INTRODUCTION

Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Regulation 95/46/EC (hereinafter: the “Regulation”) requires the Controller to take appropriate measures to provide the Data Subject with all information relating to the processing of personal data in a concise, transparent, intelligible and easily accessible form, using clear and plain language, and to facilitate the exercise of the Data Subject’s rights.

The obligation to provide prior information to the Data Subject is also rescribed by Act CXII of 2011 on Informational Self-Determination and Freedom of Information. By providing the information set out below, we fulfil this statutory
obligation.

This notice shall be published on the Company’s website or, upon request, sent to the Data Subject.

CHAPTER 1 – IDENTIFICATION OF THE CONTROLLER

The issuer of this notice, and at the same time the Controller, is:
Company name: Water K Zrt.
Registered office: 5900 Orosháza Kossuth Lajos u. 34.
Tax number: 32737411-2-04.
Company registration number: 04-10-001675.
Represented by: Jámbor Rudolf
Contact: e-mail address: info@waterk.hu
Bank account number: 1041 0400 0000 0190 0649 8070.

(hereinafter: the “Company”)

BACKGROUND TO DATA PROCESSING

(“general section”)

Why was this notice prepared?

In the course of its operations, the Controller processes personal data for several purposes and intends to do so while respecting the rights of Data Subjects and complying with its statutory obligations. The Controller also considers it important to explain to Data Subjects how personal data that come to its knowledge during its data-processing activities are processed and what the main characteristics of such processing are. 

On what basis are Data Subjects’ personal data processed?

Personal data are processed only for specified purposes and on an appropriate legal basis. These purposes and legal
bases are described below in relation to the individual processing activities.

Who processes your personal data?

Part I of this Privacy Notice provides the Data Subject with information on the identity and contact details of the applicable Processors.

What external assistance is used in the processing of your personal data?

Personal data are generally processed by the Controller at its own premises. However, for certain operations we use external assistance and engage Processors. The identity of the Processor may vary depending on the characteristics of the individual processing activity.

What principles does the Controller consider important when processing your personal data?

Personal data are processed in accordance with the applicable legal rules, with particular regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR).

In operating the webshop, only the personal data specified for the individual processing activities are processed, and the security of the personal data provided is protected by the possible and necessary technical and organisational measures. Particular attention is paid to ensuring the confidentiality, integrity and availability of personal data.

Following the provision of personal data by you, the Controller is responsible for their authenticity and accuracy. Terms used in this notice are interpreted in accordance with the definitions set out in the legislation on informational self
determination and in the GDPR.

What rights do you have in relation to personal data processed by the Controller?

The Controller ensures that Data Subjects can exercise the rights set out in the GDPR. The Controller may not refuse a request to exercise such rights unless it demonstrates that it is not in a position to identify the Data Subject. The Data Subject must therefore identify himself or herself to enable the request to be fulfilled.

The Controller shall act on the request without undue delay and, at the latest, within 1 month of receipt, or shall inform the Data Subject of any obstacle to or delay in compliance. In such a case, the time limit may be extended by a further 2 months, provided that the Data Subject is informed of the extension and the reasons for it within 1 month.

The Controller shall respond to the Data Subject’s request in the same form in which it was received. The Data Subject may also submit the request electronically, in which case the response will also be provided electronically unless the Data Subject expressly requests otherwise.

To ensure the rights of Data Subjects, the rights set out in this notice may be exercised free of charge and the Controller will therefore not charge a fee, unless the request is manifestly unfounded or excessive, in particular because of its repetitive character. If and to the extent that the requested action or information is excessive or manifestly unfounded, the Controller may charge a reasonable fee for compliance (in particular to cover the increased administrative costs of excessive requests) or may refuse to act on the request. In such a case, the Controller is required to provide reasons to the Data Subject.

In accordance with the GDPR, Data Subjects may exercise the rights specified in Chapter V.

CHAPTER 2 – IDENTIFICATION OF PROCESSORS

Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller (Article 4(8) of the Regulation).

The prior consent of the Data Subject is not required for the engagement of a Processor, but the Data Subject must be informed. Accordingly, we provide the following information:

Our Processor: employees of the Controller performing customer service activities.

Marketing partner:

Instant Fun Kft.
6800 Hódmezővásárhely, Tulipán utca 8.
Tax number: 27549711-1-06

Hosting provider
1. Rackhost.hu
Operator: Rackhost Zrt.
Contact: www.rackhost.hu, info@rackhost.hu, +3614451200.
Address: 1132 Budapest, Victor Hugo utca 18-22.
Registered office: 6722 Szeged, Tisza Lajos körút 41.
Tax number: 25333572-2-06.
Company registration number: 06-10-000489.
Bank account number: 10700433-67330115-51100005.

