PRIVACY NOTICE
Effective date: 1 August 2026
Last updated: 17 August 2026
1. DATA CONTROLLER AND PURPOSE OF THIS NOTICE
Awaretium is the education brand of SECaaS Kft. The controller responsible for the processing of personal data in connection with training courses advertised on the Awaretium website, enquiries, applications, contract formation and communications is:
Controller name: SECaaS Kft.
Registered office: 8887 Bázakerettye, Iskola u. 3A., Hungary
Postal address: 1118 Budapest, Rodostó u. 4B 306., Hungary
Company registration number: 20-09-079397
Tax number: 27457137-2-20
Email: info@awaretium.hu
Telephone: +36 1 300 9052
Websites: awaretium.eu; secaas.hu
Data Protection Officer: The Controller has not appointed a Data Protection Officer.
The purpose of this Privacy Notice is to provide transparent information about the processing of personal data relating to visitors to the website, enquirers, applicants for training courses and training participants. This Notice has been prepared in particular in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, “GDPR”), Act CXII of 2011 on Informational Self-Determination and Freedom of Information, and, where applicable, Act LXXVII of 2013 on Adult Education.
2. PRINCIPLES OF PROCESSING
SECaaS Kft. processes personal data lawfully, fairly and transparently. We collect personal data for specified, explicit and legitimate purposes, process it only to the extent necessary, and protect it against unauthorised access, alteration, loss or disclosure by means of appropriate technical and organisational measures.
3. PROCESSING ACTIVITIES
3.1. Website visits and security logging
When you use the website, technical log data may be generated in connection with the operation of hosting and website administration services.
Personal data processed:
IP address, browser type, device and operating system information, time of visit, pages viewed and technical log data.
Purpose:
To ensure the secure and proper operation of the website; troubleshooting; prevention and investigation of attacks.
Legal basis:
Article 6(1)(f) GDPR – legitimate interests.
Retention period:
As a general rule, no longer than 30 days; in the event of a security incident, until the matter has been closed.
Our legitimate interest is to maintain the security of our website, IT systems and users, remedy faults and prevent misuse. We consider that this interest is not overridden by the rights and freedoms of data subjects. You may object to this processing.
3.2. Contact requests and quotation requests
Personal data processed:
Name, email address, telephone number, organisation name, job title, message content and other information provided during communications.
Purpose:
Contacting you, responding to enquiries, preparing a tailored quotation and assessing training needs.
Legal basis:
Article 6(1)(b) GDPR where there is a specific intention to enter into a contract or a quotation request; Article 6(1)(f) GDPR – legitimate interests, for other business enquiries.
Retention period:
One year from the closure of the matter; where a contract is concluded, for the period applicable to contractual processing.
Our legitimate interest is to respond to business enquiries and maintain proportionate, purpose-limited contact with prospective customers. Please do not send special category data or personal data relating to third parties when contacting us unless this is necessary.
3.3 Training applications and contractual performance
Personal data processed:
Name, contact details, selected training course, and application-related data.
Purpose:
Processing applications, entering into contracts, organising training and maintaining contact.
Legal basis:
Article 6(1)(b) GDPR – performance of a contract.
Retention period:
Until the limitation period for civil law claims expires, generally five years.
Personal data processed:
Billing and payment data.
Purpose:
Invoicing, financial performance and compliance with statutory obligations.
Legal basis:
Article 6(1)(c) GDPR – compliance with a legal obligation.
Retention period:
Eight years for accounting records.
Personal data processed:
Attendance, performance, assessment, examination, certificate and confirmation data.
Purpose:
Delivery of training, verification of completion, and issuing certificates or confirmations.
Legal basis:
Article 6(1)(b) GDPR; Article 6(1)(c) GDPR where processing is required by law.
Retention period:
Until the limitation period for contractual claims expires, or, where a statutory retention obligation applies, for the period required by the relevant legislation.
Necessity of providing data
Providing data necessary for an application, contract formation and completion of training may be a condition for entering into a contract. Providing billing data and data required under adult education legislation may be a legal obligation. Without such data, SECaaS Kft. or the adult education provider for the relevant course may be unable to process the application, enter into the contract, deliver the training, or issue the required certificate or confirmation.
3.4 Newsletters and direct marketing
Training newsletters and electronic marketing communications are sent only where you have given separate, prior and unambiguous consent, or where this is expressly permitted by other applicable legislation. You may withdraw your consent at any time and without giving reasons by using the unsubscribe link in the message or by contacting us using the details in Section 1. We may process the minimum data necessary to comply with an unsubscribe request and maintain a record of objections.
Personal data processed:
Name, email address, the date and content of consent, and unsubscribe data.
Purpose:
Sending training newsletters and related electronic marketing communications; recording consent; and managing unsubscribe requests.
Legal basis:
Article 6(1)(a) GDPR – consent.
Retention period:
Until consent is withdrawn. The minimum data needed for the unsubscribe/objection register may be retained for as long as necessary to give effect to the objection.
