PRIVACY AND DATA SECURITY POLICY

1. DATA CONTROLLER'S DATA

Data of the Data Controller:

Data of the Data Controller:
Company name: Irbex kft.
Address :1053 Budapest, Veres Pálné u.14.

The Data Controller shall in all cases process the personal data provided to it in compliance with the applicable Hungarian and European legislation and ethical requirements, and shall in all cases take the technical and organisational measures necessary for the proper and secure processing of the data.

2. INTERPRETATIVE PROVISIONS

In our policy, data protection terms have the following meanings:

Personal data: any data that can be associated with a specific natural person (identified or identifiable) (hereinafter referred to as 'data subject'), and any inference that can be drawn from the data concerning that data subject. Personal data shall retain this quality during processing for as long as the link with the data subject can be re-established. In particular, a person shall be regarded as identifiable where he or she can be identified, directly or indirectly, by reference to a name, an identification mark or to one or more factors specific to his or her physical, physiological, mental, economic, cultural or social identity.

Consent: a voluntary and explicit expression of the data subject's wishes, based on appropriate information, by which he or she gives his or her unambiguous consent to the processing of personal data concerning him or her, either in full or in relation to specific operations.

Objection: a statement by the data subject objecting to the processing of his or her personal data and requesting the cessation of the processing or the deletion of the processed data.

Data Controller: the natural or legal person or unincorporated body which, alone or jointly with others, determines the purposes for which the data are to be processed, takes and implements the decisions concerning the processing (including the means used) or implements them with the Processor.

Data processing: any operation or set of operations which is performed upon data, regardless of the procedure used, in particular collection, recording, recording, organisation, storage, alteration, use, consultation, disclosure, transmission, alignment or combination, blocking, erasure and destruction, as well as prevention of further use of the data, taking of photographs, sound or image recordings and recording of physical characteristics which can be used to identify a person.

Transfer: making data available to a specified third party.

Disclosure: making the data available to anyone.

Data erasure: making data unrecognisable in such a way that it is no longer possible to recover it.

Data marking: the marking of data with an identification mark to distinguish it.

Data blocking: the marking of data with an identifier in order to limit its further processing permanently or for a limited period of time.

Data destruction: the complete physical destruction of the medium containing the data.

Data processing: the performance of technical tasks related to data processing operations, irrespective of the method and means used to perform the operations and the place of application, provided that the technical task is performed on the data.

Data processor: a natural or legal person or unincorporated body which processes data on the basis of a contract, including a contract concluded pursuant to a legal provision.

Data set: the set of data managed in a single register.

Third party: a natural or legal person or unincorporated body other than the data subject, the controller or the processor.

3. DATA PROCESSING SUB-PRINCIPLES

Personal data may only be processed if the data subject consents or if it is required by law or - on the basis of a law and within the scope specified therein - by a decree of a local government.

Personal data may be processed only for specified purposes, for the exercise of rights and the performance of obligations. The processing must comply with this purpose at all stages.

Only personal data which is necessary for the purpose of the processing, is adequate for the purpose, and is processed only to the extent and for the duration necessary for the purpose.

Personal data may be transferred and the different processing operations may be combined if the data subject has given his or her consent or if the law permits it and if the conditions for processing are met for each individual personal data item.

Personal data may be transferred from the country to a controller or processor in a third country, irrespective of the data medium or the means of data transfer, if the data subject has given his or her explicit consent or if the law allows it and the third country ensures an adequate level of protection for the processing of the personal data transferred.

In the case of mandatory data processing, the purposes and conditions of the processing, the scope and availability of the data to be processed, the duration of the processing and the identity of the controller are determined by the law or government regulation imposing the processing.

The law may order the disclosure of personal data in the public interest, by expressly indicating the scope of the data. In all other cases, disclosure requires the consent of the data subject, or in the case of sensitive data, written consent. In case of doubt, it shall be presumed that the data subject has not given his or her consent.

The consent of the data subject shall be deemed to be given in respect of the data communicated by him or her in the course of his or her public activities or transmitted by him or her for the purpose of disclosure.

In a procedure initiated at the request of the data subject, his or her consent to the processing of the data should be presumed. This fact shall be brought to the attention of the data subject.

The data subject may also give his or her consent in the context of a written contract with the Data Controller for the performance of the contract. In this case, the contract must contain all the information that the data subject needs to know in relation to the processing of personal data, in particular the identification of the data to be processed, the duration of the processing, the purposes of the processing, the transfer of the data, the use of a processor. The contract must unambiguously state that the data subject, by signing it, consents to the processing of his or her data as provided for in the contract.

The right to the protection of personal data and the privacy rights of the data subject must not, unless an exception is provided for by law, be prejudiced by other interests in the processing, including the disclosure of data of public interest.

