ON THE RIGHTS OF THE DATA SUBJECT CONCERNING THE PROCESSING OF THEIR PERSONAL DATA
TABLE OF CONTENTS
CHAPTER I - IDENTIFICATION OF THE DATA CONTROLLER
CHAPTER II - IDENTIFICATION OF DATA PROCESSORS
1. Postal Services, Delivery and Parcel Shipping
CHAPTER III - ENSURING THE LAWFULNESS OF DATA PROCESSING
2. Data Processing Based on the Data Subject’s Consent
3. Data Processing Based on Compliance with a Legal Obligation
4. Facilitating the Rights of the Data Subject
CHAPTER V – INFORMATION ON THE RIGHTS OF THE DATA SUBJECT
INTRODUCTION
The Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the “Regulation”), requires that the Data Controller implement appropriate measures in order to ensure that any information relating to the processing of personal data is provided to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, and that the Data Controller facilitates the exercise of the rights of the data subject.
The obligation to provide prior information to data subjects is also prescribed by Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information.
By means of the information notice set out below, we comply with our legal obligations under the above-mentioned legislation.
This information notice shall be published on the Company’s website or provided to the data subject upon request.
CHAPTER I
IDENTIFICATION OF THE DATA CONTROLLER
The issuer of this information notice, and at the same time the Data Controller:
Company name: SECURUS HUNGARY Zrt.
Registered office: 1134 Budapest, Váci út 47/b.
Business premises: 5100 Jászberény, Nagykátai út 35
Company registration number: Cg.01-10-048354
Tax number: 24961514-2-41
Representative: Szatmári Eszter
Telephone: +36 57 411-844
Fax: +36 57 412-996
E-mail: securus@securus.hu
Website: www.securus.hu
(hereinafter referred to as: the Company)
CHAPTER II
IDENTIFICATION OF DATA PROCESSORS
Data processor: a natural or legal person, public authority, agency, or any other body which processes personal data on behalf of the Data Controller; (Regulation, Article 4(8))
The use of a data processor does not require the prior consent of the data subject, but the data subject must be informed. Accordingly, we provide the following information:
1. Postal services, delivery, parcel shipping
These data processors receive from the Company the personal data necessary for delivering the ordered product (the data subject’s name, address, and telephone number) and use it solely for the purpose of delivering the product.
These service providers:
Company name: Magyar Posta Zrt.
Registered office: 1138 Budapest, Dunavirág utca 2-6.
Company registration number: 01-10-042463
Tax number: 10901232-2-44
Courier services:
1.
Company name: Agrogalgaker Kft.
Registered office: 2193 Galgahévíz, Fő út 178.
Company registration number: 13-09-172015
Tax number: 12228832-2-13
2.
Company name: TNT Express Hungary Kft.
Registered office: 1185 Budapest II, Logistics Center – Office Building, BUD International Airport, Building 283
Company registration number: 01-09-068137
Tax number: 10376166-2-44
3.
Company name: Express One Hungary Kft.
Registered office: 1239 Budapest, Európa utca 12.
Company registration number: 01-09-980899
Tax number: 13947109-2-43
CHAPTER III
ENSURING THE LAWFULNESS OF DATA PROCESSING
1. Data processing based on the consent of the data subject
(1) If the Company intends to carry out data processing based on consent, the data subject’s consent to the processing of personal data must be requested in accordance with the content and information set out in the data request form specified in the data management policy.
(2) Consent is also considered given if the data subject, while accessing the Company’s website, ticks a relevant checkbox, performs technical settings when using information society services, or makes any other statement or action which clearly indicates consent to the intended processing of personal data in the given context. Silence, pre-ticked boxes, or failure to act do not constitute consent.
(3) Consent covers all data processing activities carried out for the same purpose or purposes. If data processing serves multiple purposes simultaneously, consent must be obtained for all processing purposes.
(4) If the data subject gives consent within a written declaration that also relates to other matters – e.g., conclusion of a sales or service contract – the request for consent must be presented in a manner clearly distinguishable from other matters, in an understandable and easily accessible form, using clear and plain language. Any part of such a declaration that violates the Regulation shall not be legally binding.
(5) The Company may not make the conclusion or performance of a contract conditional upon consent to the processing of personal data that is not necessary for the performance of the contract.
(6) The withdrawal of consent must be as easy as giving it.
