THE PROTECTION OF NATURAL PERSONS RIGHTS WITH REGARD TO THE PROCESSING OF PERSONAL DATA
INTRODUCTION
Why is this privacy notice made?
During its operation, the Data Controller handles personal data for several purposes, while respecting the rights of the data subjects and fulfilling legal obligations. The Data Controller also considers it important to present to the data subject the handling and the most important characteristics of the personal data that came to the controller’s knowledge during the data processing activities.
What is the legal basis of processing the data subjects’ personal data?
Personal data is only processed for a specific purpose and on an appropriate legal basis. These purposes and legal bases are presented individually, in relation to specific data processing.
What external assistance is used to process your personal data?
Personal data is mostly processed by the Data Controller at own premises. However, there are operations for which a data processor’s external help is necessary. The data processor may change according to the characteristics of each data processing.
Who is processing your personal data?
The data subject may receive information about the data processors employed by the Data Controller and their contact details in section II of this privacy notice.
The issuer of this privacy notice and the Data Controller: COMPANY NAME: SPIRIT INNOVA Nonprofit Korlátolt Felelősségű Társaság
REGISTERED SEAT: 6783 ÁSOTTHALOM, VI. KÖRZET 912-1.
COMPANY REGISTRATION NUMBER: 06-09-021091
TAX NUMBER: 24893891-1-06
REPRESENTS: KITTI SAJÓ
CONTACT: https://mandorlaessences.com/ under „contact”
(hereinafter: Company)
SECTION II
NAME OF THE DATA PROCESSORS
Data Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller; (Regulation 2016/679 Article 4 8.)
To use a data processor, prior consent from the data subject is not required, but he or she must be notified. Accordingly, the following information is provided:
IT Services:
- Company name: Google LLCC
Registered seat: Mountain View, California, USA
(it adheres to EU-U.S. PRIVACY SHIELD FRAMEWORK)
Contact: https://www.google.com/ - Company Name: Facebook, Inc.
Registered seat: Menlo Park, California, USA
(it adheres to EU-U.S. PRIVACY SHIELD FRAMEWORK)
Contact: https://www.facebook.com/ - Hosting Provider:
COMPANY NUMBER: ShopRenter.hu Kereskedelmi és Szolgáltató Korlátolt Felelősségű Társaság
REGISTERED SEAT: 4028 Debrecen, Kassai út 129
COMPANY REGISTRATION NUMBER: 09-09-020636
TAX NUMBER: 23174108-2-09
CONTACT: https://shoprenter.hu/ - Hosting Provider:
COMPANY NAME: Websupport Magyarország Kft
REGISTERED SEAT: 1132 Budapest, Victor Hugo utca 18-22.
COMPANY REGISTRATION NUMBER: 01-09-381419
TAX NUMBER: 25138205-2-41 - Credit card payment service provider:
COMPANY NAME: OTP Mobil Szolgáltató Korlátolt Felelősségű Társaság
RESITERED SEAT: 1143 Budapest, Hungária körút 17-19
COMPANY REGISTRATION NUMBER: 01-09-174466
TAX NUMBER: 24386106-2-42
CONTACT: https://simplepay.hu/ - Data Processor performing accounting and payroll tasks:
company name: Győrfi Krisztina
registered seat: 6753 Szeged, Hajnalka utca 28
contact: gyorfi.krisztina@gmail.com - Data processor performing postal, courier and logistics tasks:
COMPANY NAME: "Csomagnet.hu" Szolgáltató Korlátolt Felelősségű Társaság
REGISTERED SEAT: 8200 VESZPRÉM, EGRY JÓZSEF UTCA 11. E. LHÁZ. FSZT. 1.
COMPANY REGISTRATION NUMBER: 19-09-517735
TAX NUMBER: 25181227-2-19
CONTACT: https://csomagnet.hu/ - Data processor performing postal, courier and logistics tasks:
COMPANY NAME: GLS GENERAL LOGISTICS SYSTEMS HUNGARY KFT.
REGISTERED SEAT: 2351 ALSÓNÉMEDI GLS EURÓPA UTCA 2.
TAX NUMBER: 12369410-2-44
CONTACT: https://gls-group.eu/HU/hu/home - Data processor performing web editing:
Company name: Online Face Nonprofit Korlátolt Felelősségű Társaság
Registered seat: 6782 Mórahalom, VI. körzet tanya 140.
