Privacy Policy

Honvéd Futball Club Korlátolt Felelősségű Társaság (hereinafter: "Honvéd FC" or "Data Controller"), as the operator of the website accessible under the domain name honvedfc.hu (hereinafter: Website) and the Honvéd Application ("Application"), hereby publishes this privacy notice regarding the data processing carried out in connection with the Website and the services related to the Website. By starting to use the Website, users visiting the Website (hereinafter: User or Data Subject) accept all terms and conditions set out in this Privacy Notice (hereinafter: Notice); therefore, please read this Notice carefully before using the Website.

I. Details of the Data Controller

The controller of the data is Honvéd Futball Club Korlátolt Felelősségű Társaság, operator of the Website
Company registration number of the Data Controller: 01-09-717539
Registered office of the Data Controller: 1194 Budapest, Temesvár utca 25/a
E-mail contact of the Data Controller: office@bhfc.hu
Representative of the Data Controller: Árpád Séllei, Managing Director

II. Principles of Data Processing

• the Data Controller processes personal data lawfully, fairly, and in a transparent manner,
• personal data are collected only for specified, explicit, and legitimate purposes and are not further processed in a manner incompatible with those purposes,
• the personal data collected and processed by Honvéd FC are adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed,
• Honvéd FC takes every reasonable step to ensure that the personal data it processes are accurate and, where necessary, kept up to date, and that inaccurate personal data are erased or rectified without delay,
• the Data Controller keeps personal data in a form which permits identification of the Data Subject for no longer than is necessary for the purposes for which the personal data are processed,
• by applying appropriate technical and organisational measures, the Data Controller ensures appropriate security of the personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage.

III. Scope of Processed Data

The Data Controller processes personal data solely for specified purposes, in order to exercise rights and fulfil obligations. At every stage, data processing complies with the purpose of the processing. The collection and processing of data are carried out fairly and lawfully. The Data Controller strives to process only such personal data that are essential and suitable for achieving the purpose of the processing. Personal data may only be processed to the extent and for the duration necessary to achieve that purpose. 

1. Data processed during registration in the Application

The Honvéd Application can be downloaded and installed from the Google Play Store and Apple App Store on compatible devices. The use of certain parts of the Application requires registration.

Purpose of data processing:

• identification of users and record-keeping of utilised services,
• providing access to content and services available to registered users,
• providing information regarding account operation and changes concerning the utilised services.

Legal basis for data processing: the voluntary consent of the data subject given with knowledge of this notice [Article 6(1)(a) of the GDPR] 

Scope of processed data:

• full name
• date of birth
• e-mail address
• password
• nationality

Duration of data processing: until withdrawal of registration, or the Data Controller deletes the data from its database after two years of inactivity counted from the user's last login to the account.

The above data are transferred to the database operating system, customer service, and business databases of the Data Controller's data processor. The data of each user are stored in the user's account.

2. Data processed during registration on the Website

The Company conditions the use of certain parts of the Website (participation in prize draws, webshop purchases, ticket purchases) on registration. The username and password provided during registration provide access to all services requiring registration and to interfaces available to registered users.

Purpose of data processing:

• identification of users and record-keeping of utilised services,
• providing access to content and services available to registered users,
• providing information regarding account operation and changes concerning the utilised services.

Legal basis for data processing: the voluntary consent of the data subject given with knowledge of this notice [Article 6(1)(a) of the GDPR] 

Scope of processed data:

• full name
• date of birth
• e-mail address
• password

Duration of data processing: until withdrawal of registration, or the Data Controller deletes the data from its database after two years of inactivity counted from the user's last login to the account.

The above data are transferred to the database operating system, customer service, and business databases of the Data Controller's data processor. The data of each user are stored in the user's account.

3. Website traffic data

Purpose of data processing: ensuring the proper and high-standard operation of the Website, monitoring and improving the quality of our services, identifying malicious visitors attacking our website, measuring traffic, statistical purposes, understanding browsing habits, improving user experience.

