OnSize Ltd.

Privacy Policy

Introduction

OnSize Kft. (2142 Nagytarcsa, Gránit utca 9, tax ID: 14504435-2-13, company registration number: 13-09-164209) (hereinafter: Service Provider, Data Controller) processes personal data in accordance with the provisions set forth in this notice. REGARDING THE PROTECTION OF NATURAL PERSONS WITH RESPECT TO THE PROCESSING OF PERSONAL DATA AND ON THE FREE MOVEMENT OF SUCH DATA, AND REPEALING DIRECTIVE 95/46/EC (GENERAL DATA PROTECTION REGULATION) REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (April 27, 2016), we we provide the following information.

This Privacy Policy governs the data processing practices of the following websites and mobile applications: https://onsize.eu/

The data processing policy is available at following page : https://onsize.eu/pages/adatkezelesi-tajekoztato https://onsize.ro/pages/gdpr Amendments to this policy take effect upon publication at the above address.

The data controller and its contact information

Name: OnSize Kft.

Registered office: 2142 Nagytarcsa, Gránit utca

9. Email: info@onsize.eu

Phone: +36 20 237 9528

Definitions

1. “personal data” means any information relating to an identified or identifiable natural person (“data subject”); “identifiable” means a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

2. “data processing”: any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means or any operation or set of operations performed in a non-automated manner, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction;

3. “controller”: the natural or legal person, public authority, agency, or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by Union or Member State law, Union or Member State law may also determine the controller or specific criteria for designating the controller;

4. “data processor”: a natural or legal person, public authority, an agency or any other body that processes personal data on behalf of the data controller;

5. “recipient”: a natural or legal person, public authority, agency, or any other body to whom or which personal data is disclosed, whether a third party or not. Public authorities that have access to personal data in the context of an individual investigation in accordance with Union or Member State law shall not be considered recipients; the processing of such data by those public authorities must comply with the applicable data protection rules in accordance with the purposes of the processing;

6. “consent of the data subject”: a freely given, specific, adequate information, by which the data subject, by a statement or by a clear affirmative action, indicates his or her agreement to the processing of personal data relating to him or her;

7. “data breach”: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, personal data transmitted, stored, or otherwise processed.

8. “profiling”: any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural , in particular for the analysis or prediction of characteristics relating to work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements;

9. “third party”: a natural or legal person, public authority, agency, or any other body other than the data subject, the controller, the processor, or those persons who, under the direct authority of the controller or processor, are authorized to process personal data.

Principles Governing the Processing of Personal Data

Personal data:

1. must be processed lawfully, fairly, and in a transparent manner in relation to the data subject (“lawfulness, fairness, and transparency”);

2. shall be collected only for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes; in accordance with Article 89(1), further processing for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes shall not be considered incompatible with the original purpose (“purpose limitation”);

3. the purposes of the data processing must be appropriate and relevant to the purposes of the data processing and must be limited to what is necessary (“data minimization”);

4. they must be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes of the processing, are erased or rectified without delay (“accuracy”);

5. Personal data must be stored in a form that allows for the identification of data subjects only for as long as is necessary to achieve the purposes of the processing; personal data may be stored for a longer period only if the processing is carried out for archiving purposes in the public interest in accordance with Article 89(1), for scientific or historical research purposes or for statistical purposes, subject to the implementation of appropriate technical and organizational measures required by this Regulation to protect the rights and freedoms of data subjects (“limited storage”);

6. processing must be carried out in such a manner that appropriate technical or organizational measures ensure the appropriate security of personal data, including protection against unauthorized or unlawful processing, accidental loss, destruction, or damage (“integrity and confidentiality”).

The data controller is responsible for compliance with the above and must be able to demonstrate such compliance (“accountability”).

The data controller declares that its data processing is carried out in accordance with the principles set forth in this section.

