Privacy Policy
PRIVACY POLICY
Futárlista
Operated by Alkusz Rendszerek Szolgáltató Kft.
Version: 1.0
Effective date: 2026.08.01.
Last updated: 2026.08.01.
────────────────────────────
TABLE OF CONTENTS
1. Introduction
2. Definitions
3. Data Controller Details
4. Scope of this Privacy Policy
5. Personal Data We Process
6. Purposes and Legal Bases of Processing
7. Transfer of Personal Data
8. International Transfer of Personal Data
9. Data Retention
10. Security of Personal Data
11. Data Subject Rights under the GDPR
12. Data Protection Incidents
13. Complaints and Legal Remedies
14. Amendments to this Privacy Policy
15. Contact Details
16. Final Provisions
Annex A – Data Retention Periods
Annex B – Categories of Cookies
Annex C – Categories of Data Processors and Service Providers
Annex D – Technical and Organisational Security Measures
Annex E – Procedure for Handling Data Subject Requests
Annex F – Version History
────────────────────────────
1. INTRODUCTION
Welcome to Futárlista, an online courier brokerage platform operated by Alkusz Rendszerek Szolgáltató Kft.
We are committed to protecting your privacy and to processing your personal data lawfully, fairly and transparently in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – GDPR), applicable Hungarian laws, and other relevant legal requirements.
This Privacy Policy explains how we collect, use, store, transfer and protect personal data when you:
• use our website;
• create a user account;
• request a quotation;
• order courier services;
• contact our customer service; or
• otherwise use our services.
The purpose of this Privacy Policy is to provide clear information about:
• the identity of the Data Controller;
• the categories of personal data we process;
• the purposes of processing;
• the legal bases of processing;
• the recipients of personal data;
• international data transfers;
• retention periods;
• the technical and organisational security measures applied;
• data subject rights under the GDPR; and
• how those rights may be exercised.
This Privacy Policy applies to all personal data processed through the Futárlista platform and related services.
1.1 About Futárlista
Futárlista is an online courier brokerage and postal intermediary platform operating in Hungary.
Our services allow customers to:
• compare courier services;
• order parcel delivery;
• arrange parcel collection;
• manage shipments;
• track deliveries;
• receive invoices;
• contact our customer service.
Futárlista does not perform physical parcel transportation.
Transportation services are always provided by the contracted courier service selected by the customer.
In order to organise and perform the services, the processing of certain personal data, and where necessary the transfer of such data to the relevant courier service provider, is essential.
1.2 Our Data Processing Principles
When processing personal data, Futárlista applies the following principles:
• Lawfulness
• Fairness
• Transparency
• Purpose limitation
• Data minimisation
• Accuracy
• Storage limitation
• Integrity and confidentiality
• Accountability
These principles apply throughout the entire lifecycle of personal data processing.
1.3 Applicable Legislation
This Privacy Policy has been prepared in particular on the basis of the following laws:
• Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR);
• Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information;
• Act CLIX of 2012 on Postal Services;
• Hungarian accounting laws;
• Hungarian tax laws;
• applicable consumer protection laws;
• other applicable laws of the European Union and Hungary.
1.4 Acceptance of the Privacy Policy
By using the Futárlista website or services, you declare that you have read and understood this Privacy Policy.
Where required by law, we request your consent for any processing activity that is based on your consent.
────────────────────────────
2. DEFINITIONS
For the purposes of this Privacy Policy, the following terms shall have the meanings set out below.
2.1 Personal Data
Personal data means any information relating to an identified or identifiable natural person.
An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to the following data:
• name;
• postal address;
• email address;
• telephone number;
• identification number;
• online identifier;
• IP address;
• location data; or
• one or more factors specific to the physical, economic, cultural or social identity of that natural person.
2.2 Data Subject
A data subject is any natural person whose personal data is processed by Futárlista.
This includes in particular:
• registered users;
• private individual customers;
• representatives of businesses;
• senders;
• recipients;
• website visitors;
• persons contacting customer service.
2.3 Processing
Processing means any operation performed on personal data, whether or not by automated means.
This includes in particular:
• collection;
• recording;
• organisation;
• storage;
• retrieval;
• consultation;
• use;
• transfer;
• disclosure;
• restriction;
• erasure;
• destruction.
2.4 Data Controller
The Data Controller is the legal person that determines the purposes and means of the processing of personal data.
For the purposes of this Privacy Policy, the Data Controller is:
Alkusz Rendszerek Szolgáltató Korlátolt Felelősségű Társaság
2.5 Data Processor
A Data Processor is a natural or legal person that processes personal data on behalf of the Data Controller.
Examples may include:
• hosting providers;
• invoicing service providers;
• payment service providers;
• IT service providers.
2.6 Courier Service Provider
A Courier Service Provider is any logistics company that performs the collection, transportation and delivery of consignments ordered through Futárlista.
Depending on the processing activity and the applicable legal framework, the courier service provider may act as an independent controller or as a processor.
2.7 Consent
Consent means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she signifies agreement to the processing of personal data relating to him or her.
Consent may be withdrawn at any time.
2.8 Data Protection Incident
A Data Protection Incident means any security event leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.
2.9 Website
Website means the online platform operated by Futárlista and available at:
2.10 Services
Services means all services provided through the Futárlista platform, in particular:
• ordering courier services;
• shipment management;
• payment handling;
• invoicing;
• customer service;
• shipment tracking.
────────────────────────────
3. DATA CONTROLLER DETAILS
3.1 Identification Details of the Data Controller
The Data Controller responsible for the processing of personal data described in this Privacy Policy is:
Company name
Alkusz Rendszerek Szolgáltató Korlátolt Felelősségű Társaság
("Alkusz Rendszerek Kft.")
