GENERAL PRIVACY POLICY OF "ODOL CONSULTING LIMITED LIABILITY COMPANY"
- Debrecen, 2024 -
TABLE OF CONTENTS
I. Introduction, purpose and scope of the Code
II. Definitions
III. Principles
IV. Legal basis for processing
1. Consent of the data subject
2. Performance of the contract
3. To comply with a legal obligation to which the controller is subject or to protect the vital interests of the data subject or of another natural person
4. the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or the legitimate interests of the controller or a third party.
V. General information on data management
VI. Processing of data relating to websites operated by the Data Controller
VII. Processing of data in the course of the economic activities of the Data Controller
VIII. Data processing in connection with employment law and employment relationships
IX. Rights of the data subject
1. (Prior) Right to information
2. Right of access of the data subject
3. The data subject's right to rectification and erasure
3.1. The right to rectification
3.2 Right to erasure ("right to be forgotten")
4. Right to restriction of processing
5. Obligation to notify the rectification or erasure of personal data or the restriction of processing
6. The right to data portability
7. The right to object
8. Right to exemption from automated decision-making
9. Right of the data subject to lodge a complaint and seek redress
9.1 Right to lodge a complaint with a supervisory authority.
9.2 Right to an effective judicial remedy against the supervisory authority
9.3.
right to legal redress
10. Restrictions
11. Information about the data breach
X. Procedure to be followed in the event of a request by the data subject
XI. Who has access to the data and the general rules on data processing
XII. Provisions on data security
1. Principles for implementing data security
2. Protection of the Company's IT records
3. Protection of the Company's paper records
XIII. Procedure in the event of a personal data breach
XIV. Other provisions
XV. Request, complaint, remedy
XVI Annexes
I. Introduction, purpose and scope of the Code
Introduction
Name of the data controller: ODOL Consulting Kft.
Headquarters: 4032, Debrecen, Menyhárt József tér 5 fsz 1
Tax number: 32431438-2-09
Company registration number: 09-09-035656
Contact: info@reloflow.hu, +36206667170
Name and contact details of the authorised representative: Ferenc Suhaj, Managing Director with independent right of representation (+36 20 666 7170; info@reloflow.hu)
The Data Controller sets out in this privacy policy ("Policy") how it collects, uses, stores, discloses or transfers personal data of its customers and partners. The Controller declares that this Policy complies in full with all applicable data protection rules and policies.
This Policy applies to all processing carried out by the Data Controller.
The Data Controller is entitled to unilaterally amend the Policy and any annexes thereto at any time and will inform its partners of such changes on its website.
In the event of any questions regarding the processing of any data by the Data Controller, the Data Controller will provide information to the requester at any of the contact details indicated, within the limits of the law.
The Policy and its annexes shall enter into force on 25 May 2018 and shall remain applicable until amended by the Data Controller.
This Privacy Policy will be reviewed and maintained in the light of changes in legislation, but at least annually.
Purpose and scope of the Rules
The purpose of this Privacy Policy is to set out the internal rules setting out the data protection and data management policy of the Data Controller in compliance with the data protection and data management provisions set out in REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Regulation (EC) No 95/46/EC (General Data Protection Regulation). By enforcing these provisions, the Data Controller shall ensure, in all its activities and services, that the data subjects' right to the protection of their personal data is respected when processing or handling their personal data.
By adopting this Policy, the Data Controller declares its compliance with the principles for the processing of personal data set out in Article 5 of REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 (hereinafter "the Regulation").
This Policy also aims to comply with the Hungarian data protection legislation, in the framework of which this Policy aims to comply with the provisions of Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (hereinafter: Info Act). In drafting the Policy and its annexes, the Data Controller has taken into account all applicable legal provisions, compliance with which is relevant for data protection rules.
The personal scope of this Policy extends to the Data Controller and the natural persons in relation to whom the data processing activities of the Data Controller are carried out. The processing activities set out in this Policy are directed at the personal data of natural persons. This Policy does not cover processing that relates to legal persons or, in particular, to undertakings that are incorporated as legal persons, including the name and form of the legal person and the contact details of the legal person. A legal person is an association, a partnership, a cooperative, an association and a foundation.
These Rules shall apply from the date of their entry into force until any further provision or until the date of their withdrawal.
II. Definitions
"personal data" and "data subject" means any information ("personal data") relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
'processing' means any operation or set of operations which is performed upon personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
"restriction of processing": the marking of stored personal data for the purpose of restricting their future processing;
"profiling" means any form of automated processing of personal data whereby personal data are used to evaluate or predict certain personal aspects relating to a natural person, in particular to analyse or predict characteristics associated with the work performance, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements of that natural person;
"pseudonymisation" means the processing of personal data in such a way that it is no longer possible to identify the natural person to whom the personal data relate without further information, provided that such further information is kept separately and technical and organisational measures are taken to ensure that no association with identified or identifiable natural persons is possible;
"filing system" means a set of personal data, structured in any way, whether centralised, decentralised or structured according to functional or geographical criteria, which is accessible on the basis of specified criteria;
'controller' means a natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of the processing are determined by Union or Member State law, the controller or specific criteria for the designation of the controller may also be determined by Union or Member State law;
"processor" means a natural or legal person, public authority, agency or any other body which processes personal data on behalf of and for the account of the controller (on the controller's instructions and in accordance with the provisions of a contract with the controller);
"recipient" means a natural or legal person, public authority, agency or any other body to whom or with which personal data are disclosed, whether or not a third party. Public authorities which may have access to personal data in the context of an individual investigation in accordance with Union or Member State law are not recipients; the processing of those data by those public authorities must comply with the applicable data protection rules in accordance with the purposes of the processing;
"third party" means a natural or legal person, public authority, agency or any other body other than the data subject, the controller, the processor or the persons who, under the direct authority of the controller or processor, are authorised to process personal data;
"the data subject's consent" means a freely given, specific, informed and unambiguous indication of his or her wishes by which the data subject signifies, by a statement or by an act expressing his or her unambiguous consent, that he or she signifies his or her agreement to the processing of personal data concerning him or her;
"data breach" means a breach of security that results in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;
"genetic data" means any personal data relating to the inherited or acquired genetic characteristics of a natural person which contains specific information about the physiology or state of health of that person and which results primarily from the analysis of a biological sample taken from that natural person;
"biometric data" means any personal data relating to the physical, physiological or behavioural characteristics of a natural person obtained by means of specific technical procedures which allow or confirm the unique identification of a natural person, such as facial image or dactyloscopic data;
"health data" means personal data relating to the physical or mental health of a natural person, including data relating to the provision of health services to a natural person which contains information about the health of the natural person;
"enterprise" means any natural or legal person carrying on an economic activity, regardless of its legal form, including partnerships or associations carrying on a regular economic activity.
III. Principles
This section sets out the principles that the Data Controller will follow throughout the duration of its processing and in all its activities. The Principles are the rules and benchmarks that govern and define the processing as a whole.
1. Personal data may only be processed for specified purposes and on a legal basis, for the exercise of a right or the performance of an obligation.
2. At all stages of processing, the purpose of the processing must be fulfilled and the collection and processing of data must be fair and lawful. Only personal data which is necessary for the purpose of the processing and is adequate for the purpose shall be processed.
3. Personal data may only be processed to the extent and for the duration necessary for the purpose.
4. The Data Controller records that the personal data processed by it is stored in the form of electronic files and paper documents, in compliance with the legal provisions on data security. This provision applies to all processing and data processing activities carried out by the Controller.
The Data Controller shall process the data lawfully and fairly and in a transparent manner for the data subject (lawfulness, fairness and transparency).
The Data Controller shall collect personal data only for specified, explicit and legitimate purposes and shall not process them in a way incompatible with those purposes (purpose limitation), and shall not carry out any processing activity on the data after the purpose of the processing has been fulfilled.
7. The Data Controller shall carry out processing that is adequate, relevant and limited to what is necessary for the purpose(s) for which it is intended (data economy). Accordingly, the Data Controller shall not collect or store more data than is strictly necessary for the purpose of the processing.
8. The Data Controller's data management is accurate and up-to-date. The Data Controller shall take all reasonable steps to ensure that personal data inaccurate for the purposes of the processing are erased or rectified without undue delay (accuracy).
9. The Controller shall store personal data in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed, subject to the storage obligations laid down in the applicable legislation (limited storage).
10. The Data Controller shall ensure adequate security of personal data, including protection against unauthorised or unlawful processing, accidental loss, destruction or damage to personal data (integrity and confidentiality), by implementing appropriate technical or organisational measures.
11. The Data Controller is responsible for compliance with the principles detailed above and for demonstrating such compliance (accountability). Accordingly, the Data Controller shall ensure the ongoing implementation of these internal rules, the continuous review of its data management and, where necessary, the amendment and supplementation of data management procedures. The Controller shall, where necessary, prepare documentation to demonstrate compliance with legal obligations.
