I. Data of the Data Controller

Name: Lénárt Barnabás sole proprietor

Registered office: Hungary, 2000 Szentendre, Barackvirág utca 1 D

Tax number: HU91970132

Registration number: 62180197

Representative: Lénárt Barna

Mailing address, complaint handling: Hungary, 2000 Szentendre, Barackvirág utca 1 D

E-mail: info@nandu-wrap.com

Phone number: +36304917775

Website: https://nandu-wrap.com

II. Description of data processing during the operation of the webshop and the performance of contracts

II.1. Contact

Content and purpose of data processing
Receiving your inquiry, answering the question and the necessary communication for this, for example, if you contact us with a question via email, contact form, or phone. Prior contact is not mandatory; you can place an order from the webshop at any time without it.

 

Processed data
The data you provide during contact.

 

Duration of data processing
We only process the data until the contact is concluded.

 

Legal basis for data processing
Your voluntary consent, which you give to the Data Controller by contacting them. [Data processing according to Article 6(1)(a) of the Regulation]

II.2. Registration on the website

Content and purpose of data processing
By storing the data provided during registration, the Data Controller can provide a more convenient service (e.g., the data of the data subject does not need to be re-entered for a new purchase). Registration is not a condition for concluding the contract.

 

Processed data
During data processing, the Data Controller processes your name, address, phone number, email address, characteristics of the purchased Product, and the date of purchase.

 

Duration of data processing
Until the withdrawal of your consent.

 

Legal basis for data processing
Your voluntary consent, which you give to the Data Controller by registering [Data processing according to Article 6(1)(a) of the Regulation]

II.3. Order processing

Content and purpose of data processing
Order processing, fulfillment, and communication related to the order (including sending notifications about order statuses, sending invoices) are carried out as data processing activities necessary for the performance of the contract.

 

Processed data
During data processing, the Data Controller processes your name, address, phone number, email address, characteristics of the purchased Product, order number, and the date of purchase.

 

Duration of data processing
We process the data for 5 years from the performance of the contract, according to the civil law statute of limitations.

 

Legal basis for data processing
Performance of the contract concluded with you as a buyer. [Data processing according to Article 6(1)(b) of the Regulation]

II.4. Issuing the invoice

Content and purpose of data processing

The data processing is carried out for the purpose of issuing an invoice in accordance with legal regulations and fulfilling the obligation to retain accounting documents. Pursuant to Section 169 (1)-(2) of Act C of 2000 on Accounting (hereinafter: Accounting Act), economic entities must retain accounting documents directly and indirectly supporting accounting records.

 

 

Processed data
Name, address.

 

Duration of data processing
Invoices issued must be retained for 8 years from the date of issue, in accordance with Section 169 (2) of the Accounting Act.

 

Legal basis for data processing

Fulfillment of a legal obligation. Pursuant to Section 159 (1) of Act CXXVII of 2007 on Value Added Tax, issuing an invoice is mandatory, and pursuant to Section 169 (2) of the Accounting Act, it must be retained for 8 years [data processing according to Article 6(1)(c) of the Regulation].

 

II.5. Data processing related to goods delivery

Content and purpose of data processing
Your order will be delivered to the address you provided, according to the shipping method you selected, with the help of our partners.

 

Processed data
Name, address, email address, phone number.

 

Duration of data processing
The Data Controller processes the data until the delivery of the ordered goods.

 

Legal basis for data processing
The legal basis for data processing is the performance of a contract [data processing according to Article 6(1)(b) of the Regulation].

II.6. Handling warranty and guarantee claims

Content and purpose of data processing
When handling warranty and guarantee claims, we must proceed according to the rules of NGM Decree 19/2014 (IV. 29.), which also specifies how to handle your claim.

 

Processed data

When handling warranty and guarantee claims, we must proceed according to the rules of NGM Decree 19/2014 (IV. 29.).

