1. Introduction

QLM Logistics Solutions Kft. (registered office: 2045 Törökbálint, Tópark utca 3., tax number: ó 14549412-2-13, company registration number: 13-09-127440), and QLM Development Center Kft. (registered office: 2045 Törökbálint, Tópark utca 3., tax number: 24208422-2-13, company registration number: 13-09-228340) (hereinafter referred to as “Service Providers, Data Controllers”) pursuant to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Regulation (EC) No 95/46/EC (General Data Protection Regulation) (27 April 2016), provides the following information and fully submits to the information contained therein.

This Privacy Policy governs the data management of the following websites: mima.hu

The privacy notice is available at:
https://mima.hu/adatkezelesi-tajekoztato/

Amendments to the Prospectus will enter into force upon publication at the above address.

2. Data controllers and their contact details

Name: QLM Logistics Solutions Kft.
Location: 2045 Törökbálint, Tópark utca 3.

E-mail: info@mima.hu
Phone: +36 23 800 420
Web: https://mima.hu

3. Definitions

3.1 “Personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

3.2 “processing” means any operation or set of operations which is performed upon personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

3.3 “controller” means a natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of the processing are determined by Union or Member State law, the controller or the specific criteria for the designation of the controller may also be determined by Union or Member State law;

3.4 “processor” means a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller;

3.5 “recipient” means the natural or legal person, public authority, agency or any other body to whom or with whom the personal data is disclosed, whether or not a third party. Public authorities which may have access to personal data in the context of an individual investigation in accordance with Union or Member State law are not recipients; the processing of such data by those public authorities must comply with the applicable data protection rules in accordance with the purposes of the processing;

3.6 “Consent of the data subject” means a freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she signifies, by a statement or by an act expressing his or her unambiguous consent, that he or she signifies his or her agreement to the processing of personal data concerning him or her;

3.7 “Data Breach” means a breach of security that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.

4. Principles governing the processing of personal data

4.1 Personal data:

4.1.1 be carried out lawfully and fairly and in a transparent manner for the data subject (“lawfulness, fairness and transparency”);

4.1.2 be collected only for specified, explicit and legitimate purposes and not processed in a way incompatible with those purposes; further processing for archiving purposes in the public interest, scientific and historical research purposes or statistical purposes (“purpose limitation”) shall not be considered incompatible with the original purpose in accordance with Article 89(1);

4.1.3 be adequate, relevant and limited to what is necessary for the purposes for which the data is processed (“data minimisation”);

4.1.4 be accurate and, where necessary, kept up to date; all reasonable steps must be taken to ensure that personal data which are inaccurate for the purposes for which they are processed are erased or rectified without undue delay (“accuracy”);

4.1.5 be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be kept for longer periods only if the personal data will be processed for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1), subject to the implementation of appropriate technical and organisational measures to safeguard the rights and freedoms of data subjects as provided for in this Regulation (“limited storage”);

4.1.6 be processed in such a way as to ensure adequate security of personal data, including protection against unauthorised or unlawful processing, accidental loss, destruction or damage (“integrity and confidentiality”), by implementing appropriate technical or organisational measures.

The controller is responsible for compliance with the above and must be able to demonstrate such compliance (“accountability”).

5. Data management

5.1 Data processing related to service orders and applications

5.1.1 The fact of data collection, the scope of the data processed and the purpose of data processing:

Személyes adat	Az adatkezelés célja
Vezeték- és keresztnév	A kapcsolatfelvételhez, a vásárláshoz és a szabályszerű számla kiállításához szükséges.
E-mail cím	Kapcsolattartás.
Telefonszám	Kapcsolattartás, a számlázással, vagy a szállítással kapcsolatos kérdések hatékonyabb egyeztetése.
Számlázási név és cím	A szabályszerű számla kiállítása, továbbá a szerződés létrehozása, tartalmának meghatározása, módosítása, teljesítésének figyelemmel kísérése, az abból származó díjak számlázása, valamint az azzal kapcsolatos követelések érvényesítése.
Jelszó	Ügyfélkapu fiókba történő biztonságos belépés biztosítása.
A megrendelés / jelentkezés időpontja	Technikai művelet végrehajtása.
A megrendeléskori / jelentkezéskori IP címe	Technikai művelet végrehajtása.

