Privacy notice
DATA MANAGEMENT INFORMATION
THE RIGHTS OF THE NATURAL PERSON CONCERNED
THE PROCESSING OF YOUR PERSONAL DATA
INTRODUCTION
On the protection of natural persons with regard to the processing of personal data
and on the free movement of such data and repealing Regulation (EC) No 95/46
REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the processing of personal data
(hereinafter: the Regulation) requires the Controller to take appropriate measures to ensure that
in order to ensure that the data subject is informed of all
each piece of information in a concise, transparent, understandable and easily accessible form, clearly
and in plain language, and that the Data Controller facilitates the processing of the data subject's
exercise your rights.
The data subject's obligation to provide prior information on the right to information
is also required by Act CXII of 2011 on Freedom of Information. See below
by providing information, we are fulfilling this legal obligation.
The information must be published on the company's website or provided to the person concerned
shall be sent on request.
CHAPTER 1
NAME OF THE CONTROLLER
The publisher of this information is also the Data Controller:
Company name: Jámbor Rudolf E.V.
Registered office: 5900 Orosháza Kossuth Lajos u. 34.
Tax number: 77744052-2-24.
No.: 21690315.
Represented by: Rudolf Jámbor
Contact details: email address: info@hometextil.hu
(hereinafter referred to as "the Company")
THE BACKGROUND TO THE PROCESSING
(„general section”)
Why this leaflet?
In the course of its operations, the Data Controller processes personal data for a number of purposes and for the following purposes
respecting your rights and complying with your legal obligations
intends to do. The data controller also considers it important to present to the data subjects the
the processing of personal data that have come to its knowledge in the course of its processing activities, its
key feature.
On what basis is the personal data of data subjects processed?
Personal data will only be processed for specific purposes and on an appropriate legal basis.
These purposes and legal bases for specific data processing are set out below
are presented.
Who processes your personal data?
In Part I of this Privacy Notice, the Data Subject can obtain information on the applicable
the identity and contact details of data processors.
What external assistance is used to process your personal data?
Personal data are mostly processed by the Data Controller at its own premises. However, there are
operations for which we use external assistance, a data processor. The
the identity of the data processor may vary according to the characteristics of each processing operation.
What principles does the Data Controller consider important when processing your personal data?
Personal data are processed in accordance with the applicable legislation, in particular
Having regard to Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016
(GDPR Regulation).
In the course of operating the webshop, only the data specified in the
personal data is processed and the security of the personal data provided is ensured by
is protected by technical and organisational measures that are possible and necessary. For this
particular attention is paid to the confidentiality of personal data,
to ensure its integrity and availability.
We are responsible for the truthfulness and accuracy of the personal data after you have provided it to us.
The Data Controller is responsible for. The terms used in this notice in relation to the
on the right to information self-determination and the interpretative provisions of the GDPR Regulation
have been interpreted according to the concepts set out in the.
What rights do you have in relation to your personal data processed by the Controller?
The controller shall ensure that data subjects exercise their rights under the GDPR Regulation
can practice. The controller may not refuse a request to exercise these rights
unless you can prove that you are unable to identify the data subject. The data subject shall
so you need to identify yourself to fulfil your request.
The controller shall process the request without delay, but no later than 1
within one month or inform the data subject of any delay in complying with the
obstacles or delays. In this case, the deadline is extended by 2 months
may be extended, provided that the extension and the reasons for it are communicated to the 1
within one month.
The controller shall respond to the data subject's request in the form in which it was received. The
the data subject has the option of submitting his/her request electronically, in which case the reply will be
electronically, unless expressly provided otherwise.
In order to safeguard the rights of data subjects, the rights set out in this information notice are free of charge.
may be exercised, the controller will not charge a fee, unless the request is clearly
unfounded or excessive, in particular because of its repetitive nature. If and in so far as the requested
the measure, information is excessive or manifestly unfounded for the controller to act reasonably
charge a fee for compliance (in particular, increased fees for excessive requests
to cover administrative costs) or refuse to process a request on the basis of
Measure. In such a case, the controller shall provide the data subject with a statement of reasons.
In compliance with the GDPR Regulation, data subjects have the rights set out in Chapter V.
can exercise.
CHAPTER 2
NAME OF DATA PROCESSORS
Data processor: a natural or legal person, public authority, agency or
any other body which processes personal data on behalf of the controller; (Regulation 4.
Article 8.)
The use of a processor does not require the prior consent of the data subject, but
you need to be informed. Accordingly, the following information is provided:
Our data processor: customer service employees of the data controller
Marketing partner:
Instant Fun Ltd.
6800 Hódmezővásárhely, Tulipán utca 8.
Tax number: 27549711-1-06
Hosting provider
1. Rackhost.com
Operator: Rackhost Zrt.
Contact: www.rackhost.hu, info@rackhost.hu, +3614451200.
Address: 1132 Budapest, Victor Hugo utca 18-22.
