PRIVACY NOTICE
VERSION HISTORY
| Version number |
Date |
Description of amendments |
| 1.0 |
2026.05.20 |
First published version |
|
|
|
1. Introduction
The Data Controller is committed to protecting the rights of the organisation’s employees and other persons having a relationship with the organisation, in particular to respecting personal rights and the right to the protection of personal data, actively facilitating the exercise of such rights, and protecting business secrets.
This Privacy Notice sets out the principles and conditions governing the processing of personal data carried out in the course of the Data Controller’s activities, with particular regard to Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: “GDPR”).
The Data Controller reserves the right to amend this Privacy Notice unilaterally. Amendments may be made in particular where required due to changes in legislation, the practice of data protection supervisory authorities, the Data Controller’s internal data processing practices, or newly identified security risks.
1 THE DATA CONTROLLER AND ITS CONTACT DETAILS
Name of the Data Controller: Tokaj-Hétszőlő Zrt. (hereinafter: “Data Controller”)
Registered office: 3910 Tokaj, Bajcsy-Zsilinszky utca 19-21, Hungary
Email address: tokaj@hetszolo.hu
Website: www.hetszolo.com
2 SPECIFIC PRIVACY NOTICES
2.1 Providing means of contact
2.1.1 Purposes of processing
| Purpose of this processing: |
Providing a means of contact and responding to customer enquiries |
2.1.2 Categories of data subjects and personal data processed
| Categories of natural persons affected by this processing: |
Persons contacting the organisation through the website or by email |
| In the course of this processing, the Data Controller processes the following personal data: |
Telephone number
Name
Subject of the message
Content of the message
Email address |
2.1.3 Legal basis for processing
| Legal basis for this processing: |
Consent – Article 6(1)(a) GDPR – the data subject has given consent to the processing of his or her personal data for one or more specific purposes; |
| Legislation governing the processing and, in the case of processing based on legitimate interests pursuant to Article 6(1)(f) GDPR, the legitimate interest forming the basis of the processing |
Not applicable |
| Where special categories of personal data are processed, identification of the relevant special category: |
No special-category data are processed |
| Additional condition(s) applicable to the processing of special categories of personal data pursuant to Article 9(2) GDPR: |
Not applicable |
Data retention period
| Retention period applicable to this processing, or the criteria used to determine the retention period: |
Civil-law limitation period (5 years) |
2.1.4 Other conditions
| Source of the data where they were not provided to the Data Controller by the data subject |
The data are provided by the data subject |
| Possible consequences of failure to provide the data: |
Not applicable |
| Other conditions having regard to Article 13(2)(e) GDPR |
Provision of the data is based on consent, and the data subject may withdraw consent |
| Where Article 6(1)(b) or (c) GDPR applies, is the provision of data a statutory or contractual requirement or a requirement necessary to enter into a contract? |
Provision of the data is based on consent, and the data subject may withdraw consent |
2.1.5 Recipients of personal data
| Processors used in connection with this processing: |
Hosting provider: MédiaCenter Hungary Kft.
Tax number: 13922579-2-03;
Development and support: Kreatív Web Ötletek Szolgáltató Betéti Társaság
Tax number: 24203290-2-05 |
| Organisations acting as joint controllers in connection with this processing: |
Not applicable |
| Regular transfers of personal data may be made to the following recipients in connection with this processing: |
Not applicable |
| Are personal data transferred outside the EEA? (If yes, how are the additional requirements of Chapter V GDPR satisfied?) |
No |
2.1.6 Automated decision-making, including profiling
In connection with this processing, the Data Controller does not carry out automated decision-making and/or profiling.
