Privacy Notice

1.1. This privacy notice (hereinafter: Privacy Notice) is issued by the following controller (hereinafter: Service Provider):

Company name

Trawell Hivatalos Fordítóiroda Korlátolt Felelősségű Társaság [Private Limited Company]

Short company name

Trawell Kft.

Registered foreign-language name

Trawell Official Translations Ltd.

Registered office, postal address

1191 Budapest, Katica utca 4. 4. em. 9. ajtó [4th floor, door 9], Hungary

Company registration number

01-09-405371 (Company Registry Court of the Budapest-Capital Regional Court [Fővárosi Törvényszék Cégbírósága])

Tax number

32072372-1-43

Telephone

+36 20 590 7083 (every day from 9 am to 8 pm, Hungarian time: UTC/GMT +1, in summer UTC/GMT +2)

E-mail

info@trawell.ltd

1.2. The Service Provider is not required to designate a data protection officer and has not designated one. Questions and requests concerning data processing may be addressed to the Service Provider by e-mail (info@trawell.ltd) or by post to its registered office — so that the request and the reply can be evidenced later.

1.3. This Privacy Notice applies to the processing of data by the Service Provider on its website (trawell.ltd, hereinafter: Website), by e-mail, by telephone and in person. In the case of an appointment by a court or an authority (Clause 2.8 of the Terms), the Service Provider processes the data received in the proceedings in accordance with the legislation governing those proceedings.

1.4. Data Subject: the natural person whose personal data the Service Provider processes — a person requesting an Offer, the Client and any person acting on its behalf, a visitor to the Website, and any person whose data appears in the document sent for translation or in the material sent for interpreting. Of the Data Subjects, only the Client may receive the document, the translation and the interpreting material (Clause 8.9).

1.5. The terms Client, Consumer, Offer and Services are defined in the Service Provider's General Terms and Conditions (hereinafter: Terms).

1.6. This Privacy Notice is based on Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: GDPR) and on Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information [2011. évi CXII. törvény az információs önrendelkezési jogról és az információszabadságról] (hereinafter: Infotv.). The terms personal data, processing, processor and recipient have the meaning given to them in Article 4 GDPR.

1.7. If the Service Provider intends to process personal data for a purpose not described in this Privacy Notice, it informs the Data Subject in advance.

2.1. An Offer can be requested through the request forms on the Website or by e-mail.

2.2. Data provided in the translation request form: name or company name, e-mail address, target language, deadline, country where the translation will be used, format, delivery method and the country to which the printed copy is to be sent by post, comments, and the uploaded document. In the interpreting request form: name, e-mail address, telephone number, the date, duration, venue and subject of the interpreting, and the uploaded material.

2.3. The purpose of the processing is to prepare and send the Offer and to keep in contact. The legal basis is taking steps at the request of the Data Subject prior to entering into a contract (Article 6(1)(b) GDPR). Without the fields marked as mandatory, no Offer can be prepared; the other fields are optional, but make the Offer more accurate.

2.4. The request arrives as an e-mail in the Service Provider's mailbox, with the uploaded files as attachments. The uploaded files do not remain on the Website's server: the server deletes them immediately after the e-mail has been sent — even if sending failed. No public or guessable link to the files is created.

2.5. The Service Provider processes, for the same purpose, the data provided for an Offer requested by e-mail. It keeps the request e-mail and the related correspondence for the period set out in Clause 5.2.

3.1. To perform the order, the Service Provider processes the following data: the data provided in the request for an Offer; the documents sent and the personal data they contain; the translation; the postal address for delivery; for interpreting, the date and time, the venue, the material sent for interpreting (Clause 4.7 of the Terms) and the working material prepared for it, and, in court or official proceedings, the names of the court or authority conducting the proceedings and of the person making the statement, and the case number; payment data (the amount, the currency, the time of payment, the payer's name and account number as provided by the bank and, for transfers from a foreign account, the bank confirmation sent); and the correspondence with the Client.

3.2. The purpose of the processing is to perform the Services and to keep in contact. The legal basis is the performance of the contract (Article 6(1)(b) GDPR). If another person acts on the Client's behalf — the person acting on behalf of a business, or the Client's legal representative — the Service Provider processes that person's name and contact details on the basis of its legitimate interest in keeping in contact (Article 6(1)(f) GDPR).