Marketing analysis, marketing services:
2. Google Analytics
- Name: Google LLC
- Location:1600 Amphitheatre Parkway, Mountain View, CA 94043 United States
States
- Contact: https://support.google.com/
- Web: www.google.com
3. YouTube
- Name: Google LLC
- Location:1600 Amphitheatre Parkway, Mountain View, CA 94043 United States
States
- Contact: https://support.google.com/
- Web: www.youtube.com
4. Facebook
- Name: Facebook Ireland Ltd
- Location: 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland
- Contact: https://www.facebook.com/privacy/explanation
– Website: www.facebook.com
5. MailChimp
- Name: The Rocket Science Group, LLC
- Location: 675 Ponce de Leon Ave NE Suite 5000 Atlanta, GA 30308 USA
- Contact: https://mailchimp.com/contact/
- Web: www.mailchimp.com
6. Benchmark
- Name: Benchmark Internet Group, LLC
- Location: 5500 Bolsa Avenue, Suite 245, Huntington Beach, CA 92649, USA
- Contact: https://www.benchmarkemail.com/contact/
- Web: https://www.benchmarkemail.com
7. Search for goods
- Name: Online Comparison Shopping Kft.
- Head office: 1074 Budapest, Rákóczi út 70-72.
- Contact: https://www.arukereso.hu/static/elerhetosegeink.html
- Web: https://www.arukereso.hu/
8. Price machine
- Name: guenstiger.de GmbH
- Location: Deichstraße 34, D-20459 Hamburg, Germany
- Contact: https://www.argep.hu/content_impresszum.html
- Web: https://www.argep.hu
Accountant:
Kiss-Tax Könyvelőház Kft.
7 Könd Street, 5900 Orosháza.
Tax registration number: 27765616-1-04
Company registration number: 04 09 016311
Operator of the billing software:
Triklon-IT Ltd.
Head office: 6800 Hódmezővásárhely, Tulipán u. 8.
Tax number: 13171960-2-06
Online/card payment bank:
K&H Bank Plc.
Headquarters: 1095 Budapest, Lechner Ödön fasor 9.
Courier services:
Magyar Posta Zrt. - MPL
Headquarters: 1138 Budapest, Dunavirág utca 2-6.,
Tax number: 10901232-2-44
GLS General Logistics Systems Hungary Csomag-Logisztikai Kft.
Location: 2351 Alsónémedi, GLS Európa u. 2.
Tax number: 12369410-2-44
FoxPost Zrt.
Headquarters:Hungary, 3200 Gyöngyös, Batsányi utca 9.
Tax number: 25034644-2-10
CHAPTER 3
ENSURE THE LAWFULNESS OF PROCESSING
/”specific part”/
1. Processing based on the data subject's consent
1.1 Where the Company wishes to carry out processing based on consent, the data subject shall.
your consent to the processing of your personal data as set out in the privacy policy
must be requested with the content and information specified in the data request form.
1.2 Consent shall also be deemed to be given if the data subject makes use of the Company's website,
check the box when you visit your online shop, the information
when using social services, the relevant technical
settings, and any other statements or actions that you make or take
in the relevant context, the data subject's consent to the intended processing of his or her personal data
clearly indicates. The silence, the ticked box or the inaction
therefore does not constitute consent.
1.3. Consent is the consent to all processing for the same purpose or purposes.
covers. If the processing serves more than one purpose at the same time, the
consent must be given for all processing purposes.
1.4. If the data subject gives his or her consent in a written declaration which is not
also applies to matters - such as the conclusion of a sales or service contract - the
the request for consent is clearly distinguishable from these other cases
should be presented in a clear and accessible way, in a clear and simple
language. Any part of such a statement containing the data subject's consent,
which contravenes the Regulation shall not be binding.
1.5. The Company may not conclude or perform a contract on the basis of personal data
consent to the processing of personal data which are not necessary for the performance of the contract
to meet.
1.6. The withdrawal of consent must be made possible in the same simple way as
to grant it.
1.7 If the personal data have been collected with the consent of the data subject, the controller shall
the data recorded, unless otherwise provided by law, in accordance with the legal obligation to which it is subject
without further specific consent and without requiring the consent of the data subject
even after you have withdrawn it.
Data controller during registration, providing information, requesting information,
for the purpose of inviting bids, processes the written (on the website chex-box)
ticked), the natural person's email address and name,
telephone number, Ip address, postal code, postal address (street, number), delivery address)
2. Processing based on the performance of a legal obligation
2.1. In the case of processing based on a legal obligation, the scope of the data to be processed, the
the purposes for which the data are processed, the period for which the data are stored, the recipients of the underlying
the provisions of the law apply.
