PRIVACY NOTICE

for visitors to the www.graboplan.hu website, requesters of quotes, and business contacts

Effective: July 28, 2026

DATA CONTROLLER INFORMATION

Full Name: GRABOPLAN Tent Manufacturing and Technical Apparel Limited Liability Company

Abbreviated Name: GRABOPLAN Kft.

Registered Office / Mailing Address: 9027 Győr, Bútorgyári utca 4.

Company Registration Number: 08-09-007345

Tax ID: 11611910-2-08

Email: info@graboplan.hu

Phone: +36 96 550 700

Website: https://graboplan.hu/[OT1]

1. Purpose and Scope of This Notice

GRABOPLAN Kft. (hereinafter: “Data Controller” or “GRABOPLAN”) respects the privacy of natural persons. This privacy notice explains what personal data is collected, for what purposes, and on what legal basis, as well as the extent of such data collection, in connection with the use of the website available at www.graboplan.hu (hereinafter: “Website”), contacting us, requesting a quote, and the resulting business relationship—specifies what personal data we process, for what purposes and on what legal basis, for how long we process it, who has access to the data, and what rights data subjects have.

The Website is an informational and quote-request platform; it is not an online store and currently does not provide user accounts, online payment, or a loyalty program. This notice therefore covers only the data processing activities that are actually relevant to the Website and the course of our business relationship.

This notice is based, in particular, on Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”), Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (“Infotv.”), and, with regard to cookies and similar technologies, Section 155(4) of Act C of 2003 on Electronic Communications (“Eht.”).

2. Detailed Description of Data Processing Activities

2.1. Contact and Request-for-Quote Forms

Data Subjects: natural persons initiating contact via the Website, as well as natural persons acting as representatives or contact persons for business entities and other organizations.

Processed Data: company name; name of the contact person (“Contact”); phone number; email address; position; subject of interest; structure; function; size; location; tent type; sidewall design; other equipment; planned installation date; content of the message; date of submission; as well as technical log data related to the submission that is necessary for the operation of the system and the prevention of misuse.

Purpose of data processing: to receive and respond to the inquiry; to conduct a preliminary technical and commercial assessment of the request; to prepare and send a quote; to document the consultation; and, if necessary, to prepare for the conclusion of a contract.

Legal basis: if the data subject requests a quote or takes a step prior to entering into a contract on their own behalf, Article 6(1)(b) of the GDPR. If the data subject acts as a representative or contact person for a company or other organization, Article 6(1)(f) of the GDPR; the legitimate interest is to handle the inquiry, facilitate business communication, and enable the submission of a quote. The retention of the inquiry and the response thereto for the purpose of substantiating legal claims is also based on Article 6(1)(f) of the GDPR.

Retention period: if no contract is concluded, 1 year from the closure of the case or the last substantive communication. If the inquiry leads to a contract, the retention periods specified in Section 2.3 apply to the data. In the event of an ongoing legal dispute or administrative proceeding, we will retain the data until the proceeding is finally resolved or until the related claim can be enforced.

Consequences of providing data: Without the data marked as mandatory, GRABOPLAN cannot process the inquiry substantively. Providing information in the additional fields is voluntary; however, omitting them may limit the ability to conduct an accurate technical or commercial evaluation of the request.

Source of data: primarily the data subject; in the case of an organizational contact person, it may also be the data subject’s employer, client, or the organization they represent.

2.2. Inquiries via email, telephone, and mail

Data processed: name; company name or organization; position; phone number; email address; mailing address; the content of the inquiry, the response, and any attachments; the dates of communications; and any other data voluntarily provided by the data subject.

Purpose of data processing: maintaining contact, providing information, making offers, handling requests or complaints, and tracking and documenting the matter.

Legal basis: depending on the nature of the inquiry, Article 6(1)(b) of the GDPR; or, in the case of organizational communication and documentation of the matter, Article 6(1)(f) of the GDPR. In the case of compliance with a legal obligation, Article 6(1)(c) of the GDPR.

Retention period: if the matter does not result in a contract, 1 year from the closure of the matter or the last substantive communication; in matters involving contractual, accounting, or legal claims, the longer period specified in Section 2.3.

2.3. Quotation, Contract Formation, Performance, and Business Relations

Data Subjects: natural person customers and contractors, as well as natural person representatives and contacts of customers, suppliers, subcontractors, designers, and other business partners.

Processed Data: name; job title; authority to represent or sign; work contact information; signature; communications related to the project, technical coordination, delivery, installation, and performance; as well as personal data contained in the contract, performance documents, and accounting records.

Purpose of data processing: submitting bids; concluding, performing, amending, and terminating contracts; maintaining technical, project, and logistical communication; invoicing; managing receivables; fulfilling legal and accounting obligations; and asserting, enforcing, or defending legal claims.

