Com­pany name:  Solu­zi­o­ni Natu­ra­li Kft.

Head­qu­ar­ters: 1025 Buda­pest, Csej­tei Street 12/B

Com­pany reg­istra­ti­on num­ber: 01–09-425125

Tax num­ber: 32458220–2‑41

Rep­re­s­en­ta­tive:  Dr. Imre Boz­sik, Manag­ing Direc­tor

Tele­fon­szám:                                   +36–30-012‑2480

E‑mail add­ress:                                       soluzionikft@gmail.com

Web­site: www.soluzioninaturali.eu

 

PURPOSE OF THE DATA PROCESSING NOTICE

The data cont­rol­ler ack­now­led­ges the cont­ent of this leg­al noti­ce as bind­ing on itself. The pur­po­se of this Data Pro­tec­ti­on Noti­ce is to inform the data cont­rol­ler’s cli­ents, part­ners and cus­to­mers regard­ing the pro­ces­sing of the­ir per­so­nal data.

The data cont­rol­ler pro­ces­ses per­so­nal data exc­lu­si­vely in accor­dance with the provi­sions of app­lic­ab­le law, in strict comp­li­ance with the requ­i­re­ments of data manag­ement and data pro­tec­ti­on provi­sions, tak­ing into account the prin­cip­les of lega­lity, fair pro­ce­du­re and tran­spa­rency, pur­po­se lim­it­ati­on, data eco­nomy, acc­uracy, and limi­ted stor­age.

The data cont­rol­ler takes all tech­ni­cal and orga­ni­za­ti­o­nal mea­sures to pro­cess the per­so­nal data of its part­ners secu­rely, in a man­ner requ­i­red by Regu­la­ti­on (EU) 2016/679 of the Euro­pe­an Par­lia­ment and of the Coun­cil.

The data cont­rol­ler has trans­for­med its every­day acti­vi­ti­es in accor­dance with the abo­ve, devel­oped its regu­la­tions, reg­is­ters, and docu­ment temp­la­tes.

The data pro­tec­ti­on guide­li­nes ari­sing from the data cont­rol­ler’s data pro­ces­sing are con­ti­nu­o­usly ava­i­lab­le at the data cont­rol­ler’s head­qu­ar­ters and web­site. The data cont­rol­ler reser­ves the right to chan­ge this infor­ma­ti­on at any time. Of cour­se, it will noti­fy its audi­en­ce of any changes in due time.

The data cont­rol­ler is com­mit­ted to pro­tec­ting the per­so­nal data of its cus­to­mers and part­ners and cons­iders it of utmost impor­tance to respect the cus­to­mers’ right to infor­ma­ti­o­nal self-deter­mi­na­ti­on. The data cont­rol­ler treats per­so­nal data con­fi­den­ti­ally and takes all secu­rity, tech­ni­cal and orga­ni­za­ti­o­nal mea­sures to gua­ran­tee the secu­rity of the data. The data cont­rol­ler descri­bes its data manag­ement prac­ti­ces below.

 

PERSONAL, SUBJECT AND TEMPORAL SCOPE OF THE DATA PROCESSING NOTICE

The per­so­nal scope of this Data Pro­tec­ti­on Noti­ce extends to the data cont­rol­ler, as well as to tho­se natu­ral per­sons who­se data is inc­lu­ded in the data pro­ces­sing ope­ra­tions cove­red by this Noti­ce, as well as to tho­se per­sons who­se rights or legi­ti­ma­te inte­rests are affec­ted by the data pro­ces­sing.

The scope of the Noti­ce covers all data pro­ces­sing ari­sing during the data cont­rol­ler’s acti­vi­ti­es, except for so-called inter­nal data pro­ces­sing (e.g. rela­ted to emp­loye­es), which is regu­lated in the data cont­rol­ler’s Data Pro­ces­sing Poli­cy.

This Noti­ce shall enter into for­ce on 24.01.2025 and shall be valid for an inde­fi­ni­te peri­od.

 

DEFINITIONS OF MORE IMPORTANT TERMS

Per­so­nal data: any infor­ma­ti­on relat­ing to an iden­ti­fi­ed or iden­ti­fi­ab­le natu­ral per­son. An iden­ti­fi­ab­le natu­ral per­son is one who can be iden­ti­fi­ed, directly or indi­rectly, in par­ti­cu­lar by refe­ren­ce to an iden­ti­fi­er such as a name, a num­ber, loca­ti­on data, an online iden­ti­fi­er or to one or more fac­tors spe­ci­fic to the phy­si­cal, phy­si­o­log­i­cal, gene­tic, men­tal, eco­no­mic, cul­t­u­ral or soci­al iden­tity of that natu­ral per­son.

Spe­ci­al data: all data fal­ling wit­hin spe­ci­al categ­ori­es of per­so­nal data, i.e. per­so­nal data reve­aling raci­al or eth­nic ori­gin, poli­ti­cal opin­ions, reli­gi­o­us or phi­lo­sophi­cal beli­efs or trade union mem­ber­ship, as well as gene­tic data, bio­met­ric data for the uni­que iden­ti­fi­ca­ti­on of natu­ral per­sons, health data and per­so­nal data con­cer­ning the sex life or sexu­al ori­en­ta­ti­on of natu­ral per­sons.

Data pro­ces­sing: any ope­ra­ti­on or set of ope­ra­tions which is per­for­med on per­so­nal data or data files, whet­her or not by auto­ma­ted means, such as coll­ec­ti­on, record­ing, orga­ni­sa­ti­on, struc­tu­ring, stor­age, adap­ta­ti­on or alte­ra­ti­on, ret­ri­e­val, con­sul­ta­ti­on, use, disc­los­ure by trans­mis­si­on, dis­se­mi­na­ti­on or other­wi­se mak­ing ava­i­lab­le, align­ment or com­bi­na­ti­on, rest­ric­ti­on or destruc­ti­on.

Data cont­rol­ler: the natu­ral or leg­al per­son, pub­lic aut­ho­rity, agency or any other body which, alo­ne or jointly with others, deter­mi­nes the pur­pos­es and means of the pro­ces­sing of per­so­nal data.

Data pro­ces­sor: the natu­ral or leg­al per­son, pub­lic aut­ho­rity, agency or any other body which pro­ces­ses per­so­nal data on behalf of the data cont­rol­ler.

 

Joint data cont­rol­lers: if the pur­pos­es and means of data pro­ces­sing are deter­mi­ned jointly by two or more data cont­rol­lers, they are cons­idered joint data cont­rol­lers.

Third par­ty: a natu­ral or leg­al per­son, pub­lic aut­ho­rity, agency or any other body other than the data sub­ject, the cont­rol­ler, the pro­ces­sor or the per­sons who, under the direct cont­rol of the cont­rol­ler or pro­ces­sor, are aut­ho­ri­sed to pro­cess per­so­nal data.

Con­sent of the data sub­ject: any fre­ely given, spe­ci­fic, ade­qua­tely infor­med and unam­bi­gu­o­us indi­ca­ti­on of the data sub­ject’s wis­hes by which the data sub­ject, by a sta­te­ment or by a clear affir­ma­tive acti­on, sig­ni­fi­es agree­ment to the pro­ces­sing of per­so­nal data con­cer­ning him or her.

Data pro­tec­ti­on inci­dent: a bre­ach of secu­rity that results in the acci­den­tal or unlaw­ful destruc­ti­on, loss, alte­ra­ti­on, una­ut­ho­ri­zed disc­los­ure of, or una­ut­ho­ri­zed access to, per­so­nal data trans­mit­ted, stor­ed, or other­wi­se pro­ces­sed.

Law­ful data pro­ces­sing by the data cont­rol­ler:

The data cont­rol­ler pro­ces­ses per­so­nal data only in the fol­lo­wing cas­es:

if the data sub­ject has given con­sent to the pro­ces­sing of his or her per­so­nal data for one or more spe­ci­fic pur­pos­es,

the data pro­ces­sing is neces­sary for the per­for­mance of a cont­ract to which the data sub­ject is a par­ty,

the data pro­ces­sing is neces­sary for the ful­fill­ment of a leg­al obli­ga­ti­on to which the data cont­rol­ler is sub­ject,

the pro­ces­sing is neces­sary to pro­tect the vital inte­rests of the data sub­ject or anot­her natu­ral per­son,

the data pro­ces­sing is neces­sary for the pur­pos­es of the legi­ti­ma­te inte­rests of the data cont­rol­ler or a third par­ty.

The data cont­rol­ler exa­mi­nes the law­ful­ness of data pro­ces­sing at every stage of its acti­vity and only pro­ces­ses data for as long as it can jus­ti­fy its pur­po­se and leg­al basis. If the con­di­tions for a leg­al basis cea­se to exist, data pro­ces­sing can only be con­ti­nu­ed if the data cont­rol­ler can jus­ti­fy anot­her app­rop­ria­te leg­al basis.

The main rule for pro­ving leg­al grounds is that they must be in writing. Even in the case of a leg­al ground est­ab­lis­hed by induc­tive con­duct, it must be exa­mi­ned whet­her it can be cle­arly pro­ven after­wards. In case of doubt, with regard to the aspects of rea­son­ab­le­ness and eco­nomy, eff­orts sho­uld be made to con­firm in writing the data pro­ces­sing est­ab­lis­hed by induc­tive con­duct.

In the case of data pro­ces­sing bas­ed on con­sent, the data sub­ject gives writ­ten con­sent to the pro­ces­sing of his or her per­so­nal data. Con­sent is not sub­ject to for­mal requ­i­re­ments, but sub­se­qu­ent pro­va­bi­lity requ­i­res writ­ten con­sent on paper or electro­ni­cally.

