Privacy Statement

PRIVACY STATEMENT

GENERAL PROVISIONS

The Press Komm Kiadó és Kommunikációs Kft., as the operator of Calm Resort Hertelend, ensures in all cases the lawfulness and appropriateness of the processing of the personal data it handles. The purpose of this notice is to give our guests who book accommodation and provide their personal data appropriate information – from the period before booking or providing their personal data until after their departure – about the conditions and guarantees under which, and for how long, our company processes their data. Our company adheres to the contents of this notice in all cases involving the processing of personal data and considers them binding upon itself.

We reserve the right to amend the contents of this unilateral legal statement. The data processing activities of our company are based on voluntary consent or, in some cases, are necessary for taking steps at the request of the data subject prior to entering into a contract.

Our data processing complies with the applicable legislation, in particular the following:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: "GDPR")

• Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information ("Info Act").

Our company details and contact information are as follows:

Name: Press Komm Kft.

Registered office: H-1035 Budapest, Miklós u. 7.

Company registration number: 01-09-931020

Tax number: 11706944-2-41

Telephone: +36 30 4711373

Email: booking@calmresort.hu

1.2. DEFINITIONS

data subject: any natural person identified, or directly or indirectly identifiable, on the basis of specific personal data;

personal data: data relating to the data subject – in particular the name and identification number of the data subject, and one or more factors specific to their physical, physiological, mental, economic, cultural or social identity – as well as any conclusions drawn from such data concerning the data subject;

consent: a voluntary and explicit indication of the data subject's wishes, based on appropriate information, by which they give unambiguous agreement to the processing of personal data relating to them, either in full or for specific operations;

controller: the natural or legal person, or organisation without legal personality, which alone or jointly with others determines the purpose of the processing of data, makes and implements decisions regarding the processing (including the means used), or has them implemented by a processor;

data processing: any operation or set of operations performed on data, regardless of the procedure used, in particular collection, recording, organisation, storage, alteration, use, retrieval, transfer, disclosure, alignment or combination, blocking, erasure and destruction, as well as preventing further use of the data, taking photographs, sound or video recordings, and recording physical characteristics suitable for identifying a person (e.g. fingerprints or palm prints, DNA samples, iris images);

data transfer: making data available to a specified third party;

disclosure: making data available to anyone;

erasure of data: making data unrecognisable in such a way that it can no longer be restored; technical data processing: performing technical tasks related to data processing operations, regardless of the method and means used to carry out the operations and the place of application, provided that the technical task is performed on the data;

processor: the natural or legal person, or organisation without legal personality, which processes data under a contract – including a contract concluded pursuant to a legal provision;

personal data breach: unlawful processing of personal data, in particular unauthorised access, alteration, transfer, disclosure, erasure or destruction, as well as accidental destruction or damage.

We provide the following information regarding our individual data processing activities.

DATA PROCESSING RELATED TO ONLINE ACCOMMODATION BOOKING

Our company offers online accommodation booking so that you can book a room at Calm Resort Hertelend quickly, conveniently and free of charge.

Controller of personal data: Press Komm Kft., H-1035 Budapest, Miklós u. 7.

Purpose of data processing: to make booking accommodation easier, free of charge and more efficient.

Legal basis for data processing: prior consent of the person booking the accommodation.

Scope of personal data processed: title; surname and first name; address (country, postcode, city, street, house number); telephone number; email address; for companies, company name and registered office; bank card number; SZÉP card details (identifier, name on card); gender.

Duration of data processing: two years following the last day of the stay according to the booking.

Use of a data processor: our company uses an IT service provider for the online booking system as follows.

Name of processor	Registered office	Description of processing task
NetHotelBooking Kft.	H-8200 Veszprém, Boksa tér 1/A	Providing online accommodation booking through the RESnWEB system

By accepting this privacy notice, the data subject expressly consents to the Processor engaging further processors – in order to make the service more convenient and personalised – as follows:

Name of further processor	Registered office	Description of processing task
The Rocket Science Group, LLC	675 Ponce de Leon Ave NE Suite 5000, Atlanta, GA 30308, USA	Owner of the Mandrill software integrated into the booking system. This software is responsible for sending automatic emails with confirmations and notifications in the case of bookings, offers and satisfaction surveys
Hostware Kft.	H-1149 Budapest, Róna utca 120-122	Customer management tasks when using the Hostware Front Office hotel system
Triptease Limited	WeWork 3 Waterhouse Square 138-142 Holborn London EC1N 2SW United Kingdom	Online chat function that allows guests to contact the accommodation and manage their bookings quickly and efficiently
BIG FISH Internet-technológiai Kft.	H-1066 Budapest, Nyugati tér 1-2	Handling the data communication required for payment transactions between the merchant's and the payment service provider's systems, and ensuring that transactions can be traced by merchant partners
OTP Mobil Kft.	H-1093 Budapest, Közraktár u. 30-32.	Handling the data communication required for payment transactions between the merchant's and the payment service provider's systems, providing customer support to users, confirming transactions and carrying out fraud monitoring to protect users.
Barion Payment Zrt.	H-1117 Budapest, Infopark sétány 1, Building I	Handling the data communication required for payment transactions between the merchant's and the payment service provider's systems, providing customer support to users, confirming transactions and carrying out fraud monitoring to protect users.
Creative Management Kft.	H-8200 Veszprém, Boksa tér 1, Building A	Server hosting

Possible consequences of failing to provide data: no contract is concluded for the guesthouse room.

Rights of the data subject: the data subject (the person whose personal data is processed by our company)

• may request access to their personal data,

• may request its rectification,

• may request its erasure,

• may request the restriction of the processing of personal data where the conditions set out in Article 18 of the GDPR are met (i.e. that our company does not erase or destroy the data until requested by a court or authority, but for no longer than thirty days, and does not otherwise process the data for any other purpose),

• may object to the processing of personal data,

• may exercise their right to data portability. Under this right, the data subject is entitled to receive their personal data in Word or Excel format and to have our company transfer this data to another controller at their request.

Other information related to data processing: our company takes all necessary technical and organisational measures to prevent a personal data breach (e.g. damage to or loss of files containing personal data, or their becoming accessible to unauthorised persons). Should a breach nevertheless occur, we keep a record for the purpose of monitoring the necessary measures and informing the data subject, which contains the scope of the personal data concerned, the scope and number of persons affected by the breach, the date, circumstances and effects of the breach and the measures taken to remedy it, as well as any other data specified in the legislation governing the processing.

Our company has concluded a data processing agreement for the processing tasks, in which NetHotelBooking Kft. undertakes, when engaging further processors, to apply the data protection and data processing guarantees prescribed for it in the data processing agreement; accordingly, we also ensure the lawful processing of personal data in the case of the processor.

DATA PROCESSING RELATED TO QUOTATION REQUESTS

Our company allows guests to request a quotation electronically. Our company provides the quotation through an automated system, taking available capacity into account.

Controller of personal data: Press Komm Kft., H-1035 Budapest, Miklós u. 7.

Purpose of data processing: providing preliminary information on the guesthouse's prices

Legal basis for data processing: prior consent of the person booking the accommodation

Scope of personal data processed: title; surname and first name; telephone number; email address; number of guests; gender.

Duration of data processing: two years following the last day of the stay according to the booking.

Use of a data processor: our company uses an IT service provider to operate the online quotation request system as follows.

Name of processor	Registered office	Description of processing task
NetHotelBooking Kft.	H-8200 Veszprém, Boksa tér 1/A	Operation of the quotation request module

By accepting this privacy notice, the data subject expressly consents to the Processor engaging further processors – in order to make the service more convenient and personalised – as follows:

Name of further processor	Registered office	Description of processing task
The Rocket Science Group, LLC	675 Ponce de Leon Ave NE Suite 5000, Atlanta, GA 30308, USA	Owner of the Mandrill software integrated into the booking system. This software is responsible for sending automatic emails with confirmations and notifications in the case of bookings, offers and satisfaction surveys
Creative Management Kft.	H-8200 Veszprém, Boksa tér 1, Building A	server hosting

Possible consequences of failing to provide data: The guesthouse cannot provide a quotation.

Rights of the data subject: the data subject (the person whose personal data is processed by our company)

• may request access to their personal data,

• may request its rectification,

• may request its erasure,

• may object to the processing of personal data,

• DATA PROCESSING RELATED TO NEWSLETTER SUBSCRIPTION

Our company keeps in touch with its guests via a newsletter, recommending its services and informing them of news and special offers relating to its operations.

