PRIVACY NOTICE

L.Z. Form Kft. – hereinafter referred to as the ‘Company’ – hereby fulfils, through the publication of this privacy notice, its obligation to provide prior information regarding the processing of data subjects’ personal data, as required by REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (EU) 2016/679 concerning the processing of personal data of data subjects, pursuant to which all information required under the relevant articles of the Regulation must be made available to data subjects in a concise, transparent, intelligible and easily accessible form, using clear and plain language.

I. IDENTIFICATION OF THE DATA CONTROLLER

The Company hereby informs the data subject that it acts as the data controller in relation to the processing of their personal data.

COMPANY NAME: L.Z. Form Kft.

REGISTERED OFFICE: 8400 Ajka, Industrial Park, plot no. 5704/4.

COMPANY REGISTRATION NUMBER: 19-09-506-768

TAX REGISTRATION NUMBER: 12962886-2-19

TELEPHONE: 06 88 216-142 (11)

NAME OF REPRESENTATIVE: Zoltán Laki

E-MAIL: lzform@ajkanet.hu

WEBSITE: www.lzform.hu

Personal data is processed by the Company’s employees who hold access rights relating to the relevant data processing purpose, to the extent necessary for the performance of their duties.

II. IDENTIFICATION OF THE DATA PROCESSOR(S)

(1) The Company does not engage any external data processor to process personal data held by it on the basis of voluntary consent for the purposes of operating and maintaining its website.

III. DEFINITIONS

1. ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

2. ‘data processing’ means any operation or set of operations which is carried out on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

3. ‘restriction of processing’: the marking of stored personal data with a view to limiting their future processing;

4. ‘profiling’: any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;

5. ‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific natural person without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data is not linked to an identified or identifiable natural person;

6. ‘filing system’ means any set of personal data organised in any way – whether centralised, decentralised or organised by functional or geographical criteria – which is accessible according to specific criteria;

7. ‘data controller’ means the natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of the processing are determined by Union or Member State law, Union or Member State law may also determine the controller or specific criteria for the designation of the controller;

8. ‘data processor’ means a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the data controller;

9. ‘recipient’ means a natural or legal person, public authority, agency or any other body to whom or to which personal data are disclosed, whether or not that recipient is a third party. Public authorities which, in the context of a specific investigation, have access to personal data in accordance with Union or Member State law shall not be regarded as recipients; the processing of such data by those public authorities must comply with the applicable data protection rules in accordance with the purposes of the processing;

10. ‘third party’: a natural or legal person, public authority, agency or any other body which is not the data subject, the data controller, the data processor or those persons authorised to process personal data under the direct authority of the data controller or data processor;

11. ‘consent of the data subject’ means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

12. ‘data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;

13. ‘undertaking’: a natural or legal person carrying out economic activities, irrespective of its legal form, including partnerships and associations carrying out regular economic activities.

IV. LEGAL BASIS FOR DATA PROCESSING

1. Consent of the data subject

(1) The lawfulness of the processing of personal data must be based on the data subject’s consent or on some other lawful basis established by law.

(2) Where data processing is based on the data subject’s consent, the data subject may give their consent to the processing of their personal data in the following forms:

a) in writing, by means of a declaration of consent to the processing of personal data,

b) electronically, through explicit conduct on the Organisation’s website, by ticking a box, or by making the relevant technical settings whilst using information society services, as well as any other statement or act which, in the given context, clearly indicates the data subject’s consent to the intended processing of their personal data.

(3) Silence, a pre-ticked box or inaction shall therefore not constitute consent.

(4) Consent shall cover all data processing activities carried out for the same purpose or purposes.

(5) Where data processing serves multiple purposes simultaneously, consent must be given in respect of all such purposes. Where the data subject gives consent following an electronic request, the request must be clear and concise and must not unduly hinder the use of the service for which consent is sought.

(6) The data subject has the right to withdraw their consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent prior to its withdrawal. The data subject must be informed of this before giving their consent. Withdrawing consent must be made just as easy as giving it.

2. Performance of a contract

(1) Processing is lawful where it is necessary for the performance of a contract to which the data subject is a party, or for taking steps at the request of the data subject prior to entering into a contract.

