Privacy Statement

This page is an English translation provided for information purposes only. The original Hungarian text is authoritative: Adatkezelési Nyilatkozat (magyarul).

Contents

I.  PURPOSE OF THE NOTICE ................................................................................................ 4

II.    DEFINITIONS ................................................................................................ 4

III. PRINCIPLES OF DATA PROCESSING ................................................................................. 6

III.1.  Lawfulness, fairness and transparency ............................................................... 7

III.2.  Purpose limitation principle ........................................................................................................ 7

III.3  Data minimisation principle ........................................................................................................ 7

III.4  Accuracy ............................................................................................................................ 7

III.5.  Storage limitation principle ...................................................................................... 7

III.6.  Integrity and data security ................................................................................................ 7

III.7.  Accountability ............................................................................................................ 8

IV.        LEGAL BASIS FOR DATA PROCESSING................................................................................. 8

V.           DATA PROCESSING ACTIVITIES ................................................................................. 8

V.1.                      Processing of personal data relating to Employees and other Contributors .. 9

V.2.                      Processing of personal data of job applicants ............................................. 12

V.3.                      Data processing carried out as a data controller for own purposes, necessary for the provision of business Services (Commercial and implementation activities) ..................................................... 13

V.4.                      Data processing carried out as a data processor with data collected by its clients during the provision of business application and IT Services ....................................... 15

V.5.      Data processing in the course of physical well-being improvement services ......................................... 17

V.6.      Data backup performed by the Data Controller ........................................................................... 18

V.7.      Website form, email and postal data processing ............................................................... 20

V.8.      Data processing related to complaint handling, exercise of Data Subjects' rights, training,

quality assurance ......................................................................... 21

V.9.      Data processing related to Google AdWords, Analytics and Website cookie management. 23

V.10.  Data processing of Facebook/LinkedIn/Twitter/YouTube applications ................................. 27

V.11.  Asset protection of properties used for own purposes – by CCTV ......................................... 29

V.12.  Asset protection of properties used for own purposes – by alarm system ........................... 31

V.13.  Sending newsletters for marketing purposes ........................................................................................ 32

VI.        PROCESSING OF PERSONAL DATA FOR STATISTICAL PURPOSES .................. 33

VII.     DATA PROCESSING AND DATA ACCESS BY THIRD PARTIES... 33

VIII.  AUTOMATED DECISION-MAKING AND

PROFILING ............................................................................................................... 33

IX. RIGHTS OF DATA SUBJECTS AND THEIR ENFORCEMENT ........................................................ 34

X.           GENERAL DATA SECURITY REGULATIONS ...................................................... 37

XI.        ACTION TO BE TAKEN UPON DETECTING AN INCIDENT ..................................................................... 37

XII.     LEGAL REMEDIES, DATA PROTECTION STAFF AND OFFICER ............... 38

XIII.  AUDIT ............................................................................................................. 38

XIV.  REFERENCED LEGISLATION ........................................................................ 38

XV.     FINAL PROVISIONS .......................................................................................... 39

ANNEXES................................................................................................................... 39

ANNEX 1: RECORD OF PROCESSING ACTIVITIES ............................................ 40

ANNEX 2: DETAILED DESCRIPTION OF DATA PROCESSORS .......................... 62

ANNEX 3: DETAILED DESCRIPTION OF CAMERAS ........................................ 65

ANNEX 4: PRIVACY NOTICE (EXTRACT)

ON CCTV SURVEILLANCE DATA PROCESSING ...................................................................... 66

Click On Hungary Kft (hereinafter: Click On, or Data Controller, registered office: 1029 Budapest, Táltos utca 23. A. ép. Tax number: 22705033-2-41 Web: https://click-on.hu, Tel: 0036-1-469-0000, email: email@click-on.hu), in compliance with its obligations under Act CXII of 2011 on the Right to Informational Self-Determination and on the Freedom of Information (hereinafter: the Privacy Act) and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter: the GDPR), hereby establishes its privacy notice (hereinafter: the Notice).

I. PURPOSE OF THE NOTICE

The purpose of this Notice is to enable the Data Subject to become acquainted with all material circumstances of the data processing activities carried out by the Data Controller and the rights associated with them, including, for instance, the lawful order of operation of the filing systems maintained by the Data Controller, and to become aware of the legal basis and retention period of the processing operations, the implementation of data security requirements, and the available avenues of action in connection with personal data breaches.

The Data Controller undertakes that all data processing relating to its activities complies with the requirements set forth in this Notice and in applicable legislation.

II. DEFINITIONS

Data: Personal data processed by the Data Controller.

Data processing (technical operations): The performance of technical tasks related to data processing operations, irrespective of the method and instruments employed for executing the operations and the place of application, provided that the technical task is performed on the data.

Data processor: A natural or legal person, or organisation without legal personality, who or which processes personal data on the basis of a contract concluded with the Data Controller, including contracts concluded pursuant to statutory provisions. Processing: Any operation or set of operations performed on data, irrespective of the procedure applied, in particular collection, recording, registration, organisation, structuring, storage, alteration, use, retrieval, transmission, dissemination, alignment or combination, restriction, erasure, and destruction, as well as the prevention of any further use of the data.

Principles of data processing: The principles set out in the GDPR with which every data processing operation must comply. In summary, these are the following: Lawfulness, fairness and transparency; Purpose limitation; Data minimisation; Accuracy; Storage limitation; Integrity and confidentiality; Accountability. These concepts are detailed in Chapter III of this document.

Purpose of processing: The Data Controller must in all cases mandatorily define the purpose intended to be achieved through the processing, and the Data Subject must be informed thereof.

Legal basis of processing: Every data processing operation must have a legal basis from among those specified in the GDPR. In the absence thereof, the processing is unlawful. These legal bases are: Consent of the Data Subject; Necessary for taking steps at the request of the Data Subject prior to entering into a contract or for the performance of a contract; Legal compliance; Protection of the vital interests of the Data Subject; In the exercise of official authority; In the protection of the legitimate interests of the Data Controller or a third party.

Data Controller: A natural or legal person, or organisation without legal personality, who or which, alone or jointly with others, determines the purposes, legal basis, and means of the processing of data (retention period, scope of data to be collected, processing method), makes and implements decisions concerning the processing (including the instruments used), or has them implemented by a Data Processor commissioned by it.

Marking of data: Supplying data with an identifying mark in order to distinguish it.

Destruction of data: The complete physical destruction of the data medium containing the data.

Erasure of data: Making data unrecognisable in such a manner that its restoration is no longer possible.

Transmission of data: Making data accessible to a specified third party.

Data protection representative: An employee of the Data Controller appointed by the organisation dealing with the protection of personal data.

Data Protection Officer: An expert designated by the organisation possessing knowledge of general and sectoral legislation concerning the protection of personal data. They may be an external contractor or an internal employee.

Blocking of data: Supplying data with an identifying mark in order to restrict its further processing permanently or for a specified period.

Data Subject: Any identified or – directly or indirectly – identifiable natural person on the basis of personal data.

Cloud service: An IT application service in the course of which the IT equipment executing the application and storing the data operates at a location remote from the user of the service, and the user has neither direct nor indirect influence over the manner of IT operation of such equipment.

GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. The Regulation is directly applicable in all EEA Member States, including Hungary.

Third party: A natural or legal person, or organisation without legal personality, other than the Data Subject, the Data Controller, or the Data Processor.

IT system: The totality of IT devices held by a given natural person or non-natural legal entity for the purpose of data recording, data processing, data transmission, or data access.

Freely Given Consent: A freely given, specific, and informed unambiguous indication of the Data Subject's wishes, by which they signify agreement to the processing of personal data relating to them, either comprehensively or covering specific operations. Consent satisfies the criterion of being freely given only where the Data Subject is not threatened by any external circumstance with any disadvantage should they refuse consent.

Personal data breach (Incident): An event where data security is breached in any way, resulting in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to, data stored, processed, or transmitted.

Contributor: A natural person who, as an employee of the Data Controller, or as an employee, representative, or sole trader of a subcontractor acting on behalf of the Data Controller, participates in the given data processing operation at the Data Controller.

Special category of personal data: The category of personal data defined by the GDPR that is subject to enhanced protection. Such data exclusively comprises the following: health data, political opinions, sexual orientation, religious beliefs, racial or ethnic origin, trade union membership, genetic data, criminal convictions and offences. This type of data is particularly sensitive and subject to enhanced protection, and the GDPR imposes specific administrative requirements in respect of processing operations involving such data.

Client: A natural person or any organisation that, as a data controller or data processor, uses the business services and core activities of the issuer of this Privacy Notice.

Filing system: The structured organisation and storage of data according to specific criteria.

Personal data: Any information relating directly or indirectly to the Data Subject – in particular by reference to the Data Subject's name, an identification number, or one or more factors specific to their physical, physiological, mental, economic, cultural, or social identity – as well as conclusions concerning the Data Subject that can be drawn therefrom. Information qualifies as personal data even if the Data Controller is unable, by its own means, to establish the indirect link between the data and the Data Subject, but doing so is theoretically possible with the aid of one or more databases compiled by a third party.

Service: The totality of business activities carried out by the Data Controller for which its clients enter into a contract or issue an order. Such activities include: software programming and systems development, application software systems provided as a cloud service, as well as its business line operated separately from the foregoing, which comprises services improving physical well-being.

Objection: A declaration by the data subject objecting to the processing of their personal data, and requesting the termination of the processing and/or the erasure of the processed data.

III. PRINCIPLES OF DATA PROCESSING

Personal data shall retain this quality during processing for as long as its relationship with the data subject can be restored, even indirectly, with the aid of data held by a third party or parties. The processing carried out by the Controller is lawful where it complies with all the principles set out in this section throughout its data processing.

