Introduction
This Privacy Notice (the “Notice”) explains how BST Solar Kft. processes personal data in the course of its business, when operating the www.bst.solar website, the related customer account and webshop, and the BST remote monitoring portal (portal.bst.solar). The Notice complies with Regulation (EU) 2016/679 (the “GDPR”) and Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information (the “Infotv.”).
Terms used in this Notice (Registered User, Approved Customer, Monitored Customer, Account, Portal, Site, Gateway) have the meaning given in the BST Solar General Terms and Conditions (GTC).
1. Data controller
- Company name: BST Solar Kft.
- Registered office: Rokolya utca 1-13., 1131 Budapest, Hungary
- Company registration number: 01-09-437175
- Tax number: 32682861-2-41; EU VAT number: HU32682861
- Represented by: Josip Kovács, Managing Director
- E-mail (including data protection requests): info@bst.solar
- Phone: +36 1 451 8070
- Website: www.bst.solar
(hereinafter: the “Controller” or “BST Solar”)
BST Solar is not required to appoint a data protection officer under Article 37 GDPR.
2. Data subjects and personal data
| Data subjects | Personal data |
|---|---|
| Business partners, customers and their contact persons and representatives | name, position, business e-mail, phone number, employer |
| Prospective customers requesting a quote or contacting us | name, e-mail, phone number, country, company name, message |
| Registered Users (level 1) | name, e-mail, phone number, country, company name (optional), encrypted password, language, time of registration and e-mail confirmation, downloaded documents, marketing consent status |
| Approved Customers (level 2) | in addition, the KYC form data: name and contact details of the company representative and contact person, billing and delivery address, uploaded company extract; orders, proforma and final invoices, payment data (date, amount and reference of the transfer) |
| Monitored Customers and their Portal users (level 3) | Portal account data (name, e-mail, role, two-factor authentication settings), login and activity logs (timestamp, IP address, device/browser), alert recipients (name, e-mail, phone number; from the launch of the mobile app, mobile device identifier for push notifications), Site address and on-site contact person |
| Visitors of www.bst.solar | IP address, cookie identifiers, browsing data, only as set out in Section 12 |
| Suppliers, subcontractors and their contact persons | name, position, business contact details |
Plant measurement data. Technical data collected during remote monitoring (power, state of charge, operating status, error messages) are generally not personal data. They may qualify as personal data where the Site can be linked to a sole trader or a private individual; in that case BST Solar processes them in accordance with this Notice.
BST Solar does not process special categories of personal data (Article 9 GDPR) and does not knowingly process data of persons under 16. Private individuals may register at level 1, but only approved companies can purchase in the webshop.
3. Purposes and legal bases
For processing based on legitimate interest (3.2, 3.7, 3.11, 3.12), BST Solar has carried out a legitimate interest assessment, which is available on request.
3.1 Preparing and performing quotes, orders and contracts
Purpose: preparing quotes, proforma invoices and order confirmations, and performing the resulting contracts (delivery, installation, commissioning, invoicing). Legal basis: Article 6(1)(b) GDPR.
3.2 Business communication
Purpose: answering enquiries, maintaining business relationships, technical support. Legal basis: Article 6(1)(f) GDPR (legitimate interest). Data submitted via the contact form (name, e-mail, phone number, country, company name, message) are processed under this point.
3.3 Compliance with legal obligations
Purpose: issuing invoices and retaining accounting records. Legal basis: Article 6(1)(c) GDPR, in accordance with Hungarian Act C of 2000 on Accounting and the applicable tax laws.
3.4 Marketing communication
Purpose: sending newsletters, professional updates and business offers electronically. Legal basis: Article 6(1)(a) GDPR (consent), in line with Section 6 of Hungarian Act XLVIII of 2008 on Commercial Advertising. Consent is given at registration via a separate, unticked checkbox and may be withdrawn at any time free of charge (unsubscribe link, account settings or e-mail).
3.5 Operating the website
Purpose: ensuring the operation and security of the website. Legal basis: Article 6(1)(f) GDPR and, where required, consent under Section 12.
3.6 Creating and managing the Account
Purpose: registration, e-mail confirmation, login, password reset, and providing document downloads to Registered Users. Legal basis: Article 6(1)(b) GDPR (performance of the terms of use of the Account).