Based on the decree, we are obliged to draw up a record of any warranty or guarantee claim reported to us, which must include:

1. your name, address, and a statement that you consent to the processing of your data recorded in the record in accordance with the decree,
2. the name and purchase price of the movable property sold under the contract concluded between you and us,
3. the date of performance of the contract,
4. the date of reporting the defect,
5. a description of the defect,
6. the right you wish to assert based on your warranty or guarantee claim, and
7. the method of settling the warranty or guarantee claim or the reason for rejecting the claim or the right to be asserted based thereon.

If we receive the purchased Product from you, we must issue a receipt for it, which must include:

1. your name and address,
2. data necessary for identifying the item,
3. the date of receipt of the item, and
4. the date when you can collect the repaired item.

 

 

Duration of data processing
The business is obliged to retain the record of the consumer's warranty or guarantee claim for three years from the date of its creation, pursuant to Section 4 (6) of NGM Decree 19/2014 (IV. 29.), and to present it upon request of the supervisory authority.

 

Legal basis for data processing
The legal basis for data processing is compliance with legal obligations under NGM Decree 19/2014 (IV. 29.) [Section 4 (1) and (6), and Section 6 (1)] [data processing according to Article 6(1)(c) of the Regulation].

II.7. Handling other consumer protection complaints

Content and purpose of data processing

You have the option to file a consumer protection complaint. The purpose of data processing is to investigate, respond to, and document consumer protection complaints related to the webshop.

A consumer protection complaint is an objection (a complaint as defined in Section 2(28a) of Act CLV of 1997 on Consumer Protection) regarding the conduct, activity, or omission of us or a person acting on our behalf or in our interest, directly related to the distribution or sale of goods to you, aiming to remedy an individual violation of rights or interests.

If you have filed a complaint with us, data processing and the provision of data are essential for the investigation of the complaint.

 

 

Processed data

The record of the complaint must contain the following:

1. your name, address or email address,
2. the place, time, and method of submitting the complaint,
3. a detailed description of your complaint, a list of documents, papers, and other evidence submitted by you,
4. our statement on our position regarding your complaint, if an immediate investigation of the complaint is possible,
5. the signature of the person who took the record and – except for verbal complaints communicated by telephone or other electronic communication service – your signature,
6. the place and time of taking the record,
7. in the case of a verbal complaint communicated by telephone or other electronic communication service, the unique identification number of the complaint.

 

 

Duration of data processing
Pursuant to Section 17/A (7) of Act CLV of 1997 on Consumer Protection, we are obliged to retain the record of a verbal complaint or a written complaint, and a copy of the substantive reply to the complaint, for three years, and to present it upon request of the supervisory authority.

 

Legal basis for data processing
Whether you file a complaint with us is your voluntary decision, however, if you do, we are obliged to handle it in accordance with Section 17/A of Act CLV of 1997 on Consumer Protection [data processing according to Article 6(1)(c) of the Regulation].

II.8. Right of withdrawal/termination

Content and purpose of data processing
The purpose of data processing is to ensure the exercise of the right of withdrawal. The handling of the right of withdrawal (receiving the withdrawal/termination statement, identifying the relevant order or contract, processing and confirming the statement, managing affairs related to the withdrawal/termination, and later verifying the occurrence of the withdrawal/termination) involves the processing of data related to the contract concerned.

 

Processed data

In case of withdrawal and termination, we process your following data related to the withdrawal:

• Name,
• order or contract identification data,
• content of the withdrawal/termination statement,
• if you request a payment solution other than the one used at the time of payment for the refund of the product purchase price, data related to the refund (e.g., bank account number)

If you submit your withdrawal or termination statement using the withdrawal function under Government Decree 45/2014 (II. 26.), we also process the following technical data:

• exact date and time of submission and receipt of the statement,
• email address or other electronic contact data,
• data related to sending the confirmation of receipt of the withdrawal/termination statement.

 

 

Duration of data processing
The Data Controller processes personal data related to the withdrawal/termination statement and its processing and management until the end of 3 calendar years from the exercise of the right of withdrawal/termination. Data retention is based on the Data Controller's legitimate interest, pursuant to Article 6(1)(f) of the Regulation, to be able to prove the fact of handling the withdrawal and the measures taken in connection therewith in the event of a potential consumer protection or other administrative/judicial procedure.

