Privacy Policy
Data processing related to the SBH-CHALLENGES APP user account
This translation is provided for information only. The Hungarian version is legally binding.
Version history
Version number: 1.0
Date: 16 April 2026
Description of changes: Privacy Policy updated due to new features in the application.
Contents
2 Introduction
3 The Controller and its contact details
4 The user account
5 Records of invoices and related documents
6 Rights of the data subject
7 Right to a remedy
8 Additional provisions on the use of the application
2. Introduction
The Controller is committed to protecting the rights of persons connected with the organisation, in particular to respecting and actively supporting the exercise of personality rights and the right to the protection of personal data, and to safeguarding business secrets.
The Controller reserves the right to amend its privacy notices unilaterally. Amendments may be necessary in particular due to changes in legislation or in the practice of the data protection supervisory authority, a newly discovered security risk or other changes.
The SBH-CHALLENGES APP is an experience-based, gamified digital platform on which users complete challenges on real routes. When using the application, data relating to users' activity, performance and movement may also be recorded.
3. The Controller and its contact details
Name of the Controller: SBH-CHALLENGES Kft. (hereinafter: "Controller").
Registered office: 3388 Poroszló, Tiszavirág út 61., Hungary
Tax number: 32613340-2-10
Website: www.sbh-challenges.com
Contact person designated by the Controller for the processing of personal data:
Name: Tamás Hajdu
E-mail: info@sbh-challenges.com
Telephone: +36-30-569-0068
4. The user account
4.1 Purposes of processing
The purposes of this processing are:
identifying Users, running competitions and storing previous results;
verifying the completion of challenges, managing and displaying leaderboards, and ensuring and improving the user experience.
4.2 Data subjects and personal data processed
Natural persons affected by this processing: Participants, Users.
In the course of this processing the Controller processes the following personal data:
Name, e-mail address, telephone number, nickname, photo, GPS-based location data, route covered, time, scores, leaderboard positions, data on completed challenges.
4.3 Legal basis for processing
The legal basis for this processing is:
performance of a contract under Article 6(1)(b) GDPR. Processing is necessary for the performance of a contract or to take steps at the request of the data subject prior to entering into a contract.
The legal basis is also the legitimate interest of the Controller under Article 6(1)(f) GDPR in operating the application, verifying the completion of challenges and managing leaderboards and user performance.
Legislation governing the processing:
for processing under Article 6(1)(f) GDPR, the underlying legitimate interest;
the contract concluded between the User and SBH-CHALLENGES Kft. for the use of the SBH-CHALLENGES APP.
Special categories of personal data, if processed:
No special category data.
Further conditions for processing special category data under Article 9(2) GDPR:
Not applicable.
4.4 Storage period
Retention period and criteria for determining it:
User data is processed for as long as the user account exists.
After the user is deleted, personal data is retained for a maximum of 30 days.
Data relating to accounting documents is retained by the Controller for 8 years under accounting legislation.
Data shown on leaderboards may continue to appear in the system in anonymised form.
4.5 Other conditions
Source of the data, if not provided by the data subject:
The data comes from the data subject.
Possible consequences of failure to provide data:
The service cannot be used.
Other conditions with regard to Article 13(2)(e) GDPR:
Providing the data is a condition for using the service.
Where Article 6(1)(b) or (c) GDPR applies, whether providing the data is a statutory or contractual requirement or a prerequisite for concluding a contract:
Providing the data is a condition for using the service.
4.6 Recipients of personal data
Processors used for this processing:
Vamosoft Kft. (tax number: 32376755-2-13) operates and develops the system.
The Controller may use further IT service providers to operate the application, e.g. cloud services, analytics and push notifications.
Joint controllership with the following organisations:
Not applicable.
Personal data may be transferred regularly to the following recipients in connection with this processing:
Owner of the application: SBH-CHALLENGES Kft.
Are data transferred outside the EEA?
Service providers used to operate the application may operate outside the European Economic Area. In such cases, data is transferred with appropriate safeguards.
4.7 Automated decision-making, including profiling
The application automatically ranks users based on their performance, by score and time; this does not constitute automated decision-making with significant effects.
4.8 Location
While the application is running, GPS-based location data is processed so that the route and challenge completed by the user can be verified.
Location data is processed only to the extent necessary for the operation of the service.
4.9 Subscription
Certain features of the application are available under a subscription (Pro version).
The subscription starts with a 7-day free trial, after which the User is obliged to pay unless the subscription is cancelled.
Subscriptions are managed through the Apple App Store and Google Play systems. Subscriptions renew automatically under the rules of the respective platform unless the User cancels them.