(2) The data subject’s consent to the processing of personal data not necessary for the performance of the contract may not be a condition for entering into the contract.

3. Compliance with a legal obligation to which the data controller is subject, or the protection of the vital interests of the data subject or another natural person

(1) Where the legal basis for data processing is compliance with a legal obligation, this is determined by law; consequently, the data subject’s consent to the processing of their personal data is not required.

(2) The data controller is obliged to inform the data subject of the purpose of the data processing, its legal basis, its duration, the identity of the data controller, as well as the data subject’s rights and the available remedies.

(3) In order to comply with a legal obligation, the data controller is entitled, following the withdrawal of the data subject’s consent, to process the set of data necessary for the fulfilment of a legal obligation to which it is subject.

4. The performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller, or for the purposes of the legitimate interests pursued by the data controller or a third party.

(1) The legitimate interests of the data controller – including any data controller to whom personal data may be disclosed – or of a third party may constitute a legal basis for data processing, provided that the interests, fundamental rights and freedoms of the data subject do not take precedence, taking into account the data subject’s reasonable expectations based on their relationship with the data controller. Such a legitimate interest may exist, for example, where there is a relevant and appropriate relationship between the data subject and the data controller, such as in cases where the data subject is a customer of the data controller or is employed by the data controller.

(2) In order to establish the existence of a legitimate interest, it is essential to carefully assess, amongst other things, whether the data subject could reasonably expect, at the time of and in connection with the collection of the personal data, that the data would be processed for that specific purpose.

(3) The data subject’s interests and fundamental rights may take precedence over the data controller’s interests where personal data are processed in circumstances in which data subjects do not expect further processing to take place.

V. THE DATA SUBJECT’S RIGHTS IN RELATION TO THE PROCESSING OF THEIR PERSONAL DATA

1. The Company provides the following brief information regarding the data subject’s rights:

The data subject has the right:

(a) to be informed prior to the commencement of data processing,

b) to receive confirmation from the data controller as to whether their personal data are being processed, and if such processing is taking place, they are entitled to access their personal data and the following information,

c) to request the rectification or erasure of their data, and to receive notification from the data controller that this has been carried out,

(d) to request the restriction of data processing and to receive notification from the data controller that this has taken place,

(e) to data portability,

(f) to object where their personal data are processed for reasons of public interest or on the grounds of the data controller’s legitimate interests.

g) to be exempt from automated decision-making, including profiling,

h) to lodge a complaint with the supervisory authority. The data subject may exercise their right to lodge a complaint via the following contact details: National Authority for Data Protection and Freedom of Information, address: 1125 Budapest, 22/c Szilágyi Erzsébet fasor, Telephone: +36 (1) 391-1400; Fax: +36 (1) 391-1410; www: http://www.naih.hu; email: ugyfelszolgalat@naih.hu

(i) an effective judicial remedy against the supervisory authority,

(j) an effective judicial remedy against the data controller or data processor,

(k) notification of a data breach.

2. Detailed information on the rights of data subjects

Right to information

(1) The data subject is entitled to receive information regarding the processing of their data prior to the commencement of any processing activities.

(2) Information to be provided where personal data are collected from the data subject:

a. the identity and contact details of the data controller and, where applicable, the data controller’s representative;

b. the contact details of the data protection officer, where applicable;

c. the purposes of the intended processing of personal data and the legal basis for the processing;

d. in the case of processing based on Article 6(1)(f) of the Regulation, the legitimate interests of the controller or of a third party;

e. where applicable, the recipients or categories of recipients of the personal data, if any;

f.

g. where applicable, the fact that the controller intends to transfer personal data to a third country or to an international organisation, as well as the existence or absence of an adequacy decision by the Commission, or, in the case of a transfer referred to in Article 46 , Article 47 or the second subparagraph of Article 49(1) of the Regulation, an indication of the appropriate and suitable safeguards, as well as the means of obtaining copies thereof or a reference to their availability.