Data pro­ces­sing bas­ed on the leg­al basis of ful­fil­ling a leg­al obli­ga­ti­on is inde­pen­dent of the con­sent of the data sub­ject, as data pro­ces­sing is deter­mi­ned by law.

Regard­less of the man­da­to­ry natu­re of data pro­ces­sing, the indi­vi­du­al con­cer­ned must be infor­med befo­re the start of data pro­ces­sing that the data pro­ces­sing is man­da­to­ry and can­not be avo­id­ed, and the indi­vi­du­al con­cer­ned must be pro­vi­ded with clear and detai­led infor­ma­ti­on abo­ut all sig­ni­fi­cant facts rela­ted to the pro­ces­sing of his or her data befo­re the start of data pro­ces­sing.

Accord­ing to the GDPR (Gene­ral Data Pro­tec­ti­on Regu­la­ti­on), per­so­nal data may also be pro­ces­sed if the pro­ces­sing is neces­sary for the per­for­mance of a cont­ract to which the indi­vi­du­al con­cer­ned is a par­ty, or if the pro­ces­sing or coll­ec­ti­on of data is neces­sary to take steps at the request of the indi­vi­du­al con­cer­ned pri­or to enter­ing into a cont­ract. The cont­rol­ler may pro­cess per­so­nal data for the pur­po­se of conc­lu­ding, per­form­ing or ter­mi­nat­ing the cont­ract on the leg­al basis of per­for­mance of the cont­ract.

 

PROCESSING OF PERSONAL DATA BY THE DATA CONTROLLER

The data cont­rol­ler is a leg­al entity pri­ma­rily engag­ed in the pro­duc­ti­on and dis­t­ri­bu­ti­on of mic­ro­bio­log­i­cal pro­ducts. In the cour­se of car­rying out the­se acti­vi­ti­es, it may come into con­tact with the per­so­nal data of natu­ral per­sons. The data cont­rol­ler car­ri­es out the fol­lo­wing data pro­ces­sing acti­vi­ti­es:

The data cont­rol­ler’s cont­rac­tu­al part­ners in its manu­fac­tu­ring, dis­t­ri­bu­ti­on and con­sult­ing ser­vi­ce acti­vi­ti­es and in its coope­ra­ti­on with resel­ler part­ners, cus­to­mers and regi­o­nal rep­re­s­en­ta­ti­ves may be both pri­vate indi­vi­du­als and leg­al enti­ti­es.

The conc­lu­si­on of the cont­ract is pre­ce­ded by a request for a quo­te in the form of an e‑mail mes­sage using the con­tact form on the cont­rol­ler’s web­site ( soluzioninaturali.eu ). The cli­ent pro­vi­des his/her name, telep­ho­ne num­ber, e‑mail add­ress, to which the cont­rol­ler sends the rele­vant quo­te. If the quo­te is rejec­ted, the data sub­ject’s per­so­nal data will be dele­ted imme­dia­tely, but no later than wit­hin 3 wor­king days. The leg­al basis for the pro­ces­sing of per­so­nal data is the conc­lu­si­on of the cont­ract (Artic­le 6(1)(b) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on). If the data sub­ject orders the offe­red ser­vi­ce, a cont­ract will be conc­lu­ded. Upon conc­lu­si­on of the cont­ract, the cont­rol­ler will acqu­i­re addi­ti­o­nal per­so­nal data of indi­vi­du­als (part­ners, rep­re­s­en­ta­ti­ves and con­tact per­sons). The leg­al basis for data pro­ces­sing is the ful­fill­ment of the obli­ga­ti­on assum­ed in the cont­ract (Artic­le 6(1)(b) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on), in the case of a con­tact per­son of a leg­al per­son, the con­sent of the data sub­ject (Artic­le 6(1)(a) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on). The data cont­rol­ler issues an invo­i­ce for the cons­ide­ra­ti­on of the cont­rac­tu­al ser­vi­ce pro­vi­ded by it, depend­ing on the ser­vi­ce pro­vi­ded. The invo­i­ce con­ta­ins the name, add­ress and pos­sibly the tax num­ber of the cus­to­mer. Issu­ing the invo­i­ce is the obli­ga­ti­on of the data cont­rol­ler set out in the law. The leg­al basis for the pro­ces­sing of per­so­nal data inc­lu­ded in the invo­i­ce is the ful­fill­ment of a leg­al obli­ga­ti­on (Artic­le 6(1)© of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on). The data cont­rol­ler stores the per­so­nal data inc­lu­ded in the invo­i­ce for 8 years, in comp­li­ance with the retent­ion obli­ga­ti­on set out in Sec­ti­on 169 of the Account­ing Act.

You can apply for pro­fes­si­o­nal advi­ce ava­i­lab­le on the data cont­rol­ler’s web­site at the data cont­rol­ler’s e‑mail add­ress pro­vi­ded in this infor­ma­ti­on. When apply­ing, the data cont­rol­ler asks for the cli­ent’s name, e‑mail add­ress and telep­ho­ne num­ber. The data cont­rol­ler pro­ces­ses per­so­nal data in order to arrange an app­rop­ria­te appoint­ment for the cli­ent and to ensure con­tact in the event of a chan­ge in appoint­ment.

The leg­al basis for the pro­ces­sing of per­so­nal data obta­ined by the cont­rol­ler in this way is the conc­lu­si­on of the cont­ract (Artic­le 6(1)(b) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on). If the data sub­ject does not use the cont­rol­ler’s ser­vi­ce at the agreed time, the cont­rol­ler shall dele­te the per­so­nal data wit­ho­ut delay, but no later than wit­hin 3 wor­king days. The leg­al basis for the pro­ces­sing of per­so­nal data during the use of the ser­vi­ce is the ful­fill­ment of the obli­ga­tions assum­ed in the cont­ract (Artic­le 6(1)(b) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on). The cont­rol­ler may issue an invo­i­ce to the cli­ent for the cons­ide­ra­ti­on for the ser­vi­ce pro­vi­ded by it, depend­ing on the ser­vi­ce pro­vi­ded. The invo­i­ce shall con­ta­in the cli­ent’s name, add­ress and, in the case of a leg­al entity, its tax iden­ti­fi­ca­ti­on num­ber. The leg­al basis for the pro­ces­sing of per­so­nal data is the ful­fill­ment of a leg­al obli­ga­ti­on (Artic­le 6(1)© of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on). The data cont­rol­ler stores the per­so­nal data on the invo­i­ce for 8 years, in comp­li­ance with the retent­ion obli­ga­ti­on set out in Sec­ti­on 169 of the Account­ing Act.

After fil­ling out the con­tact form – i.e. pro­vi­ding the­ir name and email add­ress – the inter­es­ted par­ty has the oppor­tunity to down­lo­ad short, PDF-form­at­ted infor­ma­ti­on mate­ri­als in Eng­lish and Hun­ga­ri­an for each pro­duct. The pur­po­se of pro­ces­sing per­so­nal data is to con­tact the per­son who down­lo­a­ded the infor­ma­ti­on mate­ri­al. If a cont­rac­tu­al rela­ti­onship with the inter­es­ted par­ty regard­ing a pro­duct manu­fac­tu­red or dis­t­ri­bu­ted by the data cont­rol­ler is not est­ab­lis­hed wit­hin 6 months of down­load­ing the infor­ma­ti­on mate­ri­al, the data cont­rol­ler will dele­te the per­so­nal data no later than 3 wor­king days after the expiry of the six months. The leg­al basis for pro­ces­sing per­so­nal data that the data cont­rol­ler has beco­me aware of in this way is the conc­lu­si­on of the cont­ract (Artic­le 6 (1) para­gra­ph b) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on) and the pri­or infor­med con­sent of the inter­es­ted par­ty. By fil­ling out the form, the data sub­ject dec­la­res that he/she has read the data cont­rol­ler’s Data Pro­tec­ti­on Noti­ce and has taken note of its cont­ents.

The data cont­rol­ler, in con­nec­ti­on with its com­mer­ci­al acti­vi­ti­es, during the sale of pro­ducts pro­du­ced or dis­t­ri­bu­ted by it, per­so­nally or thro­ugh soluzionikft@gmail.com accepts orders via e‑mail add­ress. Cus­to­mers can be both pri­vate indi­vi­du­als and leg­al enti­ti­es. In the case of an order, the data cont­rol­ler requests the cus­to­mer’s name (in the case of a leg­al entity, the name of the con­tact per­son and the tax num­ber of the leg­al entity), add­ress, e‑mail add­ress, and telep­ho­ne num­ber. The leg­al basis for the pro­ces­sing of per­so­nal data is the ful­fill­ment of the obli­ga­tions assum­ed in the cont­ract (Artic­le 6 (1) para­gra­ph b) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on). In the case of a leg­al entity, the per­so­nal data of the con­tact per­son is pro­ces­sed, which is bas­ed on the con­sent of the data sub­ject (Artic­le 6 (1) para­gra­ph a) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on). The pur­po­se of the pro­ces­sing of per­so­nal data is to ful­fill the obli­ga­tions assum­ed, to main­ta­in con­tact, and to send the orde­red pro­duct to the data sub­ject. The data cont­rol­ler issues an invo­i­ce to its cus­to­mers for the cons­ide­ra­ti­on for the pro­ducts it sells. The invo­i­ce con­ta­ins the cus­to­mer’s name, add­ress, and pos­sibly tax num­ber. Leg­al basis for pro­ces­sing per­so­nal data, ful­fill­ment of a leg­al obli­ga­ti­on (Artic­le 6(1)© of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on). The data cont­rol­ler stores the per­so­nal data on the invo­i­ce for 8 years, in comp­li­ance with the retent­ion obli­ga­ti­on set out in Sec­ti­on 169 of the Account­ing Act.