During the processing, the Controller shall ensure the accuracy, rectifiability, integrity and security of the data, as well as ensure that the Data Subject's data can only be stored for the period necessary for the purposes of the processing.

Personal data may be processed by the Controller provided that the Controller has an appropriate legal basis for the processing.

The Data Subject is entitled to be informed of all material circumstances of the given processing operation, the primary source of which is this Privacy Notice.

The GDPR requires that every data processing operation complies with each of the following principles:

•      Lawfulness, fairness and transparency

•      Purpose limitation • Data minimisation

•      Accuracy.

•      Storage limitation

•      Integrity and data security

•      Accountability

III.1. Lawfulness, fairness and transparency

Personal data may only be processed subject to adequate information being provided to the Data Subject.

Prior to the commencement of processing, the Data Subject must be informed whether the provision of data is voluntary or mandatory by virtue of statutory requirement. The data subject must be informed clearly, intelligibly and in detail about all facts relating to the processing of their data, in particular the purpose and legal basis of the processing, the identity of the person authorised to act as controller and processor, the duration of the processing, and who may access the data (contributors and data subjects, third parties). The information must also cover the data subject's rights and available legal remedies in relation to data processing.

III.2. Principle of purpose limitation

The Controller shall process personal data solely for predefined and communicated purposes, in order to exercise rights and fulfil obligations. The Controller endeavours to ensure that only such personal data is processed as is essential and suitable for achieving the purpose of the processing. Personal data may only be processed to the extent and for the duration necessary to achieve that purpose.

III.3 Principle of data minimisation

The Controller is entitled solely and exclusively to collect Data that are indispensable for achieving the purpose defined by it. The lawfulness of such processing ceases once the purpose has been achieved, and accordingly, the Data must subsequently be destroyed and/or erased without delay, in compliance with statutory provisions.

III.4 Accuracy

The Controller must endeavour to maintain the accuracy and up-to-date nature of the Data it processes. To this end, it must design its processing operations in a manner that ensures compliance with this principle. Such procedures may include automated data checks against other databases and/or providing the Data Subject with the possibility to report changes, etc. The Controller shall afford the Data Subject the opportunity to rectify their data in respect of all of its processing operations.

III.5. Principle of storage limitation

The storage of data is permitted only until the purpose specified in the data processing documentation has been achieved, or as required by statutory provisions. Where the purpose of the processing has been achieved or the period prescribed by statutory provisions has expired, the data must be erased or destroyed.

III.6. Integrity and data security

The organisation is obliged to design its data processing operations in such a manner that, through appropriate data security procedures (e.g. passwords, lockable cabinets, clear desk policy, etc.), access to, modification of, and erasure of the personal data processed therein are ensured exclusively for designated contributors and the respective data subject. Furthermore, data processed by the organisation must not be accessible to anyone else. The fulfilment of this principle is primarily detailed in the General Data Security Provisions section of this Privacy Notice.

III.7. Accountability

The organisation carrying out the data processing is obliged to document all of its data processing operations in the manner laid down in the GDPR. This documentation must be submitted to the supervisory authority upon request.

IV. LEGAL BASIS OF THE PROCESSING

Every data processing operation must have a legal basis from among the legal bases laid down in the GDPR. In the absence thereof, the processing is unlawful. Legal bases:

a)      Consent of the data subject;

b)      Initiation of a contract by the data subject or necessary for the performance of a contract; c) Compliance with a legal obligation;

d)      Protection of the vital interests of the data subject or of another third party;

e)      In the exercise of official authority;

f)       Legitimate interests pursued by the Controller or a third party.

The transfer of data to a third party other than the Controller and its data processors, and the interconnection of databases created during different data processing operations, may be carried out if:

-       the data subject has consented thereto, or this is prescribed by law; and

-       the conditions of processing are met in respect of each individual personal data item.

Personal data may also be processed where obtaining the data subject’s consent is impossible or would involve disproportionate costs, and the processing of personal data is necessary for compliance with a legal obligation to which the controller is subject, or is necessary for the purposes of legitimate interests pursued by the Controller or a third party, and the enforcement of such interest is proportionate to the restriction of the right to the protection of personal data.

The Controller is obliged to comply with the statutory provisions governing the processing of data subjects' personal data at all stages of the data processing.

The data processing carried out by the Controller shall be governed at all times by the applicable provisions set out in the legislation in force.

V. DATA PROCESSING OPERATIONS

In the course of its activities, the Controller processes personal data collected from its employees and from Data Subjects who come into contact with it in a non-employee capacity in the following cases:

V.1. Processing of personal data relating to Employees and other Contributors

V.2. Processing of personal data of job applicants

V.3. Processing carried out as a controller for own purposes, necessary for the provision of business Services (Commercial and implementation activities)

V.4. Processing carried out as a data processor with data collected by its clients during the provision of business application and IT Services.

V.5. Processing carried out in the course of physical well-being improvement services

V.6. Data backup performed by the Controller

V.7. Website forms, email and postal processing operations

V.8. Processing related to complaint handling, enforcement of Data Subjects' rights, training, and quality assurance

V.9. Processing related to Google AdWords, Analytics and Website Cookie management.

V.10. Data processing of Facebook/LinkedIn/Twitter/YouTube applications

V.11. Asset protection of premises used for own purposes – by CCTV

V.12. Asset protection of premises used for own purposes – by alarm system

V.13. Sending of newsletters for marketing purposes

The location of data processing is the premises of Click On Hungary Kft. (hereinafter: the Controller; premises: 1021 Budapest, Kuruclesi út 14.)

V.1. Processing of personal data relating to Employees and other Contributors

-          Brief description of the processing: Under this data processing, the Controller performs the processing operations necessary to ensure that its internal operations comply with the legislation in force, and that it is able to monitor its employees and other contributors to ensure that their work accomplishes the objectives of the Controller and that their activities fully comply with the legislation in force.

-          Categories of data subjects involved in the processing: Data Subjects who act as employees or external contributors in order to achieve the Controller's business objectives.

The Data Controller shall store the personal data specified in this Section for the duration indicated in the table, and shall thereafter erase them. In respect of the personal data of external contributors, only the data indispensable for the performance of the contract and for legal compliance are collected from the above list.

-          Brief description of the processing and consequences of failure to provide data by the data subject: Without the provision of the data requested in this processing operation, the Data Controller cannot comply with statutory obligations in respect of the relevant employee or external contributor, and, in the case of external contributors, cannot engage their activities to achieve the Data Controller’s objectives, nor can it conduct spot checks on its employees or properly organise its business processes. In this case, if the relevant employee or external contributor refuses to provide the requested personal data, they cannot work for the Data Controller.

-          Description of data transfers and access by organisations outside the data controller by data category: The Data Controller may engage external data processors for payroll accounting, occupational health aptitude examinations, the operation of its IT and security equipment, and cleaning services, which are indicated in Annex 2 to this Notice. The Data Controller shall transfer the data processed by it to further third parties only pursuant to statutory provisions, e.g. the National Tax and Customs Administration (NAV), investigative authorities, courts, other public authorities, etc.

-          Does the Data Controller carry out profiling with the data? The Data Controller does not carry out profiling with the data processed in this processing operation.

-          Does the Data Controller carry out automated decision-making procedures with the data?

The Data Controller does not carry out automated decision-making procedures with the data processed by it.

V.2. Processing of personal data of job applicants

-          Brief description of the processing: In this data processing procedure, the Data Controller processes the data necessary for the application and suitability for the job position of persons applying for employment with the Data Controller.

-          Purpose of the processing: The purpose of the processing is the evaluation of the job application targeted by the applicant, and maintaining contact with the applicant.

-          Legal basis of the processing: The legal basis of the processing is the voluntary consent of the Data Subject (Article 6(1)(a) GDPR). This consent may be withdrawn by the Data Subject at any time in writing via email. For the Data Controller to process the withdrawal of consent, proper identification of the Data Subject is essential in order to prevent infringements.

-          Categories of data subjects involved in the processing: Data Subjects who apply for a position advertised by the Data Controller.

-          Categories of data processed: personal data of the applicant:

•     applicant's name;

•     place of birth;

•     date of birth;

•     mother’s birth name;

•     domicile;

•     place of stay;

•     contact details: telephone number, email address;

•     data of document(s) certifying educational qualifications;

•     any further personal data not requested by the data controller but provided by the data subject;

•     curriculum vitae and cover letter

•     employer's notes taken regarding the applicant during the recruitment process.

-          Duration of data processing: For 6 months from the conclusion of the evaluation of the job application, or until the withdrawal of consent (whichever occurs earlier). The 6-month retention period allows the Data Controller, in the event that the Data Subject is not selected, but the selected candidate nevertheless proves unsuitable for the job position and their employment relationship is terminated within the probationary period, to choose from among the other candidates who have already applied, without conducting a new recruitment process. Beyond the 6 months following evaluation, the data collected in this manner shall only be stored by the Data Controller if it has the applicant’s explicit, unambiguous, voluntary and written consent. (For example, awaiting further vacancies, the Data Subject permits the Data Controller to further store their data.) - Brief description of the processing and consequences of failure to provide data by the data subject: Without providing the data requested in this processing operation, the Data Subject cannot apply for positions advertised by the Data Controller.

-          Description of data transfers and access by organisations outside the Controller by data category: In connection with this activity, the Controller may engage an external service provider as a Processor. The identity of the Processor can be found in Annex 2 to this Notice, and may also be requested on site at the Controller's premises or by email from the employee responsible for data protection. The Controller shall only transfer data processed by it to further third parties where required by law, e.g.: the NAV, investigative authorities, courts, or other public authorities.

-          Does the Controller carry out profiling with the data?

The Controller uses the data collected in this manner to select the suitable candidate from among the Data Subjects applying for its advertised vacancies, and thus carries out profiling, the purpose of which is the selection of the appropriate employee.