(3) In addition to the information referred to in paragraph (1), the data controller shall, at the time of obtaining personal data, provide the data subject with the following supplementary information in order to ensure fair and transparent data processing:

a. the period for which the personal data will be stored, or, if this is not possible, the criteria used to determine that period;

b. the data subject’s right to request from the data controller access to, rectification, erasure or restriction of processing of personal data concerning them, and to object to the processing of such personal data, as well as the data subject’s right to data portability;

c. in the case of processing based on Article 6(1)(a) or Article 9(2)(a) of the Regulation, the right to withdraw consent at any time, without this affecting the lawfulness of processing carried out on the basis of consent prior to withdrawal;

d. the right to lodge a complaint with a supervisory authority;

e. whether the provision of personal data is required by law or under a contractual obligation, or is a condition for entering into a contract, and whether the data subject is obliged to provide the personal data, as well as the possible consequences of a failure to provide such data;

f. the fact of automated decision-making, including profiling, as referred to in Article 22(1) and (4) of the Regulation, and, at least in such cases, the logic applied and comprehensible information regarding the significance of such processing and the likely consequences for the data subject.

(4) Where the personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information:

a. the identity and contact details of the controller and, where applicable, the controller’s representative;

b. the contact details of the data protection officer, where applicable;

c. the purposes of the intended processing of the personal data and the legal basis for the processing;

d. the categories of personal data relating to the data subject;

e. the recipients or categories of recipients of the personal data, if any;

f. where applicable, the fact that the data controller intends to transfer the personal data to a recipient in a third country or to an international organisation, as well as the existence or absence of a Commission adequacy decision, or, in the case of data transfers referred to in Article 46, Article 47 or the second subparagraph of Article 49(1) of the Regulation, an indication of the appropriate and suitable safeguards, as well as a reference to the means of obtaining copies of these documents or to their availability.

(2) In addition to the information referred to in paragraph (1), the data controller shall provide the data subject with the following supplementary information necessary to ensure fair and transparent data processing in respect of the data subject:

a. the period for which the personal data will be stored, or, where this is not possible, the criteria used to determine that period;

b. where the processing is based on point (f) of Article 6(1) of the Regulation, the legitimate interests of the data controller or a third party;

c. the data subject’s right to request from the controller access to and rectification or erasure of personal data concerning them, or restriction of processing, and to object to the processing of personal data, as well as the data subject’s right to data portability;

d. in the case of processing based on Article 6(1)(a) or Article 9(2)(a) of the Regulation, the right to withdraw consent at any time, without this affecting the lawfulness of the processing carried out on the basis of consent prior to withdrawal;

e. the right to lodge a complaint with a supervisory authority;

f. the source of the personal data and, where applicable, whether the data originate from publicly available sources; and

g. the fact of automated decision-making, including profiling, as referred to in Article 22(1) and (4) of the Regulation, and, at least in those cases, the logic applied and comprehensible information as to the significance of such processing and the expected consequences for the data subject.

(3) Where the controller intends to carry out further processing of personal data for a purpose other than that for which the data were originally collected, the controller shall, prior to such further processing, inform the data subject of that different purpose and of all relevant additional information referred to in paragraph (2).

(4) Paragraphs (1) to (3) shall not apply if and to the extent that:

a. the data subject is already in possession of the information;

b. the provision of the information in question proves impossible or would involve a disproportionate effort, in particular for archiving in the public interest, for scientific or historical research purposes or for statistical purposes, in the case of data processing carried out in accordance with the conditions and safeguards set out in Article 89(1), or where the obligation referred to in paragraph 1 of this Article would be likely to render impossible or seriously jeopardise the achievement of the purposes of such processing. In such cases, the controller shall take appropriate measures – including making the information publicly available – to protect the data subject’s rights, freedoms and legitimate interests;

c. the collection or disclosure of the data is expressly required by Union or Member State law applicable to the data controller, which provides for appropriate measures to safeguard the data subject’s legitimate interests; or

d. the personal data must remain confidential pursuant to a professional duty of confidentiality laid down in Union or Member State law, including a statutory duty of confidentiality.