The data cont­rol­ler also orga­ni­zes pro­fes­si­o­nal events, lec­tu­res, and vari­o­us prog­rams. The data cont­rol­ler is res­pon­sib­le for the prog­rams. soluzionikft@gmail.com can be reg­is­te­red in the form of a mes­sage sent to the e‑mail add­ress. During the reg­istra­ti­on, the data cont­rol­ler requests the cli­ent’s name, add­ress, e‑mail add­ress, and telep­ho­ne num­ber. The pur­po­se of data pro­ces­sing is to comp­le­te the reg­istra­ti­on for the event, to ensure the pos­si­bi­lity of kee­ping in touch with the data sub­ject, and to orga­ni­ze the prog­ram. The leg­al basis for the pro­ces­sing of per­so­nal data is the ful­fill­ment of the obli­ga­tions assum­ed in the cont­ract (Artic­le 6 (1) para­gra­ph b) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on). The data cont­rol­ler issues an invo­i­ce to the cli­ent for the amount of the pos­sib­le par­ti­ci­pa­ti­on fee. The invo­i­ce con­ta­ins the cli­ent’s name, add­ress, and, in the case of a leg­al entity, its tax num­ber. The leg­al basis for the pro­ces­sing of per­so­nal data is ful­fill­ment of a leg­al obli­ga­ti­on (Artic­le 6 (1) para­gra­ph c) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on). The data cont­rol­ler stores the per­so­nal data on the invo­i­ce for 8 years, in comp­li­ance with the retent­ion obli­ga­ti­on set out in Sec­ti­on 169 of the Account­ing Act.

The per­so­nal data of spea­kers, experts and pro­fes­si­o­nals par­ti­ci­pat­ing in the events may also be pro­ces­sed during the orga­ni­za­ti­on and promo­ti­on of the event. Sin­ce the data cont­rol­ler has a cont­rac­tu­al rela­ti­onship with the spea­ker, the leg­al basis for the pro­ces­sing of per­so­nal data is the ful­fill­ment of the obli­ga­ti­on assum­ed in the cont­ract (Artic­le 6 (1) (b) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on). The data cont­rol­ler pro­ces­ses per­so­nal data exc­lu­si­vely for the pur­po­se of orga­ni­zing the prog­ram and main­tain­ing con­tact with the spea­ker. The name and image of the spea­ker or pro­fes­si­o­nal may be disp­la­yed in adver­ti­se­ments and infor­ma­ti­on posts abo­ut the event on the data cont­rol­ler’s web­site. For this, the data cont­rol­ler requests the con­sent of the data sub­ject. The leg­al basis for the pro­ces­sing of data is the­re­fo­re the con­sent of the data sub­ject (Artic­le 6 (1) (a) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on).

In the cour­se of per­form­ing its tasks, the data cont­rol­ler pro­ces­ses the e‑mail add­res­ses and telep­ho­ne num­bers of its cli­ents, part­ners and cus­to­mers, in order to ful­fill its cont­rac­tu­al obli­ga­tions (Artic­le 6(1)(b) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on), or pur­su­ant to the­ir indi­vi­du­al con­sent (Artic­le 6(1)(a) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on).

In the cour­se of its work, the data cont­rol­ler may also have cont­rac­tu­al rela­ti­onsh­ips with sub­cont­rac­tors, supp­li­ers and other ser­vi­ce pro­vi­ders, which also pro­vi­de a basis for the pro­ces­sing of per­so­nal data. In this case, the leg­al basis for the pro­ces­sing of per­so­nal data (in the case of a natu­ral per­son or a sole prop­rie­tor) is the per­for­mance of the obli­ga­ti­on assum­ed in the cont­ract (Artic­le 6(1)(b) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on), or the exp­li­cit, pri­or infor­med con­sent of the data sub­ject in rela­ti­on to the per­so­nal data of the con­tact per­son of a leg­al per­son (Artic­le 6(1)(a) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on).

If natu­ral per­sons apply­ing to the data cont­rol­ler sub­mit a CV to the com­pany, per­so­nal data pro­ces­sing also takes place in rela­ti­on to the per­so­nal data inc­lu­ded in the CV. The leg­al basis for data pro­ces­sing is the con­sent of the data sub­ject (Artic­le 6(1)(a) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on).

The data cont­rol­ler pri­ma­rily pre­sents its acti­vi­ti­es, ser­vi­ces and pro­ducts on its own web­site (www.soluzioninaturali.eu). The web­site does not use coo­ki­es during its ope­ra­ti­on, so this type of per­so­nal data pro­ces­sing does not take place.

On the web­site, the visi­tor to the site has the oppor­tunity to con­tact the data cont­rol­ler using a con­tact form. The form must con­ta­in the name and e‑mail add­ress of the inter­es­ted par­ty. The pur­po­se of the pro­ces­sing of per­so­nal data is to con­tact the visi­tor to the site and the per­son inter­es­ted in the ser­vi­ces and pro­ducts of the data cont­rol­ler. If the ser­vi­ce is not used or a pro­duct is not orde­red wit­hin 6 months after the con­tact, the per­so­nal data of the inter­es­ted par­ty will be dele­ted wit­hin 3 wor­king days after the 6 months have elap­sed. The data cont­rol­ler pro­ces­ses per­so­nal data for the pur­po­se of conc­lu­ding a cont­ract, on this leg­al basis (Artic­le 6 (1) para­gra­ph b) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on). By comp­let­ing the form, the data sub­ject dec­la­res that he/she has read the Data Cont­rol­ler’s Data Pro­ces­sing Infor­ma­ti­on and has taken note of its cont­ents.

The data cont­rol­ler occas­io­nally takes pho­tos or vide­os of its cus­to­mers, part­ners, and event par­ti­ci­pants. If a recog­ni­zab­le indi­vi­du­al is seen in the record­ing, the record­ing will be made and used – on the data controller’s web­site or in con­nec­ti­on with other appe­aran­ces – only with the writ­ten, infor­med, pri­or, volun­tary con­sent of the data sub­ject. The leg­al basis for data pro­ces­sing is the data subject’s con­sent (Artic­le 6(1)(a) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on).

The con­sent of the data sub­ject is not requ­i­red for the record­ing and the use of the recor­ded record­ing in the case of mass record­ing and record­ing of pub­lic appe­aran­ces.

When hand­ling com­p­la­ints rela­ted to the data cont­rol­ler’s acti­vi­ti­es, the pur­po­se of data manag­ement is to enab­le the com­mu­ni­ca­ti­on of the com­p­la­int, iden­ti­fy the data sub­ject and his/her com­p­la­int, record data that must be recor­ded by law, and investiga­te the com­p­la­int and main­ta­in con­tact rela­ted to its reso­lu­ti­on.

In the event of a com­p­la­int, the pro­ces­sing of per­so­nal data is man­da­to­ry – pur­su­ant to Act CLV of 1997 on Con­su­mer Pro­tec­ti­on. Accord­ing to this, the leg­al basis for the pro­ces­sing of per­so­nal data is the ful­fill­ment of a leg­al obli­ga­ti­on (Artic­le 6 (1) © of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on).

The data cont­rol­ler keeps a data pro­ces­sing record of the abo­ve-ment­ion­ed data pro­ces­sing. The record also inc­lu­des the dead­li­nes for the dele­ti­on of per­so­nal data. The record is an annex to this Data Pro­ces­sing Noti­ce.

 

DATA PROCESSORS IN RELATION TO THE DATA CONTROLLER

If data pro­ces­sing is car­ried out on behalf of the data cont­rol­ler, the data cont­rol­ler may only use data pro­ces­sors that pro­vi­de ade­qua­te gua­ran­te­es for comp­li­ance with the requ­i­re­ments of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on or imp­le­ment app­rop­ria­te tech­ni­cal and orga­ni­za­ti­o­nal mea­sures to ensure the pro­tec­ti­on of the rights of data sub­jects.

The data cont­rol­ler hereby dec­la­res that in the cour­se of its work it only con­tacts data pro­ces­sors who have ade­qua­te gua­ran­te­es of comp­li­ance with the GDPR regu­la­ti­on and the imp­le­men­ta­ti­on of app­rop­ria­te tech­ni­cal and orga­ni­za­ti­o­nal mea­sures to ensure the pro­tec­ti­on of the rights of data sub­jects. The rele­vant sta­te­ments of the data pro­ces­sors are ava­i­lab­le.

By read­ing and ack­now­led­ging this Data Pro­tec­ti­on Noti­ce, the data sub­jects agree that the data cont­rol­ler will trans­fer the­ir per­so­nal data to the data pro­ces­sors and joint data cont­rol­lers lis­ted below.

Data pro­ces­sor is the account­ing firm emp­loyed by the data cont­rol­ler:

SEE YOU Limi­ted Lia­bi­lity Com­pany ( reg­is­te­red offi­ce: 6400 Kis­kun­ha­las, Beth­len G tér 6. I. floor 5., tax num­ber 24889166–2‑03 )

The data cont­rol­ler’s part­ner in rela­ti­on to the issu­ance of invo­i­ces:

KBOSS. hu Trad­ing and Ser­vi­ce Limi­ted Lia­bi­lity Com­pany – reg­is­te­red offi­ce: 1031 Buda­pest, Záhony utca 7., adó­szám. 13421739–2‑41.