2.2 Webshop user account
2.2.1 Purposes of processing
| Purpose of this processing: |
The purpose of processing personal data relating to webshop users is to facilitate the management of orders. Online orders are received through the webshop. Creating a user account is optional; purchases may also be made without registration. |
2.2.2 Categories of data subjects and personal data processed
| Categories of natural persons affected by this processing: |
Registered webshop users |
| In the course of this processing, the Data Controller processes the following personal data: |
Name, telephone number, email address, username, delivery address, billing address, orders |
2.2.3 Legal basis for processing
| Legal basis for this processing: |
Consent – Article 6(1)(a) GDPR – the data subject has given consent to the processing of his or her personal data for one or more specific purposes; |
| Legislation governing the processing and, in the case of processing based on legitimate interests pursuant to Article 6(1)(f) GDPR, the legitimate interest forming the basis of the processing |
Not applicable |
| Where special categories of personal data are processed, identification of the relevant special category: |
No special-category data are processed |
| Additional condition(s) applicable to the processing of special categories of personal data pursuant to Article 9(2) GDPR: |
Not applicable |
Data retention period
| Retention period applicable to this processing, or the criteria used to determine the retention period: |
The user may withdraw consent by deleting the user account. Upon termination of the account, the relevant data are deleted immediately. If purchases have been made through the account, billing data will continue to be retained for 8 years in accordance with accounting legislation. |
2.2.4 Other conditions
| Source of the data where they were not provided to the Data Controller by the data subject |
The data are provided by the data subject |
| Possible consequences of failure to provide the data: |
The user must re-enter his or her data for each order. |
| Other conditions having regard to Article 13(2)(e) GDPR |
Provision of the data is based on consent, and the data subject may withdraw consent |
| Where Article 6(1)(b) or (c) GDPR applies, is the provision of data a statutory or contractual requirement or a requirement necessary to enter into a contract? |
Provision of the data is based on consent, and the data subject may withdraw consent |
2.2.5 Recipients of personal data
| Processors used in connection with this processing: |
Hosting provider: MédiaCenter Hungary Kft.
Tax number: 13922579-2-03;
Development and support: Kreatív Web Ötletek Szolgáltató Betéti Társaság
Tax number: 24203290-2-05 |
| Organisations acting as joint controllers in connection with this processing: |
Not applicable |
| Regular transfers of personal data may be made to the following recipients in connection with this processing: |
Not applicable |
| Are personal data transferred outside the EEA? (If yes, how are the additional requirements of Chapter V GDPR satisfied?) |
No personal data are transferred outside the EEA |
2.2.6 Automated decision-making, including profiling
In connection with this processing, the Data Controller does not carry out automated decision-making and/or profiling.
2.3 Webshop sales
2.3.1 Purposes of processing
| Purpose of this processing: |
Recording information relating to the purchase of products available in the webshop is necessary for the performance of contracts and for compliance with document-retention and consumer-protection obligations. |
2.3.2 Categories of data subjects and personal data processed
| Categories of natural persons affected by this processing: |
Webshop customers |
| In the course of this processing, the Data Controller processes the following personal data: |
Name, telephone number, email address, username, delivery address, billing address, orders, tax number where applicable |
2.3.3 Legal basis for processing
| Legal basis for this processing: |
Performance of a contract – Article 6(1)(b) GDPR – processing is necessary for the performance of a contract or in order to take steps prior to entering into a contract |
| Legislation governing the processing and, in the case of processing based on legitimate interests pursuant to Article 6(1)(f) GDPR, the legitimate interest forming the basis of the processing |
Not applicable |
| Where special categories of personal data are processed, identification of the relevant special category: |
No special-category data are processed |
| Additional condition(s) applicable to the processing of special categories of personal data pursuant to Article 9(2) GDPR: |
Not applicable |
Data retention period
| Retention period applicable to this processing, or the criteria used to determine the retention period: |
Civil-law limitation period (5 years) |
2.3.4 Other conditions
| Source of the data where they were not provided to the Data Controller by the data subject |
The data are provided by the data subject |
| Possible consequences of failure to provide the data: |
The purchase cannot be completed |
| Other conditions having regard to Article 13(2)(e) GDPR |
Not applicable |
| Where Article 6(1)(b) or (c) GDPR applies, is the provision of data a statutory or contractual requirement or a requirement necessary to enter into a contract? |
Not applicable |
2.3.5 Recipients of personal data
| Processors used in connection with this processing: |
Hosting provider: MédiaCenter Hungary Kft.