2.2 Data processing based on the performance of a legal obligation in relation to the consent of the data subject
independent, as data processing is governed by law. The data subject is informed of the processing
in this case, it must be made clear that the processing is mandatory and that the
the data subject must be informed clearly and in detail, before the processing starts, of the
all facts relating to the processing of your data, in particular the purposes of the processing and
the legal basis of the processing, the data controller and the data processor, the processing
the duration of the processing, whether the controller has used the personal data of the data subject in accordance with the legal
obligation to process the data and who may access the data. A
information should include the rights and remedies of the data subject with regard to the processing
the possibilities. In the case of mandatory data processing, the information may be provided in the following ways
by publishing a reference to the legal provisions containing the information
is.
3. Processing based on legitimate interest
3.1. The legitimate interest of the Company or a third party may give rise to a legal basis for.
processing, provided that the interests and fundamental rights and freedoms of the data subject are not overridden.
priority. Account should be taken of the following on the basis of the data subject's relationship with the controller
reasonable expectations, so that personal data can be used for contact purposes, even for direct marketing
for the purposes of the processing of personal data can also be considered to be based on legitimate interest.
3.2 Processing based on legitimate interest requires a balancing of interests test. The Company
for processing in the interest of the data subject, the separate balancing of interests carried out
tests were completed with the following result: in the interest balancing test, the Company was able to
taking into account the conditions described for the processing, has concluded that the processing is justified on the basis of
with the appropriate safeguards, as set out in these rules, without which the
Company to operate competitively. Against this background, the emotional
effect and the harm to the right to privacy can be considered proportionate.
4. Disclosure of customer, contracting partner and contact details
on the management of
4.1. Preparation and conclusion of the contract by the Company for the performance of the contract,
performance, termination, granting a contractual advantage - a summary of the common
to support the economic processes in which it has an interest - may manage the data
the name, name at birth and date of birth of the natural person in a contractual relationship,
place of residence, mother’s name, address, tax reference number, identity card number, registered office, business premises
address, telephone number, email address, bank account number, customer number (client number,
order number), online identifier (buyers, suppliers list, master shopping lists), encrypted
your password, your dietary profile (individual food sensitivity, type of diet used, dietary
purposes). Such processing is also lawful if it is carried out for the purposes of
to take steps at the request of the data subject before the conclusion of the contract
needed. Recipients of personal data: in connection with the Company's customer service
employees performing accounting, tax, business and logistical tasks
employees, and data processors. Duration of storage of personal data for the duration of the contract
5 years after completion of the contract.
4.2. The data provided by the natural person contracting party in the contract for accounting, taxation
the legal basis for the processing for the fulfilment of a legal obligation, in this context the storage of data
duration 8 years.
4.3. The Company, acting on behalf of the legal entity that has entered into the contract with it, and signing the contract.
the personal data of the natural person provided in the contract, as well as his/her address, e-mail
your address and telephone number, your online identification, contract preparation, contact
exercise of rights and obligations arising from the contract - a summary of the common
to support economic processes arising within the sphere of interest – for the purpose of fulfilling a contract
by right. The storage period of this data is 5 years after the termination of the contract.
In the case of processing based on legitimate interest, the data subject has the specific right to object to the processing of personal data.
against data processing.
4.4. The Company shall not be liable to any non-signatory contact person designated as a contact person in the contract concluded with it
the name, address, telephone number, e-mail address, online identifier of the natural person
maintaining contacts, exercising rights and obligations under contracts - a summary of the
a contract for the purpose of supporting economic processes arising within a sphere of common interest
for the purposes of its performance, taking into account the fact that the contact person has
is in an employment relationship, so this processing does not affect the rights of the data subject
adversely. The contracting party declares that, in relation to the quality of the contact
informed the contact person concerned of the processing. The duration of the storage of these data is
5 years from the date of the contact point.
4.5. For all data subjects, the recipients of personal data are: the Company
its managing director, employees performing customer service-related tasks,
its employees who carry out liaison, accounting, tax and business management tasks, and
data processors.
4.6. Personal data may be transferred for processing for the purposes of taxation and accounting
an accountancy firm, marketing partner, contracted by the company.
4.7. The processing is lawful if it is justified by a contract or the conclusion of a contract.
is required in the context of the intention (Preamble 44) if it is necessary for the conclusion of the contract
necessary to take the necessary steps at the request of the data subject (Article 6(1)(b)).
Thus, for the purposes of the performance of a contract, the contractual data may be treated as described in this point.
personal data collected in the context of offers. When making or receiving an offer, you should inform the
Company must inform the offeror or the offeree of the offer.
5. Information on data processing based on the performance of a legal obligation
5.1. In the case of processing based on a legal obligation, the scope of the data to be processed, the
the purposes for which the data are processed, the period for which the data are stored, the recipients of the underlying
the provisions of the law apply.
