Privacy notice

Privacy notice of Gorky és Zentai Korlátolt Felelősségű Társaság

data processing related to services provided through the online store and contract management

1. Data Controller and contact details

Name of the Data Controller: Gorky és Zentai Korlátolt Felelősségű Társaság (hereinafter: “Data Controller”)

Registered office: 1026 Budapest, Törökvész lejtő 24.

E-mail address: webshop@bio-barat.hu

Telephone number: +36 30 868 3002

2. The categories of data processed, the purpose and legal basis of data processing, and the retention period for the data

Categories of data processed	Purpose of data processing	Legal basis for data processing	Retention period
Data related to preparing the contract (data of a contractual partner who is a private individual, or, in the case of a contractual partner that is not a private individual, the name, position, contact details, and, where applicable, reference data of the contact person, representative, and other private individuals relevant to concluding the contract)	Preparing the contract, contract management	In the case of a private-individual contractual partner, the preparation and performance of the contract to be concluded with that partner. In the case of a contractual partner that is not a private individual, the Data Controller’s legitimate interest in preparing and performing the contract. Following the failure to conclude / termination of the contract, the Data Controller’s legitimate interest in enforcing claims.	The Data Controller processes the data until the conclusion of the contract fails or, if the contract is concluded, until it terminates. After the contract fails to be concluded or terminates, the Data Controller does not delete the personal data, but retains it on the basis of a legitimate interest until the limitation period for claims arising from the contract (under civil and tax law) expires.
Data related to the performance of the contract (including data categories related to communication between the parties, settlements, and contract amendments)	Performance of the contract, contract management, compliance with accounting obligations	In the case of a private-individual contractual partner, the preparation and performance of the contract to be concluded with that partner. In the case of a contractual partner that is not a private individual, the Data Controller’s legitimate interest in preparing and performing the contract. Following the termination of the contract, the Data Controller’s legitimate interest in enforcing claims. For accounting documents generated in connection with the contract, the legal basis for data processing consists of the legal obligations arising from tax and accounting legislation.	The Data Controller processes the data until the contract terminates. After the contract terminates, the Data Controller does not delete the personal data, but retains it on the basis of a legitimate interest until the limitation period for claims arising from the contract (under civil, tax, and accounting law) expires.
Data necessary to enforce claims in the event of defective performance	Enforcing claims arising from the contract, contract management	The Data Controller’s legitimate interest in enforcing claims arising from the contract.	The Data Controller processes the data until the contract ends. After the contract ends, the Data Controller does not delete the personal data but retains it on the basis of a legitimate interest until the limitation period for claims arising from the contract (civil-law and tax-law claims) expires.
Data related to the termination of the contract	Closing contract-related settlements, enforcing claims related to contract termination, contract management	In the case of a private-individual contractual partner, the preparation and performance of the contract to be concluded with that partner. In the case of a contractual partner that is not a private individual, the Data Controller’s legitimate interest in preparing and performing the contract. Following the failure to conclude / termination of the contract, the Data Controller’s legitimate interest in enforcing claims.	The Data Controller processes the data until the contract ends. After the contract ends, the Data Controller does not delete the personal data but retains it on the basis of a legitimate interest until the limitation period for claims arising from the contract (civil-law and tax-law claims) expires.
All categories of personal data referred to above and related to any claims arising from the contract	Enforcement of legal claims	The Data Controller’s legitimate interest in possessing evidence appropriate for proving its case if a claim is asserted, including claims based on a contract that may be enforced by or against the Data Controller.	Until the expiry of the limitation period applicable to a legal claim

In connection with the above data processing activities, the Data Controller draws attention to the fact that if the data subject does not provide the above data in full then the possible consequence of failing to provide the data may be that the conclusion or performance of the contract becomes impossible.

The rightfulness of the legitimate interest with regard to processing based on this, the data subject is entitled to the right to object (see Section 5.E)!