Legal basis: Article 6(1)(b) of the GDPR in the case of a natural person as a contracting party. In the case of data concerning representatives and contact persons of legal entities or other organizations, Article 6(1)(f) of the GDPR; the legitimate interest is the effective management of the contractual and project relationship. In the case of accounting, tax, and other mandatory data processing, Article 6(1)(c) of the GDPR.

Retention period: Documents related to the contract and its performance that are necessary for legal claims are generally retained for 5 years from the termination or fulfillment of the contract, in accordance with the general statute of limitations set forth in Section 6:22 of Act V of 2013 on the Civil Code. We retain accounting records and the supporting documents for at least 8 years, in accordance with Section 169(2) of Act C of 2000 on Accounting. In the event of legal or regulatory proceedings, the data retention period may be extended until the proceedings are finally concluded.

Source of data: the data subject, the data subject’s employer or client, business partners, other contractual partners participating in the project, as well as public company and professional registries.

2.4. Website Visits, Server Logs, and IT Security

Data processed: IP address; time of visit; the page viewed and resource requested; HTTP response code; browser and operating system data; device characteristics; language setting; referring page; session ID; and campaign parameters included in the opened URL, such as gclid or gbraid, if the visitor arrives at the Website with such a parameter.

Purpose of data processing: to ensure the Website’s availability, stability, and secure operation; to troubleshoot errors; and to detect and investigate abuse, automated attacks, and security incidents.

Legal basis: Article 6(1)(f) of the GDPR; GRABOPLAN’s legitimate interest in protecting the security of the Website, its IT systems, and its users.

Retention period: generally 30 days. In the event of a security incident, abuse, or legal claim, for the period necessary to investigate the incident or enforce the claim.

Data collection: automatic; an inherent part of the technical use of the Website. The appearance of the gclid and gbraid campaign parameters does not in itself constitute the creation of a marketing profile; their further use for advertising or conversion tracking purposes may only occur under the conditions set forth in Section 2.5.

2.5. Cookies and Similar Technologies

What is a cookie: A cookie is a small data file placed on or read from a visitor’s device. The Website may also use local storage, tags, pixels, or other similar technologies.

Strictly Necessary Technologies: Technologies necessary for the basic operation, security, load balancing, and form functionality of the Website, as well as for saving cookie settings. These may be used within the scope of the exception provided for in Section 155(4) of the Eht., to the extent necessary, without separate consent. If they involve the processing of personal data, the legal basis is Article 6(1)(f) of the GDPR, or, where necessary for the provision of a specifically requested service, Article 6(1)(b) of the GDPR.

Statistical and marketing technologies: Traffic measurement, campaign and conversion tracking, evaluation of ad performance, or personalized advertising may only be activated after the visitor has given their prior, voluntary consent based on specific and adequate information. Legal basis: Article 6(1)(a) of the GDPR. The Website may also receive visitors from Google Ads campaigns; the processing of related campaign identifiers for analytical or advertising purposes may only take place after the relevant cookie category has been accepted.

Choice: The “Accept All” and “Reject All” options must be provided on an equal footing. Remaining silent, a pre-checked box, or continued use of the Website does not constitute consent.

Withdrawal of consent: Visitors may modify or withdraw their consent at any time via the “Cookie Settings” interface, accessible from every page of the Website, with the same ease as when consent was initially granted. Withdrawal does not affect the lawfulness of prior data processing.

Specific cookies: The “Cookie Settings” section of the Website contains the names, providers, purposes, categories, expiration dates, and information regarding any data transfers to third countries for the cookies and similar technologies currently in use. Non-essential technologies cannot be loaded until the appropriate consent is provided.

2.6. Verification of Consents and Privacy Statements

Processed data: the content of the cookie settings or other privacy statements; the date; the version; the technical identifier required to verify the statement; the date of any modification or withdrawal.

Purpose of data processing: to verify that GRABOPLAN has provided the appropriate information and, where consent is required, has obtained valid consent.

Legal basis: Article 6(1)(c) of the GDPR, in conjunction with the accountability requirement set forth in Article 5(2) of the GDPR and the burden of proof set forth in Article 7(1) of the GDPR; in the case of the protection of legal claims, Article 6(1)(f) of the GDPR.

Retention period: for the period necessary to enforce legal claims, calculated from the withdrawal of consent or the cessation of the relevant data processing, generally for a maximum of 5 years.

3. Recipients and Data Processors

Access to personal data is restricted to those who require it to perform their duties. These include, in particular:

· GRABOPLAN employees responsible for sales, technical, planning, project, logistics, financial, IT, and legal tasks;

· the Website’s hosting and infrastructure provider, the Website’s developer and maintainer, and email and office IT service providers;

· cookie management, analytics, and advertising service providers, exclusively in accordance with the visitor’s choices;

· delivery, installation, design, expert, or other service providers involved in the performance of the contract, provided that the transfer of personal data is necessary for the performance of their tasks;

· authorities, courts, legal representatives, and experts, if the data transfer is justified by law, an official request, or a legal claim.

