Legal Documents
Everything you need in one place: review our Terms and Conditions, Privacy Notice, Data Processing Addendum (DPA), and Cookie Notice - pick the document that's relevant to you below.
Effective from October 2, 2026
DATA PROCESSING NOTICE
1. Introduction
This Notice provides information on the data processing carried out in the course of providing the LivePly AI Chatbot and live customer service (the ‘Service’) in accordance with the provisions of the GDPR and the Information Act. This Notice forms an integral part of the General Terms and Conditions and must be read in conjunction with them; unless otherwise specified, the terms used herein have the same meaning as in the General Terms and Conditions.
2. Details of the data controller
| Data | Value |
|---|---|
| Name | SolvePly Kft. |
| Company registration number | 08-09-038874 |
| Tax number | 33119083-2-08 |
| EU tax number | HU33119083 |
| Registered office / postal address | 9019 Győr, Szent László út 172., Hungary |
| info@liveply.com | |
| Data Protection Officer | |
| office@solveply.comWebsite | https://liveply.com |
The Service Provider has not appointed a Data Protection Officer (DPO) because the data processing it carries out does not fall within the mandatory categories set out in Article 37(1) of the GDPR: it is not a public authority, its main activity does not consist of the regular and systematic monitoring of data subjects on a large scale, and it does not process special categories of data on a large scale. For data protection enquiries and requests from data subjects , please contact the Service Provider at office@solveply.com.
3. Definitions
- User: the organisation ordering or using the Service, as well as its employees or authorised representatives acting on its behalf.
- End User/Visitor: a natural person visiting the User’s digital platform and communicating with the chatbot.
- Data Subject: any natural person whose personal data is processed by the Service Provider (User, Visitor, Newsletter Subscriber).
- Newsletter Subscriber: a person who subscribes to the newsletter independently, without an account.
- Data processor: a party that processes personal data on behalf of the Service Provider.
- AI model provider: the operator of the third-party AI infrastructure used to generate the Chatbot’s responses.
4. Principles and location of data processing
4.1. The Service Provider processes personal data in accordance with the principles set out in Article 5 of the GDPR.
4.2. Data processing takes place primarily within the EU. Some of the Data Processors referred to in Section 9 may also process data in a third country; in such cases, the Service Provider applies the safeguards set out in Chapter V of the GDPR (adequacy decision, SCCs).
5. Categories of data processed, purposes and legal bases
5.1. User registration and conclusion of contract
The contract is concluded with the User as an organisation. The personal data processed here relate to the natural person acting on its behalf (contact person, representative), who is not themselves a party to the contract — therefore, the legal basis for this processing is not the performance of the contract, but the Service Provider’s legitimate interest in managing the contractual relationship and identifying the contracting party.
| Data category | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Name and email address of the natural person acting on behalf of the User | Maintaining contact, performance of the contract, verification of the User’s business status | Article 6 of the GDPR (1) f) – the Service Provider’s legitimate interest in the operation of the contractual relationship and the identification of the contracting party | For 5 years following the termination of the contract (general limitation period under the Civil Code) |
| Identification details of the represented organisation (name, registered office, tax number, VAT number, company registration number or other registration identifier – General Terms and Conditions 5.5.) | Conclusion and performance of | the contractArticle 6(1)(b) of the GDPR – performance of a contract or steps taken prior to entering into a contract | For 5 years following the termination of the contract (general limitation period under the Civil Code) |
| Login details (username and password, with the password stored as a non-reversible hash) | Access to the admin interface, account security | Article 6(1)(f) of the GDPR – the Service Provider’s legitimate interest in access management and account security | Until the account is deleted |
| When logging in via a third-party authentication service (currently: Google), the name, email address, profile picture and unique identifier | Registration and login | Article 6(1)(f) of the GDPR – the Service Provider’s legitimate interest in access management. The authentication service provider acts as an independent data controller in relation to its own account management (point 9); the Service Provider is responsible for the processing of the data transferred by the authentication service provider | Until the account is deleted |
Nature of data provision: providing the organisation’s identification details is a condition of entering into the contract; providing the name and email address of the person acting on its behalf is necessary for the use of the account. Consequences of failure to provide such data: registration cannot be completed, and the Service cannot be used.