 

Legal basis for data processing

The legal basis for data processing necessary for handling matters related to the exercise of the right of withdrawal/termination, termination of the contract, return, refund, and communication is Article 6(1)(b) of the Regulation, i.e., the performance of the contract concluded with the data subject, or the handling of matters related to its termination.

The legal basis for retaining personal data related to the exercise of the right of withdrawal, based on a legitimate interest in defending against consumer claims, is Article 6(1)(f) of the GDPR, i.e., the legitimate interest of the data controller.

 

II.9. Data processed in connection with the demonstrability of consent

Content and purpose of data processing
In case of data processing based on consent, especially during registration and newsletter subscription, the IT system stores IT data related to the consent for later demonstrability.

 

Processed data
Date of consent and the IP address of the data subject.

 

Duration of data processing
We process the data for the duration of the data processing related to the consent.

 

Legal basis for data processing
The consent of the data subject [data processing according to Article 6(1)(a) of the Regulation].

II.10. Data processing related to newsletter sending

Content and purpose of data processing
The data processing is carried out for the purpose of sending newsletters.

 

Processed data
Name, email address

 

Duration of data processing
Until the data subject withdraws their consent.

 

Legal basis for data processing
Your voluntary consent, which you give to the Data Controller by subscribing to the newsletter [data processing according to Article 6(1)(a) of the Regulation]

II.11. Data processing related to sending and displaying personalized advertisements

Content and purpose of data processing
When sending newsletters, we formulate personalized advertisements for you.

 

Processed data
Name, address, email address, phone number, data of previous purchases.

 

Duration of data processing
Until the withdrawal of your consent.

 

Legal basis for data processing
Your voluntary, specific consent, which you give to the Data Controller during data collection [data processing according to Article 6(1)(a) of the Regulation]

II.12. Sweepstakes

Content and purpose of data processing
To encourage purchases, we organize sweepstakes for customers and website visitors.

 

Processed data
Name, email address, phone number.

 

Duration of data processing
The data will be deleted after the sweepstakes is concluded, except for the winner's data, which the Data Controller is obliged to retain for 8 years based on the Accounting Act.

 

Legal basis for data processing
The legal basis for data processing is your voluntary consent. [Data processing according to Article 6(1)(a) of the Regulation]

III. Information on the use of cookies

III.1. What is a cookie?

During your visit to our website, the Data Controller uses so-called cookies. A cookie is a piece of information consisting of letters and numbers that our website sends to your browser with the aim of saving certain settings, facilitating the use of our website, and helping us collect some relevant, statistical information about our visitors.

Some cookies do not contain personal information and are not suitable for identifying individual users, but some of them contain a unique identifier – a secret, randomly generated number sequence – which is stored by your device, thus ensuring your identifiability. The operating duration of each cookie is included in the relevant description of each cookie.

You can also disable the operation of cookies in your browser settings; more information can be found at the following links:

• Internet Explorer: http://windows.microsoft.com/en-us/internet-explorer/delete-manage-cookies#ie=ie-11
• Firefox: https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer
• Mozilla: https://support.mozilla.org/hu/kb/weboldalak-altal-elhelyezett-sutik-torlese-szamito
• Safari: https://support.apple.com/guide/safari/manage-cookies-and-website-data-sfri11471/mac
• Chrome: https://support.google.com/chrome/answer/95647
• Edge: https://support.microsoft.com/hu-hu/help/4027947/microsoft-edge-delete-cookies

III.2. Legal background and legal basis for cookies:

We distinguish three basic types of cookies: strictly necessary cookies, which ensure the proper functioning of the Website, and statistical and marketing cookies.

The legal basis for data processing is your consent, according to Article 6 (1) (a) of the Regulation, for statistical and marketing cookies, and according to Article 6 (1) (f) of the Regulation, the legitimate interest necessary to ensure the functioning of the Website for strictly necessary cookies.

III.3. Main characteristics of cookies used by the website:

Strictly necessary cookies:

If you do not accept the use of these cookies, certain functions may not be available to you.

_ab Used for accessing the admin interface. Duration: 2 years.