Registered office
1158 Budapest
Késmárk utca 14/B
Hungary
Company registration number
01-09-179894
Tax number
24742070-2-42
Website
Telephone number
+36 70 229 9790
Customer service hours
Monday to Friday
09:00–18:00 (CET/CEST)
excluding Hungarian public holidays.
3.2 Our Activities
Alkusz Rendszerek Kft. operates the Futárlista online platform, which provides courier brokerage and shipment management services.
The company operates under Hungarian law as a postal intermediary, enabling its customers to use the services of various contracted courier service providers through a single online interface.
Futárlista enables customers to:
• compare courier services;
• create parcel dispatch orders;
• prepare waybills;
• order parcel collection;
• track shipments;
• manage invoices and payments;
• contact our customer service.
The physical transport and delivery of consignments are always performed by the selected courier service provider.
3.3 Role of the Data Controller
In connection with the operation of the website and the provision of services, Alkusz Rendszerek Kft. acts as the Data Controller within the meaning of Article 4(7) GDPR.
The Data Controller determines:
• the scope of personal data processed;
• the purpose of processing;
• the legal basis of processing;
• the recipients of data transfers;
• retention periods;
• the technical and organisational security measures applied.
3.4 Cooperation with Courier Service Providers
In order to perform ordered courier services, it is necessary for us to transfer certain personal data to the selected courier service provider.
Depending on the specific processing operation and the applicable legal provisions, the courier service provider may act:
• as an independent controller;
• as a joint controller; or
• as a processor.
Each courier service provider is independently responsible for the lawfulness of the data processing it performs during transportation and delivery.
3.5 Our Service Partners
The Data Controller uses carefully selected external service providers to support the operation of the Futárlista platform.
These providers may provide services in the following areas, among others:
• cloud hosting;
• software maintenance;
• payment services;
• invoicing;
• email delivery;
• cybersecurity;
• technical support;
• web analytics;
• system monitoring;
• backups.
Where such providers process personal data on behalf of the Data Controller, they may act only under a written agreement, in accordance with the instructions of the Data Controller, and they must apply appropriate technical and organisational security measures.
3.6 Contacting the Data Controller
If you have any questions regarding this Privacy Policy or the processing of personal data, you may contact us using the contact details provided above.
The Data Controller will respond without undue delay and within the deadlines set by applicable data protection laws.
────────────────────────────
4. SCOPE OF THIS PRIVACY POLICY
4.1 Personal Scope
This Privacy Policy applies to all natural persons whose personal data is processed by Futárlista in the course of providing its services.
This includes in particular:
• website visitors;
• registered users;
• private individual customers;
• representatives of businesses;
• authorised persons acting on behalf of businesses;
• senders;
• recipients;
• persons requesting quotations;
• persons contacting customer service;
• newsletter subscribers.
4.2 Material Scope
This Privacy Policy applies to all personal data processed by Futárlista in connection with the following services:
• user registration;
• user account management;
• quotation requests;
• ordering courier services;
• shipment management;
• organisation of parcel collection;
• shipment tracking;
• invoicing;
• payment handling;
• customer service;
• complaint handling;
• operation of the website;
• electronic communication;
• marketing communication, where the data subject has consented.
4.3 The Website
This Privacy Policy applies to all processing carried out via the website
including in particular:
• publicly accessible pages;
• user accounts;
• the shipment management interface;
• contact forms;
• online customer service interfaces;
• future online services of the Futárlista platform.
4.4 Offline Communication
This Privacy Policy also applies to processing carried out through the following channels:
• email communication;
• telephone communication;
• written correspondence;
• customer service enquiries;
• complaint handling;
• other business communication related to the services.
4.5 Representatives of Businesses
Where our services are used by a company or another legal entity, this Privacy Policy also applies to the personal data of natural persons acting on behalf of that organisation.
This may include for example:
• managing directors;
• company representatives;
• contact persons;
• finance administrators;
• employees arranging parcel dispatch.
This Privacy Policy does not apply to data that relates exclusively to legal entities and does not qualify as personal data.
4.6 Personal Data of Recipients
In order to perform the courier service ordered by the sender, Futárlista also processes certain personal data of recipients.
This typically includes the following data:
• name;
• delivery address;
• telephone number;
• email address (where provided).
Recipient data is processed solely for the purpose of organising, transporting and delivering the consignment and complying with related legal obligations.
4.7 Personal Data of Children
Futárlista services are intended for persons who are legally capable of entering into contracts under applicable law.
We do not knowingly collect personal data from children.
If we become aware that we have unlawfully processed the personal data of a child, we will take the necessary measures without delay to delete such data.
4.8 Third-Party Websites
Our website may contain links to websites operated by third parties.
This Privacy Policy applies only to processing carried out by Futárlista.
We do not accept responsibility for the data processing practices, content or security of external websites.
We recommend that users review the privacy policy of every external website before using it.
4.9 Language Versions
This Privacy Policy may be available in multiple languages.
If there is any discrepancy between language versions, the Hungarian language version shall prevail unless otherwise required by law.
────────────────────────────
5. PERSONAL DATA WE PROCESS
The scope of personal data processed by Futárlista depends on which services the data subject uses and how the Website is used.
We process only personal data that is necessary for providing the services, complying with legal obligations, enforcing our legitimate interests, or based on the data subject’s consent.
5.1 Data Processed During Registration
When creating a user account, we may process the following personal data:
Data category: Identification data
Examples: Full name
Data category: Company data
Examples: Company name, tax number
Data category: Contact data
Examples: Email address, telephone number
Data category: Billing data
Examples: Billing address
Data category: Login data
Examples: Username, encrypted password
Data category: Registration data
Examples: Date and time of registration
Passwords are never stored in readable form.