The list of identity providers may be expanded; the current list is set out in clause 9. The Service Provider has no access to the identity provider’s own data (e.g. the password used there). The Service Provider sends system-level (transactional) emails via the email delivery service specified in clause 9.
5.2. Invoicing and payment of fees
| Data categories | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Billing name, address, tax number, VAT number, fact and amount of payment | Issuing invoices, bookkeeping | Article 6(1)(c) of the GDPR – compliance with a legal obligation (Section 169 of the Accounting Act) | 8 years |
| Credit card transaction data | Payment of fees | The Service Provider does not process this data; with regard to credit card data, Stripe acts as an independent data controller in accordance with its own policy | The Service Provider does not store thisdata |
Nature of data provision: the provision of billing details is a statutory obligation. Consequences of failure to provide such details: an invoice cannot be issued, and the chargeable Service cannot be used.
5.3. Use of the Chatbot and End-User Communication
The data controller for the data processing operations set out in sections 5.3 to 5.3.2 is not the Service Provider,** but the User.** In this context, the Service Provider acts solely as a data processor, in accordance with the User’s documented instructions; the purposes and essential means are determined by the User. This does not extend to those logs relating to the operation of the Service which the Service Provider maintains for its own purposes, acting as a data controller in its own right; these are described in sections 5.3a and 5.3b.
The table below therefore describes the data processing carried out by the User as a data controller, for information purposes only — the User relies on the legal bases specified therein and is responsible for ensuring their validity and for carrying out the balancing test. The detailed obligations of the data processor are set out in the separate Data Processing Agreement (DPA).
| set | DataPurpose | Legal basis | Retention period |
|---|---|---|---|
| End-user messages, AI/operator responses, metadata (date and time, session ID) | Customer communication, AI response generation | Article 6(1)(b) of the GDPR – performance of a contract or steps prior to entering into a contract; for other enquiries: Article 6(1)(f) – the legitimate interests of the User (data controller) in operating customer communications | The period set by the User (1–3,650 days); failing that, 180 days, followed by automatic deletion. In healthcare mode, up to 30 days |
| Content and metadata of attached files (images: jpg, png, webp, gif; documents: PDF, docx, xlsx) – see 5.3.2. | Image: processed byAI model to generate a response; images and documents: storage and viewing by operators | theFollows the legal basis of the relevant conversation: Article 6(1)(b) for enquiries relating to a contract, otherwise Article 6 (1)(f) | Identical to the conversation; the file is also deleted when the conversation is deleted |
| Conversations forwarded to the User’s own external messaging platform via the fallback function | Continuity of customer communication | Follows the legal basis of the specific conversation: Article 6(1)(b) for contract-related enquiries, otherwise Article 6 () | In accordance with the specific platform’s own rules |
| Knowledge base documents, website content, question-and-answer pairs, content imported via MCP (if containing personal data) | Ensuring the context of AI responses | 1(f)Article 6(1)(f) of the GDPR – the User’s legitimate interest in the compilation of the knowledge base. The User selects the content and is responsible for ensuring the legal basis exists | Until deleted by the User |
Nature of data provision: entirely voluntary on the part of the End User; the use of the Chatbot and the provision of any data are not mandatory. Consequences of non-provision: the Chatbot will only be able to respond to the enquiry partially or not at all; the End User may also contact the User via another channel (email, telephone).