Legal basis for data processing: the User's consent, and Section 13/A (3) of Act CVIII of 2001 on certain issues of electronic commerce services and information society services.

Scope of processed data:

• demographic data (age, gender)
  • interests
  • geographic data (location, language)
  • behaviour (new or returning visitor, frequency, session, and duration)
  • technology (browser and operating system)
  • network (service provider)

IP address (necessary for diagnosing potential issues occurring during website loading, website administration, and demographic data. An IP address is a series of numbers that uniquely identifies computers and mobile devices of Internet users. With the help of IP addresses, the visitor using a particular computer can even be geographically located. The addresses of the pages visited, as well as the date and time data, are not in themselves suitable for identifying the data subject, but when combined with other data [e.g. provided during an inquiry], they may allow conclusions to be drawn about the user)

The Data Controller uses these data processed for statistical purposes exclusively in a form not suitable for personal identification. In order to improve the quality of its services, the Data Controller places a file containing a series of characters, a so-called cookie, on the User's computer. Certain cookies do not require your prior consent. Our Website provides brief information about these upon starting your first visit. For cookies requiring consent – where data processing starts upon visiting the page – our Company informs you upon starting your first visit and requests your consent.

Cookies used on the Website:

On the Website, we use essential, statistical, and targeted advertising cookies.

The Website uses the web analytics service provided by Google Inc. (Google Analytics). Google Analytics enables the analysis of the use of the Website. Information about the use of the Website is usually transmitted to and stored on Google servers in the USA. On behalf of the Website operator, Google uses this information to evaluate the use of the Website, compile reports on website activity, and provide other services relating to website activity and internet usage to the website operator. The data processed by Google Analytics as part of Google Analytics (e.g. IP address) are not merged with other Google data.

Google Analytics #1

We do not combine the personal data provided in connection with registration or the use of our marketing services, and identifying our visitors is fundamentally not our aim.

The Website also uses Hotjar cookies. These generate heatmaps (where visitors click), record movements on the page (session recording), display surveys and feedback boxes, distinguish unique visitors, link page visits within a session, ensure that the same user does not receive the same survey multiple times, and enable behavioural analysis for statistical purposes. The validity of Hotjar cookies is 1 year.

4. Data processed in case of newsletter subscription

On the Website and in the Application, the User has the option to subscribe exclusively to the Data Controller's newsletter via a dedicated interface. Subscribing to the newsletter requires providing the following personal data:

• full name;
• e-mail address;
• gender;
• age.

Only persons aged 16 or over are eligible to provide data.

Purpose of data processing: establishing and maintaining contact, informing Users, conducting effective marketing communications, sending personalised messages to the data subject. Sending electronic newsletters and advertising messages regarding promotions, events, and prize draws to the e-mail address provided by the Data Subject (hereinafter collectively: Newsletter).

Legal basis for data processing: consent of the data subject

Duration of data processing: until unsubscription from the newsletter. Personal data will be erased immediately upon cessation of the data processing purpose, upon expiry of the deadline specified for the respective data processing, or at the request of the User.

5. Participation in prize draws

5.1 Data processing related to the registration of participants in prize draws

Legal basis for data processing: voluntary consent of the data subject given with knowledge of this notice [Article 6(1)(a) of the GDPR]

Purpose of data processing: identification of data subjects and contact maintenance

Scope of processed data:

• name
• e-mail address
• phone number

Duration of data processing: 1 month following the conclusion of the prize draw.

5.2 Data processing related to the winner of the prize draw

Scope of processed data: name

Purpose of data processing: Data Controller publishes the winner's name on its official Facebook page for marketing purposes.

Legal basis for data processing: voluntary consent of the Applicant pursuant to Article 6(1)(a) of the Regulation

Duration of data processing: 1 month following the conclusion of the prize draw.

5.3 Data processing related to prize delivery

Scope of processed data: postal address

Purpose of data processing: handover of the prize

Legal basis for data processing: voluntary consent of the data subject pursuant to Article 6(1)(a) of the Regulation

Duration of data processing: following the delivery of the prize.