_customer_account_shop_sessions Used with the _secure_account_session_id cookie to track user sessions for new customer accounts. Duration: 30 days.

_secure_session_id Used to track the user's session through the multi-step checkout process and to link order, payment, and shipping data. Duration: 24 hours.

_shopify_country For stores where pricing currency/country is set from GeoIP, this cookie stores the detected country. This cookie helps avoid GeoIP lookups after the first request. Duration: until the session expires.

_shopify_m Used to manage customer privacy settings. Duration: 1 year.

_shopify_tm Used to manage customer privacy settings. Duration: 30 minutes.

_shopify_tw Used to manage customer privacy settings. Duration: 2 weeks.

_storefront_u Used to facilitate updating customer account data. Duration: 1 minute.

_tracking_consent Used to store user preferences if the merchant has set privacy policies in the visitor's region. Duration: 1 year.

_cmp_a Used to manage customer privacy settings. Duration: 1 day.

c Used in connection with payments. Duration: 1 year.

cart Used in connection with the cart. Duration: 2 weeks.

cart_currency Set after checkout is complete to ensure new carts are in the same currency as the most recent checkout. Duration: 2 weeks.

cart_sig A hash of the cart's contents. This is used to verify the cart's integrity and ensure certain cart operations can be performed. Duration: 2 weeks.

cart_ts Used in connection with payments. Duration: 2 weeks.

cart_ver Used in connection with the cart. Duration: 2 weeks.

checkout Used in connection with payments. Duration: 4 weeks.

checkout_token Used in connection with payments. Duration: 1 year.

customer_account_locale Used in connection with new customer accounts Duration: 1 year.

dynamic_checkout_shown_on_cart Used in connection with payments. Duration: 30 minutes.

hide_shopify_pay_for_checkout Used in connection with payments. Duration: until the session expires.

keep_alive Used in connection with customer localization. Duration: 2 weeks.

master_device_id Used when a merchant logs in. Duration: 2 years.

previous_step Used in connection with payments. Duration: 1 year.

discount_code Used in connection with payments. Duration: until the session expires.

remember_me Used in connection with payments. Duration: 1 year.

secure_customer_sig Used to identify the user after they log in as a customer to the store, so they don't have to log in again. Duration: 1 year.

shopify_pay Used in connection with payments. Duration: 1 year.

shopify_pay_redirect Used in connection with payments. Duration: 1 hour, 3 weeks, or 1 year, depending on the setting.

shop_pay_accelerated Used in connection with payments. Duration: 1 year.

source_name Used in combination with mobile apps to provide custom payment behavior when viewing a store from a compatible mobile app. Duration: until the session expires.

storefront_digest Stores a hash of the storefront password, allowing merchants to preview their storefront while it is password protected. Duration: 2 years.

tracked_start_checkout Used in connection with payments. Duration: 1 year.

checkout_session_lookup Used in connection with payments. Duration: 3 weeks.

checkout_prefill Used in connection with payments. Duration: 5 minutes.

checkout_queue_token Used in connection with payments. Duration: 1 year.

checkout_queue_checkout_token Used in connection with payments. Duration: 1 year.

checkout_worker_session Used in connection with payments. Duration: 3 days.

checkout_session_token Used in connection with payments. Duration: 3 weeks.

checkout_session_token_<> Used in connection with payments. Duration: 3 weeks.

cookietest Used to ensure the proper functioning of our systems Duration: 1 minute.

order Used in connection with the order status page. Duration: 3 weeks.

identity-state Used in connection with customer authentication Duration: 24 hours.

identity-state-<> Used in connection with customer authentication Duration: 24 hours.

identity_customer_account_number Used in connection with customer authentication Duration: 12 weeks.

card_update_verification_id Used in connection with payments. Duration: 20 minutes.

customer_account_new_login Used in connection with customer authentication Duration: 20 minutes.

customer_account_preview Used in connection with customer authentication Duration: 7 days.

customer_payment_method Used in connection with payments. Duration: 1 hour.

customer_shop_pay_agreement Used in connection with payments. Duration: 20 minutes.

pay_update_intent_id Used in connection with payments. Duration: 20 minutes.

localization Used in connection with payments. Duration: 2 weeks.

profile_preview_token Used in connection with payments. Duration: 5 minutes.

login_with_shop_finalize Used in connection with customer authentication Duration: 5 minutes.

preview_theme Used in connection with the theme editor Duration: until the session expires.

shopify-editor-unconfirmed-settings Used in connection with the theme editor Duration: 16 hours.

wpm-test-cookie Used to ensure the proper functioning of our systems Duration: until the session expires.

