Privacy Policy

Issued by OM Education & Consulting Kft.

for the https://www.bookbase.app/ , https://thegoal.co/ website and the KönyvKlub / BookBase / The Goal Mobile Application operated at these addresses

PRIVACY NOTICE

INTRODUCTORY PROVISIONS, PURPOSE AND SCOPE OF THE NOTICE

OM Education & Consulting Kft, a business company (hereinafter: Controller/Company), uses this privacy notice (hereinafter: Notice) to inform data subjects of its data processing practices on the website or mobile application operated at https://www.bookbase.app , https://thegoal.co .

The Controller considers the data provided by its natural person subscribers/visitors, and in particular the processing of personal data, to be of the utmost importance; accordingly, it treats personal data confidentially and takes all necessary – technical and organisational – measures to ensure data security. In this context, the Controller undertakes that the data processing set out in the Notice complies with the applicable – Hungarian and European Union – legislation.

The Controller is entitled to change the Notice and its content at any time. It publishes the version of the Notice in force on its website at https://www.bookbase.app , https://thegoal.co before the change enters into force, and informs data subjects of this on its website. The Controller accepts the contents of the Notice as binding on itself and complies with them when processing personal data.

The Controller welcomes questions about the Notice at the e-mail addresses below, or at its further contact details given in point II:

hello@onlinemarketinges.com

The Controller's data processing is governed primarily by the following legislation:

• Regulation (EU) 2016/679 of the European Parliament and of the Council (27 April 2016) (hereinafter: GDPR),
• Act CXII of 2011 on the right to informational self-determination and on freedom of information (hereinafter: Privacy Act),
• Act V of 2013 on the Civil Code (hereinafter: Civil Code),
• Act C of 2000 on accounting (hereinafter: Accounting Act)
• Act CLXIV of 2005 on trade (hereinafter: Trade Act)
• Act CLV of 1997 on consumer protection (hereinafter: Consumer Protection Act)
• Act CVIII of 2001 on certain issues of electronic commerce services and information society services (hereinafter: E-Commerce Act)
• Act XLVIII of 2008 on the basic requirements and certain restrictions of commercial advertising activities (hereinafter: Advertising Act)
• Act CL of 2017 on the rules of taxation (hereinafter: Taxation Act)
• Act CLIX of 2012 on postal services (hereinafter: Postal Act)
• Act CVIII of 2001 on certain issues of electronic commerce services and information society services (E-Commerce Act)

Purpose of the Notice: it sets out the principles governing the processing of the data of the natural persons (data subjects) whose data the Controller processes, and informs data subjects of the rights they have against the Controller in relation to their personal data and how to exercise them, of the personal data processed by the website, and of the Controller's contact details and the legal remedies needed to exercise those rights.

Temporal scope of the Notice: from 2026.02.09 until revoked, or until the Notice is amended.

Personal scope of the Notice: the personal scope of the Notice covers the Controller and all natural persons affected by the Controller's data processing.

Material scope of the Notice: the material scope covers all data processing by the Controller, whether electronic or paper-based.

Before subscribing on the website / in the mobile application, please also read the general terms and conditions (GTC) carefully. Before subscribing, the subscriber (data subject) must expressly accept the GTC and must consent to the data processing on the basis of the information in the Privacy Notice (by ticking the appropriate boxes).

IDENTITY AND CONTACT DETAILS OF THE CONTROLLER AND THE HOSTING PROVIDER

CONTROLLER:

Name: OM Education & Consulting Kft.

Registered office: 3300 Eger, Koháry István utca 19. 1. emelet 6

Tax number: 28775704-2-10

Company registration number: 10-09-038258

Electronic contact: hello@onlinemarketinges.com

HOSTING PROVIDER:

Company name: Amazon Web Services Inc.