6. Data processing during online ticket and season ticket sales

Data subjects have the option to purchase tickets online at jegy.honvedfc.hu, where ticket purchases can be made following registration.

Purpose of data processing: ensuring that the User does not have to enter their details for every ticket purchase, identifying the data subject for ticket and season ticket purchases under Act I of 2004 on Sport, and implementing ticket sales compliant with stadium security requirements.

Legal basis for data processing: as set forth in Section 72/B of Act I of 2004 on Sport.

Scope of processed data:

• data subject's name
• data subject's place and date of birth
• mother's name (optional)
• e-mail address (optional)

Duration of data processing: until the 3rd working day following the day of the respective match. In the case of season tickets, until the 3rd working day following the expiry of the season ticket.

7. Data processing during registration for a Fan Card

Purpose of data processing: issuance of the Fan Card and identification of the fan card holder, including in the period following the match.

Scope of processed data:

• data subject's name
• data subject's place and date of birth
• data subject's mother's name
• data subject's residential address
• e-mail address

Legal basis for data processing: your consent (data subject consent pursuant to Article 6(1)(a) of Regulation (EU) 2016/679), and the Data Controller is also authorised for this data collection pursuant to Section 72(2)(b) of Act I of 2004 on Sport.

Duration of data processing: until withdrawal of consent. 

8. Data processing during invoicing

Purpose of data processing: organisation of events (matches), issuing invoices for tickets/season tickets during performance of the contract.

 Legal basis for data processing: legal obligation (Act C of 2000 on Accounting)

Scope of processed data:

• name
• residential address
• e-mail address

Duration of data processing: 8 years following the issuance of the invoice. 

IV. DATA PROCESSING (PROCESSORS)

In accordance with applicable legislation, the Data Controller is entitled to engage data processors for specific technical operations or for the provision of services. The data processor is entitled to act only upon the instructions and decisions of the Data Controller.

Data Processors:

Honvéd FC KFT.

seat: 1194 Budapest, Temesvár utca 25/A
company registration number: 01-09-717539
postal address: 1194 Budapest, Temesvár utca 25/A
e-mail address: office@bhfc.hu
website: https://honvedfc.hu/

Nádor Rendszerház Kft. 

V. Rights of Users

You may withdraw your consent to data processing at any time by:

• a written request for erasure,
• withdrawal of consent to data processing, or
• withdrawal of consent to the processing or use of any data required to be filled in during an inquiry, or by requesting restriction/blocking thereof.

Upon request of the User, the Data Controller provides information on:

• personal data processed about them,
• the source of such data,
• the purpose of data processing,
• the legal basis,
• the duration,
• the name, address, and data-processing-related activities of the data processor,
• furthermore, in the event of transfer of personal data of the data subject, the legal basis and recipient of the data transfer.

Information may be requested by e-mail at office@bhfc.hu and by postal mail at the following postal address: 1194 Budapest, Temesvár utca 25/a, in both cases with proof of identity and specification of the postal address. The Data Controller shall respond in writing no later than 25 (twenty-five) days from receipt of the request.

The User is entitled to request the rectification of their personal data (specifying the correct data) likewise via e-mail at office@bhfc.hu or by post at 1194 Budapest, Temesvár utca 25/a, in both cases with proof of identity and provision of the postal address. The Data Controller shall immediately carry out the rectification in its records and notify the data subject thereof in writing. In addition to the above, the User may at any time request the erasure or restriction of their data – in whole or in part – free of charge, without justification, by proving identity and providing a mailing address via e-mail at office@bhfc.hu or by post at 1194 Budapest, Temesvár utca 25/a.

Upon receipt of an erasure request, the Data Controller shall immediately ensure the cessation of data processing and erase the User from its register. Instead of erasure, the Data Controller shall restrict (block) the personal data if the User so requests, or if, based on available information, it can be assumed that erasure would harm the User's legitimate interests. Personal data restricted in this way may only be processed for as long as the purpose that precluded erasure persists.