5.3.1. Recognition of contact details, identification of leads
The Chatbot can automatically recognise and extract the contact details provided during the conversation (name, telephone number, email) and assign them to the conversation in a structured manner – even if the End User provided them in free-form text. The extracted contact details are identical in content to what the End User provided during the conversation. However, as a result of this process, two pieces of data are generated that were not directly provided by the End User: the structured lead record and the ‘lead’ flag. This process serves two purposes:
) operator transparency – ensuring that contact details are available in one place;
) enquiry identification and statistics – if an email address or telephone number is recognised, the conversation is marked as an ‘enquiry’, added to a separate enquiries list on the admin interface, and counted towards the aggregate enquiries metrics. This labelling is based solely on whether an email address or telephone number appears in the conversation; the Service does not carry out any further assessment, prediction or scoring regarding the End User’s personal characteristics.
Guiding rules:
- The provision of a name alone does not result in a prospect being flagged.
- The flagging does not constitute marketing consent: advertising may only be sent with the End User’s separate, prior and explicit consent [Section 6(1) of the Act]. Objections to direct marketing must be complied with unconditionally [Article 21(2) of the GDPR].
- Aggregated metrics contain only quantities, not contact details.
- Prospective customer data constitutes a separate data set which survives the deletion of the conversation: it has its own retention period and is deleted via a separate deletion process (see below for the retention period). The Service Provider does not maintain a customer relationship management (CRM) system operated independently of the User for its own purposes.
- If the User transfers enquiry data to their own external system, this constitutes the User’s independent data processing, for which they are solely responsible.
Retention period for enquiry data. The User sets this on the admin interface on a per-chatbot basis; the default is 12 months, and the maximum limit that can be set is24 months. The period is calculatedfrom the date of the last substantive contact (last_activity_at), not from the date the enquiry data was generated. Once the retention period has expired, the enquirer’s data is automatically deleted, regardless of the retention period for the conversation. The deletion of the enquirer’s data may be requested separately from the deletion of the conversation.
The legal basis for both purposes is the User’s legitimate interest[Article 6(1)(f) of the GDPR]; the User is responsible for carrying out and documenting the balancing test.
Accuracy of name identification. Name identification is not always carried out exclusively through pre-defined, deterministic processing: the AI model provider specified in point 9 may also infer the End User’s name from the text of the conversation. As the name determined in this way is not necessarily accurate, the system also records whether the name in question was provided directly by the End User or was inferred from the content of the conversation.
The User may amend or delete any field in the enquiry record via the admin interface; this means that any name that may have been entered incorrectly can also be corrected. If the End User wishes to submit a request for rectification under Article 16 of the GDPR, they must submit it to the User; in this case, the Service Provider, acting as a data processor, shall assist in fulfilling the request in accordance with the provisions of the DPA, in line with Article 28(3)(e) of the GDPR.
The Service does not verify the accuracy of a name inferred from a conversation against any other source. If the User subsequently uses the enquirer’s data to make a substantive decision, they must ensure that the accuracy of the data is properly verified.
5.3.2. Attached files (images and documents)
The End User may attach one file per message, on a purely voluntary basis; attaching a file is not a prerequisite for using the Service.
) In the case ofan image, the content – together with the text message – is processed by the AI model provider referred to in clause 9 to generate a response, provided that the model called upon is capable of image processing; otherwise, the image is merely stored, and the End User is notified of this in the chat.
) **** The content ofdocuments (PDF, docx, xlsx) is not sent to the model provider; the Service does not perform OCR, content or embedding processing on them – it merely stores them, and only the User’s authorised staff may view them. The End User will be notified of this in the chat.
) The content of the file is determined by the End User; the Service Provider does not filter it; it may contain third-party data or special categories of data as defined in clause 5.7 – clause 5.7 applies accordingly.
) The User may disable the attachment of images and documents separately via the admin interface (Settings → Privacy); if disabled, the Chatbot will not accept the relevant file type. By default, both are enabled.
The Service Provider’s role as a data processor extends toall operations set out in sections 5.3 to 5.3.2 – including AI response generation, attachment management, contact data recognition and enquiry statistics – with the exception of sections 5.3a** and 5.3b**, where the Service Provider acts as an independent data controller; the Service Provider fulfils its obligation to provide relevant information to End Users directly through the document entitled* ‘LivePly Information for Visitors Communicating with the* Chatbot’, published on the liveply.com website. The User is responsible for ensuring that End Users are properly informed.