Tax number: 13922579-2-03;
Development and support: Kreatív Web Ötletek Szolgáltató Betéti Társaság
Tax number: 24203290-2-05 |
| Organisations acting as joint controllers in connection with this processing: |
Not applicable |
| Regular transfers of personal data may be made to the following recipients in connection with this processing: |
The recipient’s name, telephone number, email address and delivery address are transferred to the courier service responsible for delivery. The courier service used may vary depending on the size of the consignment and the delivery address. |
| Are personal data transferred outside the EEA? (If yes, how are the additional requirements of Chapter V GDPR satisfied?) |
No |
2.3.6 Automated decision-making, including profiling
In connection with this processing, the Data Controller does not carry out automated decision-making and/or profiling.
2.4 Newsletter for subscribers
2.4.1 Purposes of processing
| Purpose of this processing: |
Sending information concerning the Data Controller’s activities to interested persons for branding, educational and sales purposes. |
2.4.2 Categories of data subjects and personal data processed
| Categories of natural persons affected by this processing: |
Newsletter subscribers |
| In the course of this processing, the Data Controller processes the following personal data: |
Name, email address |
2.4.3 Legal basis for processing
| Legal basis for this processing: |
Consent – Article 6(1)(a) GDPR – the data subject has given consent to the processing of his or her personal data for one or more specific purposes; |
| Legislation governing the processing and, in the case of processing based on legitimate interests pursuant to Article 6(1)(f) GDPR, the legitimate interest forming the basis of the processing |
Not applicable |
| Where special categories of personal data are processed, identification of the relevant special category: |
No special-category data are processed |
| Additional condition(s) applicable to the processing of special categories of personal data pursuant to Article 9(2) GDPR: |
Not applicable |
Data retention period
| Retention period applicable to this processing, or the criteria used to determine the retention period: |
The data are deleted when consent is withdrawn |
2.4.4 Other conditions
| Source of the data where they were not provided to the Data Controller by the data subject |
No |
| Possible consequences of failure to provide the data: |
The newsletter cannot be sent |
| Other conditions having regard to Article 13(2)(e) GDPR |
Provision of the data is based on consent, and the data subject may withdraw consent by clicking the link at the bottom of the email or by sending a message to the Data Controller. |
| Where Article 6(1)(b) or (c) GDPR applies, is the provision of data a statutory or contractual requirement or a requirement necessary to enter into a contract? |
Provision of the data is based on consent, and the data subject may withdraw consent by clicking the link at the bottom of the email or by sending a message to the Data Controller. |
2.4.5 Recipients of personal data
| Processors used in connection with this processing: |
WD Innovation Kft. (tax number: 14546969-2-41), operator of the iuno.hu newsletter distribution software |
| Organisations acting as joint controllers in connection with this processing: |
Not applicable |
| Regular transfers of personal data may be made to the following recipients in connection with this processing: |
Not applicable |
| Are personal data transferred outside the EEA? (If yes, how are the additional requirements of Chapter V GDPR satisfied?) |
Not applicable |
2.4.6 Automated decision-making, including profiling
In connection with this processing, the Data Controller does not carry out automated decision-making and/or profiling.
2.5 Processing of functional cookies used by the website
2.5.1 Purposes of processing
| Purpose of this processing: |
Ensuring the proper operation of the website and services provided by third parties (functional cookies) |
2.5.2 Categories of data subjects and personal data processed
| Categories of natural persons affected by this processing: |
Visitors to the website |
| In the course of this processing, the Data Controller processes the following personal data: |
IP address |
2.5.3 Legal basis for processing
| Legal basis for this processing: |
Performance of a contract – Article 6(1)(b) GDPR – processing is necessary for the performance of a contract. |
| Legislation governing the processing and, in the case of processing based on legitimate interests pursuant to Article 6(1)(f) GDPR, the legitimate interest forming the basis of the processing |
Use of the website constitutes an information society service within the meaning of Act CVIII of 2001, and by using the website the visitor accepts the terms of use through his or her conduct. |
| Where special categories of personal data are processed, identification of the relevant special category: |
No special-category data are processed |
| Additional condition(s) applicable to the processing of special categories of personal data pursuant to Article 9(2) GDPR: |
Not applicable |
Data retention period
| Retention period applicable to this processing, or the criteria used to determine the retention period: |
The retention period varies by cookie; see the table in the Cookie Notice |
2.5.4 Other conditions
| Source of the data where they were not provided to the Data Controller by the data subject |
No |
| Possible consequences of failure to provide the data: |
The website will not function as intended |
| Other conditions having regard to Article 13(2)(e) GDPR |
Provision of the data cannot be omitted |
| Where Article 6(1)(b) or (c) GDPR applies, is the provision of data a statutory or contractual requirement or a requirement necessary to enter into a contract? |
Provision of the data cannot be omitted |
2.5.5 Recipients of personal data
| Processors used in connection with this processing: |
Hosting provider: MédiaCenter Hungary Kft.