Furthermore, the User may at any time decide that the Data Controller should no longer send them Newsletters. The User may withdraw consent to receive Newsletters at any time, free of charge, without justification and without limitation, by clicking on the unsubscribe link at the bottom of the newsletters, or by writing to the e-mail address office@bhfc.hu or sending a letter to 1194 Budapest, Temesvár utca 25/a (specifying accurate personal data). Upon receipt of the unsubscription request, the Data Controller shall promptly erase the unsubscribing User's data from its direct marketing database and will not send any further newsletters to the User. If the withdrawal of consent concerns exclusively direct marketing processing (Newsletter distribution), the Data Controller will only erase the User from the direct marketing register immediately, and remains entitled to process the User's data for the purpose of providing Website services used by the User. In the case of consents, each consent serves a specific purpose, meaning that website registration and newsletter subscription are two separate purposes, two separate databases, and the two are independent of each other.

The User may object to the processing of their personal data,

• if the processing or transfer of personal data is necessary solely for compliance with a legal obligation to which the Data Controller is subject or for the legitimate interests pursued by the Data Controller, the recipient, or a third party, except in the case of mandatory data processing;
• if personal data are used or transferred for direct marketing, public opinion polling, or scientific research purposes; and
• in other cases specified by law.

The Data Controller shall examine the objection within the shortest possible period, but no later than 15 days from submission of the request, adopt a decision regarding its merits, and inform the applicant thereof in writing. If the User disagrees with the decision of the Data Controller, or if the Data Controller fails to meet the above deadline, the User may apply to a court within 30 days from notification of the decision or the last day of the deadline.

In the event of using deceptive personal data, or if any visitor commits a crime or attacks our Company's system, their data will be deleted immediately upon termination of the given visitor's registration, or – where necessary – retained for the duration of civil liability proceedings or criminal proceedings.

VI. Links

The Data Controller accepts no liability for the content or the data and information protection practices of external websites accessible via links from the Website and the Application. Should the Data Controller become aware that a linked page or linking infringes third-party rights or applicable laws, it will immediately remove the link from the Website.

The Website and the Application also contain links pointing to external servers (not operated by the Data Controller); pages accessible through these links may place their own cookies or other files on your computer, collect data, or request personal data. The Data Controller excludes all liability for these.

VII. Data Security

The Data Controller undertakes to ensure data security, to take all technical and organisational measures, and to establish the procedural rules necessary to ensure that collected, stored, and processed data are protected, and to prevent their destruction, unauthorised use, and unauthorised alteration. It also undertakes to require all third parties to whom data are transferred or disclosed based on User consent to comply with data security requirements. The Data Controller ensures that unauthorised persons cannot access, disclose, transfer, alter, or delete processed data. The processed data may only be accessed by the Data Controller, its employees, and the Data Processor(s) engaged by it; the Data Controller will not disclose them to third parties who have no right of access.

The Data Controller shall make every effort to ensure that data are not accidentally corrupted or destroyed. The above undertaking is imposed by the Data Controller on its employees participating in data processing activities.

The User acknowledges and agrees that when submitting personal data on the Website and/or Application – despite the fact that the Data Controller possesses modern security tools to prevent unauthorised access or interception – the protection of data on the Internet cannot be fully guaranteed. Should unauthorised access or acquisition of data occur despite our efforts, the Data Controller shall not be liable for such data acquisition or unauthorised access, or for any damage resulting therefrom to the User. In addition, the User may also disclose their personal data to third parties who may use it for unlawful purposes or in an unlawful manner.

Under no circumstances does the Data Controller collect special categories of personal data, i.e., data revealing racial or ethnic origin, membership of national or ethnic minorities, political opinions or political party affiliations, religious or philosophical beliefs, trade union membership, health status, addictions, sex life, or criminal records.