Company registration number: 06-09-023961
tax number: 26187549-2-06
contact: https://bpro.hu/ - Data processor performing invoicing:
Company name: KBOSS.hu Kereskedelmi és Szolgáltató Korlátolt Felelősségű Társaság
registered seat: 1031 Budapest, Záhony utca 7.
Company registration number: 01-09-303201
tax number: 13421739-2-41
contact: https://www.szamlazz.hu/
LAWFULNESS OF PROCESSING
1. Data processing based on the data subject’s consent
It is considered a statement of consent, if the individual signifies agreement to the processing of personal data relating to him or her, by ticking a box (check-box) on the Company’s website or on any document provided to him or her, also making any technical adjustments related to information society services. This also applies to, any other statement or action, which signifies clearly, the consent of the data subject to the purposed processing of his or her personal data.In consent-based data collecting, the Data Controller may process the collected data without any further consent of the data subject, and also after the withdrawal of consent, if the processing is necessary for the performance of legal obligations.
2. Data processing based on performing legal obligations
In the case of data processing based on performing legal obligations, the scope of the data that can be processed, the purpose of the data processing, the duration of data storage and the recipients are governed by the provisions of the underlying legislation. The processing of personal data for compliance with a legal obligation is based on the regulation, regardless of the consent of the data subject.
In this case, prior to the processing of the data, the data subject shall be informed that the data processing is obligatory and shall be clearly and in detail informed of all facts concerning the processing, in particular the purpose and legal basis of the data processing, the person authorized to handle and process the data, the duration of the data processing, whether the personal data of the data subject are processed by the Data Controller on the basis of the legal obligation applicable to him or her, and who can get access to the data. The information shall include the rights and remedies available to the data subject. In the case of mandatory data processing, the information may also take place with the publication of a reference to the legislative provisions which contain the foregoing information.
3. Data processing based on legitimate interests
Processing shall be lawful if processing is necessary for the purposes of the legitimate interests pursued by the Company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.
Processing personal data for direct marketing purpose and for communication with data subject is considered to be legitimate interest.
Legitimate interest tests have been performed related to data processing based on legitimate interests, which are part of the appendix of this privacy notice. These are available upon request by data subjects.
4. Data processing for the protection of the vital interests of the data subject or other natural person
The protection of the life or other vital interest of the data subject or the protection of the interest of another natural person may also constitute a legal basis for the processing of data. In the case of a natural person this data processing may happen in the event of taking a medical service or stopping the spreading of epidemics.
5. Data processing based on contractual interests
Data processing may also be based on a contractual interest if it is necessary for the performance of a contract in which the data subject is a party or if it is requested by the data subject in order to prepare the contract.
6. Data processing for other purposes
Where the controller intends to further process the personal data for a purpose other than that for which the personal data was collected, the controller shall provide the data subject prior to that further processing with information on that other purpose. If it is necessary, the Company requires the consent of the data subject regarding the new purpose.
7. Promoting the rights of the data subject
The Company is obliged to ensure the exercise of the rights of the data subject during all data processing.
INFORMATION ABOUT DATA PROCESSING BY THE COMPANY
Data processing in the Company’s web shop
The purchase in the web shop operated by the Company qualifies as a contract, according to 13/A.§ of Act CVIII of 2001 on certain issues of electronic commerce services and information society services and to Government Decree 45/2014. (II.26.) on detailed rules governing contract concluded between consumers and businesses. In case of purchasing in the web shop, the legal basis of the data processing is the contract.
In accordance with (1) 13/A of Act CVIII of 2001, for the purposes of creating, defining the content of, amending, monitoring the performance of, invoicing the fees arising from, and enforcing claims related to the service contract concluded for services falling within the category of information society service, the Company may process the personal identification data of natural persons acting as a customer who registers in the web shop. For title of consent, the Company may also process the telephone number, e-mail address, bank account number, online identifier of the customer registering in the web shop.
Pursuant to (2) 13/A of Act CVIII of 2001, for the purpose of invoicing and in relation with the use of information society services, the Company may process the personal identification data of natural persons, the address, delivery address, as well as the data with respect to the date, the duration and the location of the use of the service.
Recipients and categories of recipients of personal data: employees of the Company performing tasks related to customer service, payment, transportation, marketing activities; employees of the Company’s subcontractors performing tax related and accounting services for the purpose of fulfilling tax and accounting obligations, acting as data processors, employees of the Company’s IT service provider in order to provide hosting services; employees of the courier service with respect to delivery data (name, address, telephone number) the Company’s account Manager and the current photographer and video contract partners.
