Data protection policy

1. Purpose and scope of this Privacy Notice, applicable legislation

Gyémánt-Pirazol Limited Liability Company (hereinafter: Service Provider, Data Controller), as data controller, hereby informs you about its practices relating to the processing of personal data in connection with the use of the website gyemantpirazol.hu (hereinafter: Website), the organisational and technical measures taken for the protection of such data, as well as your rights relating to data processing and the means of exercising those rights.

In the course of its data processing activities and this Notice, the Data Controller acts in accordance with the applicable legislation in force, in particular:

• Regulation (EU) 2016/679 of the European Parliament and of the Council (“General Data Protection Regulation” / “GDPR” / “Regulation”)

• Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (“Infotv.”)

• Act V of 2013 on the Civil Code (“Civil Code”)

• Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities (“Grtv.”).

2. Data Controller’s details

Name: Gyémánt-Pirazol Limited Liability Company

Short name: Gyémánt-Pirazol Kft.

Registered office: H-4031 Debrecen, Nívó utca 11.

Company registration number: 09-09-034339

Tax number: 32071814-2-09

Telephone number: +36 32 440 855

E-mail address: gyemantpirazol@gyemantpirazol.hu

2.1 Data Protection Officer

Name: Annamária Lorkóné Sőrés

Telephone number: +36 32 440 855

3. General principles of data processing

The data processing carried out in the course of Gyémánt-Pirazol Kft.’s activities is based on voluntary consent and/or statutory authorisation. In the case of data processing based on voluntary consent, the data subjects may withdraw their consent at any stage of the data processing.

4. Categories of personal data processed

The User/data subject provides his/her name, e-mail address and telephone number required for contact on the Request for Quotation / Contact form. The Data Controller processes these data on the basis of the data subject’s consent until the closure of the business relationship, which the Data Controller reviews every 6 months. The User may withdraw his/her consent to the processing of the above data at any time by sending a declaration to the e-mail address gyemantpirazol@gyemantpirazol.hu.

The data processors may use the data solely for the performance of their specific tasks and shall not transfer data to third parties without the user’s consent.

5. Cookie management

The website gyemantpirazol.hu uses cookies for the operation of the website and for monitoring activities carried out on the website. A cookie is a small data package stored in the browser by online services.

The functions of cookies:

• they collect information about visitors and their devices

• they remember visitors’ individual settings

• they facilitate the use of the website

• they ensure a quality user experience

The types of cookies used by the website are listed in a separate table available on the website.

6. Rights of data subjects and means of legal remedy

During the period of data processing, the data subject may request information on the processing of his/her personal data and may request rectification of his/her personal data or – with the exception of mandatory data – their erasure or withdrawal and may exercise his/her right to data portability and to object as set out in Section 4, via any of the contact details specified in Sections 2 and 4. The Data Controller is obliged to respond to the data subject’s request within 30 days.

6.1 Right to be informed

Gyémánt-Pirazol Kft. shall take appropriate measures to provide all information referred to in Articles 13 and 14 of the GDPR and all notifications referred to in Articles 15–22 and 34 relating to the processing of personal data to data subjects in a concise, transparent, intelligible and easily accessible form, using clear and plain language.

6.2 Right of access

The data subject shall have the right to obtain confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, to access the personal data and be informed of the following:

• the purposes of the processing;

• the categories of personal data concerned;

• the recipients or categories of recipients to whom the personal data have been or will be disclosed;

• where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

• the right to request from the controller rectification or erasure of personal data or restriction of processing and, in the case of processing based on legitimate interest, to object to such processing;

• the right to lodge a complaint with a supervisory authority;

• where the personal data are not collected from the data subject, any available information as to their source;

• the existence of automated decision-making (if such procedure is applied), including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

6.3 Right to rectification

The data subject shall have the right to obtain from Gyémánt-Pirazol Kft. without undue delay the rectification of inaccurate personal data concerning him or her, and may request that incomplete personal data be completed.