3.3. If the document to be translated or the material sent for interpreting contains health data or other special categories of personal data, or personal data relating to criminal convictions and offences, the Service Provider processes them solely for the translation or the interpreting, at the Client's request. By sending the document or the material and placing the order, the Client explicitly consents to the Service Provider processing the special categories of personal data it contains for this purpose (Article 9(2)(a) GDPR).

3.4. The Service Provider processes the data of other persons appearing in the document and in the material sent for interpreting solely for the translation or the interpreting. The Client warrants that it is entitled to have the document translated (Clause 7.5 of the Terms). If the Client is a business and the document or the material contains personal data processed by it — e.g. data of its employees or customers — the Service Provider acts, with regard to those data, as a processor on behalf of the Client (Article 28 GDPR).

3.5. For the translation, for checking the translation and for interpreting preparation, the Service Provider also uses text-processing software. For this purpose, the text of the document, of the translation and of the material sent for interpreting reaches the provider of the software, which acts as a processor (Clause 6.1) and does not use the text to develop its software. The Service Provider deletes the text stored in the software and the uploaded files after the order has been performed or, for consecutive orders in the same matter — e.g. several hearing days in the same proceedings — after the last of them has been performed.

3.6. The Service Provider does not record the interpreted conversation. For interpreting by videoconference, the Service Provider joins the call through the videoconferencing system specified by the Client (e.g. Zoom or Google Meet); the processing of data by that system is governed by its own terms. The Service Provider treats as confidential any information it learns during the interpreting (Clause 11.2 of the Terms).

3.7. The Service Provider keeps the order material — the document sent and the translation — for 10 years from performance: this way a defective translation can be corrected later (Clause 8.1 of the Terms), the Client can request a further copy, and the earlier translation can be used for a later order. It keeps the material sent for interpreting and the working material prepared for it — glossary, summary — for 8 years from the interpreting or, for consecutive orders in the same matter, from the last interpreting: this makes it possible to show what material the Offer was based on (Clause 4.7 of the Terms), and the preparation can be used for a later order. The legal basis for both is the legitimate interest of the Service Provider and of the Client (Article 6(1)(f) GDPR). At the Client's request, the Service Provider also deletes the material before then (Clause 8.3).

3.8. Invoicing and bookkeeping

3.8.1. To issue the invoice, the Service Provider processes the following data: the Client's name or company name and address, for a business its tax number and — for a business registered in another EU Member State — its EU VAT number, the description of the Services, the amount, and the e-mail address to which the invoice is sent.

3.8.2. The purpose of the processing is to issue and send the invoice — and, on request, the pro forma invoice — and to keep the books. The legal basis is a legal obligation to which the Service Provider is subject (Article 6(1)(c) GDPR).

3.8.3. The Service Provider keeps the invoice and the documents supporting the bookkeeping for at least 8 years (Section 169(2) of Act C of 2000 on Accounting [2000. évi C. törvény a számvitelről]). A request for erasure does not extend to them.

3.9. Withdrawal notice and complaints

3.9.1. Data provided through the Website's withdrawal function (Clause 10.5 of the Terms): name, identification of the order, e-mail address and the time of submission. The purpose of the processing is to receive the notice, acknowledge it by e-mail and give effect to the withdrawal. The legal basis is a legal obligation to which the Service Provider is subject (Article 6(1)(c) GDPR, Section 22(1a) of Government Decree No. 45/2014 (II. 26.) on the Detailed Rules of Contracts between Consumers and Businesses [45/2014. (II. 26.) Korm. rendelet a fogyasztó és a vállalkozás közötti szerződések részletes szabályairól]). The same applies to a notice given by e-mail or by post.

3.9.2. For a complaint, the Service Provider processes the complainant's name and contact details, the content of the complaint and the written record of an oral complaint. The purpose of the processing is to investigate and answer the complaint. The legal basis is a legal obligation to which the Service Provider is subject (Article 6(1)(c) GDPR, Section 17/A(7) of Act CLV of 1997 on Consumer Protection [1997. évi CLV. törvény a fogyasztóvédelemről]). The Service Provider keeps the written record, the written complaint and a copy of the reply for 5 years: for 3 years because the law requires it, and for a further 2 years — until civil-law claims become time-barred (Section 6:22(1) of Act V of 2013 on the Civil Code [2013. évi V. törvény a Polgári Törvénykönyvről (Ptk.)]) — on the basis of its legitimate interest (Article 6(1)(f) GDPR).

4.1. The Website does not use cookies and does not store any data on the visitor's device. Its fonts and icons are served by its own server; it does not load content from any other provider — font, map, video, analytics or advertising providers — so data about the visit does not reach such providers.

4.2. The Service Provider uses aggregated search data from Google Search Console; Search Console does not run any code on the Website.

4.3. The hosting provider's server keeps a log of requests to the Website: the IP address of the requester, the time of the request, the address requested and the browser identifier. The purpose of the processing is to operate and protect the Website. The legal basis is the Service Provider's legitimate interest (Article 6(1)(f) GDPR). The Service Provider keeps the server log for no more than 30 days.

4.4. IP address and geographical location

4.4.1. When the Website's request and withdrawal forms are submitted, the server determines from the sender's IP address the country, in some cases the locality (geolocation is approximate), and the internet service provider. It uses a database stored on the server for this: the IP address is not passed on to any third party to determine the location.

4.4.2. The IP address and the location determined appear in the request e-mail sent to the Service Provider. The purpose of the processing is to detect misuse — unsolicited requests and requests sent in someone else's name. The legal basis is the Service Provider's legitimate interest in protecting the Website and its mailbox (Article 6(1)(f) GDPR). The Service Provider keeps the e-mail for the period set out in Clause 5.2. The IP address is not entered in the Form Log (Clause 4.5).

4.4.3. The geolocation database: IP Geolocation by DB-IP, under the Creative Commons Attribution 4.0 licence.

4.5. The Form Log

4.5.1. The Service Provider also records every request for an Offer and every withdrawal notice submitted through the Website's forms in a log stored on the server (hereinafter: Form Log).

4.5.2. The Form Log contains:

• the time of submission, the form and the page from which it was submitted;
• the content of the form fields, including the name and the e-mail address;
• the number and type of attached files — not the file names;
• if the visitor reached the form's page from another website, that website's domain name; if from another page of the Website, the address of that page; and if through a link containing a source tag (e.g. utm_source=chatgpt.com), the value of the tag;
• the type of device (mobile or desktop), the name and language of the browser;
• the country, locality and internet service provider determined under Clause 4.4.1.

4.5.3. The purpose of the processing is to measure where requests for Offers come from — a search engine, an artificial-intelligence-based service or directly — and from which pages of the Website, to develop the Website on that basis, and to keep a record of requests for Offers. The legal basis is the Service Provider's legitimate interest (Article 6(1)(f) GDPR). The Service Provider does not pass the Form Log on to any third party.

4.5.4. The Website does not store any data on the visitor's device for this: the form sends the address of the referring page on submission, and the server reads the device, browser and language data from the submission request.

4.5.5. The Service Provider keeps the entries of the Form Log for 5 years from submission. After that, the name, the e-mail address, the telephone number, every free-text field, the locality, the internet service provider, and the day and hour of submission (the month remains) are automatically deleted from the entry; the other data remain as statistics without names.

4.5.6. The Service Provider stores the Form Log in a folder of the server that is not publicly accessible; it can be downloaded only with a password. The Data Subject may object to the processing in the Form Log (Clause 8.5).

4.6. Links from the Website to other websites open in a new tab. The operator of the website opened is responsible for its processing of data.

5.1. The Service Provider keeps personal data for as long as the purpose set out in Clauses 2–4 requires, and for no longer than the following periods:

Requests for Offers, correspondence, withdrawal notices

8 years from the date of the respective letter or e-mail (Clause 5.2)

Order material — the document and the translation

10 years from performance (Clause 3.7)

Interpreting material

8 years from the interpreting (Clause 3.7)

Invoices, accounting documents

at least 8 years (Clause 3.8.3)

Complaints: written record, reply

5 years (Clause 3.9.2)

Form Log

5 years, then without names (Clause 4.5.5)

Text and files in the text-processing software

until after performance (Clause 3.5)

Uploaded files on the server

until the e-mail is sent (Clause 2.4)

Server log

no more than 30 days (Clause 4.3)

5.2. The Service Provider keeps its correspondence with the Client and with the person requesting an Offer — with the attachments, the request e-mails and the withdrawal notice — for 8 years from the date of the respective letter or e-mail. The purpose of the processing is to evidence the orders, the Offers and the notices, to support the accounting documents, and to meet later requests from the Data Subject — a correction, a further copy, an earlier invoice. The legal basis is the Service Provider's legitimate interest (Article 6(1)(f) GDPR).

6.1. The Service Provider uses the following processors; a processor processes the data only on the Service Provider's instructions, for the task indicated (Article 28 GDPR):

Silicium Network Kft. [Private Limited Company], 1065 Budapest, Révay köz 4., Hungary

hosting of the Website: processing of the forms, the Form Log, the server log

Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland

the Service Provider's e-mail (Google Workspace): request e-mails, correspondence and attachments

KBOSS.hu Kft. [Private Limited Company] (Számlázz.hu), 1031 Budapest, Záhony utca 7., Hungary

issuing and sending invoices and pro forma invoices

NETLOCK Kft. [Private Limited Company], 1101 Budapest, Expo tér 5–7., Hungary

applying a qualified electronic seal and a time stamp to the electronically sealed PDF

Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland

text-processing software for the translation, for checking the translation and for interpreting preparation: the text of the document, of the translation and of the interpreting material

Corente Consulting Kft. [Private Limited Company], 2336 Dunavarsány, Homok utca 50., Hungary

bookkeeping of invoices and accounting documents

6.2. The following receive data from the Service Provider as independent controllers: the postal operator receives the addressee's name and address for sending the printed copy by post; the Service Provider's and the Client's banks receive the data needed for the transfer; authorities and courts receive what they request under the law.

6.3. The Service Provider does not pass personal data on to any other third party, does not sell it and does not use it for advertising. It does not carry out profiling or automated decision-making.

6.4. E-mail data may be stored on Google's servers outside the European Union, including in the United States. Transfers to the United States take place under the EU–US Data Privacy Framework, for which the European Commission has adopted an adequacy decision and in which Google LLC is a certified participant; where the Framework does not apply, under standard data protection clauses adopted by the Commission (Article 45 GDPR, Article 46 GDPR). The provider of the text-processing software may also process the data in the United States; that transfer takes place under standard data protection clauses adopted by the Commission (Article 46 GDPR). Otherwise, the Service Provider does not transfer personal data outside the European Union.

7.1. The Website can be accessed only over an encrypted (https) connection; form data reach the server encrypted.

7.2. Uploaded files do not remain on the server (Clause 2.4); the Form Log is kept in a password-protected folder of the server that is not publicly accessible.

7.3. The Service Provider keeps order material on its own device, and older order material on an external storage device that is not connected to any network.

7.4. Apart from the Service Provider, only the recipients named in Clause 6 have access to personal data, to the extent necessary for their task.

7.5. If a personal data breach occurs, the Service Provider handles it in accordance with the GDPR: where necessary, it notifies the supervisory authority and, if the breach involves a high risk to the Data Subject's rights, it also informs the Data Subject (Article 33 GDPR, Article 34 GDPR).

8.1. Access: The Data Subject may ask whether the Service Provider processes their personal data and, if so, which data, for what purpose, for how long and to whom it discloses them; they may also request a copy (Article 15 GDPR).

8.2. Rectification: They may request that inaccurate data be rectified and incomplete data completed (Article 16 GDPR).

8.3. Erasure (right to be forgotten): They may request the erasure of their data if processing them is no longer necessary or is unlawful for another reason. A request for erasure does not extend to what must be kept under the law — e.g. the invoice (Article 17 GDPR).