Controller of personal data: Press Komm Kft., H-1035 Budapest, Miklós u. 7.

Purpose of data processing: keeping in touch with potential guests

Legal basis for data processing: consent of the data subject – Article 6(1)(a) GDPR.

Legitimate interest: maintaining and developing business relationships with partners and guests

Scope of personal data processed: name, email address

Duration of data processing: our company processes email addresses until the data subject unsubscribes from the newsletter.

Use of a data processor: our company uses an IT service provider for the online booking system as follows.

Name of processor	Registered office	Description of processing task
NetHotelBooking Kft.	H-8200 Veszprém, Boksa tér 1/A	Storage of the newsletter database
Creative Management Kft.	H-8200 Veszprém, Boksa tér 1/A	Operation of the newsletter system

Possible consequences of failing to provide data: The data subject will not receive newsletters from our company.

Rights of the data subject: the data subject (the person whose personal data is processed by our company)

• may request access to their personal data,

• may request its rectification,

• may request its erasure,

• may object to the processing of personal data,

You can unsubscribe from the newsletter at any time by sending an email to our company at booking@calmresort.hu, or by clicking the unsubscribe link in the newsletter. In this case, your email address will be deleted from our database immediately.

Our company has concluded a data processing agreement for the processing tasks, in which NetHotelBooking Kft. and Creative Management Kft. undertake, when engaging further processors, to apply the data protection and data processing guarantees prescribed for them in the data processing agreement; accordingly, we also ensure the lawful processing of personal data in the case of the processor.

• PERSONAL DATA PROCESSING RELATED TO SATISFACTION SURVEYS

As a guesthouse, our aim is to provide our services to our guests to a high standard, so we continuously ask our guests for feedback on their experiences during their stay at our guesthouse.

Controller of personal data: Press Komm Kft., H-1035 Budapest, Miklós u. 7.

Purpose of data processing: requesting feedback from guests in order to further develop and improve our services.

Legal basis for data processing: legitimate interest of the guesthouse operator – Article 6(1)(f) GDPR.

Legitimate interest: our company has a legitimate interest in receiving information from feedback in order to develop our services.

Scope of personal data processed: name, gender, email address.

Duration of data processing: two years following the last day of the stay according to the booking.

Use of a data processor: our company uses an IT service provider for the online booking system as follows.

Name of processor	Registered office	Description of processing task
NetHotelBooking Kft.	H-8200 Veszprém, Boksa tér 1/A	Operation of the satisfaction survey module

By accepting this privacy notice, the data subject expressly consents to the Processor engaging further processors – in order to make the service more convenient and personalised – as follows:

Name of further processor	Registered office	Description of processing task
The Rocket Science Group, LLC	675 Ponce de Leon Ave NE Suite 5000, Atlanta, GA 30308, USA	Owner of the Mandrill software integrated into the booking system. This software is responsible for sending automatic emails with confirmations and notifications in the case of bookings, offers and satisfaction surveys

Possible consequences of failing to provide data: The data subject will not receive a satisfaction survey from our company.

Rights of the data subject: the data subject (the person whose personal data is processed by our company)

• may request access to their personal data,

• may request its rectification,

• may request its erasure,

• may object to the processing of personal data,

• COOKIE MANAGEMENT

In order to provide a personalised service, the Controller places a small data package, a so-called cookie, on the user's computer and reads it back during subsequent visits. If the browser returns a previously saved cookie, the provider managing the cookie can link the user's current visit with previous ones, but only in respect of its own content.

Purpose of data processing: identifying and tracking users and distinguishing them from one another, identifying users' current sessions, storing data entered during sessions, preventing data loss, web analytics measurements and personalised service.

Legal basis for data processing: consent of the data subject.

Scope of data processed: identification number, date, time and the previously visited page.

Duration of data processing: maximum 90 days

Name of processor	Registered office	Description of processing task
MediaCenter Hungary Kft.	H-6000 Kecskemét, Sosztakovics u. 3. II/6	Website operation

Further information on data processing: Users can delete cookies from their own computer or disable the use of cookies in their browser. Cookies can usually be managed in the browser's Tools/Settings menu under Privacy/History/Custom settings, under the name cookie or tracking.

Possible consequences of failing to provide data: the services described in points 2–5 above cannot be used.