Postal address: 10 Terry Avenue North, Seattle, WA 98109-5210

Electronic contact: https://aws.amazon.com/

DEFINITIONS

The definitions of the most important terms used in the Notice are set out below:

data subject: a natural person who is identified, or identifiable, on the basis of any information.

personal data: any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

data subject rights: the right to information, the right of access to personal data, the right to rectification, the right to erasure, the right to restriction of processing, the right to data portability, the right to withdraw consent, the right to object including to profiling, the right to apply to a court or to the Authority, the time limits and procedural rules for these, compensation, and damages for non-pecuniary loss.

controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

processing: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

data transfer: making data available to a specified third party.

processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

erasure of data: making data unrecognisable in such a way that it can no longer be restored – whether from a paper or an electronic record-keeping system.

profiling: any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

recipient: a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing.

third country: any state that is not an EEA state.

consent of the data subject: any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her. Consent may be withdrawn at any time, free of charge and without any conditions.

personal data breach (GDPR): a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

Subscriber: a person who, for the service(s) offered by the Provider on a subscription basis, pays the subscription fee after registration and uses the website and mobile application in full.

Website: The website operated by the Provider at the internet addresses https://www.bookbase.app , https://thegoal.co

Mobile Application: The mobile application named KönyvKlub / BookBase / The Goal, available for download from the App Store and Google Play.

Service: all of the electronically accessible service(s) provided on the website / in the mobile application operated by the Provider under a subscription system, which the Subscriber is entitled to access, for as long as the subscription relationship is in force, with the content and functionality corresponding to their subscription plan

PRINCIPLES, LEGAL BASIS AND DURATION OF DATA PROCESSING

Under the provisions of the GDPR, the data processing principles that the Controller respects and applies as binding on itself are the following:

Principle of lawfulness, fairness and transparency: personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject.

Principle of purpose limitation: personal data may be collected only for specified, explicit and legitimate purposes and must not be processed in a manner that is incompatible with those purposes

Principle of data minimisation: personal data must be adequate and relevant in relation to the purposes of the processing, and limited to what is necessary.

Principle of accuracy: personal data must be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes of the processing, are erased or rectified without delay.

Principle of storage limitation: personal data must be stored in a form which permits identification of data subjects for no longer than is necessary to achieve the purposes for which the personal data are processed.

Principle of integrity and confidentiality: personal data must be processed in a manner that ensures appropriate security of the personal data through appropriate technical or organisational measures, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.

Principle of accountability: the controller is responsible for compliance with the principles listed above and must be able to demonstrate that compliance.

Principle of necessity and proportionality: in essence, it is the same as the principle of data minimisation.

Legal bases for data processing under the GDPR

Any one processing operation may have only one legal basis. Article 6(1) of the GDPR provides for the choice of legal basis (listing the 6 possible legal bases); the list, however, does not establish any ranking among the legal bases. Following the order used in the GDPR, we set out the 6 possible legal bases, illustrating each with an example.

1. the data subject has given consent to the processing of his or her personal data for one or more specific purposes
2. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
3. processing is necessary for compliance with a legal obligation to which the controller is subject
4. processing is necessary in order to protect the vital interests of the data subject or of another natural person
5. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
6. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child

The Controller states the legal basis for the personal data it processes separately for each processing activity in section V of the Notice.

Duration of data processing

As with the legal bases of processing, the Controller also states the duration of processing separately for each processing activity in the Notice, regardless of whether the processing is based on the data subject's voluntary consent, the performance of a contract, mandatory processing required by law, or legitimate interest.

IN CONNECTION WITH OPERATING THE WEBSITE / MOBILE APPLICATION, THE CONTROLLER PROCESSES THE FOLLOWING PERSONAL DATA:

V.1./ Registration on the website / in the mobile application

Registration and a subscription are required for full access to the website and the mobile application.

• legal basis for processing: the data subject's voluntary consent (GDPR Article 6(1)(a).
• source of the data: directly from the data subject.
• purpose of processing: secure login to the user account, identification, keeping in contact, access to the full service.
• consequence of not providing the data: registration fails
• recipients of the personal data:

For the website, the hosting provider:

Company name: Amazon Web Services Inc. (Postal address: 10 Terry Avenue North, Seattle, WA 98109-5210, Electronic contact: https://aws.amazon.com/) for the purpose of registration: under GDPR Article 6(1)(b), the processing is necessary for the performance of the contract.

For the mobile application:

Google LLC. ( Postal address: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, electronic contact: https://about.google/company-info/contact-google/) for the purpose of registration: under GDPR Article 6(1)(b), the processing is necessary for the performance of the contract.

Apple Inc. ( Postal address: One Apple Park Way, Cupertino, CA 95014, USA, electronic contact: https://support.apple.com/contact) for the purpose of registration: under GDPR Article 6(1)(b), the processing is necessary for the performance of the contract.