The Controller endeavours to notify the User before renewal; however, the rules of the respective platform always govern the management and cancellation of subscriptions.
4.10 Coupon system
The application may include a coupon system through which users may obtain discounts or individual access.
When coupons are redeemed, data is processed to the extent necessary to provide the service.
5. Records of invoices and related documents
5.1 Purposes of processing
The purpose of this processing is:
to fulfil invoicing and accounting obligations and to account for the fees for services used by users.
5.2 Data subjects and personal data processed
Natural persons affected by this processing:
Users, Subscribers.
In the course of this processing the Controller processes the following personal data:
The mandatory content specified in Section 169 of the Hungarian VAT Act: date of issue, invoice number uniquely identifying the invoice, name, address and tax number of the issuer, name and address of the buyer, tax number of the buyer (for domestic taxable persons), description, quantity and net unit price of the goods or services sold, net invoice amount, VAT rate and amount; documents supporting the invoice.
5.3 Legal basis for processing
The legal basis for this processing is:
a legal obligation under Article 6(1)(c) GDPR. Processing is necessary for compliance with a legal obligation to which the Controller is subject.
Governing legislation or, for processing based on legitimate interest under Article 6(1)(f) GDPR, the underlying legitimate interest:
Act CL of 2017 (Hungarian Rules of Taxation Act), Section 78(3); Act C of 2000 (Accounting Act).
Special categories of personal data, if processed:
No special category data.
Further conditions for processing special category data under Article 9(2) GDPR:
Not applicable.
5.4 Storage period
Retention period and criteria for determining it:
8 years after the end of the financial year in which the invoice was issued.
5.5 Other conditions
Source of the data, if not provided by the data subject:
The data comes from the data subject.
Possible consequences of failure to provide data:
Providing the data is a legal obligation.
Other conditions with regard to Article 13(2)(e) GDPR:
Providing the data is mandatory.
Where Article 6(1)(b) or (c) GDPR applies, whether providing the data is a statutory or contractual requirement or a prerequisite for concluding a contract:
Providing the data is mandatory.
5.6 Recipients of personal data
Processors used for this processing:
Not applicable.
Joint controllership with the following organisations:
Not applicable.
Personal data may be transferred regularly to the following recipients in connection with this processing:
Hungarian Tax and Customs Administration (NAV), CONTIREX Kft.
1047 Budapest, Károlyi István u. 10.
Tax number: 10456691-2-41
Are data transferred outside the EEA?
Service providers used to operate the application may operate outside the European Economic Area. In such cases, data is transferred with appropriate safeguards.
5.7 Automated decision-making, including profiling
In connection with this processing, the Controller does not carry out automated decision-making and/or profiling.
6. Rights of the data subject
The Controller supports the exercise of the data subject's right to information under Articles 13 and 14 GDPR by publishing this General Privacy Policy and the specific privacy notices electronically.
Current copies of the General Privacy Policy and the specific privacy notices are also available in printed form at the Controller's registered office and sites, and a copy may be provided at the data subject's request.
At the time personal data is obtained, or at the first contact with the data subject, the Controller provides electronic access to this General Privacy Policy and to the specific privacy notice for the relevant processing or, at the data subject's request, a printed copy.
Data subjects may also request detailed information about the processing of their personal data at the contact details given in point 1, and may submit requests to exercise their rights there.
In addition to the right to information under Article 13 GDPR, data subjects have the rights listed below in relation to the processing. The Controller fulfils requests within one month of receipt at the latest, unless the period is extended due to the complexity or number of requests.
a) Right of access
Under Article 15 GDPR, the data subject may request information and confirmation from the Controller about the conditions and circumstances of the processing of their personal data, in particular:
the purpose and legal basis of the processing of their personal data;
the categories of personal data processed;
the recipients or categories of recipients of the personal data;
the intended storage period or the criteria for determining it;
their rights and available remedies;
whether the Controller carries out automated decision-making or profiling with the personal data and, if so, under what circumstances.
As part of the right of access, data subjects may request from the Controller, once and free of charge, an electronic copy of the personal data processed about them under Article 15(4) GDPR.
b) Right to rectification
Under Article 16 GDPR, the data subject has the right to have inaccurate personal data rectified by the Controller without undue delay and to have incomplete personal data completed.
c) Right to erasure
Under Article 17 GDPR, the data subject has the right to request the erasure of their data if they withdraw their consent, the data is processed unlawfully, the Controller is subject to an obligation under Union or Member State law, the purpose of processing has ceased, there are no overriding legitimate grounds for processing after an objection, or they object to processing for direct marketing purposes.