3. Recipients of personal data and categories of recipients

Category of recipients	Category of personal data transferred to the recipients	Category of recipient	Activity performed by the recipient
Courier service engaged by the Data Controller (GLS Hungary Kft.)	The data subject’s contact details	Data Processor	Corresponds to the activities carried out by the Data Controller.
Company commissioned to operate the online store (Shopify Inc.)	Data required for preparing and performing the contract	Data Controller	Provision of IT services related to the operation of the online store. Data backups are stored in EEA Member States
Company providing cloud-based hosting services (Code Omega Kft.)	Data required for preparing and performing the contract	Data Controller	Provision of IT services related to the operation of the online store

By transferring personal data to the recipient(s) above, the Data Controller does not transfer the data subject’s data to a third country. The Data Controller does not transfer personal data unless the transfer is mandatory under legislation or by order of an authority or court.

4. Processing of special categories of personal data

The Data Controller does not process special categories of personal data.

5. Data subject rights

The data subject may request from the Data Controller access to the personal data concerning them, their rectification or erasure, and, in certain cases, may also request restriction of the processing of the data. The data subject shall also have the right to lodge a complaint with the supervisory authority and the right to an effective legal remedy. The data subject may request that the personal data processed about them be provided in a machine-readable format (the right to data portability), where the legal basis for the processing is the performance of a contract with the data subject. The data subject shall also have the right to lodge a complaint with the supervisory authority and the right to an effective legal remedy.

5)Right of access

The data subject shall be entitled at any time to request information on whether and how the Data Controller processes their personal data, including the purposes of the processing, the recipients to whom their data have been disclosed, the retention period, and any of their rights relating to the processing. When exercising the right of access, the data subject shall also be entitled to request a copy of the data. In the case of a request submitted electronically, unless the data subject requests otherwise, the Data Controller shall provide the requested information electronically (in PDF format). If exercising the data subject’s right of access adversely affects the rights and freedoms of others, in particular the business secrets or intellectual property of others, the Data Controller shall be entitled to refuse to fulfil the data subject’s request to the extent necessary and proportionate. If the data subject requests the above information in multiple copies, the Data Controller shall charge a reasonable fee proportionate to the administrative costs of producing the additional copies, amounting to HUF 200 per copy/page.

5B)Right to rectification

The Data Controller shall rectify or complete the personal data concerning the data subject at the data subject’s request. If there is any doubt regarding the rectified data, the Data Controller may call upon the data subject to prove the accurate data to the Data Controller in an appropriate manner, primarily by means of a document. If the personal data affected by this right have been disclosed by the Data Controller to another person (i.e. a recipient, such as a data processor), the Data Controller shall inform those persons of the rectification of the data without undue delay, unless this is impossible or would require disproportionate effort from the Data Controller. At the data subject’s request, the Data Controller shall inform the data subject of these recipients.

5C) Right to erasure (“right to be forgotten”)

If the data subject requests the erasure of some or all of their personal data, the Controller shall erase it/them without undue delay, provided that:

the Controller no longer needs the personal data for the purpose for which it collected or otherwise processed them;
the processing is based on the data subject’s consent, but the data subject has withdrawn that consent and there is no other legal basis for the processing;
the personal data were processed unlawfully by the Controller, or
the erasure of the personal data is necessary for compliance with a legal obligation.

If the Controller has disclosed the personal data covered by this right to another person (i.e. a recipient, such as a processor), the Controller shall inform those persons of the erasure without undue delay, provided that this is not impossible or does not require disproportionate effort from the Controller. At the data subject’s request, the Controller shall inform them of these recipients. The Controller is not always obliged to erase personal data, particularly where processing is necessary to establish, exercise or defend legal claims

5.D) Right to restriction of processing

The data subject may request the restriction of the processing of their personal data in the following cases:

the data subject disputes the accuracy of the personal data – in this case, the restriction applies for the period necessary to enable the controller to verify the accuracy of the personal data;
the processing is unlawful, but the data subject opposes the erasure of the data and instead requests the restriction of its use; or
the Controller no longer needs the personal data for processing purposes, but the data subject requires it to establish, exercise or defend legal claims, or
the data subject has objected to the processing – in this case, the restriction applies for the period necessary to determine whether the Controller’s legitimate grounds take precedence over the data subject’s legitimate grounds.

