10. METHOD OF STORING PERSONAL DATA, SECURITY OF DATA MANAGEMENT
Our computer systems and other data storage locations are located at headquarters and on servers leased by the data processor. Our company selects and operates the IT tools used to manage your personal information in the course of providing the service in such a way that the managed data:
(a) accessible to authorized persons (availability);
(b) its authenticity and authentication are assured (authenticity of data management);
(c) unchangeability can be demonstrated (data integrity);
(d) be protected against unauthorized access (confidentiality of data).
We pay particular attention to the security of the data, and take the technical and organizational measures and procedures necessary to enforce the GDPR warranties. In particular, the data shall be protected by appropriate measures against unauthorized access, alteration, transmission, disclosure, deletion or destruction, and against accidental destruction, damage or unavailability due to changes in technology used.
Both our company and our partners’ IT systems and networks are protected against computer-assisted fraud, computer viruses, computer hacking and denial of service attacks. The operator also maintains security through server-level and application-level security procedures. Daily data backup is resolved. In order to avoid privacy incidents, our company will take all possible measures, and in the event of such an incident, we will take immediate action to minimize the risks
and prevent damage in accordance with our incident management policies.
11. RIGHTS OF STAKEHOLDERS, REMEDIES
The data subject may request information about the processing of his or her personal data, and may request the rectification or deletion of his or her personal data, except for mandatory data processing, exercise his or her right to data storage and protest as indicated at the data collection.
Upon request by the data subject, the information will be provided in electronic form without delay, but no later than 30 days, in accordance with our applicable policies. Requests by those concerned to enforce the rights below will be
executed free of charge.
Right to information:
Our Company shall take appropriate measures to ensure that the persons concerned have all the information on the processing of personal data referred to in Articles 13 and 14 of the GDPR and in Articles 15 to 22. 1. Each Member State
shall provide each piece of information referred to in Articles 1 and 34 in a concise, transparent, comprehensible and easily accessible form, in a clear and unambiguous manner, but in a precise manner.
The right to be informed may be exercised in writing through the contact details provided in point 1. Upon request, the person concerned may also be provided orally, upon verification of his or her identity. We inform our clients that if any of our employees have doubts about the identity of the data subject, we may ask for information to confirm the data subject’s identity.
The data subject’s right to access:
The data subject shall have the right to receive feedback from the controller as to whether the processing of his or her personal data is ongoing. Where personal data are being processed, the data subject shall have the right of access to the personal data and to the following information listed.
• Purposes of data management;
• the categories of personal data concerned;
• the recipients or categories of recipients to whom the personal data have been or will be communicated, including in particular third-country recipients (outside the European Union) or international organizations;
• the envisaged period for which the personal data will be stored;
• the right to limit rectification, erasure or data management and the right to object;
• the right to lodge a complaint to the supervisory authority;
• information on data sources; the fact of automated decision-making, including profiling, and understandable logic and the importance of such data management and the expected consequences for the data subject.
In addition, in the event of the transfer of personal data to a third country or to an international organization, the data subject shall have the right to be informed of appropriate guarantees regarding the transfer.
Right of rectification:
Under this right, anyone may request the correction of inaccurate personal information held by us and the completion of incomplete information.
Right to delete:
The data subject shall have the right to delete personal data concerning him or her without undue delay on any of the following grounds:
(a) personal data are no longer required for the purpose for which they were collected or otherwise processed;
(b) the data subject has withdrawn his consent as the basis for the processing and there is no other legal basis for the processing;
(c) the data subject objects to the processing of the data and there is no legitimate and legitimate reason for the processing;
(d) unlawful processing of personal data is established;
(e) personal data must be deleted in order to comply with a legal obligation under Union or national law applicable to the controller;
(f) personal data have been collected in the context of the provision of information society services.
Deletion of data shall not be initiated if the processing is necessary for the following purposes:
(a) for the exercise of the right to freedom of expression and information;
(b) to fulfill an obligation under the Union or national law applicable to the controller for the processing of personal data or to carry out a task in the public interest or in the exercise of official authority vested in the controller;
(c) for public health purposes or for archival, scientific and historical research or statistical purposes in the public interest;
(d) or for the filing, enforcement or defense of legal claims.