5.2. Processing based on the performance of a legal obligation in relation to the consent of the data subject
independent, as data processing is governed by law. The data subject is informed of the processing
in this case, before starting the processing, the data subject must be informed that the processing is mandatory and that the data subject must be
must be informed clearly and in detail before the processing starts, of the processing of your data
all facts relating to its processing, in particular the purposes of the processing and
the legal basis of the processing, the data controller and the data processor, the processing
the duration of the processing, whether the controller has used the personal data of the data subject in accordance with the legal
obligation to process the data and who may access the data. A
information should include the rights and remedies of the data subject with regard to the processing
the possibilities. In the case of mandatory data processing, the information may be provided in the following ways
by publishing a reference to the legal provisions containing the information
is.
6. Information on tax and accounting obligations carried out for the purpose of
about data management
6.1. The Company shall, in the performance of its legal obligations, in accordance with the tax and accounting
for the purposes of fulfilling its obligations (accounting, taxation), processes the data of persons who have business relations with it
data of natural persons as defined by law. The data processed are the general
pursuant to § 169 and § 202 of Act CXXVII of 2017 on Value Added Tax, in particular: tax number,
name, address, tax status, pursuant to Article 167 of Act C of 2000 on Accounting: name,
the address, the name of the person or organisation ordering the operation, the name of the authorising officer
and the person verifying the implementation of the provision and, depending on the organisation, the auditor
signature; on the stock movement vouchers and cash management vouchers, the recipient, the
ellennyugtákon a befizető aláírása, a személyi jövedelemadóról szóló 1995. évi CXVII.
by law: tax identification number.
6.2. Duration of storage of personal data after the termination of the legal relationship giving rise to the legal basis
8 years after.
6.3. Recipients of personal data: the Company's tax, accounting, payroll,
employees and data processors performing social security functions.
7. To protect the vital interests of the data subject or other natural person
data management
7.1. the life or other vital interests of the data subject or of another natural person
interests may also provide a legal basis for the processing. This is the case
for natural persons, if they use health services or are affected by epidemics
the processing is carried out in order to stop the spread of.
8. Information on the protection of documents of lasting value under the Archives Act
about data management
8.1. The Company shall, in the performance of its legal obligations, manage the public records, the
Act LXVI of 1995 on public archives and the protection of private archival material
(Archives Act), for the purpose of the archiving of documents of permanent value in the
The remaining valuable part of the Company's archival material intact and in a usable condition at the
for future generations. Time of data storage: for the public archives
until the handover.
8.2. Recipients of personal data: the head of the Company, the person in charge of document management, filing
an employee of the public archives.
9. Promoting the rights of the data subject
9.1 In all its processing, the Company shall ensure that the rights of the data subject are protected.
exercise.
CHAPTER 4
VISITOR DATA MANAGEMENT ON THE COMPANY'S WEBSITE - INFORMATION ABOUT COOKIES
(COOKIE)
1. Visitors to the website must be informed on the website about the use of cookies and - in order to
with the exception of session cookies, which are technically necessary - the
your consent must be sought.
2. General information about cookies
2.1. A cookie is a piece of data that the website you visit sends to the visitor's computer.
to your browser (in the form of a variable name value) so that it can store it and later use the same
website can also load its content. Cookies may be valid, may be valid for
until the browser is closed, or for an unlimited period. Thereafter, for every HTTP(S) request,
this data is also sent by the browser to the server. In this way, the data on the user's computer
modifies the data.
2.2. By their very nature, modern website services require the use of cookies, which
function to tag a user (for example, that they have logged in to the site) and to
can properly manage the following, even identify it on subsequent returns. A
the danger is that the user is not always aware of this and
may be used to track a user by the website operator or other
service provider whose content is embedded on the site (e.g. Facebook, Google Analytics),
thereby creating a profile of the person, in which case the contents of the cookie are considered personal data
considered.
2.3. Types of cookies:
2.3.1. Technically necessary session cookies: which are
the site would simply not work functionally, these are the user
to identify you, e.g. to manage whether you have logged in, what you have put in your shopping basket, etc.
This is typically a session-id store, the rest of the data is stored on the server, which is
safer. There is security implications if the session cookie value is not right
is generated, there is a risk of session hijacking attack, so it is absolutely necessary,
to ensure that these values are generated correctly. Other terminology for session cookies-
all cookies are called cookies, which are deleted when you exit the browser (a session is a
browser usage from start to exit).
2.3.2. Usage cookies: this is what you would call cookies that remember
the user's choices, for example, how the user wants to see the page.
These types of cookies are essentially the preferences data stored in the cookie.
2.3.3. Performance cookies: although they have little to do with "performance", they are usually
cookies are cookies that collect information about the user's visit to a website.
your behaviour on the website, your time spent on the website, your clicks. These are typically third
third party applications (e.g. Google Analytics, AdWords, or Yandex.ru cookies).
are suitable for profiling.
You can find out more about Google Analytics cookies here:
https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage
You can find out more about Google AdWords cookies here:
https://support.google.com/adwords/answer/2407785?hl=hu
2.4. You are not obliged to accept or enable the use of cookies. You can reset them
your browser settings to reject all cookies or to indicate when your browser is set to reject cookies.
