Privacy Policy

Effective from 01/09/2026

Archived Privacy Notice (PDF)

1. Details of the Data Controller

1.1. Identity and contact details of the Data Controller

Company Name: RADAYDRUG Ltd.

Registered Office: 4225 Debrecen, Rózsavölgy utca 151.

Telephone: +36 52/537432

Website: www.radaydrug.com

Contact details of the Company’s Internal GDPR Responsible:

Edina Csepregi

Tel.: 06 30 / 254 44 45

E-mail: edina.csepregi@radaydrug.com

1.2. Contact details of the Data Protection Officer (DPO)

Edit Ágota Szűcs, LL.M.
Tel.: 06 30 / 856 40 89

E-mail: adatvedelemdebrecen@gmail.com

2. Purpose of data processing

RADAYDRUG Ltd. (hereinafter referred to as the “Data Controller” or “RADAYDRUG Ltd.”) provides data subjects with the prior, clear and transparent information required under Articles 13–14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) through this Privacy Notice.

The Data Controller processes personal data solely for specified, explicit and legitimate purposes and in accordance with the applicable laws of the European Union and Hungary, in particular the GDPR and Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information.

The Data Controller ensures that appropriate technical and organisational measures are implemented to guarantee:

the security of personal data,
the prevention of unauthorised access,
the integrity and availability of data,
as well as the effective exercise of data subjects’ rights under the GDPR.

The purpose of this Privacy Notice is to provide data subjects with comprehensive information regarding, in particular:

the purposes and legal bases of data processing,
the categories of personal data processed,
the duration of data processing,
data transfers and data processors,
as well as the rights and available remedies of data subjects.

The Data Controller pays particular attention to maintaining the confidentiality of personal data and enforcing data security requirements in connection with pharmaceutical and pharmacovigilance-related processing activities.

The current version of this Privacy Notice is available at the Data Controller’s registered office and on its official website.

The Data Controller reserves the right to amend this Privacy Notice and shall provide appropriate and verifiable notice to data subjects in the event of any material amendments.

3. Scope of the data processing

3.1. Personal scope

This Privacy Notice applies to all natural persons whose personal data are processed by RADAYDRUG Ltd. in its capacity as Data Controller, including, in particular, individuals initiating contact through the website, job applicants, newsletter subscribers, contact persons of contractual partners, and other data subjects.

3.2. Material scope

This Privacy Notice applies to all data processing activities carried out by RADAYDRUG Ltd. involving personal data relating to an identified or identifiable natural person, irrespective of whether such processing is carried out in electronic or paper-based form.

3.3. Temporal scope

This Privacy Notice shall enter into force on the date of its publication and shall remain effective until withdrawn or amended.

4. Applicable Legislation

The Data Controller processes personal data in accordance with all applicable laws, including in particular the following legal provisions:

Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (),
Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR),
Act V of 2013 on the Civil Code of Hungary (Civil Code),
Act CXXVII of 2007 on Value Added Tax (VAT Act),
Act C of 2000 on Accounting (Accounting Act).

5. Definitions

For the purposes of this Privacy Notice, the following terms shall have the meanings set out below:

GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

Data subject: A natural person whose personal data are processed and who can be identified, directly or indirectly, by reference to specific information.

Personal data: Any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, economic, cultural or social identity of that natural person.

Special categories of personal data: Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, as well as genetic data, biometric data used for identification purposes, data concerning health, or data concerning a natural person’s sex life or sexual orientation.

Data Controller: The legal entity which, alone or jointly with others, determines the purposes and means of the processing of personal data and makes and implements decisions regarding such processing.

Data Processor: A natural or legal person or other organisation that processes personal data on behalf of and under the instructions of the Data Controller.

Recipient: A natural or legal person, public authority, agency or other body to whom personal data are disclosed, regardless of whether that person or body is a third party.

Consent: Any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which the data subject, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Personal data breach: A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

6. Principles governing the processing of personal data

When processing personal data, RADAYDRUG Ltd. acts in accordance with the data protection principles set out in Article 5 GDPR and ensures their application throughout all of its data processing activities.