Tax number: 13922579-2-03;
Development and support: Kreatív Web Ötletek Szolgáltató Betéti Társaság
Tax number: 24203290-2-05 |
| Organisations acting as joint controllers in connection with this processing: |
Not applicable |
| Regular transfers of personal data may be made to the following recipients in connection with this processing: |
No data transfer |
| Are personal data transferred outside the EEA? (If yes, how are the additional requirements of Chapter V GDPR satisfied?) |
No personal data are transferred outside the EEA |
2.5.6 Automated decision-making, including profiling
In connection with this processing, the Data Controller does not carry out automated decision-making and/or profiling.
2.6 Processing of optional cookies used by the website on the basis of consent
2.6.1 Purposes of processing
| Purpose of this processing: |
Web analytics information concerning visitors |
2.6.2 Categories of data subjects and personal data processed
| Categories of natural persons affected by this processing: |
Visitors to the website |
| In the course of this processing, the Data Controller processes the following personal data: |
Google Analytics cookies listed in the Cookie Notice |
2.6.3 Legal basis for processing
| Legal basis for this processing: |
Consent – Article 6(1)(a) GDPR – the data subject has given consent to the processing of his or her personal data for one or more specific purposes; |
| Legislation governing the processing and, in the case of processing based on legitimate interests pursuant to Article 6(1)(f) GDPR, the legitimate interest forming the basis of the processing |
Not applicable |
| Where special categories of personal data are processed, identification of the relevant special category: |
No special-category data are processed |
| Additional condition(s) applicable to the processing of special categories of personal data pursuant to Article 9(2) GDPR: |
Not applicable |
Data retention period
| Retention period applicable to this processing, or the criteria used to determine the retention period: |
The retention period varies by cookie; see the table in the Cookie Notice |
2.6.4 Other conditions
| Source of the data where they were not provided to the Data Controller by the data subject |
No |
| Possible consequences of failure to provide the data: |
Website traffic statistics cannot be analysed |
| Other conditions having regard to Article 13(2)(e) GDPR |
Provision of the data is based on consent, and the data subject may withdraw consent |
| Where Article 6(1)(b) or (c) GDPR applies, is the provision of data a statutory or contractual requirement or a requirement necessary to enter into a contract? |
Provision of the data is based on consent, and the data subject may withdraw consent |
2.6.5 Recipients of personal data
| Processors used in connection with this processing: |
Hosting provider: MédiaCenter Hungary Kft.
Tax number: 13922579-2-03;
Development and support: Kreatív Web Ötletek Szolgáltató Betéti Társaság
Tax number: 24203290-2-05 |
| Organisations acting as joint controllers in connection with this processing: |
Not applicable |
| Regular transfers of personal data may be made to the following recipients in connection with this processing: |
Google Ireland Ltd. |
| Are personal data transferred outside the EEA? (If yes, how are the additional requirements of Chapter V GDPR satisfied?) |
Yes, to the USA, under the EU-U.S. Data Privacy Framework |
2.6.6 Automated decision-making, including profiling
In connection with this processing, the Data Controller does not carry out automated decision-making and/or profiling.