5.3a. Logging the acceptance and acknowledgement of legal documents
The Service Provider logs who accepted or familiarised themselves withwhich version of a document, andwhen. There are three logs:
| Log | Data processed | Purpose | basis | LegalRetention period |
|---|---|---|---|---|
| ****Acceptance of the GTC and legal documents (GTC 5.6.) | the identifier of the person acting on behalf of the User, the type and version of the document, the language, and the date of acceptance | Verifiability of the conclusion of the contract and the acceptance of the document | Article 6 of the GDPR (1)(f) – the Service Provider’s legitimate interest in demonstrating accountability [Article 5(2) of the GDPR] | For 5 years following the termination of the contract (limitation period under the Civil Code) |
| Receipt of the Generated Information Notice (GTC 12.8. (3)) | the identification of the person acting on behalf of the User, the Chatbot’s identification, the version of the notice, the date of receipt | To verify that the User has received the Generated Notice | Article 6(1)(f) of the GDPR – legitimate interest, as above | For 5 years following the termination of the contract |
| Display of the End-User Notice (DPA 4.5a.) | session ID, chatbot ID, method and version of the notice (or, in the case of an external link, its address and content snapshot), the language, the date and time | Verification of which notice the End User was able to view | Article 6(1)(f) of the GDPR – legitimate interest, as above | The same as the retention period for the conversation, but at least 365 days |
None of the logs store IP addresses, device identifiers or usernames.
Nature of data provision: not based on data provided by the Data Subject; the logs are generated automatically during use of the Service. Consequences of failure to provide data: not applicable, as the Data Subject has no means of providing such data.
5.3b. Operation and device call logs
The Service Provider maintains logs ofoperations initiated via the Chatbot (such as booking an appointment) and calls toexternal devices. These logs contain the parameters and results of the operation, which may also include data provided by the End User – name, email address, telephone number.
| Data categories | Purpose | Legal basis | Retention period |
|---|---|---|---|
| The parameters, result, time and date of the operation and device calls, as well as the type and outcome of the operation | Troubleshooting the Service, traceability of operations, investigation of misuse | Article 6 of the GDPR (1)(f) – the Service Provider’s legitimate interest in the secure and proper operation of the Service | 365 daysfrom the date of creation , followed by automatic deletion |
This retention period applies at platform level and is independent of the retention period set for the conversation: the logs serve a different purpose – troubleshooting, dispute resolution, traceability – and therefore remain even after the conversation has been deleted.
In the event of a data subject’s request for erasure, the Service Provider will also delete these logs; there is no need to wait for the 365-day period to elapse.
Nature of data provision: this is not based on data provided by the Data Subject; the logs are generated automatically when the operation is initiated. Consequence of failure to provide data: the operation (e.g. booking an appointment) cannot be initiated.
5.4. Website traffic, cookies
| Data categories | Purpose | Legal basis | Retention period |
|---|---|---|---|
| IP address, browser and device data, session ID | The secure operation of liveply.com and the admin interface | Article 6 of the GDPR (1)(f) | Depends on the cookie – see Cookie Policy |
| Cookie ID, page views, browser and device type, approximate geographical location, traffic source (Google Analytics) | Aggregated measurement of traffic to liveply.com, website development | Article 6(1)(a) of the GDPR – the Visitor’s consent (cookie management interface); may be withdrawn at any time | Cookie lifetime (2 years); data is stored for 2 months on the Google Analytics platform – see Cookie Policy |
A separate Cookie Policy covers cookies, including their lifespan within the browser.
Nature of data provision: not based on data provided by the Data Subject; the data is generated automatically when using the website. The use of Google Analytics is based on voluntary consent. Consequences of non-consent: if the necessary cookies are disabled, certain functions of the website and the admin interface will not work; refusing to give consent for analytics does not restrict the use of the website.