Data processing related to the operation of the online store

1. The fact of data collection, the scope of the data processed, and the purpose of data processing:

Personal data	Purpose of data processing	Legal basis
Username	Identification, enabling registration.	Consent of the data subject, Article 6(1)(a) of the GDPR.
Password	Used to ensure secure access to the user account.	Consent of the data subject, Article 6(1)(a) of the GDPR.
First and last name	This is required for contacting you, making a purchase, issuing a proper invoice, and exercising the right of withdrawal.	Performance of a contract, Article 6 (1)(b).
Email address	To maintain contact.
Phone number	Communication, more efficient coordination of issues related to billing or shipping.
Billing name and address	Issuing a valid invoice, as well as creating the contract, determining its content, modifying it, monitoring its fulfillment, invoicing the resulting fees, and enforcing related claims.	Compliance with a legal obligation, Article Article 6(1)(c). (The legal obligation is Section 169(2) of Act C of 2000 on Accounting)
Shipping name and address	To enable home delivery.	Performance of a contract, Article 6 (1)(b).
Date of purchase/registration	Execution of a technical operation.	Performance of a contract, Article 6 (1)(b).
At the IP address at the time of purchase/registration IP address	Execution of a technical operation.	Performance of a contract, Article 6 (1)(b).

2. Data subjects: All data subjects who have registered or made a purchase on the webshop website. Neither the username nor the email address is required to contain personal data.

3. Duration of data processing, deadline for erasure of data: If any of the conditions set forth in Article 17(1) of the GDPR apply, the data will be retained until the data subject requests erasure. The data controller shall inform the data subject electronically of the erasure of any personal data provided by the data subject, in accordance with Article 19 of the GDPR. If the data subject’s request for erasure also extends to the email address provided by them, the data controller shall also erase the email address following the notification. Except in the case of accounting documents, as these data must be retained for 8 years pursuant to Section 169(2) of Act C of 2000 on Accounting. The data subject’s contractual data may be erased upon the expiration of the civil statute of limitations based on the data subject’s request for erasure.

Accounting documents directly and indirectly supporting the bookkeeping records (including general ledger accounts, analytical, and detailed records) must be retained in a readable format for at least 8 years, in a manner that allows them to be retrieved based on references in the accounting records.

4. Description of data subjects’ rights regarding data processing:

The data subject may request from the data controller access to personal data concerning him or her, the rectification, erasure, or restriction of processing of such data, and
The data subject has the right to data portability and to withdraw consent at any time.

5. The data subject may request access to, deletion of, modification of, or restriction of the processing of personal data, as well as data portability, in the following ways:

by mail at 2142 Nagytarcsa, Gránit utca 9,
by email atinfo@onsize.eu ,
by phone at +36 20 237 9528.

6. Please be advised that

data processing is necessary for the performance of the contract and for providing a quote.
You are required to provide your personal data so that we can fulfill your order.
Failure to provide the required information will result in our inability to process your order.

Contact

1. The fact of data collection, the scope of the data processed, and the purpose of data processing:

Personal data	Purpose of data processing	Legal basis
Name	Identification	Article 6(1)(a) of the GDPR
Email address	Communication, sending replies
Phone number	Contact
Message content, if it contains personal data	Required to reply

In the case of an email address, it is not necessary for it to contain personal data.

2. Data subjects: All data subjects who send a message via the contact form.

3. Duration of data processing and deadline for erasure: The data controller will process personal data until the purpose of the processing has been fulfilled, but for no longer than 2 years. If any of the conditions set forth in Article 17(1) of the GDPR apply, data processing will continue until the data subject requests erasure.

4. Description of data subjects’ rights regarding data processing:

The data subject may request from the data controller access to, rectification of, erasure of, or restriction of the processing of personal data concerning him or her, and
the data subject has the right to data portability and to withdraw consent at any time.

5. The data subject may request access to personal data, their erasure, rectification, or restriction of processing, as well as data portability, in the following ways:

by mail at 2142 Nagytarcsa, Gránit utca 9,
by email atinfo@onsize.eu ,
by phone at +36 20 237 9528.

6. Legal basis for data processing: the data subject’s consent, Article 6(1)(a). By contacting us, you consent to the processing of the personal data you provide during the contact (name, phone number, email address) in accordance with this policy.

7. Please be advised that

this data processing is based on your consent and is necessary for us to provide you with an offer.
You are required to provide your personal information so that we can contact you.
Failure to provide this information will result in your inability to contact the data controller.
Withdrawal of consent does not affect the lawfulness of data processing based on consent prior to withdrawal.

Customer Relationship

1. The fact of data collection, the scope of the data processed, and the purpose of data processing:

Personal data	Purpose of data processing	Legal basis
Name, email address, phone number.	Communication, identification, performance of contracts, business purposes.	Article 6(1) (b).

2. Data subjects: All data subjects who are in contact with the data controller by phone, email, or in person, or who have a contractual relationship with the data controller.

3. Duration of data processing and deadline for erasure: Emails containing requests will be retained until the data subject submits a request for erasure, but for no longer than 2 years.