The e-mail address does not need to contain any personal data.

5.1.2 Data subjects: all data subjects who register for a consultation requesting services on the websites.

5.1.3 Duration of data processing, deadline for deletion of data: immediately upon deletion of the registration. Except in the case of accounting documents, as pursuant to Article 169 (2) of Act C of 2000 on Accounting, these data must be kept for 8 years:

“The accounting documents (including general ledger accounts, analytical or detailed records) directly and indirectly supporting the accounting accounts must be kept for at least 8 years in a legible form, retrievable by reference to the accounting records.”

5.1.4 Potential data controllers entitled to access the data, recipients of personal data: personal data may be processed by the sales, marketing and finance staff of the controller, in compliance with the above principles.

5.1.5 Description of data subjects’ rights in relation to data processing:

– The data subject may request from the controller access to, rectification, erasure or restriction of processing of personal data concerning him or her and
– object to the processing of such personal data and
– the data subject has the right to data portability and to withdraw consent at any time.

5.1.6 The data subject may initiate the access to, deletion, modification or restriction of processing of personal data, data portability and objection to processing in the following ways:

– by post at 2045 Törökbálint, Tó Park utca 3.,
– by e-mail at info@mima.hu,
– by telephone at +36 23 800 420.

5.1.7 Legal basis for processing:

5.1.7.1 Consent of the data subject, Article 6 (1) (a), of the Infotv. § 5 (1)
,

5.1.7.2 Paragraph 13/A (3) of Act CVIII of 2001 on certain aspects of electronic commerce services and information society services (hereinafter: Elker Act):

“The service provider may process personal data that are technically necessary for the provision of the service. The service provider shall, other conditions being equal, choose and in any case operate the means used in the provision of the information society service in such a way that personal data are processed only to the extent strictly necessary for the provision of the service and for the fulfilment of the other purposes laid down in this Act, but only to the extent and for the duration necessary.”

5.1.7.3 Article 6(1)(c) for invoices issued in accordance with accounting legislation.

5.1.8 You are informed that

– the processing is based on your consent.
– is obliged to provide the personal data in order for us to be able to provide the ordered service/application in accordance with the contract.
– failure to provide the data will result in our inability to process the service/application ordered.

5.2 Complaints handling

5.2.1 Fact of data collection, scope of data processed and purpose of data management: complaint handling

5.2.2 Data subjects: all data subjects who order services on the websites and who have quality complaints or complaints.

5.2.3 Duration of data processing, deadline for deletion of data: copies of the record, transcript and reply to the recorded objection shall be kept for 5 years pursuant to Article 17/A (7) of Act CLV of 1997 on Consumer Protection.

5.2.4 Identity of the potential controllers of the data, recipients of personal data: personal data may be processed by the sales and marketing staff of the controller, in compliance with the above principles.

5.2.5 Description of data subjects’ rights in relation to data processing:

– The data subject may request from the controller access to, rectification, erasure or restriction of processing of personal data concerning him or her and
– object to the processing of such personal data and
– the data subject has the right to data portability and to withdraw consent at any time.

5.2.6 The data subject may request access to, erasure, modification or restriction of processing of personal data, data portability and objection to processing in the following ways:

– by post at 2045 Törökbálint, Tópark utca 3.,
– by e-mail at info@mima.hu,
– by telephone at +36 23 800 420.

5.2.7 Legal basis for processing: the data subject’s consent, Article 6 (1) (c), the Infotv. Article 5(1), and Article 17/A(7) of Act CLV of 1997 on Consumer Protection.

5.2.8 You are informed that

– the provision of personal data is based on a contractual obligation.
– the processing of personal data is a precondition for the conclusion of the contract.
– must provide personal data in order for us to handle your complaint.
– failure to provide the data will result in our not being able to deal with your complaint.

5.3 Community sites

5.3.1 Fact of data collection, scope of data processed: name registered on Facebook/LinkedIn etc. social networking sites and public profile picture of the user.

5.3.2 Data subjects: all data subjects who are registered on Facebook/LinkedIn etc. social networking sites and who “like” and follow the websites.

5.3.3 The purpose of the data collection is to share or “like” certain content, products, promotions or the website itself on social networking sites.