The system is currently sending a cookie. Although most browsers, by default,
automatically accepts cookies, but they can usually be changed to allow them,
to prevent automatic acceptance.
To find out about cookie settings for the most popular browsers, click on the links below
• Google Chrome: https://support.google.com/accounts/answer/61416?hl=hu
• Firefox: https://support.mozilla.org/hu/kb/sutik-engedelyezese-es-tiltasa-amit-weboldak-
useful
• Microsoft Internet Explorer 11: http://windows.microsoft.com/hu-hu/internet-explorer/delete-
manage-cookies#ie=ie-11
• Microsoft Internet Explorer 10: http://windows.microsoft.com/hu-hu/internet-explorer/delete-
manage-cookies#ie=ie-10-win-7
• Microsoft Internet Explorer 9: http://windows.microsoft.com/hu-hu/internet-explorer/delete-
manage-cookies#ie=ie-9
• Microsoft Internet Explorer 8: http://windows.microsoft.com/hu-hu/internet-explorer/delete-
manage-cookies#ie=ie-8
• Microsoft Edge: http://windows.microsoft.com/hu-hu/windows-10/edge-privacy-faq
• Safari: https://support.apple.com/hu-hu/HT201265
However, please note that there may be some cases where certain
website features or services will not function properly without cookies.
3. Information about the cookies used on the Company's website and the cookies that are created during the visit
data from
3.1. The data processed during the visit.
may record the following information about the visitor and the device used to browse the site and
can manage:
- the IP address used by the visitor,
- the browser type,
- the characteristics of the operating system of the browsing device (language set),
- date of visit,
- the (sub)page, feature or service visited.
Click .
This data is kept for a maximum of 90 days and is primarily used to protect against security incidents.
can be used to test.
3.2. Cookies used on the website
3.2.1. Technically necessary session cookies:
The purpose of the processing: to ensure the proper functioning of the website. These cookies are used to
are necessary to allow visitors to browse the website smoothly and
make full use of its features, available through the website
services, including, but not limited to, in particular, the services provided by the visitor on the
to comment operations or to identify the logged in user for a visit
during. The duration of the processing of these cookies is limited to the current visit of the visitor.
at the end of the session or when you close the browser, this type of cookie
will be automatically deleted from your computer.
The legal basis for this processing is the provision of e-commerce services and the
Act CVIII of 2001 on certain issues of information society services (Elkertv.)
Paragraph 13/A (3), according to which the service provider may, for the purpose of providing the service, process
personal data that are technically necessary for the provision of the service
are essential. The service provider must, where the other conditions are identical
select and in any case operate the information system in such a way that
the means used in the provision of social services to
personal data are processed only if it is necessary for the provision of the service and
is strictly necessary for the fulfilment of the other purposes set out in this Act, but
in this case only to the extent and for the duration necessary.
3.2.1. Usage cookies:
They remember the user's choices, for example, what form the user would like
see the page. These types of cookies are essentially the preferences data stored in the cookie.
The legal basis for processing is the consent of the visitor.
Purpose of data processing: to increase the efficiency of the service, user experience
to increase the user experience and make the website more convenient to use.
This data is typically on the user's computer, the website just accesses and recognizes it.
by the visitor.
3.2.2. Performance cookies:
They collect information about the user's behaviour on the website visited,
time spent, clicks.
Legal basis for processing: consent of the data subject.
Purpose of data processing: analysis of the website, sending promotional offers.
CHAPTER 5
INFORMATION ON THE RIGHTS OF THE PERSON CONCERNED
1. A brief summary of the data subject's rights:
2. Transparent information, communication and facilitation of the exercise of the rights of the data subject
3. Right to prior information - where personal data are collected from the data subject
4. Information to be provided to the data subject and the information to be made available to him or her when the
personal data were not obtained by the controller from him or her
5. Right of access of the data subject
6. Right to rectification
7. Right to erasure („right to be forgotten”)
8. Right to restriction of processing
9.
notification requirements relating to the restriction
10. The right to data portability
11. The right to object
12. Automated decision-making in individual cases, including profiling
13. Restrictions
14. Informing the data subject of the personal data breach
15. The right to lodge a complaint with a supervisory authority (official redress)
right)
16. Right to an effective judicial remedy against the supervisory authority
17.
right to legal redress
Your rights as a data subject in detail:
1. Transparent information, communication and facilitation of the exercise of data subject's rights
1.1.
all information and all communications are concise, transparent, understandable and easy to
in an accessible, clear and plain language, in particular
for any information addressed to children. The information may be provided in writing or by other
by any means, including electronic means where appropriate. At the request of the data subject
oral information may be given, provided that it is otherwise justified that the person concerned
identity.
1.2 The controller must facilitate the exercise of the data subject's rights.
1.3. The controller shall, without undue delay and in any event, respond to the request
within one month of receiving it, inform the data subject of the right to exercise his or her rights
on the measures taken in response to your request. This deadline is subject to the conditions laid down in the Regulation.
may be extended for a further two months. which must be communicated to the person concerned.