4. Identity of potential data controllers authorized to access the data, recipients of personal data: Personal data may be processed by the data controller’s authorized employees, in compliance with the above principles.

5. Description of the data subject’s rights regarding data processing:

The data subject may request from the data controller access to their personal data, its rectification, erasure, or restriction of processing, and
the data subject has the right to data portability and to withdraw consent at any time.

6. The data subject may request access to personal data, their erasure, rectification, or restriction of processing, as well as data portability, in the following ways:

by mail at 2142 Nagytarcsa, Gránit utca 9,
by email atinfo@onsize.eu ,
by phone at +36 20 237 9528.

7. Please be advised that

data processing is necessary for the performance of the contract and for providing a quote.
you are required to provide your personal data so that we can fulfill the contract or process your other request.
failure to provide the data will result in our inability to fulfill the contract or process your request.

Cookie Management

1. The so-called “cookies used for password-protected sessions,”

“cookies required for the shopping cart,” “security cookies,” “necessary cookies,” “functional cookies,” and “cookies responsible for managing website statistics do not require prior consent from data subjects.

2. Fact of data processing, scope of processed data: Unique identifier, dates, times.

3. Data subjects: All visitors to the website.

4. Purpose of data processing: To identify users, track visitors, and ensure a personalized experience.

5. Duration of data processing, deadline for data deletion:

Cookie type	Legal basis for data processing	Duration of data processing
Session cookies or other cookies essential for the website’s operation	No data processing occurs through the use of cookies.	The period until the end of the relevant visitor session; therefore, it remains on the computer only until the browser is closed.
Statistical and marketing cookies	Article 6(1) (a)	1 day – 2 years; data processing continues in accordance with the cookie notice or until the data subject withdraws their consent.

6. Explanation of data subjects’ rights regarding data processing: Data subjects have the option to delete cookies in the Tools/Settings menu of their browsers, typically under the Privacy settings.

7. Most browsers used by our users allow you to configure which cookies should be saved and enable the deletion of (specific) cookies. If you restrict the saving of cookies on specific websites or do not allow third-party cookies, this may, under certain circumstances, result in our website no longer being fully usable. Here you will find information on how to customize cookie settings for common browsers:

Google Chrome (https://support.google.com/chrome/answer/95647?hl=hu) Microsoft Edge (https://support.microsoft.com/...)

Firefox (https://support.mozilla.org/hu/kb/sutik-engedelyezese-es-tiltasa-amit-weboldak-has zn) Safari (https://support.apple.com/hu-hu/guide/safari/sfri11471/mac)

Use of Google Ads conversion tracking

1. The data controller uses the online advertising program “Google Ads” and, within that framework, utilizes Google’s conversion tracking service. Google conversion tracking is an analytics service provided by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; “Google”).

2. When a User accesses a website via a Google ad, a cookie required for conversion tracking is placed on their computer. These cookies have a limited validity period and do not contain any personal data, so the User cannot be identified by them.

3. When the User browses certain pages of the website and the cookie has not yet expired, both Google and the data controller can see that the User clicked on the ad.

4. Each Google Ads customer receives a different cookie, so they cannot be tracked across Ads customers’ websites.

5. The information—collected using conversion tracking cookies—is used to generate conversion statistics for Ads clients who have opted into conversion tracking. This allows clients to see the number of users who clicked on their ad and were redirected to a page tagged with a conversion tracking tag. However, they do not have access to information that could be used to identify any individual user.

6. If you do not wish to participate in conversion tracking, you can opt out by disabling cookies in your browser. You will then not be included in the conversion tracking statistics.

7. Under Google Consent Mode v2, Google also uses two new types of cookies: ad_user_data and ad_personalization, which are based on the user’s consent and relate to the use and sharing of data. The ad_user_data cookie is used to grant consent for Google to use user data for advertising purposes. The ad_personalization cookie determines whether data may be used to personalize ads (e.g., remarketing). The data controller ensures that the appropriate consents are obtained and revoked via its cookie banner/panel. Withdrawal of consent does not affect the lawfulness of data processing based on consent prior to withdrawal.

8. Further information and Google’s privacy policy are available at the following link: https://policies.google.com/privacy

Use of Google Analytics

1. This website uses Google Analytics, a web analytics service provided by Google Inc. (“Google”). Google Analytics uses so-called “cookies,” which are text files stored on your computer, to help analyze how users use the website.