(7) If personal data has been collected based on the data subject’s consent, the Data Controller may process the collected data for compliance with its legal obligations without additional consent and even after the withdrawal of the data subject’s consent, unless otherwise provided by law.
2. Data processing based on compliance with a legal obligation
(1) In the case of data processing based on a legal obligation, the scope of data that may be processed, the purpose of processing, the storage period, and the recipients are governed by the provisions of the relevant legislation.
(2) Data processing based on compliance with a legal obligation is independent of the data subject’s consent, as the processing is mandated by law. In such cases, the data subject must be informed prior to the commencement of processing that the processing is mandatory. The data subject must be clearly and fully informed in advance of all facts related to the processing of their data, in particular the purpose and legal basis of processing, the person authorized to process or handle the data, the duration of processing, whether the personal data are processed under a legal obligation, and who may access the data. The information must also cover the data subject’s rights and available remedies. In cases of mandatory processing, this information may be provided by referring to the relevant statutory provisions containing the above details.
3. Facilitation of the rights of the data subject
The Company is obliged, in all its data processing activities, to ensure that the rights of the data subject can be effectively exercised.
CHAPTER IV
PROCESSING OF VISITOR DATA ON THE
COMPANY’S WEBSITE – INFORMATION ON THE USE OF COOKIES
1. Visitors to the website must be informed about the use of cookies on the website, and, except for technically essential session cookies, their consent must be obtained.
2. General information on cookies
2.1. A cookie is a piece of data sent by the visited website to the visitor’s browser (in name-value format) for storage, which the same website can later retrieve. A cookie may have a limited lifespan, lasting until the browser is closed, or it may persist indefinitely. Subsequently, the browser sends this data to the server with every HTTP(S) request. In this way, it modifies data stored on the user’s device.
2.2. The purpose of a cookie is that, due to the nature of web services, it is necessary to identify a user (e.g., that they have logged into the site) and manage their experience accordingly. The risk lies in the fact that the user may not always be aware of this, and the cookie may allow the website operator or other embedded service providers (e.g., Facebook, Google Analytics) to track the user, thereby creating a profile. In such cases, the content of the cookie may be considered personal data.
2.3. Types of cookies:
2.3.1. Technically essential session cookies: These are cookies without which the website would not function properly. They are necessary to identify the user, e.g., to manage whether they are logged in, what they have added to the shopping cart, etc. Typically, this involves storing a session ID, while other data is kept on the server, which is more secure. There is a security aspect: if the session cookie value is not properly generated, there is a risk of session hijacking attacks. Therefore, it is essential that these values are correctly generated. In other terminology, “session cookies” often refer to all cookies that are deleted when the browser is closed (a session is one browser usage from start to exit).
2.3.2. Preference cookies: These are cookies that remember the user’s choices, for example, how the user prefers to view the website. Essentially, these cookies store configuration or setting data.
2.3.3. Performance cookies: Although not directly related to “performance,” this term generally refers to cookies that collect information about a user’s behavior on the website, such as time spent and clicks. These are typically third-party applications (e.g., Google Analytics, AdWords, or Yandex.ru cookies). They may be used to create profiles of visitors.
More information about Google Analytics cookies can be found here:
https://support.google.com/analytics/topic/14089939?hl=hu&ref_topic=14090456
More information about Google AdWords cookies can be found here:
https://ads.google.com/intl/hu_hu/start/overview-ha/
2.4. Acceptance or enabling of cookies is not mandatory. You can adjust your browser settings to reject all cookies or to notify you when a cookie is being sent. Although most browsers accept cookies automatically by default, these settings can usually be changed to prevent automatic acceptance and to offer you the choice each time.
Information on cookie settings for the most popular browsers can be found at the following links:
• Google Chrome
• Firefox
• Microsoft Edge
• Safari
However, please note that certain website functions or services may not work properly without cookies.
3. Information on the Cookies Used on the Company’s Website and the Data Generated During Visits
3.1. Scope of Data Processed During the Visit:
During the use of the website, our Company may record and process the following information about the visitor and the device they use for browsing:
- the IP address used by the visitor,
- the type of browser,
- characteristics of the device’s operating system used for browsing (set language),
- the time of the visit,
- the visited (sub)page, function, or service,
- clicks.
These data are retained for a maximum of 90 days and may primarily be used for the investigation of security incidents.