IV. Legal basis for processing
This section describes briefly and to the point when the Data Controller's (and any business's) processing may be lawful. In order to establish the lawfulness of processing, one or more legal grounds, i.e. an event/legal provision/circumstance/authorisation which renders the processing lawful by operation of law, are necessary. These legal grounds are briefly described below.
1. Consent of the data subject
- The lawfulness of the processing of personal data must be based on the consent of the data subject or on some other legitimate basis established by law.
- In the case of processing based on the data subject's consent, the data subject may give his or her consent to the processing of his or her personal data in the following form:
a) in writing, in the form of a declaration of consent to personal data processing,
(b) by electronic means, by any explicit conduct on the Controller's website, by ticking a box, or by making technical settings when using information society services, or by any other statement or action which, in the relevant context, unambiguously indicates the data subject's consent to the intended processing of his or her personal data.
- Silence, ticking a box or inaction does not constitute consent.
- Consent covers all processing activities carried out for the same purpose or purposes.
- If the processing is intended for more than one purpose, consent must be given explicitly for all the purposes for which the processing is intended.
- If the data subject gives his or her consent following an electronic request, the request must be clear and concise and must not unnecessarily impede the use of the service for which consent is sought.
- The data subject has the right to withdraw his or her consent at any time. Withdrawal of consent shall not affect the lawfulness of processing based on consent prior to its withdrawal. The data subject shall be informed before consent is given. The withdrawal of consent shall be made possible in the same simple manner as the giving of consent.
2. Performance of the contract
- Processing is lawful where it is necessary for the performance of a contract to which the data subject is a party or for taking steps at the request of the data subject prior to entering into a contract.
- The consent of the data subject to the processing of personal data not necessary for the performance of the contract shall not be a condition for the conclusion of the contract.
3. To comply with a legal obligation to which the controller is subject or to protect the vital interests of the data subject or of another natural person
- The legal basis for processing is determined by law in the case of the performance of a legal obligation, so the data subject's consent is not required for the processing of his or her personal data.
- The Data Controller shall inform the data subject of the purposes, legal basis, duration and identity of the data controller, as well as of the data subject's rights and remedies.
- The Data Controller is entitled to process the data set which is strictly necessary for the fulfilment of a legal obligation to which the data subject is subject, following the withdrawal of the data subject's consent.
4. the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or the legitimate interests of the controller or a third party.
- The legitimate interests of the Controller, including the controller with whom the personal data may be shared, or of a third party may constitute a legal ground for processing, provided that the interests, fundamental rights and freedoms of the data subject do not override the legitimate interests of the data subject, taking into account the reasonable expectations of the data subject in his or her relationship with the Controller. Such legitimate interest may, for example, be the case where there is a relevant and appropriate relationship between the data subject and the controller, such as where the data subject is a client of the controller or is employed by the controller.
- In order to establish the existence of a legitimate interest, it is necessary to carefully assess, inter alia, whether the data subject could reasonably expect, at the time and in the context of the collection of personal data, that processing for the purposes in question would take place.
- The interests and fundamental rights of the data subject may override the interests of the Controller if the personal data are processed in circumstances in which the data subjects do not expect further processing.
V. General information on data management
As a basic principle, the Data Controller processes and uses the personal data of the natural person concerned in order to provide the services used by the data subject, to provide the services to an adequate standard and to improve the experience of the data subject.
In particular, the Data Controller processes data in connection with the activities and cases listed below:
- processing of data in connection with the operation of the www.reloflow.hu website and the provision of services (visitor data processing, newsletter, shopping, marketing)
- processing of data in the course of the economic activities of the Data Controller (processing based on legal obligations, contact management, performance of contracts)
- processing in the context of employment law and employment relationships
The Data Controller does not employ a Data Protection Officer. If any data subject has any questions regarding data processing, he or she may contact the Data Controller using one of the contact details indicated in Section I of this Policy. In the event of a request, the Controller shall act in accordance with the procedure set out in these Rules (see "Procedure to be followed in the event of a request by the data subject").
The detailed rules for the processing of data in connection with the activities referred to in this point (in particular: scope of data processed, purpose and legal basis of processing, duration of processing) are set out in the general provisions set out in the points set out below in these Rules and in the information documents annexed to these Rules, which contain detailed rules for the processing of data in the course of each activity. In the event of rules not specifically laid down in the information documents containing the detailed rules, the general provisions of these Rules shall prevail. These Rules and the individual information notices shall in all cases be interpreted and applied together, in a consistent and complementary manner. Each shall be indivisible from the other.
VI. Processing of data relating to websites operated by the Data Controller
As stated in the previous section V, the Data Controller operates the following websites:
(i) www.reloflow.hu
The scope of the data processing carried out by the Data Controller through the operation of the websites can be described as follows:
- processing of data relating to visitors to the Sites ("cookie"/customer data processing)
- newsletter service
- shopping on the website
- redeem vouchers purchased
- marketing
The processing carried out shall be governed by these Rules and the information notices/annexes forming an integral part thereof.
We inform the data subjects that the specific and detailed rules for each processing operation (the so-called processing circles) in the course of the processing referred to in this point VI are set out in the Information Notice ("Information Notice on the processing of personal data on the websites operated by the Controller"), which is Annex 1 to these Rules. The said Notice describes in detail the processing of data under this point. The Prospectus shall be read in conjunction with and in accordance with this Policy at all times. The general provisions of this Policy shall prevail in respect of any matter not covered by this Policy.
VII. Processing of data in the course of the economic activities of the Data Controller
In the course of its economic activity, the Data Controller also carries out processing in addition to the previous point. These are data processing activities that generally occur in most companies. However, their general occurrence does not mean that you should not be informed of them. It is true that, also in relation to the processing referred to in this point, the Data Controller will make every effort to ensure that the personal data of all data subjects are kept secure and that the processing of such data also complies in all respects with the applicable data protection rules and policies.
The specific categories of processing under this point which are/may be separately identified:
- processing based on a legal obligation
- contacting
- performance of contracts
We inform the data subjects that the specific and detailed rules of the individual processing operations (the so-called processing circles) carried out in the course of the processing referred to in this point VII are set out in the Information Notice ("Information Notice on the Processing of Data in Connection with the Controller's Business Activities"), which is Annex 2 to these Rules. The said Notice describes in detail the processing under this point. The Prospectus shall at all times be read in conjunction with and in accordance with these Rules. The general provisions of this Policy shall prevail in relation to any matter not covered by the Prospectus.
VIII. Data processing in connection with employment law and employment relationships
The Data Controller wishes to inform the data subjects that, as a general rule, it only publishes job advertisements together with their identity.
The Data Controller informs the data subjects that their application materials (CV, cover letter, any attachments and other documents) will be stored and kept for a maximum of 2 months from the date of receipt. The storage is done in order to use the data subjects' application materials to meet the recruitment needs of the Data Controller. Accordingly, the Data Controller may contact the candidate concerned who has applied for a post with further job offers for which the candidate concerned is suitable for the post for a maximum period of 12 months after the application has been submitted.
If a data subject does not submit his/her application to the Data Controller within the framework of an application for a specific advertised position, the Data Controller shall request written confirmation and consent from the data subject within a reasonable period of time, but not more than 5 working days, that the Data Controller may store and use the application and the personal data of the data subject in accordance with this clause. If no consent is received within the time limit, the Data Controller shall delete the application and all personal data of the data subject from its system without any further action.
The Data Controller, as (prospective) employer, will inform the data subjects about the provisions of this point separately in the context of each job advertisement.
It can therefore be stated that the purpose of the data processing recorded so far in this section is the recruitment of the data subjects as applicants/prospective employees and the conclusion of the employment contract with them. The legal basis for the processing is the consent of the data subject. The scope of the processed data is the necessary data indicated in each job advertisement which are relevant for the assessment of the application (e.g. CV data, data of documents proving qualifications, contact details, etc.). The recipients of the personal data are the employer, the employee(s) of the Data Controller performing the human resources function and, where applicable, the data processor(s) entrusted with the performance of the HR tasks and acting on the instructions of the Data Controller.
The specific and detailed rules on further data processing (data processing categories) relating to employees are set out in the Information Notice ("Information on data processing in the context of employment law and employment relationships"), which is Annex 3 to these Rules. The said Notice describes in detail the processing of data under this point. The Prospectus shall be read in conjunction with and in accordance with these Rules at all times. The general provisions of this Policy shall prevail in relation to any matter not covered by the Prospectus. Readers are informed that the prospectus referred to in this point is not public.
IX. Rights of the data subject
1. (Prior) Right to information
(1) The data subject shall have the right to be informed of the essential information relating to the processing of his or her data before the processing of the data is started.