2. The information generated by the cookies regarding your use of this website is usually transmitted to and stored on a Google server in the United States. By activating IP anonymization on this website, Google will truncate your IP address beforehand within member states of the European Union or in other states party to the Agreement on the European Economic Area.

3. The full IP address is only transmitted to a Google server in the U.S. and shortened there in exceptional cases. On behalf of the operator of this website, Google will use this information to evaluate how the User has used the website, to compile reports for the website operator regarding website activity, and to provide other services related to website and internet usage.

4. Within the framework of Google Analytics, Google does not associate the IP address transmitted by the User’s browser with any other data held by Google. The User may prevent the storage of cookies by adjusting the settings in their browser; however, please note that in this case, not all features of this website may be fully available. You can also prevent Google from collecting and processing data related to your use of the website (including your IP address) via cookies by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=hu

Newsletter and Direct Marketing Activities Based on Consent

1. Pursuant to Section 6 of Act XLVIII of 2008 on the Fundamental Conditions and Certain Restrictions of Commercial Advertising Activities, unless otherwise provided by a separate law, advertising may be communicated to a natural person—the User—as the recipient of the advertisement through direct solicitation (hereinafter: direct marketing), in particular via electronic mail or other equivalent means of individual communication, is permitted only if the recipient of the advertisement has given their prior, clear, and explicit consent.

2. Furthermore, the User may consent, in accordance with the provisions of this notice, to the Service Provider processing the personal data necessary for sending advertising offers.

3. The Service Provider does not send unsolicited promotional messages, and the User may unsubscribe from receiving such offers free of charge, without restriction or justification. In such cases, the Service Provider will delete all personal data necessary for sending promotional messages from its records and will not contact the User with further promotional offers. The User may unsubscribe from advertisements by clicking on the link in the message.

4. The fact of data collection, the scope of processed data, and the purpose of data processing:

Personal data	Purpose of data processing	Legal basis
Name, email address.	Identification, newsletter/promotional Enabling subscription to coupons .	Consent of the data subject, Article Article 6(1)(a).
Execution of the Time	Performance of a technical operation.
IP address at the time of subscription Address	Execution of a technical operation.

5. The newsletter is sent in compliance with the provisions of Act XLVIII of 2008 on the basic conditions and certain restrictions of commercial advertising activities.

6. Data subjects: All individuals who subscribe to the newsletter.

7. Purpose of data processing: sending electronic messages containing advertisements (email, SMS, push notifications) to the data subject, providing information on current news, products, promotions, new features, etc.

8. Duration of data processing and deadline for data deletion: Data processing continues until consent is withdrawn (until unsubscription or the data subject’s request for deletion) or until the newsletter is discontinued.

9. Description of the data subject’s rights regarding data processing:

The data subject may request from the data controller access to their personal data, its rectification, erasure, or restriction of processing, and
the data subject has the right to data portability and to withdraw consent at any time.

10. Data subjects may request access to their personal data, the erasure or rectification of such data, the restriction of processing, or data portability in the following ways:

by mail at 2142 Nagytarcsa, Gránit utca 9,
by email atinfo@onsize.eu ,
by phone at +36 20 237 9528.

11. You may unsubscribe from the newsletter at any time, free of charge.

12. Please be advised that

data processing is based on your consent.
You are required to provide your personal data if you wish to receive our newsletter.
failure to provide your data will result in our inability to send you the newsletter.
Please be advised that you may withdraw your consent at any time by clicking “Unsubscribe.”
Withdrawing your consent does not affect the lawfulness of data processing based on your consent prior to withdrawal.

Complaint Handling

1. The fact of data collection, the scope of the data processed, and the purpose of data processing:

Personal data	Purpose of data processing	Legal basis
Landline and First name	Identification, maintaining contact.	Compliance with a legal obligation, Article 6 (1)(c). (Relevant legal obligation: Section 17/A(7) of Act CLV of 1997 on Consumer Protection)
Email address	Maintaining contact.
Phone number	Contact information.
Billing name and address	Identification, the ordered quality issues, complaints, questions, and problems complaints, questions, and issues .

2. Data subjects: All data subjects who make a purchase on the website and raise a quality complaint or make a complaint.

3. Duration of data processing, deadline for data deletion: Copies of the report on the complaint, the transcript, and the response thereto must be retained for 3 years pursuant to Section 17/A(7) of Act CLV of 1997 on Consumer Protection.