1.4. If the controller does not take action on the data subject's request, delay in taking action
without delay, but no later than one month after receipt of the request, inform the
the reasons for the failure to act and that the person concerned has complained about
to a supervisory authority and exercise your right of appeal to the courts.
1.5. The controller shall provide the information and inform the data subject of his or her rights and take action
free of charge, but a fee may be charged in the cases provided for in the Regulation.
The detailed rules can be found under Article 12 of the Regulation.
2. Right to be informed in advance – where personal data is collected from the data subject
2.1. The data subject has the right to obtain information and facts relating to the processing of personal data.
to be informed prior to the commencement of data processing. In this context, the
the person concerned must be informed:
1. a) the identity and contact details of the controller and its representative,
2. b) the contact details of the Data Protection Officer (if any),
3. c) the purposes for which the personal data are intended to be processed and the processing
legal basis,
4. d) in the case of processing based on legitimate interests, the controller or
the legitimate interests of third parties,
5. e) the recipients to whom the personal data are disclosed and the
categories of recipients, if any;
6. e) where applicable, the fact that the controller has moved to a third country or
intends to transfer personal data to an international organisation.
2.2 In order to ensure fair and transparent processing, the controller must.
provide the data subject with the following additional information:
1. a) the duration of the storage of the personal data or, where this is not possible, the
criteria for determining the duration;
2. b) the data subject's right to request the controller to provide him or her with the information concerning him or her
access, rectification, erasure or blocking of personal data
restrict the processing of personal data and object to the processing of such personal data,
and the data subject's right to data portability;
3. c) in the case of processing based on the data subject's consent, that the consent
at any time, without prejudice to the right to withdraw the
the lawfulness of the processing carried out on the basis of consent before its withdrawal;
4. d) the right to lodge a complaint with a supervisory authority;
5. e) that the provision of the personal data is based on a legal or contractual
is based on an obligation or is a precondition for the conclusion of a contract, and whether the
whether the data subject is obliged to provide the personal data, and the possible
the consequences of not providing the data;
6. f) the fact of automated decision-making, including profiling, and
at least in these cases, the logic used and the understandable
information on the significance of such processing and the impact of such processing on the data subject
what the expected consequences are.
2.3 If the controller further processes the personal data for purposes other than those for which they were collected, the controller may
wishes to carry out processing, before further processing, it must inform the
the data subject about this different purpose and any relevant additional information.
The detailed rules on the right to prior information are set out in Article 13 of the Regulation.
3. The information to be provided to the data subject and the information to be made available to him or her when the
personal data were not obtained by the controller from him or her
3.1. Where the data controller has not obtained the personal data from the data subject, the data subject shall be informed of
the data controller must, no later than one month from the date of collection of the personal data,
within; if the personal data are used for the purpose of contacting the data subject, at least
at the time of first contact with the data subject; or if it is likely to be communicated to another address
inform the data, at the latest when the personal data are first disclosed
the facts and information described in point 2 above and the personal data concerned.
categories, as well as the source of the personal data and, where applicable, whether the data
are from publicly available sources.
3.2 For further rules, see point 2 (Right to prior information) above.
governed by.
The detailed rules for this information are set out in Article 14 of the Regulation.
4. Right of access of the data subject
4.1 The data subject shall have the right to receive feedback from the controller on,
whether your personal data are being processed and, if so, whether such processing is taking place
is entitled to access the personal data and the related personal data described in points 2-3.
access to information (Article 15 of the Regulation).
4.2 If personal data is transferred to a third country or an international organisation
is transferred, the data subject shall have the right to be informed of the reasons for the transfer.
appropriate guarantees in accordance with Article 46 of the Regulation.
4.3. The controller shall provide the data subject with a copy of the personal data subject to the processing.
you must make available to. For any additional copies requested by the data subject, the controller shall contact.
charge a reasonable fee based on administrative costs.
Detailed rules on the right of access of the data subject are laid down in Article 15 of the Regulation.
included.
5. The right to rectification
5.1 The data subject shall have the right to obtain, at the request of the Controller without undue delay.
correct inaccurate personal data relating to him or her.
5.2. Taking into account the purposes of the processing, the data subject has the right to request the rectification of incomplete
to supplement personal data, including by means of a supplementary declaration.
These rules are set out in Article 16 of the Regulation.
6. Right to erasure („right to be forgotten”)
6.1 The data subject shall have the right to obtain, at his or her request and without undue delay, from the controller.
erase personal data relating to him or her, and the controller is obliged to ensure that the personal data
delete personal data concerning the data subject without undue delay if
1. a) the personal data are no longer necessary for the purposes for which they were
collected or otherwise treated;
2. b) the data subject withdraws his or her consent on the basis of which the data are processed, and the
there is no other legal basis for the processing;
3. c) the data subject objects to the processing and there is no overriding legitimate ground for the
reasons for the processing,
4. d) the personal data have been unlawfully processed;
5. e) the personal data in Union or Member State law applicable to the controller
must be deleted in order to comply with a legal obligation;
6. f) the collection of personal data offered directly to a child for the purpose of
in relation to the provision of social services.
