PRIVACY NOTICE
Contents
1 What is the purpose of this notice?
2 Details of the data controller
3.1 Getting in and keeping contact
3.1.1 What data are processed and what is the purpose of data processing
3.1.2 Legal basis of data processing
3.1.3 Duration of data processing
3.1.4 Method of data processing
4.5 Right to restriction of processing
5 Our process related to requests to exercise rights
5.1 Notification of recipients
5.2 Method and deadline of notification
5.4 Costs of notification and taking action
6 Possible recipients of personal data, and data processors
6.1 In terms of operating the website
6.2 In terms of social media platforms
6.3 Joint data processing with Meta Platforms Ireland Limited
8.3 How can cookies be managed?
9.1 Data processing for other purposes
9.2 Record keeping requirements
Appendix 10.1 Applicable laws and regulations
Appendix 10.2 Definition of terms relating to the processing of personal data
Appendix 10.3 Data subject rights
We hereby accept this Notice in order to provide the representatives of the natural and legal persons (hereinafter: Users) using our services with all the relevant information and details in a concise, transparent, comprehensible and easily accessible way, with clear and simple wording, and also to help Users exercise their rights specified in Section 4. Our services are available at www.hsagroup.hu.
The basis of our information obligation is Article 12 of Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: GDPR), applicable as of 25 May 2018, Article 16 of Act CXII of 2011 on informational self-determination and freedom of information (hereinafter: Infotv.), as well as Article 4 of Act CVIII of 2001 on certain aspects of electronic commerce services and information society services (hereinafter: Elkertv.).
This Notice has been prepared with consideration to GDPR, Infotv. and other laws relevant to data processing. These laws and regulations are listed in Appendix 10.1 of this Notice, the main terms are defined in Appendix 10.2, and a detailed description of the data subjects’ rights can be found in Appendix 10.3.
When preparing and implementing this notice, we followed the findings in the recommendations of the National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság) on the data protection requirements of preliminary information, and also the accountability principle described in Article 5 of the GDPR, particularly Article 5(2).
We also monitor the practice of the European Union related to the protection of personal data; thus we include in our practices the content of the guidelines on transparency set out by the Article 29 Working Party of the European Commission.
Name: HSA Group Zrt.
Registered office: H-1051 Budapest, Széchenyi István tér 7-8.
Company registration number: 01-10-142262
VAT ID: 32223877-2-41
Email: info@hsagroup.hu
This section details the relevant circumstances for each data processing activity required of all data controllers by the GDPR and other legislation applicable to the industry.
You can contact us through our home page with any purpose. Besides, it is part of our job to process the personal data of the contact persons of our business partners. Please refer to the details of the corresponding data processing below.
Personal data | Purpose of data processing | Legal basis of data processing |
name | to identify the User or the contact person of our business partner | Consent given by the User (Article 6(1) (a) of GDPR) Legitimate interest of the business partner (Article 6(1) (f) of GDPR) |
email address | getting in and keeping contact with the User or the contact person of our business partner | Consent given by the User (Article 6(1) (a) of GDPR) Legitimate interest of the business partner (Article 6(1) (f) of GDPR) |
phone number | getting in and keeping contact with the User or the contact person of our business partner | Consent given by the User (Article 6(1) (a) of GDPR) Legitimate interest of the business partner (Article 6(1) (f) of GDPR) |
public profile data accessible on social media platforms | to identify the User | Consent given by the User (Article 6(1) (a) of GDPR) Legitimate interest of the business partner (Article 6(1) (f) of GDPR) |
The consent of the User given when getting in contact by showing voluntary, explicit behaviour (making a phone call or sending an email) to processing their personal data for a purpose defined in Section 3.2.1 (Article 6(1) (a) of GDPR).
In case we use the data of the User for a purpose other than the original purpose for which it was collected, we will notify the User about doing so, obtain their preliminary, explicit consent, and give them the opportunity to ban using their data (see: Section 9.1).
The above specified personal data of the contact person of our business partner are processed based on the legitimate interest of the data controller and the business partner (Article 6(1) (f) of GDPR). It’s the legitimate interest of both parties to have effective business communications while using the website and discussing the partnership, and to be able to inform each other’s relevant representatives of the material circumstances relevant to our contract. Here, the right to informational self-determination of the contact person of our business partner is not considered to be violated, as it is their official or contractual duty to facilitate communication between the parties and to provide their personal data for this purpose. The contact person of our business partner can object to such data processing.