4. Description of the data subjects’ rights regarding data processing:

The data subject may request from the data controller access to, rectification, erasure, or restriction of processing of personal data concerning him or her, and
the data subject has the right to data portability and to withdraw consent at any time

5. The data subject may request access to personal data, their erasure, rectification, or restriction of processing, as well as data portability, in the following ways:

by mail at 2142 Nagytarcsa, Gránit utca 9,
by email atinfo@onsize.eu ,
by phone at +36 20 237 9528.

6. Please be advised that

the provision of personal data is based on a legal obligation.
The processing of personal data is a prerequisite for entering into the contract.
You are required to provide your personal data so that we can process your complaint.
Failure to provide this information will result in our inability to process the complaint you have submitted to us.

Recipients to whom personal data is disclosed

“Recipient”: any natural or legal person, public authority, agency, or any other body to whom or which personal data is disclosed, regardless of whether they are a third party.

1. Data processors (who process data on behalf of the data controller)

The data controller engages data processors to facilitate its own data processing activities and to fulfill its obligations under contracts with data subjects and applicable laws.

The data controller places great emphasis on engaging only data processors who provide adequate guarantees regarding the implementation of appropriate technical and organizational measures to ensure compliance with the data processing requirements set forth in the GDPR and the protection of data subjects’ rights.

The data processor and any person acting under the authority of the data controller or the data processor who has access to personal data shall process the personal data set forth in this policy solely in accordance with the data controller’s instructions.

The data controller is legally liable for the activities of the data processor. The data processor shall be liable for damages caused by data processing only if it has failed to comply with the obligations set forth in the GDPR that specifically apply to data processors, or if it has disregarded the data controller’s lawful instructions or acted contrary to them.

The data processor has no decision-making authority regarding the processing of data. The data controller may engage a hosting provider to provide the necessary IT infrastructure and a courier service to deliver ordered products, both acting as data processors.

2. Certain data processors

Data processing activities	Name, address, contact information
Web hosting	Web hosting: Shopify Inc (150 Elgin Street 8th Floor Ottawa, ON K2P 1L4 Canada); Email: Google Workspace
Other data processors (e.g., online invoicing, web development, marketing)	Számlázz.hu software (KBOSS.hu Kft., tax ID: 13421739-2-41, company registration number: 01-09-303201) BILLINGO TECHNOLOGIES ZRT. (Tax ID: 27926309-24-1, company registration number: 01 10 140802) GLS GENERAL LOGISTICS SYSTEMS HUNGARY KFT. (Tax ID: 12369410-24-4, Company registration number: 13 09 111755) Wise Digital Limited Liability Company (1033 Budapest, Csikós utca 8, 1st floor, door 11, tax ID: 27739462-2-41) Klaviyo, Inc. (Floor 6, 125 Summer Street, Boston, MA 02111, United States, (617) 213-1788)

“third party”: a natural or legal person, public authority, agency, or any other body that is not the data subject, the data controller, the data processor, or any person authorized to process personal data under the direct authority of the data controller or data processor.

3. Data Transfer to Third Parties

Third-party data controllers process the personal data we provide on their own behalf and in accordance with their own privacy policies.

Data controller’s activities	Name, address, contact information
Transport	GLS General Logistics Systems Hungary Parcel Logistics Ltd. (2351 Alsónémedi, GLS Európa u. 2., email:info@gls-hungary.com );
Online payment	Teya (SaltPay)

Social media platforms

The data controller maintains a presence on social media platforms in order to showcase its services and stay in touch with prospective customers and clients.

Scope of processed data: Data publicly available on the data subject’s social media profile, specifically:

– name (username) – public profile picture – interactions posted by the data subject or related to the data controller’s page (e.g., comments, messages).

Scope of data subjects: Natural persons who follow the data controller’s social media page, contact it, or send messages through it.

Purpose of data processing:

– to present the data controller’s activities and services, – marketing and communication on social media platforms, – maintaining contact with interested parties and customers.

Legal basis for data processing: The data subject’s voluntary consent to the processing of their personal data on social media platforms.

Duration of data processing: Data processing continues for as long as the data subject’s interaction remains active or until the content posted by the data subject is deleted. The data controller retains messages and communications for up to 2 years.

Additional data controllers: Social media platforms process users’ data as independent data controllers in accordance with their own privacy policies.