Analysis and marketing services for marketing purposes:

2. Google Analytics
• Name: Google LLC
• Registered office: 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States of America
• Contact: https://support.google.com/
• Website: www.google.com
3. YouTube
• Name: Google LLC
• Registered office: 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States of America
• Contact: https://support.google.com/
• Website: www.youtube.com
Page 2
4. Facebook
• Name: Facebook Ireland Ltd
• Registered office: 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland
• Contact: https://www.facebook.com/privacy/explanation
• Website: www.facebook.com
5. MailChimp
• Name: The Rocket Science Group, LLC
• Registered office: 675 Ponce de Leon Ave NE Suite 5000 Atlanta, GA 30308 USA
• Contact: https://mailchimp.com/contact/
• Website: www.mailchimp.com
6. Benchmark
• Name: Benchmark Internet Group, LLC
• Registered office: 5500 Bolsa Avenue, Suite 245, Huntington Beach, CA 92649, USA
• Contact: https://www.benchmarkemail.com/contact/
• Website: https://www.benchmarkemail.com
7. Árukereső
• Name: Online Comparison Shopping Kft.
• Registered office: 1074 Budapest, Rákóczi út 70-72.
• Contact: https://www.arukereso.hu/static/elerhetosegeink.html
• Website: https://www.arukereso.hu/
8. Árgép
• Name: guenstiger.de GmbH
• Registered office: Deichstraße 34, D-20459 Hamburg, Germany
• Contact: https://www.argep.hu/content_impresszum.html
• Website: https://www.argep.hu

 

Accountant:

Kiss-Tax Könyvelőház Kft.
5900 Orosháza, Könd utca 7.
Tax number: 27765616-1-04
Company registration number: 04 09 016311

Operator of the billing software:

Triklon-IT Kft.
Registered office: 6800 Hódmezővásárhely, Tulipán u. 8.
Tax number: 13171960-2-06

Bank processing online/card payments:

K&H Bank Nyrt.
Registered office: 1095 Budapest, Lechner Ödön fasor 9.

Courier services:

Magyar Posta Zrt. – MPL
Registered office: 1138 Budapest, Dunavirág utca 2-6.
Tax number: 10901232-2-44

GLS General Logistics Systems Hungary Csomag-Logisztikai Kft.
Registered office: 2351 Alsónémedi, GLS Európa u. 2.
Tax number: 12369410-2-44

FoxPost Zrt.
Registered office: Hungary, 3200 Gyöngyös, Batsányi utca 9.
Tax number: 25034644-2-10

CHAPTER 3 – ENSURING THE LAWFULNESS OF DATA PROCESSING

(“individual section”)

1. Processing based on the Data Subject’s consent

1.1. If the Company intends to carry out processing based on consent, the Data Subject’s consent to the processing of personal data must be requested with the content and information specified in the data request form provided for in the data-processing policy.

1.2. Consent is also deemed to have been given if, when viewing the company’s website or webshop, the Data Subject ticks a relevant box, makes relevant technical settings when using information society services, or makes any other statement or takes any other action which, in the given context, clearly indicates the Data Subject’s consent to the intended processing of his or her personal data. Silence, a pre-ticked box or inactivity therefore does not constitute consent.

1.3. Consent covers all processing activities carried out for the same purpose or purposes. If the processing serves several purposes at the same time, consent must be given for all processing purposes.

1.4. If the Data Subject gives consent as part of a written declaration that also concerns other matters – for example, the conclusion of a sales or service contract – the request for consent must be presented in a manner clearly distinguishable from those other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration containing the Data Subject’s consent that infringes the Regulation shall not be binding.

1.5. The Company may not make the conclusion or performance of a contract conditional on consent to the processing of personal data that are not necessary for the performance of that contract.

1.6. It must be as easy to withdraw consent as it is to give it.

1.7. Where personal data have been collected with the consent of the Data Subject, the Controller may, unless otherwise provided by law, continue to process the collected data without further separate consent for the purpose of complying with a legal obligation applicable to it, including after the Data Subject has withdrawn consent.

During registration, for the purposes of providing information, requesting information and requesting a quotation, the Controller processes, on the basis of the natural person’s written consent (given by ticking a checkbox on the website), the natural person’s e-mail address, name, telephone number, IP address, postal code, postal address (street, house number), and delivery address.

2. Processing based on compliance with a legal obligation

2.1. In the case of processing based on a legal obligation, the scope of data that may be processed, the purpose of processing, the retention period and the recipients are governed by the provisions of the underlying legislation.

