Privacy Policy

Privacy Statement

1. INTRODUCTION

Henriette Novak (1203 Budapest, Közműhelytelep u. 26.), hereinafter referred to as the service provider and data controller, acknowledges the binding nature of this legal notice. The company undertakes to ensure that all data processing activities comply with the requirements set forth in this policy and applicable legislation. Privacy policies related to adverr.hu data processing are continuously available at www.Adverr.hu.

Henriette Novak reserves the right to modify this notice at any time. Any changes will be communicated to our audience in due time.

Henriette Novak is committed to protecting the personal data of clients and partners, and considers respect for clients’ informational self-determination rights to be of paramount importance. Adverr.hu treats personal data confidentially and takes all security, technical, and organizational measures to guarantee data security. Adverr.hu describes its data processing practices below:

2. SCOPE OF PERSONAL DATA, PURPOSE, LEGAL BASIS, AND DURATION OF DATA PROCESSING

Henriette Novak’s data processing activities are based on voluntary consent. However, in certain cases, the processing, storage, and transmission of certain data categories are mandated by law, of which we separately notify our Partners.

We draw the attention of data subjects providing information to Henriette Novak that if they are not providing their own personal data, the data subject is obligated to obtain the consent of the affected person.

Henriette Novak’s data processing principles are in accordance with applicable data protection legislation, particularly the following:

• Regulation (EU) 2016/679 of the European Parliament and of the Council (27 April 2016) – on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR); • Act CXII of 2011 – on the right of informational self-determination and freedom of information (Infotv.) • Act V of 2013 – on the Civil Code (Ptk.) • Act CLV of 1997 – on consumer protection (Fgytv.) • Act C of 2000 – on accounting (Számv. tv.) • Act CVIII of 2001 – on electronic commerce services and information society services (Eker. tv.) • Act C of 2003 – on electronic communications (Eht.) • Act XLVIII of 2008 – on certain restrictions of economic advertising activities (Grt.) • Act CXXXIII of 2005 – on the rules of personal and property protection and private investigation activities (SzVMt.);

2.1. Partner and Contact Data

Purpose of data processing: Contact establishment on Henriette Novak’s website adverr.hu, purchasing, invoice issuance, Partner registration, differentiation between Partners, purchase and payment documentation, accounting obligation fulfillment, customer relationship maintenance, customer behavior analysis, more targeted service provision.

Legal basis of data processing: data processing necessary for contract performance [GDPR Article 6(1)(b)], Accounting Act Section 169(2).

Types of processed data: identification number, date, time, company name, delivery address, names of purchased products, quantity, purchase price, payment method.

Duration of data processing: eight years in accordance with Accounting Act Section 169(2).

Possible consequences of failure to provide data: the Partner cannot place an order.

Data processors:

2.2. Quality Complaints Handling, Returns

Purpose of data processing: Handling quality complaints related to food offered by Henriette Novak and services provided.

Legal basis of data processing: data processing necessary for contract performance [GDPR Article 6(1)(b)] and Consumer Protection Act Section 17/A(7).

Types of processed personal data: unique complaint identifier, Partner name, delivery address, complaint location and time, complaint method, documents and evidence submitted by Partner, complaint description, location and time of record-taking and name and signature of record-keeper, or product data in case of returns.

Duration of data processing: Five years for complaint records and copies of written responses to complaints according to Consumer Protection Act Section 17/A(7).

Possible consequences of failure to provide data: the affected person cannot exercise consumer rights.

Legal basis of data processing: data processing necessary for contract performance [GDPR Article 6(1)(b)].

2.3. Marketing Database

Henriette Novak processes data of those who have given consent for direct marketing contact.

Purpose of data processing: building business database, sending newsletters containing commercial advertising to affected persons, creating personalized offers using online analytical data, and forwarding offers from data controllers and partners.

Legal basis of data processing: voluntary consent of the affected person, Economic Advertising Act Section 6(5).

Scope of processed data: name, address, email address, phone number, consent for direct marketing contact, and the system stores subscription and unsubscription data.

Duration of data processing: until withdrawal of the affected person’s consent.

Possible consequences of failure to provide data: the affected person will not be informed about offers from data controllers and partners.