Statistical cookies:

Google Analytics cookie: Google Analytics is Google's analytics tool that helps website and app owners understand how their visitors engage with their properties. The service may use cookies to collect information and report website usage statistics without personally identifying visitors to Google. The main cookie used by Google Analytics is the "__ga" cookie. In addition to reports on website usage statistics, Google Analytics – in conjunction with some of the advertising cookies described above – can also be used to show more relevant ads on Google products (such as Google Search) and across the internet. Google Analytics cookie lifetimes: _ga – 2 years; ga – 2 years. Analytics cookies will only store information about you if you have consented to the use of cookies in the cookie management panel and Google stores this consent using Google Consent mode v2. In this case, Google will also be aware if you later withdraw this consent.

_landing_page Tracking landing pages Duration: 2 weeks.

_orig_referrer Tracking landing pages Duration: 2 weeks.

Marketing cookies:

Google Adwords cookie When someone visits our site, the visitor's cookie ID is added to the remarketing list. Google uses cookies – such as NID and SID cookies – to customize ads shown in Google products, such as Google Search. These cookies are used, for example, to remember your most recent searches, your previous interactions with individual advertisers' ads or search results, and your visits to advertisers' websites. AdWords conversion tracking uses cookies. To track sales and other conversions resulting from an ad, it saves cookies to the user's computer when that person clicks on an ad. Some common uses of cookies include: selecting ads based on what is relevant to the user, improving reports on campaign performance, and avoiding showing ads that the user has already seen. Google Adwords cookie lifetimes: NID – 6 months; _gcl_aw – 90 days; _gcl_au – 90 days; Conversion – 90 days. Adwords cookies will only store information about you if you have consented to the use of cookies in the cookie management panel and Google stores this consent using Google Consent mode v2. In this case, Google will also be aware if you later withdraw this consent.

Facebook pixel (Facebook cookie) The Facebook pixel is a code that allows the website to report conversions, build target audiences, and provide the site owner with detailed analytical data on visitors' website usage. With the help of the Facebook pixel, the website can display personalized offers and advertisements to website visitors on the Facebook platform. Used Facebook pixel cookies and their lifetimes: _fbp – 3 months; fr – 3 months

_s Shopify analytics. Duration: 30 minutes.

_shopify_d Shopify analytics. Duration: until the session expires.

_shopify_fs Shopify analytics. Duration: 30 minutes.

_shopify_s Shopify analytics. Duration: 30 minutes.

_shopify_sa_p Shopify marketing and referral analytics. Duration: 30 minutes.

_shopify_sa_t Shopify marketing and referral analytics. Duration: 30 minutes.

_shopify_y Shopify analytics. Duration: 1 year.

_y Shopify analytics. Duration: 1 year.

_shopify_ga Shopify and Google Analytics. Duration: until the session expires.

customer_auth_provider Shopify analytics. Duration: until the session expires.

customer_auth_session_created_at Shopify analytics. Duration: until the session expires.

unique_interaction_id Shopify analytics. Duration: 10 minutes.

IV. Recipients of personal data

IV.1. Scope of data processors used by the Data Controller

Data processor: a natural or legal person, public authority, agency or any other body that processes personal data on behalf of the data controller.

IV.1.1. Hosting provider

Name of the data processor: Shopify Inc.

Contact details of the data processor:

Phone number: +1 (888) 746-7439

Email address: info@shopify.com

Registered office: 151 O’Connor Street, Ground floor, Ottawa, ON K2P 2L8, Canada

Website: https://shopify.com

The Data Processor stores personal data based on a contract concluded with the Data Controller. It is not authorized to access personal data.