-          The Controller does not carry out automated decision-making on the basis of the data processed by it.

-          Positions performing data processing:

•     employee or external contributor performing finance and payroll functions;

•     professional manager associated with the advertised position;

•     the managing director of the Controller.

V.3. Processing carried out for own purposes as a controller, necessary for the provision

of business Services (Commercial and implementation activities)

-          Brief description of the processing: This section summarises the processing essential for the commercial and implementation activities of the Controller's general business Services, where it acts as a controller. In the course of its business activities, the Controller contacts Data Subjects as potential customers. In such cases, contact is first made using the contact details provided by the Data Subjects or made public by them. These contact details, even if they were originally personal data, lose their character as personal data through their voluntary disclosure to the public. If provided to the Controller by the Data Subject, the Data Subject gives their voluntary consent to its processing by implied conduct, until such consent is withdrawn in writing (by email). If successful, the initial contact is followed by further personal communication prior to the order, along with the recording of the personal data of the relevant person, which is voluntarily provided by the Data Subject, and is therefore deemed by the Controller as consent by implied conduct. Thereafter, if an order is placed / a contract is concluded, the legal basis for the processing is the conclusion of a contract initiated by the Data Subject, or the performance thereof (Article 6(1)(b) of the GDPR). In connection with the order, the Controller also processes

the personal data recorded in this manner for the purpose of the related performance, subsequent warranty administration where applicable, or follow-up of the transaction concerned. The storage locations of the personal data are the Controller's email system, Wiki, and its own xFLOWer CRM system.

-          Purpose of processing: Fulfilment of the Controller's business objectives.

-          Legal basis for processing:

o   For data collected prior to placing an order / concluding a contract, the legal basis for processing is the consent of the Data Subject (Article 6(1)(a) of the GDPR), which may be withdrawn at any time in the absence of an order or contract. o In the event of an order or contract conclusion, the legal basis for all personal data included in the contracts and necessary for performance is the conclusion of a contract initiated by the Data Subject, or the performance thereof (Article 6(1)(b) of the GDPR),

o   Following the performance of the order or contract, when processing personal data contained in the contract, performance documents and invoices, the legal basis is compliance with a legal obligation (point (c) of Article 6(1) of the GDPR, Act CL of 2017 on the Rules of Taxation, Act C of 2000 on Accounting, and the provisions of Book Six of the Civil Code concerning warranties).

-          Categories of data subjects involved in the processing:

o   Data Subjects who contact the Controller in the context of business contact, concluding contracts, invoicing, provision of Services, or warranty administration.

-          Categories of data processed:

o   Data collected prior to placing an order / concluding a contract: name, email address, telephone number, job title, area of interest, and any data provided by the Data Subject about themselves or their colleagues. The Controller records these data in the email and Wiki system or in a spreadsheet.

o   Data processed in the event of an order or contract conclusion: personal data contained in the contract, invoice, certificate of performance, and personal data necessary for performance. The Controller records these data in the Wiki and its own xFLOWer CRM system.

o   Data processed following the performance of an order or contract: the categories of personal data used in the contract, for warranty administration, and on the invoice, which are recorded in the Wiki and its own xFLOWer CRM system.

-          Duration of processing:

o   For data collected prior to placing an order / concluding a contract: until the withdrawal of consent applicable to these data. o For data processed in the event of an order or contract conclusion: 9 years from the settlement of the final invoice pursuant to Section 169 of Act C of 2000 on Accounting.

o   For data processed following the performance of an order or contract: 9 years from the settlement of the final invoice pursuant to Section 169 of Act C of 2000 on Accounting, or, where the contract or statutory law provides for a longer warranty/guarantee period, until the expiry of such warranty period.

Upon the expiry of the processing period, the Controller shall promptly erase the personal data collected within this processing activity in accordance with statutory requirements.

-          Brief description of the consequences of failure by the Data Subject to provide data: Without providing the data requested in this processing activity, the Data Subject cannot enter into a business relationship with the Controller – or to the extent necessary for their work –, and the Controller is unable to perform the contracted activity.

-          Description of data transfers and access by organisations outside the Controller by data category: In connection with this activity, the Controller may engage an external service provider as a Processor. The identity of the Processors can be found in Annex 2 to this Notice, and may also be requested on site at the Controller's premises or by email from the employee responsible for data protection. The Controller shall only transfer data processed by it to further third parties where required by law, e.g.: the NAV, investigative authorities, courts, or other public authorities.

-          Does the Controller carry out profiling with the data? The Controller may group the personal data collected in this manner according to case/task, client, commercial and individual criteria. It may carry out profiling as a result of this activity.

-          Does the Controller carry out automated decision-making with the data? The Controller does not carry out automated decision-making on the basis of the data processed by it.

-          Positions performing data processing: employees or contributors handling the relevant Service, order/contract conclusion, as well as those participating in performance, and the executive management of the Controller.

V.4. Processing carried out as a processor involving data collected by clients during the provision of business applications and IT Services.

-          Brief description of the processing: The Controller's core activity is the provision of an IT application developed by it in on-premise and cloud deployments. In these application environments, the controller of the personal data contained therein, and the owner of the data, is the organisation ordering the application (hereinafter: the Customer). In the course of its business activities, the issuer of this Notice acts as a Data Processor when supporting these environments; therefore, in this processing section, Click On Hungary Kft. is hereinafter referred to as the Processor. The Processor is in all cases in a contractual relationship with the Customer, which clearly defines the tasks and obligations of the Processor. The contract is protected by business secrecy; therefore, regarding specific details, if the Data Subject wishes to learn the details of the processing of their personal data, they must contact the Customer as the data controller. The processor acts in all cases in such a manner as to adequately protect the data entrusted to it against both external and internal unauthorised access, to meet the Customer's requirements, and to comply with the statutory provisions applicable to it. For this purpose, it performs event and transaction logging during the operation of the application, and uses test data and anonymised data during its support activities wherever possible.

-          Purpose of data processing: The purpose of the data processing is set out in the relevant Client’s privacy notice. Acting as a data processor bound by an agency/service contract, it acts in the course of its activities solely for the data processing purposes specified therein and does not use the data processed in this manner for any other purpose.

-          Legal basis of data processing: In respect of this data processing, it acts as a data processor on the basis of a valid contractual relationship. The legal basis for the data processing must be ensured by the Client (data controller) in such cases, and the Data Subject may ascertain it from the Client’s privacy notice. The legal basis for the logging processing activity is either the relevant clause of the contract with the Client or, if the contract does not stipulate conditions for logging, compliance with a legal obligation (Article 6(1)(c) GDPR) prescribed by Act CVIII of 2001 on Electronic Commerce and Information Society Services.

-          Categories of data subjects involved in the processing: The categories of Data Subjects can be identified from the Client’s privacy notice.

-          Categories of processed data: In the course of its data processing activities, it processes data strictly necessary for the provision thereof. The precise scope of these data can be ascertained from the privacy notice of the Client (data controller). In accordance with statutory requirements and for the purpose of troubleshooting potential service errors, the Data Processor maintains logs recording the login username, timestamp, success or failure of the attempt, as well as the IP address and port number of the Data Subject.

-          Duration of data processing: During the contractual relationship and following its expiry, within the period stipulated therein, the Data Processor shall surrender the data entrusted to it to the Client and, where required by legislation, retain them in the manner prescribed by law. The Data Processor maintains backups of the applications accessible in the cloud service operated by it. In such cases, the Client’s data remain in the backup until the retention period specified in the section “Data backups performed by the Data Controller”, the processing of which can be consulted in that section. It does not retain any surrendered data for its own purposes thereafter, unless otherwise provided by law. In the case of an active data processor contractual relationship, the Data Subject may ascertain the exact retention period from the privacy notice of the Client (data controller). In terms of logging, the Data Processor adheres to statutory provisions prescribing a 12-month retention period, or, if the Client stipulates a longer retention period, acts in accordance with the Client’s instructions. The Data Subject may request further information in this regard from the Client (data controller). Logs reaching the prescribed retention period shall be deleted.

-          Brief description of the processing and consequences of failure to provide data by the data subject: The Data Subject may ascertain these circumstances from the privacy notice of the Client (data controller) organisation.

-          Description of data transfers and access by organisations other than the data controller, by category of data: In connection with this activity, the Data Processor may engage an external service provider as a Sub-processor. Such sub-processor is deemed accepted by the Client provided that no written objection is raised against it. The name of the Sub-processor is set out in Annex 2 to this Notice, in the list of data processors available on the Data Processor’s premises, or may be requested by email from the staff member responsible for data protection. The Data Processor transfers the data processed by it to further third parties solely on the basis of statutory obligations or the written instructions of the Client (data controller). The Data Subject may obtain further information in this regard from the privacy notice of the Client (data controller).

-          Does the Data Controller carry out profiling with the data? The Data Processor may only carry out profiling on the processed data based on the written instructions of the Client. The Data Subject may obtain further information on this from the privacy notice of the Client (data controller).

•     The Data Controller’s employee responsible for executive management;

•     The Data Controller’s employee performing expert, technical contributor, or auxiliary activities, or an external contributor supporting such activities, as set out in Annex 2 to the Notice.

V.5. Data processing in the course of physical wellbeing enhancement services

-          Brief description of data processing: The Data Controller provides physical wellbeing enhancement services as a separate business division. In the course of the service, acting as Data Controller, it collects standard and special categories of personal data (health data) of Data Subjects who use its service. The use of the Service is entirely voluntary. The Client organisation merely provides its employees with the opportunity to use the Service. Data subjects, as employees of the Client organisation, may voluntarily choose or refuse to use the service without any undue influence. The Data Controller has drawn the attention of the Client and the Data Subjects to the fact that an employer is not entitled to mandate the use of the Service offered by it for employees. Should the Data Controller become aware of any information indicating that use was made mandatory for employee Data Subjects, it shall suspend and/or terminate its activities at the Client with immediate effect. As health data collection is involved, this may occur solely with the voluntary consent of the data subject. For this reason, the Data Controller provides only anonymised and aggregated data concerning the participating employees to the Client. The Data Controller collects health data per Data Subject using smart health devices within an application of a dedicated cloud provider operating within the EU.