Moza­ik Inte­gra­ted Manag­ement Sys­tem – reg­is­te­red offi­ce: 5500 Gyo­ma­end­rőd Rákó­czi F. utca 3., tax num­ber: 11055011–2‑04

The data pro­ces­sor (and also an inde­pen­dent data cont­rol­ler in the per­for­mance of its tasks) is the cou­ri­er com­pany emp­loyed by the data cont­rol­ler:

GLS HUNGARY KFT. reg­is­te­red offi­ce: 2351 Alsó­né­me­di, GLS Euro­pe Street 2., 06 29 886–700, info@gls-hungary.com

The com­pany host­ing the cont­rol­ler’s web­site is also cons­idered a data pro­ces­sor:

• Com­pany name: Web­sup­port Magyar­or­szág Kft.
• Head­qu­ar­ters: 1132 Buda­pest, Vic­tor Hugo utca 18–22.
• Tax num­ber: 25138205–2‑43
• Com­pany reg­istra­ti­on num­ber: 01–09-381419
• Com­mu­nity tax num­ber: HU25138205
• Bank account num­ber: 12011179–01395626-00100003 – Raif­fe­i­sen Bank Zrt.
• IBAN code: HU38 1201 1179 0139 5626 0010 0003
• Pho­ne: +36 1 700 4140
• E‑mail add­ress: info@tarhelypark.hu

A part­ner coope­rat­ing with the data cont­rol­ler who main­ta­ins the data cont­rol­ler’s web­site is also cons­idered a data pro­ces­sor:

• Com­pany name: Oszt­he­i­mer Balázs Gábor EV.
• Head­qu­ar­ters: 8800 Nagy­ka­ni­zsa, Ifjú­ság utca 23.
• Tax num­ber: 56423057–1‑40

 

The ser­ver of the data cont­rol­ler’s email sys­tem is also a data pro­ces­sor:

• Com­pany name: Goog­le LLC
• Head­qu­ar­ters: 1600 Amp­hit­he­at­re Park­way, Moun­tain View, CA 94043, USA
• Com­pany reg­istra­ti­on num­ber: Dela­ware állam­ban beje­gyez­ve, cég­jegy­zék­szám: 3582691
• Tax num­ber: US EIN: 77–0493581

The ope­ra­tor of the logis­tics sys­tem used by the data cont­rol­ler is cons­idered a data pro­ces­sor:

Moza­ik Inte­gra­ted Manag­ement Sys­tem reg­is­te­red offi­ce: 5500 Gyo­ma­end­rőd Rákó­czi F. utca 3. – reg­is­te­red offi­ce: 5500 Gyo­ma­end­rőd Rákó­czi F. utca 3., tax num­ber: 11055011–2‑04

When stor­ing data in a clo­ud-bas­ed online data­ba­se, the ser­vi­ce pro­vi­der is cons­idered a data pro­ces­sor:

Name: Meta Plat­forms Tech­no­lo­gi­es Ire­land Limi­ted

Add­ress: MERRION ROAD, DUBLIN 4, D04 X2K5, IRELAND

Ser­vi­ces rela­ted to the META Plat­form: Gmail, Goog­le meet, Goog­le workspace, Goog­le drive

 

The data cont­rol­ler also for­wards its cus­to­mers’ per­so­nal data to the Nati­o­nal Tax and Cus­toms Offi­ce.

The cont­rac­ted data pro­ces­sing and data manag­ement part­ners pro­cess the part­ners’ per­so­nal data exc­lu­si­vely on the basis of instruc­tions given by the data mana­ger (except for the app­li­ca­ti­on of leg­al requ­i­re­ments) and under an obli­ga­ti­on of con­fi­den­ti­a­lity.

 

DATA PROCESSING RELATED TO CONTRACTS CONCLUDED BY THE DATA CONTROLLER

Cus­to­mer cont­racts:

In the con­text of the data cont­rol­ler’s ser­vi­ces and acti­vi­ti­es, its cont­rac­tu­al part­ners in coope­ra­ti­on with resel­ler part­ners, cus­to­mers and regi­o­nal rep­re­s­en­ta­ti­ves can be both pri­vate indi­vi­du­als and leg­al enti­ti­es. The conc­lu­si­on of the cont­ract is pre­ce­ded by a request for a quo­te sent by SMS to the telep­ho­ne num­ber pro­vi­ded in this infor­ma­ti­on or in the form of a mes­sage to the data cont­rol­ler’s e‑mail add­ress spe­ci­fi­ed in this infor­ma­ti­on. The cli­ent pro­vi­des his name, telep­ho­ne num­ber and e‑mail add­ress, to which the data cont­rol­ler sends its rele­vant offer. If the offer is rejec­ted, the data sub­ject’s per­so­nal data will be dele­ted imme­dia­tely, but no later than wit­hin 3 wor­king days. The leg­al basis for the pro­ces­sing of per­so­nal data is the conc­lu­si­on of the cont­ract (Artic­le 6 (1) (b) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on). If the data sub­ject orders the offe­red ser­vi­ce, a cont­ract will be conc­lu­ded. Upon conc­lu­si­on of the cont­ract, the data cont­rol­ler will rece­ive addi­ti­o­nal per­so­nal data of the pri­vate indi­vi­du­als (part­ners and con­tacts). The leg­al basis for data pro­ces­sing is the ful­fill­ment of the obli­ga­ti­on assum­ed in the cont­ract (Artic­le 6(1)(b) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on), or the con­sent of the data sub­ject in the case of a con­tact per­son of a leg­al entity (Artic­le 6(1)(a) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on). The data cont­rol­ler issues an invo­i­ce for the cons­ide­ra­ti­on of the ser­vi­ce pro­vi­ded by it under the cont­ract. The invo­i­ce con­ta­ins the name, add­ress and, in the case of a leg­al entity, the tax num­ber. Issu­ing the invo­i­ce is the obli­ga­ti­on of the data cont­rol­ler set out in the law. The leg­al basis for the pro­ces­sing of per­so­nal data inc­lu­ded in the invo­i­ce is the ful­fill­ment of a leg­al obli­ga­ti­on (Artic­le 6(1)© of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on). The data cont­rol­ler stores the per­so­nal data inc­lu­ded in the invo­i­ce for 8 years, in comp­li­ance with the retent­ion obli­ga­ti­on set out in Sec­ti­on 169 of the Account­ing Act.

In con­nec­ti­on with the data cont­rol­ler’s com­mer­ci­al acti­vi­ti­es, during the sale of pro­ducts pro­du­ced or dis­t­ri­bu­ted by it, orders are pla­ced at the e‑mail add­ress pro­vi­ded in this infor­ma­ti­on. Cus­to­mers can be both pri­vate indi­vi­du­als and leg­al enti­ti­es. In the case of an order, the data cont­rol­ler requests the cus­to­mer’s name (in the case of a leg­al entity, the name and tax num­ber of the con­tact per­son), add­ress, e‑mail add­ress, and telep­ho­ne num­ber. The leg­al basis for the pro­ces­sing of per­so­nal data is the ful­fill­ment of the obli­ga­tions assum­ed in the cont­ract (Artic­le 6 (1) para­gra­ph b) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on). In the case of a leg­al entity, the per­so­nal data of the con­tact per­son is pro­ces­sed, which is bas­ed on the con­sent of the data sub­ject (Artic­le 6 (1) para­gra­ph a) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on). The pur­po­se of the pro­ces­sing of per­so­nal data is the ful­fill­ment of the obli­ga­tions assum­ed, main­tain­ing con­tact, and send­ing the orde­red pro­duct to the data sub­ject. The data cont­rol­ler issues an invo­i­ce to its cus­to­mers for the cons­ide­ra­ti­on for the pro­ducts sold by it. The invo­i­ce con­ta­ins the cus­to­mer’s name, add­ress, and pos­sibly tax num­ber. Leg­al basis for pro­ces­sing per­so­nal data, ful­fill­ment of a leg­al obli­ga­ti­on (Artic­le 6(1)© of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on). The data cont­rol­ler stores the per­so­nal data on the invo­i­ce for 8 years, in comp­li­ance with the retent­ion obli­ga­ti­on set out in Sec­ti­on 169 of the Account­ing Act.

Supp­li­er cont­racts:

The data cont­rol­ler may also manage the con­tact deta­ils of supp­li­ers (name, e‑mail add­ress, telep­ho­ne num­ber) and may also be in con­tact with ser­vi­ce pro­vi­ders and sub­cont­rac­tors. In order to main­ta­in con­tact with part­ners, per­so­nal data may also be pro­ces­sed in the­se cas­es (per­so­nal data of the con­tact per­son or the natu­ral per­son, sole prop­rie­tor). The leg­al basis for the pro­ces­sing of per­so­nal data is the ful­fill­ment of the obli­ga­ti­on assum­ed in the cont­ract (Artic­le 6 (1) (b) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on), or the con­sent of the con­tact per­son (Artic­le 6 (1) (a) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on).

The data cont­rol­ler comp­le­tes a con­sent dec­la­ra­ti­on with the com­pany’s con­tact per­sons, inform­ing them of the­ir rights rela­ted to per­so­nal data and request­ing the­ir con­sent to pro­cess the­ir data. In such cas­es, the leg­al basis for the pro­ces­sing of per­so­nal data is the data sub­ject’s exp­ress, writ­ten, and app­rop­ria­tely infor­med con­sent to the data pro­ces­sing (Artic­le 6(1)(a) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on). If the cont­ract conc­lu­ded with the part­ner has been ter­mi­na­ted and the stat­uto­ry retent­ion obli­ga­ti­on does not apply to the retent­ion of data and docu­ments, the telep­ho­ne num­bers and e‑mail add­res­ses will be dele­ted. The data cont­rol­ler stores the per­so­nal data inc­lu­ded in the cont­ract and on the invo­i­ce for 8 years, in comp­li­ance with the retent­ion obli­ga­ti­on set out in Sec­ti­on 169 of the Account­ing Act.