2.2. Processing based on compliance with a legal obligation is independent of the Data Subject’s consent because the processing is determined by law. Before the processing begins, the Data Subject must be informed that the processing is mandatory and must also be clearly and fully informed of all facts relating to the processing of his or her data, in particular the purpose and legal basis of the processing, the persons authorised to carry out the processing and
processing operations, the duration of the processing, whether the Controller processes the Data Subject’s personal data on the basis of a legal obligation applicable to it, and who may have access to the data. The information must also cover the Data Subject’s rights and remedies in relation to the processing. In the case of mandatory processing, the information may also be provided by publishing a reference to the statutory provisions containing the above information.

3. Processing based on legitimate interests

3.1. A legitimate interest of the Company or a third party may provide a legal basis for processing, provided that such interest is not overridden by the interests, fundamental rights and freedoms of the Data Subject. The reasonable expectations of the Data Subject based on his or her relationship with the Controller must be taken into account; accordingly, processing personal data for contact purposes, including direct marketing, may also be regarded as being based on legitimate interests.

3.2. Processing based on legitimate interests requires a balancing test. In relation to processing carried out in the Company’s interests, the balancing tests performed separately concluded as follows: taking into account the conditions described for the relevant processing, the Company concluded that the processing is justified subject to the appropriate safeguards set out in this policy, since without it the Company would not be able to operate competitively. In this light, the emotional impact on Data Subjects and the interference with the right to privacy may be regarded as proportionate.

4. Information on the processing of customer data, contracting partners and contact persons.

4.1. On the legal basis of performance of a contract, for the purposes of preparing, concluding, performing and terminating the contract and granting contractual discounts – in summary, supporting economic processes arising within the parties’ common sphere of interest – the Company may process the name, birth name, date and place of birth, mother’s name, home address, tax number, identity card number, registered office and business premises address, telephone number, e-mail address, bank account number, customer number (client number, order number), online identifier (lists of customers and suppliers, regular-customer lists), encrypted password and dietetic profile (individual food sensitivity, type of diet followed, objectives to be achieved through the diet) of a natural person who is in a contractual relationship with it. Such processing is also lawful where the processing is necessary in order to take steps at the request of the Data Subject prior to entering into a contract. Recipients of the personal data: employees of the Company performing customer-service, accounting, taxation, sales and logistics tasks, and its Processors. The retention period for personal data is 5 years after performance of the contract.

4.2. The legal basis for processing, for accounting and taxation purposes, the data provided in the contract by a natural person contracting party is compliance with a legal obligation; in this context, the retention period is 8 years.

4.3. The Company processes, on the legal basis of performance of a contract, the personal data provided in the contract of a natural person acting on behalf of a legal person contracting with the Company – who signs the contract – as well as his or her home address, e-mail address, telephone number and online identifier, for the purposes of preparing the contract, maintaining contact, and exercising rights and obligations arising from the contract – in summary, supporting economic processes arising within the parties’ common sphere of interest. The retention period for these data is 5 years after termination of the contract. Where processing is based on legitimate interests, the Data Subject has the important right to object to the processing.

4.4. The Company processes, on the legal basis of performance of a contract, the name, address, telephone number, email address and online identifier of a natural person designated as a contact person – but not a signatory – in a contract concluded with the Company, for the purposes of maintaining contact and exercising rights and obligations arising from the contract – in summary, supporting economic processes arising within the parties’ common sphere of interest – taking into account that the contact person has an employment-related legal relationship with the contracting party and therefore this processing does not adversely affect the Data Subject’s rights. The contracting party declares that it has informed the relevant contact person of the processing associated with acting as a contact person. The retention period
for these data is 5 years after the contact-person status ceases.

4.5. For all Data Subjects, the recipients of personal data are: the Company’s managing director, employees performing customer-service tasks, contact persons, employees performing accounting, taxation and sales tasks, and Processors.

4.6. Personal data may be transferred for processing, for taxation and accounting purposes, to the accounting firm and marketing partner commissioned by the Company.

4.7. Processing is lawful where it is necessary in the context of a contract or an intention to conclude a contract (Recital 44), or where it is necessary in order to take steps at the request of the Data Subject prior to entering into a contract
(Article 6(1)(b)). Accordingly, on the legal basis of performance of a contract, personal data collected in the context of contractual offers may also be processed as described in this point. When an offer is made or received, the Company must inform the offeror or the recipient of the offer accordingly.

5. Information on processing based on compliance with a legal obligation

5.1. In the case of processing based on a legal obligation, the scope of data that may be processed, the purpose of processing, the retention period and the recipients are governed by the provisions of the underlying legislation.