5.3.4 Duration of data processing, time limit for deletion of data, the identity of the possible controllers entitled to access the data and the rights of the data subjects with regard to data processing: the data subject can find out about the source of the data, the processing of the data and the method and legal basis of the transfer on the relevant Community site. The processing takes place on the social networking sites, and the duration, the method of processing, the possibilities for deletion and modification of the data are governed by the rules of the social networking site concerned.

5.3.5 Legal basis for processing: the data subject’s voluntary consent to the processing of his or her personal data on social networking sites.

5.4 Customer relations and other data processing

5.4.1 If the data subject has any questions or problems when using the services of the data controller, he or she may contact the data controller by the means provided on the website (telephone, e-mail).

5.4.2 We will provide information about any processing not listed in this notice at the time of collection.

5.4.3 In the event of an exceptional request from a public authority or other bodies authorised by law, the Service Provider shall provide information, disclose data, hand over data or make documents available.

5.4.4 In such cases, the Service Provider shall disclose to the requester – provided that the requester has indicated the precise purpose and scope of the data – personal data only to the extent and to the extent strictly necessary for the purpose of the request.

5.5 Newsletter, direct marketing activities

5.5.1 Pursuant to Article 6 of Act XLVIII of 2008 on the Basic Conditions and Certain Restrictions of Economic Advertising Activities, the User may expressly consent in advance to being contacted by the Service Provider with advertising offers and other mailings at the contact details provided at the time of registration.

5.5.2 In addition, the User may, subject to the provisions of this Policy, consent to the processing of personal data by the Service Provider necessary for the sending of advertising offers.

5.5.3 The Service Provider shall not send unsolicited advertising messages and the User may unsubscribe from receiving offers without any restriction and without giving any reason, free of charge. In this case, the Service Provider shall delete all personal data of the User from its records, which are necessary for sending advertising messages, and shall not contact the User with further advertising offers. The User may unsubscribe from advertising by clicking on the link in the e-mail messages.

5.5.4 The fact of data collection, the scope of data processed and the purpose of data processing:

Személyes adat	Az adatkezelés célja
Vezeték- és keresztnév	Azonosítás, a hírlevélre való feliratkozás lehetővé tétele.
E-mail cím	Azonosítás, a hírlevélre való feliratkozás lehetővé tétele.
A feliratkozás időpontja	Technikai művelet végrehajtása.
A feliratkozáskori IP cím	Technikai művelet végrehajtása.

5.5.5 Data subjects: all data subjects who subscribe to the newsletter / direct marketing activities.

5.5.6 Purpose of data processing: sending electronic messages (e-mail, sms, push messages) containing useful professional content, knowledge material, advertising to the data subject, providing information about current information, products, promotions, new features, etc.

5.5.7 Duration of data processing, deadline for deletion of data: data processing lasts until the withdrawal of the consent, i.e. until unsubscription.

5.5.8 Identity of the potential controllers of the data, recipients of personal data: personal data may be processed by the sales and marketing staff of the controller, in compliance with the above principles.

5.5.9 Description of data subjects’ rights in relation to data processing:

– the data subject may request the controller to access, rectify, erase or restrict the processing of personal data concerning him or her, and
– object to the processing of such personal data, and
– the data subject has the right to data portability and to withdraw consent at any time.

5.5.10 The data subject may initiate the access to, deletion, modification or restriction of processing of personal data, data portability and objection to processing in the following ways:

– by post at 2045 Törökbálint, Tópark utca 3.,
– by e-mail at info@mima.hu,
– by telephone at +36 23 800 420.

5.5.11 The data subject may unsubscribe from the newsletter / direct marketing activity at any time, free of charge.

5.5.12 Legal basis for data processing: the data subject’s consent, Article 6 (1) (a), the Infotv. Article 5 (1), and Article 6 (5) of Act XLVIII of 2008 on the Basic Conditions and Certain Restrictions of Economic Advertising Activities:

“The advertiser, the advertising service provider or the publisher of the advertisement shall keep a record of the personal data of the persons who have given their consent within the scope specified in the consent. The data recorded in this register, relating to the recipient of the advertising, may be processed only in accordance with the consent given in the consent form, until it is withdrawn, and may be disclosed to third parties only with the prior consent of the person concerned.”

5.5.13 You are informed that

– the processing is based on your consent.
– must provide personal data if you wish to receive newsletters from us.
– failure to provide this information will result in our inability to send you a newsletter / direct marketing mailing.