5.5. Customer service, complaint handling
| Data categories | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Name, email address, content of the enquiry – if the enquiry relates to the contract | Responding to the enquiry, contractual administration | Article 6 of the GDPR (1)(f) – the Service Provider’s legitimate interest in managing the customer relationship and handling any claims | From the closure of the enquiry until the end of the general limitation period under the Civil Code (5 years) |
| Name, email address, content of the enquiry – for all other enquiries | Responding to the enquiry | Article 6(1)(f) of the GDPR – the Service Provider’s legitimate interest in managing customer communications | For 1 year from the closure of the enquiry |
The Service is intended exclusively for business (non-consumer) use (Clause 4.5 of the General Terms and Conditions), therefore the complaint handling and retention rules under the Consumer Protection Act do not apply to this data processing; the retention period is based on the limitation period under the Civil Code.
The procedural rules for complaint handling are set out in Clause 15 of the GTC, whilst the data subject’s remedies (complaints to the supervisory authority, legal proceedings) are set out in Clause 8 of this Notice.
Nature of data provision: voluntary. Consequence of failure to provide data: the enquiry cannot be answered.
5.6. Children’s data
The Service is intended for B2B customer communication; the Service Provider does not intend the Chatbot to target persons under the age of 18 and does not knowingly collect data from them. If the target audience of the User’s interface is likely to include persons under the age of 18, the Chatbot may only be operated with prior consent in accordance with clause 12.9 of the GTC and upon acceptance of the Supplementary Terms and Conditions for Minors, in the ‘Minor Target Audience’ mode specified therein; The purpose of this mode is precisely to ensure that the Chatbot does not collect personal data from minors, so that the consent requirements under Article 8 of the GDPR do not arise in the context of the Chatbot’s operation. Compliance with Article 8 of the GDPR remains the responsibility of the User in all their own processes outside the Chatbot where data processing based on consent from minors takes place.
5.7. Special categories of data
The End User may, during a conversation – or in an attached file – share special categories of data as defined in Article 9 of the GDPR. The Service Provider does not request or encourage the provision of such data, and the system has not been designed to process such data. It is the User’s responsibility to configure the Chatbot and to inform End Users in such a way as to prevent the provision of such data. If, due to the nature of the User’s activities, End Users are likely to disclose such data, it is solely the User’s responsibility to make the necessary settings (including disabling file attachments – 5.3.2(d)), to provide the necessary information, and to ensure the legal basis and safeguards set out in Article 9(2) of the GDPR. If the User’s activities are of a healthcare nature, the Chatbot may be operated subject to prior consent in accordance with clause 12.9 of the GTC and acceptance of the Supplementary Healthcare Terms and Conditions. The Service Provider shall not be held liable for any special categories of data provided voluntarily, despite the warning.
5.8. Newsletter and marketing
| Data categories | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Email address; name (if provided) upon independent subscription | Newsletter, marketing communications | Article 6(1)(a) of the GDPR – prior, explicit consent (opt-in as defined by the GDPR) | Until withdrawal |
| Open and click tracking | Measuring the effectiveness of communications | Article 6(1)(a) of the GDPR – the consent given upon subscription also covers this | / unsubscriptionUntil withdrawal / unsubscription |
5.8.1. Subscription is based on voluntary consent given via a separate, unchecked tick box; it is not a condition for using the Service.
5.8.2. Consent may be withdrawn at any time, without giving a reason, by unsubscribing from the newsletter, via the admin interface or using the contact details set out in point 2.
Nature of data provision: voluntary; subscription is not a condition for using the Service. Consequence of failure to provide consent: the Service Provider will be unable to send newsletters.
6. Automated decision-making
6.1. The Chatbot’s AI responses are generated through automated processing, but this does not typically constitute automated decision-making with legal effects or of comparable significance as defined in Article 22 of the GDPR: the Chatbot engages in customer communication of an informative nature. The expression of interest referred to in clause 5.3.1 does not in itself have any legal effect; decisions on further steps are taken by the User’s staff member.