3.7 Customer status verification (KYC)
Purpose: verifying that the applicant is a genuine, operating company and that the person acting on its behalf is authorised to represent it; creating the customer record in the business management system. Legal basis: Article 6(1)(b) GDPR (pre-contractual steps) and Article 6(1)(f) GDPR (BST Solar’s legitimate interest in preventing fraud and non-payment). Approval is decided by a BST Solar employee, not by an automated system.
3.8 Webshop orders, proforma invoices and invoicing
Purpose: processing webshop orders, issuing the proforma invoice (PI), identifying payments, delivery and final invoicing. Orders are transferred automatically to the business management system. Legal basis: Article 6(1)(b) GDPR; retention of invoices and records under Article 6(1)(c) as per 3.3.
3.9 Remote monitoring service
Purpose: operating the Gateway and the VPN connection, collecting and displaying plant data on the Portal, managing Portal users’ permissions. Legal basis: Article 6(1)(b) GDPR (remote monitoring contract). Where BST Solar manages Portal accounts of the customer’s employees or agents on the customer’s instructions, BST Solar acts as a processor; the terms are set out in the data processing annex to the GTC (Article 28 GDPR).
3.10 Alerts and operational notifications
Purpose: sending fault, status and maintenance notifications by e-mail and mobile push to the designated recipients. Legal basis: Article 6(1)(b) GDPR. Recipients are designated by the customer, who is responsible for informing them. These are not marketing messages. E-mail and push alerts are available from the launch of these functions.
3.11 Security logging
Purpose: protecting Accounts, the Portal and remote access, detecting unauthorised access and incidents, meeting cybersecurity obligations. Legal basis: Article 6(1)(f) GDPR (security of the systems and of customers’ plants) and Article 6(1)(c) where logging is required by law.
3.12 Logging acceptance of terms
Purpose: evidencing which version of the GTC, this Notice and the level-specific terms the user accepted or acknowledged, and when. Data recorded: user, document name and version, timestamp, IP address. Legal basis: Article 6(1)(f) GDPR (establishing legal claims) and Article 6(1)(c) (demonstrating consent, Article 7(1) GDPR).
4. Retention period
BST Solar retains personal data only for as long as necessary for the purpose; after the period expires, the data are deleted or irreversibly anonymised.
| Data | Retention period |
|---|---|
| Quote requests and enquiries not leading to a contract | up to 1 year from the last contact, or until an earlier erasure request |
| Account data (levels 1–2) | while the Account exists; after 24 months of inactivity the Account is deleted following prior e-mail notice |
| KYC data, uploaded company extract | 1 year if the application is rejected; 5 years from the end of the customer relationship if approved |
| Orders, proforma and final invoices, payment data | 8 years, as required by accounting and tax laws |
| Contracts, business correspondence | 5 years from the end of the relationship (general limitation period under the Hungarian Civil Code) |
| Portal accounts, alert recipients | until the remote monitoring contract ends, then 30 days (data export) |
| Plant measurement data | during the contract; exportable for 30 days after termination, then deleted or kept in anonymised form |
| Login, Portal and VPN logs | 12 months; in case of an incident, until the investigation is closed |
| Log of accepted terms | 5 years from the termination of the Account or contract |
| Data processed on the basis of marketing consent | until consent is withdrawn; the fact of withdrawal is kept for 5 years |
| Website cookies | as set out in Section 12 |
5. Recipients and processors
BST Solar discloses personal data to the recipients below only to the extent necessary for the purpose. It concludes a contract under Article 28 GDPR with every processor; the current list of processors is available on request at info@bst.solar.
| Recipient | Role | Data received | Location |
|---|---|---|---|
| Website and webshop platform provider | processor | account, KYC, order and log data | EEA |
| Business management system provider | processor | customer record, orders, proforma and final invoices | EEA |
| E-mail delivery provider | processor | name, e-mail, newsletter and alert messages | EEA |
| Mobile push notification provider (from the launch of the mobile app) | processor | device identifier, message text | may be outside the EEA (Section 6) |
| Office e-mail and cloud storage provider | processor | correspondence, documents | EEA |
| Accountant | processor | invoices, payment data | Hungary |
| BST Solartech s.r.o. (group company) | independent controller | project data for joint performance | EEA |
| Carrier, courier service | independent controller | name, delivery address, phone number | EEA |
| Bank | independent controller | transfer data | Hungary |
| Courts, authorities (e.g. the Hungarian Tax Authority) | independent controller | data required by law | Hungary |
The Portal and the VPN run on BST Solar’s own server located in its Budapest office; backups remain in Hungary.