6. The data processors used

6.1 Hosting provider

6.1.1 Activity provided by the data processor: reseller hosting services

6.1.2 Name and contact details of the data processor:

MikroTek Hungary Kft.
Address: 2049 Diósd, Homokos utca 113.
Phone: +36 30 205 8057
E-mail: info@mikrotek.hu
Web: https://mikrotek.hu

6.1.3 Fact of processing, scope of data processed: all personal data provided by the data subject.

6.1.4 Data subjects: all data subjects using the websites.

6.1.5 Purpose of data processing: to make the website available and to ensure its proper operation.

6.1.6 Duration of data processing, deadline for deletion of data: data processing lasts until the termination of the agreement between the data controller and the hosting provider or until the data subject’s request for deletion to the hosting provider.

6.1.7 Legal basis for data processing: the User’s consent, the Infotv. Article 5(1), Article 6(1)(a), and Article 13/A(3) of Act CVIII of 2001 on certain aspects of electronic commerce services and information society services.

6.2 Newsletter provider

6.2.1 Activity performed by the data processor: online newsletter service

6.2.2 Name and contact details of the data processor:

MailChimp c/o The Rocket Science Group, LLC
Address: 675 Ponce De Leon Ave NE,
Suite 5000
Atlanta, GA 30308 USA
Web: https://mailchimp.com

All further information on data processing is detailed in section 5.2 and its subsections.

7. Management of cookies (cookies)

7.1 Fact of processing, scope of data processed: unique identification number, dates, times.

7.2 Data subjects: all data subjects visiting the websites.

7.3 Purpose of data processing: to identify users and track visitors.

7.4 Duration of data processing, deadline for deletion of data:

Cookie típusa	Adatkezelés jogalapja	Adatkezelés időtartama	Kezelt adatkör
Munkamenet cookie-k (session)	Az elektronikus kereskedelmi szolgáltatások, valamint az információs társadalmi szolgáltatások egyes kérdéseiről szóló 2001. CVIII. törvény (Elkertv.) 13/A. § (3) bekezdése	A vonatkozó látogatói munkamenet lezárásáig tartó időszak	connect.sid

7.5 Identity of the potential data controllers: no personal data is processed by the data controller through the use of cookies.

7.6 Description of data subjects’ rights in relation to data management: data subjects have the possibility to delete cookies in the Tools/Preferences menu of their browsers, usually under the Privacy settings.

7.7 Legal basis for data processing: no consent is required from the data subject where the sole purpose of the use of cookies is the transmission of communications over an electronic communications network or where the use of cookies is strictly necessary for the provision of an information society service expressly requested by the subscriber or user.

8. Using Google AdWords conversion tracking

8.1 The data controller uses the online advertising program “Google AdWords” and uses Google’s conversion tracking service within its framework. Google Conversion Tracking is an analytics service of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; “Google”).

8.2 When you access a website through a Google ad, a cookie is placed on your computer for conversion tracking. These cookies have a limited validity and do not contain any personal data, so the User cannot be identified by them.

8.3 When the User browses certain pages of the website and the cookie has not expired, Google and the data controller may see that the User has clicked on the advertisement.

8.4 Each Google AdWords client receives a different cookie, so they cannot be tracked through AdWords clients’ websites.

8.5 The information obtained by Google and the data controller through the use of conversion tracking cookies is used to generate conversion statistics for Google AdWords customers who opt for conversion tracking. Customers are thus informed of the number of users who click on their ad and are referred to a page with a conversion tracking tag. However, they do not have access to information that would allow them to identify any user.

8.6 If you do not wish to participate in conversion tracking, you can opt out by disabling the option to set cookies in your browser. The User will then not be included in the conversion tracking statistics.

8.7 Further information and Google’s privacy statement can be found at https://www.google.de/policies/privacy/

9. Using Google Analytics

9.1 The data controller uses Google Analytics, a web analytics service provided by Google Inc. (“Google”). Google Analytics uses so-called “cookies”, text files that are saved on the User’s computer to help analyse the use of the website visited by the User.

9.2 The information generated by the cookies used by the User in connection with the websites is usually transmitted to and stored on a Google server in the USA. By activating the IP anonymisation on the website, Google will previously shorten the User’s IP address within the member states of the European Union or in other states party to the Agreement on the European Economic Area.