• data transfer to a third country: Accordingly, in connection with registration the data subject acknowledges and is aware that they provide the personal data required for registration of their own volition and at their own responsibility, on the understanding that the data will be transferred to third countries. Legal safeguards for the data transfer are provided by the EU–US Data Privacy Framework, which complies with the EU data protection rules (GDPR).
• automated decision-making, profiling: the Company does not carry out processing of this kind; it does not score data subjects or classify them into different categories on the basis of any system, criterion, etc. during registration.

The data subject may withdraw at any time the voluntary consent given in writing via the website in respect of the personal data named in this point and for the stated purpose of processing, by a written statement sent to any of the Controller's contact details given in point II, or, as described above, by deleting their user account. Withdrawal of consent is free of charge and not subject to any condition; however, withdrawal of consent does not affect the lawfulness of processing before the withdrawal.

V/2. Issuing invoices in connection with Advance Purchases

The Controller issues invoices to subscribers on the website in connection with the sale of the service it distributes. It processes and stores the invoice in its invoicing system for the period required by the legislation in force.

• legal basis for processing: the processing is necessary for compliance with a legal obligation to which the Controller is subject (GDPR Article 6(1)(c), having regard to Section 169 (2) of the Accounting Act
• source of the data: directly from the data subject.
• purpose of processing: issuing a document certifying payment of the consideration for the service, and fulfilment of the Controller's accounting obligations.
• consequence of not providing the data: the natural person purchasing the service cannot receive an invoice in their name.
• recipients of the personal data:

Invoicing software:

Company name: Billingo Technologies Zártkörűen Működő Részvénytársaság (Postal address:1133 Budapest, Árbóc utca 6., Electronic contact: hello@billingo.hu) for the purpose of issuing invoices: under GDPR Article 6(1)(b), the processing is necessary for the performance of the contract.

Technical data processing related to subscriptions:

RevenueCat Inc. ( Postal address: 548 Market St #94496, San Francisco, CA 94104, USA, electronic contact: https://www.revenue-inc.com/contact/) for the purpose of managing subscriptions: under GDPR Article 6(1)(b), the processing is necessary for the performance of the contract. Legal safeguards for the data transfer are provided by the EU–US Data Privacy Framework, which complies with the EU data protection rules (GDPR).

• data transfer to a third country: none
• automated decision-making, profiling: the Controller does not carry out processing of this kind; it does not score data subjects or classify them into different categories on the basis of any system, criterion, etc. during invoicing.

In the case of a subscription in the mobile application, we inform data subjects that the invoice will be issued directly by Google LLC. or Apple Inc., over which the Controller has no influence. In this case the contract is concluded directly with the said Companies, and their privacy notices apply.

V/3. Online card payment

For purchases on the website, the Controller provides online card payment on the basis of a contract concluded with a third-party external service provider. In connection with this online card payment, the Controller processes the following data relating to the Data Subject who completes a subscription on the website and pays by online card payment:

The Controller has no access to the bank card data used during online card payment and, under the rules of the International Card Companies, is not entitled to know it. This card data is processed and stored by the payment service provider in an environment compliant with PCI DSS certification.

• legal basis for processing: the data subject's voluntary consent (GDPR Article 6(1)(a).
• source of the data: directly from the data subject.
• purpose of processing: payment of the consideration for the service, so that the full service becomes available to the Subscriber
• consequence of not providing the data: The full content of the Service does not become accessible, as the data subject cannot subscribe.
• recipients of the personal data:

For the website, the hosting provider:

Company name: Amazon Web Services Inc. (Postal address: 10 Terry Avenue North, Seattle, WA 98109-5210, Electronic contact: https://aws.amazon.com/) for the purpose of fulfilling the subscription: under GDPR Article 6(1)(b), the processing is necessary for the performance of the contract.

Payment service provider:

Company name: Stripe Inc. (Postal address: 354 Oyster Point Blvd, South San Francisco, CA 94080, USA, Electronic contact: https://support.stripe.com//) for the purpose of fulfilling the subscription: under GDPR Article 6(1)(b), the processing is necessary for the performance of the contract.