Principle of lawfulness, fairness and transparency

RADAYDRUG Ltd. processes personal data only where an appropriate legal basis exists and does so in a transparent manner, by providing data subjects with the information set out in this Privacy Notice.

Principle of purpose limitation

Personal data are collected for specified, explicit and legitimate purposes. RADAYDRUG Ltd. shall not process personal data in a manner that is incompatible with the original purpose of the processing.

Principle of data minimisation

RADAYDRUG Ltd. processes only such personal data, and only to the extent, that are necessary and proportionate for achieving the relevant purpose of the processing.

Principle of accuracy

RADAYDRUG Ltd. takes all reasonable steps to ensure that the personal data it processes are accurate and, where necessary, kept up to date. Inaccurate personal data shall be rectified or erased without undue delay.

Principle of storage limitation

RADAYDRUG Ltd. retains personal data only for the period necessary to achieve the purposes of the processing, taking into account the applicable legal retention obligations.

Principle of integrity and confidentiality

RADAYDRUG Ltd. implements appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage.

Principle of accountability

RADAYDRUG Ltd. is responsible for compliance with the applicable data protection requirements and is able to demonstrate such compliance.

7. Legal Bases for Processing Personal Data

When processing personal data, RADAYDRUG Ltd. applies the legal basis set out in Article 6(1) GDPR that is appropriate for the specific purpose of the processing.

The legal basis for processing may include, in particular, the following:

a) Performance of a contract (Article 6(1)(b) GDPR)

The processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract.

b) Compliance with a Legal Obligation (Article 6(1)(c) GDPR)

The processing is necessary for compliance with a legal obligation to which RADAYDRUG Ltd. is subject under European Union or Member State law.

c) Performance of a task carried out in the public interest (Article 6(1)(e) GDPR)

The processing is necessary for the performance of a task carried out in the public interest by RADAYDRUG Ltd.

d) Legitimate interests (Article 6(1)(f) GDPR)

The processing is necessary for the purposes of the legitimate interests pursued by RADAYDRUG Ltd. or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject. The existence of a legitimate interest is assessed by RADAYDRUG Ltd. through a legitimate interest assessment.

e) Consent (Article 6(1)(a) GDPR)

The processing is based on the freely given, specific and informed consent of the data subject.

RADAYDRUG Ltd. assigns the appropriate legal basis to each processing purpose and documents it in its records of processing activities.

8. Rights of data subjects and the exercise of those rights

8.1. Right to information

The data subject shall have the right to receive information from the Data Controller regarding the processing of his or her personal data in a concise, transparent, intelligible and easily accessible form.

In particular, the Data Controller shall provide information on:

the contact details of the Data Controller and the Data Protection Officer,
the purpose and legal basis of the processing,
the content of the legitimate interest pursued, where processing is based on legitimate interest,
the categories of personal data processed,
the recipients of data transfers,
the retention period,
the rights of the data subject and the manner in which such rights may be exercised,
the right to lodge a complaint with a supervisory authority,
where applicable, the existence of automated decision-making.

Where the Data Controller has not obtained the personal data directly from the data subject, it shall provide the information required under Article 14 GDPR.

8.2. Right of access

The data subject shall have the right to obtain confirmation as to whether or not personal data concerning him or her are being processed. Where personal data are being processed, the data subject shall have the right to access:

the personal data being processed,
the purposes of the processing,
the recipients of data transfers,
the retention period,
the rights of the data subject,
the possibility of lodging a complaint,
the source of the data (where the data were not obtained from the data subject).

The Data Controller shall provide the data subject with a copy of the personal data being processed.

8.3. Right to rectification

The data subject shall have the right to request the rectification of inaccurate personal data concerning him or her and the completion of incomplete personal data.

The Data Controller shall comply with the request without undue delay.

8.4. Right to erasure (“Right to be forgotten”)

The data subject shall have the right to request the erasure of his or her personal data where one of the following grounds applies:

the personal data are no longer necessary in relation to the purposes for which they were collected,
the data subject withdraws consent and there is no other legal basis for the processing,
the data subject validly objects to the processing,
the processing is unlawful,
erasure is required by law.