An aggregator authorised by a level-3 customer receives access only on the customer’s separate written decision; the customer controls the data towards that aggregator.
6. Transfers to third countries
BST Solar processes personal data primarily within the European Economic Area (EEA). Currently there are no transfers outside the EEA. Once the mobile app is launched, transfers may occur for mobile push notifications, which are delivered by the services of mobile operating system vendors. Such transfers take place only where the European Commission has adopted an adequacy decision (e.g. for providers certified under the EU–US Data Privacy Framework) or appropriate safeguards, such as the Standard Contractual Clauses adopted by the Commission, are in place. BST Solar does not include personal data in push messages, only a short description of the event.
7. Automated decision-making
BST Solar does not use automated decision-making, including profiling, that produces legal effects concerning the data subject or similarly significantly affects them. Customer status approval is decided by an employee. Remote monitoring alerts are triggered automatically by technical thresholds, but they concern the plant’s condition and are not decisions about individuals.
8. Data security
BST Solar applies appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, destruction and accidental loss, in particular:
- encrypted data transmission (HTTPS) and encrypted password storage;
- role-based access: each customer sees only its own data and Site;
- two-factor authentication, mandatory on the Portal;
- encrypted VPN connection between the Gateway and BST systems;
- logging of logins and administrator actions;
- regular backups.
In the event of a personal data breach, BST Solar acts in accordance with Articles 33–34 GDPR: where required, it notifies the Hungarian supervisory authority (NAIH) within 72 hours and, where the risk is high, also informs the data subjects.
9. Rights of data subjects
Under the GDPR, data subjects have the following rights:
- right of access (Article 15);
- right to rectification (Article 16);
- right to erasure (“right to be forgotten”, Article 17), where there are grounds for it; accounting records cannot be deleted during the 8-year retention period;
- right to restriction of processing (Article 18);
- right to data portability (Article 20);
- right to object (Article 21) to processing based on legitimate interest, including direct marketing;
- right to withdraw consent (Article 7(3)).
Directly from the Account: a logged-in user can update and download their data, switch off marketing consent and request deletion of their Account.
Requests may also be sent to info@bst.solar. BST Solar may verify the requester’s identity and replies within one month of receipt. This period may be extended by two further months where necessary, in which case the data subject is informed.
Where BST Solar acts as a processor at level 3 (Section 3.9), it forwards the data subject’s request to the customer as controller and assists in fulfilling it.
10. Right to lodge a complaint
If a data subject considers that the processing of their personal data infringes the GDPR, they may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):
- address: Falk Miksa utca 9-11., 1055 Budapest, Hungary
- postal address: 1363 Budapest, Pf. 9.
- phone: +36 1 391 1400
- e-mail: ugyfelszolgalat@naih.hu
- website: www.naih.hu
Data subjects may also bring proceedings before a court, including the regional court of their place of residence or stay. Data subjects living in another EU Member State may also contact the supervisory authority of their place of residence.
11. Amendments and versioning
BST Solar reserves the right to amend this Notice, in particular if its activities, services or the applicable laws change. Each version has a version number and an effective date. BST Solar notifies account holders of material changes by e-mail or at their next login and, where necessary, asks them to acknowledge the new version.
The current and previous versions are available on www.bst.solar, where the BST Solar Kft. GTC can also be found. This Notice is available in Hungarian and English; in case of discrepancy, the Hungarian text prevails.
12. Cookies
www.bst.solar uses the cookie categories below. Cookies that are not strictly necessary are placed only after consent is given in the cookie banner; consent may be withdrawn at any time in the banner or in the browser.
| Category | Purpose | Legal basis | Duration |
|---|---|---|---|
| Strictly necessary | login, cart, language, security, remembering the cookie choice | Article 6(1)(f) GDPR; Section 155(4) of the Hungarian Electronic Communications Act | session, up to 1 year |
| Statistics | measuring traffic (e.g. pages viewed) | consent | up to 1 year |
| External content | embedded YouTube videos | consent | as per the provider’s rules |
For embedded videos, YouTube (Google) acts as an independent controller and may transfer data outside the EEA with the safeguards described in Section 6.
Version: v2.0 – effective from 6 October 2026. Previous version: v1.0, effective from 13 August 2026.