(2) Information to be provided where personal data are collected from the data subject:
o the identity and contact details of the controller and, where applicable, the controller's representative;
o the contact details of the Data Protection Officer, if any;
o the purposes for which the personal data are intended to be processed and the legal basis for the processing;
o in the case of processing based on Article 6(1)(f) of the Regulation, the legitimate interests of the controller or a third party;
o where applicable, the recipients of the personal data and the categories of recipients, if any;
o where applicable, the fact that the controller intends to transfer the personal data to a third country or an international organisation and the existence or absence of an adequacy decision by the Commission or, in the case of a transfer referred to in Article 46, Article 47 or the second subparagraph of Article 49(1) of the Regulation, an indication of the appropriate and adequate safeguards and a reference to the means of obtaining a copy or the availability of a copy.
(3) In addition to the information referred to in paragraph 1, the controller shall, at the time of obtaining the personal data, in order to ensure fair and transparent processing, provide the data subject with the following additional information:
o the duration of the storage of personal data or, where this is not possible, the criteria for determining that duration;
o the right of the data subject to request the controller to access, rectify, erase or restrict the processing of personal data concerning him or her and to object to the processing of such personal data, and the right to data portability;
o in the case of processing based on Article 6(1)(a) or Article 9(2)(a) of the Regulation, the right to withdraw consent at any time, without prejudice to the lawfulness of the processing carried out on the basis of consent prior to its withdrawal;
o the right to lodge a complaint with a supervisory authority;
o whether the provision of the personal data is based on a legal or contractual obligation or is a precondition for the conclusion of a contract, whether the data subject is under an obligation to provide the personal data and the possible consequences of not providing the data;
o the fact of automated decision-making, including profiling, as referred to in Article 22(1) and (4) of the Regulation, and, at least in those cases, clear information on the logic used and the significance of such processing and its likely consequences for the data subject.
(4) Where the personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information:
o the identity and contact details of the controller and, where applicable, the controller's representative;
o the contact details of the Data Protection Officer, if any;
o the purposes for which the personal data are intended to be processed and the legal basis for the processing;
o the categories of personal data concerned;
o the recipients of the personal data and the categories of recipients, if any;
o where applicable, the fact that the controller intends to transfer the personal data to a recipient in a third country or to an international organisation and the existence or absence of an adequacy decision by the Commission or, in the case of a transfer referred to in Article 46, Article 47 or the second subparagraph of Article 49(1) of the Regulation, an indication of the appropriate and suitable safeguards and a reference to the means of obtaining a copy or their availability.
(5) In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following additional information necessary to ensure fair and transparent processing for the data subject:
o the duration of the storage of personal data or, where this is not possible, the criteria for determining that duration;
o where the processing is based on Article 6(1)(f) of the Regulation, the legitimate interests of the controller or a third party;
o the right of the data subject to request the controller to access, rectify, erase or restrict the processing of personal data concerning him or her and to object to the processing of personal data, and the right to data portability;
o in the case of processing based on Article 6(1)(a) or Article 9(2)(a) of the Regulation, the right to withdraw consent at any time, without prejudice to the lawfulness of the processing carried out on the basis of consent prior to its withdrawal;
o the right to lodge a complaint with a supervisory authority;
o the source of the personal data and, where applicable, whether the data originate from publicly available sources; and
o the fact of automated decision-making, including profiling, as referred to in Article 22(1) and (4) of the Regulation and, at least in those cases, the logic used and clear information on the significance of such processing and its likely consequences for the data subject.
(6) If the controller intends to further process personal data for a purpose other than that for which they were obtained, the controller shall inform the data subject of that other purpose and of any relevant additional information referred to above before further processing.
(7) Paragraphs (1) to (6) do not apply if and to the extent that:
o the data subject already has the information;
o the provision of the information in question proves impossible or would involve a disproportionate effort, in particular in the case of processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, taking into account the conditions and guarantees referred to in Article 89(1), or where the obligation referred to in paragraph 1 of this Article would be likely to render impossible or seriously impair the achievement of the purposes of such processing. In such cases, the controller shall take appropriate measures, including making the information publicly available, to protect the rights, freedoms and legitimate interests of the data subject;
o the acquisition or disclosure of the data is expressly required by Union or Member State law applicable to the controller, which provides for appropriate measures to protect the data subject's legitimate interests; or
o the personal data must remain confidential under an obligation of professional secrecy imposed by EU or Member State law, including a legal obligation of secrecy.
2. Right of access of the data subject
(1) The data subject shall have the right to obtain from the controller feedback as to whether or not his or her personal data are being processed and, if such processing is taking place, the right to access the personal data and the following information:
o the purposes of the processing;
o the categories of personal data concerned;
o the recipients or categories of recipients to whom or with whom the personal data have been or will be disclosed, including in particular recipients in third countries or international organisations;
o where applicable, the envisaged period of storage of the personal data or, if this is not possible, the criteria for determining that period;
o the right of the data subject to obtain from the controller the rectification, erasure or restriction of the processing of personal data concerning him or her and to object to the processing of such personal data;
o the right to lodge a complaint with a supervisory authority;
o if the data were not collected from the data subject, any available information on their source;
o the fact of automated decision-making, including profiling, as referred to in Article 22(1) and (4) of the Regulation and, at least in those cases, the logic used and clear information on the significance of such processing and its likely consequences for the data subject.
(2) Where personal data are transferred to a third country or an international organisation, the data subject shall have the right to be informed of the appropriate safeguards for the transfer in accordance with Article 46.
(3) The data controller shall provide the data subject with a copy of the personal data processed upon request/request. For additional copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject has made the request by electronic means, the information shall be provided in a commonly used electronic format, unless the data subject requests otherwise.
3. The data subject's right to rectification and erasure
3.1. Right to rectification
(1) The data subject shall have the right to obtain, upon his or her request and without undue delay, the rectification of inaccurate personal data relating to him or her. Taking into account the purposes of the processing, the data subject shall have the right to obtain the rectification of incomplete personal data, including by means of a supplementary declaration.
3.2 Right to erasure ("right to be forgotten")
(1) The data subject shall have the right to obtain from the controller the erasure of personal data relating to him or her without undue delay at his or her request and the controller shall be obliged to erase personal data relating to him or her without undue delay where one of the following grounds applies:
o the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
o the data subject withdraws his or her consent pursuant to Article 6(1)(a) of the Regulation (consent to the processing of personal data) or Article 9(2)(a) of the Regulation (explicit consent) and there is no other valid legal basis for the processing;
o the data subject objects to the processing on the basis of Article 21(1) of the Regulation (right to object) and there is no overriding legitimate ground for the processing, or the data subject objects to the processing on the basis of Article 21(2) of the Regulation (objection to processing for commercial purposes);
o the personal data have been unlawfully processed;
o the personal data must be erased in order to comply with a legal obligation under Union or Member State law to which the controller is subject;
o personal data have been collected in connection with the provision of information society services referred to in Article 8(1).
(2) Where a controller has disclosed personal data and is required to erase it at the request of the data subject, it shall take reasonable steps, including technical measures, taking into account the available technology and the cost of implementation, to inform the controllers that process the data that the data subject has requested the deletion of the links to or copies or replicas of the personal data in question.
(3) Paragraphs (1) and (2) shall not apply where the processing is necessary:
o to exercise the right to freedom of expression and information;
o for the purposes of complying with an obligation under Union or Member State law to which the controller is subject to which the processing of personal data is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
o on grounds of public interest in the field of public health pursuant to Article 9(2)(h) and (i) of the Regulation and Article 9(3) of the Regulation;
o for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) of the Regulation, where the right referred to in paragraph 1 would be likely to render such processing impossible or seriously impair it; or
o to bring, enforce or defend legal claims.
4. Right to restriction of processing
(1) The data subject shall have the right to obtain, at his or her request, restriction of processing by the controller if one of the following conditions is met:
· the data subject contests the accuracy of the personal data, in which case the restriction applies for the period of time necessary to allow the controller to verify the accuracy of the personal data;
· the data processing is unlawful and the data subject opposes the erasure of the data and requests instead the restriction of their use;
· the controller no longer needs the personal data for the purposes of processing, but the data subject requires them for the establishment, exercise or defence of legal claims; or
· the data subject has objected to the processing pursuant to Article 21(1) of the Regulation; in this case, the restriction shall apply for the period until it is established whether the legitimate grounds of the controller override those of the data subject.
(2) Where processing is restricted pursuant to paragraph 1, such personal data may be processed, except for storage, only with the consent of the data subject or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or of an important public interest of the Union or of a Member State.
(3) The controller shall inform the data subject at whose request the processing has been restricted pursuant to paragraph (1) in advance of the lifting of the restriction.
5. Obligation to notify the rectification or erasure of personal data or the restriction of processing
(1) The controller shall inform all recipients to whom or with whom the personal data have been disclosed of the rectification, erasure or restriction of processing, unless this proves impossible or involves a disproportionate effort.
