Privacy Policy
This document contains information regarding the processing of personal data of users (hereinafter
referred to as "Data Subjects") on the seekretbox mobile application (hereinafter referred to as the
"Application") operated by BITWITCH.IO Korlátolt Felelőségű Társaság (hereinafter referred to as
the "Data Controller"), as well as on the website partners.seekretbox.com (hereinafter referred to as
the "Website").
Our contact details are as follows:
Registered office: 76 Kossuth Street, Pusztaberki 2658, Hungary
Email address: serious@bitwitch.io
The privacy policy is prepared in accordance with Regulation (EU) 2016/679, the General Data
Protection Regulation (hereinafter referred to as the "Regulation"). Scope of processed data, legal
basis for data processing, purpose, and duration of data processing.
1.1. Data required for registration on the Website
Description of the data processing scenario, purpose of data processing, and scope of processed
data:
During the registration process on the Website, the Data Controller processes the name and email
address of the Data Subject. The purpose of data processing is to enable the use of the Website.
Legal basis for data processing:
The legal basis for data processing is the Data Subject's consent in accordance with Article 6(1)(a) of
the Regulation.
Duration of data processing:
The data will be processed for the duration of the Data Subject's use of the Website.
1.2. Data required for accessing the Application
Description of the data processing scenario, purpose of data processing, and scope of processed
data:
Access to the Application is granted through authentication provided by Google Inc.'s Gmail
authentication service. The purpose of data processing is to enable the use of the Application. The
Application processes the Data Subject's authentication data (email address) provided by Google Inc.
Legal basis for data processing:
The legal basis for data processing is the Data Subject's consent in accordance with Article 6(1)(a) of
the Regulation.
Duration of data processing:
The data will be processed for the duration of the Data Subject's use of the Application.
1.3. Displaying SeekretBoxes
Description of the data processing scenario, purpose of data processing, and scope of processed
data:
Using the Application, the Data Subject can view SeekretBoxes located within a 50-meter radius of
their current location on the map.
To display SeekretBoxes, the Application processes the Data Subject's:
• location data
• email address.
SeekretBox does not store the Data Subject's location data, it is only processed for the purpose of
the Application's functionality.
Legal basis of data processing
The legal basis for data processing is your consent based on Article 6(1)(a) of the Regulation.
Duration of data processing
We will process the data for the duration of your use of the Application. Access to location data can
be denied at any time in the privacy settings of your phone; however, in this case, the display of
secret boxes will not function.
1.4. Data processed in the framework of complaint handling
Description of data processing scope, purpose of data processing, and types of processed data. If we
handle any service-related inquiries or address your complaints, we also process personal data
during the handling process. Regarding complaint handling, we process your name, contact
information (email address, phone number, postal address), and the details of your complaint. The
purpose of data processing is to fulfill legal requirements for warranty and complaint handling.
Legal basis of data processing
Whether you submit a complaint to us is your voluntary decision; however, if you do, we are obliged
to retain the complaint for a period of 3 years according to Section 17/A(7) of Act CLV of 1997 on
Consumer Protection. Therefore, the data processing will be based on a legal obligation under
Article 6(1)(c) of the Regulation.
Duration of data processing
According to the Consumer Protection Act, we are required to retain the data for a period of 3 years
following the complaint handling.
2. Data Processors
During data processing, we engage the following data processors:
• Google Inc. (related to the Application) and
• Web Amazon Services (related to the Website) who provide hosting services.
Your rights regarding data processing
During the data processing period, you have the following rights according to the provisions of the
Regulation:
• Right to access personal data and information related to data processing,
• Right to rectification,
• Right to restriction of processing,
• Right to erasure,
• Right to data portability.
If you wish to exercise your rights, it requires your identification, and we need to communicate with
you. Therefore, providing personal data will be necessary for identification purposes (but
identification can be based on data that we already process about you), and your complaints related
to data processing will be available in our email account within the time frame specified in this
notice. Complaints related to data processing will be responded to within 30 days at the latest.
3.1. Access to personal data and information
You have the right to receive feedback on whether the processing of your personal data is in
progress and, if it is, you have the right to:
• Access the processed personal data and
• Be informed about the following:
• Purposes of data processing;
• Categories of personal data processed about you;
• Recipients or categories of recipients to whom the personal data has been or will be
disclosed
• The planned duration of storage of personal data, or if that is not possible, the criteria used
to determine that duration;
• Your right to request rectification, erasure, or restriction of your personal data and to object
to the processing of personal data based on legitimate interests;
• The right to lodge a complaint with a supervisory authority;
• Any available information about the source of the data if it was not collected directly from
you
• The existence of automated decision-making, including profiling, and meaningful information
about the logic involved, as well as the significance and the envisaged consequences of such
processing for you.
The purpose of exercising this right may be to determine and verify the lawfulness of data
processing, therefore, if requests for information are frequent, we may charge a reasonable fee for
providing the information. We provide access to personal data by sending you the processed
personal data and information via email after your identification. Please indicate in your request
whether you request access to personal data or information related to data processing.