Duration of personal data processing: until the registration/service is maintained or until withdrawal of the data subject’s consent (request for deletion), in case of purchase, until the end of a term of 8 years following the year of purchase.
When shopping in the web shop, the Privacy Policy must be available via a link.
Data processing according to social media (Facebook, Instagram)
The Data Controller manages its own page on Facebook and on Instagram. The data subject could subscribe to the Facebook News Feed of the Company by clicking the “Like” button on the page and follow the Company’s page on Instagram by clicking the „Follow” button.
Purpose of personal data processing: information about the current news and information regarding the Data Controller
Legal basis of data processing: freely given consent of the data subject (Facebook’s/Insagram’s privacy policy)
Categories of processed personal data: name of the data subject
Period for which the personal data are stored: The data subject may unsubscribe from the Facebook News Feed of the Law Firm by clicking the “Dislike” button on the page or delete the unwanted content appearing on his or her News Feed in Settings. The data subject may click the „Unfollow” button to stop following the Company.
Data processing regarding personal data of customers, contract partners and their contacts
If the Company and its business partner make a contract, the parties shall name the contact person and his or her address in the contract.
Purpose of personal data processing: business partnership, fulfillment of the provisions of the contracts
Legal basis of data processing: the data processing is necessary to fulfill a contractual obligation
Categories of processed personal data: the data subjects’ name, address, phone number, job title, and e-mail address
Period for which the personal data are stored: 5 years from the termination of contract, and/or the statutory retention period
Cookie policy on the website of the Company
Cookies are text files with small pieces of data, that are stored in the user’s computer or phone (HDD, SSD) until their expiration date, and if a user returns to that site in the future, the web browser returns that data to the web server. Their purpose is to store data regarding visiting the website, and personal adjustments, but these are not personal data of the user. Cookies help to create a user friendly website and to improve the user’s experience. If the user does not agree to use cookies, the use of the website will be intermitted.
Purpose of personal data processing: improvement in user’s internet experience, storage of personal adjustments
Legal basis of data processing: the data subject’s freely given consent
Categories of processed personal data: the Data Controller stores every analytical information without name or any other personal data
Period for which the personal data are stored: The data subject can delete the cookies anytime on his or her computer or phone
Data processing of applicants’ personal data, accordingly their CV and application
The Law Firm processes the CVs sent to it and personal data given in it, based on the consent of the data subject (even by implicit conduct)
Categories of processed personal data: the natural person’s name, place and date of birth, mother’s name, address, educational attainment, photo, phone number, e-mail address, employers’ opinion (if it is available), CV, and personal data in these documents
Purpose of personal data processing: application, assessment of the application and to make an employment contract
Recipients of personal data, and categories of recipients: the employer at the Law Firm who exercises employer’s rights, and other employees dealing with labour related tasks
Period for which the personal data are stored: 5 years from the application and assessment of the application. The personal data of applicants not chosen to contract must be removed after 5 years, this also pertains to the personal data of an applicant who has withdrawn his or her application. Storing personal data after 5 years has to be consent-based.
If the applicant does not give his or her consent, he or she shall not be chosen to make an employer contract.
INFORMATION ABOUT THE RIGHTS OF DATA SUBJECT
You can find further information about the rights of the data subject in General Data Protection Regulation (https://eur-lex.europa.eu/legal-content/HU/TXT/HTML/?uri=CELEX:32016R0679)
- Information and access to personal data (Article 13 and 14)
- Right of access by the data subject (Article 15)
- Right to rectification (Article 16)
- Right to erasure (‘right to be forgotten’ – Article 17)
- Right to restriction of processing (Article 18)
- Right to data portability (Article 20)
- Right to object (Article 21)
- Right to not be subject to automated individual decision-making, including profiling (Article 22),
- Right for remedies (Article 77-82).
- Right to lodge a complaint with a supervisory authority:
Every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes General Data Protection Regulation. You can find further information about remedies under Article 77.
Contact of the supervisory authority:
The National Authority for Data Protection and Freedom of Information
Registered seat: 9-11. Falk Miksa Street, Budapest, 1055 HUNGARY
Postal address: 1363 Budapest, Pf.: 9.
Phone number: +36 (1) 391-1400
E-mail address: ugyfelszolgalat@naih.hu
Place and date: Ásotthalom / 2021 september .24
SPIRIT INNOVA NONPROFIT LTD.