5.2. Processing based on compliance with a legal obligation is independent of the Data Subject’s consent because the processing is determined by law. Before the processing begins, the Data Subject must be informed that the processing is mandatory and must also be clearly and fully informed of all facts relating to the processing of his or her data, in particular the purpose and legal basis of the processing, the persons authorised to carry out the processing and
processing operations, the duration of the processing, whether the Controller processes the Data Subject’s personal data on the basis of a legal obligation applicable to it, and who may have access to the data. The information must also cover the Data Subject’s rights and remedies in relation to the processing. In the case of mandatory processing, the information may also be provided by publishing a reference to the statutory provisions containing the above information.

6. Information on processing for compliance with tax and accounting obligations

6.1. On the legal basis of compliance with a legal obligation, for the purpose of fulfilling statutory tax and accounting obligations (bookkeeping, taxation), the Company processes data prescribed by law relating to natural persons entering into a business relationship with it. The processed data include in particular, pursuant to Sections 169 and 202 of Act CXXVII of 2017 on Value Added Tax: tax number, name, address, tax status; and pursuant to Section 167 of Act C of 2000 on Accounting: name, address, identification of the person or organisation ordering the economic transaction, the person authorising it and the person certifying execution of the instruction, and, depending on the organisation, the signature of the controller; on stock-movement and cash-management documents, the signature of the recipient, and on counter-receipts, the signature of the payer; and pursuant to Act CXVII of 1995 on Personal Income Tax: tax identification number.

6.2. The retention period for personal data is 8 years after termination of the legal relationship forming the legal basis.

6.3. Recipients of personal data: employees and Processors of the Company performing taxation, accounting, payroll and social-security tasks.

7. Processing to protect the vital interests of the Data Subject or another natural person

7.1. Protection of the life or other vital interests of the Data Subject or of another natural person may also provide a legal basis for processing. Such a case may arise for a natural person where he or she receives healthcare services or where processing is carried out to stop the spread of epidemics.

8. Information on processing of documents of permanent value under the Archives Act

8.1. On the legal basis of compliance with a legal obligation, the Company processes documents qualifying as being of permanent value under Act LXVI of 1995 on Public Records, Public Archives and the Protection of Private Archives (Archives Act), for the purpose of ensuring that the permanently valuable part of the Company’s archival material is preserved intact and in a usable condition for future generations. Retention period: until transfer to the public archives.

8.2. Recipients of personal data: the head of the Company, the employee responsible for records management and archiving, and an employee of the public archives.

9. Facilitating the exercise of the Data Subject’s rights

9.1. In all of its processing activities, the Company is required to ensure that the Data Subject can exercise his or her rights.

CHAPTER 4 – VISITOR DATA PROCESSING ON THE COMPANY’S WEBSITE – INFORMATION ON THE USE OF COOKIES

1. Information and consent regarding cookies

Visitors to the website must be informed on the website about the use of cookies and, with the exception of technically strictly necessary session cookies, their consent must be requested.

2. General information on cookies

2.1. A cookie is data sent by a visited website to the visitor’s browser (in variable-name/value form) so that the browser stores it and the same website can later retrieve its content. A cookie may have an expiry period, which may last until the browser is closed or may be unlimited. In subsequent HTTP(S) requests, the browser also sends these data to the server. In this way, data stored on the user’s computer are modified.

2.2. By their nature, modern website services require cookies. Their function is to mark a user (for example, to indicate that the user is logged in), to handle the user accordingly and, if applicable, identify the user on a later return. The risk lies in the fact that the user is not always aware of this and cookies may enable the website operator or another service provider whose content is embedded in the site (e.g. Facebook, Google Analytics) to track the user and create a profile; in such a case the content of the cookie may be considered personal data.

2.3. Types of cookies:

2.3.1. Technically strictly necessary session cookies: without these the site simply would not function. They are necessary to identify the user, for example to manage whether the user is logged in, what has been placed in the cart,
etc. Typically, a session ID is stored and the other data are stored on the server, which is more secure. There is also a security aspect: if the value of the session cookie is not generated properly, there is a risk of a session-hijacking attack, so it is essential that these values be generated properly. In other terminology, all cookies that are deleted when the browser is closed are called session cookies (a session being a browser-use period from opening to closing the browser).

2.3.2. Functionality cookies: this term is generally used for cookies that remember the user’s choices, for example how the user wishes to view the site. These types of cookies essentially contain settings data stored in the cookie.