The Data Controller shall not be obliged to erase the personal data where the processing is necessary for compliance with a legal obligation, the performance of a task carried out in the public interest, or for the establishment, exercise or defence of legal claims.

8.5. Right to restriction of processing

The data subject shall have the right to request the restriction of processing where:

the accuracy of the personal data is contested by the data subject,
the processing is unlawful and the data subject opposes the erasure of the personal data,
the Data Controller no longer needs the personal data for the purposes of the processing, but the data subject requires them for the establishment, exercise or defence of legal claims,
the data subject has objected to the processing.

Where processing has been restricted, such personal data shall, with the exception of storage, be processed only in specific circumstances permitted by applicable law.

8.6. Right to object

The data subject shall have the right to object to the processing of his or her personal data where the processing is based on:

the performance of a task carried out in the public interest, or
a legitimate interest.

The Data Controller shall assess the objection and shall cease the processing unless it demonstrates compelling legitimate grounds for the processing that override the interests, rights and freedoms of the data subject.

8.7. Right to data portability

The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to the Data Controller, in a structured, commonly used and machine-readable format, and shall have the right to transmit those data to another controller, where:

the processing is based on consent or on a contract, and
the processing is carried out by automated means.

8.8. Right to an effective remedy

The data subject shall have the right to lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) and to seek a judicial remedy if he or she considers that the processing of his or her personal data infringes applicable legal requirements.

9.Authorised persons and their responsibilities in data processing

Within the Company, access to personal data shall be granted exclusively to those employees and executive officers whose access is necessary for the performance of their job-related duties.

Access rights shall be restricted on the basis of the Company’s internal access management procedures and shall be assigned according to responsibilities and authorised functions.

10. Engagement of data processors

The Company engages data processors to perform certain data processing activities.

The data processors shall process personal data solely on the basis of the Company’s instructions and in compliance with the applicable legal requirements.

The Company engages only data processors that provide sufficient guarantees in accordance with the requirements of Article 28 GDPR. The Company applies a data processing agreement compliant with Article 28 GDPR or another legally binding instrument recognised under applicable data protection law.

10.1. Information on the engagement of data processors

The Data Controller engages the following data processors in connection with specific data processing activities:

IT Operations / System Administration Services

Name: INFOLINK Kft.
Activity: Information technology system operation and system administration services.

In the course of operating and maintaining the Data Controller’s information technology systems, the service provider may gain access to personal data solely in a technical capacity and exclusively on the instructions of the Data Controller.

The service provider does not independently determine the purposes or essential means of the processing and acts as a data processor on behalf of the Data Controller pursuant to a data processing agreement compliant with Article 28 GDPR.

Accounting Services

Name: CONS-BUDAPEST Kft.
Activity: Provision of accounting and bookkeeping services.

For the purpose of fulfilling accounting and tax-related obligations, the service provider processes the necessary personal data on behalf of the Data Controller and exclusively in accordance with the Data Controller’s instructions.

CRM System Operations

Name: HighLevel LLC
Activity: Provision and operation of a CRM system.

In connection with the provision and technical operation of the CRM system, the service provider processes customer and contact person data on behalf of the Data Controller and exclusively in accordance with the Data Controller’s instructions.

Hosting Services / Website Operations

Name: Linuxweb Kft.
Activity: Hosting services and the technical operation and maintenance of the website.

In the course of operating the website, the service provider may gain technical access to personal data processed through the website, in particular log data, contact details and technical data relating to the operation of the website.

The service provider may process such data exclusively on the instructions of the Data Controller for the purposes of operating the website, maintaining its security, correcting errors and performing technical maintenance. The service provider does not independently determine the purposes or essential means of the processing.

Newsletter Distribution System

Name: HighLevel LLC
Activity: Provision and operation of a newsletter distribution system.

The service provider supplies the information technology infrastructure necessary for the distribution of newsletters and the technical administration of e-mail campaigns on behalf of the Data Controller.

The service provider processes the names and e-mail addresses of newsletter subscribers, as well as technical data relating to newsletter distribution, exclusively on the instructions of the Data Controller and does not independently determine the purposes or essential means of the processing.