2.7 Records of invoices and related accounting documents
2.7.1 Purposes of processing
| Purpose of this processing: |
Compliance with statutory obligations relating to the retention of invoices and supporting accounting documents. |
2.7.2 Categories of data subjects and personal data processed
| Categories of natural persons affected by this processing: |
Customer |
| In the course of this processing, the Data Controller processes the following personal data: |
Mandatory invoice information specified in Section 169 of the Hungarian VAT Act: date of issue of the invoice; invoice number uniquely identifying the invoice; name, address and tax number of the issuer; name and address of the customer; tax number of the customer where the customer is a domestic taxable person; description and quantity of the products/services supplied; net unit price of the products/services supplied (value exclusive of tax); net amount of the invoice (value exclusive of tax); VAT rate and VAT amount; and documents supporting the invoice |
2.7.3 Legal basis for processing
| Legal basis for this processing: |
Legal obligation – Article 6(1)(c) GDPR – processing is necessary for compliance with a legal obligation to which the Data Controller is subject. |
| Legislation governing the processing and, in the case of processing based on legitimate interests pursuant to Article 6(1)(f) GDPR, the legitimate interest forming the basis of the processing |
Act CL of 2017 (new Act on the Rules of Taxation), Section 78(3); Act C of 2000 on Accounting |
| Where special categories of personal data are processed, identification of the relevant special category: |
No special-category data are processed |
| Additional condition(s) applicable to the processing of special categories of personal data pursuant to Article 9(2) GDPR: |
Not applicable |
Data retention period
| Retention period applicable to this processing, or the criteria used to determine the retention period: |
8 years from the issue of the invoice and 8 years following the end of the relevant financial year. |
2.7.4 Other conditions
| Source of the data where they were not provided to the Data Controller by the data subject |
No |
| Possible consequences of failure to provide the data: |
Provision of the data is required by law |
| Other conditions having regard to Article 13(2)(e) GDPR |
Provision of the data is mandatory |
| Where Article 6(1)(b) or (c) GDPR applies, is the provision of data a statutory or contractual requirement or a requirement necessary to enter into a contract? |
Provision of the data is mandatory |
2.7.5 Recipients of personal data
| Processors used in connection with this processing: |
No data processor |
| Organisations acting as joint controllers in connection with this processing: |
Not applicable |
| Regular transfers of personal data may be made to the following recipients in connection with this processing: |
No data transfer |
| Are personal data transferred outside the EEA? (If yes, how are the additional requirements of Chapter V GDPR satisfied?) |
No |
2.7.6 Automated decision-making, including profiling
In connection with this processing, the Data Controller does not carry out automated decision-making and/or profiling.
2.8 Processing of personal data of persons designated by companies contracting with the Data Controller for contact or other purposes
2.8.1 Purposes of processing
| Purpose of this processing: |
Contractual partners provide the personal data of their employees participating in the performance of the contract and authorised to act as contact persons for the purpose of performing the contract. |
2.8.2 Categories of data subjects and personal data processed
| Categories of natural persons affected by this processing: |
Natural persons associated with a contractual partner |
| In the course of this processing, the Data Controller processes the following personal data: |
Name; contact details (email address, telephone number); any other data potentially provided by the partner |
2.8.3 Legal basis for processing
| Legal basis for this processing: |
Legitimate interests – Article 6(1)(f) GDPR – processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party. |
| Legislation governing the processing and, in the case of processing based on legitimate interests pursuant to Article 6(1)(f) GDPR, the legitimate interest forming the basis of the processing |
The Data Controller has a legitimate interest in maintaining contact with its contractual partner through the natural persons designated by that partner. |
| Where special categories of personal data are processed, identification of the relevant special category: |
No special-category data are processed |
| Additional condition(s) applicable to the processing of special categories of personal data pursuant to Article 9(2) GDPR: |
Not applicable |
Data retention period
| Retention period applicable to this processing, or the criteria used to determine the retention period: |
The same period as applies to the retention of the contract. |
2.8.4 Other conditions
| Source of the data where they were not provided to the Data Controller by the data subject |
Yes |
| Possible consequences of failure to provide the data: |
The data are required for the performance of the contract. The contractual partner is responsible for ensuring that the transfer of the data is lawful. |
| Other conditions having regard to Article 13(2)(e) GDPR |
Not applicable |
| Where Article 6(1)(b) or (c) GDPR applies, is the provision of data a statutory or contractual requirement or a requirement necessary to enter into a contract? |
Not applicable |
2.8.5 Recipients of personal data
| Processors used in connection with this processing: |
No data processor |
| Organisations acting as joint controllers in connection with this processing: |
Not applicable |
| Regular transfers of personal data may be made to the following recipients in connection with this processing: |
No data transfer |
| Are personal data transferred outside the EEA? (If yes, how are the additional requirements of Chapter V GDPR satisfied?) |
No |
2.8.6 Automated decision-making, including profiling
In connection with this processing, the Data Controller does not carry out automated decision-making and/or profiling.