4. THE BASIS FOR DATA PROCESSING

The processing of personal data by the Data Controller in the course of its activities is always based on law or voluntary consent. Personal data may be processed only for specific purposes, for the exercise of rights and the performance of obligations.
Only personal data that is necessary for the purpose of the processing, is adequate for the purpose, and only to the extent and for the duration necessary for the purpose.
In some cases, in the absence of consent, the processing is based on another legal basis or on Article 6 of the Regulation.

a) Purpose: issuing an invoice
Data : name, address

b) Issue of a management form
Data: name, address, eye.ig number

e) Purpose : newsletter subscription
Data :e-mail address.

The Data Controller does not record the user's IP address or any other personal data when visiting the websites operated by the Data Controller.

The html code of the websites operated by the Data Controller may contain independent links from and to external servers for web analytics purposes. The measurement also includes tracking of conversions.

The user can delete the use of cookies from his/her own computer or prohibit their use in his/her browser. These options depend on the browser, but are typically available in the Settings / Privacy menu.

5. SECURITY OF DATA PROCESSING

Our service provider:
NETJEL Bt. 9023 Győr, Ifjúság körút 87. fszt. 2.
The data you provide is stored on a server operated by the hosting provider.
Only our staff or the staff operating the server have access to the data, but they are all responsible for the security of the data.

Activity description: hosting services, server services.

The purpose of the processing: to ensure the functioning of the website. Data processed: personal data provided by the data subject. Duration of processing and time limit for deletion of data.
Data processing until the end of the website's operation or in accordance with the contractual agreement between the website operator and the hosting provider.
If necessary, the person concerned may also request the deletion of his or her data by contacting the hosting provider. The legal basis for processing is the consent of the data subject or processing based on law.

Duration of processing:
The data will be processed until consent is withdrawn. You can withdraw your consent to the processing at any time by sending an e-mail to the contact e-mail address.

To delete your data:
This will be done when consent to processing is withdrawn. You can withdraw your consent to data processing at any time by sending an e-mail to the contact e-mail address. You may request the modification or deletion of your personal data by e-mail, telephone or letter using the contact details provided above.
The data may be accessed by the manager and employees of the controller.

How the data is stored: Electronic.

Data transmission: The data controller does not transfer data.

The user can give his consent to the processing of his data by deliberately ticking the empty checkbox on the website, which is specifically designed for this purpose.

In particular, the Data Controller shall protect the data against unauthorised access, alteration, disclosure, disclosure, deletion or destruction and against accidental destruction or accidental damage. The Data Controller, together with the server operators, shall ensure the security of the data by technical, organisational and organisational measures that provide a level of protection appropriate to the risks associated with the processing.

6. RIGHTS OF DATA SUBJECTS

Right to request information
You may request information from us, via the contact details provided, about what data our company processes, on what legal basis, for what purpose, from what source and for how long. Upon your request, we will send you information without delay, but within 30 days at the latest, to the e-mail address you have provided.

The right to rectification
You can ask us to change any of your details using the contact details provided. Upon your request, we will promptly, but within 30 days at the latest, inform you of this by e-mail to the e-mail address you have provided.

The right to erasure
You can ask us to delete your data using the contact details provided. Upon your request, we will do so without delay, but within 30 days at the latest, by sending you an e-mail to the e-mail address you have provided. The Controller will erase personal data if its processing is unlawful, if the data subject requests it, if it is incomplete or inaccurate - and this situation cannot be lawfully rectified - provided that erasure is not excluded by law, if the purpose of the processing has ceased, if the statutory period for storing the data has expired or if it has been ordered by a court or the Data Protection Commissioner

The right to blocking
You can ask us to block your data using the contact details provided. The blocking will last as long as the reason you have given us makes it necessary to store the data. Upon your request, we will do so without delay, but within a maximum of 30 days, by sending you an e-mail to the e-mail address you have provided.

The right to protest
You may object to the processing of your data by using the contact details provided. We will examine the objection within the shortest possible time from the date of the request, but no later than 15 days, decide whether it is justified and inform you of our decision by e-mail.

The data subject may object to the processing of his or her personal data if the processing (transfer) of the personal data is necessary solely for the purposes of the exercise of a right or legitimate interest pursued by the controller or the recipient of the data, unless the processing is required by law, the use or transfer of the personal data is for direct marketing, public opinion polling or scientific research purposes, or the exercise of the right to object is otherwise permitted by law.

The Data Controller shall examine the objection within the shortest possible time from the date of the request, but not later than 15 days, and inform the applicant in writing of the outcome of the examination, with the simultaneous suspension of the processing. Where the objection is justified, the controller shall be obliged to terminate the processing, including further recording and transmission, and to block the data, and to notify the objection and the measures taken on the basis of the objection to all those to whom the personal data concerned by the objection have been previously disclosed and who are obliged to take action to enforce the right to object.

Enforcement possibilities in relation to data processing
If you experience unlawful processing, please notify us so that we can restore the lawful status within a short period of time. We will do our utmost to resolve the problem in your interest.
If, in your opinion, the lawful situation cannot be restored, please notify the authority at the following contact details: National Authority for Data Protection and Freedom of Information; 1530 Budapest, Pf.: 5; 1125 Budapest, Szilágyi Erzsébet fasor 22/c; Phone: +36 (1) 391-1400