Withdrawal of consent for direct marketing messages and deletion or modification of personal data can be requested at the following contacts:

• by email at [email protected], or via the unsubscribe button at the bottom of newsletters
• by post to Henriette Novak, 1203 Budapest, Közműhelytelep u. 26.

2.4. Henriette Novak Customer Correspondence

If you contact our Company using the contact information provided in this notice or on the website, you can reach the data controller. Henriette Novak deletes every received email along with the sender’s name, email address, date and time data, and other personal data provided in the message after a maximum of five years from data provision.

2.5. Job Application

On the www.adverr.hu website or at the [email protected] email address, it is possible to apply for jobs. The employer, as data controller, processes the provided personal data for recruitment purposes during the selection process and for one year thereafter.

Henriette Novak stores received applications.

Purpose of data processing: Job application at Henriette Novak, participation in the selection process.

Legal basis of data processing: voluntary consent of the affected person.

Types of processed personal data: name, permanent address, residence, phone number, email address, place and date of birth, uploaded or sent photos, cover letters, CVs, applications, and other personal data provided therein.

Data deletion deadline: one year from application submission.

Possible consequences of failure to provide data: the affected person cannot apply for job offers published by Adverr.hu.

2.6. www.adverr.hu Server Logging

When visiting the www.adverr.hu website, the web server does not record user data.

2.7. Cookies

The service provider places a small data package, a so-called cookie, on the user’s computer for customized service and reads it back during subsequent visits. If the browser sends back a previously saved cookie, the cookie-handling service provider can link the user’s current visit with previous ones, but only regarding its own content.

Purpose of data processing: user identification, differentiation between users, identification of users’ current sessions, storing data provided during sessions, preventing data loss, user identification and tracking, web analytics measurements.

Legal basis of data processing: the data controller has a legitimate interest in user identification and customized service provision [GDPR Article 6(1)(f)].

Scope of processed data: identification number, date, time, and previously visited page.

Duration of data processing: thirty minutes.

Users can delete cookies from their computers or disable cookie use in their browsers. Cookie management is generally available in browsers under Tools/Settings menu, under Privacy/History/Custom settings menu, under cookie, süti, or tracking designation.

More information about data processing by www.google.com/analytics is available at http://www.google.com/intl/hu/policies.

2.8. Other Data Processing

We provide information about data processing not listed in this notice at the time of data collection. We inform our Partners that courts, prosecutors, investigative authorities, misdemeanor authorities, administrative authorities, the National Authority for Data Protection and Freedom of Information, or other bodies authorized by law may contact the data controller for information provision, data disclosure, transfer, or document provision.

Henriette Novak provides personal data to authorities – if the authority has specified the exact purpose and scope of data – only to the extent absolutely necessary for achieving the purpose of the request.

3. METHOD OF PERSONAL DATA STORAGE, DATA PROCESSING

Henriette Novak and its data processors implement appropriate technical and organizational measures considering the state of technology, implementation costs, the nature, scope, circumstances, and purposes of data processing, and the varying probability and severity of risks to natural persons’ rights and freedoms, to guarantee an appropriate level of data security corresponding to the risk level.

Adverr.hu selects and operates IT tools used for personal data processing to ensure that processed data: • is accessible to authorized persons (availability); • has guaranteed authenticity and authentication (data processing authenticity); • has verifiable unchangeability (data integrity); • is protected against unauthorized access (data confidentiality).

Henriette Novak protects data with appropriate measures, particularly against unauthorized access, modification, transmission, disclosure, deletion or destruction, accidental destruction or damage, and inaccessibility due to changes in applied technology.

Henriette Novak ensures with appropriate technical solutions that electronically processed data files in various registers cannot be directly linked and assigned to affected persons (except where permitted by law) for the protection of electronically processed data files.

Henriette Novak, considering the current state of technology, ensures data processing security protection through technical, organizational, and institutional measures that provide a protection level appropriate to the risks associated with data processing.

During data processing, Henriette Novak maintains: • confidentiality: protects information so only authorized persons can access it; • integrity: protects the accuracy and completeness of information and processing methods; • availability: ensures that when authorized users need it, they can actually access the desired information and related tools are available.