2.3.3. Performance cookies: although they have little to do with “performance”, this is the term generally used for cookies that collect information about the user’s behaviour within the visited website, time spent there and clicks. These
are typically third-party applications (e.g. Google Analytics, AdWords or Yandex.ru cookies). They can be used to create a profile of the visitor.
Information about Google Analytics cookies is available here:
https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usageInformation about Google AdWords cookies is available here:
https://support.google.com/adwords/answer/2407785?hl=hu

2.4. You are not required to accept or enable the use of cookies. You can change your browser settings to reject all cookies or to indicate when the system is sending a cookie. Most browsers automatically accept cookies by default, but these settings can generally be changed to prevent automatic acceptance.Information about cookie settings in the most popular browsers is available at the following links:

• Google Chrome: https://support.google.com/accounts/answer/61416?hl=hu

• Firefox: https://support.mozilla.org/hu/kb/sutik-engedelyezese-es-tiltasa-amit-weboldak-haszn

• Microsoft Internet Explorer 11: http://windows.microsoft.com/hu-hu/internet-explorer/delete-manage-cookies#ie=ie-11

• Microsoft Internet Explorer 10: http://windows.microsoft.com/hu-hu/internet-explorer/delete-managecookies#ie=ie-10-win-7

• Microsoft Internet Explorer 9: http://windows.microsoft.com/hu-hu/internet-explorer/delete-manage-cookies#ie=ie-9

• Microsoft Internet Explorer 8: http://windows.microsoft.com/hu-hu/internet-explorer/delete-manage-cookies#ie=ie-8

• Microsoft Edge: http://windows.microsoft.com/hu-hu/windows-10/edge-privacy-faq

• Safari: https://support.apple.com/hu-hu/HT201265

Nevertheless, please note that certain website functions or services may not operate properly without cookies.

