The data controller
- Name
ALTEO Energiaszolgáltató Nyilvánosan Működő Részvénytársaság
- Registered office
1117 Budapest, Dombóvári út 25., Hungary
- Company registration number
01-10-045985
- Tax number
14292615-4-44
Principles of personal data processing
The Company processes personal data in accordance with the following principles.
- Lawfulness, fairness and transparency
We process personal data lawfully, fairly and in a transparent manner toward the data subject.
- Purpose limitation
Personal data are collected only for specified, explicit and legitimate purposes, and are not processed in a manner incompatible with those purposes (further processing for archiving in the public interest, scientific or historical research or statistical purposes is not considered incompatible with the original purpose).
- Data minimisation
Personal data must be adequate and relevant for the purposes of processing and limited to what is necessary.
- Accuracy
Personal data must be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data inaccurate for the purposes of processing are erased or rectified without delay.
- Storage limitation
Personal data must be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes of processing; personal data may be stored for longer only where they will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) GDPR, subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject.
- Integrity and confidentiality
Personal data must be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
- Accountability
The Controller is responsible for compliance with the above data-protection principles and must be able to demonstrate that compliance.
Legal basis for data processing
Personal data processing must be lawful, i.e. based on one of the following legal grounds:
- a) Consent
The data subject has given consent.
- b) Performance of contract
Necessary for the performance of a contract or for taking steps at the data subject’s request prior to entering into a contract.
- c) Legal obligation
Performance of a legal obligation applicable to the controller.
- d) Létfontosságú érdek
Protection of the vital interests of a natural person.
- e) Legitimate interest
For the legitimate interests pursued by the controller or a third party (except processing by public authorities in the performance of their tasks).
- f) Public interest / official authority
Necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Duration of data processing
The Company processes personal data only for the shortest time necessary to achieve the specified purpose, but no longer than the time required by law, or, in the absence of such provision, for one (1) year from the data being made available to the Controller. The Controller may process the data subject’s personal data as long as the purpose of processing exists. The Controller terminates processing if the data subject has requested erasure of their personal data under Section 14(e) of the Hungarian Privacy Act or under Article 17 GDPR.
Scope of data processed
The Company processes only personal data that meets the conditions set out in each respective privacy notice.
Data processing, data transfer
The Company may transfer personal data to its subsidiaries according to the current corporate group structure. In this case joint controllership applies. If the data subject wishes to assert a claim relating to processing by a subsidiary, the Company commits to forwarding the claim to that subsidiary.
Provisions on personal data
The data subject may at any time request information on the processing of their personal data from the Company in writing — by registered or recorded-delivery letter sent to the Company’s address, or by email to compliance@alteo.hu. The Company treats a postal request as authentic only if the data subject can be clearly identified from it. For an email request, the message is considered authentic only if sent from the email address used during the previous contact (e.g. registration, application, tender submission, etc.).
Upon request, the Company must provide the data subject with the necessary information within twenty-five (25) days of receipt of the request.
The information is free of charge. The data subject may only be denied information in the cases specified in Section 19 of the Hungarian Privacy Act.
If the personal data are not accurate and the accurate personal data are available to the Controller, the Controller rectifies them. Instead of erasure the Controller restricts the personal data if the data subject so requests or if the available information suggests that erasure would harm the data subject’s legitimate interests. Such restricted personal data may only be processed as long as the purpose of processing that excluded erasure persists. The Controller informs the data subject of rectification, restriction, marking and erasure, and also everyone to whom the data were previously transferred for processing. If the Controller does not comply with the data subject’s rectification, restriction or erasure request, it communicates in writing within twenty-five (25) days of receipt the factual and legal reasons for the refusal. In the event of refusal the Controller informs the data subject of the option of judicial remedy and of turning to the Hungarian National Authority for Data Protection and Freedom of Information.
Legal remedy
The data subject may exercise their rights against processing of their personal data (object) in the cases specified in Sections 21–24 of the Hungarian Privacy Act and Article 21 GDPR. The Controller examines the objection within the shortest time but no later than fifteen (15) days of submission, decides on its merits and informs the data subject in writing. From receipt of the notice or, if absent, the data subject has thirty (30) days to bring an action before the competent court.
If their rights are violated, the data subject may turn to court or the data-protection authority against the controller.
Data-protection court proceedings are heard out of turn. The case falls under the jurisdiction of the regional court (törvényszék). At the data subject’s choice, the action may also be brought before the regional court of the subject’s domicile or place of residence.
You can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) at the contacts below:
Download the full notice
This page contains the current text of the 1 September 2025 amendment. The official, signed version is available as a PDF — in any regulatory procedure the PDF is the authoritative source.