Privacy Notice

BVN Növényvédő Kft. | bvn.hu

Effective from: 28 September 2026

In this Notice, BVN Növényvédő Kft. (hereinafter: the Controller) explains the processing of personal data associated with visits to the https://bvn.hu website and its pages under the same domain, the contact options available on the website, and its technical operation. This Notice also applies to the foreign-language pages of the website.

Data subjects include website visitors, individuals submitting enquiries, and contact persons acting on behalf of a business or other organisation. Personal data include, for example, names, email addresses linked to an individual, IP addresses, and information about individuals contained in messages.

Viewing product information, the laboratory presentation or the knowledge base does not in itself constitute placing an order or subscribing to a newsletter. Where necessary, the Controller provides separate information on processing associated with any subsequent contract, invoicing or other processing not described here. When you follow a link to another provider’s website, that provider’s privacy terms also apply.

For privacy-related questions or to exercise your rights as a data subject, you may contact the Controller by email at info@bvn.hu or by post at the registered office stated above.

The Controller processes personal data for specified purposes, on an appropriate legal basis, and only to the extent and for the duration necessary. It ensures that the data are accurate and protected in a manner appropriate to the risks. Data may not be used for a new purpose incompatible with the original purpose without an appropriate legal basis and the provision of relevant information.

Processing is governed in particular by Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.), and the electronic communications rules applicable to cookies and similar technologies.

The contact form requests your name, email address and message. The Controller also processes the date and time of the enquiry, any personal data voluntarily included in the message, and subsequent correspondence. For enquiries by email or telephone, the Controller processes the contact details and information provided that are necessary to handle the enquiry.

The purposes of processing are to answer questions, provide information about products and crop protection solutions, handle enquiries about laboratory testing, process requests for quotations, and maintain the contact necessary for these activities. The Controller does not use enquiry data to send advertising without a separate legal basis.

Please provide only the information necessary to handle your enquiry. Do not send health data, copies of identity documents or other sensitive information that is not necessary for the enquiry.

• For general enquiries and organisational contact persons, processing is based on legitimate interests under Article 6(1)(f) GDPR. The legitimate interests are to respond to incoming business and professional enquiries, maintain contact, and ensure continuity in handling enquiries. Data subjects may object to this processing.
• Where the data subject intends to enter into a contract personally and the enquiry is necessary to take steps at their request before entering into that contract, the legal basis is Article 6(1)(b) GDPR. This legal basis does not apply to a company employee’s data solely because a contract is to be concluded with the company.

Information on the substance of the legitimate interests assessment and the safeguards applied is available from the Controller at info@bvn.hu.

The Controller retains enquiries and responses that are not associated with entering into a contract or separate legal proceedings for no more than 1 year after the enquiry has been closed. Data that are no longer necessary for the purpose are deleted earlier.

If an enquiry results in a contractual relationship or legal dispute, only the documents and data necessary for that purpose are transferred to the related, separately defined processing activity. This does not justify retaining all enquiries for several years as a general rule.

Providing data is voluntary. Without a name, a valid reply address and a meaningful message, an enquiry cannot be submitted through the form or cannot be answered adequately. The informational content of the website remains accessible regardless.

Form submissions are stored in the Forminator database and the recipient’s email inbox.

Serving the website may generate technical data, including IP addresses, request timestamps, the address of the requested page or resource, HTTP response codes, technical characteristics of the browser and operating system, and any referring page address transmitted. The Controller and its hosting provider process the data recorded under the actual logging settings.

The purposes are troubleshooting, maintaining availability, and detecting and preventing unauthorised access and automated attacks. The legal basis is Article 6(1)(f) GDPR; the legitimate interest is the secure operation of the website and contact channels.

Retention: no more than 1 year. In the event of a specific incident, extracts necessary as evidence may be retained separately for as long as required to investigate the incident or handle a legal claim. Data subjects may object to processing based on this legal basis.

The contact form uses Cloudflare Turnstile to filter automated and abusive submissions. Cloudflare processes technical signals for this purpose, including IP addresses, browser identifiers, TLS fingerprints, and identifiers associated with the website and the verification process.

Provider: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare acts as a processor when processing data to protect the website. When processing data to improve its own bot detection capabilities, it acts as an independent controller under its own privacy notice.

On the BVN website, the purpose is to prevent spam and attacks, and the legal basis is legitimate interests under Article 6(1)(f) GDPR. Necessity, proportionality and technical settings must be recorded in a legitimate interests assessment. Retention in BVN’s systems: no more than 1 year. The retention terms for Cloudflare’s own processing are set out in the provider’s privacy notice.

Failure to pass the verification may prevent the form from being submitted. In that case, you can also contact us at info@bvn.hu or by telephone. Further information: https://www.cloudflare.com/turnstile-privacy-policy/ and https://www.cloudflare.com/privacypolicy/.

A cookie is a small data file stored in the browser. The website may use cookies and similar technologies to remember visitors’ choices and, with separate consent, to measure website traffic. Storage that is strictly necessary for operation is treated differently from storage for convenience or statistical purposes.

Technical storage that is strictly necessary to provide the requested service does not require consent. The legal basis for the associated processing of personal data is Article 6(1)(f) GDPR; the legitimate interests are operating the service and remembering visitors’ privacy choices. Functional, analytics or advertising technologies that are not strictly necessary may only be used with prior, voluntary consent. The legal basis for their processing of personal data is Article 6(1)(a) GDPR.