Hand­ling of invo­i­ces issu­ed to cus­to­mers and the per­so­nal data con­ta­ined the­re­in:

The data cont­rol­ler issues an invo­i­ce to its cus­to­mers and cli­ents for the cons­ide­ra­ti­on for the ser­vi­ces pro­vi­ded and pro­ducts sold under the cont­ract. The invo­i­ce con­ta­ins the name, add­ress and, in the case of a leg­al entity, the tax num­ber of the cus­to­mer. The invo­i­ce is issu­ed by the data cont­rol­ler in order to ful­fill a leg­al obli­ga­ti­on. The leg­al basis for the pro­ces­sing of per­so­nal data inc­lu­ded in the invo­i­ce is ful­fill­ment of a leg­al obli­ga­ti­on (Artic­le 6(1)© of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on). The data cont­rol­ler stores the per­so­nal data recor­ded in this way for 8 years, in comp­li­ance with the retent­ion obli­ga­ti­on set out in Sec­ti­on 169 of the Account­ing Act.

Child­ren’s data, pro­ces­sing of spe­ci­al categ­ori­es of per­so­nal data:

The data cont­rol­ler intends to sell its ser­vi­ces and pro­ducts exc­lu­si­vely to per­sons over the age of 18.

The data sub­ject dec­la­res that he/she is over 16 years of age when sub­mitt­ing his/her CV on the data cont­rol­ler’s web­site. A per­son under the age of 16 may not apply in this way, given that the val­idity of the leg­al dec­la­ra­ti­on con­tain­ing his/her con­sent to data pro­ces­sing under Artic­le 8(1) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on (GDPR) requ­i­res the per­mis­si­on of his/her leg­al rep­re­s­en­ta­tive. The data cont­rol­ler is not able to veri­fy the age and entit­le­ment of the per­son giving his/her con­sent, so the data sub­ject gua­ran­te­es that the data pro­vi­ded is true.

The data cont­rol­ler does not record any sen­sit­ive data bro­ught to the attent­ion of the data cont­rol­ler or made ava­i­lab­le to it. If such data has ente­red any of its sys­tems wit­ho­ut the data cont­rol­ler’s know­ledge, it will be dele­ted from the sys­tem imme­dia­tely upon detec­ti­on.

Retent­ion of names, email add­res­ses, and pho­ne num­bers by the data cont­rol­ler:

In the cour­se of its acti­vi­ti­es, the data cont­rol­ler also learns the e‑mail add­res­ses and telep­ho­ne num­bers of its part­ners, cus­to­mers and cli­ents. The per­so­nal data ente­red into its sys­tem in this way is pro­ces­sed pri­ma­rily in order to ful­fill its cont­rac­tu­al obli­ga­tions (Artic­le 6 (1) para­gra­ph b) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on). If the cont­ract conc­lu­ded with the part­ner has been ter­mi­na­ted and the stat­uto­ry retent­ion obli­ga­ti­on does not apply to the retent­ion of data and docu­ments, the telep­ho­ne num­bers and e‑mail add­res­ses will be dele­ted. In some cas­es, the data cont­rol­ler still has a legi­ti­ma­te inte­rest in retain­ing the data, in which case it requests the data sub­ject’s exp­ress and writ­ten con­sent to the retent­ion of his or her per­so­nal data (Artic­le 6 (1) para­gra­ph a) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on).

Pro­ces­sing of app­li­ca­tions and CVs rece­i­ved by the data cont­rol­ler:

Natu­ral per­sons apply­ing for the posit­i­on of data cont­rol­ler may sub­mit a CV to the com­pany. If the CV is sub­mit­ted beca­u­se the data cont­rol­ler is loo­king for an emp­loyee and has adver­ti­sed the posit­i­on, the CV may only be used in con­nec­ti­on with that posit­i­on.

If the app­li­cant did not meet the con­di­tions for the adver­ti­sed posit­i­on and anot­her can­di­da­te was selec­ted, the CV will be dest­royed imme­dia­tely. The data cont­rol­ler may only reta­in the app­li­ca­ti­on bas­ed on the exp­li­cit, unam­bi­gu­o­us and volun­tary con­sent of the data sub­ject (Artic­le 6(1)(a) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on), pro­vi­ded that its retent­ion is neces­sary to achi­eve the pur­po­se of the data pro­ces­sing.

Az adat­ke­ze­lő „ano­nim” állás­hir­de­té­se­ket (azok az állás­hir­de­té­sek, ame­lyek­ben a mun­kál­ta­tó nem tűn­te­ti fel a nevét, ezért az állás­pá­lyá­zat elkül­dé­sé­nek idő­pont­já­ban a jelent­ke­zők nem lehet­nek tisz­tá­ban azzal, hogy mely mun­kál­ta­tó­nak az állá­sá­ra jelent­kez­nek) nem ad fel, ugyan­is ez ellen­té­tes az adat­ke­ze­lő kilé­té­re vonat­ko­zó elő­ze­tes tájé­koz­ta­tás köve­tel­mé­nyé­vel. Az adat­ke­ze­lő, amennyi­ben állás­hir­de­tést ad fel, min­den eset­ben tájé­koz­tat­ja az érin­tet­te­ket kilé­té­ről.

If the app­li­cant has volun­ta­rily sent a CV to the data cont­rol­ler wit­ho­ut advert­ising, he/she dec­la­res whet­her he/she con­sents to the pro­ces­sing of per­so­nal data by the data cont­rol­ler. Sub­mitt­ing a CV does not mean that the data sub­ject also con­sents to the data cont­rol­ler retain­ing his/her app­li­ca­ti­on mate­ri­als. It is also impor­tant that the data cont­rol­ler may use the CV only in rela­ti­on to the vac­an­ci­es indi­ca­ted by the job app­li­cant. CVs are stor­ed for a stan­dard peri­od of 3 months, unless the data sub­ject pro­vi­des a lon­ger peri­od in his/her con­sent.

When asses­sing a job app­li­ca­ti­on, the data cont­rol­ler will only check and obta­in infor­ma­ti­on from the app­li­cant’s pro­fi­le page on the soci­al net­work if the data sub­ject has been infor­med of this in advance. Even in such cas­es, it will only view pub­lic data and will only use infor­ma­ti­on that is rele­vant to the job app­li­ca­ti­on or the posit­i­on for which it is being selec­ted. Under no cir­cum­stan­ces will the data cont­rol­ler save, store or for­ward the app­li­cant’s pro­fi­le page to a third par­ty.

If the data sub­ject is not selec­ted for the given posit­i­on, the data cont­rol­ler will inform him/her of this and the rea­son for the rejec­ti­on.

Tak­ing pho­tos and vide­os at the data cont­rol­ler:

The data cont­rol­ler occas­io­nally takes pho­tos or vide­os of its cus­to­mers, part­ners, and event par­ti­ci­pants. If a recog­ni­zab­le indi­vi­du­al is seen in the record­ing, the record­ing will be made and used – on the data controller’s web­site or in con­nec­ti­on with other appe­aran­ces – only with the writ­ten, infor­med, pri­or, volun­tary con­sent of the data sub­ject. The leg­al basis for data pro­ces­sing is the data subject’s con­sent (Artic­le 6(1)(a) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on).

The con­sent of the data sub­ject is not requ­i­red for the record­ing and the use of the recor­ded record­ing in the case of mass record­ing and record­ing of pub­lic appe­aran­ces.

If the data sub­ject withd­raws con­sent and requests the ter­mi­na­ti­on of the use of the record­ing, or the dele­ti­on of the record­ing, the data cont­rol­ler will comply with this request imme­dia­tely.

DATA CONTROLLER’S WEBSITE

 

On the data cont­rol­ler’s own web­site ( www.soluzioninaturali.eu ) pre­sents its acti­vi­ti­es, ser­vi­ces and the pro­ducts it manu­fac­tu­res and dis­t­ri­bu­tes to inter­es­ted par­ti­es.

The data cont­rol­ler’s web­site does not use coo­ki­es during its ope­ra­ti­on, so this type of per­so­nal data pro­ces­sing does not take place.

Per­so­nal data pro­ces­sing when using the con­tact form:

On the web­site, the visi­tor to the site has the oppor­tunity to con­tact the data cont­rol­ler using a con­tact form. The form must con­ta­in the name and e‑mail add­ress of the inter­es­ted par­ty. The pur­po­se of the pro­ces­sing of per­so­nal data is to con­tact the visi­tor to the site and the per­son inter­es­ted in the ser­vi­ces and pro­ducts of the data cont­rol­ler. If the ser­vi­ce spe­ci­fi­ed in the cont­ract is not used or the pro­duct is not orde­red wit­hin 6 months after the con­tact, the per­so­nal data of the inter­es­ted par­ty will be dele­ted wit­hin 3 wor­king days after the 6 months have elap­sed. The data cont­rol­ler pro­ces­ses per­so­nal data for the pur­po­se of conc­lu­ding the cont­ract, on this leg­al basis (Artic­le 6 (1) para­gra­ph b) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on). By comp­let­ing the form, the data sub­ject dec­la­res that he/she has read the data cont­rol­ler’s Data Pro­ces­sing Infor­ma­ti­on and has taken note of its cont­ents.