We process the provided personal data until the consent is withdrawn. The User can withdraw their consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
We process the personal data of the contact persons of our business partners for a period necessary for communication and until we are required to do so by applicable law (in compliance with Act V of 2013, it is 5 years from the performance or termination of the contract, and in compliance with Act C of 2000, it is 8 years from issuing the invoice).
Electronically.
It is important for us to process data in a way that meets the requirements of fairness, lawfulness and transparency. In this context, we will briefly describe in this section what type of rights data subjects have. Further details can be found in Appendix 3 to this notice.
Our Users may request free information on the details of the processing of their personal data, access to or obtain a copy of the personal data processed, and in certain cases specified by law, request the rectification, erasure, blocking or restriction of the processing of such personal data and object to the processing of such personal data. Users may send their requests for information or requests under this section to the contact details provided in Section 2.
Our User can receive feedback from us about the processing of their personal data, access these personal data and the details of their processing, and obtain a copy of the personal data processed by us.
On the User’s request, we rectify their inaccurate personal data without undue delay, and the User shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
On the User’s request, we shall erase their personal data, if processing is not needed any more, or if the User withdraws their consent, or objects to processing their data, or processing is unlawful.
We seek to inform all data controllers of the User’s request for erasure (if they require us to do so) who accessed or might have accessed the potentially disclosed data of the User.
On the User’s request, we shall restrict data processing if the accuracy of personal data is debatable, or data processing is unlawful, or our User objects to processing their data, or in case we no longer need the provided personal data.
Our User can receive the personal data concerning and provided by them in a structured, commonly used and machine-readable format, and has the right to transmit it to other data controllers.
Our User should have the right to object to processing their personal data based on legitimate interest for a reason related to their own circumstances (see: Section 3.1). In this case we are not allowed to process these personal data any longer, unless we demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the User or for the establishment, exercise or defence of legal claims. In case of objection, personal data are not allowed to be processed any further by default.
We shall assess the request as soon as possible after submission, but no later than 30 days – 15 days in the case of an objection – after submission, and decide whether it is valid, and notify the requester of this decision. If we don’t fulfil the request of the requester, we inform them in our decision about the factual and legal reasons.
It is important for us to keep personal data safe, and we also respect the User’s right to informational self-determination, therefore we seek to respond to all requests in a fair and timely manner. In this regard, we ask Users to contact us first with any complaints or queries before turning to authorities or courts to enforce their potential claims, so that any objections can be addressed as quickly as possible.
In case this proves unsuccessful, our User can enforce their rights at court based on Act V of 2013 on the Civil Code (the action can be brought before the competent regional court as per the domicile or place of residence of our User; for a list of regional courts and their contact details, please visit http://birosag.hu/torvenyszekek), moreover, based onthose set out in the Infotv., can reach out to the National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság) (address: H-1055 Budapest, Falk Miksa utca 9-11.; mailing address: H-1363 Budapest, Pf.: 9.; phone: +36 1 391 1400; fax: +36 1 391 1410; email: ugyfelszolgalat@naih.hu; website: https://naih.hu/; hereinafter: NAIH), and file a complaint there.
In the event of rectification, erasure or restriction of data processing, we will always notify the recipients to whom the personal data of the User might have been disclosed, unless this proves to be impossible, or when the effort necessary to do so would be disproportionate. On the User’s request, we shall give information about these recipients.
We shall give information about the measures taken at the requests related to Section 4 electronically no later than one month after receiving such request, if the User does not require otherwise. This period can be extended with an additional two months as applicable, regarding the complexity of the request or the number of requests. The User shall be informed of such extension together with a description of the underlying reasons within one month from receiving the request.
When requested by the User, the information may be provided orally, provided that the User’s identity is proven by other means.
If we do not take action on a request, we shall inform the User of the reasons no later than one month after receiving the request, and also of the fact that they can lodge a complaint with NAIH and seek a judicial remedy (Section 4.9).