Facebook / Meta joint data processing

The data controller maintains a Facebook / Meta profile for this activity. Data processing for statistical purposes carried out on the Facebook social media site is a joint data processing arrangement between the Data Controller and Facebook Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, Ireland). Detailed information regarding the terms of the joint data processing agreement is provided in the Data Controllers’ Addendum for the Facebook Page Insights feature. The addendum is available at the following link: https://www.facebook.com/legal/terms/page_controller_addendum The Data Controller communicates via private message on the social media site only if you contact us there.

1. Categories of Data Subjects

data subjects who have registered on the social media site and “liked” the Data Controller’s profile page,
any data subject who contacts the Data Controller via a private message on the social media site.

2. Purpose of data processing

The purpose of data processing is to share and promote the Data Controller’s activities and services on the Facebook social media platform. The Data Controller may use the data provided by the data subject in a private message to respond to the message; otherwise, the Data Controller does not collect data through social media platforms nor does it extract data from them.

3. Legal basis for data processing

Data processing is based on Article 6(1)(a) of the GDPR; the legal basis for data processing is the data subject’s consent to the processing of their personal data on the Facebook social media platform.

4. Scope of processed data

the data subject’s registered name,
the data subject’s public profile picture
other public data provided or shared by the data subject on the social media platform

5. Source of the personal data processed: The data subject is the source of the data processed.

6. Withdrawal of consent: You may withdraw your consent to data processing at any time and delete your post or comment. Data processing takes place via social media platforms operated by third parties . If you withdraw your consent, the Data Controller will delete the conversation with you. Withdrawal of consent does not affect the lawfulness of data processing based on consent prior to withdrawal.

You may request access to your personal data, their deletion, modification, or restriction of processing, and data portability may be requested by the data subject in the following ways:

by mail at 2142 Nagytarcsa, Gránit utca 9,
by email atinfo@onsize.eu ,
by phone at +36 20 237 9528.

7. Duration of data processing

until the data subject withdraws their consent,
or, if correspondence takes place, for 2 years.

8. Transfer of personal data, recipients, and categories of recipients: For the definition of “recipient,” see Article 4(9) of the GDPR. The Data Controller shall only transfer the Data Subject’s personal data to state bodies and authorities—including, in particular, courts, the public prosecutor’s office, investigative authorities, administrative authorities, and the National Authority for Data Protection and Freedom of Information—in exceptional cases and pursuant to a legal obligation.

9. Possible consequences of failure to provide data

If data is not provided, the Data Subject will not be able to obtain information about the Data Controller’s activities and services via the Facebook social media platform or send messages to the Data Controller via Facebook Messenger.

10. Automated decision-making (including profiling): No automated decision-making, including profiling, takes place during data processing.

11. Joint Data Controller Agreement with Facebook Ireland Ltd.:

The Page Insights feature displays aggregated data that provides insight into how data subjects use the Facebook page. Facebook Ireland Limited (“Facebook Ireland”) and the Data Controller are joint controllers with respect to the processing of analytics data. The Page Insights Addendum defines Facebook’s responsibilities and the Data Controller’s responsibilities regarding the processing of analytics data. Facebook Ireland assumes primary responsibility under the GDPR for the processing of analytics data and for complying with all relevant obligations under the GDPR regarding the processing of analytics data. Facebook Ireland also makes an excerpt of the Page Insights Addendum available to all data subjects. The Data Controller shall ensure that it has a valid legal basis for processing analytics data under the GDPR, identifies the Page’s data controller, and complies with all other applicable legal obligations. Facebook Ireland is solely responsible for the processing of personal data in connection with the Page Insights feature, except for data falling within the scope of the Page Insights Addendum. The Page Insights Addendum does not grant the Data Controller the right to request personal data of Facebook users that Facebook Ireland processes in connection with Facebook, including page analytics data. The Data Controller may not act on behalf of Facebook Ireland in responding to data protection requests and may not provide responses.

Customer Relations and Other Data Processing

1. If any questions arise or the data subject encounters any issues while using the Data Controller’s services, they may contact the Data Controller via the methods provided on the website (phone, email, social media, etc.).

2. The Data Controller will delete data received via email, messages, telephone, Meta, etc., along with the inquirer’s name and email address, as well as any other personal data voluntarily provided, no later than two years after the data was provided.

3. We will provide information regarding data processing not listed in this notice at the time the data is collected.

4. In the event of an exceptional request from an authority, or a request from other bodies authorized by law, the Service Provider is obligated to provide information, disclose data, transfer data, or make documents available.

5. In such cases, the Service Provider shall disclose personal data to the requesting party—provided that the party has specified the exact purpose and scope of the data— only to the extent strictly necessary to fulfill the purpose of the request.

Rights of Data Subjects

1. Right of access

You have the right to receive confirmation from the data controller as to whether your personal data is being processed, and if such processing is taking place, you have the right to access your personal data and the information listed in the Regulation.

2. Right to Rectification

You have the right to have inaccurate personal data concerning you rectified by the data controller without undue delay upon your request. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

3. Right to erasure

You have the right to request that the data controller erase personal data concerning you without undue delay, and the data controller is obligated to erase personal data concerning you without undue delay under certain conditions.

4. The Right to Be Forgotten

If the data controller has made the personal data public and is required to erase it, it shall, taking into account available technology and the cost of implementation, take reasonable steps—including technical measures—to inform data controllers processing the data that you have requested the deletion of links to, or copies or replicas of, the personal data in question.

5. Right to Restriction of Processing

You have the right to request that the data controller restrict data processing if any of the following conditions are met:

You contest the accuracy of the personal data; in this case, the restriction applies for a period enabling the data controller to verify the accuracy of the personal data;
the processing is unlawful, and you oppose the erasure of the data and instead request the restriction of its use;
the data controller no longer needs the personal data for the purposes of processing, but you require it for the establishment, exercise, or defense of legal claims;
You have objected to the processing of your data; in this case, the restriction applies for as long as it has not been determined whether the controller’s legitimate grounds override your legitimate grounds.

6. Right to data portability

You have the right to receive the personal data concerning you that you have provided to a data controller in a structured, commonly used, and machine-readable format, and you have the right to transmit those data to another controller without hindrance from the controller to whom you have provided the personal data (...)

7. Right to object

In cases where data processing is based on legitimate interests or on the exercise of official authority as legal grounds, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data by (...) including profiling based on the aforementioned provisions.

8. Objection in the case of direct marketing

If personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for this purpose, including profiling, provided that it is related to direct marketing. If you object to the processing of personal data for direct marketing purposes, the personal data may no longer be processed for that purpose.

9. Automated decision-making in individual cases, including profiling: You have the right not to be subject to a decision based solely on automated processing—including profiling—that produces legal effects concerning you or similarly significantly affects you.

The preceding paragraph does not apply if the decision:

is necessary for the conclusion or performance of a contract between you and the data controller;
is authorized by Union or Member State law to which the data controller is subject, which also provides for appropriate measures to safeguard your rights, freedoms, and legitimate interests; or
is based on your explicit consent.

Timeframe for Action

The data controller shall inform you of the measures taken in response to the above requests without undue delay, but in any event within 1 month of receipt of the request.

If necessary, this may be extended by 2 months. The data controller will inform you of any extension of the deadline within 1 month of receiving the request, stating the reasons for the delay.

If the data controller does not take action in response to your request, it will inform you without delay, but no later than one month from the date of receipt of the request, of the reasons for not taking action, as well as of your right to file a complaint with a supervisory authority and to seek judicial remedy.

Security of Data Processing

The data controller and the data processor shall take appropriate technical and organizational measures, taking into account the state of the art, the costs of implementation, as well as the nature, scope, context, and purposes of the processing, and the risk of varying likelihood and severity to the rights and freedoms of natural persons, to ensure a level of security appropriate to the risk, including, where appropriate:

1. pseudonymization and encryption of personal data;

2. ensuring the ongoing confidentiality, integrity, availability, and resilience of the systems and services used to process personal data;

3. in the event of a physical or technical incident, the ability to restore access to personal data and the availability of the data in a timely manner;

4. a procedure for regularly testing, assessing, and evaluating the effectiveness of the technical and organizational measures taken to ensure the security of data processing.

5. Processed data must be stored in such a way that unauthorized persons cannot access it.

In the case of paper-based data carriers, this is achieved by establishing a system for physical storage and archiving; in the case of data processed in electronic form, by using a central access control system.

6. The method of storing data using IT must be selected so that its deletion—taking into account any differing retention periods—can be performed upon the expiration of the data retention period or when necessary for other reasons. The deletion must be irreversible.

7. Paper-based data carriers must be stripped of personal data using a document shredder or by engaging an external organization specializing in document destruction. In the case of electronic data carriers, physical destruction must be ensured in accordance with the rules governing the disposal of electronic data carriers, and, if necessary, the data must be securely and irreversibly deleted in advance.