6.2 The right to erasure may not be exercised if the processing is necessary
1. a) exercise of the right to freedom of expression and information
for the purposes of;
2. b) the obligation under Union or Member State law applicable to the controller
or in the public interest or in the exercise of official authority vested in the controller
in the exercise of its functions;
3. c) on the basis of public interest in the field of public health;
4. d) for archiving purposes in the public interest, scientific and historical research purposes or
for statistical purposes, where the right to erasure is unlikely to be possible
would make or seriously jeopardise that processing; or
5. e) to bring, enforce or defend legal claims.
Detailed rules on the right to erasure are set out in Article 17 of the Regulation.
7. The right to restriction of processing
7.1 Where the processing is restricted, such personal data, with the exception of storage, shall be
only with the consent of the data subject or for the establishment or exercise of legal claims
or to protect or defend the rights of another natural or legal person,
or in the important public interest of the Union or of a Member State.
7.2 The data subject shall have the right to obtain from the Controller, at his or her request, the restriction of processing if the processing is
one of the following is met:
1. a) the data subject contests the accuracy of the personal data, in which case the restriction is limited to the
for a period of time that allows the Controller to verify the
the accuracy of personal data;
2. b) the processing is unlawful and the data subject opposes the erasure of the data and requests instead
restrictions on their use;
3. c) the Controller no longer needs the personal data for the purposes of processing,
but the data subject needs them for the establishment or exercise of legal claims or
to protect; or
4. d) the data subject has objected to the processing; in this case, the restriction is limited to the
for a period until it is established that the controller has a legitimate interest in
whether his or her reasons take precedence over the legitimate grounds of the data subject.
7.3 The data subject shall be informed in advance of the lifting of the restriction on processing.
The relevant rules are set out in Article 18 of the Regulation.
8.
notification requirements relating to the restriction
The controller shall inform each recipient of any rectification, erasure or
the restriction of processing to whom or with which the personal data have been disclosed, unless this
proves impossible or requires disproportionate effort. At the request of the data subject, the
the controller shall inform those recipients.
These rules can be found under Article 19 of the Regulation.
9. The right to data portability
9.1 Subject to the conditions set out in the Regulation, the data subject shall have the right to obtain, in respect of the data
the personal data made available to the controller are disaggregated and widely used,
in a machine-readable format, and has the right to receive such data
to another controller without that controller preventing it,
to which you have provided the personal data, if
1. a) the processing is based on consent or on a contract; and
2. b) the processing is carried out by automated means.
9.2 The data subject may also request the direct transfer of personal data between data controllers.
9.3 The exercise of the right to data portability must not infringe Article 17 of the Regulation (Article 9.3).
the right to erasure („the right to be forgotten”). The right to data portability is not
applies where the processing is in the public interest or where the controller is subject to
for the performance of a task carried out in the exercise of its public powers
needed. This right must not adversely affect the rights and freedoms of others.
The detailed rules are set out in Article 20 of the Regulation.
10. The right to object
10.1. The data subject has the right, for reasons relating to his or her own situation, to request at any time
object to the processing of personal data in the public interest or in the performance of a public task (Article 6(1)(e)), or
processing based on legitimate interests (Article 6(f)), including on the provisions referred to above
based profiling. In this case, the data controller does not use the personal data
may continue to process it, unless the controller proves that the processing is
is justified by overriding legitimate grounds which override the legitimate interests of the person concerned
interests, rights and freedoms, or which have legal claims against
in connection with the submission, exercise or defence of your rights.
10.2 If the processing of personal data is carried out for direct marketing purposes, the data subject
has the right to object at any time to the processing of personal data concerning him or her for this purpose
including profiling, where it is necessary for the purposes of direct marketing
is linked to. If the data subject objects to the processing of their personal data for the purposes of direct marketing
the personal data may no longer be processed for these purposes.
10.3. These rights shall be expressly invoked at the latest at the time of the first contact with the data subject.
should be brought to its attention and the relevant information should be provided clearly and in all other
information should be displayed separately from the information.
10.4. The data subject has the right to object to automated processing based on technical specifications.
you can also practice with tools.
10.5. If the processing of personal data for scientific or historical research purposes or
for statistical purposes, the data subject shall have the right to obtain, in relation to his or her own situation
object to the processing of personal data relating to him or her on the grounds that such processing is unlawful, unless.
processing is necessary for the performance of a task carried out for reasons of public interest.
The relevant rules are set out in the Article of the Regulation.