(2) At the request of the data subject, the controller shall inform him or her of the recipients.
6. The right to data portability
(1) The data subject shall have the right to receive personal data relating to him or her which he or she has provided to a controller in a structured, commonly used, machine-readable format and the right to transmit those data to another controller without hindrance from the controller to whom the personal data have been provided, if:
o the processing is based on consent pursuant to Article 6(1)(a) of the Regulation (consent to the processing of personal data) or Article 9(2)(a) of the Regulation (explicit consent to processing) or on a contract pursuant to Article 6(1)(b); and
o the processing is carried out by automated means.
(2) In exercising the right to data portability under paragraph (1), the data subject shall have the right to request, where technically feasible, the direct transfer of personal data between controllers.
(3) The exercise of the right referred to in paragraph (1) of this Article shall be without prejudice to Article 17 of the Regulation. That right shall not apply where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
(4) The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.
7. The right to object
(1) The data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to processing of his or her personal data carried out in the exercise of his or her official authority or in the public interest or to processing necessary for the purposes of the legitimate interests pursued by the controller or by a third party (processing based on Article 6(1)(e) or (f) of the Regulation), including profiling based on those provisions. In such a case, the controller may no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
(2) If personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to the processing of personal data concerning him or her for such purposes, including profiling, where it is related to direct marketing.
(3) Where the data subject objects to the processing of personal data for direct marketing purposes, the personal data shall no longer be processed for those purposes.
(4) The right referred to in paragraphs (1) and (2) shall be explicitly brought to the attention of the data subject at the latest at the time of the first contact with the data subject and the information shall be clearly displayed separately from any other information.
(5) In the context of the use of information society services and by way of derogation from Directive 2002/58/EC, the data subject may exercise the right to object by automated means based on technical specifications.
(6) Where personal data are processed for scientific or historical research purposes or statistical purposes in accordance with Article 89(1) of the Regulation, the data subject shall have the right to object, on grounds relating to his or her particular situation, to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
8. Right to exemption from automated decision-making
(1) The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
(2) Paragraph (1) shall not apply where the decision:
o necessary for the conclusion or performance of a contract between the data subject and the controller;
o is permitted by Union or Member State law applicable to the controller which also lays down appropriate measures to protect the rights and freedoms and legitimate interests of the data subject; or
o is based on the explicit consent of the data subject.
(3) In the cases referred to in points (a) and (c) of paragraph 2, the controller shall take appropriate measures to safeguard the rights, freedoms and legitimate interests of the data subject, including at least the right to obtain human intervention by the controller, to express his or her point of view and to object to the decision.
(4) The decisions referred to in paragraph (2) shall not be based on the special categories of personal data referred to in Article 9(1) of the Regulation, unless Article 9(2)(a) or (g) applies and appropriate measures have been taken to safeguard the rights, freedoms and legitimate interests of the data subject.
9. Right of the data subject to lodge a complaint and seek redress
9.1 Right to lodge a complaint with a supervisory authority.
(1) The data subject shall have the right to lodge a complaint with the supervisory authority pursuant to Article 77 of the Regulation if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.
(2) The data subject may exercise his or her right to lodge a complaint by contacting:
- Hungarian National Authority for Data Protection and Freedom of Information - address: 1125 Budapest, Szilágyi Erzsébet fasor 22/c.; telephone: +36 (1) 391-1400; fax: +36 (1) 391-1410; website: http://www.naih.hu; e-mail: ugyfelszolgalat@naih.hu.
(3) The supervisory authority with which the complaint has been lodged shall inform the client of the procedural developments concerning the complaint and of the outcome thereof, including the right of the client to seek judicial remedy pursuant to Article 78 of the Regulation.
9.2 Right to an effective judicial remedy against the supervisory authority
(1) Without prejudice to any other administrative or non-judicial remedy, any natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of the supervisory authority concerning him.
(2) Without prejudice to other administrative or non-judicial remedies, any person concerned shall have the right to an effective judicial remedy if the competent supervisory authority does not deal with the complaint or does not inform the person concerned within three months of the procedural developments concerning the complaint lodged pursuant to Article 77 of the Regulation or of the outcome of the complaint.
(3) Proceedings against a supervisory authority shall be brought before the courts of the Member State in which the supervisory authority is established.
(4) If proceedings are brought against a decision of a supervisory authority on which the Board has previously issued an opinion or taken a decision under the consistency mechanism, the supervisory authority shall send that opinion or decision to the court.
9.3 Right to an effective judicial remedy against the controller or processor
(1) Without prejudice to the administrative or non-judicial remedies available, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, any data subject shall have an effective judicial remedy if he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data not in accordance with this Regulation.
(2) Proceedings against a controller or processor shall be brought before the courts of the Member State in which the controller or processor is established. Such proceedings may also be brought before the courts of the Member State in which the data subject has his or her habitual residence, unless the controller or processor is a public authority of a Member State acting in its exercise of official authority.
10. Restrictions
(1) Union or Member State law applicable to a controller or processor may, by legislative measures, limit the scope of the rights and obligations set out in Article 5 in respect of its provisions in Articles 12 to 22 and Article 34 and in accordance with the rights and obligations set out in Articles 12 to 22, if the limitation respects the essential content of fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to protect them:
o national security;
o defence;
o public safety;
o the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the protection against and prevention of threats to public security;
o other important objectives of general interest of the Union or of a Member State, in particular important economic or financial interests of the Union or of a Member State, including monetary, budgetary and taxation matters, public health and social security;
o the independence of the judiciary and the protection of judicial procedures;
o prevent, investigate, detect and prosecute ethical violations in regulated professions;
o in the cases referred to in points (a) to (e) and (g), even occasionally, control, inspection or regulatory activities connected with the exercise of official authority;
o to protect the data subject or to protect the rights and freedoms of others;
o enforce civil claims.
(2) The legislative measures referred to in paragraph 1 shall contain, where appropriate, at least detailed provisions:
o the purposes or categories of processing,
o categories of personal data,
o the scope of the restrictions imposed,
o safeguards to prevent misuse or unauthorised access or disclosure,
o to define the controller or to define categories of controllers,
o the duration of storage and the applicable safeguards, taking into account the nature, scope and purposes of the processing or categories of processing,
o the risks to the rights and freedoms of data subjects, and
o the data subjects' right to be informed of the restriction, unless this might undermine the purpose of the restriction.
11. Information about the data breach
(1) Where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall inform the data subject of the personal data breach without undue delay.
(2) The information referred to in paragraph 1 provided to the data subject shall clearly and prominently describe the nature of the personal data breach and shall include at least the name and contact details of the data protection officer or other contact person who will provide further information, the consequences of the personal data breach and the likely consequences, the measures taken or envisaged by the controller to remedy the personal data breach, including, where appropriate, measures to mitigate any adverse consequences of the personal data breach.
(3) The data subject need not be informed as referred to in paragraphs (1) to (2) if any of the following conditions are met:
o the data controller has implemented appropriate technical and organisational protection measures and these measures have been applied to the data affected by the personal data breach, in particular measures, such as the use of encryption, which render the data unintelligible to persons not authorised to access the personal data;
o the controller has taken additional measures following the personal data breach to ensure that the high risk to the rights and freedoms of the data subject referred to in paragraph 1 is no longer likely to materialise;
o information would require a disproportionate effort. In such cases, the data subjects should be informed by means of publicly disclosed information or by a similar measure which ensures that the data subjects are informed in an equally effective manner.
(4) Where the controller has not yet notified the data subject of the personal data breach, the supervisory authority may, after having considered whether the personal data breach is likely to present a high risk, order the data subject to be informed or determine that one of the conditions referred to in paragraph 3 is met.
X. Procedure to be followed in the event of a request by the data subject
- The Data Controller is committed to protecting the rights of data subjects. To this end, it will do its utmost to ensure that the rights of data subjects are exercised to the fullest extent possible and that they are not adversely affected.
- The Data Controller shall facilitate the exercise without difficulty by any data subject of his or her rights under the law and the directives that are intended to ensure the protection of his or her personal data.
- The Data Controller may not refuse to comply with a request to exercise the rights of the data subject as set out in this Policy, unless the Data Controller proves that it is not possible to identify the data subject.
- The Controller shall inform the data subject of the action taken on the request without undue delay and in any event within 30 days of receipt of the request. If necessary, taking into account the complexity of the request and the number of requests, this time limit may be extended by a further (maximum) 30 days. The Data Controller shall inform the data subject of the extension of the time limit, stating the reasons for the delay, within 30 days of receipt of the request.
- Where the data subject has made the request by electronic means, the information shall be provided by electronic means where possible, unless the data subject requests otherwise.
- If the Data Controller does not take action on the data subject's request, the Data Controller shall inform the data subject without delay and at the latest within 30 days of receipt of the request of the reasons for the failure to act and of the right to lodge a complaint with the supervisory authority and to seek judicial remedy.