• data transfer to a third country: Accordingly, in connection with the subscription the data subject acknowledges and is aware that they provide the personal data required for the subscription of their own volition and at their own responsibility, on the understanding that the data will be transferred to third countries. Legal safeguards for the data transfer are provided by the EU–US Data Privacy Framework, which complies with the EU data protection rules (GDPR).
• automated decision-making, profiling: the Company does not carry out processing of this kind; it does not score data subjects or classify them into different categories on the basis of any system, criterion, etc. during online payment

In the case of a subscription in the mobile application, we inform data subjects that the payment is handled directly by Google LLC. or Apple Inc., over which the Controller has no influence. In this case the contract is concluded directly with the said Companies, and their privacy notices apply.

V/4. Marketing database, newsletter, sending advertising, marketing analytics

The Controller is entitled to send newsletters and other marketing messages to natural person data subjects who, during or after registration, have expressly consented to receiving marketing and advertising messages by ticking a checkbox provided specifically for this purpose. The data subject may withdraw their previously given consent at any time, without any conditions, by a written statement sent to any of the available contact details, or by clicking the “Leiratkozom/Unsubscribe” link provided for this purpose in the newsletter – usually at its end – as described there. The newsletters sent by the Controller are general and uniform newsletters, and the Controller carries out no profiling of data subjects in connection with sending them.

In the mobile application, the data subject may allow the receipt of “push” messages. If this is allowed, the Controller's mobile application periodically sends “push” notifications to the data subject's device. The data subject can switch off the receipt of “push” messages at any time.

In our mobile application and on our website we process certain data for marketing and analytics purposes, so that we can better understand our users' behaviour and improve the quality of our services. For this we use third-party service providers, which process the data solely for predefined purposes, for example:

• to measure user activity in the application or on the website,
• to analyse the performance of marketing campaigns,
• for fraud prevention and security checks.

The data may generally include technical identifiers, browser and device data, and information related to actions performed in the application or on the website. Users have the right to access their data, to request its erasure or the restriction of its processing, and to object to the processing in accordance with the applicable legislation.

We do not carry out profiling on the basis of the data; we use it solely for statistical purposes to improve the user experience, and we process it anonymously.

• legal basis for processing: the data subject's voluntary consent (GDPR Article 6(1)(a).
• source of the data: directly from the data subject.
• purpose of processing: presenting the latest features of the Service, and sending reminders and other marketing materials that may interest data subjects.
• consequence of not providing the data: The data subject is not directly informed about the latest features of the Service or other marketing materials.
• recipients of the personal data:

E-mail campaigns, sending notifications:

Company name: Customer.io Inc.. (Postal address: 921 SW Washington St #820, Portland, OR 97205, USA, Electronic contact: https://customer.io/) for the purpose of sending marketing materials and push messages and running e-mail campaigns: under GDPR Article 6(1)(a), the processing takes place with the data subject's consent. Legal safeguards for the data transfer are provided by the EU–US Data Privacy Framework, which complies with the EU data protection rules (GDPR).

Marketing analytics measurement

Company name: Adjust Gmbh. (Postal address: Saarbrücker Straße 37a, 10405 Berlin, Germany, Electronic contact: privacy@adjust.com.) measuring marketing campaigns and user behaviour: under GDPR Article 6(1)(a), the processing takes place with the data subject's consent.

• data transfer to a third country: Accordingly, in connection with subscribing to marketing and the newsletter, the data subject acknowledges and is aware that they provide their data of their own volition and at their own responsibility, on the understanding that the data will be transferred to third countries.
• automated decision-making, profiling: the Company does not carry out processing of this kind; it does not score data subjects or classify them into different categories on the basis of any system, criterion, etc. for marketing purposes.

V/5. Data processing related to the Célok AI (Goals AI) feature

The so-called Célok AI (Goals AI) feature is available on both our website and our mobile application, through which you can easily access your personalised learning path at any time. When using it, you first describe your personal goal, for example “start a business” or “improve productivity”. The AI then asks 5–6 contextual questions in order to understand your situation and needs precisely. Based on your answers, the AI generates a personalised learning path with daily micro-tasks that help you reach the goal step by step. We continuously track your progress so that the difficulty of the tasks and the recommendations can always be optimally adjusted to your development.

Using the feature is solely the subscriber's decision; you are not obliged to use it, and once you have started it you can switch it off at any time.