6.4 Right to erasure (“right to be forgotten”)

The data subject shall have the right to obtain the erasure of personal data concerning him or her without undue delay where one of the following grounds applies:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

• the data subject withdraws consent on which the processing is based and there is no other legal ground for the processing;

• the data subject objects to the processing based on legitimate interest, and there are no overriding legitimate grounds for the processing;

• the personal data have been unlawfully processed by the Data Controller and this has been established on the basis of a complaint;

• the personal data have to be erased for compliance with a legal obligation under Union or Member State law to which the controller is subject.

Where the Data Controller has made the personal data public and is obliged to erase the personal data pursuant to the above, the Data Controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform other controllers processing the personal data that the data subject has requested the erasure of any links to, or copy or replication of, those personal data.

As a general rule, the Data Controller does not make the data subject’s personal data public.

Erasure shall not apply to the extent that processing is necessary:

• for exercising the right of freedom of expression and information;

• for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject (e.g. data processing related to invoicing, as the retention of invoices is prescribed by law) or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

• for the establishment, exercise or defence of legal claims (e.g. if the Data Controller has a claim against the data subject that has not yet been settled, or a consumer or data protection complaint procedure is in progress).

6.5 Right to restriction of processing

The data subject shall have the right to obtain from the Data Controller restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by the data subject; in this case, the restriction applies for a period enabling the Data Controller to verify the accuracy of the personal data; if no verification is required, no restriction will be applied;

• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;

• the Data Controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; or

• the data subject has objected to processing based on legitimate interest; in this case, processing shall be restricted pending the verification whether the legitimate grounds of the controller override those of the data subject.

Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with the data subject’s consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State. The Data Controller shall inform the data subject in advance (at least 3 working days before the lifting of the restriction) of the lifting of the restriction of processing.

6.6 Right to data portability

Where the processing is based on the performance of a contract or on the data subject’s consent, the data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to the Data Controller, in a commonly used and machine-readable format and shall have the right to transmit those data to another controller. Where technically feasible, the data subject may request that the Data Controller transmit the data directly to another controller.

6.7 Right to object

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data based on legitimate interests. In this case the Data Controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

6.8 Right to withdraw consent

The data subject shall have the right to withdraw his or her consent to data processing at any time, in which case the Data Controller shall erase the data from its systems.

7. Remedies

7.1 If, in the data subject’s opinion, the Data Controller has infringed any provision of law relating to data processing or has not complied with any of his/her requests, the data subject may initiate proceedings by the National Authority for Data Protection and Freedom of Information in order to terminate the presumed unlawful data processing (postal address: 1530 Budapest, Pf.: 5., e-mail: ugyfelszolgalat@naih.hu).

7.2 The data subject may also bring the matter before a court if his or her rights have been infringed in the course of data processing.

8. Data security

In the course of operating its IT systems, the Data Controller ensures, through the necessary access management, internal organisational and technical solutions, that the data subject’s data cannot be accessed by unauthorised persons, and that unauthorised persons cannot delete, export or modify the data from the system. The Data Controller enforces data protection and data security requirements vis-à-vis its data processors as well. The Data Controller keeps a record of any potential data protection incidents and, where necessary, informs the data subject of any incidents that arise.

9. Other provisions

The Data Controller reserves the right to amend this Privacy Notice in a manner that does not affect the purpose and legal basis of the data processing.

The Data Controller informs its clients that the courts, the public prosecutor, the investigating authorities, the misdemeanour authorities, the administrative authorities, the National Authority for Data Protection and Freedom of Information, the Hungarian National Bank or other bodies authorised by law may contact the Data Controller for the purpose of providing information, disclosing or transmitting data or making documents available.

 

Gyémánt-Pirazol Kft. shall disclose personal data to such authorities only to the extent and in the manner that is indispensable for achieving the purpose of the request, provided that the authority has specified the precise purpose and the scope of the data.