IV.1.2. Data processing related to newsletter sending

Name of the company operating the newsletter sending system: Shopify Inc.

Registered office of the company operating the newsletter sending system: 151 O’Connor Street, Ground floor, Ottawa, ON K2P 2L8, Canada

Phone number of the company operating the newsletter sending system: +1 (888) 746-7439

Email address of the company operating the newsletter sending system: info@shopify.com

Website of the company operating the newsletter sending system: https://shopify.com

The Data Processor assists in sending newsletters based on a contract concluded with the Data Controller.

IV.1.3. Data processing related to invoicing

Name of the data processor: Billingo Technologies Zrt.

Registered office of the data processor: 1133 Budapest, Árbóc utca 6. I. emelet

Phone number of the data processor:  +36-1/500-9491

Email address of the data processor: hello@billingo.hu

Website of the data processor: https://www.billingo.hu

The Data Processor assists in issuing and recording accounting documents based on a contract concluded with the Data Controller.

IV.2. Data transfer to third parties

The Data Controller transfers data to third parties (recipients) as follows. These recipients process the data not according to the instructions of the Data Controller, but as independent data controllers based on their own data processing policies.

IV.2.1. Recipients of data processing related to goods delivery

Name of the recipient: GLS General Logistics Systems Hungary Csomag-Logisztikai Kft.

Registered office of the recipient: 2351 Alsónémedi, GLS Európa u. 2.

Phone number of the recipient: 06-29-88-67-00

Email address of the recipient: info@gls-hungary.com

Website of the recipient: https://gls-group.eu/HU/hu/home

 

The courier service assists in delivering the ordered goods based on a contract concluded with the Data Controller. The courier service processes the personal data received according to the data processing policy available on its website.

Purpose of data transfer: to provide the courier service with data related to the purchase for the purpose of delivery.

Legal basis for data transfer: according to Article 6 (1) (b) of the Regulation, the performance of the contract concluded between you and the Data Controller, which also includes the delivery of the product, if you have chosen a delivery method during the order.

 

IV.2.2. Recipients of data processing related to goods delivery

Name of the recipient: Magyar Posta Zártkörűen Működő Részvénytársaság

Registered office of the recipient: 1138 Budapest, Dunavirág utca 2-6.

Phone number of the recipient: +36-1/767-8200

Email address of the recipient: ugyfelszolgalat@posta.hu

Website of the recipient: posta.hu

 

The courier service assists in delivering the ordered goods based on a contract concluded with the Data Controller. The courier service processes the personal data received according to the data processing policy available on its website.

Purpose of data transfer: to provide the courier service with data related to the purchase for the purpose of delivery.

Legal basis for data transfer: according to Article 6 (1) (b) of the Regulation, the performance of the contract concluded between you and the Data Controller, which also includes the delivery of the product, if you have chosen a delivery method during the order.

 

IV.2.3. Recipients of data processing related to goods delivery

Name of the recipient: FámaFirst Kft.

Registered office of the recipient: 2220 Vecsés, Tengely utca 3.

Phone number of the recipient: +36 1 300 9500

Recipient's email address: info@famafutar.hu

Recipient's website: www.famafutar.hu

 

The courier service participates in the delivery of the ordered goods based on a contract concluded with the Data Controller. The courier service handles the personal data received according to the data processing policy available on its website.

Purpose of data transfer: to provide the courier service with data related to the purchase in order to effect delivery.

Legal basis for data transfer: performance of the contract concluded between you and the Data Controller, pursuant to Article 6 (1) (b) of the Regulation, which also includes the delivery of the product if you have chosen a shipping method during the order.

 

V. Your rights regarding data processing

During the period of data processing, you are entitled to the rights indicated in this notice according to the provisions of the Regulation.

If you wish to exercise your rights, it will involve your identification, and the Data Controller will necessarily have to communicate with you. Therefore, personal data will be required for identification (but identification can only be based on data that the Data Controller already processes about you), and your complaints regarding data processing will be available in the Data Controller's email account within the period specified in this notice for complaints.

The Data Controller will respond to complaints regarding data processing within 30 days at the latest.