4. PROCESSING RELATED TO ADULT EDUCATION
The applicability of adult education rules depends on the legal arrangement of the specific training course.
For training courses advertised and delivered by SECaaS Kft. in its own name, SECaaS Kft. acts as controller in connection with applications, contract formation, training administration, training completion and the processing of related documentation.
For training courses in which adult education provider functions are performed by Pannon Quality Menedzsment Tanácsadó Kft. (“Pannon Quality Kft.”), Pannon Quality Kft. acts as an independent controller. Section 4.1 of this Notice applies to such training courses.
Where adult education rules apply to a training course, the controller processes the personal data necessary to establish the adult education relationship, organise and deliver training, verify training completion, maintain mandatory training documentation, and comply with statutory record-keeping and data-reporting obligations.
The legal basis for processing, depending on the specific personal data and processing activity, is:
- Article 6(1)(b) GDPR, where processing is necessary for entering into or performing the adult education contract; and/or
- Article 6(1)(c) GDPR, where processing is required to comply with a legal obligation.
Depending on the type of training, the nature of the legal relationship and the applicable legal requirements, the controller may process, in particular:
- name used and name at birth;
- mother’s name;
- country, place and date of birth;
- contact details, in particular email address and telephone number;
- information relating to the highest educational qualification;
- educational identification number or data required to apply for one;
- status data required by law;
- data relating to the selected training course, the adult education contract and the adult education relationship;
- data evidencing attendance, use of learning materials, training completion, knowledge assessment, examination, evaluation, and the issuing of certificates or confirmations;
- data relating to training fees, invoicing and payment; and
- user and technical log data required for completion of training through a digital learning platform.
Adult education documentation and related personal data must be retained in accordance with the retention obligation set out in Section 16 of Act LXXVII of 2013 on Adult Education. As a general rule, mandatory documentation must be retained until the last day of the eighth year following its creation.
Where sector-specific legislation applicable to a training course prescribes a longer retention period, the relevant data and documents must be retained for at least the period required by that legislation.
Providing data necessary for an application, the conclusion of an adult education contract, completion of training, and compliance with statutory record-keeping and data-reporting obligations may be a contractual or legal requirement. Without such data, the controller may be unable to process the application, conclude the training contract, deliver the training, or issue a document, certificate or confirmation evidencing completion.
4.1 Cooperation with Pannon Quality Kft.
For training courses where adult education registration, an adult education contract, statutory record-keeping or data reporting is required, the adult education relationship is established between Pannon Quality Menedzsment Tanácsadó Kft. (“Pannon Quality Kft.”) and the training participant.
In connection with these training courses, Pannon Quality Kft. acts as an independent controller. Based on its own processing purposes and legal bases, Pannon Quality Kft. processes, in particular, the personal data necessary to enter into the adult education contract, organise and deliver training, maintain mandatory records, provide data to authorities where required, and document training completion.
Pannon Quality Kft. provides information about its independent processing activities in its own privacy notice. Training participants may review Pannon Quality Kft.’s privacy notice when entering into the adult education contract.
Where necessary for adult education registration or preparation of an adult education contract, SECaaS Kft. may transfer to Pannon Quality Kft. the personal data supplied by the applicant that is necessary for the relevant training course.
The purpose of the transfer is limited to preparing the adult education relationship, entering into the adult education contract, and administration necessary to comply with applicable legal obligations.
Depending on the nature of the specific training course, the data transferred may include, in particular:
- name and contact details;
- data relating to the selected training course, the application and the training need; and
- further data requested from the applicant that is necessary for the adult education contract, mandatory records or statutory data reporting.
SECaaS Kft. transfers only data that is necessary and proportionate for the purpose concerned. Depending on the specific processing situation, the legal basis for the transfer is Article 6(1)(b) GDPR, namely taking steps at the applicant’s request prior to entering into a contract, or, where applicable, Article 6(1)(c) GDPR, namely compliance with a legal obligation.
Following the transfer of data to Pannon Quality Kft., Pannon Quality Kft. is independently responsible for its own processing. SECaaS Kft. does not determine the purposes and means of Pannon Quality Kft.’s adult education processing; therefore, the parties are not joint controllers in this respect.
In providing the digital learning environment associated with delivery of training, Awaretium, as the education brand of SECaaS Kft., may provide LMS services to Pannon Quality Kft.
In this case, SECaaS Kft. processes personal data held in the LMS as a processor on behalf of, and in accordance with the documented instructions of, Pannon Quality Kft. SECaaS Kft. uses the TalentLMS cloud-based LMS service to provide the technical digital learning environment. TalentLMS may act as a sub-processor of SECaaS Kft. in this process.
Pannon Quality Kft. and SECaaS Kft. regulate the terms of processing related to LMS services in a written data processing agreement compliant with Article 28 GDPR. SECaaS Kft. ensures that any engagement of a sub-processor is carried out under the conditions set out in Article 28 GDPR.