Under exceptional circumstances, where we have reasonable doubts concerning the identity of the natural person making the request, we shall request the provision of additional information necessary to confirm their identity. This measure is necessary to promote the confidentiality of data processing defined in Article 5 (1) (f) of GDPR, i.e. to prevent unauthorised access to the personal data.
We shall provide information for the requests concerning Section 4, and implement the corresponding measures free of charge.
If the User’s request is clearly unreasonable or has an excessive character (especially when it’s recurrent), we shall charge a reasonable fee (considering the incurring administrative costs when providing the requested information or the notification, or implementing the requested measure), or we shall refuse to take action based on the request.
The web host as data processor has the right to access the personal data provided during the use of the website.
Name: Websupport Magyarország Kft.
Contact: https://www.hsagroup.hu/impresszum/
Our website is connected to various social media platforms (e.g. Facebook, LinkedIn, Twitter, Google+, Instagram, YouTube); which means that in case the User “likes” our Facebook page, or “follows” us on Twitter, we get to know all the publicly available personal data connected to their account. Data processing activities on these platforms are subject to the relevant information contained in the respective service provider’s own privacy notice.
Facebook (including the Facebook mobile app and the in-app browser) is available through the Meta product portfolio of Meta Platforms Ireland Limited (registered office: 4 Grand Canal Square Grand Canal Harbour Dublin 2, Ireland; Irish company registration number: 462932; website: https://about.facebook.com/meta). In the context of using Facebook, the terms of use, the privacy policy and the privacy notice of Meta Platforms Ireland Limited should be referenced in case of current data processing activities, depending on the specific purpose of the data processing:
https://www.facebook.com/legal/Workplace_GDPR_Addendum;
https://www.workplace.com/legal/WorkplaceEuropeanDataTransferAddendum?fbclid=IwAR1KngiTZgbBM7CxwiyX7937hOazemFX9svQl34lMfVEwNJkhdboDUDF_9A; . https://www.facebook.com/about/privacyshield.
Data processing implemented by us is based on the consent given by the User, in compliance with Article 6(1) (a) of the GDPR. You can withdraw your consent at any time in the future by changing your preferences in the cookie banner. The withdrawal of consent shall not affect the lawfulness of data processing based on consent before its withdrawal.
Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, we shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of the GDPR and protect the rights of data subjects.
We and the employees of the data processors are authorised to access the personal data of the User to an extent appropriate for the tasks of their job. We shall take all security, technical and organisational measures to safeguard the safety of the data.
Our IT systems can only be accessed with personalised accounts. When assigning such access, there is a “necessary and sufficient” approach: any employee can use our IT systems and services to the extent appropriate for completing their tasks, with the corresponding rights and for the sufficient period of time. Access to the IT systems and services shall be given only to the person who is not subject to restrictions for security or other (e.g. conflict of interest) reasons, and who has the professional, business and information security knowledge for the safe use thereof.
We and our data processors are bound by a written statement of strict confidentiality and are required to act in accordance with these rules of confidentiality in the course of our activities.
Data (except for the data stored by our data processors) are stored on our own devices, in a data centre. The IT devices storing these data are located separately, in severed, secured server rooms, protected by a multi-level access control system with authorisation control.
Our intranet is safeguarded by multi-level firewall protection. There is always a hardware firewall (gateway device) at the entry points of the public networks used, everywhere and in every instance. Data is stored redundantly, which means the same data is stored at different locations, in order to protect them from destruction, loss, damage or unauthorised destruction.
Our intranets are protected from outside attack via multi-level, active protection (e.g. virus protection) against complex malware codes. We enable the necessary external access to the IT systems and databases we operate via an encrypted data connection (VPN).
We shall do our best to always keep our IT devices and software compliant with the technological solutions widely accepted in the market. Through our developments, we create systems that use logging to control and monitor operations and detect incidents such as unauthorised access. Our server is located on a separate and dedicated server of the web host provider, protected and secured. Taking into account the applicable recommendation of NAIH, we use the https protocol on the website, which means a higher level of data security as opposed to the http protocol.
For the appropriate functioning of our website, in certain cases we place small data files on the computer device of the User, just like most modern websites do.