Passwords are stored only in encrypted or hashed form using modern industry-standard methods.
5.2 Data Related to Shipments
To organise courier services, we process the personal data of both the sender and the recipient.
Sender data
We may process the following data:
• full name;
• company name (where applicable);
• pickup address;
• telephone number;
• email address.
Recipient data
We may process the following data:
• full name;
• delivery address;
• telephone number;
• email address (where available).
Recipient data is processed solely for the purpose of organising and performing the ordered courier service.
Shipment data
Depending on the selected courier service, we may also process the following shipment data:
• shipment identifier;
• selected courier service;
• pickup date;
• number of parcels;
• parcel weight;
• parcel dimensions;
• declared value (where applicable);
• delivery notes;
• identification numbers generated by the courier service.
Where necessary for customs clearance or compliance with legal obligations, additional shipment data may also be processed.
5.3 Payment Data
Where payment is made through the Futárlista platform, we may process the following data:
• payment transaction identifier;
• transaction identifier;
• amount paid;
• currency;
• payment status;
• invoice reference number.
Futárlista does not store full bank card details.
Bank card data is processed directly within the system of the relevant payment service provider.
5.4 Billing Data
For compliance with Hungarian accounting and tax laws, we process the following data:
• billing name;
• billing address;
• company name;
• tax number;
• EU VAT number (where applicable);
• invoice number;
• payment status.
Accounting documents are retained for the period required by applicable law.
5.5 Customer Service Data
Where you contact our customer service, we may process the following data:
• name;
• email address;
• telephone number;
• shipment identifier;
• content of correspondence;
• complaint details;
• voluntarily attached documents;
• customer service history.
We process this data in order to respond to enquiries, resolve issues and improve our customer service.
5.6 Data Automatically Collected During Use of the Website
When using the Website, certain technical information may be collected automatically.
This may include in particular:
• IP address;
• browser type;
• browser version;
• operating system;
• device type;
• language settings;
• date and time of access;
• referring website;
• visited pages;
• session duration;
• navigation events;
• log data relating to system errors.
We process this data mainly for the following purposes:
• operation of the Website;
• maintaining IT security;
• performance monitoring;
• troubleshooting;
• statistical analysis.
5.7 Cookies and Similar Technologies
Futárlista uses cookies and similar technologies to improve the operation, performance and security of the Website.
Depending on the user’s settings, cookies used may include:
• strictly necessary cookies;
• functional cookies;
• analytics cookies;
• marketing cookies.
Detailed information about cookies is provided in Annex B – Categories of Cookies.
5.8 Processing for Marketing Purposes
Where you have consented, we may process the following data for marketing purposes:
• name;
• email address;
• date of subscription;
• marketing preferences;
• record of consent.
You may withdraw your consent at any time using the unsubscribe link in newsletters or by contacting the Data Controller directly.
5.9 Communication
Where you contact us by email, telephone, online form or other communication channel, we process the data you provide voluntarily.
This may include in particular:
• contact details;
• shipment-related information;
• questions and enquiries;
• complaints;
• attached documents.
5.10 Fraud Prevention
In order to protect our customers and services, we may process certain data for:
• detecting fraud;
• preventing misuse of our services;
• identifying suspicious transactions;
• preventing unauthorised use of our systems;
• investigating security events.
The legal basis for such processing is the legitimate interest of the Data Controller.
5.11 Special Categories of Personal Data
Futárlista does not intentionally request or process special categories of personal data.
This includes in particular:
• health data;
• biometric data;
• genetic data;
• political opinions;
• religious or philosophical beliefs;
• trade union membership;
• criminal data;
• data concerning a natural person’s sex life or sexual orientation.
Please provide such data only where required by law or expressly required for a specific service.
5.12 Accuracy of Personal Data
The user is responsible for ensuring that the personal data provided to Futárlista is accurate, complete and up to date.
Where the user provides the personal data of another person – for example a recipient – the user declares that he or she is entitled to provide such data and that the legal requirements for doing so have been met.
────────────────────────────
6. PURPOSES AND LEGAL BASES OF PROCESSING
Futárlista processes personal data only where there is an appropriate legal basis under Article 6 GDPR.
The legal basis applied depends on the specific processing activity.
6.1 Performance of a Contract
The primary legal basis for processing personal data is the performance of a contract or taking steps at the request of the data subject prior to entering into a contract.
This applies in particular to the following processing activities:
• creating and managing user accounts;
• preparing quotations;
• organising courier services;
• coordinating collection and delivery;
• communicating with customers;
• issuing waybills and shipping documents;
• processing payments;
• issuing invoices;
• providing customer service;
• handling complaints.
Without processing the necessary personal data, Futárlista cannot provide the ordered services.
6.2 Compliance with Legal Obligations
Certain personal data is processed in order to comply with legal obligations applicable to the Data Controller.
Such obligations may arise in particular from the following laws:
• the GDPR;
• Hungarian accounting laws;
• Hungarian tax laws;
• laws on postal services;
• consumer protection laws;
• court decisions;
• lawful requests from authorities.
Where processing is required by law, the provision of personal data may be mandatory.
If the data is not provided, Futárlista may not be able to provide the requested service or comply with its legal obligations.
6.3 Legitimate Interest
In certain cases, personal data is processed on the basis of the legitimate interests of the Data Controller or a third party.
Such legitimate interests may include in particular:
• prevention of fraud;
• protection of the Website;
• maintenance of IT security;
• prevention of unauthorised access;
• investigation of misuse;
• keeping logs;
• ensuring business continuity;
• enforcement of contractual rights;
• establishment, exercise or defence of legal claims.