Per­so­nal data pro­ces­sing when using clo­ud-bas­ed app­li­ca­tions:

The data cont­rol­ler pri­ma­rily uses clo­ud-bas­ed ser­vi­ces for stor­ing, bac­king up and sha­ring docu­ments. The com­mon fea­tu­re of such ser­vi­ces is that they are not pro­vi­ded by the user’s com­pu­ter, but by a remo­te ser­ver, a ser­ver cen­ter that can be loca­ted anyw­he­re in the world. Online stor­age also pro­vi­des such a ser­vi­ce. The gre­at advan­tage of clo­ud app­li­ca­tions is that they pro­vi­de highly secu­re, fle­xibly expan­dab­le IT stor­age and pro­ces­sing capa­ci­ty that is essen­ti­ally inde­pen­dent of geo­gra­phi­cal loca­ti­on.

In the­se cas­es, the clo­ud ser­vi­ce pro­vi­der can be cons­idered a data pro­ces­sor who pro­ces­ses per­so­nal data on behalf of the data cont­rol­ler. Clo­ud ser­vi­ce pro­vi­ders are obli­ged to tre­at per­so­nal data con­fi­den­ti­ally and may only pro­cess data on the instruc­tions of the data cont­rol­ler.

The data cont­rol­ler selects its clo­ud ser­vi­ce pro­vi­ders with the grea­test pos­sib­le care, takes all gene­rally expec­ted mea­sures to conc­lu­de cont­racts with them that also take into account the data secu­rity inte­rests of its cli­ents and cus­to­mers, makes the­ir data manag­ement prin­cip­les tran­spa­rent to them, and regu­larly checks data secu­rity.

Clo­ud-bas­ed stor­age spa­ces are pass­word-pro­tec­ted, and only the data mana­ger can access the data stor­ed the­re.

The data cont­rol­ler’s part­ners exp­ressly con­sent to the data trans­fer neces­sary for the use of clo­ud-bas­ed app­li­ca­tions by accept­ing this Data Pro­tec­ti­on Noti­ce. The leg­al basis for data pro­ces­sing is the con­sent of the data sub­ject (Artic­le 6(1)(a) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on).

Hand­ling com­p­la­ints rela­ted to the acti­vi­ti­es of the data cont­rol­ler:

When hand­ling com­p­la­ints rela­ted to the data cont­rol­ler’s acti­vi­ti­es, the pur­po­se of data manag­ement is to enab­le the com­mu­ni­ca­ti­on of the com­p­la­int, iden­ti­fy the data sub­ject and his/her com­p­la­int, record data that must be recor­ded by law, and investiga­te the com­p­la­int and main­ta­in con­tact rela­ted to its reso­lu­ti­on.

In the event of a com­p­la­int, the pro­ces­sing of per­so­nal data is man­da­to­ry – pur­su­ant to Act CLV of 1997 on Con­su­mer Pro­tec­ti­on. Accord­ing to this, the leg­al basis for the pro­ces­sing of per­so­nal data is the ful­fill­ment of a leg­al obli­ga­ti­on (Artic­le 6 (1) © of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on).

The data cont­rol­ler will reta­in the minutes of the com­p­la­int and a copy of the res­pon­se for 5 years, and will pro­cess per­so­nal data bas­ed on this during this peri­od.

Secu­rity of data pro­ces­sing:

The data cont­rol­ler under­ta­kes to ensure the secu­rity of the data, to take tech­ni­cal and orga­ni­sa­ti­o­nal mea­sures and to main­ta­in pro­ce­dural rules that ensure that the data recor­ded, stor­ed and pro­ces­sed are pro­tec­ted and to pre­vent the­ir destruc­ti­on, una­ut­ho­ri­sed use and una­ut­ho­ri­sed modi­fi­ca­ti­on. It also under­ta­kes to call on all third par­ti­es to whom the data is trans­mit­ted or trans­fer­red to comply with the data secu­rity requ­i­re­ments.

The data cont­rol­ler ensures that una­ut­ho­ri­zed per­sons can­not access, disc­lose, trans­mit, modi­fy or dele­te the data pro­ces­sed. The data pro­ces­sed may only be acces­sed by the data cont­rol­ler and the data processor(s) used by it, and it shall not be pas­sed on to third par­ti­es who are not aut­ho­ri­zed to access the data.

The data cont­rol­ler pays spe­ci­al attent­ion to the secu­rity of the per­so­nal data of its cus­to­mers and cus­to­mers. It acts in full comp­li­ance with leg­al provi­sions and requ­i­res this from all its part­ners. The pro­tec­ti­on of per­so­nal data inc­lu­des phy­si­cal data pro­tec­ti­on (stor­ing docu­ments in a loc­ka­ble room and cabi­net) as well as IT pro­tec­ti­on (using anti­vi­rus, fire­wall, pass­word pro­tec­ti­on).

The data cont­rol­ler stores the per­so­nal data pro­vi­ded by the data sub­ject pri­ma­rily on the ser­vers of the data processor(s) spe­ci­fi­ed in this Data Manag­ement Noti­ce equ­ip­ped with stan­dard pro­tec­ti­on sys­tems, partly on its own IT equ­ip­ment, and in the case of paper data car­ri­ers, at its reg­is­te­red offi­ce, in a properly loc­ked man­ner.

The data sub­jects ack­now­ledge and accept that when pro­vi­ding the­ir per­so­nal data, the pro­tec­ti­on of the data can­not be fully gua­ran­te­ed on the inter­net and in com­pu­ter sys­tems. In the event of una­ut­ho­ri­zed access or disc­los­ure of data, des­pi­te the eff­orts of the data cont­rol­ler, it is neces­sary to pro­ce­ed as descri­bed in this noti­ce.

Rights of tho­se affec­ted by data pro­ces­sing:

Tran­spa­rent infor­ma­ti­on:

This Data Manag­ement Noti­ce also ser­ves the pur­po­se of pro­vi­ding clear, con­ci­se, tran­spa­rent and under­stan­d­ab­le infor­ma­ti­on abo­ut the data manag­ement acti­vi­ti­es app­li­ed by the data cont­rol­ler.

Access rights:

The data sub­ject has the right to rece­ive feed­back from the data cont­rol­ler as to whet­her his or her per­so­nal data is being pro­ces­sed and, if such pro­ces­sing is tak­ing place, he or she has the right to access the per­so­nal data and the fol­lo­wing infor­ma­ti­on:

the pur­po­se of data pro­ces­sing,

the categ­ori­es of per­so­nal data con­cer­ned,

the reci­pi­ents to whom the per­so­nal data were disc­los­ed,

the plan­ned peri­od of stor­age of per­so­nal data.

You can request infor­ma­ti­on abo­ut the abo­ve data from the data cont­rol­ler at the fol­lo­wing add­ress or e‑mail add­ress:

Solu­zi­o­ni Natu­ra­li Kft. – Hun­gary 1025 Buda­pest, Csej­tei street 12/B

E‑mail: soluzionikft@gmail.com

The data cont­rol­ler hereby informs you that it will res­pond to your request wit­hin 30 days. Requests for infor­ma­ti­on sent by post will be res­pon­ded to by post, and requests sent by email will be res­pon­ded to by email.

Right to rec­ti­fi­ca­ti­on:

The data sub­ject has the right to have the data cont­rol­ler cor­rect inacc­ura­te per­so­nal data con­cer­ning him or her, at his or her request.

You can request infor­ma­ti­on abo­ut the abo­ve data from the data cont­rol­ler at the fol­lo­wing add­ress or e‑mail add­ress:

Solu­zi­o­ni Natu­ra­li Kft. – Hun­gary 1025 Buda­pest, Csej­tei street 12/B

E‑mail: soluzionikft@gmail.com

The data cont­rol­ler hereby informs you that it will res­pond to your request wit­hin 30 days. Requests for infor­ma­ti­on sent by post will be res­pon­ded to by post, and requests sent by email will be res­pon­ded to by email.

Right to rec­ti­fi­ca­ti­on:

The data sub­ject has the right to obta­in from the cont­rol­ler the era­sure of per­so­nal data con­cer­ning him or her. The cont­rol­ler is obli­ged to era­se the per­so­nal data upon request if one of the fol­lo­wing grounds app­li­es:

the per­so­nal data are no lon­ger neces­sary for the pur­po­se for which they were coll­ec­ted,

the data sub­ject withd­raws the­ir pre­vi­o­usly given con­sent and the­re is no other leg­al basis for the data pro­ces­sing,

the data sub­ject objects to the data pro­ces­sing and the­re are no over­ri­ding legi­ti­ma­te grounds for the data pro­ces­sing,

the per­so­nal data has been pro­ces­sed unlaw­fully,

the data must be eras­ed to comply with a leg­al obli­ga­ti­on under EU or Mem­ber Sta­te law.

You can request infor­ma­ti­on abo­ut the abo­ve data from the data cont­rol­ler at the fol­lo­wing add­ress or e‑mail add­ress:

Solu­zi­o­ni Natu­ra­li Kft. – Hun­gary 1025 Buda­pest, Csej­tei street 12/B

E‑mail: soluzionikft@gmail.com

The data cont­rol­ler hereby informs you that it will res­pond to your request wit­hin 30 days. Requests for infor­ma­ti­on sent by post will be res­pon­ded to by post, and requests sent by email will be res­pon­ded to by email.

Right to rest­rict data pro­ces­sing:

The data sub­ject has the right to request that the data cont­rol­ler rest­rict data pro­ces­sing, pri­ma­rily if:

dis­pu­tes the acc­uracy of the data,

cons­iders the data pro­ces­sing unlaw­ful, but for some rea­son does not request the dele­ti­on of the data.