Where the newsletter service provider transfers personal data outside the European Economic Area, the Data Controller shall ensure the implementation of appropriate safeguards in accordance with Chapter V GDPR, in particular through the use of Standard Contractual Clauses (SCCs) adopted by the European Commission.

11.Information on data processing activities (Articles 13–14 GDPR)

11.1. Data processing related to the operation of the website

Log Data

In the course of operating the website, the server automatically records the following data:

IP address,
date and time of the visit,
browser type,
operating system,
referring website.

The purpose of the processing is to maintain the security of the information technology system, prevent misuse, and perform technical monitoring and troubleshooting of the system. The Data Controller may also process log data for the purposes of preventing, detecting and investigating information technology and cybersecurity incidents.

Legal Basis: Article 6(1)(f) GDPR – legitimate interest.

The legitimate interest pursued is the maintenance of information system security and the investigation of potential misuse.

The data subject has the right to object to processing based on legitimate interests.

Retention Period: Up to 30 days.

Cookies

The website currently uses only strictly necessary and functional cookies, in particular for the purpose of retaining cookie preferences and storing the selected language setting. The website currently does not use cookies for statistical, marketing or remarketing purposes. Should such cookies be introduced in the future, they will be used only on the basis of the data subject’s prior consent.

11.2. Contact requests

When a person contacts the Data Controller through the website or through the contact details provided, the Data Controller processes the individual’s name, e-mail address, telephone number, and any other personal data provided in the message.

The purpose of the processing is to respond to inquiries, maintain communications, provide quotations, or handle other related matters.

Depending on the nature of the inquiry, the legal basis for the processing shall be:

Article 6(1)(b) GDPR – taking steps at the request of the data subject prior to entering into a contract,
Article 6(1)(f) GDPR – the Data Controller’s legitimate interest in handling and responding to inquiries.

Retention Period: Up to 1 year from the closure of the inquiry, or, in the event of a legal claim, for the period necessary for the establishment, exercise or defence of such claim.

11.3. Contact relating to pharmacovigilance

Where inquiries submitted through the website relate to pharmacovigilance, drug safety, or other health-related information, the Data Controller shall process personal data solely for the purposes of investigating, documenting and responding to the inquiry, as well as for complying with applicable drug safety obligations and legal requirements.

Such inquiries may involve the processing of health data or other special categories of personal data.

The legal basis for the processing is:

Article 6(1)(c) GDPR – processing necessary for compliance with a legal obligation to which the Data Controller is subject,
Article 9(2)(i) GDPR – processing necessary for reasons of public interest in the area of public health, as well as for compliance with applicable pharmacovigilance and drug safety legislation.

11.4. International data transfers

In connection with the use of certain information technology or cloud-based services, the Data Controller may transfer personal data to, or store personal data in, countries outside the European Economic Area.

In the event of such transfers, the Data Controller shall ensure the implementation of appropriate safeguards as required under Chapter V GDPR, in particular through the use of Standard Contractual Clauses (SCCs) adopted by the European Commission.

Data subjects may request further information regarding international data transfers through the contact details of the Data Controller.

11.5. Automated decision-making and profiling

The Data Controller does not carry out automated decision-making or profiling in connection with the operation of the website.

11.6. Newsletter subscription

When subscribing to the newsletter available through the website, the Data Controller processes the data subject’s name and e-mail address for the purpose of sending professional updates, news and other information.

The legal basis for the processing is the data subject’s consent pursuant to Article 6(1)(a) GDPR.

The data subject is entitled to withdraw consent at any time and may unsubscribe from the newsletter at any time through the unsubscribe link included in the newsletter or by contacting the Data Controller using the contact details provided.

The Data Controller shall process the personal data until the withdrawal of consent.

12. Submission and fulfilment of data subject requests

Data subjects may exercise their rights relating to the processing of their personal data through the following contact channels:

by e-mail: by contacting the Internal GDPR Responsible
by post: by sending a letter to the Company’s address
directly to the Data Protection Officer.

Data subject requests are received and coordinated by the Company’s designated Internal GDPR Responsible. The DPO shall be involved as necessary, particularly in complex, disputed or higher data protection risk cases.