Our company has concluded a data processing agreement for the processing tasks, in which MediaCenter Hungary Kft. undertakes, when engaging further processors, to apply the data protection and data processing guarantees prescribed for it in the data processing agreement; accordingly, we also ensure the lawful processing of personal data in the case of the processor.

• WEBSITE SERVER LOGGING

When the www.calmresort.hu website is visited, the web server automatically logs the user's activity.

Purpose of data processing: when the website is visited, the provider records visitor data in order to monitor the operation of the services and prevent misuse.

Legal basis for data processing: Article 6(1)(f) GDPR. Our company has a legitimate interest in the secure operation of the website.

Type of personal data processed: identification number, date, time, address of the page visited.

Duration of data processing: maximum 90 days.

Name of processor	Registered office	Description of processing task
NetHotelBooking Kft.	H-8200 Veszprém, Boksa tér 1/A	Recording visitor data and information required for server operation

Name of processor	Registered office	Description of processing task
MediaCenter Hungary Kft.	H-6000 Kecskemét, Sosztakovics u. 3. II/6	Website operation

Further information: our company does not link the data obtained from analysing log files with other information and does not seek to identify the user. The addresses of the pages visited and the date and time data are not in themselves suitable for identifying the data subject, but when combined with other data (e.g. provided during registration) they can be used to draw conclusions about the user.

Data processing by external service providers related to logging:

The HTML code of the portal contains links coming from and pointing to external servers independent of our company. The external provider's server is in direct contact with the user's computer. Please note that, due to the direct connection to their servers and direct communication with the user's browser, the providers of these links can collect user data (e.g. IP address, browser and operating system data, mouse pointer movement, address of the page visited and time of the visit). An IP address is a series of numbers that uniquely identifies the computers and mobile devices of users accessing the internet.

IP addresses can even be used to locate the visitor using a particular computer geographically. The addresses of the pages visited and the date and time data are not in themselves suitable for identifying the data subject, but when combined with other data (e.g. provided during registration) they can be used to draw conclusions about the user.

• PROCESSING OF DATA ON THE REGISTRATION FORM

On check-in, the guesthouse asks guests to complete a registration form containing their personal data. The data on the registration form is stored in the guesthouse software and on paper.

Controller of personal data: Press Komm Kft., H-1035 Budapest, Miklós u. 7.

Purpose of data processing: keeping in touch with guests during their stay and after departure, sending birthday greetings, distinguishing between guests, assisting with tourist tax returns, managing the loyalty programme, statutory obligations.

Legal basis for data processing: consent of the data subject – Article 6(1)(a) GDPR.

Scope of personal data processed: name, email address, telephone number, date of birth, address, vehicle registration number, room number, dates of arrival and departure, details of accompanying persons, newsletter subscription, payment method.

Duration of data processing: On the registration form, the guest consents to the storage of their personal data; the guesthouse stores the data for 8 years from the date of consent.

Use of a data processor: Vendégem web software

Name of processor	Registered office	Description of processing task
Press Komm Kft.	H-1035 Budapest, Miklós u. 7.	Storage of guest data

Possible consequences of failing to provide data: The data subject cannot take possession of their guesthouse room.

Rights of the data subject: the data subject (the person whose personal data is processed by our company)

• may request access to their personal data,

• may request its rectification,

• may request its erasure,

• may object to the processing of personal data,

• PROCESSING OF DATA RELATED TO TELEPHONE BOOKINGS

The guesthouse also sells its rooms by telephone, after which it requests a written order from the guests. The guesthouse records bookings taken by telephone in its guesthouse software together with the booker's details.

Controller of personal data: Press Komm Kft., H-1035 Budapest, Miklós u. 7.

Purpose of data processing: recording the room booking.

Legal basis for data processing: consent of the data subject – Article 6(1)(a) GDPR.

Scope of personal data processed: name, telephone number, email address.

Duration of data processing: The guesthouse stores the data for 8 years from the date of approval.

Use of a data processor:

Name of processor	Registered office	Description of processing task
Press Komm Kft.	H-1035 Budapest, Miklós u. 7.	Storage of guest data

Possible consequences of failing to provide data: The room booking is not concluded.

