Legal information
Privacy notice
Information on the data processing connected to the adult training services of BDAT Solutions Kft.
This Privacy Notice explains how BDAT Solutions Kft. ("the Company", "we") processes the personal data of natural persons ("you") who interact with the Bdat.ACADEMY website (bdat.academy, bdatacademy.hu) and its training services. It provides the information required by Article 13 of the General Data Protection Regulation (GDPR).
1. Data controller
BDAT Solutions Kft.
Registered office: Kossuth Lajos utca 48–50, 1211 Budapest, Hungary
Company registration number: 01-09-377435 · EU VAT number: HU28960546
E-mail: connect@bdat.academy
Data protection contact: Gábor Sulok, Data Protection Officer (DPO), info@bdatsolutions.com.
2. What data we process, why, and on what legal basis
| Activity | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Registration for an open course, waiting list | name, e-mail address, phone number, company name (optional), message (optional), the selected course and date | processing the registration, confirming the place, communication about the course | steps prior to a contract and performance of the contract (GDPR Art. 6(1)(b)) | until the course is closed and related claims are time-barred (general limitation period: 5 years); accounting records are kept for 8 years as required by Hungarian accounting law |
| Request for an in-house training proposal, general enquiries | name, e-mail address, phone number, company name, content of the message | answering the enquiry, preparing a proposal | steps prior to a contract (Art. 6(1)(b)); for other enquiries, our legitimate interest in responding and maintaining business contact (Art. 6(1)(f)) | until the enquiry is closed, or until the proposal expires; for contracts, as above |
| Ordering a self-paced (AI CERTs) course | name, e-mail address, company and billing details, the selected course | fulfilling the order and setting up access to the learning material on the partner's platform | performance of the contract (Art. 6(1)(b)) | until contractual claims are time-barred; accounting records for 8 years |
| Exams and certificates | participant's name, e-mail address, exam details | arranging the exam or exam voucher included in the course with the certification body | performance of the contract (Art. 6(1)(b)) | until the exam is completed and certificate-related claims are time-barred |
| Newsletter and course announcements | name, e-mail address | informing you about new courses and dates | consent (Art. 6(1)(a)), which you may withdraw at any time | until consent is withdrawn |
| Operating and protecting the website | IP address, browser and device data, time of the request, result of the bot check | serving and accelerating the website, protection against attacks and automated abuse | legitimate interest (Art. 6(1)(f)) | for the short period needed for security purposes, according to the provider's technical logging practice |
For registrations and proposal requests, the data not marked as optional in the table is required; without it we cannot fulfil your request. For self-paced courses and exams, passing on the participant's name and e-mail address is a condition of setting up access or arranging the exam; without it we cannot deliver the service. Subscribing to the newsletter is a separate consent, independent of any registration.
Where a registration or order is placed by an employer, we receive the participants' names and e-mail addresses from the employer and use them solely to organise the course or the exam. We ask the ordering party to inform the participants about this notice.
3. Processors and recipients
We process data with the help of the following providers under data processing agreements:
- Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA): hosting and content delivery of the website, storage of registrations, and bot protection (Turnstile). Cloudflare processes technical data such as IP addresses to operate and secure the website.
- Brevo (Sendinblue SAS, 7 rue de Madrid, 75008 Paris, France): transactional e-mails (confirmations) and newsletters.
- Microsoft Ireland Operations Ltd. (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland): e-mail and office document management (Microsoft 365).
The following organisations process the data they receive from us as independent controllers, under their own rules and not on our instructions, to the extent necessary to deliver the service:
- AI CERTs (United States): the learning material and exam of self-paced AI courses are provided on the partner's own online platform. To set up your access we pass on your name and e-mail address; on the platform the partner's own privacy rules also apply. We inform you about this separately on the course page before you order.
- The Open Group and PeopleCert (and their appointed exam centres): accredited TOGAF® and ITIL® exams, issuing exam vouchers and certificates.
Beyond this, we disclose personal data to third parties only where required by law or with your explicit consent.
4. Cookies and similar technologies
The website currently does not use statistical or marketing cookies and does not track visitors. Technical data needed for operation (for example the bot check) is processed by Cloudflare in its own systems. Should we introduce analytics or advertising tools in the future, we will do so only with your prior consent: a cookie banner will let you decide, and we will update this notice.
5. Transfers to third countries
Among the providers and recipients listed above, Cloudflare (a processor) as well as AI CERTs and the certification bodies (independent controllers) may process data outside the European Economic Area, for example in the United States. We transfer data only under the conditions of Chapter V of the GDPR (on the basis of an adequacy decision of the European Commission or standard contractual clauses); information on the legal basis and safeguards of a specific transfer is available on request.
6. Your rights
- Access: you may ask which personal data we process about you and request a copy.
- Rectification: you may ask us to correct inaccurate or incomplete data.
- Erasure: you may ask us to delete your data where there is no longer a legal basis or purpose for processing.
- Restriction: in certain cases you may ask us to restrict processing.
- Data portability: you may receive the data processed on the basis of a contract or consent in a structured, machine-readable format.
- Objection: you may object to processing based on legitimate interest.
- Withdrawal of consent: you may unsubscribe from the newsletter at any time via the link in the footer of each e-mail or by e-mail; withdrawal does not affect the lawfulness of earlier processing.
You may send your request to our data protection contact (info@bdatsolutions.com) or to connect@bdat.academy; we respond within one month, and for complex or numerous requests this period may be extended by up to two months, of which we will inform you.
7. Complaints
If you believe that we process your data unlawfully, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, Falk Miksa utca 9–11, 1055 Budapest, Hungary; postal address: P.O. Box 9, 1363 Budapest, Hungary; ugyfelszolgalat@naih.hu; www.naih.hu), with the supervisory authority of your own country, or bring the matter before a court.
8. Data security
The Company operates an information security management system certified to ISO/IEC 27001:2022 (certification body: TAM CERT). Data is transmitted over encrypted connections, access is role-based, and registration data is stored in an access-controlled database separated from the public content of the website.
Our Information Security Policy is available here: Information Security Policy (PDF).
9. Changes to this notice
We update this notice as our services and the applicable law change. The current version is always available on this page. Last updated: 2026-09-07.