• legal basis for processing: the data subject's voluntary consent (GDPR Article 6(1)(a),
• source of the data: directly from the data subject.
• purpose of processing: use of the CélokAi feature
• consequence of not providing the data: the CélokAi feature cannot be used
• recipients of the personal data:

For the website, the hosting provider:

Company name: Amazon Web Services Inc. (Postal address: 10 Terry Avenue North, Seattle, WA 98109-5210, Electronic contact: https://aws.amazon.com/) for use of the CélokAi feature: under GDPR Article 6(1)(a), the processing takes place on the basis of the data subject's consent.

Owners of the artificial intelligence systems used by CélokAi:

Company name: OpenAI LLC. (Postal address: 3180 18th Street, San Francisco, CA 94110, USA, Electronic contact: https://help.openai.com/en/collections/3742473-chatgpt) for use of the CélokAi feature: under GDPR Article 6(1)(a), the processing takes place on the basis of the data subject's consent.

Company name: Anthropic PBC (Postal address: 548 Market St, PMB 90375, San Francisco, CA 94104, USA Electronic contact: https://support.claude.com/en/) for use of the CélokAi feature: under GDPR Article 6(1)(a), the processing takes place on the basis of the data subject's consent.

• data transfer to a third country: Accordingly, by using the CélokAI feature the data subject acknowledges and is aware that they provide their data of their own volition and at their own responsibility, on the understanding that the data will be transferred to third countries. As regards the transfer of data, the Data Processing Agreement (DPA) undertaken by the above-mentioned companies ensures that the data processing and data transfer comply with the requirements of the GDPR.
• automated decision-making, profiling: The artificial intelligence (AI) used by the Controller carries out profiling in order to help the data subject achieve their personal goals. By using the CélokAI feature, the data subject acknowledges and expressly consents to this profiling. The data subject may withdraw this consent at any time, without any conditions. CélokAI works solely from the answers provided, the significance of which is that it defines the data subject's goals and how to achieve them as precisely as possible. As a result, the data subject will be aware of how they can achieve their goals.

V/6. Requests for information, complaints, quality objections (in electronic form)

The Controller also allows data subjects interested in its product to request information from it on any other subject not falling within the scope of a request for quotation, and to communicate their complaints. Requests for information may be made at the e-mail address hello@onlinemarketinges.com.

• legal basis for processing: the data subject's voluntary consent (GDPR Article 6(1)(a),
• source of the data: directly from the data subject.
• purpose of processing: providing information (a reply) to the data subject and the contact necessary for this
• consequence of not providing the data: the request for information fails
• data transfer to a third country: none
• automated decision-making, profiling: the Controller does not carry out processing of this kind; it does not score data subjects or classify them into different categories on the basis of any system, criterion, etc. in connection with the above.

SECURITY OF DATA PROCESSING, PERSONAL DATA BREACHES

The Controller hereby informs data subjects that, pursuant to Article 32(1) of the GDPR and Recital (83) of the GDPR, it has taken and continuously takes all technical and organisational measures within its power to ensure the protection of personal data in connection with processing in accordance with the requirements of the GDPR and to minimise the likelihood of personal data breaches.

In the course of the processing carried out for the purposes and on the legal bases listed in point V, the Controller also continuously ensures that the level of protection of data subjects' data meets the level required by law.

If, despite the Controller's data security efforts listed in this point, a personal data breach occurs for any reason, the Controller will, in line with the severity of the breach, immediately take the measures prescribed by law.

In the event of a personal data breach, depending on its severity (where the breach is likely to result in a high risk to the data subject), it will notify the data subjects without delay and will also make the notification with the required content to the Authority within the prescribed 72 hours.

Those of the Controller's staff and employees who process personal data may carry out their tasks related to the processing of personal data only after signing a confidentiality declaration.

HANDLING OF COOKIES

What is a COOKIE?

A COOKIE is a small file that the websites visited store on the visitor's ( for the purposes of this chapter this category includes anyone who visits the site only for browsing, the Business that registers on the site, and the Customer) computer, smartphone, tablet (hereinafter: device), etc. Their use ensures that the provider can display the website content with the content expected by the visitor, (providing the user experience) and in addition they make the visitor's browsing more efficient, help to display content matching the user's interests, and are also necessary, for example, for language settings and for using (playing) audio and video files. In addition, we share data about the visitor's use of the website with our social media, advertising and analytics partners, who may combine it with other data that the visitor has provided to them or that they have collected from other services used by the visitor. By continuing to browse the website, the Business consents to the use of cookies. Cookies have numerous functions and different lifetimes, and a great many types are known.