Where necessary, the Data Controller performs a balancing test to determine whether its legitimate interests do not override the rights and freedoms of the data subject.
6.4 Consent
Certain processing activities are carried out solely on the basis of the data subject’s consent.
These may include in particular:
• subscribing to newsletters;
• marketing communication;
• use of optional cookies;
• promotional campaigns;
• customer satisfaction surveys.
Consent may be withdrawn at any time.
Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
6.5 Protection of Vital Interests
In exceptional cases, the processing of personal data may be necessary to protect the vital interests of a natural person.
This legal basis applies only in extraordinary situations where processing is necessary to protect human life or physical integrity.
6.6 Public Interest or Exercise of Official Authority
As a general rule, Futárlista does not process personal data on the basis of carrying out a task in the public interest or exercising official authority.
If future legal changes or the nature of our services make this necessary, this Privacy Policy will be amended accordingly.
6.7 Purposes of Processing
Depending on the service used, Futárlista processes personal data in particular for the following purposes:
• creating and managing user accounts;
• brokering courier services;
• organising parcel collection and transportation;
• communicating with customers;
• preparing shipping documents;
• issuing invoices;
• processing payments;
• providing shipment tracking;
• operating customer service;
• handling complaints;
• maintaining customer relations;
• improving our services;
• maintaining IT security;
• preventing fraud;
• complying with legal obligations;
• responding to requests from authorities;
• protecting the rights of Futárlista.
Personal data is not processed for purposes incompatible with those set out in this Privacy Policy.
6.8 Change of Purpose
Where Futárlista intends to process personal data for a purpose other than that for which it was originally collected, the data subject will be informed before such processing begins, unless otherwise provided by law.
Where required by law, we will also obtain the data subject’s consent before commencing the new processing activity.
6.9 Automated Decision-Making and Profiling
Futárlista does not currently use solely automated decision-making that would produce legal effects concerning the data subject or similarly significantly affect him or her.
We also do not carry out profiling within the meaning of Article 22 GDPR.
If such processing is introduced in the future, we will provide appropriate safeguards and prior information to the data subjects concerned.
────────────────────────────
7. TRANSFER OF PERSONAL DATA
Futárlista transfers personal data to third parties only where:
• it is necessary for the performance of the ordered service;
• it is required by law; or
• it is necessary for the protection of the legitimate interests of the Data Controller.
Futárlista does not sell personal data to third parties.
We do not disclose personal data to third parties for direct marketing purposes.
All transfers are carried out in accordance with applicable data protection laws.
7.1 Transfers to Courier Service Providers
Futárlista’s primary role is to organise courier services.
For this purpose, we transfer the personal data necessary for performing the shipment to the courier service provider selected by the customer.
Only data necessary for the performance of the service is transferred.
Sender data
The transferred data may include in particular:
• full name;
• company name (where applicable);
• pickup address;
• telephone number;
• email address.
Recipient data
The transferred data may include in particular:
• full name;
• delivery address;
• telephone number;
• email address (where available).
Shipment data
The following shipment data may also be transferred to the courier service provider:
• shipment identifier;
• selected courier service;
• number of parcels;
• weight;
• dimensions;
• pickup time;
• delivery notes;
• declared value (where applicable).
Only data necessary for the performance of the service is transferred.
7.2 Courier Partners
Depending on the selected service, personal data may be transferred to one of the following contracted courier service providers:
• DPD Hungária Kft.;
• UPS Magyarország Kft.;
• GLS General Logistics Systems Hungary Csomag-Logisztikai Kft.;
• FedEx Express Hungary Kft.;
• Express One Hungary Kft.;
• TNT Magyarország Kft. (where applicable);
• other contracted courier partners available on the Futárlista platform.
The list of courier partners may change from time to time.
The current list of partners is available upon request.
7.3 Payment Service Providers
In the case of electronic payment, the personal data necessary to complete the transaction may be transferred to the payment service provider.
The transferred data may include in particular:
• transaction identifier;
• amount payable;
• currency;
• invoice reference number;
• payment status.
Futárlista does not receive or store full bank card details.
Bank card data is processed exclusively within the payment service provider’s own system in accordance with PCI DSS security requirements.
7.4 Invoicing Service Providers
In order to comply with accounting and tax obligations, the data necessary for invoicing may be transferred to an invoicing service provider.
The transferred data may include in particular:
• customer name;
• billing address;
• company name;
• tax number;
• EU VAT number (where applicable);
• invoice amount;
• payment status.
Billing data is used solely for accounting and tax purposes.
7.5 IT Service Providers
To ensure the operation of Futárlista, we use various IT service providers.
These providers may perform the following tasks in particular:
• hosting;
• provision of cloud infrastructure;
• software development;
• system maintenance;
• system monitoring;
• creation of backups;
• cybersecurity services;
• email delivery;
• technical support.
All service providers may process personal data only under a written agreement and in accordance with the instructions of the Data Controller.
7.6 Professional Advisors
Personal data may also be transferred to professional advisors where lawful and necessary.
Such advisors may include in particular:
• lawyers;
• accountants;
• auditors;
• insurance advisors;
• other professional advisors.
All such transfers are limited to what is necessary.
7.7 Authorities
Personal data may also be transferred to authorities where required by law or in response to a lawful official request.
This may include in particular:
• courts;
• tax authorities;
• customs authorities;
• law enforcement authorities;
• supervisory authorities;
• other authorities acting under applicable law.
Where permitted by law, the data subject will be informed of the transfer in advance.
7.8 Corporate Transactions
If the operation of Futárlista is affected by:
• merger;
• acquisition;
• transfer of business line;
• reorganisation;
• insolvency proceedings
personal data may be transferred as part of the transaction.