6.2. If the User wishes to use the Chatbot for such decision-making, they shall be solely responsible for its lawfulness and for the rights of Data Subjects under Article 22 of the GDPR, and, in accordance with clause 12.9(3)(d) of the GTC, the Service Provider’s prior written consent is required for this.
7. Rights of the Data Subject
Pursuant to Articles 15–22 of the GDPR, the Data Subject may, using the contact details set out in clause 2, request:
- access – information regarding the data being processed, its purpose, legal basis and duration;
- rectification – the correction of inaccurate data and the completion of incomplete data;
- erasure (‘right to be forgotten’) subject to the conditions set out in Article 17 of the GDPR;
- restriction in the cases set out in Article 18 of the GDPR;
- data portability – the data provided by the User in a structured, machine-readable format;
- objection – against data processing based on legitimate interests. The End User may lodge an objection with the User against data processing via the Chatbot based on the User’s legitimate interests (including the identification of enquiries);
- withdrawal of consent – at any time, without affecting the lawfulness of data processing prior to withdrawal.
The Service Provider shall comply with the request within one month at the latest; in the case of a complex request, this period may be extended by two months, subject to prior notification.
End Users communicating with the Chatbot may submit their requests to the User (the website operator) in its capacity as data controller. If such a request is received directly by the Service Provider, the Service Provider – acting as a data processor – shall forward it to the User concerned without undue delay and shall cooperate in its fulfilment in accordance with the DPA. The Service Provider shall itself comply with requests relating to data falling within the scope of its own data processing, as set out in clauses 5.3a and 5.3b.
8. Remedies
8.1. The Data Subject may lodge a complaint with the Service Provider using the contact details set out in clause 2.
8.2. A complaint may be lodged with the supervisory authority:
| Data | Value |
|---|---|
| Authority | National Authority for Data Protection and Freedom of Information (NAIH) |
| Registered office | 1055 Budapest, Falk Miksa utca 9-11. |
| Postal address | 1363 Budapest, PO Box 9. |
| Telephone | +36 (1) 391-1400 |
| ugyfelszolgalat@naih.huWebsite | https://www.naih.hu |
8.3. The Data Subject may also bring the matter before a court; the proceedings may be brought – at their discretion – before the court having jurisdiction over their place of residence or place of stay.
9. Data processors and other recipients
| Recipient | Role | Activity | Place of data processing |
|---|---|---|---|
| Hetzner Online GmbH | Data processor | Hosting and server services | Germany () |
| Stripe Payments Europe, Limited | Independent data controller – acts for its own purposes and in accordance with its own policies with regard to credit card data | Credit card payments | EUIreland (EU) / USA – SCC |
| KBOSS.hu Kft. (Szamlazz.hu) | Data processor | Electronic invoicing | Hungary |
| Bookkeeping and accounting service provider (the accountant or accountancy firm engaged by the Service Provider) | Data processor | Accounting, bookkeeping and payroll tasks | Hungary |
| Mailjet SAS | Data processor | Transactional and newsletter/marketing emails, open/click tracking | France (EU) |
| Google Ireland Limited (Google Analytics 4) | Data processor | Aggregated measurement of traffic to liveply.com – only with the Visitor’s consent given via the cookie management interface | Ireland (EU) / occasionally the USA – DPF or SCC |
| Google Ireland Limited (identification service; the list may be expanded) | Independent data controller – acts in accordance with its own policies when managing the user’s Google account, not on the Service Provider’s | instructionsRegistration, login | Ireland (EU) / in some cases the USA – DPF or SCC |
| Microsoft Ireland Operations Limited (Azure OpenAI Service) | Data processor | Generation of AI responses; embedding; conversation analysis and summarisation; extraction/inference of contact details (in particular, name); processing of attached images, where the model is capable of doing so. Attached documents (PDF, docx, xlsx) are not forwarded (5.3.2.). AI is not used for user statistics | European Union (Sweden). The service provider may retain conversations for up to 30 days for the purpose of preventing misuse; this retention takes place within the European Economic Area, and the service provider’s deletion policy does not apply to this |
| External messaging platform (at the User’s discretion) – this feature is under development and is currently unavailable | In accordance with the data processor’s or the platform’s own terms and conditions | Fallback message forwarding via the User’s own account | In accordance with the relevant platform |
| External hosting provider(s) (MCP, at the User’s discretion) | Data processor | Importing documents into a knowledge base | In accordance with the relevant provider; SCC for third countries |
It is the User’s responsibility to ensure that only storage space whose contents they are authorised to transfer is connected to the MCP.