¶
2.9 Data relating to followers of the company’s Facebook profile
2.9.1 Purposes of processing
| Purpose of this processing: |
Communicating with interested persons via Facebook. |
2.9.2 Categories of data subjects and personal data processed
| Categories of natural persons affected by this processing: |
Visitors to the Facebook page and customers |
| In the course of this processing, the Data Controller processes the following personal data: |
Data collected by Facebook in connection with Page Insights; see: https://www.facebook.com/legal/terms/page_controller_addendum ; |
2.9.3 Legal basis for processing
| Legal basis for this processing: |
Consent – Article 6(1)(a) GDPR – the data subject has given consent to the processing of his or her personal data for one or more specific purposes. |
| Legislation governing the processing and, in the case of processing based on legitimate interests pursuant to Article 6(1)(f) GDPR, the legitimate interest forming the basis of the processing |
The data subject gives consent to the processing by following the page and may withdraw consent by unfollowing it. |
| Where special categories of personal data are processed, identification of the relevant special category: |
No special-category data are processed |
| Additional condition(s) applicable to the processing of special categories of personal data pursuant to Article 9(2) GDPR: |
Not applicable |
Data retention period
| Retention period applicable to this processing, or the criteria used to determine the retention period: |
In accordance with the contractual terms of the platform provider, Meta Inc. |
2.9.4 Other conditions
| Source of the data where they were not provided to the Data Controller by the data subject |
The data originate from the data subject. |
| Possible consequences of failure to provide the data: |
Content cannot be shared with followers |
| Other conditions having regard to Article 13(2)(e) GDPR |
Provision of the data is based on consent, and the data subject may withdraw consent |
| Where Article 6(1)(b) or (c) GDPR applies, is the provision of data a statutory or contractual requirement or a requirement necessary to enter into a contract? |
Provision of the data is based on consent, and the data subject may withdraw consent |
2.9.5 Recipients of personal data
| Processors used in connection with this processing: |
Not applicable |
| Organisations acting as joint controllers in connection with this processing: |
Meta Inc. Information on joint controllership is available at: https://www.facebook.com/privacy/explanation/ |
| Regular transfers of personal data may be made to the following recipients in connection with this processing: |
No data transfer |
| Are personal data transferred outside the EEA? (If yes, how are the additional requirements of Chapter V GDPR satisfied?) |
No |
2.9.6 Automated decision-making, including profiling
In connection with this processing, the Data Controller does not carry out automated decision-making and/or profiling. ¶
2.10 Records of measures relating to the exercise of data subject rights under the GDPR
2.10.1 Purposes of processing
| Purpose of this processing: |
Compliance with record-keeping obligations relating to the exercise of data subject rights under the GDPR (see Article 5(2) and Article 12 GDPR) |
2.10.2 Categories of data subjects and personal data processed
| Categories of natural persons affected by this processing: |
Natural persons exercising their rights as data subjects |
| In the course of this processing, the Data Controller processes the following personal data: |
Name, decision, application/request, registration details |
2.10.3 Legal basis for processing
| Legal basis for this processing: |
Legal obligation – Article 6(1)(c) GDPR – processing is necessary for compliance with a legal obligation to which the Data Controller is subject. |
| Legislation governing the processing and, in the case of processing based on legitimate interests pursuant to Article 6(1)(f) GDPR, the legitimate interest forming the basis of the processing |
Article 5(2) and Article 12 GDPR; Section 24 of the Hungarian Health Act; Section 7(3)-(5) and (7) of the Hungarian Health Data Act |
| Where special categories of personal data are processed, identification of the relevant special category: |
Yes |
| Additional condition(s) applicable to the processing of special categories of personal data pursuant to Article 9(2) GDPR: |
Not applicable |
Data retention period
| Retention period applicable to this processing, or the criteria used to determine the retention period: |
5 years following the most recent interaction |
2.10.4 Other conditions