Any such transfer is carried out subject to appropriate confidentiality obligations and compliance with applicable law.
7.9 Data Minimisation
In every transfer, Futárlista transfers only the minimum amount of data necessary to achieve the intended purpose.
The organisations receiving the data are entitled to process it only for the purpose for which it was transferred.
────────────────────────────
8. INTERNATIONAL TRANSFER OF PERSONAL DATA
Futárlista primarily processes personal data within the European Economic Area (EEA).
However, in certain cases – especially in connection with international shipments or the use of certain IT services – personal data may also be transferred to countries outside the EEA.
In all such cases, Futárlista ensures that appropriate safeguards as required under Chapter V of the GDPR are in place.
These may include in particular:
• an adequacy decision of the European Commission;
• Standard Contractual Clauses (SCCs);
• Binding Corporate Rules (BCRs);
• an approved code of conduct;
• an approved certification mechanism;
• or any other transfer safeguard recognised by the GDPR.
Where necessary, we also apply additional technical and organisational measures to ensure an appropriate level of protection for personal data.
8.1 International Shipments
Where the destination country of a shipment is outside the European Union or the European Economic Area, certain personal data may be transferred to:
• the selected courier service provider;
• customs authorities;
• border authorities;
• logistics partners;
• import and export authorities;
• other organisations involved in the transportation.
Only data necessary for performing the shipment and complying with legal obligations is transferred.
8.2 International Technology Providers
Certain technology service providers supporting the operation of Futárlista may process personal data outside the European Economic Area.
Before engaging such providers, Futárlista examines whether appropriate data protection safeguards are in place.
8.3 Further Information
Further information about international transfers of personal data may be requested from the Data Controller using the contact details set out in this Privacy Policy.
────────────────────────────
9. DATA RETENTION
Futárlista retains personal data only for as long as necessary to achieve the purpose of processing or to comply with our legal obligations.
When determining retention periods, we take into account in particular:
• the purpose of processing;
• applicable laws;
• contractual obligations;
• legitimate business interests;
• applicable limitation periods.
After the retention period expires, personal data is securely deleted, anonymised or otherwise permanently removed in accordance with our internal retention rules.
9.1 User Accounts
Personal data related to user accounts is processed for the duration of the user relationship.
After account termination, certain data may still be retained where necessary for:
• compliance with legal obligations;
• resolution of disputes;
• prevention of fraud;
• enforcement of contractual rights;
• protection of our legitimate interests.
9.2 Shipment Data
Data related to shipments is retained only for as long as necessary for:
• performance of the courier service;
• customer service activities;
• complaint handling;
• compliance with legal obligations;
• establishment, exercise or defence of legal claims.
9.3 Accounting Documents
Invoices, accounting documents and related financial records are retained for the period specified by Hungarian accounting and tax laws.
9.4 Customer Communication
Communication with customers – including emails, online enquiries and customer service correspondence – may be retained for a reasonable period for the following purposes:
• responding to enquiries;
• improving customer service;
• investigating complaints;
• resolving disputes;
• proving contractual performance.
9.5 Log Files
Technical log files generated during the operation of the Website are retained only for as long as necessary for:
• maintaining IT security;
• investigating technical incidents;
• detecting unauthorised access;
• diagnosing system errors;
• performance analysis.
9.6 Marketing Data
Personal data processed for marketing purposes on the basis of consent is retained until:
• the data subject withdraws consent;
• the data subject unsubscribes from marketing communication; or
• the purpose of processing ceases to exist.
9.7 Legal Claims
Where personal data is necessary for the establishment, exercise or defence of legal claims, it may be retained until the expiry of the applicable limitation period.
────────────────────────────
10. SECURITY OF PERSONAL DATA
Futárlista applies appropriate technical and organisational measures to ensure a level of security appropriate to the nature of the personal data processed and the risks associated with processing.
Our security measures are regularly reviewed and updated where necessary.
10.1 Technical Measures
Depending on the nature of the processing, we may apply the following security measures in particular:
• HTTPS/TLS encrypted communication;
• secure server infrastructure;
• firewall protection;
• protection against malicious software;
• intrusion detection systems;
• encrypted or hashed password storage;
• secure authentication procedures;
• role-based access control;
• logging;
• backups;
• disaster recovery procedures;
• system monitoring.
10.2 Organisational Measures
Our organisational measures include in particular:
• confidentiality obligations;
• employee data protection training;
• internal security policies;
• documented access control procedures;
• regular review of permissions;
• incident handling procedures;
• supplier controls.
Personal data may be accessed only by persons who require such access for the performance of their job duties.
10.3 Confidentiality
Employees, contractors and processors of Futárlista are required to treat personal data confidentially.
Access to personal data is always granted on a need-to-know basis.
10.4 Password Security
User passwords are never stored in readable form.
Passwords are stored only in encrypted or hashed form in accordance with modern industry standards.
We recommend that users:
• use strong passwords;
• do not reuse passwords across other services;
• keep login credentials confidential;
• notify Futárlista immediately in the event of suspected unauthorised access.
10.5 Incident Management
Futárlista maintains documented procedures for:
• identifying security events;
• assessing risks;
• remedying incidents;
• restoring affected systems;
• documenting actions taken.
Where an incident involving personal data occurs, it is handled in accordance with Articles 33 and 34 GDPR.
10.6 Continuous Improvement
Information security measures are regularly reviewed.
Our technical and organisational measures are continuously improved to ensure they remain appropriate in light of:
• new cybersecurity risks;
• technological developments;
• legal changes;
• changes in our operations;
• recommendations of supervisory authorities.
────────────────────────────
11. DATA SUBJECT RIGHTS UNDER THE GDPR
Futárlista respects the rights of all data subjects in relation to the protection of personal data.