The data subject’s right of access

(1) The data subject shall have the right to obtain from the data controller confirmation as to whether or not personal data concerning him or her are being processed; where such processing is taking place, the data subject shall have the right to access the personal data and the following information:

a. the purposes of the processing;

b. the categories of personal data relating to the data subject;

c. the recipients or categories of recipients to whom the personal data have been or will be disclosed, including, in particular, recipients in third countries or international organisations;

d. where applicable, the envisaged period for which the personal data will be stored, or, if this is not possible, the criteria used to determine that period;

e. the data subject’s right to request from the controller the rectification, erasure or restriction of processing of personal data concerning him or her, and to object to the processing of such personal data;

f. the right to lodge a complaint with a supervisory authority;

g. where the data have not been collected from the data subject, any available information as to their source;

h. the fact of automated decision-making, including profiling, as referred to in Article 22(1) and (4) of the Regulation, and, at least in such cases, the logic involved and comprehensible information as to the significance of such processing and the likely consequences for the data subject.

(2) Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards relating to the transfer in accordance with Article 46.

(3) The data controller shall provide the data subject with a copy of the personal data being processed. For any further copies requested by the data subject, the data controller may charge a reasonable fee based on administrative costs. Where the data subject has submitted the request by electronic means, the information shall be provided in a commonly used electronic format, unless the data subject requests otherwise.

The data subject’s right to rectification and erasure

The right to rectification

(1) The data subject shall have the right to obtain from the data controller, upon request and without undue delay, the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to request that incomplete personal data be completed, including by means of providing a supplementary statement.

The right to erasure (‘the right to be forgotten’)

(1) The data subject has the right to have personal data concerning him or her erased by the data controller without undue delay upon request, and the data controller is obliged to erase personal data concerning the data subject without undue delay if any of the following grounds apply:

a. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

b. the data subject withdraws their consent on which the processing is based, pursuant to Article 6(1)(a) of the Regulation (consent to the processing of personal data) or Article 9(2)(a) of the Regulation (giving explicit consent), and there is no other legal basis for the processing;

c. the data subject objects to the processing of their personal data pursuant to Article 21(1) of the Regulation (right to object) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) of the Regulation (objection to the processing of personal data for direct marketing purposes);

d. the personal data have been unlawfully processed;

e. the personal data must be erased in order to comply with a legal obligation under Union or Member State law to which the controller is subject;

f. the personal data were collected in connection with the offering of information society services referred to in Article 8(1).

(2) Where the data controller has made the personal data public and is obliged to erase it at the data subject’s request, the data controller shall, taking into account the available technology and the costs of implementation, take all steps reasonably expected – including technical measures – to inform controllers processing the data that the data subject has requested the deletion of links to, or copies or replicas of, the personal data in question.

(3) Paragraphs (1) and (2) shall not apply where the processing is necessary:

a. for the purposes of exercising the right to freedom of expression and information;

b. for compliance with a legal obligation under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

c. on grounds of public interest in the area of public health, in accordance with Article 9(2)(h) and (i) and Article 9(3) of the Regulation;

d. in accordance with Article 89(1) of the Regulation, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, in so far as the right referred to in paragraph (1) is likely to render impossible or seriously impair such processing; or

e. for the establishment, exercise or defence of legal claims.

The right to restriction of processing

(1) The data subject shall have the right to obtain from the controller restriction of processing upon request where any of the following applies:

a. the data subject disputes the accuracy of the personal data; in this case, the restriction shall apply for a period enabling the data controller to verify the accuracy of the personal data;

b. the processing is unlawful, and the data subject opposes the erasure of the data and requests, instead, that its use be restricted;

c. the data controller no longer needs the personal data for the purposes of processing, but the data subject requires it for the establishment, exercise or defence of legal claims; or

d. the data subject has objected to the processing in accordance with Article 21(1) of the Regulation; in this case, the restriction shall apply for as long as it has not been established whether the data controller’s legitimate grounds override those of the data subject.

(2) Where processing is restricted pursuant to paragraph (1), such personal data may, apart from storage, be processed only with the data subject’s consent, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of substantial public interest of the Union or of a Member State.

(3) The data controller shall inform the data subject, at whose request the processing has been restricted pursuant to paragraph (1), in advance of the lifting of the restriction on processing.

Obligation to notify in relation to the rectification or erasure of personal data, or the restriction of processing

(1) The data controller shall inform any recipient to whom, or to whom the personal data has been disclosed, unless this proves impossible or involves a disproportionate effort.

(2) At the data subject’s request, the data controller shall provide information about these recipients.