-          Purpose of data processing: The purpose of the Data Processing is to assess the health status of the relevant Data Subject and, following assessment, where requested, to improve and monitor it, and to provide feedback to the Data Subject. With the aid of aggregated and anonymised data, the Client may obtain a general overview of the overall physical fitness of its employees and subsequently monitor their general physical improvement.

-          Legal basis of data processing: In the case of this processing, the Data Controller’s legal basis for special categories of data (health data) is the voluntary consent of the data subject (Article 6(1)(a) GDPR). The form of voluntary consent is the Data Subject’s application to use the Service by email, based on the Client’s informational email. The withdrawal of voluntary consent may be initiated and executed independently by the Data Subject by indicating the withdrawal of voluntary consent to the Data Controller via email. In such cases, if necessary for identification purposes, the Data Controller may request supplementary data from the Data Subject and, following conclusive identification, shall erase the Data Subject’s health data.

In the case of standard personal data, the legal basis of processing prior to the commencement of the provision of the service is the voluntary consent of the data subject (Article 6(1)(a) GDPR). Once the Service has been performed and invoiced, the Data Controller shall retain the name of the Data Subject and the name of their employer in order to provide adequate supporting documentation for its issued invoice for the purpose of statutory compliance. For such data, the legal basis of data processing is compliance with a legal obligation (Article 6(1)(c) GDPR). The legal obligation is prescribed by the Accounting Act (Act C of 2000). .

-          Categories of data subjects involved in the processing: The Data Subjects are those Data Subjects designated by the Client who are entitled to use the Data Controller’s Service.

-          Categories of processed data: The Data Controller collects the name of the Client, the Data Subject’s name, sex, date of birth, contact details (email address, telephone number), health data indicative of their physical condition, and historical changes thereto.

-          Duration of data processing: With respect to health data, processing continues until the withdrawal of the Data Subject’s voluntary consent. In the case of data stored in documents supporting invoices under the Accounting Act, 9 years from the issuance of the invoice.

-          Brief description of the data processing, what would happen if the data subject fails to provide data: The Data Subject will not be able to use the Controller's Service.

-          Does the Controller perform profiling with the data? The Data Processor carries out profiling regarding changes in physical condition. This profile is disclosed exclusively to the Data Subject. The Customer is not entitled to access this profile.

V.6. Data backups performed by the Controller

-       Brief description of the data processing: Under this data processing activity, the Controller backs up all digitally stored data on computers or servers managed by it. By means of this data processing, absent any differing applicable contractual terms with the Customer, it is possible to restore the data of the application operated as a cloud service to a point in time of up to a maximum of 7 days prior. The Data Subject may ascertain this from the Customer's privacy notice. Backups from the Wiki system are handled separately by the Controller, as any partial destruction of educational materials stored therein would likely be detected only significantly later. The retention period for backups of the Wiki system is: 5 years. The backup retention period of the email system can be ascertained from the privacy notice of its data processor specified in Annex 2. The provider of the healthcare application undertakes a 5-year retention period in respect of healthcare data.

All data backups are stored in an encrypted form in a physically and logically segregated environment. Only the technical contributor designated for this purpose is authorised to restore backups, strictly on the basis of written instructions from the Managing Director. The restoration of a backup is in all cases documented in minutes, specifying the reason for restoration, date and time, and the scope of data concerned.

-       Purpose of the data processing: By backing up data, the Controller prepares for the prevention and mitigation of a partial or total IT disaster and data loss.

-       Legal basis of the data processing: Compliance with a legal obligation to which the Controller is subject (Article 6(1)(c) of the GDPR), constituting the organizational and technical measures required under the GDPR to prevent data loss as a personal data breach. (GDPR Regulation: pursuant to Article 4(12) of REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL).

-       Categories of data subjects involved in the data processing: Those Data Subjects whose data have been electronically recorded in the IT System of the issuer of this Notice, regardless of whether processing is carried out as a Controller or as a Data Processor. - Categories of processed data: Affects all information located on the servers used by the Controller, as the Controller has designed its backup procedure to create complete backups of the given directory structure in order to ensure the most complete recovery possible and ease of management.

-       Duration of data processing: For the Customer, absent any differing applicable contractual terms, data of the application operated as a cloud service can be restored to a point in time of up to a maximum of 7 days prior. The Data Subject may ascertain any such potentially longer retention period from the Customer's privacy notice. Backups from the Wiki system are handled separately by the Controller, as any partial destruction of data stored therein would likely be detected only significantly later. The retention period for backups of the Wiki and healthcare systems is: 5 years. The backup retention period of the email system can be ascertained from the privacy notice of its data processor specified in Annex 2. Following the expiry of the duration of data processing, the Controller shall promptly delete personal data collected under this data processing in accordance with statutory provisions.

-       Brief description of the data processing, what would happen if the data subject fails to provide data: The Data Subject does not provide any data within this data processing activity. This data processing is based on personal data collected in other data processing operations; therefore, the consequences described therein shall apply should the Data Subject refuse to provide their personal data. If data backup does not take place, the Controller cannot prepare for the prevention and mitigation of an IT disaster or data loss, which may even render its entire operation impossible.

-       Description of data transfers and access by organisations external to the Controller by data category: In connection with this activity, the Controller may engage an external service provider as a Data Processor. The name of the Data Processor can be found in Annex 2 to the Notice, on the list of data processors at the premises of the Controller, or may be requested via email from the staff member dealing with data protection. The Controller transfers data processed by it to further third parties only on the basis of statutory requirements.

-       Does the Controller perform profiling with the data? The Controller does not perform profiling with the Data Subject's data in this procedure.

-       Job roles carrying out data processing: IT specialist involved in backups, Managing Director.

V.7. Website form, email and postal data processing

-       Brief description of the data processing: The Controller processes data either with the consent of the Data Subject or on the grounds of other data processing activities listed in the Notice, in the case of website forms, emails and postal mail. Submission of the website form generates an email which is not stored on the web server, but solely on the email server, within the email solution of the data processor detailed in Annex 2 to the Notice. The respective contributor has the option to handle these emails in the cloud or downloaded to their own computer. Postal items are received, stored and answered sorted by topic.

-       Purpose of the data processing: Ensuring communication between the Controller and the Data Subject, including the storage and monitoring thereof.

-       Legal basis of the data processing: Where the Data Subject sends a postal letter, email or web form, or provides their email and postal address to the Controller in any other data processing procedure, they consent by implied conduct to the Controller storing such communications until further written withdrawal by the Data Subject. Accordingly, the legal basis of this data processing is the Data Subject's consent (Article 6(1)(a) of the GDPR). Where the Data Subject's consent is the legal basis, the Data Subject may withdraw it in writing at any time.

Where the postal letter and email communication of the Data Subject is linked to another data processing activity listed in this Notice, the legal basis for processing the personal data contained in the communication in question shall, instead of the Data Subject's consent, correspond to that of the relevant linked data processing activity.

Where the email or postal communication of the Data Subject infringes the legitimate interests of the Controller (e.g. unlawful act, illegal content, etc.), the legal basis for data storage shall, instead of the Data Subject's consent, be the legitimate interest of the Controller, namely data security (Article 6(1)(f) of the GDPR).

Data Subjects are advised that the Controller creates backups and archives of data generated in this data processing activity, from which point the provisions set out in the General data backup section shall apply to the data duplicated in this manner.

Where the legal basis of this data processing is the Data Subject's consent, the Data Subject may request the erasure of entries and personal data relating to them, which for security reasons may entail immediate verification prior to erasure; furthermore, the Controller can execute this request only from the environment performing this data processing, not from the backup system.

-       Categories of data subjects involved in the data processing: Those Data Subjects who wish to engage in written communication with the Controller.

-       Categories of processed data: Letters, emails, calendar entries, to-dos and other sent objects – documents – sent to the postal and email addresses of the Controller.

-       Duration of data processing: Data are stored from the date of creation until withdrawal of the Data Subject's consent, or in the manner and for the duration specified in other data processing operations. Where the legal basis during this data processing is the Controller's legitimate interest, such as data security, the Controller shall store personal data processed in this manner for 90 days, during which it decides whether or not it is necessary to take further legal steps. If the Controller takes further legal steps, it shall set the storage period for the data at 1 year following the final or legally binding closure of the matter concerned.

-       Brief description of the data processing, consequences of failure to provide data by the data subject: Without providing the data requested in the context of this data processing, the Data Subject cannot communicate in writing with the Controller or, where access is available, use its IT network.

-       Description of data transfers and access by organisations external to the Controller by data category: In connection with this activity, the Controller may engage an external service provider as a Data Processor. The designation of the Data Processor can be found in Annex 2 to this Notice, on the list of data processors at the Controller’s premises, or may be requested via email from the staff member responsible for data protection. The Controller shall transfer the data processed by it to further third parties only on the basis of statutory obligations.

-       Does the Controller perform profiling with the data? The Controller may carry out profiling using the data collected in this manner by categorising communications with regard to topics, persons, and timestamps.

-       Does the Controller carry out automated decision-making procedures with the data? The Controller does not carry out automated decision-making procedures with the data processed by it. - Positions performing data processing: Managing Director, IT employee or external contributor, and the contributor responsible for the relevant field as determined on the basis of the content of the communication.