9.3 Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the website operator, Google will use this information to evaluate how the User has used the website, to compile reports on website activity for the website operator and to provide other services relating to website and internet use.

9.4 Google Analytics will not associate the IP address transmitted by the User’s browser with any other data held by Google. You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. You may also prevent Google from collecting and processing information about your use of the website (including your IP address) by means of cookies by downloading and installing the browser plug-in available at https://tools.google.com/dlpage/gaoptout?hl=hu

10. Data protection provisions regarding the use and application of LinkedIn

10.1 The data controller has incorporated certain modules of LinkedIn Corporation on this website.

10.2 LinkedIn is operated by LinkedIn Corporation (2029 Stierlin Court Mountain View, CA 94043, USA) and LinkedIn Ireland (Privacy Policy Issues, Wilton Plaza, Wilton Place, Dublin 2, Ireland) for data protection issues outside the United States.

10.3 Each time you open one of our websites that has a LinkedIn module (LinkedIn plug-in), the module will initiate the browser used by the data subject to download the appropriate representation of the LinkedIn module. Further information about LinkedIn plug-ins can be found at https://developer.linkedin.com/plugins. In the course of this technical process, LinkedIn learns which specific subpages of our website have been visited by the data subject.

10.4 If the data subject is simultaneously logged in to LinkedIn, LinkedIn will recognise which specific subpages of our website the data subject has visited each time the data subject opens our website and throughout the entire time the data subject is on our website. The LinkedIn module collects this information and LinkedIn associates it with the LinkedIn account of the data subject. When the data subject clicks on a LinkedIn button on our website, LinkedIn associates this information with the data subject’s LinkedIn account and stores this personal data.

10.5 If the data subject is logged in to LinkedIn when he or she opens our website, LinkedIn will always receive information via the LinkedIn module – regardless of whether the data subject clicked on the LinkedIn module or not – about whether the data subject has visited our website. If the data subject does not want this information to be transmitted to LinkedIn, he or she can prevent this by logging out of his or her LinkedIn account before opening our website. On LinkedIn https://www.linkedin.com/psettings/guest-controls, you can opt-out of receiving email or SMS messages and targeted ads, and manage your ad preferences. LinkedIn also uses the services of service providers such as Quantcast, Google Analytics, BlueKai, DoubleClick, Nielsen, Comscore, Eloqua and Lotame, which may place cookies on your computer. You can reject these cookies by visiting https://www.linkedin.com/legal/cookie-policy. LinkedIn’s current privacy policy can be found at https://www.linkedin.com/legal/privacy-policy. LinkedIn’s cookie policy can be found at https://www.linkedin.com/legal/cookie-policy.

11. Data protection provisions regarding the use and application of YouTube

11.1 The data controller has incorporated certain YouTube modules on this website.

11.2 The operator of YouTube is YouTube, LLC (901 Cherry Ave., San Bruno, CA 94066, USA). YouTube, LLC is a subsidiary of Google Inc. (1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA).

11.3 The YouTube module initiates the automatic downloading of the corresponding YouTube module by the browser of the IT system of the data subject each time the individual pages of this website operated by the data controller and containing YouTube modules (YouTube videos) are opened. More information about YouTube can be found at https://www.youtube.com/intl/hu/yt/about/. In the course of this technical process, YouTube and Google learn which specific subpages of our website have been visited by the data subject.

11.4 If the data subject is simultaneously logged in to YouTube, YouTube will recognise which specific subpages of our website the data subject has visited each time the data subject opens our website and throughout the entire time the data subject is on our website. YouTube and Google collect this information and associate it with the YouTube account of the data subject.

11.5 If the data subject is logged in to YouTube when accessing our website, YouTube and Google will always receive information via the YouTube module, regardless of whether the data subject has clicked on the YouTube video or not, about whether the data subject has visited our website. If the data subject does not want this information to be transmitted to YouTube and Google, he or she can prevent this by logging out of his or her YouTube account before opening our website. The privacy policy provided by YouTube on https://policies.google.com/privacy?hl=hu&gl=hu explains how YouTube and Google collect, process and use personal data.