The Controller will not comply with a request for erasure if it is required by law to store the personal data and the statutory retention period has not yet expired.
d) Right to restriction of processing
Under Article 18 GDPR, the data subject has the right to request restriction of processing where one of the following applies:
The data subject contests the accuracy of the personal data.
The processing is unlawful and the data subject opposes erasure and requests restriction of use instead.
The Controller no longer needs the personal data for the purposes of processing, but the data subject requires them for the establishment, exercise or defence of legal claims.
The data subject has objected to processing.
e) Right to data portability
Under Article 20 GDPR, the data subject may request that the Controller provide their personal data processed by automated means on the basis of consent (Article 6(1)(a) GDPR) or performance of a contract (Article 6(1)(b) GDPR) in a structured, commonly used and machine-readable format.
Where technically feasible, the Controller will transmit the personal data directly to another controller named in the data subject's request.
The right to data portability does not create an obligation for controllers to adopt or maintain technically compatible processing systems.
If the data subject's right to data portability adversely affects the rights and freedoms of others, in particular their business secrets or intellectual property, the Controller is entitled to refuse the request to the extent necessary.
The rules on the right to data portability do not apply where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
f) Automated decision-making, profiling
Under Article 22(3) GDPR, where the specific privacy notice states that automated decision-making, including profiling, takes place in the relevant processing, the data subject may request human intervention on the part of the Controller, express their point of view and contest the decision.
The Controller automatically ranks users based on their performance, by score and time; this does not constitute automated decision-making with significant effects.
g) Right to object
Under Article 21 GDPR, the data subject may object at any time, on grounds relating to their particular situation, to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority (Article 6(1)(e) GDPR) or based on the legitimate interest of the Controller (Article 6(1)(f) GDPR).
After an objection, personal data will only be processed further if there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
7. Right to a remedy
a) Data protection officer, person responsible for data protection
The data subject may contact the Controller at any time at the contact details given in this notice with any questions about the processing or protection of their personal data or the exercise of their rights, or to make a complaint.
b) Right to lodge a complaint with a supervisory authority
Without prejudice to other administrative or judicial remedies, every data subject has the right to lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) if they consider that the Controller or a processor engaged by it has committed an infringement or caused a risk of infringement through its activities or omissions.
Contact details of the National Authority for Data Protection and Freedom of Information (NAIH):
Registered office: 1055 Budapest, Falk Miksa utca 9-11.
Postal address: 1363 Budapest, Pf. 9.
Tel.: +36 1 391-1400, +36 30 683-5969, +36 30 549-6838
E-mail: ugyfelszolgalat@naih.hu
Website: http://naih.hu/
c) Right to an effective judicial remedy against the Controller or processor
Without prejudice to available administrative or non-judicial remedies, including the right to lodge a complaint with the supervisory authority, every data subject may bring proceedings before a court if they consider that the Controller or a processor engaged by it has infringed their rights relating to the processing of their personal data.
The case falls within the jurisdiction of the regional court for the Controller's registered office, i.e. the Budapest-Capital Regional Court (Fővárosi Törvényszék).
The data subject may also choose to bring the action before the regional court for their place of residence or stay.
A list of Hungarian regional courts is available at https://birosag.hu/torvenyszekek.
8. Additional provisions on the use of the application
The SBH-CHALLENGES APP is used at the user's own risk. When completing the challenges, routes and tasks available in the application, the user must comply with the applicable laws, traffic rules and safety regulations for the given environment.
The Controller accepts no liability for any injury, accident, property damage or other disadvantage suffered by the user in connection with the use of the application or the completion of challenges.
The scores, leaderboards and results shown in the application are calculated according to rules set by the Controller. The Controller reserves the right to change the scoring system, the rules of play and the content of the challenges unilaterally.
The user must use the application as intended. Any conduct aimed at influencing or manipulating the operation of the application, or at unlawfully influencing the results of other users, is prohibited.
The Controller is entitled to exclude a user from using the application without warning if the user breaches these terms or behaves abusively.
The terms of prizes and rewards announced in the application may be set out separately. The Controller reserves the right to change or withdraw prizes, in particular in the event of abuse or breach of the rules.
Certain features of the application are available under a subscription (Pro version). Subscriptions are managed through the Apple App Store and Google Play systems. Subscriptions may renew automatically under the rules of the respective platform (Apple App Store, Google Play) unless the user cancels them.
The Controller is entitled to change or discontinue the operation, availability and individual features of the application without prior notice.