- The Data Controller shall provide the information and information requested free of charge to the data subject. However, if the data subject's request is manifestly unfounded or excessive, in particular because of its repetitive nature, the Controller may, taking into account the administrative costs of providing the information or information requested or of taking the action requested, charge a reasonable fee or refuse to act on the request.
The burden of proving that the request is manifestly unfounded or excessive lies with the controller.)
XI. Who has access to the data and the general rules on data processing
- The personal data of the data subjects may be accessed by the employees of the Data Controller with access rights related to the relevant processing purpose (and allocated by the employer), and by persons and organisations performing data processing activities for the Data Controller on the basis of service contracts, to the extent and to the extent necessary for the performance of their activities, as determined by the Data Controller.
- Processors shall in all cases perform processing activities on behalf of and under the instructions of the Controller. Processors, unlike the Data Controller, are therefore not free to make their own decisions regarding the processing. Processors may not use personal data received from the Controller for their own purposes.
- The Data Controller shall monitor the work of the processors.
- Any data processor is entitled to use an additional data processor only if the Data Controller has given its prior written consent.
- The Data Controller records that it uses an external data processor, in particular in the cases listed below, in order to achieve the purposes listed below:
(i) operation and maintenance of Internet websites, hosting services, newsletter services
(ii) tax and accounting obligations, invoicing software services, bookkeeping and payroll services
- The list of processors used by the Data Controller for any of its activities is set out in a separate document, Annex 4 to these Rules ("Register of Processors").
XII. Provisions on data security
1. Principles for implementing data security
- The Data Controller may process personal data only in accordance with the activities set out in this Policy and for the purposes for which they are processed.
- The Data Controller shall ensure the security of the data, and in this context undertakes to take all technical and organizational measures that are indispensable to enforce the laws on data security, data protection and confidentiality rules, and to establish the procedural rules necessary to enforce the above-mentioned laws.
- The technical and organisational measures to be implemented by the Data Controller shall be aimed in particular at:
· pseudonymisation and encryption of personal data;
· ensuring the continued confidentiality, integrity, availability and resilience of the systems and services used to process personal data;
· in the event of a physical or technical incident, the ability to restore access to and availability of personal data in a timely manner;
· the use of a procedure to regularly test, assess and evaluate the effectiveness of the technical and organisational measures taken to ensure the security of processing,
- In determining the appropriate level of security, explicit account should be taken of the risks arising from the processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal data transmitted, stored or otherwise processed.
- The Data Controller shall take appropriate measures to protect the data against unauthorised access, alteration, disclosure, disclosure, erasure or destruction, accidental destruction or damage and inaccessibility resulting from changes in the technology used.
- The Data Controller shall keep records of the data processed by it in accordance with the applicable legislation, ensuring that the data may only be accessed by employees, other persons acting in the interests of the Data Controller and data processors who need to know the data in order to perform their job or task.
- The Data Controller shall store personal data provided in the course of each processing activity separately from other data, with the understanding that, in accordance with the above provisions, the separate data files may be accessed only by employees with appropriate access rights.
- The managers and employees of the Data Controller shall not transmit personal data to third parties, and shall take the necessary measures to prevent unauthorised access.
- The Data Controller shall allow access to personal data to those of its employees who have signed a confidentiality undertaking in relation to the personal data processed in order to comply with data security rules.
- When determining and applying data security measures, the Data Controller shall take into account the state of the art and, where there are several possible processing solutions, shall choose the solution offering a higher level of protection of personal data, unless this would involve a disproportionate level of difficulty.
2. Protection of the Company's IT records
- The Data Controller shall take the following measures necessary to ensure the security of its IT records:
· Provide the data files it manages with permanent protection against computer viruses (using real-time virus protection software).
· Ensure the physical protection of the hardware assets of the IT system, including protection against elemental damage,
· Ensures that the IT system is protected against unauthorised access, both in terms of software and hardware,
· Take all measures necessary to restore data files, perform regular backups and ensure separate and secure management of backups.
3. Protecting the Company's paper records
- The Data Controller shall take the necessary measures to protect paper records, in particular with regard to physical security and fire protection.
- The Controller's managers, employees and other persons acting on behalf of the Controller shall keep secure and protect the data media containing personal data which they use or have in their possession, regardless of the means of recording the data, against unauthorised access, alteration, disclosure, disclosure, erasure or destruction and against accidental destruction or damage.
XIII. Procedure in the event of a personal data breach
- A personal data breach is a breach of security within the meaning of the Regulation that results in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.
- A data breach is the loss or theft of a device (laptop, mobile phone) containing personal data, the loss or unavailability of a code to decrypt a file encrypted by the Data Controller, infection by ransomware (ransomware) that renders the data processed by the Data Controller inaccessible until the payment of a ransom, an attack on the IT system, the disclosure of an e-mail or address list containing personal data sent in error, etc.
- In case of detection of a data breach, the Data Controller's representative shall immediately conduct an investigation to identify the data breach and its possible consequences. The necessary measures shall be taken to remedy the damage.
- You must notify the data protection incident to the competent supervisory authority without undue delay and, if possible, no later than 72 hours after becoming aware of the data protection incident, unless the data protection incident is unlikely to pose a risk to the rights and freedoms of natural persons. If the notification is not made within 72 hours (although it is necessary), it must be accompanied by the reasons justifying the delay.
- If the data processor becomes aware of a data breach, it shall notify the Data Controller without undue delay after becoming aware of it.
- In the notification referred to in paragraph 4, at least:
· describe the nature of the personal data breach, including, where possible, the categories and approximate number of data subjects and the categories and approximate number of data subjects affected by the breach;
· the name and contact details of the Data Protection Officer or other contact person who can provide further information;
· explain the likely consequences of the data breach;
· describe the measures taken or envisaged by the Data Controller to remedy the personal data breach, including, where appropriate, measures to mitigate any adverse consequences of the personal data breach.
- If and to the extent that it is not possible to provide the information at the same time, it may be provided in instalments at a later date without further undue delay.
- The Data Controller shall keep a record of the data breaches, indicating the facts relating to the data breach, its effects and the measures taken to remedy it. This record shall enable the supervisory authority to verify compliance with the requirements of Article 33 of the Regulation.
XIV. Other provisions
- The Data Controller's manager shall explain the provisions of this Policy to all employees of the Data Controller.
- The Controller's manager shall ensure that all employees of the Controller comply with the provisions of this Policy. For the purpose of implementing this obligation, the Controller's administrator shall require that the employment contracts of the Controller's employees be amended to include a declaration of the employee's commitment to comply with and enforce this Policy.
- The establishment and amendment of this Policy is the responsibility of the Data Controller's Chief Executive Officer.
XV. Request, complaint, remedy
If any data subject has any questions or comments regarding the Data Controller's data management activities, he/she may submit his/her question/request/comment to the Data Controller at any of the contact details indicated in this Policy. Depending on the subject of the request, the Controller shall act in accordance with the provisions of these Rules.
You can lodge a complaint or seek redress from the following bodies:
National Authority for Data Protection and Freedom of Information Address: 1055 Budapest,
9-11 Falk Miksa Street.
Phone: +36 (1) 391-1400
Fax: +36 (1) 391-1410
www: http://www.naih.hu
In case of violation of the rights of minors in relation to offensive, hateful, exclusionary content, rectification, rights of a deceased person, defamation of reputation:
National Media and Infocommunications Authority 1015 Budapest, Ostrom u. 23-25.
Mailing address: 1525. Pf. 75
Tel: (06 1) 457 7100
Fax: (06 1) 356 5520
E-mail: info@nmhh.hu
The data subject may take legal action if his or her rights are infringed. The court will rule on the case out of turn. It is the Data Controller's responsibility to prove that the processing complies with the law. The competent court has jurisdiction to rule on the case. In addition to the general rule of jurisdiction, the place of residence or habitual residence of the data subject shall be a ground for the jurisdiction of the court.
In the event that the Data Controller infringes the personal rights of the data subject by unlawful processing of the data subject's data or by breaching the requirements of data security, the data subject may claim damages or compensation from the Data Controller.
XVI Annexes
Annex 1: "Information on data management on the websites operated by the Data Controller"
This Notice shall be deemed to be Annex 1 to the Data Controller's Policy ("General Data Protection Policy"). This Notice describes in detail the data processing activities of the Controller in relation to its website activities. This Notice shall be read in conjunction with and in accordance with the relevant Policy and its Annexes. For matters not covered by this Policy, the general provisions of the Policy and the specific provisions of its further annexes shall prevail.
1. Introduction
Name of the data controller: ODOL Consulting Kft.