8. The data controller implements the following specific data security measures:

To ensure the security of personal data processed on paper, the Service Provider applies the following measures (physical protection):

1. Documents must be stored in a secure, lockable, dry room.

2. If personal data processed on paper is digitized, the rules governing digitally stored documents shall apply

3. The Service Provider’s employee responsible for data processing may only leave the room where data processing is taking place to secure the data storage media entrusted to them or to lock the room.

4. Personal data may only be accessed by authorized persons; third parties may not have access to it.

5. The Service Provider’s building and premises are equipped with fire safety and security systems.

IT Security

1. The computers and mobile devices (and other data storage media) used in data processing are the property of the Service Provider.

2. The computer system used by the Service Provider that contains personal data is equipped with virus protection.

3. To ensure the security of digitally stored data, the Service Provider performs data backups and archiving.

4. Access to the central server is restricted to authorized personnel only.

5. Data on the computers can only be accessed with a username and password.

Notifying the data subject of a data breach

If the data breach is likely to result in a high risk to the rights and freedoms of natural persons, the data controller shall notify the data subject without undue delay.

The information provided to the data subject must clearly and in plain language describe the nature of the data breach and provide the name and contact details of the data protection officer or other contact person providing further information; it must describe the likely consequences of the data breach; the measures taken or planned by the data controller to address the data breach must be described, including, where appropriate, measures to mitigate any adverse consequences resulting from the data breach.

The data subject does not need to be informed if any of the following conditions are met:

the controller has implemented appropriate technical and organizational security measures, and those measures were applied to the data affected by the personal data breach, in particular measures—such as encryption—that render the data unintelligible to any person who is not authorized to access the personal data;
the controller has taken further measures following the data breach to ensure that the high risk to the rights and freedoms of the data subject is unlikely to materialize in the future;
notification would require a disproportionate effort. In such cases, data subjects must be informed through publicly available information or by taking similar measures that ensure data subjects are informed in an equally effective manner.

If the data controller has not yet notified the data subject of the data breach, the supervisory authority may, after assessing whether the data breach is likely to result in a high risk, order that the data subject be notified.

Reporting a data breach to the authority

The data controller shall notify the competent supervisory authority of the personal data breach without undue delay and, where feasible, no later than 72 hours after becoming aware of the personal data breach, to the competent supervisory authority pursuant to Article 55, unless the data breach is unlikely to pose a risk to the rights and freedoms of natural persons. If the notification is not made within 72 hours, the reasons for the delay must also be provided.

Review in the case of mandatory data processing

If the duration of mandatory data processing or the periodic review of its necessity is not specified by law, a local government ordinance, or a binding legal act of the European Union, the data controller shall review, at least every three years from the commencement of data processing, whether the processing of personal data by the data controller or by a data processor acting on its behalf or pursuant to its instructions is necessary to achieve the purpose of the data processing.

The controller shall document the circumstances and results of this review, retain this documentation for ten years following the completion of the review, and make it available to the National Authority for Data Protection and Freedom of Information (hereinafter: the Authority) upon the Authority’s request.

Right to File a Complaint

Complaints regarding any potential violations by the data controller may be filed with the National Authority for Data Protection and Freedom of Information:

National Authority for Data Protection and Freedom of Information 1055 Budapest, Falk Miksa Street 9-11

Mailing Address: 1363 Budapest, P.O. Box 9

Phone: +36-1-391-1400

Fax: +36-1-391-1410

Email: ugyfelszolgalat@naih.hu

Closing Remarks

In preparing this information sheet, we have taken into account the following laws and recommendations:

On the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (GDPR) (April 27, 2016);
Act CVIII of 2001 – on certain issues concerning electronic commerce services and information society services (in particular Section 13/A);
Act XLVII of 2008 – on the Prohibition of Unfair Commercial Practices against Consumers;
Act XLVIII of 2008 – on the fundamental conditions and certain restrictions of commercial advertising (in particular Section 6a);
Act XC of 2005 on freedom of electronic information;
Act C of 2003 on Electronic Communications (specifically Section 155a);
Opinion No. 16/2011 on the EASA/IAB Recommendation on Best Practices for Behavioral Online Advertising;
Recommendation of the National Authority for Data Protection and Freedom of Information on data protection requirements for prior information.

Version: 3 · Date of approval: April 19, 2021 · Date generated: April 19, 2021 · Date updated: April 27, 2026 · Verified and prepared by: Virtualjog.hu

Privacy Policy