Right to restrict data management:
At the request of the data subject, we limit the processing of data under the conditions of Article 18 of the GDPR, ie if:
(a) the data subject disputes the accuracy of the personal data, in which case the restriction shall be for a period which allows the accuracy of the personal data to be verified;
(b) the processing is unlawful and the data subject opposes the erasure of the data and instead requests that their use be restricted
(c) the controller no longer needs personal data for the purpose of processing, but the data subject requires them to assert, assert or defend a legal claim; obsession
(d) the data subject has objected to the processing; in this case, the restriction shall apply for a period until it is established whether the legitimate grounds of the controller prevail over those of the data subject.
Except where stored, personal data may be processed only with the consent of the data subject, or for the purpose of making, enforcing or defending legal claims, protecting the rights of another natural or legal person, or for important
public interests of the European Union or a Member State. The data subject shall be informed in advance of the lifting of the restriction on data management.
Right to carry data:
The data subject shall have the right to receive the personal data concerning him or her which he or she has made available to the controller in a structured, widely used, machine-readable format and to pass on such data to another controller. Our company can fulfill such request of the data subject in word or excel format.
Right of objection:
Where personal data are processed for the purpose of direct marketing, the data subject shall have the right to object at any time to the processing of personal data concerning him or her for this purpose, including profiling, in so far as it relates to direct marketing. If you object to the processing of personal data for the purpose of direct marketing, the data cannot be processed for this purpose.
Automated decision making on individual issues, including profiling:
The data subject shall have the right not to be subject to any decision based solely on automated data management, including profiling, which would have legal effects or be substantially affected by him. The above authority does not apply if data management
(a) necessary for the conclusion or performance of a contract between the data subject and the controller;
(b) it is made available under Union or national law applicable to the controller, which shall have the rights, freedoms and legitimate interests of the data subject
(c) establish appropriate protection measures; obsession
(d) is based on the explicit consent of the data subject.
Right of Withdrawal:
The data subject shall have the right to withdraw his or her consent at any time. Withdrawal of the consent shall not affect the legality of the consent based data management prior to the withdrawal.
Rules of procedure:
The controller shall inform the data subject without undue delay, but in any event within one month of receipt of the request, in accordance with Articles 15 to 22 of GDPR. Measures taken following an application under Article. Where necessary, taking into account the complexity of the application and the number of applications, this time limit may be extended by a further two months. The controller shall inform the data subject of the extension of the deadline, indicating the reasons for the delay, within one month of receipt of the request.
If the data subject has made an application by electronic means, the information shall be provided by electronic means unless the data subject requests otherwise.
If the controller does not act on the data subject’s request, it shall inform the data subject without delay and no later than one month after receipt of the request, of the reasons for the non-action and of the data subject’s ability to lodge a complaint with the supervisory authority.
Unless it proves impossible or involves a disproportionate effort, the controller shall inform any recipient to whom he or she has been provided with any rectification, erasure or restriction on the processing of personal data. At the request of the data subject, the controller shall inform those addressees.
Compensation and damages:
Any person who has suffered material or non-material damage as a result of a breach of the Data Protection Regulation shall be entitled to compensation from the controller or the processor for the damage suffered. The data processor shall only be liable for damages caused by the data processing if he / she has not complied with the legal obligations specifically imposed on the data processors, or if the data controller has disregarded or acted contrary to the lawful instructions of the data controller. If several controllers or processors, or both controllers and processors, are involved in the same data processing and are responsible for the damage caused by the data processing, each data controller or processor shall be jointly and severally liable for the entire damage.
The controller or the processor shall be released from liability if it proves that it is not in any way responsible for the event giving rise to the damage.
Access to Justice and Data Protection Authority Procedure:
The data subject may take legal action against the controller in case of violation of his rights. The court will deal with the matter out of turn.
Complaints may be submitted to the National Data Protection and Freedom of Information Authority.
Address of the Authority: 1125 Budapest, Erzsébet fasil 22 / C, Szilágyi, Mailing address: 1530 Budapest, Pf .: 5., Phone: + 36-1-391.1400, E-mail: ugyfelszolgalat@naih.hu