Headquarters: 4032, Debrecen, Menyhárt József tér 5 fsz 1
Company registration number: 09-09-035656
Tax identification number: 32431438-2-09
Contact: +36 20 666 7170; info@reloflow.hu;
Name and contact details of the authorised representative: Ferenc Suhaj, Managing Director with independent right of representation (+36 20 666 7170; info@reloflow.hu)
Websites operated by the Data Controller:
The scope of the processing covered by this Notice:
- processing of data relating to visitors to the Sites ("cookie"/customer data processing)
- newsletter service
- shopping on the website
- redeem vouchers purchased
- marketing
2. Processing of data relating to visitors to the Sites ("cookie"/customer data processing)
We use cookies to provide you with content, to analyse our website and for possible advertising purposes in order to provide you with a convenient browsing and shopping experience.
2.1. General information
- During the visits to the website of the Data Controller, one or more cookies/cookies are sent to the computer of the person visiting the website, through which his/her browser(s) will be identified, provided that the person visiting the website has given his/her explicit (active) consent to this in advance, after having been clearly and unambiguously informed, by his/her further browsing behaviour.
- A "cookie" is a small packet of information that the server sends to the browser, and the browser sends back to the server for each request directed to the server.
- Cookies are used solely to improve the user experience and automate the login process. The cookies used on the website do not store personally identifiable information.
- Cookies are short data files placed on the user's computer by the website visited. The purpose of the cookie is to make the given infocommunication or internet service easier and more convenient. There are several types, but they generally fall into two broad categories. One is the temporary cookie, which is placed on the user's device by the website only during a particular session (e.g. during the security identification of an online banking transaction), and the other is the persistent cookie (e.g. a website's language setting), which remains on the computer until the user deletes it. According to the European Commission's guidelines, cookies [unless strictly necessary for the use of the service] can only be placed on the user's device with the user's permission.
- In the case of cookies that do not require the user's consent, information should be provided during the first visit to the website. It is not necessary for the full text of the cookie notice to appear on the website, but it is sufficient for website operators to briefly summarise the substance of the notice and provide a link to the full notice.
- In the case of cookies requiring consent, the information may also be linked to the first visit to the website, if the processing of data associated with the use of cookies starts as soon as the page is visited. Where the use of the cookie is linked to the use of a function explicitly requested by the user, the information may also be provided in relation to the use of that function. Even in this case, it is not necessary for the full text of the cookie notice to be displayed on the website, a brief summary of the substance of the notice and a link to the full notice.
2.2. Settings for cookies
- As described above, cookies may be stored by our company as Data Controller on the data subject's (website visitor's) device if this is strictly necessary for the functioning of the website. In all other cases, and for all other types of cookies, the prior explicit consent of the data subject is required for the use and storage of cookies.
- The Data Controller uses several types of cookies. Some of the cookies are placed on the data subject's device by the Data Controller, others are placed on the data subject's device by data processors or third party service providers.
- The data subject can review his or her current cookies in relation to the website operated by the Data Controller that is currently being visited at any time via the relevant website under the "cookie policy" section and change the settings. Data Subjects T are informed that when reviewing the cookies, they will be given the opportunity to obtain information on the exact name of the cookies used, the purpose of the cookie and the storage period of the cookie.
- In addition, browsers typically offer the possibility for the data subject to change their cookie settings. Changing cookie settings in the browser is usually done via the {menu} {preferences} {privacy and security} {cookies}.
2.3. Categorisation of used cookies
2.3.1. Essential cookies
The website used by the data subject cannot function properly without the essential cookies. Without these cookies, the data subject will not be able to use the website he or she has visited.
2.3.2. Preferential, preference cookies
Preferential cookies allow us to remember information that changes the way the website behaves or looks (e.g. language preference, region preference, etc.)
2.3.3. Statistical cookies
Through the collection and reporting of data in an anonymous form, statistical cookies help the Data Controller to understand, analyse and use the way visitors (data subjects) interact with the website they visit.
2.3.4. Cookies for marketing purposes
We use personalised marketing cookies to track visitors' website activity. The goal is to serve the most relevant ads to individual users, display content that is relevant to their preferences, and encourage them to be active.
2.3.5. Unclassified cookies
Unclassified cookies are cookies that are still under classification with individual cookie providers.
2.4. Request for information
If any data subject has any questions regarding the processing of cookies, he or she may request information via the contact details provided by the Data Controller.
3. Newsletter service
(1) The legal basis for data processing in the case of newsletter subscription is the voluntary consent of the data subject, which the data subject gives by ticking the box(es) next to the text "newsletter subscription" on the Controller's website after being informed about the processing of his or her data.
(2) The data subject in case of newsletter subscription: any natural person who subscribes to the newsletter of the Data Controller and gives his/her consent to the processing of his/her personal data.
(3) Data processed in the case of newsletter subscriptions: name, e-mail address.
(4) The purpose of data processing in the case of newsletter subscription: to inform the data subject about the services and products of the Data Controller, changes in them, to inform about news and events, to send economic advertising, to send e-mail messages/newsletters containing marketing enquiries.
(5) The recipients of the data (who may know the data) in case of newsletter subscription: the Data Controller's manager, customer contact staff, data processor's staff performing the tasks related to the operation of the Data Controller's website.
(6) Duration of data processing in the case of newsletter subscriptions: until consent is withdrawn and until unsubscription.
(7) The data subject may unsubscribe from the newsletter at any time. The unsubscription to the newsletter shall be made by clicking on the unsubscribe link in the footer of the e-mails sent to the data subject, by postal letter sent to the Data Controller's headquarters.
4. Shopping on a website
(1) The online sale of goods and services on the Company's website, the conclusion of contracts (purchases) by electronic means is subject to Act CVIII of 2001 (Eker tv.). Purchases on the website are not subject to registration.
(2) The purposes of the processing in relation to purchases on the website:
- the online sale of products
- documenting the purchase and payment
- identifying and contacting the customer
- the performance of contracts concluded online
- invoicing and payment processing
- detect suspicious transactions in online payments
- proof of compliance with the legal obligation to provide information to consumers
- proof of the conclusion of the contract
- creating the contract, defining its content, amending it and monitoring its performance.
(4) In the case of purchases on the website, the legal basis for processing is the consent of the data subject, the performance of contractual and legal obligations and, in the case of fraudulent transactions, legitimate interest.
(5) The categories of data concerned by the processing are: the customer's full name, address, telephone number, e-mail address, login password, tax number, the products purchased, data related to payment transactions.
(6) Categories of data subjects: any natural person who makes a purchase on the website of the Data Controller.
(7) The categories of data recipients are: the Data Controller's managing director; employees performing customer relations and sales-related tasks; employees of the data processor operating the Data Controller's websites; employees of the Data Controller performing accounting and invoicing tasks, data processors performing these tasks; and STRIPE PAYMENTS EUROPE LTD. (registered office: One Spencer Dock, North Wall Quay, Dublin1, VAT: IE3206488LH)
(8) Duration of processing:
- until completion of the contract or, failing this, until 5 years after the conclusion of the contract
- if the Data Controller is obliged to retain the data under the Accounting Act, the Data Controller shall retain such data for 8 years after the purchase.
5. Redeeming vouchers purchased
(1) The Data Controller shall process the data of natural persons who have redeemed previously purchased vouchers under the voucher redemption menu on the website in connection with the performance of the contractual relationship. The data subject shall be informed of the processing of personal data and shall consent to the processing of his or her data by ticking the box.
(2) Data subjects: all natural persons who call upon the Data Controller to perform a contract by using the voucher redemption menu item.
(3) The legal basis for data processing is the performance of a contract, the purpose of data processing is to maintain contact, enforce claims arising from the contract, and ensure compliance with contractual obligations.
(4) Recipients of personal data: the Data Controller's manager, employees of the Data Controller performing customer service and accounting tasks on the basis of their job function, data processors.
(5) Personal data processed: voucher code, full name, e-mail address, telephone number.
(6) Duration of processing: 5 years from the termination of the contract.
6. Marketing
(1) The legal basis for the Data Controller's processing of data for marketing purposes is the data subject's consent, which is clear and explicit. The data subject shall give his or her unambiguous and explicit prior consent by ticking the box next to the text "consent to marketing enquiries" on the Controller's website, following the information on the processing of his or her data.
(2) The Data Controller may also process data for marketing purposes by sending you a newsletter and by using cookies for marketing purposes, the provisions of which are set out in Section 2 of this Policy.
(3) The data subject may also give his or her consent on paper by filling in a separate document.
(4) The data subject is any natural person who gives his or her unambiguous and explicit consent to the processing of his or her personal data by the Data Controller for marketing purposes.
(5) The purposes of data processing are: maintaining contact; sending advertisements and offers related to the provision of services and the sale of products; sending notifications of promotions by electronic or postal means.
(6) The recipients of personal data are: the Data Controller's manager, employees performing customer service and marketing tasks on the basis of their job function and data processors performing tasks in this context, and the employees of the data processor performing tasks related to the operation of the Data Controller's website.
(7) Personal data processed: full name, address, telephone number, e-mail address.