The Data Controller stores the data on its own computing devices located at its registered office or, in the case of the data processor, in a rented server facility. The Data Controller selects and operates the IT tools used so that processed data remain accessible to authorised persons, their authenticity and authentication are maintained, their integrity can be verified, and they are protected against unauthorised access. Protection of data against unauthorised access, alteration, transfer, disclosure, erasure, or destruction, as well as against accidental destruction, damage, and unavailability resulting from changes in applied technology, is ensured such that the Data Controller, in light of the current state of technology, ensures data processing security through technical, organisational, and administrative measures providing an adequate level of protection against risks arising in connection with data processing.

VIII. Legal Remedies

Regarding data processing, you may:

• request information,
• request rectification, modification, or supplementation of personal data processed by us,
• object to data processing and request erasure as well as restriction/blocking of your data (except in cases of mandatory processing),
• seek judicial remedy before a court,
• lodge a complaint with or initiate proceedings before the supervisory authority (https://www.naih.hu/panasz-vagy-kozerdeku-bejelentes-a-panasztorveny-szerint).

Supervisory Authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (National Authority for Data Protection and Freedom of Information)

• Registered office: 1055 Budapest, Falk Miksa utca 9-11
• Postal address: 1363 Budapest, Pf.: 9.
• Phone: +36 (1) 391-1400
• E-mail: ugyfelszolgalat@naih.hu
  Website: https://naih.hu/

Upon your request, we provide information regarding your data processed by us or processed on our behalf by commissioned data processors:

• your data,
• their source,
• the purpose and legal basis of data processing,
• its duration, or if not possible, the criteria used to determine that duration,
• the names, addresses, and data-processing activities of our data processors,
• the circumstances and effects of personal data breaches and our measures taken to remedy and prevent them, furthermore
• in case of transfer of your personal data, the legal basis and recipient of the transfer.

The information is provided free of charge, except where you have already submitted an information request regarding the same scope of data within the current year. Any reimbursement of costs already paid by you will be refunded if the data were processed unlawfully or if the information request led to rectification. Information may only be refused in cases provided by law, indicating the legal basis and informing you of the possibility of judicial remedy or recourse to the Authority.

Our Company shall notify you and all parties to whom data were previously transferred for processing purposes of any rectification, restriction, marking, and erasure of personal data, unless the omission of such notification does not harm your legitimate interests.

If we do not comply with your request for rectification, restriction, or erasure, we will communicate the factual and legal grounds for our refusal in writing or – with your consent – electronically within 25 days of receipt of the request, and inform you of the possibility of judicial remedy and recourse to the Authority.

If you object to the processing of your personal data, we will examine the objection within 15 days of submission of the request and inform you of our decision in writing.

We will refuse compliance with the request if we prove compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise, or defence of legal claims. If you disagree with our decision, or if we fail to meet the deadline, you may apply to a court within 30 days from notification of the decision or the last day of the deadline.

If the User feels that their right to the protection of personal data has been violated, they may seek legal remedies before the competent authorities pursuant to applicable legislation. Data protection lawsuits fall within the jurisdiction of the regional court (törvényszék); the lawsuit – at the choice of the data subject – may also be initiated before the regional court having jurisdiction over the data subject's domicile or place of residence. Foreign citizens may also lodge a complaint with the supervisory authority competent for their place of residence.

Regarding advertisements sent electronically, the National Media and Infocommunications Authority (Nemzeti Média- és Hírközlési Hatóság) has jurisdiction; detailed regulations can be found in Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information, as well as Act CVIII of 2001 on certain issues of electronic commerce services and information society services. 

The Data Controller makes every effort to ensure that the processing of personal data is carried out in compliance with the law; however, if the User feels that this has not been met, they may contact us by e-mail at office@bhfc.hu or by post at 1194 Budapest, Temesvár utca 25/a. We kindly request that before turning to the supervisory authority or the court with a complaint, you contact our Company in order to consult and resolve the issue as quickly as possible.

Dated: Budapest, 8 January 2026