V.8. Data processing related to complaint handling, the exercise of Data Subjects’ rights, training,

and quality assurance

-       Brief description of the data processing: In the case of notifications relating to complaint handling and the exercise of Data Subjects’ rights, the Controller stores, investigates, and takes action based on incoming complaints and requests for the exercise of rights to ensure regulatory compliance and on the grounds of its business interests. The first step in complaint handling and the exercise of rights is in all cases the proper identification of the Data Subject to determine whether the Data Subject concerned is entitled to submit the notification or request. The Controller endeavours to avoid requesting excessive amounts of data, but must verify whether the Data Subject concerned is entitled to submit the complaint or exercise the right, thereby avoiding committing an infringement precisely as a result of the Data Subject’s request. Such identification may consist of a few questions regarding the details of the case to which the complaint or exercise of rights relates, and/or certain identity data of the Data Subject. The Controller’s objective is to verify the Data Subject’s entitlement in relation to their submission. Following this, the Controller shall notify the Data Subject of the success or failure of the identification. If the Controller considers the Data Subject’s submission to be justified based on statutory requirements, it shall inform the Data Subject in writing of the time limit required for fulfilment—which may not exceed 30 days—and of any further prerequisites, if necessary. The Controller may only establish prerequisites for the Data Subject that are genuinely necessary, or requirements that are prescribed or permitted by law.

When processing data for training purposes, the Controller likewise creates training materials on the grounds of its legitimate business interests. Training materials may be prepared on any topic relating to its Services or organisational operations. Training materials may take the form of videos, images, presentations, and documents. A contributor may appear in a training video, as it forms part of the Data Subject’s activities to prepare training materials for the Controller on the topics assigned to them. Through these training materials, the Controller ensures the flow of information between itself and various contributors, as well as prospective or existing Clients. When producing training materials, it is not recommended for contributors to record their own image or video, as the message communicated and the displayed screen capture convey the instructional information. Situations may arise where, in addition to the contributor, a contributor of a specific Client also appears in the training video. In such cases, the video in question shall be accessible exclusively to the given Client and the Controller’s own contributors, and shall not be accessible to other Clients. If requested by the Client in writing, the relevant training video shall be deleted. Complaints and requests for the exercise of rights, as well as training videos, are stored in the Wiki system and retained until the time limits specified herein.

-       Purpose of data processing: The Controller’s purpose is to manage and process incoming complaints and requests for the exercise of rights, to take the necessary measures, and to demonstrate regulatory compliance. The purpose of processing data in training materials is to achieve business objectives.

-       Legal basis for data processing: Until the closure of the complaint or exercise of rights, the legal basis is compliance with a legal obligation to which the Controller is subject (Article 6(1)(c) GDPR), pursuant to Section 6:22 of Act V of 2013 on the Civil Code (Ptk.) and Section 17/A of Act CLV of 1997 on Consumer Protection. The legal basis for processing data relating to training materials is the legitimate interest pursued by the Controller, namely the fulfilment of the Controller’s business and ownership objectives (Article 6(1)(f) GDPR).

-       Categories of data subjects involved in the data processing: Data Subjects who lodge a complaint with or request the exercise of their rights from the Controller, as well as Data Subjects whose personal data in any form appear in a training material.

-       Categories of data processed: The Controller’s complaint handling and the exercise of Data Subjects’ rights are conducted in writing. This may take the form of minutes taken in person, or letters sent to postal and email addresses. The scope of processed data in all cases encompasses the data stored in relation to the entire case, which may be documents or digital recordings made by technical means. Such personal data may relate to the identification of the Data Subject, the description of the complaint or exercise of rights, its evaluation, etc. In the case of training materials, this includes the voice, and potentially the image, of the instructor or trained Data Subject, and any personal data relating to them that appears in the training material.

-       Duration of data processing: If complaints and requests for the exercise of rights relate to other data processing activities specified in the Notice, they shall be retained until the erasure period indicated therein, but for a minimum of 5 years following the closure of the complaint. If no retention period is specified for the documentation in question, the retention period shall be 5 years pursuant to Section 6:22 of Act V of 2013 on the Civil Code (Ptk.).

In the case of training materials, the retention period for training materials is indefinite, as it cannot be determined in advance for how long the relevant training material will be necessary for achieving the Controller’s business objective.

-       Brief description of the data processing, consequences of failure to provide data by the data subject: If the Data Subject does not consent to the recording in writing and processing of their complaint or request for the exercise of rights in the manner specified in the Notice, they will be unable to lodge a complaint or initiate the exercise of rights with the Controller. If the Data Subject, as a contributor of the Client, does not wish to have their personal data recorded in the training material, they shall submit this request in writing, and the Controller will produce the training material in such a way that their personal data are not recorded, or, if already recorded, will erase the personal data recorded in the training material. In the case of a contributor of the Controller, the creation of training materials forms part of the job description or contractual assignment; therefore, they may not object to this. However, the Controller strives for data minimisation and records only strictly necessary personal data in the training material, e.g. screenshot/board capture + speaker's voice, but not their video recording or photograph.

-       Description of data transfers and access by organisations external to the Controller by data category: In connection with this activity, the Controller may engage an external service provider as a Data Processor. The designation of the Data Processor can be found in Annex 2 to this Notice, on the list of data processors at the Controller’s premises, or may be requested via email from the staff member responsible for data protection. The Controller shall transfer the data processed by it to further third parties only on the basis of statutory obligations.

-       Does the Controller perform profiling with the data? The Controller may carry out profiling using the data collected in this manner by categorising data in relation to persons, cases, or time periods.

-       Does the Controller carry out automated decision-making procedures with the data? The Controller does not carry out automated decision-making procedures with the data processed by it. - Positions performing data processing: the executive officer of the Controller, and the Contributor concerned by the complaint. In the case of training materials, the Contributor participating in the training.

V.9. Data processing related to the management of Google AdWords, Analytics and Website Cookies.

-          Brief description of the data processing: The Controller uses cookies, as well as Google AdWords and Analytics solutions on the website in order to ensure the day-to-day operation of the website and for its marketing activities.

-          General purpose of the data processing: The purpose of using Google services is to increase website traffic and attract prospective customers. Google services also use cookies to collect personal data. The purposes of cookies are:

o   technical operation of the website o improving the website user experience with preference cookies o data collection for marketing purposes with third-party cookies

-          Legal basis of the data processing:

o   In the case of cookies strictly necessary for the operation of the website, the legal basis is the legitimate interest of the Controller (Article 6(1)(f) of the GDPR)

o   In the case of all other types of cookies, the legal basis is the consent of the Data Subject (Article 6(1)(a)

of the GDPR)

-          Categories of data subjects involved in the data processing: Data subjects involved in the processing are Data Subjects who visit the Controller’s website and those who click on the Controller’s advertisement within Google Ads.

-          Categories of personal data, purpose of use, and retention periods: During the browsing of the website, through the use of cookies placed on the Data Subject’s device, the following may be automatically recorded:

o   the start and end time of the Data Subject’s visit, o IP address,

o   and in certain cases – depending on the settings of the Data Subject’s computer – the type and language of the browser and operating system, the parameters of the Data Subject’s device, settings configured on the website by the Data Subject, subpages visited and time spent thereon.

The retention period of personal data listed in this table depends on the type of cookie. The

exact name and retention period of third-party cookies can be verified by the Data Subject based on the table in the third party's privacy policy, the link to which is indicated herein for assistance. The third party may, in its own right, alter cookie parameters without prior notice; however, the Data Subject may consult them at any time via the link provided in the table.

The primary details of the cookies and their retention periods grouped by function are as follows:

Strictly necessary for the proper functioning of the website

Necessary cookies help make our website usable by enabling basic functions such as page navigation and access to secure areas of the website. The website cannot function properly without these cookies.

Preference cookies

These cookies provide features that serve the Data Subject's convenience when using the website, such as remembering the Data Subject's progress on the website, or their preferred website settings, etc.

Marketing and/or third-party cookies

These cookies are used to track visitors across websites. The intention is to display ads that are relevant and engaging for individual users, thereby making our website more valuable to publishers and third-party advertisers.

The descriptions relating to the processing of personal data via cookies provided by third parties can be found by the Data Subject on the website of the third party (indicated under the service provider in the table). By way of assistance, at the time of issuing this Privacy Notice, they are accessible at the following links: https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage https://policies.google.com/privacy?hl=hu

https://policies.google.com/technologies/cookies?hl=en-US

Regarding the management of cookies, the Data Subject may find assistance, depending on the browser used, at the following links:

Internet Explorer: https://support.microsoft.com/hu-hu/help/17442/windows-internetexplorer-delete-manage-cookies

Firefox: https://support.mozilla.org/hu/kb/weboldalak-altal-elhelyezett-sutik-torleseszamito

Chrome: https://support.google.com/chrome/answer/95647?hl=en

-          Brief description of the data processing, consequences of failure to provide data by the data subject: Cookies are small text files downloaded onto the Data Subject's device upon using the website. These files are capable of further data collection from the metadata of websites viewed by the Data Subject. These data are transmitted to the owner of the cookie. o Without cookies strictly necessary for its operation, the website would not function properly or would not be sufficiently secure. o Without preference (convenience) cookies, the website requires the re-identification of the Data Subject upon each visit, does not remember viewed pages, or lacks other convenience functions, although the website would continue to function securely. o Without marketing cookies, the website cannot advertise itself online and cannot collect analytical information.

-          Description of data transfers and access by organisations outside the Controller by data category: The Controller performs the following international data transfers. In connection with the present activity, the Controller may engage external service providers as Data Processors. The designation of the Data Processor can be found in Annex 2 to the Privacy Notice, on the list of data processors available at the Controller’s premises, or may be requested via email from the staff member responsible for data protection. The Controller shall only transfer data processed by it to further third parties on the basis of a statutory requirement.