| Source of the data where they were not provided to the Data Controller by the data subject |
The data originate from the data subject. |
| Possible consequences of failure to provide the data: |
The identity of the person making the enquiry cannot be established and therefore no response can be provided. |
| Other conditions having regard to Article 13(2)(e) GDPR |
Provision of the data is mandatory |
| Where Article 6(1)(b) or (c) GDPR applies, is the provision of data a statutory or contractual requirement or a requirement necessary to enter into a contract? |
Provision of the data is mandatory |
2.10.5 Recipients of personal data
| Processors used in connection with this processing: |
Not applicable |
| Organisations acting as joint controllers in connection with this processing: |
Not applicable |
| Regular transfers of personal data may be made to the following recipients in connection with this processing: |
No data transfer |
| Are personal data transferred outside the EEA? (If yes, how are the additional requirements of Chapter V GDPR satisfied?) |
No |
2.10.6 Automated decision-making, including profiling
In connection with this processing, the Data Controller does not carry out automated decision-making and/or profiling. ¶
3 RIGHTS OF DATA SUBJECTS
The Data Controller facilitates the exercise of the Data Subject’s right to information under Articles 13 and 14 GDPR by publishing this General Privacy Notice and the specific privacy notices electronically. Current copies of the General Privacy Notice and the specific privacy notices are also available in printed form at the Data Controller’s registered office and business premises, and copies may be provided to the Data Subject upon request.
At the time the personal data are obtained or upon first contact with the Data Subject, the Data Controller provides the electronic location of this General Privacy Notice and the specific privacy notice applicable to the relevant processing operation or, at the Data Subject’s request, provides a printed copy thereof.
Data Subjects may also request detailed information concerning the processing of their personal data using the contact details specified in Section 1 and may submit requests relating to the exercise of their data subject rights through the same contact details.
In addition to the right to information under Article 13 GDPR, Data Subjects have the rights set out below in relation to the processing of their personal data. The Data Controller will respond to requests no later than one month following receipt of the request, unless an extension is required due to the complexity or number of requests.
3.1 Right of access
Pursuant to Article 15 GDPR, the Data Subject may request information and confirmation from the Data Controller regarding the conditions and circumstances of the processing of his or her personal data, in particular:
- the purposes and legal bases of processing relating to the Data Subject’s personal data;
- the categories of personal data concerned;
- the recipients or categories of recipients of the personal data;
- the envisaged retention period applicable to the Data Subject’s personal data or the criteria used to determine that period;
- the Data Subject’s options for exercising his or her rights and available remedies;
- whether the Data Controller carries out automated decision-making or profiling using the personal data and, if so, the circumstances of such processing.
In exercising their right of access, pursuant to Article 15(4) GDPR, Data Subjects may request one electronic copy of the personal data processed concerning them from the Data Controller free of charge.
3.2 Right to rectification
Pursuant to Article 16 GDPR, the Data Subject has the right to obtain from the Data Controller without undue delay the rectification of inaccurate personal data concerning him or her and to request the completion of incomplete personal data.
3.3 Right to erasure
Pursuant to Article 17 GDPR, the Data Subject has the right to request the erasure of his or her personal data from the Data Controller where consent has been withdrawn, the data have been unlawfully processed, erasure is required for compliance with an obligation under Union or Member State law applicable to the Data Controller, the purpose of the processing has ceased to exist, or where the Data Subject has objected to the processing and there are no lawful grounds for continuing the processing, including where the Data Subject objects to processing carried out for direct marketing purposes.
The Data Controller will not comply with a request for erasure where legislation requires the personal data to be retained and the applicable statutory processing or retention period has not yet expired.