A cookie is a small text file placed on the computer device (including mobile phones) of the User by the website. This allows the website to “remember” the settings of the User (e.g. language, font size, display option, etc. used), so that the User won’t need to set these again when visiting our website. For a list of the cookies used on our website, please see the Cookie Policy published on the website (https://www.hsagroup.hu/sutik//).
Cookie files can be deleted (for more details see www.AllAboutCookies.org), or most browsers used today can block them, too. In this case, however, you will need to make certain settings again each time you use our website, and some services might not function properly. For details about deleting and blocking cookies, see www.AllAboutCookies.org (in English) and the following links regarding the various browsers used by the User:
If we want to use the data provided for a purpose other than the original purpose for which it was collected, we will notify the Users about doing so, obtain their preliminary, explicit consent, and give them the opportunity to ban using their data.
In compliance with Article 30 of the GDPR, we keep records of the data processing activities carried out under our responsibility (records of data processing activities).
A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data processed. In case of a personal data breach, we are obliged to proceed according to Articles 33 and 34 of the GDPR. We document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken.
We have the right to amend this Notice any time unilaterally. In case this Notice is amended, we keep the previous versions, and, if possible and reasonable, notify the data subjects of the amended clauses.
Effective date: 10 July 2023
When drafting this Notice, the Data Controller considered the applicable and effective laws and regulations and the major international recommendations, particularly the following:
Access
The User shall have the right to get access to their personal data processed by us, upon their request submitted via our contact details. By doing this, the User shall obtain information on the following:
Moreover, the User may request making a copy of their personal data subject to data processing available for them. In this case, personal data shall be made available to them in a structured, commonly used and machine-readable format (PDF/XML), and/or in a printed, paper-based version thereof. The User can request such copy free of charge.
Rectification
The User shall have the right to ask the personal data concerning them and processed by us, and which are inaccurate, to be rectified upon their request submitted via our contact details. In case we do not have the information necessary for the correction and completion of the erroneous data, we may ask them to submit the additional information and a verification of the accuracy of these data. We shall restrict processing the data subject’s personal data, and temporarily suspend the operations carried out related to them (except storage), until the correction and completion of data is finished (due to lack of supplementary information).
Erasure
The User shall have the right to ask the erasure of the personal data concerning them and processed by us, upon their request submitted via our contact details, if any of the following conditions apply:
In case we find upon the request of the User that there is a valid obligation to erase the personal data processed by us, we cease processing the data, and destroy the personal data processed earlier. In addition, an obligation to erase personal data may result from the withdrawal of consent, the exercise of the right to object, and also based on legal obligations.
Restriction of data processing
The User shall have the right to ask the restriction of processing the personal data concerning them and processed by us, upon their request submitted via our contact details, in the following cases
We shall automatically restrict processing the personal data when the User contests the accuracy of the personal data, and/or the User exercises their right to object. In this case, restriction applies to a period enabling the verification of the accuracy of the personal data and/or (in case of objection) exploring if the preconditions for data processing are still met.
During the restriction period, no data processing operations shall be completed on the marked personal data, except for storage. In case data processing is restricted, personal data shall be processed exclusively in the following instances:
We shall inform the User before the restriction is lifted.
Data portability
The User shall have the right to ask the provision of the personal data concerning them and processed by us, for further use defined by the User, upon their request submitted via our contact details. In addition, the User can also request us to transfer their personal data to the other data controller specified by them.
This right applies exclusively to the personal data provided by the User and processed for the completion of their contract. There is no option to make any other data portable. Personal data shall be provided to the User in a structured, commonly used and machine-readable format (PDF/XML), and/or in a printed, paper-based version thereof.
Please note that exercising this right does not automatically mean erasing the User’s personal data in our systems. Moreover, the User should have the right to re-establish their relationship with us even after portability of their data is implemented.
Objection
The User shall have the right to object to processing their personal data for purposes described in Section 3.1 of this Notice, upon their request submitted via our contact details. In this case we assess whether the compelling legitimate grounds for the processing which override the interests, rights and freedoms of the User or for the establishment, exercise or defence of legal claims. If we find that such grounds exist, we carry on processing the personal data. Otherwise, we shall not process the personal data any longer.
Career. For everyone.
DES&DEV:
