This Privacy Policy (hereinafter referred to as the "Privacy Policy") contains information about how nDRU 1.0 Ltd (hereinafter referred to as "nDRU") processes your personal data in connection with the services provided through the www. drivendru.com website, mobile website and the nDRU APP mobile application (hereinafter referred to as the "Platform") (hereinafter referred to as the "Service"). Detailed information on the use of cookies is not included in this Privacy Notice. Information on the management of cookies is available here.

Data Controller: nDRU 1.0 Ltd., company registration number: 01-09-374640, tax number: 28802839-2-43, registered office: 1221 Budapest, Hajó utca 1., e-mail: info@drivendru.com (hereinafter referred to as "nDRU" or "Data Controller").

Please note that no DPO has been appointed for the data processed.

If NDRU processes your personal data on the basis of legitimate interest, you have the right to object to the processing. If you wish to exercise this right, please contact us by e-mail or other means.

Terms used in this Privacy Notice

For the meaning of terms used in this Privacy Notice, please refer to the following paragraph.

Data Processor: a natural or legal person, public authority, agency or any other body that processes personal data on behalf of (on behalf of) nDRU.

Data processing: any operation or set of operations which is performed upon personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

You: are a user of the services provided by nDRU through the Platform.

Personal Data: any information about you that allows us to identify you directly or indirectly. Personal Data means your name, identification number, location data, online identifier or one or more factors relating to your physical, physiological, genetic, mental, economic, cultural, or social characteristics.

Service: the set of services provided by nDRU to you in the context of the operation of the Platform, i.e., the operation of the Platform, the provision of the use of the Platform (including registration, making partner services available, browsing, order management, location identification, payment, provision of the e-service book and complaint handling).

1. Data Processing Policy

a)     Your Personal Data will be processed fairly and transparently in accordance with the law. 

b)     We will only process your Personal Data for the lawful purposes set out in this Privacy Notice.

c)     We will not process Personal Data that is not adequate, relevant or necessary for the purposes of the processing set out in the Privacy Notice. 

d)    We do our best to keep your Personal Data accurate and up to date. We will take all reasonable steps to delete or correct inaccurate Personal Data.

e)     We store your Personal Data in a format that allows us to identify you only for the purposes for which we process your Personal Data and for the time necessary to do so.

f)      We will process your Personal Data in a manner that ensures appropriate security for the processing of Personal Data, including protection against unauthorised or unlawful processing, accidental loss, destruction or damage.

2.  Why and how do we process your Personal Data?

In most cases, we process your Personal Data in order to provide you with our services. However, we may also process your data for other purposes (e.g. to comply with our legal obligations or to enforce our legal claims). Detailed information about the purposes for which we process your data and other relevant processing circumstances are set out below, grouped by purpose.

We do not carry out automated decision-making and profiling when processing Personal Data, otherwise we will inform you directly.

2.1 Registration, provision of access to the service, user account management

Purpose of processing of Personal Data: to create and manage your nDRU account upon registration and thus provide you with access to the Services.

Legal basis for processing: processing is necessary for the performance of a contract between you and NDRU.

Categories of Personal Data processed: the Personal Data you provide when registering: e-mail address, password, customer code, first name, surname, delivery address, telephone number, name, registered office, tax number, company registration number, photograph, vehicle type, registration number, chassis number, engine number, registration number, registration number, billing information (name, tax number, address), service history, make, model, year of manufacture, engine capacity, power, fuel, tyre size, mileage. If logging in with a Facebook account or Apple ID, the following additional personal data: e-mail address.

Duration of storage of Personal Data: the nDRU will process Personal Data until the user account is deleted.

Recipients of personal data, data processors:

2.2 Provision of services

Purpose of processing Personal Data: to make available through the Platform partner services that provide service and product purchase options, courier services, additional partner services (e.g. insurance, instant assistance, parking services), to manage and process orders, to communicate with you, to provide an e-service book, to identify locations.

Legal basis for processing: processing is essentially necessary for the performance of the contract between you and nDRU. In the context of the contract between you and nDRU, nDRU processes your Personal Data on the basis of its legitimate interest. nDRU's legitimate interest is to provide you with a service that meets your requests.

Categories of Personal Data processed: the data you provide when you register (see 2.1), location data, vehicle data, type of vehicle, registration number, chassis number, engine number, registration number, registration number, billing data (name, tax number, address), service history, make, model, year of manufacture, engine capacity, power, fuel, tyre size, mileage, service history, service history, quantity, value of parts, labour charges, other costs, existing faults of the car, faults of the car repaired, mileage, chassis number, engine number, cc, kw, type, make.

Duration of storage of Personal Data: the nDRU will process Personal Data for the time necessary to achieve the purpose of the processing, up to the time of deletion of the user accou

Recipients of personal data, data processors:

2.3 Customer service, complaint handling

Purpose of processing of Personal Data: the processing of any complaints, claims or other requests you may have through NDRU's customer service, including customer service provided through postal address, e-mail address, telephone and chat function.

Legal basis for processing: NDRU processes your personal data on the basis of its legitimate interest. NDRU's legitimate interest is to be able to effectively remedy and manage service failures and your complaints and requests. In some cases, processing is necessary to comply with a legal obligation (e.g. to preserve a recorded voice).

Categories of Personal Data Processed: the data you provide when registering or using the Service (see 2.1 and 2.2), and data related to the submission and handling of messages or complaints and requests sent by you.

Duration of storage of Personal Data NDRU will retain Personal Data relating to your complaint for 5 years from the date of receipt of the complaint. For the purpose of handling and documenting the complaint, NDRU will record your complaint made over the telephone and will retain the recorded audio for 5 years from the date of recording.

Recipients of personal data, data processors:

2.4 Collection of fees

Purpose of processing your Personal Data: to ensure payment of your order through a payment service provider by credit card, bank transfer or Apple Pay.

Legal basis for processing: nDRU processes your personal data on the basis of its legitimate interest. NDRU has a legitimate interest in ensuring payment of fees in return for the Service, to collect the fees.

Categories of Personal Data processed: data provided by you when registering or when using the Service (see 2.1 and 2.2), payment method data. nDRU records but does not store your credit card details. The NDRU does not have access to the credit card data, which can only be processed by payment service providers. You have the possibility to save your credit card details (credit card number, name on the credit card, expiry date, CVC number) in order to avoid having to re-enter these details for future Orders. When saved, all data will be stored as a "token" (non-reversible code) and only the token will be used and transmitted for future orders.

Duration of storage of Personal Data: the nDRU will process Personal Data for the time necessary to achieve the purpose of the processing, up to the time of deletion of the user account.

Recipients of personal data, data processors:

2.5 Newsletters and direct marketing messages

Purpose of processing of Personal Data: sending marketing messages in the form of direct marketing enquiries (e.g. newsletter, push message).

Legal basis for processing: your consent.

Categories of Personal Data processed: data provided by you during registration (see 2.1 and 2.2), vehicle data, service data/service status, service history,

Duration of storage of Personal Data: the relevant Personal Data will be stored until consent is withdrawn (e.g. unsubscribing from a newsletter), but for a maximum of 10 years from the date of consent.

Recipients of personal data, data processors:

2.6 Rating (rating)

Purpose of processing Personal Data: to improve the Service, to measure and increase user satisfaction based on information about the quality of the Service.

Legal basis for processing: your Personal Data is processed by NDRU based on its legitimate interest. NDRU's legitimate interest is to provide a high-quality service.

Categories of Personal Data processed: data provided by you during registration (see points 2.1 and 2.2), ratings, comments, completion times, satisfaction data, vehicle data, services used or ordered.

Duration of storage of Personal Data: the nDRU will retain your Personal Data relating to your assessment for 5 years from the date of receipt of the assessment.

Recipients of personal data, data processors:

2.7 Enforcement of legal claims

Purpose of the processing of Personal Data: to assert, exercise and defend nDRU's legal claims.

Legal basis for processing: nDRU processes your personal data on the basis of its legitimate interest. NDRU has a legitimate interest in pursuing nDRU's legal claims.

Categories of Personal Data processed: data provided by you during registration (see 2.1 and 2.2), vehicle data, service data, service history data, data relating to your complaints and their handling, data relating to the billing and collection of fees, other Personal Data necessary to enforce a legal claim.

Duration of storage of Personal Data: the relevant Personal Data will be kept for 5 years after the deletion of the user account.

Recipients of personal data, data processors:

2.8 Measuring business performance, making management decisions

Purpose of processing your Personal Data: the NDRU keeps statistics on which service you have been to, how many times, how much you have paid (labour or parts and how much of that was the NDRU commission), what parts you have replaced, what parts were not replaced in order to accurately measure your business performance and make appropriate management decisions based on this, and thus provide a higher quality service.

Legal basis for processing: your Personal Data is processed by nDRU on the basis of its legitimate interest. NDRU has a legitimate interest in accurately measuring your business performance and making appropriate management decisions based on that performance, so as to provide you with the highest quality of service.

Categories of Personal Data processed: information on which service you have been to, how many times, how much you have paid (labour or parts and how much of that was the NDRU commission), what parts you have replaced, what parts were not replaced.

Duration of storage of Personal Data: the NDRU will keep your Personal Data relating to the above statistics for 3 years from the date of the service.

3.  Your rights in relation to data processing by nDRU

You have the following rights in relation to the processing activities carried out by NDRU:

• Right of access

  You may request access from the NDRU to your Personal Data processed by the NDRU, as well as information about the purposes of the processing, the categories of data processed, the recipients of the transfers, the duration of the processing, your rights with regard to the processing of your Personal Data by the NDRU and your right to apply to the data protection authority. In addition, where your Personal Data is collected by NDRU from a source other than you, you have the right to be informed of the source of the data and whether NDRU uses automated decision-making or similar procedures, including the logic of their operation and the significance of such processing and the likely consequences for you. You may also request information on whether and under what conditions nDRU transfers your Personal Data outside the EEA.

If you request it, we will provide you with a copy of your Personal Data processed by nDRU.

• right to rectification

  You have the right to have inaccurate personal data concerning you corrected by nDRU upon your request. You have the right to request that incomplete personal data be completed by means of a supplementary declaration.

  
  

• right to erasure

At your request, nDRU will delete your Personal Data immediately if one of the following grounds applies:

a)     the personal data are no longer necessary for the purposes for which they were collected;

b)     You withdraw your consent on which the processing is based and there is no other legal basis for the processing;

c)     You object to the processing and there are no overriding legitimate grounds for the processing;

d)    the processing of your Personal Data is unlawful;

e)     your Personal Data must be deleted in accordance with applicable law.

Please note that nDRU has the right to refuse to delete your Personal Data if it is necessary, inter alia, to ensure freedom of expression and information, to comply with a legal obligation or to assert, exercise or defend a legal claim.

• Right to restriction of processing

You have the right to request restriction of processing if one of the following conditions is met:

a)     You contest the accuracy of the personal data, in which case the restriction applies for the period of time that allows the accuracy of the personal data to be verified;

b)    the processing is unlawful, and you oppose the erasure of the data and instead request the restriction of their use;

c)     nDRU no longer needs the Personal Data for the purposes of processing, but you require it for the establishment, exercise or defence of legal claims;

d)    if you have objected to the processing; in this case, the restriction applies for the period until it is established whether nDRU's legitimate grounds prevail over your legitimate grounds.

If the processing is restricted, such personal data, except for storage, may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for important public interests of the European Union or of a Member State.

• right to protest

Where nDRU processes your Personal Data for direct marketing purposes, you have the right to object to the processing of your Personal Data for such purposes, in which case nDRU may no longer process your Personal Data for such purposes.

In addition, you have a general right to object to processing where the legal basis for the processing activity is the legitimate interest of nDRU or a third party. In such a case, the nDRU may no longer process the Personal Data unless the nDRU can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

• right to data portability

You have the right to receive the Personal Data that you provide to nDRU in a structured, commonly used, machine-readable format, and the right to have nDRU transfer this data directly to another data controller, provided that the following conditions are met:

-       the processing is based on consent or is necessary for the performance of a contract to which you are a party or for taking steps at your request prior to entering into that contract; and

-       the processing is carried out by automated means.

• right to withdraw consent

You have the right to withdraw your consent at any time, which does not affect the lawfulness of the processing based on consent prior to the withdrawal.

The NDRU shall take the measures necessary to exercise the above rights without delay, within one month of receipt of the request. If necessary, and taking into account the complexity of the request and the number of requests, this period may be extended by a further two months, of which the nDRU will inform you, stating the reasons.

In the event that you submit such a request electronically, the nDRU will inform you electronically where possible, unless you request otherwise.

In the event that the NDRU does not take the necessary action on your request, it will inform you of the reasons within one month of receipt of the request.

If the NDRU has reasonable doubts as to the identity of the natural person submitting the request, it may request additional information necessary to confirm the identity of the data subject.

4.  Remedies

If you do not agree with the response or action of the nDRU, or if you feel that your rights have been violated, you may lodge a complaint with the National Authority for Data Protection and Freedom of Information (address: H-1055 Budapest, Falk Miksa utca 9-11, web: http://naih.hu/, postal address: 1363 Budapest, Pf. 9.; phone: +36-1-391-1400; e-mail: ugyfelszolgalat@naih.hu). In case of violation of your personal rights, you may apply to the Metropolitan Court of Budapest or to the competent court in your place of residence (for more information: https://birosag.hu/birosag-kereso). 

5.   Miscellaneous provisions

Please note that the nDRU may periodically review this Privacy Notice and amend it as necessary. In the event that nDRU makes changes to this Privacy Notice, it will notify and publish them in the usual way (for example, by e-mail or on the website). Please review the NDRU Privacy Notice from time to time.