The right to data portability

(1) The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a data controller, in a structured, commonly used and machine-readable format; he or she shall also have the right to transmit those data to another data controller without hindrance from the data controller to whom the personal data have been provided, if:

a. the processing is based on Article 6(1)(a) of the Regulation (the data subject’s consent to the processing of personal data) or Article 9(2)(a) of the Regulation (the data subject’s explicit consent to the processing), or on a contract as referred to in Article 6(1)(b); and

b. the processing is carried out by automated means.

(2) In exercising the right to data portability referred to in paragraph (1), the data subject shall have the right to request, where technically feasible, the direct transmission of personal data from one controller to another.

(3) The exercise of the right referred to in paragraph (1) of this Article shall not prejudice Article 17 of the Regulation. That right shall not apply where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

(4) The right referred to in paragraph (1) shall not adversely affect the rights and freedoms of others.

The right to object

1) The data subject shall have the right to object, on grounds relating to their particular situation, at any time to the processing of their personal data carried out in the public interest or in the exercise of official authority, or to the processing necessary for the purposes of the legitimate interests pursued by the data controller or by a third party (processing based on Article 6(1)(e) or (f) of the Regulation), including profiling based on those provisions. In such a case, the data controller may no longer process the personal data, unless the data controller demonstrates that there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or which relate to the establishment, exercise or defence of legal claims.

(2) Where personal data are processed for the purposes of direct marketing, the data subject shall have the right to object at any time to the processing of personal data concerning him or her for such purposes, including profiling, in so far as it is related to direct marketing.

(3) Where the data subject objects to the processing of personal data for the purposes of direct marketing, such personal data shall no longer be processed for that purpose.

(4) The data subject must be expressly informed of the right referred to in paragraphs (1) and (2) at the latest at the time of the first contact with them, and the relevant information must be presented clearly and separately from any other information.

(5) In connection with the use of information society services and by way of derogation from Directive 2002/58/EC, the data subject may exercise the right to object by means of automated tools based on technical specifications.

(6) Where personal data are processed for scientific or historical research purposes or for statistical purposes in accordance with Article 89(1) of the Regulation, the data subject shall have the right to object, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

The right not to be subject to automated decision-making

(1) The data subject shall have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning him or her or similarly significantly affects him or her.

(2) Paragraph (1) shall not apply where the decision:

a. is necessary for the conclusion or performance of a contract between the data subject and the controller;

b. is authorised by Union or Member State law to which the controller is subject, which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or

c. is based on the data subject’s explicit consent.

(3) In the cases referred to in points (a) and (c) of paragraph (2), the data controller shall take appropriate measures to protect the data subject’s rights, freedoms and legitimate interests, including at least the right of the data subject to request human intervention by the data controller, to express their point of view, and to object to the decision.

(4) The decisions referred to in paragraph (2) shall not be based on the special categories of personal data referred to in Article 9 (1) of the Regulation, unless point (a) or (g) of Article 9(2) applies and appropriate measures have been taken to safeguard the data subject’s rights, freedoms and legitimate interests.

The data subject’s right to lodge a complaint and seek redress

The right to lodge a complaint with the supervisory authority.

(1) The data subject has the right, pursuant to Article 77 of the Regulation, to lodge a complaint with the supervisory authority if, in the data subject’s view, the processing of personal data relating to them infringes this Regulation.

(2) The data subject may exercise their right to lodge a complaint using the following contact details:

National Authority for Data Protection and Freedom of Information Address: 1125 Budapest, 22/c Szilágyi Erzsébet fasor Telephone: +36 (1) 391-1400; Fax: +36 (1) 391-1410 www: http://www.naih.hu e-mail: ugyfelszolgalat@naih.hu

(3) The supervisory authority to which the complaint has been lodged shall inform the data subject of developments in the proceedings relating to the complaint and of the outcome thereof, including the fact that, pursuant to Article 78 of the Regulation, the data subject is entitled to a judicial remedy.

The right to an effective judicial remedy against the supervisory authority

(1) Without prejudice to other administrative or non-judicial remedies, every natural and legal person shall have the right to an effective judicial remedy against a legally binding decision of the supervisory authority concerning them.