On this basis we distinguish (without claiming to be exhaustive), for example:

1. Essential cookies help make websites usable by enabling basic functions such as page navigation and access to secure areas of the website. The website cannot function properly without these cookies.
2. By collecting and reporting data anonymously, statistical cookies help the website owner understand how visitors interact with the website. The use of these cookies helps the Controller operating the website to develop and maintain the site's system and optimise its performance.
3. By using preference cookies we can remember information that changes how the website behaves or looks, for example the visitor's preferred language or the region in which they are located.
4. There are also cookies created by third parties, for example certain social networking sites such as Facebook, which for example make it possible to track the effectiveness of advertisements. Through the use of these cookies the Controller does not see the personal data of individual users. This data is stored and processed by Facebook, which may also link it to the data subject's user account or use it for its advertising purposes in accordance with Facebook's data use policy. The data subject may allow Facebook and its partners to display advertisements on and off Facebook. This category also includes marketing cookies, which are used to track visitors' website activity. The aim is to display relevant advertisements to individual users and to encourage them to take action, which in turn makes websites more valuable to the publishers of content and to third-party advertisers.

Having regard to Section 155 (4) of Act C of 2003 on electronic communications (Electronic Communications Act) - “Data may be stored on, or data stored there may be accessed on, the electronic communications terminal equipment of a subscriber or user only on the basis of the consent of the user or subscriber concerned, given after clear and comprehensive information – also covering the purpose of the data processing.”- if you do not wish to allow cookies to be placed, the Controller will not place cookies on your device. Restricting cookies naturally means, however, that the website content will be available not with the content and in the form the visitor wishes to display, but only in a kind of “restricted mode” in comparison, and certain functions will not be available at all, or only partially.

Cookies often store settings related to websites, such as the default language or location. When you return to the website, the browser sends the cookies related to that website. This allows the website to provide personalised information.

By default, the collection and sending of data by cookies is unnoticeable to the user. However, it is possible to change the settings in browsers, as a result of which requests to store cookies, or to delete them when the browser is closed, among others, can be approved or rejected.

Your browser can also be set so that cookies can be created only with the visitor's consent, or are rejected in general. It should be noted, however, that without cookies certain areas of the website can be used only to a limited extent or not at all. The Business can control the use of cookies and, if necessary, prevent it by configuring browsers as follows:

• Microsoft Edge

1. Select the ’Settings” menu item
2. Click the ’Cookies and site permissions’ tab
3. By clicking ’Manage and delete cookies and site data’ you can set whether cookie data is allowed.

• Google Chrome

1. Click the Chrome menu and select the ’Settings’ menu item on the browser toolbar
2. Click the ’Privacy and security’ menu item
3. Within it, by selecting ’Third-party cookies” you can allow or block cookies

• Firefox

1. Select the ’Settings’ option
2. Click the ’Privacy & Security’ panel
3. next to ’Cookies and Site Data’ you can make the desired settings

• Opera

1. Select the ’Tools’ menu item and then the ’Settings’ option
2. Click the ’Privacy and security’ panel
3. Make the desired settings under Cookies

• Safari

1. Click the ’Safari’ (Tools) button, and within it ’Settings’
2. Click the ’Privacy’ panel
3. The desired settings must be made under Cookies and website data

1. Use of Google Analytics

The website uses this freely available system, which shows users' website browsing habits, including, for example, where visitors clicked through from, how much time they spend on the website, and from where geographically they visited the website. Its use also makes it possible to find out how visitors reach the website, to determine the traffic sources (which browser), when visitors enter, where they arrive after entering, what the bounce rate is on each page of the website, etc. Various statistics are produced from this. Google Inc., which operates the service, also achieves all this through the use of Cookies. The data collected in this way and the statistical data created are transferred to and stored on one of Google's servers in the USA. With IP anonymisation activated on the website, Google first shortens the User's IP address within the Member States of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transferred to a Google server in the USA and shortened there. Within Google Analytics, the IP address transmitted by the User's browser is not merged with other Google data.