-          Does the Controller carry out profiling with the data? If so, for what purpose? The Controller does not carry out profiling, as it does not obtain data relating to individual Data Subjects concerning the visitors to the website.

-          Who may access personal data collected during data processing within the Controller's organisation? The contributor acting as the website administrator, the contributor providing IT support, and the managing director of the Controller.

V.10. Data processing of Facebook/LinkedIn/Twitter/YouTube applications

-       Brief description of the data processing: In the scope of this data processing, the Controller uses social media applications provided by third parties for marketing purposes, in order to strengthen its presence in the online space, build customer loyalty, and communicate its marketing messages to potential customers as widely as possible.

Applications used: Facebook, LinkedIn, Twitter, YouTube.

Each application operates on a similar principle. The Data Subject may indicate their like/follow/subscription to the Controller’s profile, that is, indicate their general interest towards the Controller. By indicating their interest, through implied conduct, the Data Subject provides their voluntary consent to the use of their data thus obtained for marketing purposes. The Data Subject grants their consent freely; they are not subject to any substantive influence, nor do they incur any significant, quantifiable business advantage or disadvantage in return for providing or withholding such indication of interest.

During the data processing, the Controller may access those parts of the personal data stored in the application of the Data Subject who has already indicated their interest which the Data Subject has configured in the given application as publicly viewable, and may segment the interested Data Subjects according to geographical, temporal, or other marketing criteria, as well as reach them with various marketing communications.

The data processing continues until the Data Subject terminates their indication of interest linked to the Controller's profile within the given application, thereby withdrawing their voluntary consent by conduct. The Controller treats the granting or withdrawal of the Data Subject's voluntary consent separately for each application; therefore, if the Data Subject withdraws their voluntary consent in one application, this applies solely to that application and the marketing messages and content contained therein. If they have also given their voluntary consent in another application, the Controller may still lawfully process their personal data through that application and engage in marketing communication with the Data Subject until the withdrawal of consent relating to that application.

-       Purpose of the data processing: The data processing takes place for marketing purposes, in order to strengthen its presence in the online space, foster customer loyalty, and communicate marketing messages to potential customers as widely as possible.

-       Legal basis of the data processing: The Data Subject’s voluntary consent (Article 6(1)(a) of the GDPR). The Data Subject may unilaterally withdraw this voluntary consent at any time.

-       Categories of data subjects involved in the data processing: Those Data Subjects who have indicated their like/follow/subscription intent, or their general interest, in the Facebook, LinkedIn, Twitter, and YouTube applications, thereby giving their voluntary consent to the Controller for the processing of their personal data for marketing purposes.

-       Scope of data processed: The Controller accesses the data permitted under the settings of the Data Subject's own profile within the given application.

-       Duration of data processing: Until the withdrawal of voluntary consent within the given application. - Brief description of the data processing, consequences of failure to provide data by the data subject: If the Data Subject does not grant their voluntary consent to the Controller, they cannot receive the Controller’s marketing messages via these applications.

Description of data transfers and access by organisations outside the controller by data category: Each of the companies owning the respective applications is an independent controller in its own right, and, together with the issuer of this Privacy Notice, qualifies as a joint controller in respect of the personal data that the issuer of this Privacy Notice may access within the given application, from the perspective of the Data Subject’s personal data stored in the respective application. Data Subjects are advised to carefully review their personal data settings within the given application to determine which data they keep publicly accessible. The privacy notices for the respective applications are available at the following links:

o   Facebook Inc. https://www.facebook.com/about/privacy o LinkedIn Corp. https://www.linkedin.com/legal/privacy-policy?trk=hb_ft_priv o Twitter Inc. https://twitter.com/en/privacy

o   YouTube (Google) https://policies.google.com/privacy?hl=hu

The Data Processor shall only transfer the data processed by it to further third parties on the basis of a statutory requirement.

-       Does the Data Processor carry out profiling with the data? The issuer of this Notice (Data Controller) may carry out profiling in respect of the Data Subjects' data, whether in terms of time, geographical location, or business activity and marketing, using the personal data of the Data Subjects obtained in this manner.

-       Does the Data Processor engage in automated decision-making procedures with the data? The issuer of this Notice (Data Controller) does not carry out automated decision-making procedures with the data processed by it.

-       Job roles performing data processing: The managing director of the issuer of this Notice (Data Controller), as well as the personnel entrusted with administering the respective applications.

V.11. Asset protection of properties used for own purposes – by camera

Brief description of the data processing: Under this data processing, the Data Controller records and stores video camera footage installed in the building(s) used by it for its own purposes in accordance with the statutory provisions. The contributors of the Data Controller and other Data Subjects entering the area monitored by cameras receive written information regarding the data processing carried out by the electronic surveillance system. An information notice regarding the use of the electronic surveillance system is displayed in a clearly visible, easily legible manner that facilitates orientation for third parties wishing to enter the premises.

-          Purpose of the data processing: Asset protection of properties used for own purposes – The purpose of surveillance and recording visual footage is to protect the life and physical integrity of persons present on the premises of the properties, as well as to protect persons present on the premises of the properties, the properties themselves, and the assets located on the properties. Within this framework, the purpose is to detect infringements, apprehend perpetrators in flagrante delicto, prevent unlawful acts, and furthermore to use such recordings as evidence in official proceedings in connection therewith.

-          Legal basis for data processing: The legal basis for the data processing is the legitimate interest of the Data Controller, which is the protection of persons and property. (Point (f) of Article 6(1) of the GDPR)

-          Categories of data subjects involved in the data processing: Those Data Subjects who enter the field of view of the cameras operating in or around the property (properties) used by the Data Controller for its own purposes.

-          Scope of data processed: Surveillance of the Data Subject entering the field of view of the Data Controller's cameras is carried out using an electronic surveillance system (cameras), during which visual recordings containing personal data are created. Date and time, movement, and facial image data of persons may be extracted from the recordings. The camera system is operated by the Data Controller, during which only authorised persons may access the data collected in this manner. No audio recording is made during recording. The system is capable of both live viewing and recording, including via the internet.

-          Duration of data processing: 30 business days, given that the Data Controller also has Clients providing financial and insurance services, and the supervisory authority of these organisations consequently regards the Data Controller as an organisation performing outsourced activities.

In respect of any camera, in the event of an incident, for an additional 30 days, or until the cessation of the legitimate interest of the Data Controller (e.g. until the conclusion of internal disciplinary proceedings, the termination of police or judicial proceedings, etc.).

-          Brief description of the data processing, what would happen if data provision by the data subject failed to occur: Without providing the data requested in this data processing, the Data Subject cannot access the properties managed by the Data Controller and equipped with cameras.

-          Description of data transfers and access by organisations outside the controller by data type: The Data Controller may engage an external service provider as a Data Processor in connection with this activity. The name of the Data Processor can be found in Annex 2 to this Notice, in the list of data processors available at the premises of the Data Controller, or may be requested by email from the internal colleague responsible for data protection. The Data Controller transfers the data processed by it to further third parties only on the basis of statutory provisions.

-          Does the Data Controller carry out profiling with the data? The Data Controller does not carry out profiling with the data collected in this manner.

-          Job roles performing data processing: Only the following persons are authorised to view images broadcast continuously by the cameras, to review recordings made and stored by the cameras, and to save recordings made and stored by the cameras: the managing director, as well as the personnel dealing with building security.

-          Data security measures:

o   The control unit is positioned in such a manner that it is physically protected against intrusion. o The control unit is positioned in such a manner that it can only be accessed via a VPN connection.

o   Viewing and reviewing the visual recordings is possible via remote login to the control unit. In such cases, the active monitor is positioned so that, during the broadcast of the visual recordings, no person outside the scope of authorisation can see them. o Surveillance and the reviewing of stored visual recordings may be monitored solely for the purpose of screening for unlawful acts and initiating the measures necessary for their cessation. No recordings of the images broadcast by the cameras may be made using any device other than the central recording unit.

o   Access to stored visual recordings may only take place in a secure manner, with a password and username, and in such a way that the identity of the person processing the data can be established. The reviewing of stored visual recordings and the backups made of visual recordings must be documented in the form of minutes. Upon the cessation of the grounds for authorisation, access to the stored visual recordings must be terminated without delay.

o   In the recording device, the operating system and the recorded footage run from separate hard drives.

o   Following the detection of an unlawful act, measures must be taken to preserve the recording made of the act and to initiate the necessary official proceedings without delay, and the authority must simultaneously be informed that a visual recording was made of the act.

Detailed data regarding the cameras is contained in Annex 3 to this Notice.

V.12. Asset protection of properties used for own purposes – by alarm system

-       Brief description of the data processing: Under this data processing, the Data Controller records and stores data generated by the alarm system installed in the buildings used by it for its own purposes in accordance with the statutory provisions.

-       Purpose of the data processing: Protecting access to assets and intellectual property located on the premises, thereby ensuring asset protection.

-       Legal basis for data processing: The legal basis for the data processing is the legitimate interest of the Data Controller, which is the protection of persons and property. (Point (f) of Article 6(1) of the GDPR)

The contributors of the Data Controller receive written information regarding data processing carried out via the alarm system.

-       Categories of data subjects involved in the data processing: Data Subjects arming and disarming the alarm system.

-       Scope of data processed: The data processed comprises the fact of arming/disarming, the Data Subject carrying it out, and the date and time thereof.

-       Duration of data processing: If no incident is reported, the data will be erased after 30 business days. In the event of an incident report, the data controller may store the data for a further 30

days, or until the conclusion of the relevant police or judicial proceedings.

-       Brief description of the data processing, what would happen if data provision by the data subject failed to occur: Without providing the data requested in this data processing, the Data Subject cannot use the alarm system installed in the property of the Data Controller.