12. Facebook pixel application

12.1 Our Website may use a Facebook pixel (“Facebook Pixel”), which is an invisible image contained in the pages of our Website and stored on Facebook’s servers. Each time you open a page on our Website where this “pixel” is captured, this pixel is downloaded to your device from the relevant Facebook server. Facebook receives the following data: your IP address and specific parameters of your device (e.g. type, operating system, specific software and hardware).

12.2 Although we cannot link this information to you personally, Facebook may do so if you have a Facebook profile. So, in this case, Facebook acts as the data controller. We therefore recommend that you consult the Facebook Privacy Policy to understand the purposes, including advertising, for which information collected by Facebook is processed.

12.3 We only receive statistical information from Facebook, not your personal data.

12.4 If you do not wish to receive certain promotional information, you can set your advertising preferences on your own personalised Facebook page. Finally, you can also indicate in the settings of your mobile device that your personal data should not be disclosed to third parties. Find out more about the Facebook homepage.

13. Use of Hotjar

13.1 We strive to provide a good user experience on our website. To help us achieve this, we use the Hotjar website analytics application to track visitors’ activities on our website (e.g. mouse movements, clicks, etc.). When visiting our website, visitors can remove cookies placed on their computing device at any time or disable the use of cookies in their browser.

In order to ensure that visitors are not identifiable, Hotjar only operates in those parts of the website where it is not necessary to provide visitors with personal information. We do not operate the website analytics application on those areas of the website where data fields need to be filled in, and therefore visitors cannot be identified to us.

Data stored by the application; data about your browser and device (country, IP address in anonymised form, type of device used, screen size, browser type, operating system type, time of visit).

You can turn off the collection and storage of data in your browser. For more information, please visit https://www.hotjar.com/opt-out

The stored data will be kept for one year.

14. Rights of data subjects

14.1 Right of access: you have the right to receive feedback from the controller as to whether your personal data are being processed and, if such processing is taking place, you have the right to access your personal data and the information listed in the Regulation.

14.2 Right to rectification: you have the right to obtain, at your request and without undue delay, the rectification of inaccurate personal data relating to you. Having regard to the purposes of the processing, you have the right to request that incomplete personal data be completed, inter alia, by means of a supplementary declaration.

14.3 Right to erasure: You have the right to obtain from the controller the erasure of personal data relating to you without undue delay and the controller is obliged to erase personal data relating to you without undue delay under certain conditions.

14.4 Right to be forgotten: if the controller has disclosed the personal data and is obliged to delete it, it will take reasonable steps, including technical measures, taking into account the available technology and the cost of implementation, to inform the controllers that have processed the data that you have requested the deletion of the links to or copies of the personal data in question.

14.5 Right to restriction of processing: you have the right to have the controller restrict processing at your request if one of the following conditions is met:

– you contest the accuracy of the personal data, in which case the restriction applies for the period of time that allows the controller to verify the accuracy of the personal data;
– the processing is unlawful and you oppose the erasure of the data and instead request the restriction of their use;
– the controller no longer needs the personal data for the purposes of the processing but you request them for the establishment, exercise or defence of legal claims;
– you have objected to the processing, in which case the restriction applies for a period of time until it is established whether the controller’s legitimate grounds override your legitimate grounds.

14.6 Right to data portability: you have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used, machine-readable format and the right to transmit these data to another controller without hindrance from the controller to whom you have provided the personal data.

14.7 Right to object: you have the right to object to the processing of your personal data, including profiling based on the aforementioned provisions, at any time on grounds relating to your particular situation.

14.8 Objection in the case of direct marketing: where personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such purposes, including profiling, where it is related to direct marketing. If you object to the processing of your personal data for direct marketing purposes, your personal data may no longer be processed for those purposes.

14.9 Automated decision making in individual cases, including profiling: you have the right not to be subject to a decision based solely on automated processing, including profiling, which would have legal effects concerning you or similarly significantly affect you.

The preceding paragraph shall not apply in the case where the decision:

– necessary for entering into, or performance of, a contract between you and the controller;
– permitted by Union or Member State law applicable to the controller which also lays down adequate measures to protect your rights and freedoms and legitimate interests; or
– based on your explicit consent.

15. Deadline for action

15.1 The controller shall inform you of the action taken on the above requests without undue delay and in any event within 30 calendar days of receipt of the request.

