Privacy notice
This notice explains how D.A.S. CERTIFICATION Kft. processes personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Hungarian Act CXII of 2011 on the right to informational self-determination and on freedom of information (Infotv.).
Last updated: 4 November 2026
1. Data controller
- Name
- D.A.S. CERTIFICATION Korlátolt Felelősségű Társaság (D.A.S. CERTIFICATION Kft.)
- Registered office
- 1054 Budapest, Kálmán Imre utca 1., Hungary
- Company reg. no.
- Cg. 01-09-384534
- Tax no.
- 29252134-2-41
- Represented by
- Ruben Petronio, managing director
- info@dascertification.eu
- Phone
- +36 30 097 8523
D.A.S. Certification has not appointed a data protection officer, as it is not required to do so under Article 37 GDPR; all data protection requests can be sent to info@dascertification.eu.
2. Processing activities
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| (a) Replying to enquiries and quotation requests (e-mail, phone) | Name, e-mail, phone, organisation, content of the message | Art. 6(1)(b) GDPR (steps prior to a contract) and Art. 6(1)(f) GDPR (legitimate interest in answering) | 12 months after the last communication; if a contract follows, as in (b) |
| (b) Certification activities: application, contract, audits, certification decisions, surveillance and recertification | Name, role and contact details of the client's contact persons and of persons interviewed during audits; audit evidence | Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (obligations under ISO/IEC 17021-1 and NAH accreditation rules) | For the duration of the certification and for 5 years after its termination |
| (c) Public register of certified organisations (searchable on the Verify certificate page) | Organisation name, address, certified standard, IAF/EA sectors, certificate number, status (active, suspended, withdrawn), issue and expiry dates | Art. 6(1)(c) GDPR (ISO/IEC 17021-1 public information requirements) and Art. 6(1)(f) GDPR | While the certificate is valid; status changes are kept in the register as required by accreditation rules |
| (d) Handling of complaints and appeals | Name, contact details, content of the complaint or appeal, related documents | Art. 6(1)(c) and Art. 6(1)(f) GDPR | 5 years after the case is closed |
| (e) Auditor applications | CV, qualifications, contact details | Art. 6(1)(b) GDPR (steps prior to a contract) and, for keeping the CV for future selections, Art. 6(1)(a) GDPR (consent) | Until the end of the selection, at most 12 months; longer only with consent |
| (f) Contracted auditors | Identity and contact data, qualifications, competence records, impartiality and confidentiality declarations | Art. 6(1)(b) and Art. 6(1)(c) GDPR | For the duration of the contract and 5 years after its termination |
| (g) Invoicing and accounting | Name, address, tax number, invoice data | Art. 6(1)(c) GDPR – Hungarian Act C of 2000 on Accounting, §169 | 8 years |
| (h) Website operation and security | IP address, date and time, browser data in server logs | Art. 6(1)(f) GDPR (security and availability of the website) | For the period needed for security purposes, as set by the hosting provider |
| (i) Cookie preference | Consent choice and date stored in the browser | Art. 6(1)(c) GDPR (ePrivacy rules) | 12 months |
3. Source of data
Personal data are collected from the data subject, or from the client organisation (for its staff) as part of the certification contract.
4. Recipients
D.A.S. Certification does not sell personal data and does not use automated decision-making or profiling.
- Contracted auditors and technical experts bound by confidentiality and impartiality declarations;
- the National Accreditation Authority (NAH), for accredited certifications, during accreditation assessments;
- courts and authorities when required by law.
5. Processors
| Processor | Service | Location / transfers |
|---|---|---|
| Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden (privacy@lovable.dev) | Website hosting | Sweden (EU); its sub-processors are listed at trust.lovable.dev; any transfer outside the EEA relies on the European Commission's Standard Contractual Clauses |
| Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | E-mail (Google Workspace) and cloud document storage (Google Drive) | EU; transfers to Google LLC (USA) rely on the EU–US Data Privacy Framework and Standard Contractual Clauses |
| External accounting service provider | Bookkeeping and payroll | Hungary |
6. Security
Data are stored on protected internal storage and in Google Workspace with access limited to authorised staff; all staff and auditors sign confidentiality declarations.
7. Your rights
Under Articles 15–22 GDPR you have the right of access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interest, and the right to withdraw your consent at any time without affecting earlier processing.
Send requests to info@dascertification.eu. We reply within one month, which may be extended by two further months for complex requests, as allowed by Art. 12(3) GDPR. We may ask you to confirm your identity.
8. Remedies
You can lodge a complaint with the Hungarian supervisory authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9-11; postal address: 1363 Budapest, Pf. 9.; phone: +36 1 391 1400; e-mail: ugyfelszolgalat@naih.hu; website: www.naih.hu.
You may also bring an action before the court; under Infotv. you may choose the regional court (törvényszék) of your place of residence or stay. You may also complain to the supervisory authority of your EU country of residence.
9. Changes
We publish updates to this notice on this page, with the date of the last update.