You can request infor­ma­ti­on abo­ut the abo­ve data from the data cont­rol­ler at the fol­lo­wing add­ress or e‑mail add­ress:

Solu­zi­o­ni Natu­ra­li Kft. – Hun­gary 1025 Buda­pest, Csej­tei street 12/B

E‑mail: soluzionikft@gmail.com

The data cont­rol­ler hereby informs you that it will res­pond to your request wit­hin 30 days. Requests for infor­ma­ti­on sent by post will be res­pon­ded to by post, and requests sent by email will be res­pon­ded to by email.

Right to data por­ta­bi­lity:

The data sub­ject has the right to rece­ive the per­so­nal data con­cer­ning him or her in a struc­tu­red, com­monly used and machi­ne-readab­le for­mat and has the right to trans­mit the­se data to anot­her cont­rol­ler.

You can request infor­ma­ti­on abo­ut the abo­ve data from the data cont­rol­ler at the fol­lo­wing add­ress or e‑mail add­ress:

Solu­zi­o­ni Natu­ra­li Kft. – Hun­gary 1025 Buda­pest, Csej­tei street 12/B

E‑mail: soluzionikft@gmail.com

In the event of a data bre­ach, the data secu­rity bre­ach must be of a seri­o­us natu­re, meaning that the bre­ach must be of a deg­ree that the per­so­nal data:

with its destruc­ti­on,

with the loss,

by chang­ing it,

una­ut­ho­ri­zed disc­los­ure or

asso­ci­a­ted with una­ut­ho­ri­zed access.

An inci­dent is cons­idered to be one of the abo­ve, but this does not exc­lu­de the pos­si­bi­lity of seve­ral points occur­r­ing simul­ta­ne­o­usly. This does not only inc­lu­de int­ent­io­nal, mali­ci­o­us beha­vi­or, but also inju­ri­es cau­s­ed by neg­li­gen­ce. An inci­dent the­re­fo­re occurs when it is cau­s­ed by an acci­dent or an unlaw­ful act.

Examp­les of data bre­a­ches inc­lu­de:

ille­gal trans­mis­si­on of per­so­nal data on a docu­ment, por­tab­le devi­ce, data car­ri­er or IT sys­tem (e.g. by mail),

una­ut­ho­ri­zed access to an IT sys­tem or app­li­ca­ti­on that pro­ces­ses per­so­nal data,

damage to or loss of part or all of a data­ba­se con­tain­ing per­so­nal data,

the unu­sa­bi­lity of part or all of the IT sys­tem due to a virus or other mali­ci­o­us soft­ware, etc.

In the absen­ce of app­rop­ria­te and timely acti­on, a data bre­ach may cau­se phy­si­cal, mate­ri­al or non-mate­ri­al damage to natu­ral per­sons, inc­lu­ding loss of cont­rol over the­ir per­so­nal data or rest­ric­ti­on of the­ir rights, discri­mi­na­ti­on, iden­tity theft or misu­se, finan­cial loss, una­ut­ho­ri­zed de-iden­ti­fi­ca­ti­on, damage to rep­uta­ti­on, bre­ach of the con­fi­den­ti­a­lity of per­so­nal data pro­tec­ted by pro­fes­si­o­nal sec­recy, or other sig­ni­fi­cant eco­no­mic or soci­al disad­van­tage to the natu­ral per­sons con­cer­ned.

In the event of a pos­sib­le data bre­ach (unless the data bre­ach is unli­kely to result in a risk to the rights and fre­e­doms of natu­ral per­sons), the cont­rol­ler shall imme­dia­tely noti­fy the Nati­o­nal Data Pro­tec­ti­on and Fre­e­dom of Infor­ma­ti­on Aut­ho­rity. As soon as the cont­rol­ler beco­mes aware of the bre­ach, it shall noti­fy the bre­ach wit­ho­ut undue delay and, whe­re fea­sib­le, no later than 72 hours after it has beco­me aware of the bre­ach. If the noti­fi­ca­ti­on can­not be made wit­hin 72 hours, the rea­son for the delay shall be sta­ted in the noti­fi­ca­ti­on and the requ­i­red infor­ma­ti­on shall be pro­vi­ded in deta­il wit­ho­ut furt­her undue delay.

To report a data pro­tec­ti­on inci­dent, the Nati­o­nal Data Pro­tec­ti­on and Fre­e­dom of Infor­ma­ti­on Aut­ho­rity ope­ra­tes a sys­tem crea­ted spe­ci­fi­cally for this pur­po­se on its web­site, thro­ugh which reports can be made electro­ni­cally.

The cont­rol­ler shall keep records of data pro­tec­ti­on inci­dents, indi­cating the facts relat­ing to the data pro­tec­ti­on inci­dent, its effects and the mea­sures taken to remedy it. The cont­rol­ler shall keep records of the data relat­ing to the inci­dents, inc­lu­ding the­ir caus­es, the events and the scope of the per­so­nal data con­cer­ned. The records shall also inc­lu­de the effects and con­se­qu­en­ces of the inci­dents, the mea­sures taken to remedy them and the cont­rol­ler’s conc­lu­sions (for examp­le: why it beli­eves that the inci­dent is not repor­tab­le or, if the noti­fi­ca­ti­on is dela­yed, what was the rea­son for the delay).

It is not neces­sary to noti­fy the super­vi­sory aut­ho­rity of an inci­dent that is unli­kely to result in a risk to the rights and fre­e­doms of natu­ral per­sons.

If the data bre­ach is likely to result in a high risk to the rights and fre­e­doms of the cont­rol­ler’s part­ners, cus­to­mers and cli­ents, we will imme­dia­tely inform the affec­ted part­ner. The infor­ma­ti­on pro­vi­ded to the data sub­ject must cle­arly and intel­li­gibly descri­be the natu­re of the data bre­ach and pro­vi­de the most impor­tant infor­ma­ti­on and mea­sures.

The data sub­ject does not need to be infor­med as abo­ve if any of the fol­lo­wing con­di­tions are met:

the cont­rol­ler has imp­le­men­ted app­rop­ria­te tech­ni­cal and orga­ni­sa­ti­o­nal pro­tec­ti­on mea­sures and the­se mea­sures have been app­li­ed to the data affec­ted by the data bre­ach, in par­ti­cu­lar mea­sures that make the data unin­tel­li­gib­le to per­sons not aut­ho­ri­sed to access the per­so­nal data;

the data cont­rol­ler has taken furt­her mea­sures fol­lo­wing the data pro­tec­ti­on inci­dent to ensure that the high risk to the rights and fre­e­doms of the data sub­ject is no lon­ger likely to mate­ri­a­li­se;

In such cas­es, the infor­ma­ti­on would requ­i­re a dis­pro­por­ti­on­ate eff­ort. In such cas­es, the data sub­jects sho­uld be infor­med by means of pub­licly pub­lis­hed infor­ma­ti­on or simil­ar mea­sures sho­uld be taken to ensure that the data sub­jects are infor­med in a simil­arly effec­tive man­ner.

Infor­ma­ti­on abo­ut the rele­vant leg­i­sla­ti­on:

Regu­la­ti­on (EU) 2016/679 of the Euro­pe­an Par­lia­ment and of the Coun­cil of 27 April 2016 – on the pro­tec­ti­on of natu­ral per­sons with regard to the pro­ces­sing of per­so­nal data and on the free move­ment of such data, and repe­a­ling Direc­tive 95/46/EC (Gene­ral Data Pro­tec­ti­on Regu­la­ti­on, GDPR);

2011. Act CXII of 2011 – on the right to infor­ma­ti­o­nal self-deter­mi­na­ti­on and fre­e­dom of infor­ma­ti­on (Info. Act);
2012. Act V of 2011 – on the Civil Code (Civil Code);
2013. Act C of 2011 – on account­ing (Account­ing Act).

Right to go to court:

In the event of a vio­la­ti­on of the­ir rights, the data sub­ject may take leg­al acti­on aga­inst the data cont­rol­ler. The court will pro­ce­ed with the case wit­ho­ut delay.

Data pro­tec­ti­on aut­ho­rity pro­ce­du­re:

You can file a com­p­la­int with the Nati­o­nal Data Pro­tec­ti­on and Fre­e­dom of Infor­ma­ti­on Aut­ho­rity:

Name: Nati­o­nal Data Pro­tec­ti­on and Fre­e­dom of Infor­ma­ti­on Aut­ho­rity

Head­qu­ar­ters: 1055 Buda­pest, Falk Mik­sa u. 9–11.

Mai­ling add­ress: 1363 Buda­pest, P.O. Box 9.

Pho­ne: 0613911400

Fax: 0613911410

E‑mail: ugyfelszolgalat@naih.hu

Web­site:                      http://www.naih.hu

 

RIGHT TO OBJECT (PURSUANT TO ARTICLE 21 OF THE GENERAL DATA PROTECTION REGULATION)

Az Érin­tett til­ta­koz­hat sze­mé­lyes ada­ta­i­nak az álta­lá­nos adat­vé­del­mi ren­de­let 6. cikk (1) bekez­dés e), vala­mint f) aga­inst pro­ces­sing neces­sary for the pur­pos­es of the legi­ti­ma­te inte­rests pur­su­ed by the Cont­rol­ler or by a third par­ty, inc­lu­ding pro­fil­ing bas­ed on the afor­ement­ion­ed provi­sions. In such a case, the Cont­rol­ler shall no lon­ger pro­cess the per­so­nal data unless the Cont­rol­ler demonst­ra­tes compel­l­ing legi­ti­ma­te grounds for the pro­ces­sing which overr­ide the inte­rests, rights and fre­e­doms of the Data Sub­ject or for the est­ab­lish­ment, exerci­se or defen­ce of leg­al cla­ims.