(8) Duration of processing: until the processing of personal data for marketing purposes is withdrawn by the data subject.
7. Who has access to the personal data (recipients)
In general, in the case of the processing referred to in this Notice, access to personal data is limited to the persons authorised by the Data Controller. In this Notice, the Controller has indicated for each type of processing the persons to whom it may grant authorisation. This means that the previously designated persons may have access to the personal data for the performance of their tasks.
The Data Controller also uses the web analytics services of Google LLC, 1600 Amphitheatre Parkway Mountain View CA 94043, Google Analytics, Google Adwords, a data protection shield for the EU-U.S., and Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
Web analytics services also use cookies to help analyse the use of online interfaces. By providing specific and explicit consent to the use of online platforms, the data subject authorises Google Analytics and Google Adwords to transfer information generated by cookies about the use of the online platform to Google servers in the United States of America. The other cookies processed are stored on servers within the European Union. By providing specific consent on the website, the user consents to the collection and analysis of his/her data in the manner and for the purposes set out above. The above mentioned service providers use this information to evaluate and analyse the use of online interfaces by the data subject, to compile reports on the activities carried out on online interfaces and to provide other services related to the activities carried out on those interfaces and to the use of the Internet. However, it remains important to stress that the cookies used on the website do not store personally identifiable information.
8. Data transmission
In connection with the online sale and purchase of products via the website, as a data processing purpose, data relating to purchases made on the Internet will be transferred to STRIPE PAYMENTS EUROPE LTD. (registered office: One Spencer Dock, North Wall Quay, Dublin1, VAT: IE3206488LH) in order to enable the company to process online card transactions securely and in a traceable manner via its network. (This company has already been identified in paragraph 5(7) of this Notice.)
This company guarantees the security of your personal data and the transaction through its own website (secure payment gateway, secure card payment guarantee window) when you pay by card after purchase.
Data transmitted: full name, e-mail address, telephone number, address, billing address if different, IP address, additional data related to the payment transaction.
The Data Controller does not process the data of the cardholder (e.g. its number and expiry date) in any form.
9. Final provisions
The provisions of the Code and its annexes shall apply to the data processing provisions not mentioned in this Notice, as stated at the beginning of this Notice. Thus, in particular, but not exclusively, the provisions of the Policy shall govern the rights of data subjects, data security measures and remedies.
Annex 2: "Information on data management in relation to the economic activities of the Data Controller"
This Notice shall be deemed to be Annex 2 to the General Data Protection Regulation of the Controller ("General Data Protection Regulation"). This Notice describes in detail the processing of data relating to the economic activities of the Controller. It shall be read in conjunction with and in accordance with the relevant Policy and its Annexes. For matters not covered by this Notice, the general provisions of the Policy and the specific provisions of its further annexes shall prevail.
1. Introduction
Name of the data controller: ODOL Consulting Kft.
Headquarters: 4032, Debrecen, Menyhárt József tér 5 fsz 1
Company registration number: 01 09 282683
Tax identification number: 32431438-2-09
Contact: +36 20 666 7170; info@reloflow.hu;
Name and contact details of the authorised representative: Ferenc Suhaj, Managing Director with independent right of representation (+36 20 666 7170; info@reloflow.hu)
The scope of the processing covered by this Notice:
- processing based on a legal obligation
- contacting
- performance of contracts.
We inform Data Subjects T. that the "specific" data processing related to the websites operated by the Data Controller are regulated in detail in a separate information notice, in Annex 1 of the Policy. This Policy sets out the detailed rules for the general processing of data in the course of the economic activities of the Controller.
2. Processing based on a legal obligation
2.1. Processing of data to fulfil accounting obligations
(1) The legal basis for the processing of the data of the Data Controller's natural person customers, buyers and suppliers is the fulfilment of legal obligations (Article 159 (1) of Act CXXVII of 2007), the purpose of the use of the data is to determine the mandatory data content of the invoice, issue the invoice, and perform related accounting tasks.
(2) Data subjects: the Data Controller's natural person clients, customers, suppliers.
(3) The scope of the data processed: the names, addresses of the Data Controller's natural person customers, customers, suppliers, the serial number of the invoice issued.
(4) The following persons shall be entitled to access personal data: the manager or employee who issues the invoice as a job function, the manager or employee who performs the accounting function, or the contracted data processing partners performing such a function. The Data Controller is entitled to process personal data recorded in the course of the performance of the legal obligation referred to above for a period of 8 years from the termination of the contract (business relationship).
2.2. Data processing related to the fulfilment of tax and contribution obligations
(1) Pursuant to Article 50 (1) of Act CL of 2017 on the Rules of Taxation, the Data Controller shall submit monthly, by the twelfth day of the month following the month concerned, an electronic declaration of all taxes, contributions and/or data specified in paragraph (2) related to payments and benefits made to natural persons resulting in tax and/or social security obligations.
(2) Data subjects: the controller's manager, employees and their family members.
(3) Scope of the data processed: the Controller's manager, employees and their family members Art. 50 (2), highlighting the natural person's natural person identification data (including previous name and title), gender, nationality, tax identification number of the natural person, social security number.
(4) Recipients: employees of the Data Controller performing accounting and payroll activities as part of their job duties, and data processors.
(5) The Data Controller shall be entitled to process personal data recorded in the course of the performance of the legal obligation referred to above for a period of 8 years from the termination of the legal relationship.
3. Keeping in touch
3.1. Processing of data during requests for information, requests for proposals
(1) In connection with the services provided or products sold by the Data Controller, the Data Controller shall provide third parties with the opportunity to request information or to request offers.
(2) The legal basis for data processing is the consent of the data subject in the case of a request for information or a request for a proposal.
(3) In the case of a request for information or a request for a quotation, the data subject shall be any natural person who requests information or a quotation in connection with the services or products of the Data Controller and provides personal data.
(4) Data processed: name, address, telephone number, e-mail address, content of the request/question/offer.
(5) Purpose of processing in case of a request for information: identification, contact, response.
(6) The purpose of data processing in the case of a request for a proposal: to make a proposal, to maintain contact.
(7) The recipients of the data (who may have access to the data) in the case of a request for information or a request for a quote: the Data Controller's manager, customer contact person.
(8) Duration of data processing In case of a request for information or an offer: until consent is withdrawn or 180 days after the provision of the information or the offer, the Data Controller shall delete the personal data.
3.2. Processing of contact details of natural person representatives of legal entity customers, buyers, suppliers
(1) The scope of personal data that may be processed: the name, address, telephone number, e-mail address, online identifier of the natural person.
(2) Purpose of processing personal data: performance of a contract with a legal entity partner of the Data Controller, business relations,
(3) Legal basis for processing: consent of the data subject.
(4) Recipients or categories of recipients of personal data: employees of the Controller performing customer service tasks.
(5) Duration of the storage of personal data: 5 years after the business relationship or the data subject's capacity as a representative has been established.
4. Data processing activities related to the performance of the contract
(1) The Data Controller shall process the personal data of natural persons - customers, buyers, suppliers - contracting with it in the context of the contractual relationship. The data subject shall be informed of the processing of personal data.
(2) Data subjects: all natural persons who enter into a contractual relationship with the Data Controller.
(3) The legal basis for data processing is the performance of a contract, the purpose of data processing is to maintain contact, enforce claims arising from the contract, and ensure compliance with contractual obligations.
(4) Recipients of personal data: the Data Controller's manager, employees of the Data Controller performing customer service and accounting tasks on the basis of their job function, data processors.
(5) The personal data processed include: order data (order number, products ordered, price and total value of products), customer card number, name, address, delivery address, registered office, entrepreneur's ID number, farmer's ID number, total amount of the order, delivery method and cost, payment method, transaction code, payment made.
(6) Duration of processing: 5 years from the termination of the contract.
5. Final provisions
The provisions of the Code and its annexes shall apply to the data processing provisions not mentioned in this Notice, as stated at the beginning of this Notice. Thus, in particular, but not exclusively, the provisions of the Policy shall govern the rights of data subjects, data security measures and remedies.
Annex 3: "Information on data processing in the context of employment law and employment relationships"
This Notice shall be deemed to be Annex 3 to the General Data Protection Regulation of the Data Controller. This Notice describes in detail the employment law and related data processing. This Notice shall be read in conjunction with and in accordance with the relevant Policy and its annexes. For matters not covered by this Notice, the general provisions of the Rules and the specific provisions of the additional annexes thereto shall prevail.
1. Introduction
Name of the data controller: ODOL Consulting Kft.
Headquarters: 1095 Budapest, Lechner Ödön fasor 1. Fsz. door 293.