3. Information on cookies used on the Company’s website and data generated during visits

3.1. Data processed during a visit: when the Company’s website is used, the website may record and process the
following data about the visitor and the device used for browsing:
• the IP address used by the visitor;
• browser type;
• characteristics of the operating system of the device used for browsing (configured language);
• date and time of the visit;
• the visited (sub)page, function or service;
• clicks.
These data are retained for a maximum of 90 days and may primarily be used to investigate security incidents.
3.2. Cookies used on the website
3.2.1. Technically strictly necessary session cookies:
Purpose of processing: to ensure the proper operation of the website. These cookies are necessary so that visitors can
browse the website and use its functions and the services available through the website smoothly and fully, including, in
particular, remembering actions performed by the visitor on particular pages or identifying a logged-in user during a visit.
The duration of processing by these cookies is limited to the visitor’s current visit; at the end of the session or when the
browser is closed, this type of cookie is automatically deleted from the visitor’s computer.
The legal basis for this processing is Section 13/A(3) of Act CVIII of 2001 on certain issues of electronic commerce
services and information society services (E-Commerce Act), according to which the service provider may process
personal data that are technically indispensable for providing the service. Where the other conditions are the same, the
service provider must select and in every case operate the tools used in providing an information-society service in such
a way that personal data are processed only where strictly necessary for providing the service and fulfilling the other
purposes specified in that Act, and even then only to the extent and for the time necessary.
3.2.1. Functionality cookies:
These remember the user’s choices, for example how the user wishes to view the site. These types of cookies
essentially contain settings data stored in the cookie.
Legal basis of processing: the visitor’s consent.
Purpose of processing: to improve the effectiveness of the service, improve the user experience and make use of the
website more convenient.
These data are typically stored on the user’s computer; the website merely accesses them and may recognise the visitor
through them.
3.2.2. Performance cookies:
These collect information about the user’s behaviour within the visited website, time spent there and clicks.
Legal basis of processing: the Data Subject’s consent.
Purpose of processing: analysis of the website and sending advertising offers.
CHAPTER 5 – INFORMATION ON THE RIGHTS OF THE DATA SUBJECT
Rights of the Data Subject – summary
1. Transparent information, communication and facilitation of the exercise of the Data Subject’s rights
2. Right to prior information – where personal data are collected from the Data Subject
3. Information to be provided to the Data Subject where personal data have not been obtained from the Data Subject
4. Right of access by the Data Subject
Page 7
5. Right to rectification
6. Right to erasure (“right to be forgotten”)
7. Right to restriction of processing
8. Notification obligation regarding rectification or erasure of personal data or restriction of processing
9. Right to data portability
10. Right to object
11. Automated individual decision-making, including profiling
12. Restrictions
13. Communication of a personal data breach to the Data Subject
14. Right to lodge a complaint with a supervisory authority (right to administrative remedy)
15. Right to an effective judicial remedy against a supervisory authority
16. Right to an effective judicial remedy against the Controller or Processor
Rights of the Data Subject – detailed provisions
1. Transparent information, communication and facilitation of the exercise of the Data Subject’s
rights
1.1. The Controller must provide the Data Subject with all information and communications relating to the processing of
personal data in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in
particular for any information specifically addressed to a child. The information shall be provided in writing or by other
means, including, where appropriate, by electronic means. At the request of the Data Subject, the information may be
provided orally, provided that the identity of the Data Subject has been proven by other means.
1.2. The Controller must facilitate the exercise of the Data Subject’s rights.
1.3. The Controller shall provide the Data Subject with information on action taken on a request to exercise his or her
rights without undue delay and in any event within one month of receipt of the request. Under the conditions set out in
the Regulation, this period may be extended by a further two months, of which the Data Subject must be informed.
1.4. If the Controller does not take action on the Data Subject’s request, it shall inform the Data Subject without delay
and at the latest within one month of receipt of the request of the reasons for not taking action and of the possibility of
lodging a complaint with a supervisory authority and seeking a judicial remedy.
1.5. The Controller provides the information and communications concerning the Data Subject’s rights, and actions
taken, free of charge; however, a fee may be charged in the cases specified in the Regulation.
The detailed rules are contained in Article 12 of the Regulation.
2. Right to prior information – where personal data are collected from the Data Subject
2.1. The Data Subject has the right to receive information about the facts and circumstances relating to the processing
before the processing begins. In this context, the Data Subject must be informed of:
• a) the identity and contact details of the Controller and, where applicable, its representative;
• b) the contact details of the data protection officer, where applicable;
• c) the purposes of the intended processing of personal data and the legal basis for the processing;
• d) where processing is based on legitimate interests, the legitimate interests pursued by the Controller or by a third
party;
• e) the recipients of the personal data – those to whom the personal data are disclosed – or the categories of
recipients, if any;
• e) where applicable, the fact that the Controller intends to transfer personal data to a third country or international
organisation.
2.2. To ensure fair and transparent processing, the Controller must provide the Data Subject with the following additional
information:
• a) the period for which the personal data will be stored, or, if this is not possible, the criteria used to determine that
period;
• b) the Data Subject’s right to request from the Controller access to and rectification or erasure of personal data
concerning him or her, or restriction of processing, and the right to object to such processing, as well as the right to
data portability;
• c) where processing is based on the Data Subject’s consent, the right to withdraw consent at any time, without
affecting the lawfulness of processing based on consent before its withdrawal;
• d) the right to lodge a complaint with a supervisory authority;
Page 8
• e) whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to
enter into a contract, whether the Data Subject is obliged to provide the personal data, and the possible
consequences of failure to provide such data;
• f) the existence of automated decision-making, including profiling, and, at least in those cases, meaningful