The IT systems and networks of both Henriette Novak and partners involved in data processing are protected against computer-assisted fraud, espionage, sabotage, vandalism, fire and flood, as well as computer viruses, computer break-ins, and denial-of-service attacks. The operator ensures security through server-level and application-level protection procedures. We inform users that electronic messages transmitted over the internet, regardless of protocol (email, web, ftp, etc.), are vulnerable to network threats that may lead to dishonest activity, contract disputes, or information disclosure or modification. To protect against such threats, the data controller takes all reasonable precautions. Systems are monitored to record any security deviations and provide evidence for any security events. System monitoring also enables checking the effectiveness of applied precautions.

Henriette Novak as data controller records potential data protection incidents, indicating facts related to the data protection incident, its effects, and remedial measures taken. Henriette Novak reports potential data protection incidents to the National Authority for Data Protection and Freedom of Information without delay and, if possible, within 72 hours of becoming aware of the incident, unless the data protection incident is unlikely to pose risks to natural persons’ rights and freedoms.

4. DATA CONTROLLER INFORMATION AND CONTACT DETAILS

Name: Henriette Novak
Headquarters: Budapest, Közműhelytelep u. 26.
Business premises: Budapest, Közműhelytelep u. 26.
Tax number: 56272662-1-43
Phone number: +36308450537
Email: [email protected]

5. LEGAL REMEDY OPTIONS

The affected person may request information about personal data processing, request correction of personal data, and – except for mandatory data processing – deletion, withdrawal, restriction of data processing, and may exercise data portability and objection rights in the manner indicated at data collection or through the data controller’s customer service.

5.1 Right to Information:

Upon the affected person’s request, Henriette Novak takes appropriate measures to provide all information referred to in GDPR Articles 13 and 14 regarding personal data processing and all communications under Articles 15-22 and 34 in a concise, transparent, intelligible, and easily accessible form, clearly and plainly worded.

5.2 Right of Access by the Data Subject:

The affected person has the right to receive feedback from the data controller regarding whether personal data processing is ongoing, and if such processing is ongoing, has the right to access personal data and the following information: purposes of data processing; categories of personal data concerned; recipients or categories of recipients to whom personal data have been or will be disclosed, particularly third-country recipients or international organizations; planned duration of personal data storage; rights of rectification, erasure, restriction of processing, and objection; right to lodge a complaint with a supervisory authority; information about data sources; the existence of automated decision-making, including profiling, and meaningful information about the logic involved and the significance and envisaged consequences of such processing for the data subject. In case of personal data transfer to third countries or international organizations, the affected person has the right to be informed about appropriate safeguards relating to the transfer. Henriette Novak provides a copy of personal data undergoing processing to the affected person. For additional copies requested by the affected person, the data controller may charge a reasonable fee based on administrative costs.

Upon the affected person’s request, Henriette Novak provides information in electronic form. The right to information can be exercised in writing through the contact details specified in the Introduction and Section 4.

Upon request and following credible proof and identification of the affected person’s identity, information may also be provided orally.

5.3 Right to Rectification:

Adverr.hu rectifies personal data if it does not correspond to reality and the correct personal data is available.

5.4 Right to Erasure:

The affected person has the right to request that Henriette Novak erase personal data concerning them without undue delay if one of the following grounds applies: • personal data are no longer necessary for the purposes for which they were collected or otherwise processed; • the data subject withdraws consent on which processing is based and there is no other legal ground for processing; • the data subject objects to processing and there are no overriding legitimate grounds for processing; • personal data have been unlawfully processed; • personal data must be erased for compliance with legal obligations under Union or Member State law applicable to the controller; • personal data have been collected in relation to information society services offered.

Data erasure cannot be initiated if processing is necessary: for exercising freedom of expression and information rights; for compliance with legal obligations under Union or Member State law applicable to the controller or for performing tasks in the public interest or in the exercise of official authority; for public health purposes or for archiving, scientific, historical research, or statistical purposes in the public interest; or for establishing, exercising, or defending legal claims.

5.5 Right to Restriction of Processing:

Upon the affected person’s request, Henriette Novak restricts processing if one of the following conditions is met: • the data subject contests the accuracy of personal data, in which case restriction applies for the period enabling verification of personal data accuracy; • processing is unlawful and the data subject opposes erasure, requesting restriction of use instead; • the controller no longer needs personal data for processing purposes, but the data subject requires them for establishing, exercising, or defending legal claims; or • the data subject has objected to processing; in this case, restriction applies until determination whether the controller’s legitimate grounds override the data subject’s legitimate grounds.