V.1. Right to withdraw consent

You have the right to withdraw your consent to data processing at any time. In this case, your personal data based on consent will be deleted from our systems.

V.2. Right of access to personal data

You have the right to receive confirmation from us as to whether or not we are processing your personal data. If so, you have the right to access this data and to be informed about the following:

• the purpose for which we process your personal data;
• the type (category) of personal data we process about you;
• to whom, or to which recipients, we have transferred or may transfer personal data;
• how long we store personal data, or if this cannot be determined in advance, the criteria used to determine the storage period;
• your rights to rectification, erasure or restriction of processing of your personal data, and to object in the case of processing based on legitimate interest;
• the possibility to lodge a complaint with a supervisory authority;
• the source of the data if we did not obtain it from you;
• whether we use automated decision-making (including profiling), and if so, its essence, logic, and the expected consequences for you.

The primary purpose of exercising the right of access is to verify the lawfulness of data processing. If you request information of the same content unreasonably frequently, we are entitled to charge a reasonable fee.

V.3. Right to rectification

You have the right to have inaccurate personal data concerning you rectified by the Data Controller without undue delay.

V.4. Right to restriction of processing

You have the right to obtain from the Data Controller restriction of processing where one of the following applies:

• you contest the accuracy of the personal data, in which case the restriction applies for a period enabling the Data Controller to verify the accuracy of the personal data; if the accurate data can be determined immediately, no restriction will take place;

• the processing is unlawful, but you oppose the erasure of the data for any reason (e.g., because the data is important to you for the assertion of a legal claim), and therefore you request the restriction of their use instead of their erasure;

• the Data Controller no longer needs the personal data for the purpose of the specified data processing, but you require them for the establishment, exercise or defence of legal claims; or

• you have objected to the processing, but the Data Controller's legitimate interest may also justify the processing; in this case, until it is established whether the Data Controller's legitimate grounds override your legitimate grounds, processing must be restricted.

If processing is restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

V.5. Right to erasure – right to be forgotten

You have the right to obtain from the Data Controller the erasure of personal data concerning you without undue delay where one of the following grounds applies:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed by the Data Controller;
• you withdraw your consent on which the processing is based and there is no other legal ground for the processing;
• you object to the processing based on legitimate interest, and there are no overriding legitimate grounds (i.e., legitimate interest) for the processing,
• the personal data have been unlawfully processed by the Data Controller and this has been established based on the complaint,
• the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the Data Controller is subject.

Erasure shall not apply to the extent that processing is necessary:

• for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject (such a case is data processing within the framework of invoicing, as the retention of invoices is prescribed by law), or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• for the establishment, exercise or defence of legal claims (e.g., if the Data Controller has a claim against you and it has not yet been fulfilled, or a consumer or data processing complaint is ongoing).

V.6. Right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on legitimate interest. In this case, the Data Controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

V.7. Right to data portability

Where processing is based on your voluntary consent or on the performance of a contractual obligation, you have the right to request from the Data Controller to receive the data you have provided to the Data Controller, which the Data Controller will provide to you in XML, JSON, or CSV format. If technically feasible, you may request that the Data Controller transmit the data in this format to another data controller.

V.8. Right to legal remedy

If you believe that the Data Controller has violated any legal provision concerning data processing or has not complied with any of your requests, you may initiate proceedings before the Hungarian National Authority for Data Protection and Freedom of Information (headquarters: 1055 Budapest, Falk Miksa utca 9-11., mailing address: 1363 Budapest, Pf. 9., email: ugyfelszolgalat@naih.hu, phone numbers: +36 (30) 683-5969 +36 (30) 549-6838; +36 (1) 391 1400) to terminate the alleged unlawful data processing.

We also inform you that in case of violation of legal provisions concerning data processing, or if the Data Controller has not complied with any of your requests, you may turn to the competent court of your place of residence or habitual abode.

VI. Other provisions

VI.1. Amendment of the data processing policy

The Data Controller reserves the right to amend this data processing policy in a way that does not affect the purpose and legal basis of data processing.

VI.2. Downloadable version

You can also download this data processing policy in PDF format here.