Restriction of processing means that, except for storage, the Data Controller does not process the personal data subject to the restriction, or processes it only to the extent to which the data subject has consented, and that, even without such consent from the data subject, the Data Controller may process the data that is necessary for the establishment, exercise, or defense of legal claims, for protecting the rights of another natural or legal person, or for reasons of important public interest of the Union or of a European Union Member State. The Data Controller shall inform the data subject in advance of the lifting of the restriction on processing. Where the Data Controller has disclosed the personal data covered by this right to another person (i.e. a recipient, such as a data processor), the Data Controller shall inform those persons without delay of the restriction on processing, unless this proves impossible or would require disproportionate effort from the Data Controller. At the data subject’s request, the Data Controller shall inform them of these recipients.

5.E) Right to object

Where the legal basis for processing data concerning the data subject is the legitimate interest of the Data Controller or a third party, the data subject has the right to object to the processing. The Data Controller is not required to uphold the objection if it demonstrates that

the processing is justified by compelling legitimate grounds that override the interests, rights, and freedoms of the data subject; or
the processing is related to the establishment, exercise, or defense of the Data Controller’s legal claims.

5.F)Right to data portability

The data subject has the right to receive the personal data concerning them that they have provided to the Data Controller in a structured, commonly used, machine-readable format (e.g. by email), and also has the right to have this data transmitted directly by the Data Controller to another data controller.

If the right to data portability is exercised, the Data Controller shall comply with the data subject’s request by sending an email attachment in PDF format.

5G) Right to lodge a complaint and right to an effective remedy

If the data subject considers that the processing of their personal data by the Data Controller infringes the data protection legislation in force at any given time, in particular the provisions of the General Data Protection Regulation, they have the right to lodge a complaint with the competent data protection supervisory authority of the Member State of their habitual residence, place of work, or the place of the alleged infringement. In Hungary, a complaint may be lodged with the National Authority for Data Protection and Freedom of Information (“NAIH”). The contact details of the NAIH are:

Website: http://naih.hu/ Telephone: +36-1-391-1400

Address: 1125 Budapest, Szilágyi Erzsébet fasor 22/c. Fax: +36-1-391-1410

Postal address: 1530 Budapest, P.O. Box 5. E-mail: ugyfelszolgalat@naih.hu

The data subject also has the right to lodge a complaint with a supervisory authority established in another European Union Member State, in particular in the Member State of their habitual residence, place of work, or the place of the alleged infringement.

The data subject may also bring an action before a court in the event of the above infringement, regardless of their right to lodge a complaint. In the case of the Data Controller, the competent court is the Budapest-Capital Regional Court; however, the data subject may also initiate proceedings before the regional court having jurisdiction over their place of residence. The contact details of the regional courts in Hungary are available at the following link: http://birosag.hu/torvenyszekek. The data subject may also bring an action before the court having jurisdiction in the Member State of their habitual residence, provided that their habitual residence is in another Member State of the European Union. The data subject is also entitled to bring an action before a court against a legally binding decision concerning them issued by the supervisory authority. The data subject is further entitled to judicial remedy if the supervisory authority does not deal with the complaint or does not inform the data subject within three months of the procedural developments or outcome concerning the complaint submitted. The data subject has the right to authorize a nonprofit organization or association, established in accordance with the law of a Member State of the European Union and having statutory objectives in the public interest and the protection of the rights and freedoms of data subjects with regard to personal data, to lodge the complaint on their behalf, seek judicial review of the supervisory authority’s decision, bring an action, and exercise their right to compensation on their behalf.

Automated decision-making and profiling

The Data Controller does not carry out automated decision-making or profiling in the course of processing personal data concerning data subjects.

Deadline for responding to the data subject’s request

The Data Controller shall ensure that, if data subjects exercise any of their rights in connection with this data processing and contact the Data Controller in this regard, the Data Controller responds to such requests without undue delay and no later than within one month, except in the case of withdrawal of consent, when it shall promptly arrange for the deletion of the data processed on the basis of consent.

If necessary, taking into account the complexity and number of requests, the deadline specified in the preceding paragraph may be extended by a further two months. In such cases, the Data Controller shall inform the data subject of the extension of the deadline, stating the reasons for the delay, within one month of receiving the request. If the data subject submitted the request electronically, the information shall, where possible, be provided electronically.

* * *

Effective from June 1, 2022

Privacy Notice – bio-barat.hu online store

Privacy notice