Privacy policy

Your data protection rights and remedies, including their limitations, are detailed in the GDPR (in particular Articles 15, 16, 17, 18, 19, 20, 21, 22, 77, 78, 79, and 82).

You have the right to request information about your personal data at any time, to request the correction, deletion, or restriction of its processing, to object to processing based on legitimate interests, and to exercise your right to data portability. The key rights are summarized below:

Right to information: If the Data Controller processes personal data concerning you, the Data Controller is obliged to provide you with information – even without a prior request – about the main characteristics of the processing, including the purpose, legal basis, duration of processing, the identity and contact details of the Data Controller and its representative, recipients of personal data (including safeguards for transfers to third countries), the legitimate interests of the Data Controller or third parties when processing is based on legitimate interest, and your rights and remedies related to data processing (including the right to lodge a complaint with a supervisory authority), if you do not already have this information.

Right of access: You are entitled to obtain confirmation from the Data Controller as to whether your personal data is being processed. If such processing is ongoing, you have the right to access the personal data and certain related information, including the purposes of processing, categories of personal data concerned, recipients of personal data, the (planned) retention period, your rights and remedies (including the right to lodge a complaint with a supervisory authority), and, if applicable, the source of the data. Upon request, the Data Controller will provide you with a copy of the personal data under processing. The Data Controller may charge a reasonable administrative fee for additional copies. The right to obtain a copy shall not adversely affect the rights and freedoms of others. The Data Controller will inform you, upon request, about the possibility, method, and any potential costs of obtaining copies.

Right to rectification: You have the right to request that the Data Controller promptly correct inaccurate personal data concerning you. Considering the purpose of processing, you also have the right to request the completion of incomplete personal data, for example by providing a supplementary statement.

Right to erasure (“Right to be Forgotten”): You have the right to request the deletion of your personal data without undue delay, and the Data Controller is obliged to erase your personal data without undue delay if certain conditions apply, including:

• the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
• you withdraw consent on which the processing is based, and there is no other legal basis for processing;
• the personal data has been unlawfully processed;
• you object to the processing and there is no overriding legitimate reason for continued processing;
• the personal data must be erased to comply with a legal obligation under EU or Member State law;
• the personal data has been collected in connection with the offer of information society services.

If the processing is based on your consent, withdrawing consent will prevent you from continuing to use the service.

If you withdraw consent for direct marketing, you will no longer receive direct marketing messages from the Service Provider. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Right to restrict processing: You have the right to request that the Data Controller restrict processing if one of the following applies:

a) you contest the accuracy of the personal data, for the period necessary to verify the accuracy;
b) processing is unlawful and you oppose deletion and instead request restriction;
c) the Data Controller no longer needs the personal data for processing purposes, but you require them to establish, exercise, or defend legal claims; or
d) you have objected to processing, pending verification whether the Data Controller’s legitimate grounds override yours.

Where processing is restricted under the above, personal data may only be processed with your consent, for the establishment, exercise, or defense of legal claims, to protect the rights of another natural or legal person, or for important public interest of the EU or a Member State.

The Data Controller will inform you prior to lifting the restriction.

Right to data portability: You have the right to receive personal data you have provided to the Data Controller in a structured, commonly used, and machine-readable format, and to transmit that data to another Data Controller without hindrance, if:

a) processing is based on your consent or a contract in which you are a party; and
b) processing is carried out by automated means.

Where technically feasible, you may request direct transmission of your personal data between data controllers. The right to data portability shall not adversely affect the right to erasure or the rights and freedoms of others.

Right to object: You have the right to object at any time to the processing of your personal data based on the Data Controller’s legitimate interests, including profiling based on such provisions. In such cases, the Data Controller shall no longer process the data unless it demonstrates compelling legitimate grounds that override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims. If personal data is processed for direct marketing, including profiling for direct marketing purposes, you may object at any time; upon objection, personal data shall no longer be processed for such purposes.

Exercising your rights: The Data Controller shall respond without undue delay, and at the latest within one month of receiving your request. Considering the complexity and number of requests, this period may be extended by a further two months. The Data Controller shall inform you of any extension, including reasons, within one month of receiving your request.

If the Data Controller does not take action following your request, it shall inform you without delay, and at the latest within one month of receiving the request, of the reasons and your right to lodge a complaint with the competent supervisory authority (in Hungary: the National Authority for Data Protection and Freedom of Information – NAIH), and to seek judicial remedies.

NAIH Contact:

• Address: 1125 Budapest, Szilágyi Erzsébet fasor 22/C
• Phone number: +36 1 391 1400
• Fax: +36 1 391 1410
• Email: ugyfelszolgalat@naih.hu
• Website: http://naih.hu

You may also bring legal action in court. Proceedings may be initiated either at your place of residence or habitual residence. The court may order the Data Controller to provide information, rectify, restrict, or erase personal data, annul automated decision-making, and take your objection into account. The court may order publication of its judgment so that the Data Controller or any other data controller and the violation are identifiable.

You may claim compensation from the Data Controller for damages resulting from unlawful processing, including breaches of data security. The Data Controller is exempt from liability if it proves that the damage or violation of your rights was caused by unavoidable reasons beyond its control. No compensation is payable if the damage arose from intentional or grossly negligent conduct by the affected party.