When processing is under restriction, personal data may only be processed, with the exception of storage, with the data subject’s consent, or for establishing, exercising, or defending legal claims, or for protecting rights of other natural or legal persons, or for important public interests of the Union or Member States.

Henriette Novak informs the data subject before lifting processing restrictions.

5.6 Right to Data Portability:

The data subject has the right to receive personal data concerning them, which they provided to the controller, in a structured, commonly used, machine-readable format and to transmit this data to another controller.

5.7 Right to Object:

The data subject has the right to object at any time, on grounds relating to their particular situation, to processing of personal data concerning them for tasks carried out in the public interest or in exercising official authority vested in the controller, or processing necessary for legitimate interests pursued by the controller or third party, including profiling based on those provisions.

In case of objection, the controller shall no longer process personal data unless it demonstrates compelling legitimate grounds for processing that override the interests, rights, and freedoms of the data subject, or for establishing, exercising, or defending legal claims.

Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to processing of personal data concerning them for such marketing, including profiling related to direct marketing. Where the data subject objects to processing for direct marketing purposes, Henriette Novak shall no longer process personal data for such purposes.

5.8 Automated Individual Decision-making, Including Profiling:

The data subject has the right not to be subject to decisions based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. This right does not apply if processing is necessary for entering into or performance of a contract between the data subject and controller; is authorized by Union or Member State law applicable to the controller, which also lays down suitable measures to safeguard the data subject’s rights, freedoms, and legitimate interests; or is based on the data subject’s explicit consent.

5.9 Right to Withdraw:

The data subject has the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before withdrawal.

5.10 Procedural Rules:

The controller informs the data subject without undue delay, and in any event within one month of receipt of the request, about actions taken pursuant to Articles 15-22 of GDPR. This period may be extended by two additional months where necessary, considering the complexity and number of requests.

The controller informs the data subject about the extension within one month of receipt of the request, indicating reasons for the delay. Where the data subject makes the request electronically, information shall be provided electronically where possible, unless otherwise requested by the data subject.

Where the controller takes no action on the data subject’s request, the controller informs the data subject without delay and at the latest within one month of receipt of the request about reasons for not taking action and the possibility of lodging a complaint with a supervisory authority and seeking judicial remedy.

Henriette Novak provides requested information and communications free of charge. Where requests from a data subject are manifestly unfounded or excessive, particularly due to their repetitive character, the controller may charge a reasonable fee considering administrative costs of providing information or communications or taking requested action, or refuse to act on the request.

The controller informs all recipients to whom personal data have been disclosed of any rectification, erasure, or restriction of processing, unless this proves impossible or involves disproportionate effort. Upon request, the controller informs the data subject about these recipients.

The controller provides a copy of personal data undergoing processing to the data subject. For additional copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request electronically, information shall be provided in electronic format unless otherwise requested by the data subject.

5.11 Compensation and Non-material Damages:

Any person who has suffered material or non-material damage as a result of GDPR infringement shall receive compensation from the controller or processor for the damage suffered. A processor shall only be liable for damage caused by processing where it has not complied with GDPR obligations specifically directed to processors or has acted outside or contrary to lawful instructions of the controller. Where more than one controller or processor, or both a controller and processor, are involved in the same processing and are responsible for damage caused by processing, each controller or processor shall be held liable for the entire damage. A controller or processor shall be exempt from liability if it proves that it is not in any way responsible for the event giving rise to the damage.

5.12 Right to Judicial Remedy:

In case of rights violations, the data subject may turn to court against the controller (at the choice of the data subject, at the court having jurisdiction over the respondent’s seat or the data subject’s residence). The court handles the case with priority. Proceedings related to personal data protection are fee-exempt.

5.13 Data Protection Authority Procedure:

Complaints can be filed with the National Authority for Data Protection and Freedom of Information:

National Authority for Data Protection and Freedom of Information
Headquarters: 1125 Budapest, Szilágyi Erzsébet fasor 22/C.
Email: [email protected]
Website: www.naih.hu

2022.11.04. Henriette Novak