a specific legal and necessity assessment. |
Where Helpers Hungary itself makes a transfer covered by a European Commission adequacy decision, no additional Article 46 GDPR safeguard is required. For structured or recurring transfers by Helpers Hungary to a country without an applicable adequacy decision, the Company uses an appropriate Article 46 GDPR mechanism, normally the European Commission Standard Contractual Clauses, assesses the legal and practical circumstances of the transfer and applies supplementary technical, organizational or contractual measures where required. Transfers carried out by Meta, LinkedIn or X in their own or joint-controller capacity are governed by the relevant provider’s published privacy and international-transfer framework, as summarized in the table above. Article 49 GDPR derogations are not used for routine transfers and may be relied on only exceptionally and case by case where their strict conditions are met. Further information about the applicable transfer mechanism, and a copy or description of the relevant safeguards, may be requested at privacy@helpers.hu.
Detailed information about strictly necessary and optional cookies and similar technologies, including their providers, purposes, personal data, legal bases and duration, is provided in the separate Cookie Notice. Strictly necessary technologies are used only where and to the extent technically indispensable for the website service requested by the visitor under Section 13/A(3) of Act CVIII of 2001. Optional technologies are activated only after consent under Section 13/A(4) of that Act and may be disabled through the website’s consent settings. The Cookie Notice and consent panel are kept aligned with the technologies actually used.
You may exercise your GDPR rights by contacting privacy@helpers.hu. We may request information reasonably necessary to verify your identity. Rights are subject to the conditions and limitations of the GDPR and applicable law. For Facebook and LinkedIn Page Insights, you may exercise your rights against either Helpers Hungary or the relevant joint-controller provider. Requests submitted to Helpers Hungary will be forwarded promptly to the relevant provider in accordance with the applicable joint-controller arrangement.
1. Right of access: you may obtain confirmation as to whether we process your personal data and, where applicable, access to those data and the information required by Article 15 GDPR.
2. Right to rectification: you may request correction of inaccurate data and completion of incomplete data.
3. Right to object
WHERE PROCESSING IS BASED ON ARTICLE 6(1)(F) GDPR, YOU MAY OBJECT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION. WE WILL STOP THE PROCESSING UNLESS WE DEMONSTRATE COMPELLING LEGITIMATE GROUNDS THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING IS NECESSARY FOR THE ESTABLISHMENT, EXERCISE OR DEFENSE OF LEGAL CLAIMS.
4. Right to restriction: you may request restriction of processing in the circumstances set out in Article 18 GDPR.
5. Right to erasure: you may request deletion where the conditions of Article 17 GDPR are met. This right does not override statutory retention duties, authority requirements or the need to retain data for a concrete legal claim.
6. Right to data portability: where processing is automated and based on consent or contract, you may receive data provided by you in a structured, commonly used and machine-readable format and may request direct transmission where technically feasible.
7. Withdrawal of consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Website consent can be changed through the consent settings and other consent may be withdrawn at privacy@helpers.hu.
8. Complaint and judicial remedy: you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (1055 Budapest, Falk Miksa utca 9-11; postal address: 1363 Budapest, Pf. 9; email: ugyfelszolgalat@naih.hu; telephone: +36 1 391 1400) and may seek a judicial remedy before a competent court. The Company does not use customer or website data for solely automated decision-making, including profiling, that produces legal effects or similarly significantly affects you. The online citizenship eligibility tool may provide an automated preliminary indication, but this is informational and does not determine your legal eligibility or whether the Company will accept an engagement.
Last updated: v2.0, October 9, 2026.
(1) In accordance with common practice on the Internet, our Company uses cookies on its website. A cookie is a small data file with a series of characters that are placed on the visitor’s computer when he or she visits a website. When the visitor visits the website again, thanks to the cookie, it can recognize the visitor’s browser.
(2) Our Company’s website will store and process the following data of visitor and the device used for browsing:
(3) It is not mandatory to accept and enable the use of cookies. You can reset your browser’s setting to reject any cookie or to notify you when a cookie is being sent to your machine. Although most browsers automatically accept cookies by default, this can in general be modified in order to prevent automatic acceptance and give you the chance to decide in very individual case.
You can find information about the cookie settings of the most popular web browsers by clicking on the links below
Furthermore, please note that certain functions or services of the website may not work properly with cookies disabled.
(4) The cookies used on the website by themselves cannot establish the identity of the user.
(5) The cookies used on the Company’s website:
i. Strictly (technically) necessary session cookies
These cookies enable the visitor to browse the website and use its functions and the services provided via the website smoothly and fully, including especially keeping track of the User’s movements on the website during a specific visit. These cookies are retained only for the period of the current visit and once the session is over and the browser is closed, these cookies are automatically deleted from your computer.
The legal basis of this type of processing is Article 13/A (3) of Act CVIII of 2001 on certain issues of electronic trading services and information society services.
The purposes of processing: to ensure the proper operation of the website.
ii. Consent based cookies:
These cookies enable the Company to remember the selections made by the user on the website. The visitor may object to this kind of processing at any time before or during the use of the service. These data may not be linked to the identification data of the user and may not be disclosed to a third person without the consent of the user.
ii.1. Functional cookies:
The purposes of processing: To increase the effectiveness of the service and user experience as well as to make the use of the website more convenient.
The period of processing is 6 months.
Scope of processed data: ZOPIM, ADDTOANY
ii.2. Performance cookies:
