Legal notice

Data Processing Policy

Appendix on the internal rules for carrying out data processing performed on behalf of another data controller

Csomád, Hungary, 10 June 2026 — Mag-Log TM Kft.

Table of Contents

1

Introduction and scope

The rules of this Appendix shall apply where the Company carries out data processing activities as a data processor on the instructions of another data controller. In such cases, the Company is required to maintain a record of processing activities as data processor (Article 30(2) of the Regulation). For the purposes of this Appendix and its annexes, "Controller" shall mean the data controller named in Part I of the Privacy Policy.

2

Processor guarantees

2.1. As data processor, the Company guarantees — in particular with regard to expertise, reliability and resources — that it implements the technical and organisational measures necessary to ensure compliance with the requirements of the Regulation, including the security of processing.

2.2. In the course of its activities, the Processor ensures that persons authorised to access the personal data concerned — unless they are already subject to an appropriate statutory obligation of confidentiality — undertake an obligation of confidentiality with respect to the personal data that comes to their knowledge. The text of the applicable Confidentiality Declaration is set out in Annex 1 to this Appendix.

2.3. The Company has appropriate hardware and software tools and undertakes to implement the technical and organisational measures necessary to ensure the lawfulness of processing and the protection of the rights of data subjects.

2.4. The Company has the legal and technical means required for electronic communication with public authorities.

2.5. The Company undertakes to make available to the instructing controller all information necessary to demonstrate compliance with the legal provisions applicable to the engagement of a processor.

3

Obligations and rights of the client (controller)

3.1. The Controller is entitled to verify at the Processor's premises the performance of the activities set out in the agreement.

3.2. The Controller bears responsibility for the lawfulness of its instructions relating to the tasks defined in the agreement; nevertheless, the Processor is required to notify the Controller without delay if an instruction of the Controller, or its implementation, would infringe applicable law.

3.3. It is the Controller's obligation to inform the natural persons concerned about the data processing carried out under this agreement and, where required by law, to obtain their consent.

4

Obligations and rights of the Company as data processor

4.1. Right to instruct

In carrying out its activities, the Processor acts exclusively on the written instructions of the Controller.

4.2. Confidentiality

In the course of its activities, the Processor ensures that persons authorised to access the personal data concerned — unless they are already subject to an appropriate statutory obligation of confidentiality — undertake an obligation of confidentiality with respect to the personal data that comes to their knowledge.

4.3. Data security

Taking into account the state of the art and the costs of implementation, and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Processor implements appropriate technical and organisational measures to guarantee a level of data security appropriate to the risk.

  • ▪The Processor takes measures to ensure that natural persons acting under its authority who have access to personal data may process such data only in accordance with the controller's instructions.
  • ▪The Processor ensures that stored data can be accessed, whether through an internal system or by direct access, only by persons authorised to do so and only in connection with the purpose of the processing.
  • ▪The Processor ensures the necessary regular maintenance and development of the tools it uses.
  • ▪Devices storing the data are kept in a closed room with adequate physical protection, and the Processor also ensures their physical protection.
  • ▪In order to perform the tasks defined in the agreement, the Processor is required to engage persons with appropriate knowledge and experience and ensures that persons it engages are trained in the applicable data protection legislation to be observed.

4.4. Engagement of a sub-processor

The Processor undertakes to engage a further data processor only subject to the conditions laid down in the Regulation and the Hungarian Information Act. Under this agreement, the Controller grants the Processor general authorisation to engage a further data processor (sub-contractor). Before engaging a further processor, the Processor informs the Controller of the identity of the further processor and of the tasks planned for it. Where the Processor engages the services of a further processor for carrying out specific processing activities on behalf of the Controller, it is required to conclude a written agreement with that further processor imposing the same data protection obligations on it. If the further processor fails to fulfil its data protection obligations, the Processor that engaged it remains fully liable to the Controller for the performance of those obligations.

4.5. Cooperation with the Controller

  • aIn its capacity as data processor, the Company assists the Controller by all appropriate means in facilitating the exercise of data subjects' rights, in order to enable the Controller to fulfil its obligations in this respect.
  • bAs Processor, the Company assists the Controller in complying with its obligations under Articles 32–36 of the Regulation (data security, data protection impact assessment and prior consultation), taking into account the nature of the processing and the information available to the Processor.
  • cAs data processor, the Company makes available to the Controller all information necessary to demonstrate compliance with the obligations set out in Article 28 of the Regulation, and allows for and contributes to audits, including inspections, conducted by the Controller. The Processor informs the Controller immediately if, in its opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions.
5

General terms and conditions of the data processing activity

5.1. The Company enters into a written agreement with the client for the data processing activity.

5.2. The general terms and conditions of the Company's data processing activity are set out in Annex 2 to this Appendix.

5.3. The content of the general terms and conditions must be disclosed to the other party before the agreement is concluded, and must be accepted by that party.

Dated

Csomád, Hungary, 10 June 2026

Mag-Log TM Kft.