-       Does the Data Controller carry out profiling with the data? The Data Controller does not carry out profiling with the personal data collected in this manner.

-       Job roles performing data processing: Persons authorised to view alarm system data: Managing Director.

-       Data security measures:

o The storage of and access to data processed in this manner is encrypted; authorised persons may only access it using a username and password. o The inspection of data must be carried out in such a way that unauthorised persons cannot access it.

V.13. Sending of marketing newsletters

-       Brief description of the data processing: In the present processing activity, the Data Controller outlines the main parameters of the newsletter sending operations operated by it for marketing purposes. The Data Subject provides their personal data with their voluntary consent in order to receive marketing newsletters. Voluntary consent may be withdrawn at any time by means of a declaration sent by email to the Data Controller from the previously provided email address. The Data Controller sends such marketing messages exclusively either to email addresses that are publicly and lawfully available or to email addresses provided by the Data Subject by means of voluntary consent.

-       Purpose of data processing: Initiating business contact, marketing branding, marketing communication, brand building.

-       Legal basis for data processing: The legal basis for the data processing is the voluntary consent of the Data Subject (point (a) of Article 6(1) of the GDPR). Voluntary consent may be given: via email to an employee or addressed to the central email address, or via the contact details of the data protection officer, or via an online web form, or in person. Voluntary consent may be withdrawn: via the link found in the newsletter.

-       Categories of data subjects involved in the data processing: Those Data Subjects who have given their voluntary consent and provided the necessary data, as well as those whose data are public pursuant to statutory provisions.

-       Categories of personal data processed: Name, email address, area of interest.

-       Duration of data processing: Until the withdrawal of voluntary consent.

-       Brief description of the data processing, consequences of failure to provide data by the data subject: If the Data Subject does not give their voluntary consent, they will not receive business newsletters from the Data Controller.

-       Does the Data Controller carry out profiling with the data? The Data Controller may categorise the data according to areas of interest; therefore, it carries out profiling with the personal data collected in this manner.

-       Job roles performing data processing: Managing Director, collaborator involved in data processing responsible for marketing activities.

VI. PROCESSING OF PERSONAL DATA FOR STATISTICAL PURPOSES

Unless statutory provisions provide otherwise, personal data processed within the framework of mandatory data processing may be received by the Hungarian Central Statistical Office for statistical purposes in a form allowing individual identification, and may be processed by it as provided by law.

Unless statutory provisions provide otherwise, personal data collected, received, or processed for statistical purposes may only be processed for statistical purposes. Detailed rules on the processing of personal data for statistical purposes are laid down by specific legislation.

VII. DATA PROCESSING BY PROCESSORS AND DATA ACCESS BY THIRD PARTIES

The Data Controller is entitled to engage Data Processors to perform specific sub-tasks. The list of Data Processors, their activities, and the types of data accessible by them are contained in Annex 2 to this Notice.

A decision based on the assessment of the Data Subject’s personal aspects may be made solely by automated data processing only if an opportunity for review is provided to the Data Subject during the decision-making process, in which case the review is conducted by a natural person.

Upon request by the Data Subject, the Data Controller shall provide information regarding the method applied during the decision made by automated data processing and the essence thereof. The Data Subject has the right to express their point of view.

The Data Controller does not engage in automated decision-making.

The Data Controller may carry out profiling activities in respect of processing operations where this is indicated in Section V of this Notice.

Profiling is not automated.

Upon request by the Data Subject, the Data Controller shall provide information regarding the method applied during profiling and the essence thereof. The Data Subject has the right to express their point of view and to request the Data Controller to modify its decision. In such a case, the Data Controller is obliged to reconsider its decision to ensure that it has fully complied with the conditions determined by it and with statutory provisions.

IX. RIGHTS OF DATA SUBJECTS AND THEIR ENFORCEMENT

The following section sets out the rights of Data Subjects and details the options for their enforcement. As a general rule, a Data Subject may only exercise any of their rights to an extent that does not infringe the rights of other Data Subjects. The Data Subject may request the enforcement of any of their rights in writing (by email, postal letter, or minutes drawn up on-site) from any employee of the Data Controller or from any data processor acting on behalf of the Data Controller; however, in order to expedite the process, it is recommended to contact the person designated in Section XII. The Data Controller shall be obliged to reply to the Data Subject's request, primarily in the same format in which the request was received (e.g. if received by post, the reply must also be sent by post). The reply must in all cases contain the outcome of the assessment of the request and, in the event of refusal, the detailed reasoning thereof, and/or the measures taken or planned on the basis of the request. If the Data Controller deems that further identification of the Data Subject is necessary, it shall draw up minutes jointly with the Data Subject and may request the presentation of a photographic identity document of the Data Subject. The minutes shall contain the personal data of the Data Subject, the fact that their identity has been verified, as well as their request and the actions taken in response thereto. If the fulfillment or refusal of the request involves several steps extended over time, several sets of minutes may be drawn up concerning the respective steps. The minutes shall always be prepared in two counterparts, one of which shall be retained by the Data Subject. Where future measures need to be taken that also affect the Data Subject (e.g. erasure of data), the deadlines therefor must also be stated. Minutes completed and signed by the Data Subject shall be filed by the Data Controller, shall not be used for any other purpose, and, in the event of any investigation by a supervisory authority, shall be made available to the authority as evidence.

RIGHTS OF DATA SUBJECTS Right to a transparent procedure

The Data Subject may familiarise themselves with the procedures for storing, handling, and processing personal data concerning them, and may receive comprehensive information regarding the data processing without prejudice to the rights of other Data Subjects. The Data Subject may exercise this right even prior to the commencement of data processing by reviewing the Data Controller's publicly available Privacy Notice/Policy, and may request further information from the person specified in Section XIII.

Right of access (inspection)

The Data Subject may inspect the records kept concerning them containing personal data, subject to prior arrangement with the Data Controller, without prejudice to the rights of other Data Subjects.

Right to obtain a copy

The Data Subject may request a copy of the unprocessed data collected about them. The Data Controller is obliged to provide a copy of the data collected about the Data Subject upon the Data Subject’s request; however, the provision of a copy of further derived data is at the Data Controller’s sole discretion. The Data Subject may not cause unreasonable costs for the Data Controller through repetitive requests for copies; if they nevertheless do so, the Data Controller may ask the Data Subject to reimburse the actual direct costs, but fulfillment of the request is in principle free of charge. The Data Controller must fulfill the request in the format in which it was received (e.g. if by post, then by post; if electronically, then electronically). In fulfilling the request, the information must be easily readable by the Data Subject and processable using widely used solutions.

Right to restriction of processing

In the event of a legal dispute with the Data Controller, the Data Subject may request the restriction of processing from the Data Controller without prejudice to the rights of other Data Subjects. In this case, the Data Controller shall block the data specified in the Data Subject’s written request. Following such blocking, the Data Controller shall not carry out any modification to the blocked data. Following the conclusion of the legal dispute, the data processing shall either continue or be terminated in accordance with the provisions of the decision resolving the dispute.

Right to object to data processing

The Data Subject may object to any part of, or the entirety of, the processing of their personal data by the Data Controller. In such a case, the Data Controller is obliged to examine the lawfulness of the designated data processing and, if it deems the objection justified, to terminate the data processing without undue delay.

Right to be informed about the profiling procedure

Where the Data Controller carries out such activity with their data, the Data Subject may request information from the Data Controller regarding the methods of the profiling procedure. In such a case, the

Data Controller is obliged to provide information on the criteria on the basis of which the creation of the profile takes place.

Right to be informed about the automated decision-making procedure

Where the Data Controller carries out such activity with their data, the Data Subject may request to be informed of the criteria on the basis of which the automated decision-making procedure operates.

Right to contest the automated decision-making procedure and to obtain human intervention

Where the Data Controller carries out such activity with their data, the Data Subject may contest the outcome of the automated decision-making procedure. In such a case, the Data Controller is obliged to have the relevant procedure re-examined and reviewed by an intervening natural person. The outcome of the review may also be identical to the outcome of the original procedure.

Right to data portability: The Data Subject has the right to request a copy of the personal data collected from them, without hindering the work of the Data Controller thereby. The data thus obtained must be accessible, readable, and processable by standard procedures for the Data Subject.

Right to erasure of data

The Data Subject has the right to request the erasure of personal data concerning them, where the legal basis for the Processing is:

-  the consent of the Data Subject, or

-  the performance of a contract initiated by the Data Subject, which contract ultimately was not concluded, or was concluded but has already been performed, and in each case there is no other legal basis for the Processing.

Where the legal basis for the Processing:

-  is a legal obligation,

-  is the legitimate interest of the Data Controller,

-  is the exercise of official authority or the performance of a task carried out in the public interest,

-  is based on the vital interests of the Data Subject, the erasure of personal data concerning the Data Subject shall not be possible.

Right to information

Data subjects may request information on the processing of their data. The primary tool of information towards the Data Subject is the Privacy Notice; furthermore, the data subject may request information from the data protection officer.

The Data Controller shall endeavour to ensure that data subjects receive information regarding the details of data processing prior to the processing taking place.

Upon request of the data subject, the Data Controller is obliged to provide information on the data concerning the data subject processed by it, their source, the purpose, legal basis, and duration of the data processing, the name and address of the data processor and its activity related to data processing, as well as – in the event of the transfer of the data subject's personal data – the legal basis and recipient of the data transfer.

The Data Controller is obliged to provide the information in an intelligible form, in writing upon the data subject's request to that effect, within the shortest possible time from the submission of the request, but at the latest within thirty (30) days. The provision of information is free of charge if the applicant has not yet submitted an information request regarding the same scope of data in the current year. In other cases, a fee reimbursement may be determined. The fee reimbursement already paid shall be refunded if the data were processed unlawfully or the request for information led to rectification.