information about the logic involved, as well as the significance and the envisaged consequences of such
processing for the Data Subject.
2.3. Where the Controller intends to further process the personal data for a purpose other than that for which the
personal data were collected, it shall, prior to that further processing, provide the Data Subject with information on that
other purpose and with any relevant further information.
The detailed rules on the right to prior information are contained in Article 13 of the Regulation.
3. Information to be provided to the Data Subject where personal data have not been obtained
from the Data Subject
3.1. Where the Controller has not obtained the personal data from the Data Subject, the Controller must provide the Data
Subject with the facts and information referred to in point 2 above, as well as the categories of personal data concerned,
the source from which the personal data originate and, where applicable, whether they came from publicly accessible
sources: at the latest within one month after obtaining the personal data; if the personal data are to be used for
communication with the Data Subject, at the latest at the time of the first communication with the Data Subject; or, if
disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed.
3.2. The further rules set out in point 2 above (Right to prior information) apply.
The detailed rules governing this information are contained in Article 14 of the Regulation.
4. Right of access by the Data Subject
4.1. The Data Subject has the right to obtain from the Controller confirmation as to whether or not personal data
concerning him or her are being processed and, where that is the case, access to the personal data and to the related
information referred to in points 2-3 above (Article 15 of the Regulation).
4.2. Where personal data are transferred to a third country or international organisation, the Data Subject has the right to
be informed of the appropriate safeguards pursuant to Article 46 of the Regulation relating to the transfer.
4.3. The Controller shall provide the Data Subject with a copy of the personal data undergoing processing. For any
further copies requested by the Data Subject, the Controller may charge a reasonable fee based on administrative costs.
The detailed rules on the Data Subject’s right of access are contained in Article 15 of the Regulation.
5. Right to rectification
5.1. The Data Subject has the right to obtain from the Controller without undue delay the rectification of inaccurate
personal data concerning him or her.
5.2. Taking into account the purposes of the processing, the Data Subject has the right to have incomplete personal data
completed, including by means of providing a supplementary statement.
These rules are contained in Article 16 of the Regulation.
6. Right to erasure (“right to be forgotten”)
6.1. The Data Subject has the right to obtain from the Controller the erasure of personal data concerning him or her
without undue delay, and the Controller is obliged to erase personal data concerning the Data Subject without undue
delay where one of the following grounds applies:
• a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise
processed;
• b) the Data Subject withdraws the consent on which the processing is based and there is no other legal ground for
the processing;
• c) the Data Subject objects to the processing and there are no overriding legitimate grounds for the processing;
• d) the personal data have been unlawfully processed;
• e) the personal data must be erased for compliance with a legal obligation in Union or Member State law to which the
Controller is subject;
• f) the personal data have been collected in relation to the offer of information society services directly to a child.
6.2. The right to erasure does not apply where processing is necessary:
• a) for exercising the right of freedom of expression and information;
• b) for compliance with a legal obligation under Union or Member State law to which the Controller is subject, or for the
performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;
• c) for reasons of public interest in the area of public health;
Page 9
• d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes,
insofar as the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of
that processing; or
• e) for the establishment, exercise or defence of legal claims.
The detailed rules on the right to erasure are contained in Article 17 of the Regulation.
7. Right to restriction of processing
7.1. Where processing has been restricted, such personal data shall, with the exception of storage, be processed only
with the Data Subject’s consent or for the establishment, exercise or defence of legal claims, for the protection of the
rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.
7.2. The Data Subject has the right to obtain restriction of processing from the Controller where one of the following
applies:
• a) the accuracy of the personal data is contested by the Data Subject, for a period enabling the Controller to verify
the accuracy of the personal data;
• b) the processing is unlawful and the Data Subject opposes the erasure of the personal data and requests restriction
of their use instead;
• c) the Controller no longer needs the personal data for the purposes of the processing, but they are required by the
Data Subject for the establishment, exercise or defence of legal claims; or
• d) the Data Subject has objected to processing, pending verification of whether the legitimate grounds of the
Controller override those of the Data Subject.
7.3. The Data Subject shall be informed before the restriction of processing is lifted.
The applicable rules are contained in Article 18 of the Regulation.
8. Notification obligation regarding rectification or erasure of personal data or restriction of
processing
The Controller shall communicate any rectification or erasure of personal data or restriction of processing to each
recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate
effort. The Controller shall inform the Data Subject about those recipients if the Data Subject requests it.
These rules are contained in Article 19 of the Regulation.
9. Right to data portability
9.1. Under the conditions set out in the Regulation, the Data Subject has the right to receive the personal data
concerning him or her which he or she has provided to a Controller in a structured, commonly used and machine
readable format, and has the right to transmit those data to another Controller without hindrance from the Controller to
which the personal data have been provided, where:
• a) the processing is based on consent or on a contract; and
• b) the processing is carried out by automated means.
9.2. The Data Subject may also request direct transmission of personal data between Controllers.
9.3. The exercise of the right to data portability shall be without prejudice to Article 17 of the Regulation (Right to erasure
(“right to be forgotten”)). The right to data portability shall not apply where the processing is necessary for the
performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller. This
right shall not adversely affect the rights and freedoms of others.
The detailed rules are contained in Article 20 of the Regulation.
10. Right to object
10.1. The Data Subject has the right to object, on grounds relating to his or her particular situation, at any time to the
processing of personal data concerning him or her based on the public interest/performance of a public task (Article 6(1)