(2) Without prejudice to other administrative or non-judicial remedies, every data subject shall have the right to an effective judicial remedy if the competent supervisory authority fails to deal with the complaint or fails to inform the data subject, within three months, of the progress or outcome of the proceedings relating to a complaint lodged under Article 77 of the Regulation.

(3) Proceedings against a supervisory authority shall be brought before the courts of the Member State in which the supervisory authority has its seat.

(4) Where proceedings are brought against a decision of the supervisory authority in respect of which the Board has previously issued an opinion or taken a decision under the consistency mechanism, the supervisory authority shall be obliged to forward that opinion or decision to the court.

The right to an effective judicial remedy against the data controller or data processor

(1) Without prejudice to any available administrative or non-judicial remedies – including the right to lodge a complaint with the supervisory authority pursuant to Article 77 – every data subject shall have the right to an effective judicial remedy if they consider that their rights under this Regulation have been infringed as a result of the processing of their personal data in breach of this Regulation.

(2) Proceedings against the controller or the processor shall be brought before the courts of the Member State in which the controller or the processor has established its place of business. Such proceedings may also be brought before the courts of the Member State in which the data subject has their habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers.

Restrictions

(1) Union or Member State law applicable to the data controller or data processor may, by means of legislative measures, restrict the scope of the rights and obligations set out in Articles 12 to 22 and Article 34, and of the provisions set out in Articles 12 to 22, in respect of the rights and obligations referred to in Article 5 provisions, provided that the restriction respects the essence of fundamental rights and freedoms and constitutes a measure that is necessary and proportionate in a democratic society for the protection of:

a. national security;

b. defence;

c. public security;

d. the prevention, investigation, detection or prosecution of criminal offences, or the execution of criminal penalties, including the protection against and prevention of threats to public security;

e. other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation matters, public health and social security;

f. the protection of judicial independence and judicial proceedings;

g. in the case of regulated professions, the prevention, investigation and detection of breaches of professional ethics, and the conduct of proceedings in relation thereto;

h. in the cases referred to in points (a) to (e) and (g) – even on an ad hoc basis – supervisory, investigative or regulatory activities connected with the exercise of public authority;

i. the protection of the data subject or the rights and freedoms of others;

j. the enforcement of civil law claims.

(2) The legislative measures referred to in paragraph (1) shall, where appropriate, contain detailed provisions on at least:

a. the purposes of data processing or the categories of data processing,

b. the categories of personal data,

c. the scope of the restrictions imposed,

d. safeguards to prevent misuse or unauthorised access or disclosure,

e. the identification of the data controller or the categories of data controllers,

f. the duration of data storage and the applicable safeguards, taking into account the nature, scope and purposes of the data processing or the categories of data processing,

g. the risks to the rights and freedoms of data subjects, and

h. the right of data subjects to be informed of the restriction, unless this could undermine the purpose of the restriction.

i. Notification of a data breach

(1) Where a data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall inform the data subject of the data breach without undue delay.

(2) The information provided to the data subject referred to in paragraph (1) must clearly and comprehensibly describe the nature of the data breach and must include at least

the name and contact details of the data protection officer or any other contact person providing further information, the likely consequences of the data breach, the measures taken or planned by the data controller to address the data breach, including, where applicable, measures aimed at mitigating any adverse consequences arising from the data breach.

(3) The data subject need not be informed as referred to in paragraph (1) if any of the following conditions are met:

a. the data controller has implemented appropriate technical and organisational protection measures, and these measures were applied to the data affected by the data breach, in particular measures – such as the use of encryption – which render the data unintelligible to any person not authorised to access the personal data;

b. following the data breach, the controller has taken further measures to ensure that the high risk to the rights and freedoms of data subjects referred to in paragraph (1) is unlikely to materialise in the future;

c. providing the information would require a disproportionate effort. In such cases, data subjects must be informed through publicly available information or by means of a similar measure ensuring that they are informed in an equally effective manner.

(4) If the data controller has not yet notified the data subject of the data breach, the supervisory authority, having assessed whether the data breach is likely to result in a high risk, may order that the data subject be notified, or may determine that one of the conditions referred to in paragraph (3) has been met.

VI. PROCEDURE TO BE FOLLOWED IN THE EVENT OF A REQUEST BY THE DATA SUBJECT

(1) The Organisation shall facilitate the exercise of the data subject’s rights and may not refuse to comply with a request aimed at exercising the data subject’s rights as set out in this privacy notice, unless it can demonstrate that it is unable to identify the data subject.

