Privacy Policy

Regarding the use of data processors and their activities related to data processing

Data processing aimed at the storage of personal data

Name of the data processor: UNAS Online Kft.

Contact details of the data processor:

Phone number:

E-mail address: unas@unas.hu

Registered office: 9400 Sopron, Kőszegi út 14.

Based on a contract concluded with the Data Controller, the Data Processor performs the storage of personal data. They are not entitled to access personal data.

Data processing activity related to delivery

Name of the data processor: GLS General Logistics Systems Hungary Csomag-Logisztikai Kft.

Registered office of the data processor: 2351 Alsónémedi, GLS Európa u. 2.

Data processor’s phone number:  +36-29/88 66 70

Data processor’s e-mail address: info@gls-hungary.com

Based on the contract concluded with the Data Controller, the Data Processor contributes to the delivery of the ordered goods. In doing so, the Data Processor may process the buyer's name, address, and phone number until the end of the calendar year following the dispatch of the postal item, after which it shall delete them without delay.

Data processing activities related to newsletter distribution

Name of the company operating the newsletter system: Sales Autopilot

Registered office of the company operating the newsletter system: Margit krt. 31-33. mezzanine 4, 1024 Budapest,

Phone number of the company operating the newsletter system: (+36) 1 490 0172

E-mail address of the company operating the newsletter system: info@salesautopilot.hu

Based on the contract concluded with the Data Controller, the Data Processor contributes to the sending of newsletters. In doing so, the Data Processor processes the data subject's name and e-mail address to the extent necessary for sending the newsletter and shall delete them without delay upon the data subject's request.

Your rights regarding data processing

Within the duration of the data processing, you are entitled to the following rights under the provisions of the Regulation:

• right to withdraw consent
• access to personal data and information related to data processing
• right to rectification
• restriction of processing,
• right to erasure
• right to object
• right to data portability.

If you wish to exercise your rights, it will involve your identification, and the Data Controller must necessarily communicate with you. Therefore, you will need to provide personal data for identification purposes (but identification can only be based on data that the Data Controller otherwise processes about you), and your data processing-related complaints will be available in the Data Controller's email account for the period specified in this information notice regarding complaints. If you have been our customer and wish to identify yourself for complaint handling or warranty claim purposes, please also provide your order ID. By using this, we can also identify you as a customer.

The Data Controller will respond to complaints related to data processing within 30 days at the latest.

Right to withdraw consent

You have the right to withdraw your consent to data processing at any time; in such cases, the provided data will be deleted from our systems. However, please note that in the case of an unfulfilled order, withdrawal may have the consequence that we cannot complete the delivery to you. Furthermore, if the purchase has already been completed, we cannot delete data related to invoicing from our systems based on accounting regulations, and if you have outstanding debts to us, we may continue to process your data based on our legitimate interest in collecting the debt even if consent is withdrawn.

Access to personal data

You have the right to receive feedback from the Data Controller as to whether your personal data is being processed, and if processing is underway, you have the right to:

• gain access to the processed personal data and
• be informed by the Data Controller about the following:
  • the purposes of the processing;
  • the categories of personal data processed about you;
  • information about the recipients or categories of recipients with whom the Data Controller has shared or will share the personal data;
  • the intended period of storage of the personal data, or if this is not possible, the criteria for determining this period;
  • your right to request from the Data Controller the rectification, erasure, or restriction of processing of personal data concerning you, and to object to the processing of such personal data in the case of processing based on legitimate interests;
  • the right to lodge a complaint with a supervisory authority;
  • if the data was not collected from you, any available information about its source;
  • the fact of automated decision-making (if such procedure is applied), including profiling, as well as at least in these cases, understandable information about the logic applied and the significance of such processing, and the expected consequences for you.

The purpose of exercising this right may be to establish and verify the lawfulness of the processing; therefore, in case of repeated requests for information, the Data Controller may charge a reasonable fee in exchange for providing the information.

The Data Controller provides access to personal data by sending you the processed personal data and information via email after verifying your identity. If you have a registration, we ensure access by allowing you to view and check the personal data processed about you by logging into your user account.

Please indicate in your request whether you are requesting access to personal data or information related to data processing.

Right to rectification

You have the right to have inaccurate personal data concerning you rectified by the Data Controller without undue delay upon your request.

Right to restriction of processing

You have the right to have the processing restricted by the Data Controller upon your request if one of the following conditions is met:

• You contest the accuracy of the personal data; in this case, the restriction applies to the period allowing the Data Controller to verify the accuracy of the personal data. If the accurate data can be determined immediately, no restriction will occur;
• the processing is unlawful, but you oppose the erasure of the data for any reason (for example, because the data is important to you for the enforcement of legal claims), therefore you do not request the erasure of the data but instead request the restriction of its use;
• the Data Controller no longer needs the personal data for the purposes of the stated processing, but you require them for the establishment, exercise, or defense of legal claims; or
• you have objected to the processing, but the Data Controller's legitimate interest may also justify the processing; in this case, until it is determined whether the Data Controller's legitimate reasons take precedence over your legitimate reasons, the processing must be restricted.

If processing is subject to restriction, such personal data may only be processed, with the exception of storage, with the consent of the data subject, or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State.

The Data Controller will inform you in advance (at least 3 working days before lifting the restriction) about the lifting of the restriction of processing.