Rights of the data subject: the data subject (the person whose personal data is processed by our company)

• may request access to their personal data,

• may request its rectification,

• may request its erasure,

• may object to the processing of personal data,

• PROCESSING OF DATA RELATED TO LOST PROPERTY

The guesthouse keeps a register of items found in rooms and common areas after guests have departed.

Controller of personal data: Press Komm Kft., H-1035 Budapest, Miklós u. 7.

Purpose of data processing: keeping a register of lost property, notifying guests, returning lost items

Legal basis for data processing: consent of the data subject – Article 6(1)(a) GDPR.

Scope of personal data processed: room number, name, description of the item found, date

Duration of data processing: the guesthouse keeps lost property for 1 month, and therefore also stores the related data for 1 month from the date it is entered in the register. If the owner collects the item, the data is deleted.

Use of a data processor: Recorded in writing by the guesthouse operator.

Name of processor	Registered office	Description of processing task
Press Komm Kft.	H-1035 Budapest, Miklós u. 7.	Maintenance of own server

Rights of the data subject: the data subject (the person whose personal data is processed by our company)

• may request access to their personal data,

• may request its rectification,

• may request its erasure,

• may object to the processing of personal data,

• DATA PROCESSING RELATED TO CORRESPONDENCE

The controller keeps in touch with guests and enquirers through the email addresses it uses.

Controller of personal data: Press Komm Kft., H-1035 Budapest, Miklós u. 7.

Purpose of data processing: keeping in touch with guests

Legal basis for data processing: consent of the data subject – Article 6(1)(a) GDPR.

Scope of personal data processed: name, email address, content of correspondence.

Duration of data processing: 5 years

Use of a data processor:

Name of processor	Registered office	Description of processing task
Creative Management Kft.	H-8200 Veszprém, Boksa tér 1/A	Provision of online hosting
Press Komm Kft.	H-1035 Budapest, Miklós u. 7.	Maintenance of email software on workstations

Rights of the data subject: the data subject (the person whose personal data is processed by our company)

• may request access to their personal data,

• may request its rectification,

• may request its erasure,

• may object to the processing of personal data,

• DATA PROCESSING DURING PAYMENT:

Guests can pay in cash, by gift voucher, SZÉP card, Erzsébet voucher or bank card.

Controller of personal data: Press Komm Kft., H-1035 Budapest, Miklós u. 7.

Purpose of data processing: issuing an invoice for the services used

Legal basis for data processing: voluntary consent of the data subject

Scope of personal data processed: name and address on the invoice, list of services, total amount, payment method, invoice date, date of performance

Duration of data processing: 8 years

Use of a data processor:

Name of processor	Registered office	Description of processing task
OTP Bank	H-1051 Budapest, Nádor u. 16.	For bank card payments: identifier, amount, date

• ELECTRONIC SURVEILLANCE SYSTEM

Security camera recordings are made on the premises of Calm Resort Hertelend.

Camera recordings are made in the guesthouse yard, car park, indoor common areas and service areas. Only specifically designated persons are authorised to view and access the recordings.

Controller of personal data: Press Komm Kft., H-1035 Budapest, Miklós u. 7.

Purpose of data processing: promoting the safety of guests and staff, protecting property, proving infringements and clarifying disputes.

Legal basis for data processing: voluntary consent of the data subject by entering the premises.

Duration of data processing: 30 days in service areas, 14 days in other areas.

Name of processor	Registered office	Description of processing task
Press Komm Kft.	H-1035 Budapest, Miklós u. 7.	Maintenance of the camera system

• DATA PROCESSING RELATED TO GROUP BOOKINGS AND CORPORATE EVENTS

Calm Resort Hertelend also offers group bookings and event organisation, in connection with which it stores personal data.

Controller of personal data: Press Komm Kft., H-1035 Budapest, Miklós u. 7.

Purpose of data processing: booking accommodation for groups and organising events, identifying guests, running events

Legal basis for data processing: prior consent of the person making the group or event booking.

Scope of personal data processed: for companies, company name, tax number and registered office; name, telephone number and email address of the person making the booking; names, dates of birth and vehicle registration numbers of participants; list of ordered services included in the confirmation and offer

Duration of data processing: 5 years following the last day of the stay according to the booking.

Use of a data processor: Recorded on the guesthouse's own server.

Name of processor	Registered office	Description of processing task
Press Komm Kft.	H-1035 Budapest, Miklós u. 7.	Maintenance of own server

Possible consequences of failing to provide data: no contract is concluded for the event or group booking.