Company registration number: 09-09-035656
Tax identification number: 32431438-2-09
Contact: https://reloflow.hu
Name and contact details of the authorised representative: Ferenc Suhaj, Managing Director with independent right of representation (+36 20 666 7170; sashalmi.attila@reloflow.hu)
The scope of the processing covered by this Notice:
- the controller prior to the establishment of the employment relationship
- processing during the employment relationship
2. Pre-employment processing
Data processing prior to the establishment of an employment relationship is carried out in the context of the pre-employment application procedure and the assessment of suitability for the job.
2.1. Processing of data during the recruitment process
(1) The legal basis for the processing of personal data in the context of a recruitment procedure is the consent of the data subject.
(2) The purposes of data processing: evaluation of applications, conclusion of employment contracts.
(3) The data concerned by the processing: name, address, place of birth, date, education, professional qualifications, telephone number, e-mail address, photo, professional experience, other data contained in the application file sent by the applicant.
(4) The persons concerned are the natural persons applying for the job.
(5) Recipients of personal data: the employer, the employee(s) performing the human resources function, and, where applicable, the data processor acting on the instructions of the Data Controller and entrusted with the performance of the HR tasks. (In the event of the use of a data processor, the Data Controller shall inform the data subject in advance of the identity of the data processor.)
(6) Duration of data processing: after the selection of the employee, the purpose of data processing ceases to exist for the applicants who have not been selected, and therefore the personal data of the applicants shall be deleted immediately, unless the applicant has explicitly consented to the processing of his/her application file by the Data Controller in case of the subsequently proven unsuitability of the selected applicant or for the purposes of pre-selection for a new job opportunity. In the latter case, the period of data processing is set by the Controller at 1 year (12 months).
(7) The obligation to cancel the application shall also apply if the person concerned changes his or her mind or withdraws his or her application during the application process. The candidate must be informed of the result of the selection decision.
2.2. Processing of data during the assessment of suitability for the job
(1) Pursuant to Article 10 (1) of the Labour Code, only two types of aptitude tests may be applied to employees: on the one hand, aptitude tests which are required by a rule on employment relationship, and on the other hand, tests which are not required by a rule on employment relationship, but which are necessary for the exercise of a right or the performance of an obligation specified in the rule on employment relationship.
(2) In both cases of the aptitude test, the (prospective) employees as the persons concerned shall be informed in detail, inter alia, about the skills and abilities to be assessed, the means and methods of the test. If the examination is required by law, employees should also be informed of the title of the law and the exact place of the law.
(3) Legal basis for processing: legitimate interest of the employer.
(4) Purpose of data processing: to determine suitability for a job, to establish an employment relationship.
(5) The persons entitled to process personal data in relation to the test result are the examiner and the person tested. The employer may only receive information on whether or not the person examined is suitable for the job and on the conditions under which the person is suitable for the job. However, the employer cannot know the details of the examination or its full documentation.
(6) Duration of the processing of personal data relating to the aptitude test: 3 years after the termination of the employment relationship.
3. Data processing during the employment relationship
3.1. Data processing in the framework of the employment register
(1) The Data Controller shall process the personal data of the employees named below, processed in the employment records, on the basis of the employer's legitimate interest, the performance of a legal obligation, the performance of a contract. The Data Controller shall inform the employee, as the data subject, of the legal basis and purpose of the processing prior to the commencement of the processing activity.
(2) The scope of the personal data of employees processed by the Controller in the employment register:
· Name
· address, temporary address, postal address,
· contact details, telephone number, e-mail address,
· Social security number, tax identification number, identity card number,
· the amount of your salary,
· bank account number,
· addresses and bank account numbers of blocking, deductions,
· children, dependants and their social security numbers,
· tax identification number,
· employee contact details,
· next of kin to be notified.
(3) Persons concerned by the processing: employees of the Data Controller at any given time.
(4) The recipients of the personal data recorded above are: the employer, employees of the Data Controller performing personnel, accounting, payroll and data processing tasks.
(5) Purpose of data processing: fulfilment of obligations arising from the employment relationship (payment of wages), exercise of rights arising from the employment relationship, establishment and termination of the employment relationship.
(6) Duration of data processing: 8 years after the termination of the employment relationship in the case of general employment documents (including, for example, employment contracts). In the case of employment records relating to payroll accounting and the employee's insurance relationship, 5 years after the applicable retirement age.
3.2 Monitoring the employee's conduct in the employment relationship
(1) The employer, as Data Controller, may monitor the employee as data subject only in the context of his or her conduct in the employment relationship. The control and the means and methods used in the course of the control shall not involve any violation of human dignity. The employee's private life shall not be subject to control.
(2) The employer shall inform the employee in advance of the use of technical means which will be used to monitor the employee.
3.2.1. Processing of data related to the use of an e-mail account provided by the Data Controller to the employee
(1) The Data Controller shall make an e-mail account available to employees in order to enable employees to keep in touch with each other or to correspond with customers, other persons and organisations on behalf of the Data Controller.
(2) Employees of the Data Controller are not allowed to use the e-mail account described above for private purposes. The head of the employer is entitled to check the contents of the employees' company e-mail accounts and the correspondence of the employees every six months.
(3) The employer must inform the employee of the employer's interest in taking action before controlling the use of the email account.
(4) The employer shall, subject to the principle of gradualness, develop a system of gradual control, which shall adequately ensure the protection of personal data and minimise the impact of the control on the privacy of employees.
(5) As a general rule, the presence of the employee must be ensured when checking the use of the e-mail account.
(6) In order to maintain lawful control of the e-mail account, the employer must provide detailed information to the employees in advance. In the information, the employer must state, inter alia:
(i) for what purposes and for what employer interests the e-mail account may be checked (and, of course, the employee must be informed of the employer's interest in the check before the specific check is carried out);
(ii) who on behalf of the employer may carry out the inspection;
(iii) the rules according to which the checks may be carried out (gradual approach);
(iv) what the procedure is;
(v) what rights and remedies employees have in relation to the processing of their data in connection with the monitoring of their e-mail account.
(7) The first step in the verification is to check the e-mail address and the subject of the e-mail, and then a more detailed, higher level check of the use of the e-mail account may be carried out.
(8) The employer shall not be entitled to check the content of private e-mails stored in the e-mail account, even if the employees have been informed of the fact of the check in advance. The employee shall be requested to delete the private e-mails, if the employee does not comply with the request or is unable to delete the personal data due to his/her absence, the employer shall be entitled to delete the personal data immediately upon the inspection, and at the same time may apply labour law sanctions against the employee for violation of the regulation on the use of company e-mail.
(9) Every six months, the employer shall be entitled to send information to employees in the mail system on the prohibition of private use of company e-mail accounts.
(10) The legal basis for the control of the e-mail account made available to the employee by the Data Controller is the legitimate interest of the employer, the purpose of which is to monitor the fulfilment of the employee's obligations and to monitor compliance with the prohibition on the use of private e-mail accounts.
3.2.2.2 Control of the use of laptops, tablets and telephones provided to the employee
(1) Employers may provide employees in certain jobs with "company" laptops, tablets and telephones for the performance of their work.
(2) Employers shall prohibit employees from using the above-mentioned devices for personal purposes. Pursuant to the above provision, the handling, storage, use of any personal data, such as photos, passwords, identifiers for employees' personal accounts, e-mails, private applications, or use for private conversations on the above-mentioned devices is prohibited.
(3) The provisions set out in section 3.2.1 shall apply to the control of the above-mentioned instruments, the persons carrying out the control, the legal basis and the purposes of the processing.
3.3. Ad hoc processing of data relating to employees
(1) The employer shall organise team-building trainings and other events, in which employees shall be given the opportunity to participate, with the aim of improving communication between employees, promoting more effective cooperation and increasing the level of trust between employees, and strengthening mutual respect and commitment.
(2) The legal basis for the processing of data in the course of the activities referred to in the previous paragraph is the consent of the employee.
(3) The purpose of data management is to improve communication between employees, to facilitate more effective cooperation and increase the level of trust between employees, and to strengthen mutual respect and commitment.
(4) Persons concerned: all employees who participate in the training or other event.
(5) Scope of personal data: portraits of employees.
(6) Deadline for deletion of data: 6 months after withdrawal of consent or publication in the employer's internal system.
(7) Persons entitled to access the data (categories of recipients): visitors to the website and social platforms of the Data Controller.
4. Final provisions
The provisions of the Policy apply to the data processing provisions not mentioned in this Notice, as stated at the beginning of this Notice. Thus, in particular, but not exclusively, the provisions of the Policy and its annexes shall govern the rights of data subjects, data security measures and remedies.
Annex 4: "Register of data processors"
DATA PROCESSORS' RECORDS
DATA PROCESSORS
Name of data processor
Contact details of the data processor
Activity
TAX Feeling Ltd.
4027 Debrecen, Fáy András utca 19.
accounting
KBOSS.hu Kft
1031 Budapest, Záhony utca 7/D.
billing software service
Debrecen, 2024.02.06.
ODOL Consulting Ltd.
represented by Ferenc Suhaj, Managing Director