3.4 Right to restriction of processing
Pursuant to Article 18 GDPR, the Data Subject has the right to obtain from the Data Controller restriction of processing where one of the following applies:
- the accuracy of the personal data is contested by the Data Subject;
- the processing is unlawful and the Data Subject opposes the erasure of the personal data and requests restriction of their use instead;
- the Data Controller no longer needs the personal data for the purposes of the processing, but they are required by the Data Subject for the establishment, exercise or defence of legal claims;
- the Data Subject has objected to the processing.
3.5 Right to data portability
Pursuant to Article 20 GDPR, the Data Subject may request that personal data concerning him or her which are processed by automated means on the basis of the Data Subject’s consent [Article 6(1)(a) GDPR] or for the performance of a contract [Article 6(1)(b) GDPR] be provided by the Data Controller in a structured, commonly used and machine-readable format.
Where technically feasible, the Data Controller will, at the Data Subject’s request, transmit the personal data directly to another controller designated in the Data Subject’s request.
The right to data portability under this Section does not create an obligation for controllers to implement or maintain technically compatible data processing systems.
Where the exercise of the Data Subject’s right to data portability would adversely affect the rights and freedoms of others, in particular the trade secrets or intellectual property rights of others, the Data Controller may refuse to comply with the request to the extent necessary.
The rules governing the right to data portability do not apply where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller.
3.6 Automated decision-making and profiling
Pursuant to Article 22(3) GDPR, where the relevant specific privacy notice states that automated decision-making, including profiling, is carried out in relation to a particular processing operation, the Data Subject may request human intervention on the part of the Data Controller, express his or her point of view in connection with the decision-making process, and contest the decision.
The Data Controller currently does not carry out automated decision-making or profiling.
3.7 Right to object
Pursuant to Article 21 GDPR, the Data Subject has the right to object, on grounds relating to his or her particular situation, at any time to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller [Article 6(1)(e) GDPR], and to processing based on the legitimate interests of the Data Controller [Article 6(1)(f) GDPR].
Where an objection is submitted, the personal data may continue to be processed only where compelling legitimate grounds for the processing exist which override the interests, rights and freedoms of the Data Subject, or where the processing is required for the establishment, exercise or defence of legal claims.
4 RIGHT TO SEEK A REMEDY
4.1 Data Protection Officer
The Data Subject may at any time contact the Data Controller’s Data Protection Officer or, where no Data Protection Officer has been appointed, the contact person designated for data protection matters using the contact details set out in the section entitled THE DATA CONTROLLER AND ITS CONTACT DETAILS, if the Data Subject has any questions or wishes to make a complaint concerning the processing or protection of his or her personal data or the exercise of data subject rights.
4.2 Right to lodge a complaint with the data protection supervisory authority
Without prejudice to any other administrative or judicial remedy, every Data Subject has the right to lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information if the Data Subject considers that an act or omission by the Data Controller or a processor engaged by the Data Controller has infringed applicable data protection rules or created a risk of such infringement.
Contact details of the Hungarian National Authority for Data Protection and Freedom of Information:
Registered office: 1055 Budapest, Falk Miksa utca 9-11., Hungary
Postal address: 1363 Budapest, Pf. 9., Hungary
Tel.: 06 1/391-1400, +36 (30) 683-5969, +36 (30) 549-6838
Email: ugyfelszolgalat@naih.hu
Website: http://naih.hu/
Judicial remedy
Right to an effective judicial remedy against the Data Controller or processor
Without prejudice to any available administrative or non-judicial remedies, including the right to lodge a complaint with the data protection supervisory authority, every Data Subject has the right to bring proceedings before a court where he or she considers that the Data Controller or a processor engaged by the Data Controller has infringed his or her rights in connection with the processing of personal data.
Proceedings fall within the jurisdiction of the court competent according to the registered office of the Data Controller, i.e. the Budapest-Capital Regional Court. The Data Subject may alternatively choose to bring proceedings before the court competent according to his or her place of residence or stay. A list of regional courts is available at http://birosag.hu/torvenyszekek.