(2) The Company shall inform the data subject of the measures taken in response to the request without undue delay, but in any event within one month of receipt of the request. Where necessary, taking into account the complexity of the request and the number of requests, this time limit may be extended by a further two months. The data controller shall inform the data subject of any extension of the time limit within one month of receipt of the request, stating the reasons for the delay.

(3) If the data subject submitted the request electronically, the information shall be provided electronically where possible, unless the data subject requests otherwise.

(4) If the Organisation fails to take action in response to the data subject’s request, it shall, without delay but no later than one month from receipt of the request, inform the data subject of the reasons for failing to take action, as well as of the data subject’s right to lodge a complaint with the supervisory authority and to seek judicial redress.

(5) The Company shall provide the data subject with the following information and measures free of charge: feedback on the processing of personal data, access to the data being processed, rectification, supplementation and erasure of data, restriction of processing, data portability, the right to object to processing, and notification of a data breach.

(6) If the data subject’s request is manifestly unfounded or – in particular due to its repetitive nature – excessive, the data controller may, having regard to the administrative costs involved in providing the requested information or taking the requested action, charge a fee of 5,000 HUF, or may refuse to take action in response to the request.

(7) The burden of proving that the request is manifestly unfounded or excessive lies with the data controller.

(8) Without prejudice to Article 11 of the Regulation, if the data controller has reasonable doubts as to the identity of the natural person submitting a request under Articles 15 to 21 of the Regulation, it may request further information necessary to confirm the identity of the data subject.

IX. PROCEDURE TO BE FOLLOWED IN THE EVENT OF A DATA BREACH

(1) A personal data breach, within the meaning of the Regulation, is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to, personal data transmitted, stored or otherwise processed.

(2) The loss or theft of a device containing personal data (such as a laptop or mobile phone) shall be deemed a data breach; the same applies to the loss or becoming inaccessible, infection by ransomware (extortion virus) which renders the data processed by the data controller inaccessible until the ransom is paid, an attack on the IT system, an email containing personal data sent in error, the disclosure of a mailing list, etc.

(3) Upon detection of a data protection incident, a representative of the Company shall immediately conduct an investigation to identify the data protection incident and determine its possible consequences. The necessary measures must be taken to mitigate the damage.

(4) The data breach must be reported to the competent supervisory authority without undue delay and, where possible, no later than 72 hours after it has come to the Company’s attention, to the competent supervisory authority, unless the data breach is unlikely to pose a risk to the rights and freedoms of natural persons. If the notification is not made within 72 hours, the reasons justifying the delay must also be provided.

(5) The data processor shall notify the data controller of the data breach without undue delay after becoming aware of it.

(6) The notification referred to in paragraph (3) shall at least:

a. describe the nature of the data breach, including – where possible – the categories and approximate number of data subjects, as well as the categories and approximate number of data records affected by the breach;

b. provide the name and contact details of the data protection officer or any other contact person who can provide further information;

c. the likely consequences of the data breach must be described;

d. the measures taken or planned by the data controller to address the data breach must be described, including, where applicable, measures to mitigate any adverse consequences arising from the data breach.

(7) If and insofar as it is not possible to provide the information simultaneously, it may be provided in instalments at a later date without further undue delay.

(8) The data controller shall keep a record of data breaches, setting out the facts relating to the data breach, its effects and the measures taken to remedy it. This record shall enable the supervisory authority to verify compliance with the requirements set out in Article 33 of the Regulation.

VI. DATA PROCESSING RELATED TO THE WEBSITE

Information regarding the data of visitors to the Company’s website

The Company does not use cookies on its website.

Registration, newsletter subscription

(1) The legal basis for data processing in the case of registration or newsletter subscription is the data subject’s consent, which the data subject provides by ticking the box next to the text ‘registration’ or ‘newsletter subscription’ on the Company’s website, following the provision of information regarding the processing of their data.

(2) The data subjects in the case of registration or newsletter subscription: any natural person who wishes to subscribe to the Company’s newsletter or to register on the website and who gives their consent to the processing of their personal data.

(3) Scope of data processed in the case of newsletter subscriptions: name, email address.

(4) Scope of data processed in the case of registration: name, address, email address, telephone number, login password.

(5) The purpose of data processing when subscribing to the newsletter: to inform the data subject about the Company’s services and products, any changes thereto, and to provide information on news and events.

(6) The purpose of data processing in the case of registration: to establish contact for the purpose of preparing a contract; to provide the data subject with services available free of charge on the website; and to grant access to non-public content on the website.

(7) Recipients of the data (those who may become aware of the data) in the case of newsletter subscription or registration: the head of the Company, staff responsible for customer relations, and the data processors responsible for operating the Company’s website.

(8) The duration of data processing in the case of newsletter subscriptions and registration: in the case of newsletter subscriptions, until unsubscription; in the case of registration, until deletion at the data subject’s request.

(9) The data subject may unsubscribe from the newsletter at any time or request the deletion of their registration (personal data). Unsubscribing from the newsletter is done by clicking on the unsubscribe link provided in the footer of the emails sent to the data subject, or by sending a letter by post to the Company’s registered office.

Data processing in connection with direct marketing activities

The Company does not engage in direct marketing activities.

Data processing in connection with an online shop

The Company does not operate an online shop.

VII. DATA PROCESSING ACTIVITIES RELATED TO THE PERFORMANCE OF A CONTRACT

(1) The Company processes the personal data of natural persons with whom it has a contractual relationship – clients, customers, suppliers – in connection with that contractual relationship. The data subject must be informed of the processing of their personal data.

(2) The data subjects are: all natural persons who enter into a contractual relationship with the Company.

(3) The legal basis for data processing is the performance of a contract; the purpose of data processing is to maintain contact, to enforce claims arising from the contract, and to ensure compliance with contractual obligations.

(4) The recipients of personal data are: the head of the Company; the Company’s employees performing customer service and accounting duties as part of their job roles; and data processors.

(5) Scope of personal data processed: name, address, registered office, telephone number, email address, tax number, bank account number, business licence number, primary producer licence number.

(6) Duration of data processing: 5 years from the termination of the contract.

VIII. INFORMATION ON DATA PROCESSING RELATED TO THE USE OF AN ELECTRONIC SURVEILLANCE SYSTEM

Our company does not operate an electronic surveillance and recording system (CCTV system).

IX. PROVISIONS RELATING TO DATA SECURITY

(1) The Company may process personal data only in accordance with the activities set out in this policy and in line with the purpose of data processing.

(2) The Company shall ensure the security of the data, and in this regard undertakes to take all technical and organisational measures that are strictly necessary to ensure compliance with legislation on data security and rules on data and confidentiality protection, and to establish the procedural rules necessary for the enforcement of the legislation specified above.

(3) The Company shall protect data by taking appropriate measures against unauthorised access, alteration, disclosure, deletion or destruction, as well as against accidental destruction and damage, and against data becoming inaccessible as a result of changes in the technology used.

(4) The technical and organisational measures to be implemented by the Company to ensure data security are set out in the Company’s data protection policy.

(5) When defining and applying measures to ensure data security, the Company shall take into account the current state of the art; where there are several possible data processing solutions, it shall choose the solution that ensures a higher level of protection for personal data, unless this would entail disproportionate difficulty.

X. RULES RELATING TO DATA PROCESSING

1. General rules relating to data processing

(1) The data controller shall determine the data processor’s rights and obligations relating to the processing of personal data within the framework of the law and specific legislation governing data processing.

(2) The Company declares that, in the course of its activities as a data processor, it has no authority to take substantive decisions regarding data processing; it may process personal data coming to its knowledge solely in accordance with the data controller’s instructions, and may not carry out data processing for its own purposes; and is obliged to store and retain personal data in accordance with the data controller’s instructions.

(3) The Company is responsible for the lawfulness of the instructions given to the data processor regarding data processing operations.

(4) The Company is obliged to provide data subjects with information regarding the identity of the data processor and the location of the data processing.

(5) The Company shall not authorise the data processor to engage any further data processors.

(6) The contract relating to data processing must be in writing. Data processing may not be entrusted to any organisation which has a business interest in using the personal data to be processed.

Dated 10 December 2019.