11. Automated decision-making in individual cases, including profiling
11.1. The data subject has the right not to be subject to the processing of personal data
the scope of a decision based on processing, including profiling, which is
would have legal effects or would be similarly significantly affected.
11.2 This right does not apply if the decision:
1. a) the conclusion or performance of a contract between the data subject and the controller
necessary to;
2. b) is made by Union or Member State law applicable to the controller
which allows the rights and freedoms and legitimate interests of the data subject to be protected
also establish appropriate measures for its protection; or
3. c) is based on the explicit consent of the data subject.
11.3 In the cases referred to in points (a) and (c) above, the controller shall ensure that the following
take measures to protect the rights, freedoms and legitimate interests of the data subject
interests, including at least the right to obtain from the controller the rights of the data subject to obtain human
request intervention, express its views and object to the decision.
Further rules are set out in Article 22 of the Regulation.
12. Restrictions
Legislation of EU or Member State law applicable to the controller or processor
measures to restrict rights and obligations (Articles 12 to 22, 34, 5 and 6 of the Regulation).
Article 3) if the restriction respects the fundamental rights and freedoms of the person concerned.
content.
The conditions for this restriction are set out in Article 23 of the Regulation.
13. Informing the data subject of the personal data breach
13.1. If the data breach is likely to result in a high risk to the natural person
the rights and freedoms of individuals, the controller shall, without undue delay
must inform the data subject of the personal data breach. This information shall clearly and
clearly describe the nature of the personal data breach and provide at least the
the following:
1. a) the Data Protection Officer or other contact person providing further information
names and contact details;
2. c) describe the likely consequences of the data breach, including
consequences;
3. d) describe the steps taken by the controller to remedy the personal data breach or
planned measures, including, where appropriate, the measures to be taken as a result of the data breach
measures to mitigate any adverse consequences.
13.2 The data subject need not be informed if any of the following conditions are met:
1. a) the controller has implemented appropriate technical and organisational security measures
implemented and these measures are applied to the data affected by the data breach
have been applied, in particular measures such as the
the use of encryption - which are not used to access personal data
make the data unintelligible to authorised persons;
2. b) the controller has taken further measures following the personal data breach
which ensure that the rights and freedoms of the data subject are not subject to high
risk is no longer likely to materialise;
3. c) the information would require a disproportionate effort. In such cases the
data subjects must be informed by means of publicly disclosed information or by means of
a similar measure should be taken to ensure that the persons concerned are equally effectively
information to.
Further provisions are set out in Article 34 of the Regulation.
14. The right to lodge a complaint with a supervisory authority (administrative redress)
right)
The data subject has the right to lodge a complaint with a supervisory authority - in particular with
your habitual residence, place of work or place of the alleged infringement
in a Member State - where the data subject considers that the processing of personal data relating to him or her
is in breach of the Regulation. The supervisory authority to which the complaint was submitted is obliged to
inform the customer of procedural developments concerning the complaint and its
the outcome, including whether the customer has the right to a judicial remedy.
These rules are set out in Article 77 of the Regulation.
Contact details of the supervisory authority:
National Authority for Data Protection and Freedom of Information
Office: 1125 Budapest Szilágyi Erzsébet fasor 22/c.
Postal address:1530 Budapest, Pf.: 5.
Phone number: +36 (1) 391-1400
Central e-mail address: ugyfelszolgalat@naih.hu
15. Right to an effective judicial remedy against the supervisory authority
15.1 Without prejudice to other administrative or non-judicial remedies,
all natural and legal persons have the right to an effective judicial remedy against the surveillance
against a legally binding decision by a public authority which applies to him or her.
15.2 Without prejudice to other administrative or non-judicial remedies,
all data subjects have the right to an effective judicial remedy if the competent supervisory authority
does not deal with the complaint or does not inform the person concerned within three months of the
procedural developments or the outcome of a complaint.
15.3. Proceedings against the supervisory authority shall be brought by the supervisory authority
must be brought before a court in a Member State.
15.4 If proceedings are brought against a decision of a supervisory authority in relation to which
the Board has previously issued an opinion under the consistency mechanism, or
a decision, the supervisory authority is obliged to submit this opinion or decision to the court
to send.
These rules are set out in Article 78 of the Regulation.
16. Effective judicial remedies against the controller or processor
right to legal redress
16.1. Administrative or non-judicial remedies available -
including the right to lodge a complaint with a supervisory authority, without prejudice to any
the data subject is entitled to an effective judicial remedy if he or she considers that the personal data
have been found to have infringed this Regulation as a result of the processing of their data in breach of this Regulation
rights under.
16.2 Proceedings against the controller or processor may be brought by the controller or processor against the
must be brought before the courts of the Member State where the data processor is established. Such
proceedings may be brought in the courts of the Member State of habitual residence
except where the controller or processor is a data controller or processor of a Member State with public authority.
a public authority acting in its capacity as a public authority.
These rules are set out in Article 79 of the Regulation.
Celt: Orosháza, 2026. 04. 14.