Visitors can accept or reject optional categories in the cookie settings or change their preferences individually. Rejection must not prevent general access to the website’s informational content. Continuing to browse does not in itself constitute consent.

Preferences can be changed and consent withdrawn at any time by opening the cookie settings available on the website. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Cookies can also be deleted or blocked in the browser; this may affect certain convenience features.

Service used to measure website traffic: Google Analytics 4

The purpose is to analyse visitor traffic and content usage in aggregate. Depending on the measurement features enabled, the data processed include online identifiers, page views, events, timestamps, approximate geographical location and device characteristics. Technical transmission may also involve IP addresses; the data are not automatically considered anonymous.

Retention of event and user data: 2 years. Privacy notice: https://policies.google.com/privacy?hl=hu.

Within the Controller’s organisation, personal data may be accessed by staff who need them to handle enquiries or operate the system. Technical service providers may access only the data necessary for their tasks. Processing activities performed on behalf of the Controller are governed by a contract and the Controller’s documented instructions.

Data may be disclosed to authorities, courts or other authorised bodies only on an appropriate legal basis and to the extent necessary to comply with the request or obligation. In connection with a legal claim, the necessary data may also be disclosed to a legal representative.

When the retention period expires, the Controller deletes the personal data or irreversibly anonymises them, unless legislation or a duly substantiated legal claim justifies their further retention separately. Deletion also covers form entries and copies of correspondence stored for the same purpose.

The maximum period before data in backups are overwritten is 1 year. Access to backups retained solely for recovery purposes is restricted. If a backup is restored, previously completed lawful deletions must be reapplied.

The Controller applies technical and organisational measures proportionate to the risks to protect personal data, including access restrictions, encrypted website data transmission and secure system operation. The detailed measures are determined according to the processing environment.

In the event of a personal data breach, the Controller investigates the incident and takes the necessary measures. Under the conditions laid down in the GDPR, it notifies the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to individuals’ rights and freedoms. Where the risk is high, the Controller also informs the affected data subjects, unless a GDPR exception applies.

Subject to the applicable statutory conditions, data subjects may exercise the following rights:

• Access: you may request information on whether the Controller processes your personal data, for what purposes, which categories of data are involved, how long they are retained, and with whom they are shared. You may also request a copy of the personal data being processed.
• Rectification: you may request the correction of inaccurate data and the completion of incomplete data.
• Erasure: you may request the deletion of your data where the relevant conditions are met, for example if the purpose of processing no longer applies, or you have withdrawn consent and there is no other legal basis. Erasure may be limited, for example, by a legal obligation or the enforcement of legal claims.
• Restriction: in the cases provided for by the GDPR, you may request restrictions on the use of your data, for example while their accuracy is disputed or an objection is being assessed.
• Data portability: where processing is automated and based on consent or a contract, you may request the data you have provided in a structured, commonly used, machine-readable format and, where technically feasible, their transmission to another controller, without adversely affecting the rights of others.
• Withdrawal of consent: where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Data subjects may object at any time, on grounds relating to their particular situation, to processing based on legitimate interests. The Controller will then cease processing unless it demonstrates compelling legitimate grounds that override the data subject’s interests, rights and freedoms, or the processing is related to the establishment, exercise or defence of legal claims. The right to object to processing for direct marketing purposes is unconditional; following an objection, the data may no longer be processed for that purpose.

Requests may be sent to info@bvn.hu or by post to the registered office. The Controller provides information on the action taken without undue delay and no later than one month after receiving the request. For complex or numerous requests, this period may be extended by a further two months. The Controller will inform you of the extension and its reasons within the first month.

Exercising your rights is generally free of charge. For manifestly unfounded or excessive requests, a reasonable fee or refusal may apply under the GDPR; the Controller must demonstrate that the conditions for this are met. Where there are reasonable doubts about the requester’s identity, only additional information necessary to verify identity may be requested. If a request is refused, the Controller provides the reasons and information on available remedies.

When handling website enquiries, the Controller does not use decisions based solely on automated processing that produce legal effects concerning data subjects or similarly significantly affect them. Spam protection may carry out technical checks; if a submission is rejected, contact by email and telephone remains available.

If you identify a concern relating to the processing of your data, you may contact the Controller directly. Doing so is not a prerequisite for lodging a complaint with a supervisory authority or seeking a judicial remedy.

In Hungary, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):

• Address: 1055 Budapest, Falk Miksa utca 9–11.
• Postal address: 1363 Budapest, Pf. 9.
• Telephone: +36 1 391 1400
• Email: ugyfelszolgalat@naih.hu; website: https://www.naih.hu

According to NAIH’s guidance, formal proceedings cannot be initiated by ordinary email. The Authority’s website explains the current official submission methods. Under the GDPR, data subjects may also lodge a complaint with a supervisory authority in a Member State, in particular the Member State of their habitual residence, place of work or the alleged infringement.

Data subjects may also seek a judicial remedy in relation to processing and claim compensation where the statutory conditions are met. The commencement of proceedings and the determination of the competent court are governed by the GDPR, the Infotv. and the applicable procedural legislation.

The Controller updates this Notice when processing activities or legislation change and makes the current version available on the website. It provides information about any new processing purpose before processing begins for that purpose. Amending this Notice does not in itself replace any consent required for a new or different purpose.