Data processors may process the data in accordance with GRABOPLAN’s documented instructions and under contractual terms compliant with Article 28 of the GDPR. In accordance with Article 13(1)(e) of the GDPR, this notice specifies the categories of recipients; upon the data subject’s request for access, we will provide detailed information regarding the specific recipients involved in the given case. The specific service providers related to cookies are listed on the “Cookie Settings” page.

4. Data Transfer Outside the European Economic Area

Certain IT, analytics, or advertising service providers may process data outside the European Economic Area (“EEA”), particularly in the United States. Such data transfers may only take place under the conditions set forth in Chapter V of the GDPR, specifically:

· on the basis of an adequacy decision by the European Commission pursuant to Article 45 of the GDPR—in the case of the United States, for example, to an organization actively participating in the EU-U.S. Privacy Shield Framework—or

· by applying appropriate safeguards pursuant to Article 46 of the GDPR, such as the standard contractual clauses adopted by the European Commission, supplemented by additional measures if necessary.

Information regarding the specific service provider, destination country, and transfer safeguards can be found on the “Cookie Settings” page or by requesting information from the Data Controller.

5. Data Security

GRABOPLAN implements technical and organizational measures commensurate with the risks to protect the confidentiality, integrity, and availability of personal data. As part of this, it specifically regulates access, ensures the protection of systems and backups, performs IT updates, and maintains appropriate logging of access and security incidents. Only authorized persons may access personal data.

6. Rights of Data Subjects

Data subjects may exercise the following rights in accordance with the conditions set forth in the GDPR:

Right of Access – Article 15 of the GDPR: You may request confirmation as to whether we are processing your personal data, and you may request access to and a copy of the data, as well as information regarding the relevant circumstances of the data processing.

Right to Rectification – Article 16 of the GDPR: You may request the rectification of inaccurate personal data and the completion of incomplete data.

Right to Erasure – Article 17 of the GDPR: You may request the erasure of your personal data if the legal conditions for such erasure are met. Erasure cannot be requested, among other cases, if the processing is necessary for compliance with a legal obligation or for the establishment, exercise, or defense of legal claims.

Right to restriction of processing – Article 18 of the GDPR: You may request the restriction of processing, for example, if you contest the accuracy of the data or the lawfulness of the processing.

Right to data portability – Article 20 of the GDPR: In the case of automated data processing based on consent or a contract, you may request that the data you have provided be delivered in a structured, commonly used, machine-readable format, or—if technically feasible—transferred to another data controller.

Right to Object – Article 21 of the GDPR: You may object to data processing based on Article 6(1)(f) of the GDPR for reasons related to your particular situation. In such cases, we will cease the data processing unless we demonstrate compelling legitimate grounds for the processing that override your interests, or the processing is necessary for the establishment, exercise, or defense of legal claims.

Withdrawal of Consent – Article 7(3) of the GDPR: You may withdraw your consent at any time. The withdrawal does not affect the lawfulness of data processing carried out on the basis of your consent prior to the withdrawal.

Automated decision-making – Article 22 of the GDPR: You have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. GRABOPLAN does not use such automated decision-making in the data processing covered by this notice.

7. Handling of Requests

Requests from data subjects may be submitted via email to info@graboplan.hu, by phone at +36 96 550 700, or by mail to 9027 Győr, Bútorgyári utca 4.[OT2] The Data Controller will respond to the request without undue delay, generally within one month of receipt. Pursuant to Article 12(3) of the GDPR, the deadline may be extended by an additional two months, taking into account the complexity of the request and the number of requests; we will provide information regarding the extension and its reason within one month.

To protect the identity and data of the data subject, we may request additional information necessary for identification, to the extent proportionate. As a general rule, requests are processed free of charge; however, in the case of a manifestly unfounded or excessive request pursuant to Article 12(5) of the GDPR, a reasonable fee may be charged, or the request may be refused.

8. Complaints and Judicial Remedies

The data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work, or the place where the alleged infringement occurred. In Hungary, the competent supervisory authority is:

NATIONAL AUTHORITY FOR DATA PROTECTION AND FREEDOM OF INFORMATION (NAIH)

Address1055 Budapest, Falk Miksa Street 9–11.

Mailing Address1363 Budapest, P.O. Box 9.

Emailugyfelszolgalat@naih.hu

Phone+36 1 391 1400; +36 30 683 5969; +36 30 549 6838

Websitehttps://www.naih.hu/

The data subject may also bring a lawsuit before a court pursuant to Article 79 of the GDPR and the provisions of the Information Act. The court has jurisdiction over the case; at the data subject’s discretion, the lawsuit may also be filed with the court of the data subject’s place of residence or stay.

9. Amendments to This Privacy Notice

GRABOPLAN may amend this Privacy Notice in the event of changes to the Website’s functions, the service providers used, internal data processing procedures, or the legal environment. The currently effective version is available under the “Privacy” menu item on the Website. In the event of a significant change that adversely affects data subjects, GRABOPLAN may draw specific attention to the amendment in a manner appropriate to the circumstances.