3.2. Cookies used on the website
3.2.1. Technically essential session cookies
Purpose of data processing: To ensure the proper functioning of the website. These cookies are necessary for visitors to navigate the website and use its functions and services smoothly and fully. This includes, among other things, remembering actions performed by the visitor on the website or identifying a logged-in user during a visit. The duration of data processing for these cookies applies only to the current visit of the visitor; upon the end of the session or closing the browser, this type of cookie is automatically deleted from the computer.
The legal basis for this data processing is Section 13/A (3) of Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services (Elkertv.), which provides that the service provider may process personal data that are technically necessary for providing the service. The provider must, under otherwise identical conditions, select and operate the tools used in providing information society services so that personal data are processed only if it is strictly necessary for providing the service and achieving other purposes defined in this law, and even in such cases, only to the extent and for the duration required.
3.2.1. Preference cookies:
These cookies remember the user’s choices, for example, how the user prefers to view the website. Essentially, these cookies store configuration or setting data.
Legal basis for data processing: The visitor’s consent.
Purpose of data processing: To improve service efficiency, enhance the user experience, and make website usage more convenient.
These data are primarily stored on the user’s device; the website only accesses them and may use them to recognize the visitor.
3.2.2. Performance cookies:
These cookies collect information about the user’s behavior on the website, such as time spent and clicks. They are typically provided by third-party applications (e.g., Google Analytics, AdWords).
Legal basis for data processing: The data subject’s consent.
Purpose of data processing: Website analysis and delivery of advertising offers.
CHAPTER V
INFORMATION ON THE RIGHTS OF THE DATA SUBJECT
I. Summary of the Data Subject’s Rights:
- Transparent information, communication, and facilitation of the exercise of the data subject’s rights
- Right to prior information – if personal data is collected from the data subject
- Information to the data subject and information to be provided if personal data is not obtained from the data subject
- Right of access of the data subject
- Right to rectification
- Right to erasure (“right to be forgotten”)
- Right to restriction of processing
- Obligation to notify regarding rectification, erasure, or restriction of processing of personal data
- Right to data portability
- Right to object
- Automated individual decision-making, including profiling
- Limitations
- Notification of the data subject in the event of a data breach
- Right to lodge a complaint with a supervisory authority (right to an administrative remedy)
- Right to an effective judicial remedy against a supervisory authority
- Right to an effective judicial remedy against a controller or processor
II. Az érintett jogai részletesen:
1. Transparent information, communication, and facilitation of the exercise of the data subject’s rights
1.1. The controller must provide the data subject with all information and each communication regarding the processing of personal data in a concise, transparent, intelligible, and easily accessible form, using clear and plain language, particularly for any information addressed to a child. The information shall be provided in writing or by other means, including, where appropriate, electronically. Upon request, oral information may also be provided, provided the identity of the data subject is otherwise verified.
1.2. The controller shall facilitate the exercise of the data subject’s rights.
1.3. The controller shall provide information to the data subject on the actions taken on a request to exercise their rights without undue delay and in any event within one month of receipt of the request. This period may be extended by two further months where necessary, taking into account the complexity and number of the requests, and the data subject shall be informed of any such extension.
1.4. If the controller does not take action on the data subject’s request, they shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and of the possibility for the data subject to lodge a complaint with a supervisory authority and to seek a judicial remedy.
1.5. The controller shall provide information, communication, and action on the data subject’s rights free of charge, although a fee may be charged in cases provided for in the Regulation.
Detailed rules are provided in Article 12 of the Regulation.
2. Right to Prior Information – if Personal Data is Collected from the Data Subject
2.1. The data subject has the right to be informed about the facts and information related to data processing prior to the commencement of data processing. In this context, the data subject shall be informed of:
a) the identity and contact details of the controller and, where applicable, the controller’s representative,
b) the contact details of the data protection officer (if any),
c) the purposes of the intended processing of personal data, as well as the legal basis for the processing,
d) in the case of processing based on legitimate interests, the legitimate interests of the controller or a third party,
e) the recipients or categories of recipients of the personal data, if any,
f) where applicable, the fact that the controller intends to transfer personal data to a third country or international organization.