15.2 If necessary, this may be extended by a further 60 calendar days. The controller will inform you of the extension, stating the reasons for the delay, within 30 calendar days of receipt of the request.

15.3 If the controller fails to act on your request, the controller will inform you without delay, but at the latest within 30 calendar days of receipt of the request, of the reasons for the failure to act, of the possibility to lodge a complaint with a supervisory authority and of your right to judicial remedy.

16. Security of data processing

16.1 The controller and the processor shall implement appropriate technical and organisational measures, taking into account the state of the art and the cost of implementation, the nature, scope, context and purposes of the processing and the varying degrees of probability and severity of the risk to the rights and freedoms of natural persons, in order to ensure a level of data security appropriate to the level of risk, including, where appropriate:

– the pseudonymisation and encryption of personal data;
– the continued confidentiality, integrity, availability and resilience of the systems and services used to process personal data;
– the ability to restore access to and availability of personal data in the event of a physical or technical incident in a timely manner;
– a procedure for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures taken to ensure the security of processing.

17. Informing the data subject of the personal data breach

17.1 If the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall inform the data subject of the personal data breach without undue delay.

17.2 The information provided to the data subject shall clearly and prominently describe the nature of the personal data breach and provide the name and contact details of the Data Protection Officer or other contact person who can provide further information; describe the likely consequences of the personal data breach; describe the measures taken or envisaged by the controller to remedy the personal data breach, including, where appropriate, measures to mitigate any adverse consequences of the personal data breach.

17.3 The data subject need not be informed if any of the following conditions are met:

– the data controller has implemented appropriate technical and organisational protection measures and these measures have been applied to the data affected by the personal data breach, in particular measures, such as the use of encryption, which render the data unintelligible to persons not authorised to access the personal data;
– the controller has taken additional measures following the personal data breach to ensure that the high risk to the rights and freedoms of the data subject is no longer likely to materialise;
– the provision of information would require a disproportionate effort. In such cases, the data subjects should be informed by means of publicly disclosed information or by means of a similar measure which ensures that the data subjects are informed in an equally effective manner.

17.4 If the controller has not yet notified the data subject of the personal data breach, the supervisory authority may, after having considered whether the personal data breach is likely to present a high risk, order the data subject to be informed.

18. Reporting a data breach to the authority

18.1 The controller shall notify a personal data breach to the supervisory authority competent pursuant to Article 55 without undue delay and, where possible, no later than 72 hours after the personal data breach has come to its attention, unless the personal data breach is unlikely to pose a risk to the rights and freedoms of natural persons.

18.2 If the notification is not made within 72 hours, it must be accompanied by the reasons justifying the delay.

19. Possibility to complain

19.1 A complaint against a possible infringement by the controller may be lodged with the National Authority for Data Protection and Freedom of Information:

Hungarian National Authority for Data Protection and Freedom of Information
Registered office: 1125 Budapest, Szilágyi Erzsébet fasor 22/C.
Postal address: 1530 Budapest, P.O. Box 5
Phone: +36 1 391 1400
Fax: +36 1 391 1410
E-mail: ugyfelszolgalat@naih.hu

20. Closing words

The following legislation has been taken into account in the preparation of this information:

– REGULATION (EU) No 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Regulation (EC) No 95/46/EC (General Data Protection Regulation)
– CXII. törvény – az információs önrendelkezési jogról és az információszabadságról (a továbbiakban: Infotv.)
– 2001. évi CVIII. törvény – az elektronikus kereskedelmi szolgáltatások, valamint az információs társadalommal összefüggő szolgáltatások egyes kérdéseiről (főképp a 13/A. §-a)
– 2008. évi XLVII. törvény – a fogyasztókkal szembeni tisztességtelen kereskedelmi gyakorlat tilalmáról;
– 2008. évi XLVIII. Act on the Basic Conditions and Certain Restrictions on Commercial Advertising (in particular § 6)
– Act XC of 2005 on the Freedom of Electronic Information
– Act C of 2003 on Electronic Communications (in particular § 155)
– Act No 16/2011. Opinion on the EASA/IAB Recommendation on best practice on behavioural online advertising

– Recommendation of the National Authority for Data Protection and Freedom of Information on data protection requirements for prior
information
– Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural
persons with regard to the processing of personal data and on the free movement of such data, and repealing Regulation (EC) No 95/46/EC