Rights of the data subject: the data subject (the person whose personal data is processed by our company)

• may request access to their personal data,

• may request its rectification,

• may request its erasure,

• may object to the processing of personal data,

• DATA PROCESSING RELATED TO PHOTOGRAPHS AND VIDEOS

Calm Resort Hertelend takes photographs and videos for marketing purposes.

Controller of personal data: Press Komm Kft., H-1035 Budapest, Miklós u. 7.

Purpose of data processing: promoting the guesthouse and inspiring potential guests.

Legal basis for data processing: prior consent of the data subject.

Scope of personal data processed: photos, videos and sound recordings of guests, staff and models.

Duration of data processing: 100 years

Use of a data processor: Recorded on the guesthouse's own server.

Name of processor	Registered office	Description of processing task
Press Komm Kft.	H-1035 Budapest, Miklós u. 7.	Maintenance of own server

Possible consequences of failing to provide data: the recordings cannot be made.

Rights of the data subject: the data subject (the person whose personal data is processed by our company)

• may request access to their personal data,

• may request its rectification,

• may request its erasure,

• may object to the processing of personal data,

• OTHER DATA PROCESSING

We provide information on data processing not listed in this notice when the data is collected. Please note that certain authorities, bodies performing public tasks and courts may contact our company to request personal data. Our company only discloses personal data to these bodies – provided that the body concerned has specified the exact purpose and scope of the data – to the extent that is strictly necessary to achieve the purpose of the request, and only if the request is required by law.

• METHOD OF STORING PERSONAL DATA AND SECURITY OF DATA PROCESSING

Our company's IT systems and other data storage locations are located at its premises and on servers rented by the processor. Our company selects and operates the IT tools used to process personal data in the course of providing the service in such a way that the data processed:

• a) is accessible to those authorised to access it (availability);

• b) its authenticity and authentication are ensured (authenticity of processing);

• c) its integrity can be verified (data integrity);

• d) is protected against unauthorised access (data confidentiality).

We pay particular attention to data security, and we take the technical and organisational measures and establish the procedural rules necessary to give effect to the guarantees under the GDPR. We protect data with appropriate measures, in particular against unauthorised access, alteration, transfer, disclosure, erasure or destruction, as well as accidental destruction, damage and inaccessibility resulting from changes in the technology used.

The IT systems and networks of our company and our partners are protected against computer-assisted fraud, computer viruses, computer intrusions and denial-of-service attacks. The operator ensures security through server-level and application-level protection procedures. Data is backed up daily. Our company takes all possible measures to prevent personal data breaches; should such a breach occur, we act immediately – in accordance with our incident management policy – to minimise the risks and remedy any damage.

18. RIGHTS OF DATA SUBJECTS AND LEGAL REMEDIES

The data subject may request information about the processing of their personal data, and may request the rectification or – except for mandatory processing – the erasure or withdrawal of their personal data, and may exercise their rights to data portability and to object in the manner indicated when the data was collected, or via the controller's contact details above.

At the request of the data subject, we provide information in electronic form without delay, but no later than within 30 days, in accordance with our relevant policy. We fulfil data subjects' requests to exercise the rights below free of charge.

Right to information:

Our company takes appropriate measures to provide data subjects with all the information referred to in Articles 13 and 14 of the GDPR and every communication under Articles 15–22 and 34 relating to the processing of personal data in a concise, transparent, intelligible and easily accessible form, using clear and plain language, yet precisely.

The right to information can be exercised in writing via the contact details given in point 1. At the data subject's request – after verifying their identity – information may also be provided orally. Please note that if our staff have doubts about the identity of the data subject, we may request the information necessary to confirm their identity.

Right of access of the data subject:

The data subject has the right to obtain confirmation from the controller as to whether their personal data is being processed. Where personal data is being processed, the data subject has the right to access the personal data and the following information:

• the purposes of the processing;

• the categories of personal data concerned;

• the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular recipients in third countries (outside the European Union) or international organisations;

• the envisaged period for which the personal data will be stored;

• the right to request rectification, erasure or restriction of processing and the right to object;

• the right to lodge a complaint with a supervisory authority;

• information on the source of the data; the existence of automated decision-making, including profiling, as well as meaningful information about the logic involved and the significance and envisaged consequences of such processing for the data subject.