2.2. To ensure fair and transparent processing, the controller shall provide the data subject with the following additional information:
a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
b) the data subject’s rights to request access to and rectification, erasure, or restriction of processing of their personal data, to object to the processing, and the right to data portability;
c) in the case of processing based on consent, the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal;
d) the right to lodge a complaint with a supervisory authority;
e) whether the provision of personal data is part of a statutory or contractual requirement or a prerequisite for entering into a contract, and whether the data subject is obliged to provide the personal data, as well as the possible consequences of failure to provide such data;
f) the existence of automated decision-making, including profiling, and at least in these cases, meaningful information about the logic involved and the significance and envisaged consequences for the data subject.
2.3. If the controller intends to process personal data for purposes other than those for which they were collected, the data subject shall be informed prior to the further processing about the different purpose and any relevant additional information.
Detailed rules on the right to prior information are contained in Article 13 of the Regulation.
3. Information to the Data Subject if Personal Data is Not Obtained from Them
3.1. If the controller did not obtain the personal data from the data subject, the controller shall provide the data subject with the information referred to in section 2 at the latest: within one month of obtaining the personal data, at the first communication with the data subject, if the personal data is used to contact the data subject, or when the personal data is first disclosed to another recipient, if such disclosure is envisaged. The controller shall also inform the data subject about the categories of personal data, the source of the personal data, and, where applicable, whether the data come from publicly accessible sources.
3.2. The provisions outlined in section 2 (Right to Prior Information) shall apply accordingly to any further details.
Detailed rules for this notification are provided in Article 14 of the Regulation.
4. Right of Access of the Data Subject
4.1. The data subject has the right to obtain confirmation from the controller as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data and the related information referred to in sections 2 and 3. (Article 15 of the Regulation)
4.2. Where personal data are transferred to a third country or to an international organization, the data subject has the right to be informed of the appropriate safeguards pursuant to Article 46 of the Regulation.
4.3. The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs.
Detailed rules on the right of access are set out in Article 15 of the Regulation.
5. Right to Rectification
5.1. The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning them.
5.2. Considering the purposes of processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.
These rules are set out in Article 16 of the Regulation.
6. Right to Erasure (“Right to be Forgotten”)
6.1. The data subject has the right to obtain from the controller the erasure of personal data concerning them without undue delay, and the controller shall have the obligation to erase personal data without undue delay where:
a) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
b) the data subject withdraws consent on which the processing is based and where there is no other legal ground for the processing;
c) the data subject objects to the processing and there are no overriding legitimate grounds for the processing;
d) the personal data have been unlawfully processed;
e) the personal data must be erased to comply with a legal obligation under Union or Member State law to which the controller is subject;
f) the personal data have been collected in relation to the offer of information society services directly to a child.
6.2. The right to erasure shall not apply if processing is necessary:
a) for exercising the right of freedom of expression and information;
b) for compliance with a legal obligation which requires processing under Union or Member State law or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
c) for reasons of public health in the public interest;
d) for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, insofar as the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
e) for the establishment, exercise, or defense of legal claims.
Detailed rules on the right to erasure are set out in Article 17 of the Regulation.
7. Right to Restriction of Processing
7.1. Where processing is restricted, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State.
7.2. The data subject has the right to obtain from the controller restriction of processing where one of the following applies:
a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
c) the controller no longer needs the personal data for the purposes of processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims; or
d) the data subject has objected to processing pending verification of whether the controller’s legitimate grounds override those of the data subject.
7.3. The data subject shall be informed before the restriction of processing is lifted.
The applicable rules are set out in Article 18 of the Regulation.
8. Obligation to Notify Regarding Rectification, Erasure, or Restriction of Processing
The controller shall communicate any rectification, erasure, or restriction of processing of personal data to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about these recipients upon request.
These rules are set out in Article 19 of the Regulation.
9. Right to Data Portability
9.1. The data subject shall have the right, in accordance with the conditions set out in the Regulation, to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used, and machine-readable format, and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:
a) the processing is based on consent or on a contract; and
b) the processing is carried out by automated means.
9.2. The data subject may request the direct transmission of personal data from one controller to another where technically feasible.
9.3. The exercise of the right to data portability shall not adversely affect the rights and freedoms of others and shall not prejudice the right to erasure (Article 17). The right to data portability does not apply where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Detailed rules are set out in Article 20 of the Regulation.