5. PROCESSORS, RECIPIENTS AND DATA TRANSFERS
SECaaS Kft. transfers personal data or makes it available only to the extent necessary to fulfil the purposes specified in this Notice. Personal data may be accessed by authorised personnel of SECaaS Kft. and by the following recipients and processors.
| Recipient / Data Processor | Role and Activity | Data |
| Websupport Magyarország Kft. | Processor – web hosting and related operational services. | Data stored on the website and data generated during technical operation. |
| SECaaS Kft. / Awaretium LMS | ECaaS Kft. acts as an independent controller for training courses advertised and delivered in its own name, direct customer relationships, applications, contract formation, invoicing and the use of the LMS in connection with its own training services. SECaaS Kft. acts as a processor when providing the digital learning environment for training courses organised by Pannon Quality Kft., where Pannon Quality Kft. acts as an independent controller. In this capacity, SECaaS Kft. processes personal data solely on the documented instructions of Pannon Quality Kft. | Data processed in the capacity of independent controller: Name, email address, telephone number, organisation name, job title, application and contractual data, billing and payment data, training enrolment data, learning material usage and progress data, test, examination and assessment results, data necessary for issuing certificates or confirmations, and technical log data necessary for use of the system. Data processed in the capacity of processor on behalf of Pannon Quality Kft.: Name, email address, user identifier, training enrolment data, learning material usage and progress data, test, examination and assessment results, and technical log data necessary for use of the system. |
| TalentLMS / Epignosis | Processor and/or technical sub-processor supporting SECaaS Kft.’s processing activities – provision and operation of a cloud-based learning management system (LMS), management of user accounts, learning material access, storage of training progress and assessment data, and provision of system administration and technical support | he categories of data processed in TalentLMS depend on the relevant training arrangement. They may include, in particular, name, email address, user identifier, organisation name, job title, training enrolment data, learning material usage and progress data, test, examination and assessment results, data necessary to issue certificates or confirmations, and technical log data necessary for use of the system. |
| Pannon Quality Kft. | Independent controller and recipient – entering into adult education contracts, organising and delivering training, maintaining mandatory records, and fulfilling related statutory obligations. | Applicant, participant and training data necessary for adult education registration, preparation and conclusion of the adult education contract, and the specific training course. |
| Accounting, legal and IT service providers; authorities, courts and other bodies authorised by law | Performance of statutory, contractual and operational tasks, or compliance with mandatory requests from authorities or courts. | Only personal data necessary to perform the relevant task or comply with the request. |
6. COOKIES AND SIMILAR TECHNOLOGIES
The Awaretium website may use cookies necessary for its operation. Statistical, marketing and other non-essential cookies or similar technologies are activated only after you have given prior consent. Refusing or withdrawing consent does not adversely affect the basic use of the website.
The “Accept” and “Reject” options are available with equal prominence in the cookie management interface. Settings may be changed by category and withdrawn at any time. A separate Cookie Notice on the website provides information about the name, purpose, provider and retention period of cookies, as well as any related transfers to third countries.
7. AUTOMATED DECISION-MAKING
SECaaS Kft. does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
8. DATA SECURITY
SECaaS Kft. applies appropriate technical and organisational measures to ensure the security of personal data, taking into account the nature, scope, context and purposes of processing, as well as the risks to the rights and freedoms of data subjects.
Such measures may include, in particular, access management, role-based access restrictions, unique user identification, authentication and password-protection measures, logging, regular updates and vulnerability management, backups, encrypted communications, and incident-management and recovery procedures.
Personal data may be accessed only by persons who need to know the data in order to perform their job duties or fulfil their contractual obligations.
9. DATA SUBJECT RIGHTS AND REQUESTS
Subject to the conditions set out in applicable law, you have the right to access, rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent. Where processing is based on legitimate interests, you may object to the processing at any time.
You may submit your request to the email address provided in Section 1. We will fulfil or respond to your request without undue delay and, as a general rule, within one month. Where necessary, this period may be extended by a further two months; you will be informed of the extension within one month. The right to erasure is not absolute; for example, data may continue to be processed where retention is required by law or necessary for the establishment, exercise or defence of legal claims.
10. COMPLAINTS AND LEGAL REMEDIES
If you believe that the processing of your personal data is unlawful, please contact us first so that we can investigate the matter. You may also lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):
1055 Budapest, Falk Miksa utca 9–11., Hungary
Postal address: 1363 Budapest, Pf. 9., Hungary
Telephone: +36 1 391 1400
Email: ugyfelszolgalat@naih.hu
Website: naih.hu
You may also bring legal proceedings. At your choice, proceedings may be initiated before the competent court for your place of residence or habitual residence.
11. AMENDMENTS TO THIS NOTICE
SECaaS Kft. may amend this Privacy Notice in the event of changes in legislation, new processing activities, services or technological changes. The amended Notice will apply from its published effective date. Please review the current version before providing personal data, submitting an application or using the website.