Within the framework of applicable law, you may exercise the following rights at any time using the contact details provided in this Privacy Policy.
We respond to requests without undue delay and no later than one month from receipt, unless the GDPR allows a longer period.
Where there are reasonable doubts concerning the identity of the person submitting the request, we may ask for additional information to verify identity.
11.1 Right to Information
You have the right to receive clear, transparent and easily understandable information about:
• what personal data we process;
• for what purpose we process it;
• the legal basis of processing;
• to whom personal data is disclosed;
• how long data is retained;
• whether international transfers take place;
• what rights you have under applicable data protection laws.
This Privacy Policy forms part of that information.
11.2 Right of Access
You have the right to obtain confirmation as to whether Futárlista processes your personal data.
If so, you have the right to access in particular the following information:
• your personal data;
• the purposes of processing;
• the categories of personal data concerned;
• the recipients or categories of recipients to whom the data has been disclosed;
• the retention period;
• your rights;
• the source of the data, where it was not obtained directly from you;
• information on automated decision-making, where such processing takes place.
Upon request, we provide a copy of the personal data processed, unless restricted by law.
11.3 Right to Rectification
You have the right to request the correction of inaccurate personal data without undue delay.
You also have the right to request completion of incomplete personal data.
We ask our users to keep their data up to date at all times.
11.4 Right to Erasure ("Right to be Forgotten")
You have the right to request the erasure of your personal data, in particular where:
• the personal data is no longer necessary for the purpose for which it was collected;
• you withdraw consent and there is no other legal basis for the processing;
• you successfully object to the processing;
• the personal data has been unlawfully processed;
• erasure is required by law.
The right to erasure is not absolute.
Futárlista may continue to retain personal data where necessary for:
• compliance with legal obligations;
• establishment, exercise or defence of legal claims;
• compliance with accounting or tax obligations;
• protection of its legitimate interests, where permitted by law.
11.5 Right to Restriction of Processing
You have the right to request restriction of processing where:
• you contest the accuracy of the personal data;
• the processing is unlawful but you oppose erasure;
• the Data Controller no longer needs the data, but you require it for legal claims;
• you have objected to processing and the balancing of interests is still pending.
During the restriction period, personal data will be stored, but no other processing operation will be carried out except as permitted by law.
11.6 Right to Data Portability
Where processing is based on consent or a contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used and machine-readable format.
Where technically feasible, you may also request that your data be transmitted directly to another controller.
11.7 Right to Object
You have the right to object at any time to the processing of your personal data where such processing is based on the legitimate interest of Futárlista.
If you object, the processing will be discontinued unless we demonstrate compelling legitimate grounds that override your rights and freedoms or where processing is necessary for the establishment, exercise or defence of legal claims.
11.8 Right to Withdraw Consent
Where processing is based on consent, you have the right to withdraw that consent at any time.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
This may apply in particular to:
• newsletter subscriptions;
• marketing communications;
• cookies based on consent;
• promotional activities.
11.9 Rights Related to Automated Decision-Making
Futárlista does not currently use solely automated decision-making that would produce legal effects or similarly significantly affect the data subject.
We also do not perform profiling within the meaning of Article 22 GDPR.
If such processing is introduced in the future, data subjects will receive appropriate information and the safeguards required by law.
11.10 Right to Lodge a Complaint
If you believe that we have processed your personal data unlawfully, you have the right to lodge a complaint with the competent supervisory authority.
However, we kindly ask that, where possible, you first contact us so that we can resolve the issue quickly and effectively.
11.11 Exercising Your Rights
You may submit requests relating to your GDPR rights using the following contact details:
Email:
or
through any official contact channel provided by Futárlista.
In order to protect personal data, we may request proof of identity before fulfilling the request.
11.12 Response Deadline
Futárlista responds to all requests as quickly as possible.
In accordance with Article 12 GDPR:
• requests are generally answered within one month;
• in particularly complex cases or where there is a large number of requests, this period may be extended by up to two additional months;
• the data subject will be informed of the extension within the original one-month period.
────────────────────────────
12. DATA PROTECTION INCIDENTS
Futárlista applies documented procedures for the identification, investigation and handling of incidents affecting personal data.
A Data Protection Incident means any security event that results in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.
12.1 Identification and Investigation of Incidents
In the event of a data protection incident, Futárlista:
• identifies the nature of the incident;
• assesses the scope of the personal data affected;
• determines the approximate number of affected individuals;
• evaluates the likely risks;
• takes the necessary remedial and preventive measures.
All incidents are documented in an internal register.
12.2 Notification of the Supervisory Authority
Where a data protection incident is likely to result in a risk to the rights and freedoms of natural persons, Futárlista notifies the competent supervisory authority without undue delay and, where feasible, within 72 hours in accordance with Article 33 GDPR.
The notification shall include, where available, in particular:
• the nature of the incident;
• the categories of personal data concerned;
• the approximate number of affected individuals;
• the likely consequences of the incident;
• the measures taken or proposed;
• contact details for further information.
12.3 Communication to Data Subjects
Where a data protection incident is likely to result in a high risk to the rights and freedoms of data subjects, Futárlista informs the affected individuals without undue delay, unless an exception under Article 34 GDPR applies.
The communication shall contain in clear language:
• the nature of the incident;
• the likely consequences;
• the measures taken;
• recommended actions for the affected individuals;
• contact details for further information.
12.4 Incident Register
Futárlista keeps a record of all data protection incidents, regardless of whether notification to an authority or communication to data subjects was required.
The register includes in particular:
• the circumstances of the incident;
• its consequences;
• the remedial measures taken;
• the measures introduced to prevent future incidents.