(e)) or legitimate interests (Article 6(1)(f)), including profiling based on those provisions. In such a case, the Controller
shall no longer process the personal data unless the Controller demonstrates compelling legitimate grounds for the
processing which override the interests, rights and freedoms of the Data Subject, or grounds for the establishment,
exercise or defence of legal claims.
10.2. Where personal data are processed for direct marketing purposes, the Data Subject has the right to object at any
time to the processing of personal data concerning him or her for such marketing, including profiling to the extent that it is
related to such direct marketing. Where the Data Subject objects to processing for direct marketing purposes, the
personal data shall no longer be processed for such purposes.
10.3. At the latest at the time of the first communication with the Data Subject, these rights must be explicitly brought to
the attention of the Data Subject and the relevant information must be presented clearly and separately from any other
information.
Page 10
10.4. The Data Subject may exercise the right to object by automated means using technical specifications.
10.5. Where personal data are processed for scientific or historical research purposes or statistical purposes, the Data
Subject has the right, on grounds relating to his or her particular situation, to object to the processing of personal data
concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public
interest.
The applicable rules are contained in an Article of the Regulation.
11. Automated individual decision-making, including profiling
11.1. The Data Subject has the right not to be subject to a decision based solely on automated processing, including
profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
11.2. This right does not apply if the decision:
• a) is necessary for entering into, or performance of, a contract between the Data Subject and the Controller;
• b) is authorised by Union or Member State law to which the Controller is subject and which also lays down suitable
measures to safeguard the Data Subject’s rights and freedoms and legitimate interests; or
• c) is based on the Data Subject’s explicit consent.
11.3. In the cases referred to in points a) and c) above, the Controller shall implement suitable measures to safeguard
the Data Subject’s rights and freedoms and legitimate interests, including at least the right to obtain human intervention
on the part of the Controller, to express his or her point of view and to contest the decision.
Further rules are contained in Article 22 of the Regulation.
12. Restrictions
Union or Member State law applicable to the Controller or Processor may, by way of legislative measures, restrict the
scope of rights and obligations (Articles 12-22, Article 34 and Article 5 of the Regulation), provided that the restriction
respects the essence of fundamental rights and freedoms.
The conditions for such restrictions are contained in Article 23 of the Regulation.
13. Communication of a personal data breach to the Data Subject
13.1. Where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the
Controller shall communicate the personal data breach to the Data Subject without undue delay. This communication
shall describe in clear and plain language the nature of the personal data breach and shall contain at least the following
information:
• a) the name and contact details of the data protection officer or other contact point where more information can be
obtained;
• c) the likely consequences of the personal data breach;
• d) the measures taken or proposed to be taken by the Controller to address the personal data breach, including,
where appropriate, measures to mitigate its possible adverse effects.
13.2. Communication to the Data Subject is not required if any of the following conditions is met:
• a) the Controller has implemented appropriate technical and organisational protection measures, and those
measures were applied to the personal data affected by the personal data breach, in particular measures – such as
encryption – that render the personal data unintelligible to any person who is not authorised to access them;
• b) the Controller has taken subsequent measures following the personal data breach which ensure that the high risk
to the rights and freedoms of the Data Subject is no longer likely to materialise;
• c) communication would involve disproportionate effort. In such cases, the Data Subjects shall instead be informed by
means of publicly available information or a similar measure by which they are informed in an equally effective
manner.
Further rules are contained in Article 34 of the Regulation.
14. Right to lodge a complaint with a supervisory authority (right to administrative remedy)
The Data Subject has the right to lodge a complaint with a supervisory authority – in particular in the Member State of his
or her habitual residence, place of work or place of the alleged infringement – if the Data Subject considers that the
processing of personal data relating to him or her infringes the Regulation. The supervisory authority with which the
complaint has been lodged shall inform the complainant of the progress and outcome of the complaint, including the
possibility of a judicial remedy.
These rules are contained in Article 77 of the Regulation.
Contact details of the supervisory authority:
Nemzeti Adatvédelmi és Információszabadság Hatóság
Registered office: 1125 Budapest Szilágyi Erzsébet fasor 22/c.
Page 11
Postal address: 1530 Budapest, Pf.: 5.
Telephone: +36 (1) 391-1400
Central e-mail address: ugyfelszolgalat@naih.hu
15. Right to an effective judicial remedy against a supervisory authority
15.1. Without prejudice to any other administrative or non-judicial remedy, every natural or legal person has the right to
an effective judicial remedy against a legally binding decision of a supervisory authority concerning that person.
15.2. Without prejudice to any other administrative or non-judicial remedy, each Data Subject has the right to an effective
judicial remedy where the competent supervisory authority does not handle a complaint or does not inform the Data
Subject within three months of the progress or outcome of the complaint lodged.
15.3. Proceedings against a supervisory authority shall be brought before the courts of the Member State where the
supervisory authority is established.
15.4. Where proceedings are brought against a decision of a supervisory authority which was preceded by an opinion or
decision of the Board in the consistency mechanism, the supervisory authority shall forward that opinion or decision to
the court.
These rules are contained in Article 78 of the Regulation.
16. Right to an effective judicial remedy against the Controller or Processor
16.1. Without prejudice to any available administrative or non-judicial remedy – including the right to lodge a complaint
with a supervisory authority – each Data Subject has the right to an effective judicial remedy where he or she considers
that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in
non-compliance with the Regulation.
16.2. Proceedings against a Controller or Processor shall be brought before the courts of the Member State where the
Controller or Processor has an establishment. Such proceedings may also be brought before the courts of the Member
State where the Data Subject has his or her habitual residence, unless the Controller or Processor is a public authority of
a Member State acting in the exercise of its public powers.
These rules are contained in Article 79 of the Regulation.
Dated: Orosháza, 20 January 2025.