 

LEGAL REMEDIES RELATED TO DATA PROCESSING

Ini­ti­a­ti­on of leg­al pro­ce­e­dings

The Data Sub­ject may take leg­al acti­on aga­inst the Data Cont­rol­ler or, in con­nec­ti­on with data pro­ces­sing ope­ra­tions fal­ling wit­hin the scope of the data pro­ces­sor’s acti­vi­ti­es, aga­inst the data pro­ces­sor if, in his or her opin­ion, the Data Cont­rol­ler or the data pro­ces­sor acting on his or her behalf or on his or her instruc­tions pro­ces­ses his or her per­so­nal data in vio­la­ti­on of the provi­sions on the pro­ces­sing of per­so­nal data set out in law or in a bind­ing leg­al act of the Euro­pe­an Union.

The tri­al is wit­hin the juris­dic­ti­on of the court. The tri­al may also be ini­tia­ted – at the cho­i­ce of the Data Sub­ject – befo­re the court com­pe­tent for the Data Sub­ject’s place of res­iden­ce or res­iden­ce.

The Data Cont­rol­ler shall com­pen­sa­te for the damage cau­s­ed by the unlaw­ful pro­ces­sing of the Data Sub­ject’s data or the vio­la­ti­on of data secu­rity requ­i­re­ments, but shall be exempt from lia­bi­lity if the damage was cau­s­ed by an una­vo­i­da­b­le cau­se out­si­de the scope of data pro­ces­sing. The Data Cont­rol­ler shall not com­pen­sa­te for the damage to the extent that it resul­ted from the int­ent­io­nal or grossly neg­li­gent con­duct of the inju­red par­ty. In the event of a vio­la­ti­on of the Data Sub­ject’s per­so­nal rights, the Data Sub­ject may cla­im dama­ges.

Ini­ti­a­ti­on of offi­ci­al pro­ce­e­dings

The Data Sub­ject at the Nati­o­nal Data Pro­tec­ti­on and Fre­e­dom of Infor­ma­ti­on Aut­ho­rity (1055 Buda­pest, Falk Mik­sa utca 9–11, web­site:  http://naih.hu; pos­tal add­ress: 1396 Buda­pest, P.O. Box: 9.; telep­ho­ne: +36–1‑391‑1400; fax: +36–1‑391‑1410; e‑mail: ugyfelszolgalat@naih.hu) may ini­tia­te an investiga­ti­on or an offi­ci­al pro­ce­du­re in order to enfor­ce his/her rights, citing that a vio­la­ti­on of the law has occur­red in con­nec­ti­on with the pro­ces­sing of his/her per­so­nal data or that the­re is an imme­dia­te risk of such a vio­la­ti­on, in par­ti­cu­lar,

• if, in his/her opin­ion, the Data Cont­rol­ler rest­ricts the enfor­ce­ment of the Data Sub­ject’s rights spe­ci­fi­ed in Sec­ti­on 8.1 or rejects the request to enfor­ce the­se rights (ini­ti­a­ti­on of an investiga­ti­on), and
• if, in your opin­ion, the Data Cont­rol­ler, or the data pro­ces­sor acting on his/her behalf or on his/her instruc­tions, vio­la­tes the provi­sions on the pro­ces­sing of per­so­nal data set out in law or in a bind­ing leg­al act of the Euro­pe­an Union (request for an offi­ci­al pro­ce­du­re).

Other provi­sions:

The data cont­rol­ler will pro­vi­de infor­ma­ti­on abo­ut data pro­ces­sing not lis­ted in this infor­ma­ti­on when coll­ec­ting the data. In such cas­es, the provi­sions of the app­lic­ab­le laws shall apply.

The data cont­rol­ler hereby informs its cli­ents that courts, pro­se­cu­tors’ offi­ces, investiga­tive aut­ho­ri­ti­es, mis­de­meanor aut­ho­ri­ti­es, admi­nistra­tive aut­ho­ri­ti­es, the Nati­o­nal Data Pro­tec­ti­on and Fre­e­dom of Infor­ma­ti­on Aut­ho­rity, the Hun­ga­ri­an Nati­o­nal Bank, or other bodi­es aut­ho­ri­zed by law may con­tact the data cont­rol­ler to pro­vi­de infor­ma­ti­on, com­mu­ni­ca­te or trans­fer data, or make docu­ments ava­i­lab­le. The data cont­rol­ler will only pro­vi­de the aut­ho­ri­ti­es with per­so­nal data to the extent and inso­far as the aut­ho­rity has spe­ci­fi­ed the pre­ci­se pur­po­se and scope of the data, which is abso­lu­tely neces­sary to achi­eve the pur­po­se of the request.

The Data Cont­rol­ler pro­ces­ses per­so­nal data in accor­dance with the app­lic­ab­le laws for the data pro­ces­sing peri­od spe­ci­fi­ed in this data pro­ces­sing infor­ma­ti­on.

The Data Sub­ject has the right to request that the Data Cont­rol­ler era­se per­so­nal data con­cer­ning him or her wit­ho­ut undue delay, and the Data Cont­rol­ler is obli­ged to era­se per­so­nal data con­cer­ning the Data Sub­ject wit­ho­ut undue delay if one of the fol­lo­wing rea­sons app­li­es:

• the per­so­nal data are no lon­ger neces­sary for the pur­pos­es for which they were coll­ec­ted or other­wi­se pro­ces­sed;
• the per­so­nal data has been pro­ces­sed unlaw­fully;
• the per­so­nal data must be eras­ed for comp­li­ance with a leg­al obli­ga­ti­on impo­s­ed by a bind­ing Euro­pe­an Union leg­al act or regu­la­ti­on app­lic­ab­le to the Cont­rol­ler;

Data can­not be dele­ted if data pro­ces­sing is neces­sary:

• for the pur­po­se of exerc­i­sing the right to fre­e­dom of exp­r­es­si­on and infor­ma­ti­on;
• for the pur­po­se of ful­fil­ling an obli­ga­ti­on under a bind­ing leg­al act of the Euro­pe­an Union or a law app­lic­ab­le to the Cont­rol­ler requ­i­ring the pro­ces­sing of per­so­nal data, or for the per­for­mance of a task car­ried out in the pub­lic inte­rest or in the exerci­se of offi­ci­al aut­ho­rity ves­ted in the Cont­rol­ler;
• on grounds of pub­lic inte­rest in the field of pub­lic health in accor­dance with Artic­le 9(2)(h) and (i) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on and Artic­le 9(3) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on;
• for archi­ving pur­pos­es in the pub­lic inte­rest, sci­en­ti­fic and his­to­ri­cal rese­arch pur­pos­es or sta­tis­ti­cal pur­pos­es in accor­dance with Artic­le 89(1) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on, whe­re the right to era­sure would likely rend­er impos­sib­le or seri­o­usly jeo­p­ar­di­se such pro­ces­sing; or
• to assert, enfor­ce or defend leg­al cla­ims.

The Data Sub­ject may request in writing that the Data Cont­rol­ler rest­rict the pro­ces­sing of his/her per­so­nal data if one of the fol­lo­wing app­li­es:

• the Data Sub­ject dis­pu­tes the acc­uracy of the per­so­nal data, in which case the rest­ric­ti­on shall apply for a peri­od of time that allows the Data Cont­rol­ler to veri­fy the acc­uracy of the per­so­nal data;
• the pro­ces­sing is unlaw­ful and the Data Sub­ject oppos­es the era­sure of the data and ins­tead requests the rest­ric­ti­on of the­ir use;
• the Cont­rol­ler no lon­ger needs the per­so­nal data for the pur­pos­es of data pro­ces­sing, but the Data Sub­ject requ­i­res them for the est­ab­lish­ment, exerci­se or defen­se of leg­al cla­ims; or
• the Data Sub­ject has objec­ted to the pro­ces­sing pur­su­ant to Artic­le 21(1) of the Gene­ral Data Pro­tec­ti­on Regu­la­ti­on; in this case, the rest­ric­ti­on shall apply for a peri­od of time until it is deter­mi­ned whet­her the legi­ti­ma­te grounds of the Cont­rol­ler overr­ide tho­se of the Data Sub­ject.

If pro­ces­sing is rest­ric­ted on the basis of the abo­ve, such per­so­nal data, with the except­ion of stor­age, may only be pro­ces­sed with the con­sent of the Data Sub­ject, or for the est­ab­lish­ment, exerci­se or defen­ce of leg­al cla­ims, or for the pro­tec­ti­on of the rights of anot­her natu­ral or leg­al per­son, or for impor­tant pub­lic inte­rest rea­sons of the Euro­pe­an Union or a Mem­ber Sta­te.

The Data Cont­rol­ler shall inform the Data Sub­ject – at who­se request the data pro­ces­sing was rest­ric­ted – in advance of the lift­ing of the rest­ric­ti­on on data pro­ces­sing.

The web­site of the Data Pro­tec­ti­on Aut­ho­rity con­ta­ins furt­her infor­ma­ti­on abo­ut the data pro­tec­ti­on rights refer­red to in this Data Pro­tec­ti­on Noti­ce.

Buda­pest, 2025. már­ci­us 03.

Dr. Boz­sik Imre

Biop­lant-Che­mie Kft.

exe­cu­tive