This enables demonstration of compliance with Articles 33 and 34 GDPR.
────────────────────────────
13. COMPLAINTS AND LEGAL REMEDIES
Futárlista is committed to handling data protection related enquiries and complaints fairly, promptly and transparently.
If you have any concerns regarding the processing of your personal data, we ask that you first contact us so that the issue may be resolved as quickly as possible.
Nothing in this Privacy Policy limits any rights you may have under the GDPR or other applicable law.
13.1 Contacting Futárlista
Questions, requests or complaints concerning the processing of personal data may be submitted using the following contact details:
Alkusz Rendszerek Szolgáltató Korlátolt Felelősségű Társaság
Registered office
1158 Budapest
Késmárk utca 14/B
Hungary
Website
Telephone number
+36 70 229 9790
Customer service hours
Monday to Friday
09:00–18:00 (CET/CEST)
excluding Hungarian public holidays.
13.2 Supervisory Authority
If you believe that the processing of your personal data infringes applicable data protection laws, you have the right to lodge a complaint with the competent supervisory authority.
For Futárlista, the competent supervisory authority is:
National Authority for Data Protection and Freedom of Information (NAIH)
Address
1055 Budapest
Falk Miksa utca 9–11.
Hungary
Postal address
1363 Budapest, Pf. 9
Telephone
+36 1 391 1400
Website
A complaint submitted to the supervisory authority does not affect your right to any other administrative or judicial remedy.
13.3 Judicial Remedy
Independently of any available administrative remedies, you have the right to seek a judicial remedy if you consider that your rights under the GDPR have been infringed as a result of the processing of your personal data.
Proceedings may be brought before the competent Hungarian court with jurisdiction.
Where permitted by law, proceedings may also be brought before the court of your place of residence or habitual residence.
The burden of proof lies with the Data Controller to demonstrate that the processing of personal data complies with applicable data protection laws.
If the court determines that the processing was unlawful, it may in particular order:
• rectification of inaccurate personal data;
• erasure of personal data;
• restriction of processing;
• provision of the requested information;
• cessation of unlawful processing;
• payment of damages where provided by law.
13.4 Compensation
Any person who has suffered material or non-material damage as a result of an infringement of the GDPR has the right to receive compensation from the controller or processor responsible for the damage in accordance with Article 82 GDPR.
13.5 Cooperation with Supervisory Authorities
Futárlista fully cooperates with the competent supervisory authorities and provides all information required by law in connection with investigations concerning the processing of personal data.
────────────────────────────
14. AMENDMENTS TO THIS PRIVACY POLICY
Futárlista reserves the right to amend or update this Privacy Policy from time to time.
Such amendments may take place in particular in the following cases:
• legal changes;
• changes to our services;
• technological developments;
• improvements to security measures;
• organisational changes;
• recommendations of supervisory authorities.
The current version of this Privacy Policy is always published on the Futárlista Website.
Where amendments materially affect the processing of personal data, data subjects will be informed in the manner required by law.
The “Last updated” date indicated at the beginning of the document shows the effective date of the latest amendment.
────────────────────────────
15. CONTACT DETAILS
If you have any questions regarding this Privacy Policy or the processing of your personal data, please contact us.
Alkusz Rendszerek Szolgáltató Korlátolt Felelősségű Társaság
Registered office
1158 Budapest
Késmárk utca 14/B
Hungary
Website
Telephone number
+36 70 229 9790
Customer service hours
Monday to Friday
09:00–18:00 (CET/CEST)
excluding Hungarian public holidays.
────────────────────────────
16. FINAL PROVISIONS
This Privacy Policy forms an integral part of the General Terms and Conditions governing the use of the Futárlista platform.
This Policy applies to all processing activities carried out in connection with the services provided by Alkusz Rendszerek Szolgáltató Korlátolt Felelősségű Társaság through the website www.futarlista.hu.
By using the Website or the services, the user declares that he or she has read and accepted the contents of this Privacy Policy.
Where any processing activity requires consent under applicable law, such consent shall be obtained separately by the Data Controller.
If any provision of this Privacy Policy is found to be invalid or unenforceable, this shall not affect the validity of the remaining provisions.
This Privacy Policy shall be governed by the laws of Hungary and the directly applicable laws of the European Union, in particular Regulation (EU) 2016/679 (GDPR).
────────────────────────────
ANNEX A – DATA RETENTION PERIODS
Category of personal data: User account data
Purpose of processing: User account management
Legal basis: Performance of a contract
Retention period: Duration of the user relationship and the applicable limitation period
Category of personal data: Shipment data
Purpose of processing: Provision of courier services
Legal basis: Performance of a contract
Retention period: For as long as necessary to perform the service and comply with legal obligations
Category of personal data: Customer service correspondence
Purpose of processing: Customer service
Legal basis: Contract / Legitimate interest
Retention period: Up to 5 years after closure of the matter
Category of personal data: Accounting documents
Purpose of processing: Compliance with accounting and tax obligations
Legal basis: Legal obligation
Retention period: 8 years (or as required by applicable law)
Category of personal data: Payment transaction data
Purpose of processing: Financial administration
Legal basis: Legal obligation
Retention period: 8 years
Category of personal data: Website security logs
Purpose of processing: IT security
Legal basis: Legitimate interest
Retention period: Generally up to 12 months, unless longer retention is necessary
Category of personal data: Newsletter subscription data
Purpose of processing: Marketing
Legal basis: Consent
Retention period: Until withdrawal of consent
Category of personal data: Cookie settings
Purpose of processing: Operation of the Website
Legal basis: Consent / Legitimate interest
Retention period: For the lifespan of the relevant cookie
Category of personal data: Complaint handling records
Purpose of processing: Legal compliance
Legal basis: Legal obligation
Retention period: Up to 5 years after closure of the complaint
Category of personal data: Fraud prevention records
Purpose of processing: Security
Legal basis: Legitimate interest
Retention period: For as long as necessary for the investigation and prevention purpose
────────────────────────────
ANNEX B – CATEGORIES OF COOKIES
Futárlista uses cookies and other similar technologies to ensure the proper functioning of the Website, improve user experience, analyse Website performance and, where applicable, provide marketing functions.