8.4. Restriction: They may request that the Service Provider only store the data but not use them — e.g. while it checks whether data disputed by the Data Subject are accurate, or while it decides on the Data Subject's objection (Article 18 GDPR).

8.5. Objection: They may object at any time, on grounds relating to their particular situation, to processing based on legitimate interest — such as the Form Log, the keeping of the order material, of the interpreting material and of the correspondence, and the processing of the IP address. The Service Provider then no longer processes the data unless the processing is justified by compelling grounds that take precedence, or is necessary for the enforcement of legal claims (Article 21(1) GDPR).

8.6. Data portability: They may receive, in a machine-readable format, the data they have provided to the Service Provider and that are processed on the basis of a contract, and transmit them to another controller (Article 20 GDPR).

8.7. Withdrawal of consent: They may withdraw their consent under Clause 3.3 at any time; withdrawal does not affect the lawfulness of earlier processing. After withdrawal, the Service Provider deletes the document or the material — except for the invoice.

8.8. Requests may be submitted by e-mail or by post (Clause 1.2). If there is doubt as to whether the request was submitted by the Data Subject, the Service Provider may ask for proof of identity (Article 12(6) GDPR). The Service Provider fulfils the request free of charge and replies without undue delay, at the latest within one month; if the request is complex, the period may be extended by a further two months, of which the Service Provider gives notice within one month (Article 12(3) GDPR).

8.9. The Service Provider releases the document sent for translation, the translation and the material sent for interpreting only to the Client. If the document or the material contains health data or other special categories of personal data, or personal data relating to criminal convictions and offences, the person making the request must prove that they placed the order. Any other person named in the document or the material may request information about their own data; providing a copy must not adversely affect the rights of others — including the Client (Article 15(4) GDPR).

8.10. Redress

8.10.1. If the Data Subject considers that the Service Provider is processing their personal data unlawfully, they may turn to the Hungarian National Authority for Data Protection and Freedom of Information (Section 22 of the Infotv., Article 77 GDPR):

Hungarian National Authority for Data Protection and Freedom of Information [Nemzeti Adatvédelmi és Információszabadság Hatóság]

Registered office

1055 Budapest, Falk Miksa utca 9–11., Hungary

Postal address

1363 Budapest, Pf. 9., Hungary

Telephone

+36 1 391 1400

E-mail

ugyfelszolgalat@naih.hu

Website

naih.hu

8.10.2. A Data Subject living in another state of the European Union or of the European Economic Area may also turn to the supervisory authority competent for their habitual residence or place of work.

8.10.3. The Data Subject may also go to court. At their choice, they may also bring the action before the Hungarian regional court competent for their place of residence or stay (Section 23(3) of the Infotv., Article 79 GDPR). If the Data Subject lives in another state of the European Union or of the European Economic Area, they may also bring the action before the courts of the state of their habitual residence (Article 79(2) GDPR).

8.10.4. Before lodging a complaint, the Data Subject may also contact the Service Provider; this is the quickest way to resolve complaints.

9.1. This Privacy Notice applies from 24 October 2026. The Service Provider may amend the Privacy Notice; it publishes the amended text on the Website together with the date from which it applies. It keeps earlier versions and sends them on request.

9.2. Clause 11.4 of the Terms refers to this Privacy Notice: by accepting the Offer, the Client declares that it has read the Privacy Notice.

Legislation applied

• General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) — Article 4 (definitions) · Article 6 (legal bases) · Article 9 (special categories of personal data) · Articles 12–22 (information, rights of the Data Subject) · Article 28 (processor) · Articles 33–34 (personal data breach) · Articles 45–46 (transfers) · Articles 77–79 (redress)
• Act on the Right of Informational Self-Determination and on Freedom of Information (Act CXII of 2011, Infotv.) — Sections 22–23 (enforcement of rights, judicial remedy)
• Accounting Act (Act C of 2000) — Section 169 (retention of accounting documents)
• Consumer Protection Act (Act CLV of 1997) — Section 17/A (handling of complaints)
• Government Decree No. 45/2014 (II. 26.) — Section 22 (acknowledgement of the withdrawal notice)
• Hungarian Civil Code (Act V of 2013) — Section 6:22 (limitation period)