Mag-Log TM Kft.

Annexes

Annexes

M1

Annex 1

Employee confidentiality declaration

Name of employer

_________________________________________

Confidentiality Declaration

Employee's name

___________________________

Job title

___________________________

Considering that, in respect of its activities, my employer qualifies as a data processor under EU Regulation 2016/679 (the General Data Protection Regulation, "GDPR") and under Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information, and that under these provisions the processor must ensure that persons authorised to process personal data undertake an obligation of confidentiality, and having become acquainted with the concept of "personal data" under the Regulation, meaning any information relating to an identified or identifiable natural person ("data subject") —

I hereby make the following confidentiality declaration:

  1. 1I undertake that any personal data that comes to my knowledge in the course of my work for the above-named employer will be processed and transmitted by me solely for the purpose of performing my job duties, that I will not use it for any other purpose, that I will not disclose or hand it over to any unauthorised person, that I will not permit unauthorised access to the personal data, and that I will not make the personal data public.
  2. 2I acknowledge that this obligation of confidentiality continues to bind me even after the termination of my employment or other work-related legal relationship.
  3. 3I acknowledge that breach of this obligation of confidentiality constitutes a material breach of an obligation arising from my employment, for which the employer may apply labour-law consequences. I acknowledge the notice regarding the criminal offence of breach of private secrets under Section 223 of the Hungarian Criminal Code, under which a person who, without proper cause, discloses a private secret that has come to their knowledge by virtue of their occupation or public office is punishable by confinement for a misdemeanour. The penalty is imprisonment of up to one year if the offence causes significant harm to interests.

Dated

_________________, this _____ day of _____________ 20____

employee's signature

M2

Annex 2

General terms and conditions of the data processing activity

Details of the Service Provider (Processor)

Company name:
Mag-Log TM Kft.
Registered seat:
2161 Csomád, Kossuth Lajos út 79.
Company registration number:
13-09-130548
Tax number:
14857513-2-13
Phone:
06-30-331-7134
E-mail:
hello@maglog.hu
Website:
www.maglog.hu | www.importexport.hu | www.importexportakademia.hu | www.klikkk.hu
Represented by:
Barabás Botond
Data Protection Officer:
none

These General Terms and Conditions for Data Processing ("Data Processing GTC") apply to all agreements concluded by the Service Provider with the ordering party (the "Client") for the provision of any service, unless such agreements provide otherwise.

I. General terms and conditions of the data processing activity

2. Subject matter of the processing

The subject matter of the processing is the handling of the data of natural persons who are in a legal relationship with the Client (the "data subject") in connection with the performance of the Agreement. Engaging the Processor does not require the prior consent of the data subject, but the data subject must be informed, which is the Client's responsibility.

Duration of the processing

For as long as the Agreement concluded with the Client remains in force, or until the data subject's consent is withdrawn.

3. Nature and purpose of the processing

The Processor processes the data of the data subjects for the purpose of providing the service, within the scope of the following activity: Business and other management consulting.

4. Types of personal data

  • ▪The name, address, telephone number and online identifier of the natural person
  • ▪Data specified in the Agreement
  • ▪In the case of mandatory processing, personal data specified by law

5. Categories of data subjects

The Client's natural-person customers, buyers, suppliers, clients, contact persons and employees.

6. Processor guarantees

For the duration of the Agreement, the Service Provider, as processor, guarantees the implementation and maintenance of the technical and organisational measures necessary to ensure compliance with the requirements of the EU General Data Protection Regulation (GDPR), including the security of processing. In this context, the Processor guarantees that:

  • ▪the Service Provider uses appropriate hardware and software tools and solutions to ensure the protection of the data processed in performing the Agreement,
  • ▪all of its processing is carried out with appropriate confidentiality and appropriate technical and organisational safeguards,
  • ▪every employee involved in processing has appropriate professional knowledge in the fields of data protection, data security and confidential data handling,
  • ▪every employee involved in processing is bound by an obligation of confidentiality with respect to the personal data that comes to their knowledge.

7. Obligations and rights of the Client (controller)

7.1. The Controller is entitled to verify at the Processor's premises the performance of the activities set out in the Agreement.

7.2. The Controller bears responsibility for the lawfulness of its instructions relating to the tasks defined in the Agreement; nevertheless, the Processor is required to notify the Controller without delay if an instruction of the Controller, or its implementation, would infringe applicable law.

7.3. It is the Controller's obligation to inform the natural persons concerned about the data processing carried out under this agreement and, where required by law, to obtain their consent.

7.4. In the case of mandatory processing, it is the Client's obligation to store and retain the personal data and its carriers.

8. Obligations and rights of the Service Provider as data processor

8.1. Right to instruct: In carrying out this activity, the Processor acts exclusively on the written instructions of the Controller.

8.2. Confidentiality: In the course of its activities, the Processor ensures that persons authorised to access the personal data concerned undertake an obligation of confidentiality.