3.2. Right to Rectification
You have the right to request the correction of inaccurate personal data concerning you without
undue delay.
3.3. Right to Restriction of Processing
You have the right to request the restriction of the processing if one of the following applies:
• You contest the accuracy of the personal data, in which case the restriction applies for a
period enabling us to verify the accuracy of the personal data. If the verification is not
necessary, we will not apply any restrictions.
• The processing is unlawful, and you oppose the erasure of the data and instead request the
restriction of their use.
• We no longer need the personal data for the purposes of the designated processing, but you
require them for the establishment, exercise, or defense of legal claims.
• You have objected to the processing, and while it is being determined whether our legitimate
grounds override your legitimate interests, the processing shall be restricted.
If the processing is restricted, such personal data, with the exception of storage, shall only be
processed with your consent or for the establishment, exercise, or defense of legal claims or for the
protection of the rights of another natural or legal person or for reasons of important public interest
of the Union or of a Member State. You will be informed in advance (at least 3 working days before
the lifting of the restriction) about the lifting of the restriction.
3.4. Right to Erasure - Right to be Forgotten
You have the right to request the erasure of your personal data without undue delay if one of the
following grounds applies:
• The personal data are no longer necessary in relation to the purposes for which they
were collected or otherwise processed.
• You withdraw your consent, and there is no other legal ground for the processing.
• You object to the processing based on legitimate interests, and there are no
overriding legitimate grounds for the processing.
• The personal data have been unlawfully processed, and this has been confirmed
based on your complaint.
• The personal data must be erased for compliance with a legal obligation under
applicable Union or Member State law.
If we have made the personal data concerning you public and we are obligated to erase it for any of
the reasons mentioned above, taking into account available technology and the cost of
implementation, we will take reasonable steps, including technical measures, to inform other data
controllers processing the personal data that you have requested the erasure of any links to, or
copies or replications of, that personal data. In principle, we do not disclose your personal data.
The right to erasure does not apply to the extent that processing is necessary for the following
purposes:
• for the exercise of the freedom of expression and information
• for compliance with a legal obligation that requires the processing of personal data
under applicable Union or Member State law (such as data processing carried out in
invoicing, as the retention of invoices is required by law), or for the performance of a task
carried out in the public interest or in the exercise of official authority vested in the data
controller.
• for the establishment, exercise, or defense of legal claims (e.g., if we have a claim
against you that has not been fulfilled yet, or if there is an ongoing consumer or data
protection complaint).
3.5. Right to Data Portability
If the processing is necessary for the performance of a contract or is based on your voluntary
consent, you have the right to request that the personal data you have provided to us be provided to
you in a machine-readable format, which we will provide to you in XML, JSON, or CSV format, if
technically feasible. If technically feasible, you may also request that we transmit the data in this
format to another data controller.
3.6. Remedies
If you believe that we have violated any legal provisions relating to data processing or have not
fulfilled any of your requests, you may initiate an investigation procedure by the National Authority
for Data Protection and Freedom of Information (mailing address: 1363 Budapest, Pf.: 9, email:
ugyfelszolgalat@naih.hu) to cease the presumed unlawful data processing. Additionally, we inform
you that you have the right to initiate civil proceedings before a court.
4. Data Security
During the operation of our information systems, we implement necessary authorization
management, internal organization, and technical solutions to ensure that your data does not fall
into the hands of unauthorized persons, and that unauthorized persons cannot delete, retrieve, or
modify the data from the system. We also enforce data protection and security requirements with
our data processors. We maintain a record of any potential data breaches and, if necessary, inform
you about any incidents that may arise.
5. Other provisions
We reserve the right to modify this data processing information in a manner that does not affect the
purpose and legal basis of the data processing.
However, if we intend to carry out further data processing for a purpose different from the purpose
of collection of the collected data, we will inform you about the purpose of the data processing and
the following information before the additional data processing:
• the duration of the storage of personal data, or if this is not possible, the criteria
used to determine the storage period;
• your right to request access to your personal data, their rectification, erasure, or
restriction of processing, and, in the case of processing based on legitimate interests, your
right to object to the processing of personal data, as well as your right to data portability in
the case of processing based on consent or contractual relationship
• in the case of processing based on consent, the right to withdraw your consent at
any time
• your right to lodge a complaint with the supervisory authority
• whether the provision of personal data is based on a statutory or contractual
obligation or is a prerequisite for entering into a contract, as well as whether you are obliged
to provide personal data and the possible consequences of the failure to provide such data
• the existence of automated decision-making, including profiling, and at least in these
cases, meaningful information about the logic involved, as well as the significance and the
envisaged consequences of such processing for you.
The data processing can only commence following this, provided that the legal basis for the data
processing is consent, and in addition to the information provided, you must also give your consent.
This Data Processing Information is valid from April 20, 2023.