You can manage the consent settings in your browser at any time as described above, or in the manner set out in the browser's cookie information in force from time to time, and you can also withdraw your consent with effect for the future.

2. Google Ads

This website uses the remarketing function of Google Inc. The purpose of this function is to display to visitors of the website advertisements matching their interests within the Google advertising network. The browser of the person visiting the website stores so-called “cookies”. These are text files which, by being stored on the computer, make it possible to recognise the visitor again when they visit websites belonging to the Google advertising network. On such sites, the visitor may be shown advertisements relating to content that the visitor has previously viewed on websites that use Google's remarketing function. According to its own information, Google does not collect any personal data in this process.

The legal basis for processing of this kind is your consent given under GDPR Article 6(1)(a)).

RECIPIENTS

For the processing activities it carries out in connection with operating the website, the Controller sets out in detail in point V, separately for each processing activity, the recipients, that is, the organisations and private individuals to whom it discloses the personal data it processes. For every recipient it also states the legal basis and purpose of the transfer of the personal data.

As set out in point V, the Controller may also transfer personal data – to the extent necessary to provide the service – to countries outside the European Economic Area (EEA), including the United States of America.

Data transfers outside the EEA take place only in accordance with the conditions laid down in the GDPR, with appropriate safeguards in place. The safeguards applied may include in particular the following:

• EU–US Data Privacy Framework: for US processors certified under this framework (in particular: Apple, Google, Stripe);
• Adequacy decisions: for third countries in respect of which the European Commission has found an adequate level of data protection.

In addition to the recipients listed in detail for the processing activities in point V, further recipients may also include the following authorities, organisations and persons:

• Authorities and courts entitled to supervise the Controller and to oblige the Controller to provide data; purpose of the transfer: to assist the work of the authorities and organisations, legal basis of the transfer: compliance with a legal obligation);
• In the case of legal proceedings brought against the data subject, courts, bailiffs, notaries, and the data subject's statutory or authorised representative; purpose of the transfer: initiating legal proceedings, facilitating the exercise of the right of representation; legal basis of the transfer: compliance with a legal obligation).

RIGHTS OF DATA SUBJECTS

The individual data subject rights:

right to information: GDPR Articles 13 and 14

Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information

1. the identity and the contact details of the controller and of the controller's representative;
2. the contact details of the data protection officer;
3. the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;
4. where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;
5. where applicable, the recipients or categories of recipients of the personal data, if any;
6. where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation.

in addition, the Controller must provide information on:

1. the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
2. the data subject's right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject, and to object to such processing, as well as the data subject's right to data portability;
3. where the processing is based on point (a) of Article 6(1) (consent of the data subject) or point (a) of Article 9(2), the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
4. the right to lodge a complaint with a supervisory authority;
5. whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data;
6. the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. The Controller does not carry out activities of this kind.

Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, it must provide the data subject, prior to that further processing, with information on that other purpose and with any relevant further information as referred to above.

the Controller is also under an obligation to provide information on:

1. the circumstances and effects of a personal data breach (Article 34) and the measures taken to remedy it
2. in the case of a transfer of data to recipients, the legal basis, purpose and recipient of the transfer

right of access to personal data: GDPR Article 15

The data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

1. the purposes of the processing;
2. the categories of personal data concerned;
3. the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
4. where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
5. the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
6. the right to lodge a complaint with a supervisory authority;
7. where the personal data are not collected from the data subject, any available information as to their source;
8. the existence of automated decision-making, including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

At the data subject's request, the Controller provides a copy of the personal data it processes free of charge, as the data subject requests – electronically or by post. In the case of a repeated request on the same subject, the Controller has the right to charge a reasonable fee or may refuse to act on the request. The right to information may be exercised in writing via the contact details given in point II; information may be given orally after proof of identity.

right to rectification: GDPR Article 16

The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement. If the data needed for rectification are available to the Controller, the controller carries out the rectification of the data automatically – even without a separate request to that effect.

right to erasure: GDPR Article 17

The data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay, and the controller has the obligation to erase personal data concerning the data subject without undue delay where one of the following grounds applies:

1. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed,
2. the data subject withdraws the consent on which the processing is based, and there is no other legal ground for the processing,
3. the data subject objects to the processing and there are no overriding legitimate grounds for the processing,
4. the personal data have been unlawfully processed,
5. the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject,
6. the personal data have been collected in relation to the offer of information society services.
7. However, the right to erasure (to be forgotten) is not absolute, so it does not apply to the extent that processing is necessary:
8. for exercising the right of freedom of expression and information,
9. for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,
10. for reasons of public interest in the area of public health,
11. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes,
12. for the establishment, exercise or defence of legal claims.