Right to erasure – right to be forgotten

You have the right to have the Data Controller erase personal data concerning you without undue delay if one of the following grounds applies:

• the personal data is no longer necessary for the purposes for which the Data Controller collected or otherwise processed it;
• you withdraw your consent and there is no other legal ground for the processing;
• you object to processing based on legitimate interests, and there are no overriding legitimate grounds (i.e., legitimate interest) for the processing;
• the personal data has been processed unlawfully by the Data Controller, and this has been established based on a complaint;
• the personal data must be erased for compliance with a legal obligation in Union or Member State law to which the Data Controller is subject.

If the Data Controller has made the personal data concerning you public for any lawful reason and is obliged to erase it for any of the reasons mentioned above, taking into account available technology and the cost of implementation, it shall take reasonable steps – including technical measures – to inform other data controllers processing the data that you have requested the erasure of links to, or copies or replications of, the personal data in question.

Erasure does not apply to the extent that processing is necessary:

• for exercising the right of freedom of expression and information;
• for compliance with an obligation under Union or Member State law to which the data controller is subject and which requires processing of personal data (such as processing within the framework of invoicing, as the retention of invoices is prescribed by law), or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller;
• for the establishment, exercise, or defense of legal claims (e.g., if the Data Controller has a claim against you that has not yet been fulfilled, or if a consumer or data protection complaint is being processed).

Right to object

You have the right to object at any time, for reasons related to your particular situation, to the processing of your personal data based on legitimate interests. In this case, the Data Controller may no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.

If personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such purposes, which includes profiling to the extent that it is related to such direct marketing. If you object to the processing of personal data for direct marketing purposes, the personal data shall no longer be processed for such purposes.

Right to data portability

If the processing is carried out by automated means, or if the processing is based on your voluntary consent, you have the right to request the Data Controller to receive the data you provided to the Data Controller, which the Data Controller will make available to you in XML, JSON, or CSV format; if technically feasible, you may request that the Data Controller transmit the data in this format to another data controller.

Automated decision-making

You have the right not to be subject to a decision based solely on automated processing (including profiling) which produces legal effects concerning you or similarly significantly affects you. In these cases, the Data Controller is obliged to take appropriate measures to protect your rights, freedoms, and legitimate interests, including at least your right to obtain human intervention on the part of the data controller, to express your point of view, and to contest the decision.

The above shall not apply if the decision:

• is necessary for entering into, or performance of, a contract between you and the data controller;
• is authorized by Union or Member State law to which the data controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
• is based on your explicit consent.

Registration in the data protection register

Under the provisions of the Infotv. (Privacy Act), the Data Controller was required to register certain data processing activities in the data protection register. This notification obligation ceased to exist on May 25, 2018.

Data security measures

The Data Controller declares that it has taken appropriate security measures to protect personal data against unauthorized access, alteration, transmission, disclosure, erasure, or destruction, as well as accidental destruction and damage, and against becoming inaccessible due to changes in the technology used.

The Data Controller does its utmost, within its organizational and technical capabilities, to ensure that its data processors also take appropriate data security measures when working with your personal data.

Remedies

If you believe that the Data Controller has violated any legal provision concerning data processing, or has failed to fulfill any of your requests, you may initiate an investigation procedure by the National Authority for Data Protection and Freedom of Information to terminate the alleged unlawful data processing (postal address: 1530 Budapest, Pf.: 5., e-mail: ugyfelszolgalat@naih.hu).

Furthermore, we inform you that in the event of a violation of the legal provisions concerning data processing, or if the Data Controller has not fulfilled any of your requests, you may initiate a civil lawsuit against the Data Controller before a court.

Modification of the Data Management Information Notice

The Data Controller reserves the right to modify this data management information notice in a way that does not affect the purpose and legal basis of the data processing. By using the website after the entry into force of the modification, you accept the modified data management information notice.

If the Data Controller intends to perform further data processing in relation to the collected data for a purpose other than the purpose of their collection, it will inform you about the purpose of the data processing and the following information prior to the further data processing:

• about the duration of storage of the personal data, or if this is not possible, the criteria for determining this duration;
• about your right to request from the Data Controller access to, rectification, erasure, or restriction of processing of personal data concerning you, and to object to the processing of personal data in the case of processing based on legitimate interests, as well as the right to request the right to data portability in the case of processing based on consent or a contractual relationship;
• in the case of processing based on consent, about the fact that you can withdraw your consent at any time,
• about the right to lodge a complaint with a supervisory authority;
• whether the provision of personal data is based on a statutory or contractual obligation or is a prerequisite for concluding a contract, as well as whether you are obliged to provide the personal data, and the possible consequences of failure to provide the data;
• the fact of automated decision-making (if such procedure is applied), including profiling, as well as at least in these cases, understandable information about the logic applied and the significance of such processing, and the expected consequences for you.

Data processing can only begin after this; if the legal basis for the data processing is consent, in addition to the information, you must also consent to the data processing.

This document contains all relevant data processing information regarding the operation of the webshop based on the European Union's General Data Protection Regulation No. 2016/679 (hereinafter: Regulation, GDPR) and Act CXII of 2011 (hereinafter: Infotv.).

Delivery to post office or parcel point

Please note that Magyar Posta Zrt. identifies the recipient according to its current data management information notice; therefore, in certain cases, it may request your personal data upon delivery when collecting at a post office or postal point.