8.3. Data security:

  • ▪The Processor is required to implement appropriate technical and organisational measures to guarantee a level of data security appropriate to the risk.
  • ▪The Processor is required to take measures to ensure that persons acting under its authority may process data only in accordance with the controller's instructions.
  • ▪The Processor is required to ensure that stored data is accessed only by persons authorised to do so and only in connection with the purpose of the processing.
  • ▪The Processor is required to ensure the regular maintenance and development of the tools used.
  • ▪Devices storing the data must be kept in a closed room with adequate physical protection.
  • ▪The Processor is required to engage persons with appropriate knowledge and experience and to ensure they are trained accordingly.

8.4. Engagement of a sub-processor:

The Processor undertakes to engage a further data processor only subject to the conditions laid down in the Regulation and the Hungarian Information Act. Before engaging a further processor, the Processor informs the Controller of the tasks planned for it. If the further processor fails to fulfil its data protection obligations, the Processor that engaged it remains fully liable to the Controller.

Identification of further data processors

Company name:
Registered seat:
Phone:
E-mail:
Website:
Data Protection Officer:
none

8.5. Cooperation with the Controller:

  • aIn its capacity as data processor, the Service Provider assists the Controller by all appropriate means to enable the exercise of data subjects' rights.
  • bAs Processor, the Company assists the Controller in complying with its obligations under Articles 32–36 of the Regulation.
  • cAs data processor, the Company makes available to the Controller all information necessary to demonstrate compliance with the obligations set out in Article 28 of the Regulation, including facilitating audits.

9. Procedure upon termination of the agreement

Termination of the underlying agreement also results in the termination of this data processing agreement. Following such termination, the Service Provider, as processor, shall return to the controller all personal data and records in its possession, in accordance with the underlying agreement — and, in the absence of any other arrangement between the parties, shall delete from its records any electronically held data, lists and registers.

II. Data processing provisions

These data processing provisions apply to the agreements referred to in point 1. For the purposes of this point 10 and its sub-points, the Service Provider qualifies as controller, and the data subject is the contracting party, or its representative or contact person.

10.1. The Service Provider, as controller, processes the personal data provided in the agreement by the natural person contracting with it, for the purpose of exercising the rights and obligations arising from the agreement and for maintaining contact, on the legal basis of performance of a contract. The retention period for this data is 5 years following termination of the agreement. The legal basis for processing the data provided for accounting and tax purposes is compliance with a legal obligation, in which case the retention period is 8 years.

10.2. The Service Provider processes the personal data provided in the agreement — as well as the address, e-mail address, telephone number and online identifier — of the natural person acting on behalf of the legal person contracting with it, for the purpose of maintaining contact, on the legal basis of legitimate interest. The retention period for this data is 5 years following termination of the agreement. Where processing is based on legitimate interest, the data subject has the particular right to object to the processing.

10.3. The Service Provider processes the name, address, telephone number, e-mail address and online identifier of the natural person designated as contact person in the agreement concluded with it, for the purpose of maintaining contact and exercising rights and obligations arising from the agreement, on the legal basis of legitimate interest. The retention period for this data is 5 years following the end of the person's role as contact person.

10.4. With respect to all data subjects, the recipients of the personal data are: the Service Provider's management, its employees performing client-relationship duties, and its accounting, tax and IT processors.

10.5. Personal data may be transferred for processing, for accounting and bookkeeping purposes, to the accounting firm engaged by the Service Provider, and for mailing and delivery purposes to the Hungarian Post Office or the courier service engaged, as well as to IT service providers.

10.6. Rights of the data subject

As described above, the natural person concerned has the following rights vis-à-vis the Service Provider, as controller, in connection with the processing:

  • ▪the right to transparent information, communication and facilitation of the exercise of rights,
  • ▪the right to prior information and disclosure (where the controller did not obtain the data from the data subject directly),
  • ▪the right of access and the right to rectification,
  • ▪the right to be informed of a personal data breach,
  • ▪the right to lodge a complaint with a supervisory authority,
  • ▪the right to an effective judicial remedy against the controller,
  • ▪subject to the conditions set out in data protection legislation: the right to erasure, the right to restriction of processing, the right to data portability, the right to object, and rights relating to automated decision-making.

Further detailed information about the rights of the natural person concerned, and information about the identity of the processors, is available in the Privacy Notice published on the Service Provider's website.

11. Termination of the agreement

Termination or cancellation of the agreement is governed by the provisions of the Agreement concluded between the parties.

12. Closing provisions

12.1. Matters not regulated in these General Terms and Conditions are governed by Act V of 2013 on the Civil Code, EU Regulation 2016/679, Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information, and the provisions of the Civil Code.

12.2. By signing, the Client confirms that it has read and accepted the provisions of these General Terms and Conditions in full prior to signing, and has received a copy thereof.

12.3. Having read and duly understood these general terms and conditions, the Parties have signed them in approval, in full agreement with their intent.

Dated at _________________, this ____ day of _____________ ______

Service Provider

Client