The Service Provider may engage additional AI model providers in the future. Prior to the introduction of a new provider, the Service Provider shall amend this Notice and notify Users in accordance with the procedure set out in clause 4.4 of the DPA, at least 30 days prior to the introduction.
If the User sets up access to their own model provider or their own model endpoint, the transfer of data to that endpoint is a decision taken by the User in their capacity as a data controller: they are responsible for ensuring lawfulness, for the safeguards set out in Chapter V of the GDPR, and for the data processing agreement; the Service Provider does not monitor the endpoint and does not use it as its own sub-processor (DPA Clauses 5 and 6.4).
The Service Provider engages Data Processors by accepting their public data processing terms and conditions (DPA), exercising due diligence in accordance with Article 28(1) of the GDPR. Furthermore, it does not disclose personal data to third parties, except where required by law or with the Data Subject’s explicit consent.
Data disclosure to public authorities and for law enforcement purposes. The Service Provider shall transfer personal data to the relevant authority on the basis of a legal obligation or a court or administrative decision, and – to the extent necessary – for the purposes of enforcing its rights, resolving a legal dispute or investigating a suspicion of unlawful activity, including sharing such data with its legal representative who is bound by a duty of confidentiality. The Data Subject shall be informed of this, unless otherwise provided for by law.
10. Data security
10.1. The Service Provider shall implement appropriate technical and organisational measures to protect against unauthorised access, alteration, disclosure, transmission, erasure, destruction, as well as accidental loss or damage. In particular: it stores tenants’ data in separate database schemas; it transmits data via an encrypted channel; it stores passwords exclusively as non-reversible cryptographic hashes (Argon2) and does not retain them in their original form anywhere; it stores the access keys and tokens provided by the User – the use of which requires their decryption – in encrypted form (AES-256-GCM); it grants access in accordance with the principle of least privilege.
10.2. Data breach. The procedure depends on whether the Service Provider is classified as a data controller or a data processor in relation to the data processing in question.
(1) Where the Service Provider is the data controller – in particular in relation to data processing under clauses 5.1, 5.2, 5.3a, 5.3b, 5.4, 5.5 and 5.8 – the Service Provider shall notify the NAIH of the incident in accordance with Article 33(1) of the GDPR, without undue delay and no later than 72 hours, unless it is unlikely to result in a risk. In the event of a high risk, the Data Controller shall also inform the Data Subjects in accordance with Article 34 of the GDPR.
(2) Where the Service Provider, actingas a data processor – within the scope set out in Sections 5.3 to 5.3.2 – reports the incident not to the NAIH but to the User as the data controller, in accordance with Article 33(2) of the GDPR, it shall do so without undue delay and within the time limit specified in the DPA. In this case, it is the User’s obligation to notify the NAIH and to inform the Data Subjects; the Service Provider shall cooperate in this regard in accordance with the DPA.
11. Amendments to this Notice
11.1. The Service Provider may amend this Privacy Notice unilaterally, in particular in the event of changes to legislation, the addition of new features or changes to the group of Data Processors.
11.2. The current Privacy Notice is available on the liveply.com website. The Service Provider shall provide information regarding any amendments substantially affecting the rights of Data Subjects by applying the notification procedure set out in clause 13.2 of the General Terms and Conditions.
12. Applicable legislation
GDPR; Information Act (Act CXII of 2011); Civil Code (Act V of 2013); Accounting Act (Act C of 2000); Eker Act (Act CVIII of 2001); Fgytv. (Act CLV of 1997); Grt. (Act XLVIII of 2008).