In addition, where personal data is transferred to a third country or an international organisation, the data subject has the right to be informed of the appropriate safeguards relating to the transfer.

Right to rectification:

Under this right, anyone may request the rectification of inaccurate personal data concerning them that is processed by our company, and the completion of incomplete data.

Right to erasure:

The data subject has the right to have their personal data erased without undue delay at their request where one of the following grounds applies:

• the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;

• the data subject withdraws the consent on which the processing is based, and there is no other legal ground for the processing;

• the data subject objects to the processing and there are no overriding legitimate grounds for the processing;

• the personal data has been unlawfully processed;

• the personal data must be erased to comply with a legal obligation under EU or Member State law to which the controller is subject;

• the personal data has been collected in relation to the offer of information society services.

Erasure of data cannot be requested where processing is necessary for the following purposes:

• for exercising the right of freedom of expression and information;

• for compliance with a legal obligation under EU or Member State law to which the controller is subject that requires processing, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

• for reasons of public interest in the area of public health, or for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes;

• or for the establishment, exercise or defence of legal claims.

Right to restriction of processing:

At the request of the data subject, we restrict processing where the conditions set out in Article 18 of the GDPR apply, i.e. if:

• the data subject contests the accuracy of the personal data, in which case the restriction applies for a period enabling the accuracy of the personal data to be verified;

• the processing is unlawful and the data subject opposes the erasure of the data and requests the restriction of its use instead;

• the controller no longer needs the personal data for the purposes of the processing, but the data subject requires it for the establishment, exercise or defence of legal claims; or

• the data subject has objected to processing; in this case the restriction applies pending the verification of whether the legitimate grounds of the controller override those of the data subject.

Where processing has been restricted, such personal data may, with the exception of storage, only be processed with the data subject's consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State. The data subject must be informed in advance before the restriction of processing is lifted.

Right to data portability:

The data subject has the right to receive the personal data concerning them, which they have provided to the controller, in a structured, commonly used and machine-readable format, and to transmit that data to another controller. Our company can fulfil such a request in Word or Excel format.

Right to object:

Where personal data is processed for direct marketing purposes, the data subject has the right to object at any time to the processing of their personal data for such marketing, including profiling to the extent that it is related to direct marketing. If the data subject objects to processing for direct marketing purposes, the personal data may no longer be processed for such purposes.

Automated individual decision-making, including profiling:

The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. This right does not apply if the decision

• is necessary for entering into, or performance of, a contract between the data subject and the controller;

• is authorised by EU or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and

• legitimate interests; or

• is based on the data subject's explicit consent.

•

Right to withdraw consent:

The data subject has the right to withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Procedural rules:

The controller informs the data subject of the action taken on a request under Articles 15–22 of the GDPR without undue delay and in any event within one month of receipt of the request. Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months. The controller informs the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay.

Where the data subject makes the request by electronic means, the information is provided by electronic means unless otherwise requested by the data subject.

If the controller does not take action on the data subject's request, it informs the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

The controller communicates any rectification, erasure or restriction of processing carried out to each recipient to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate effort. The controller informs the data subject about those recipients if the data subject requests it.

Compensation and damages for non-material harm:

Any person who has suffered material or non-material damage as a result of an infringement of the data protection regulation has the right to receive compensation from the controller or processor for the damage suffered. A processor is liable for the damage caused by processing only where it has not complied with obligations under the law specifically directed to processors or where it has acted outside or contrary to the lawful instructions of the controller. Where more than one controller or processor, or both a controller and a processor, are involved in the same processing and are responsible for any damage caused by processing, each controller or processor is held jointly and severally liable for the entire damage.

A controller or processor is exempt from liability if it proves that it is not in any way responsible for the event giving rise to the damage.

Right to go to court and data protection authority proceedings:

In the event of an infringement of their rights, the data subject may take legal action against the controller. The court deals with the case as a matter of priority.

Complaints may be lodged with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).

Our registration number: NAIH-114710/2017

Address of the authority: H-1125 Budapest, Szilágyi Erzsébet fasor 22/C; postal address: H-1530 Budapest, Pf.: 5.

Telephone: +36-1-391.1400

Email: ugyfelszolgalat@naih.hu