10. Right to Object
10.1. The data subject shall have the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them based on public interest or the performance of a task carried out in the public interest or in the exercise of official authority (Article 6(1)(e)) or on the basis of legitimate interests (Article 6(f)), including profiling based on those provisions. In such a case, the controller shall no longer process the personal data unless they demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.
10.2. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning them for such marketing, including profiling to the extent that it is related to such direct marketing. If the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
10.3. The data subject shall be explicitly informed of their right to object at the latest at the first communication and in a clear and prominent manner, separately from other information.
10.4. The data subject may exercise the right to object by automated means based on technical specifications.
10.5. Where personal data are processed for scientific, historical research, or statistical purposes, the data subject shall have the right to object to processing on grounds relating to their particular situation, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
The applicable rules are set out in the Regulation.
11. Automated Individual Decision-Making, Including Profiling
11.1. The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.
11.2. This right shall not apply if the decision:
a) is necessary for entering into or performance of a contract between the data subject and the controller;
b) is authorized by Union or Member State law to which the controller is subject, which also lays down suitable measures to safeguard the data subject’s rights, freedoms, and legitimate interests; or
c) is based on the explicit consent of the data subject.
11.3. In the cases referred to in points a) and c), the controller shall implement suitable measures to safeguard the data subject’s rights, freedoms, and legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express their point of view, and to contest the decision.
Further rules are set out in Article 22 of the Regulation.
12. Limitations
Union or Member State law may restrict the scope of the rights and obligations provided by the Regulation to the controller or processor, by legislative measures, if such a restriction respects the essence of the fundamental rights and freedoms.
The conditions for such limitations are set out in Article 23 of the Regulation.
13. Notification of the Data Subject in the Event of a Data Breach
13.1. Where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay. This communication shall describe the nature of the personal data breach in clear and plain language and at least contain:
a) the name and contact details of the data protection officer or other contact point where more information can be obtained;
b) a description of the likely consequences of the personal data breach;
c) a description of the measures taken or proposed by the controller to address the personal data breach and, where appropriate, to mitigate its possible adverse effects.
13.2. The data subject shall not be informed if any of the following conditions are met:
a) the controller has implemented appropriate technical and organizational protection measures, and those measures were applied to the personal data affected by the breach, in particular measures that render the data unintelligible to any person who is not authorized to access it, such as encryption;
b) the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of the data subject is no longer likely to materialize;
c) communication would involve disproportionate effort. In such cases, the data subjects shall be informed by public communication or similar means, ensuring the same level of protection.
Further rules are set out in Article 34 of the Regulation.
14. Right to Lodge a Complaint with a Supervisory Authority
The data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or place of the alleged infringement, if the data subject considers that the processing of personal data relating to them infringes the Regulation. The supervisory authority with which the complaint has been lodged shall inform the data subject of the progress and outcome of the complaint, including the right to an effective judicial remedy.
These rules are set out in Article 77 of the Regulation.
15. Right to an Effective Judicial Remedy Against a Supervisory Authority
15.1. Without prejudice to any other administrative or non-judicial remedy, every natural and legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.
15.2. Without prejudice to any other administrative or non-judicial remedy, every data subject shall have the right to an effective judicial remedy if the competent supervisory authority does not handle the complaint or does not inform the data subject within three months of the progress or outcome of the lodged complaint.
15.3. Proceedings against a supervisory authority shall be brought before the courts of the Member State in which the supervisory authority has its seat.
15.4. If proceedings are brought against a decision of a supervisory authority for which the Board has previously delivered an opinion or adopted a decision under the consistency mechanism, the supervisory authority shall forward that opinion or decision to the court.
These rules are set out in Article 78 of the Regulation.
16. Right to an Effective Judicial Remedy Against a Controller or Processor
16.1. Without prejudice to any available administrative or non-judicial remedies, including the right to lodge a complaint with a supervisory authority, every data subject shall have the right to an effective judicial remedy if they consider that their rights under this Regulation have been infringed as a result of the processing of their personal data.
16.2. Proceedings against a controller or processor shall be brought before the courts of the Member State in which the controller or processor has an establishment. Such proceedings may also be brought before the courts of the Member State of the data subject’s habitual residence, unless the controller or processor is a public authority acting in the exercise of its public powers in a Member State.
These rules are set out in Article 79 of the Regulation.
Dated, Jászberény, 24 May 2018