Users may change their cookie preferences through the cookie management interface displayed on the Website or through their browser settings.
B.1 Strictly Necessary Cookies
These cookies are essential for the functioning of the Website and therefore cannot be switched off.
They are used in particular for the following purposes:
• maintaining user sessions;
• authenticating users;
• ensuring the security of the Website;
• remembering cookie settings;
• enabling navigation;
• preventing abuse.
Legal basis:
Article 6(1)(f) GDPR – Legitimate interest
and where necessary
Article 6(1)(b) GDPR – Performance of a contract
B.2 Functional Cookies
Functional cookies allow the Website to remember the settings selected by the user.
This may include for example:
• selected language;
• selected currency;
• user preferences;
• previously entered settings.
Legal basis:
Consent (where required by law).
B.3 Analytics Cookies
Analytics cookies help us analyse the use of the Website.
In particular, we may measure:
• page views;
• session duration;
• navigation paths;
• most popular pages;
• device types;
• browser statistics;
• Website performance.
Analytics services may include for example:
• Google Analytics 4.
Where possible, analytics is carried out using aggregated data.
Legal basis:
Consent.
B.4 Marketing Cookies
Marketing cookies may be used for the following purposes:
• measuring advertising performance;
• displaying personalised advertisements;
• remarketing;
• measuring the effectiveness of campaigns.
Marketing cookies are activated only after the user has given prior consent.
Legal basis:
Consent.
B.5 Managing Cookies
Users have the right to:
• accept all cookies;
• reject optional cookies;
• customise cookie settings;
• withdraw consent at any time.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
────────────────────────────
ANNEX C – CATEGORIES OF DATA PROCESSORS AND SERVICE PROVIDERS
In order to ensure the secure and efficient operation of its services, Futárlista engages carefully selected data processors and other service providers.
C.1 Courier Service Providers
For example:
• DPD Hungária Kft.
• UPS Magyarország Kft.
• GLS General Logistics Systems Hungary Csomag-Logisztikai Kft.
• FedEx Express Hungary Kft.
• Express One Hungary Kft.
• TNT Magyarország Kft. (where applicable)
• other contracted courier partners.
These organisations receive only the personal data necessary to perform the courier service.
C.2 Payment Service Providers
For example:
• Stripe;
• Revolut Pay;
• other payment service providers integrated into the Futárlista platform.
Bank card data is processed directly within the system of the payment service provider.
Futárlista does not store full bank card details.
C.3 Invoicing Service Providers
Invoices may be issued through an invoicing service provider.
For example:
• Számlázz.hu.
Billing data is processed solely for accounting and tax purposes.
C.4 Hosting Providers
Hosting providers may ensure:
• operation of web servers;
• operation of databases;
• storage of backups;
• provision of cloud infrastructure.
C.5 IT Service Providers
IT service providers may perform in particular the following tasks:
• software development;
• system maintenance;
• cybersecurity;
• technical support;
• system monitoring;
• disaster recovery.
C.6 Email Service Providers
Email service providers may ensure:
• sending transactional emails;
• user notifications;
• password reset emails;
• shipment notifications;
• customer communication.
C.7 Professional Advisors
This may include in particular:
• lawyers;
• accountants;
• auditors;
• insurance advisors;
• other professional advisors.
Personal data is transferred to them only for lawful purposes and to the extent necessary.
────────────────────────────
ANNEX D – TECHNICAL AND ORGANISATIONAL SECURITY MEASURES
Futárlista continuously reviews and improves its information security measures.
Technical measures
• HTTPS/TLS encrypted communication;
• secure server infrastructure;
• firewall protection;
• protection against malicious software;
• intrusion monitoring;
• role-based access control;
• strong password requirements;
• hashed password storage;
• database protection measures;
• security logging;
• backups;
• disaster recovery procedures.
Organisational measures
• confidentiality declarations;
• employee data protection training;
• access control policies;
• supplier controls;
• information security policies;
• internal audits;
• incident handling procedures;
• regular review of permissions.
The detailed technical implementation of security measures is not public where disclosure would reduce the security of the systems.
────────────────────────────
ANNEX E – PROCEDURE FOR HANDLING DATA SUBJECT REQUESTS
Data subjects may exercise their GDPR rights using the contact details provided in this Privacy Policy.
Requests may in particular relate to:
• access;
• rectification;
• erasure;
• restriction of processing;
• data portability;
• objection;
• withdrawal of consent.
In order to protect personal data, Futárlista may request proof of identity from the applicant.
Requests are generally assessed within one month.
In particularly complex cases, the response period may be extended by up to a further two months.
Futárlista may refuse manifestly unfounded or excessive requests in accordance with applicable law.
────────────────────────────
ANNEX F – VERSION HISTORY
Version: 1.0
Date: 2026.08.01.
Description: First Hungarian language edition of the Privacy Policy
Version: 1.1
Date: —
Description: Future amendments
Version: 2.0
Date: —
Description: Future amendments
────────────────────────────
END OF DOCUMENT
Privacy Policy
Futárlista
Operated by Alkusz Rendszerek Szolgáltató Kft.
© Alkusz Rendszerek Szolgáltató Kft. All rights reserved.