The Data Controller may refuse to inform the data subject only if permitted by law. The Data Controller is obliged to communicate to the data subject the grounds for refusing the information, and is further obliged to inform the data subject of the possibilities of legal remedy.

Right to rectification

The data subject may request that the data controller rectify their inaccurate personal data. If regular data transmission takes place on the basis of the data to be rectified, the data controller shall, where necessary, inform the recipient of the data transmission of the rectification, and shall draw the data subject's attention to the fact that they must also initiate the rectification with other data controllers.

Enforcement of data subjects' rights

Where the Data Subject detects an infringement in the data processing, they may apply directly to the territorially competent court with their claim for damages, or lodge a complaint with the supervisory authority (National Authority for Data Protection and Freedom of Information, 1055 Falk Miska u. 9-11. Postal address: 1363 Budapest, Pf.: 9., tel: 391-14-00, e-mail: ugyfelszolgalat@naih.hu, web: http://naih.hu hereinafter: NAIH). Where the Data Subject turns to the NAIH, they acknowledge that the NAIH has no competence to award damages to compensate for the infringement of the Data Subject's rights. Should the Data Subject claim such damages, it is recommended to opt for applying to the competent court in connection with the alleged infringement.

X. GENERAL DATA SECURITY REQUIREMENTS

The issuer of this Notice, whether acting as a data controller or as a data processor, is obliged to ensure data security. To this end, it must take the necessary technical and organisational measures with regard to both data sets stored by means of IT equipment and those stored on traditional, paper-based data carriers.

To enforce the conditions of data security, the Data Controller ensures the adequate training of the employees concerned.

The measures set out in this section apply to all data processing operations described in the Notice. The Contributors have been informed of the introduced security rules and are obliged to comply with them, including:

-          Password protection of company smartphones

-          BIOS and HDD password protection of desktop computers and laptops

-          Username/password protection of operating systems

-          Password/username protection of applications – Clear Desk policy

-          Lockable cabinets and offices

-          Provision of antivirus and firewall solutions

-          Operation of data backups

-          Restriction of network access

-          Restriction of file-sharing access with username and password

-          Prohibition of the installation and use of applications outside the company application profile

-          Prohibition of non-company applications that request access to the contact lists of the device in question

-          The use of cloud services is permitted exclusively in the case of own or client corporate subscriptions, and/or subject to managerial instruction

-          Use of distinct passwords for different applications

-          Automated monitoring of the IT System

-          Application of multi-factor authentication for the enhanced protection of health data.

XI. ACTION REQUIRED UPON DETECTING AN INCIDENT

Should any Contributor to data processing or any Data Subject detect an incident or deem its occurrence probable, please report it without delay, but no later than the next business day, to the e-mail address of the data protection officer specified in Section XII. The Data Controller shall investigate the notification without delay, and if the incident is probable and poses a risk to any Data Subject, it shall notify the NAIH and the Data Subject within 72 hours, as well as take other necessary steps prescribed by law.

A personal data breach shall be deemed to include personal data being subject to:

-          unauthorised access/viewing

-          transmission to unauthorised persons

-          loss/erasure

-          unauthorised alteration/copying/use deviating from the purpose and manner of data processing.

XII. LEGAL REMEDIES, DATA PROTECTION EMPLOYEE AND OFFICER

The data subject may submit a request for information, rectification, erasure, or objection to the data protection officer.

Internal employee responsible for data protection at the Controller:

Szederkényi Zsolt adatvedelem@click-on.hu

The Controller shall provide the information within the shortest possible time from the submission of the request, but within a maximum of fifteen 30 days, in writing and in an intelligible form.

The Controller may not erase the data subject's data if the processing is mandatory under statutory law. The processing of data may be suspended pending the conclusion of the relevant proceedings. The processing of personal data relating to the Data Subject concerned shall be terminated if the Controller has agreed to the objection, or if the court has established the legitimacy of the objection.

The Controller shall compensate any damage caused to others by unlawful processing of the data subject's data or by breach of data security requirements. The Controller shall be exempt from liability if the damage was caused by an unavoidable cause outside the scope of data processing.

The Controller shall not be obliged to compensate damage to the extent that it resulted from the intentional or grossly negligent conduct of the injured party.

If the data subject does not agree with the Controller's decision, they may lodge a complaint or seek legal remedy with the Authority as specified in Chapter IX.

XIII. MONITORING

Compliance with data protection rules, in particular the provisions of this Notice, must be continuously monitored by the heads of the organisational units performing data processing activities at the Controller and by the Managing Director.

The data protection officer at the Controller is obliged to carry out an audit at least once a year.

XIV. REFERENCED LEGISLATION

Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR)

Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services

Act CLV of 1997 on Consumer Protection

Act LXVI of 1995 on Public Records, Public Archives and the Protection of Private Archive Material

Act C of 2000 on Accounting

Act CL of 2017 on the Rules of Taxation

Act I of 2012 on the Labour Code

Act V of 2013 on the Civil Code

Act CXXXIII of 2005 on the Rules of Private Security and Private Investigation Activities

XV. FINAL PROVISIONS

In matters not regulated in this Notice, the provisions of the referenced acts and the Civil Code shall apply.

This Notice shall enter into force on the day of its promulgation, as indicated on page 3 of the Notice, and simultaneously the previous privacy notice shall be repealed.

This Privacy Notice and the associated background materials are the intellectual property of Data Protection Officer György Földvári, and Click On Hungary Kft. is exclusively entitled to use them for business, but non-commercial purposes. Any use of this Notice and the associated background materials, in whole or in part, by another controller or processor without the permission of Beszerző Központ Kft or György Földvári, sole trader, is strictly prohibited!

Szederkényi Zsolt

Managing Director

ANNEXES

Annex 1: Record of Processing Activities

Annex 2: Detailed Description of Data Processors

Annex 3: Detailed Description of Cameras

Annex 4: Separate Privacy Notice on Video Surveillance

Annex 1: Record of Processing Activities

Joint controller in respect of data processing by Facebook, Google, LinkedIn, Twitter, YouTube is the owner of the respective application

Annex 2: Detailed presentation of Data Processors

I hereby certify that the information contained in this table is true and accurate in all respects.

Budapest, 22 November 2023

Managing Director, Data Protection Officer

Annex 3:

Detailed description of the surveillance cameras

Place of data processing:

1021 Budapest, Kuruclesi út 14.

Budapest, 24.10.2024

Annex No. 4:

PRIVACY NOTICE (extract) ON VIDEO CAMERA DATA PROCESSING

1.       Name and contact details of the data controller operating the video camera:

Click On Hungary Kft. (registered office: 1029 Táltos u. 23.; Place of data processing: 1021 Budapest, Kuruclesi út 14.; tax number: 22705033-2-41)

2.       Data protection officer of the data controller and contact details:

Szederkényi Zsolt at the email address adatvedelem@click-on.hu. 3. Purpose and legal basis of data processing

The purpose of using the video camera is the surveillance of the premises used by the Data Controller, in order to preserve the property and physical integrity of persons present therein, as well as the equipment, intellectual creations, and business secrets located there. The legal basis of the data processing is the legitimate interest of the Data Controller. (Point (f) of Article 6(1) GDPR)

4.       Specification of the legitimate interest The legitimate interest of the Data Controller is the protection of property—including equipment, intellectual creations, and business secrets located on the premises used by it—and the physical integrity of persons.

(protection of persons and property)

5.       Consequences of failure to provide data

If the Data Subject refuses this data processing, they will be unable to enter the premises operated by the Data Controller.

6.       Description of data processing, retention period and criteria for use, reasons for access

The                   video camera records continuously in accordance with the table referenced in Section 10. The device does not record audio. In the absence of an incident report, the recording shall be erased after 30 working days. In the event of an incident report, the Data Controller may store it for 30 days, or until the conclusion of the relevant police or court proceedings. The recordings may only be viewed by authorised persons in the event of an incident or upon a report by the relevant Data Subject.

7.       Designation of persons authorised to access

8.       The video recording may only be viewed by the managing director of the Data Controller, and, upon request, by the Data Subject concerned, exclusively in the event of prior notification of an incident, or pursuant to a written instruction/memorandum of the Data Controller.

9.       Rights of Data Subjects and options for legal enforcement During the processing of their personal data, the Data Subject is entitled to the rights detailed in this paragraph. The methods for exercising these rights comprise submitting a written and/or oral request or complaint to the Data Controller's staff, in particular to the person designated in Section 2 of this Privacy Notice.

If the Data Subject detects an infringement in the data processing, they may apply directly with a claim for compensation to the court having territorial jurisdiction, or lodge a complaint with the supervisory authority (Nemzeti Adatvédelmi és Információszabadság Hatóság, 1055 Budapest, Falk Miska u. 9-11, tel: 391-14-00, e-mail: ugyfelszolgálat@naih.hu, web: http://naih.hu hereinafter: NAIH). If the Data Subject turns to the NAIH, they acknowledge that the NAIH has no competence to award compensation to remedy an infringement of the Data Subject's rights. Should the Data Subject seek such compensation, we recommend applying to the competent court in connection with the alleged infringement.

The exercise of their own rights by the Data Subject must not impair the rights of other data subjects. In this Notice, we only provide a list of the rights that may be exercised in connection with this video camera data processing. These are the following: transparent procedure, right to request information, right to restriction of processing, right of access, right to obtain a copy, right to object to data processing. These rights are set out in detail in the Data Controller's privacy notice covering all data processing activities.

10.    Description of the location and operating parameters of the cameras

The                   Data Subject may consult the exact location, type, resolution, operation, and field of view captured by the video camera in the public notice available with the Data Controller's data protection officer and on the https://click-on.hu website, which can also be requested by email.

Budapest, 24.10.2024. Szederkényi Zsolt, Managing Director