The Data Controller shall inform the data subject of the measures taken within a maximum period of 1 month from receipt of the request.

Where necessary, taking into account the complexity and number of requests, this period may be extended by a further 2 months. The Data Controller shall inform the data subject of any such extension and the reasons for it within the initial one-month period.

If the Data Controller does not take action on the data subject’s request, it shall inform the data subject without undue delay and no later than 1 month after receipt of the request of the reasons for not taking action, and of the possibility of lodging a complaint with a supervisory authority or seeking a judicial remedy.

As a general rule, the exercise of data subject rights shall be free of charge. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, the Data Controller may, pursuant to Article 12(5) GDPR, charge a reasonable fee or refuse to act on the request.

Where the Data Controller has reasonable doubts concerning the identity of the data subject, it shall be entitled to request additional information necessary to confirm the identity of the data subject.

13. Data security

The Data Controller implements appropriate technical and organisational measures to ensure the security of personal data, in particular for the purpose of preventing unauthorised access, unauthorised alteration, disclosure, loss or destruction of personal data.

14. Available remedies

If a data subject considers that the Data Controller or a data processor acting on behalf of the Data Controller processes his or her personal data in violation of applicable legal requirements, the data subject may exercise the following remedies.

14.1. Lodging a complaint with the supervisory authority

Pursuant to Article 77 GDPR, the data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or the place of the alleged infringement.

In Hungary, the competent supervisory authority is:

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Postal Address: H-1363 Budapest, P.O. Box 9
Registered Office: 1055 Budapest, Falk Miksa utca 9–11, Hungary
Telephone: +36 (1) 391-1400
E-mail: ugyfelszolgalat@naih.hu
Website: https://naih.hu

14.2. Judicial remedy

Pursuant to Article 79 GDPR, the data subject has the right to bring legal proceedings where he or she considers that the processing of personal data relating to him or her infringes the provisions of the GDPR.

Such proceedings fall within the jurisdiction of the competent regional court (törvényszék).

At the choice of the data subject, proceedings may be brought before the regional court having jurisdiction over the data subject’s place of residence or habitual residence, or before the regional court having jurisdiction over the registered office of the Data Controller (Debrecen Regional Court).

The court shall proceed with priority in such matters.

14.3. Right to compensation

Pursuant to Article 82 GDPR, the data subject shall have the right to receive compensation from the Data Controller or the data processor for material or non-material damage suffered as a result of an infringement of the GDPR.

15. Miscellaneous provisions

As a general rule, RADAYDRUG Ltd. collects personal data directly from data subjects.

Where personal data are not obtained directly from the data subject – in particular where the data subject acts as the contact person of a legal entity contractual partner or where the data originate from a public register – the source of the personal data shall be the contractual partner or the relevant register. In such cases, RADAYDRUG Ltd. shall provide the data subject with the information required under Article 14 GDPR within a reasonable period and, at the latest, within one month of obtaining the personal data or at the time of the first communication with the data subject.

In the event of a request from a public authority, where such request is based on a legal obligation and clearly specifies the purpose of the request and the categories of data requested, RADAYDRUG Ltd. shall disclose personal data only to the extent necessary and proportionate. All disclosures of personal data to public authorities shall be documented.

16. Amendments and publication of the Privacy Notice

The Data Controller reserves the right to amend this Privacy Notice unilaterally, in particular in the event of changes in legislation, changes in regulatory practice, the introduction of new services, changes in data processors, or changes to its data processing practices.

The Controller shall publish the amended Privacy Notice on its website. The amended Privacy Notice shall enter into force on the effective date specified in the document, and the Privacy Notice shall always indicate its effective date.

Where an amendment affects the rights of data subjects or the essential circumstances of the processing, the Data Controller shall, where possible and appropriate, also inform the data subjects directly.

Any amendment to the Privacy Notice shall not result in an unjustified restriction of the rights of data subjects or adversely affect those rights retroactively.

The Data Controller shall ensure that the current version of the Privacy Notice is continuously available on the website in an easily accessible manner.