The right to erasure is therefore not absolute, which in essence means, for example, the following limits in the case of the website:

For processing where the legal basis is compliance with a legal obligation, e.g. issuing a document certifying payment of the consideration for the purchased product, the duration of processing is eight years under Section 169 (2) of the Accounting Act.

For processing based on the data subject's voluntary consent, such limits naturally do not apply, and there is no obstacle to erasure.

If the Controller rejects a request for erasure, it always does so in a written reply stating the reasons.

right to restriction of processing (blocking): GDPR Article 18

The data subject has the right to obtain from the controller restriction of processing where one of the following applies:

1. the accuracy of the personal data is contested by the data subject, in which case the restriction applies for a period enabling the controller to verify the accuracy of the personal data;
2. the processing is unlawful and the data subject opposes the erasure of the data and requests the restriction of their use instead;
3. the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims, or
4. the data subject has objected to processing; in this case the restriction applies pending the verification whether the legitimate grounds of the controller override those of the data subject.

right to data portability: GDPR Article 20

The data subject has the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format, and has the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where the processing is based on consent and is carried out by automated means.

However, the exercise of this right shall be without prejudice to the right to erasure and shall not adversely affect the rights and freedoms of others.

right to object: GDPR Article 21

The data subject has the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on the following, including profiling:

1. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; GDPR Article 6(1)(e).
2. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. GDPR Article 6(1)(f).

Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where the data subject objects to processing for direct marketing purposes, the Controller will no longer process the personal data for such purposes.

right to withdraw consent: GDPR Article 7

The data subject has the right to withdraw their previously given voluntary consent at any time, e.g. in the case of a subscription to the newsletter or marketing messages. Naturally, the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. The data subject must be informed of this before giving consent. We indicate this separately in every case among the processing activities listed in point V where the legal basis is voluntary consent.

Automated individual decision-making, including profiling: GDPR Article 22

The data subject has the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning him or her or similarly significantly affects him or her.

This right does not apply if the decision:

1. is necessary for entering into, or performance of, a contract between the data subject and the controller;
2. is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or
3. is based on the data subject's explicit consent.

Under the GDPR, “profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

Enforcement of rights relating to personal data after the death of the data subject: Section 25 of the Privacy Act

After the death of the data subject, in the case of processing falling within the scope of the GDPR, within five years of the data subject's death, the rights of access, rectification, erasure, restriction of processing and objection to which the deceased was entitled during their lifetime may be exercised by a person authorised by the data subject by means of a declaration made to the controller in a public document or in a private document of full probative value.

In the case of processing not falling within the scope of the GDPR, the rights that may be exercised are the right of access, the right to rectification, the right to erasure and the right to restriction of processing.

If the data subject has not made a legal declaration as described above, their close relative under the Civil Code is entitled, even in its absence, to exercise certain rights in respect of processing falling within the scope of the GDPR and processing not falling within it, within five years of the data subject's death. The rights of the data subject may be exercised by the close relative who first exercises this entitlement.

LEGAL REMEDIES

As a guarantee that the data subject's rights are enforced, the Controller examines a request submitted by the data subject within the shortest possible time from its submission, but no later than within 30 days, decides whether it is well founded, and notifies the applicant of its decision in writing free of charge (electronically, if the request was also received that way).

If the Business or the natural person data subject has any question or request regarding our processing of the personal data provided, please contact our Company directly, with confidence, at the contact details given in point II when exercising your rights to information, access, rectification, blocking, erasure, withdrawal of consent or objection.

If we grant your request, we, or the recipient or processor acting on our behalf or under our instructions, will rectify or erase the personal data or restrict the processing of these data. If the request is granted, we will also notify the recipients to whom the data were transferred before this measure, so that they can carry out the rectification, erasure or restriction of processing in respect of their own processing.

If we reject your request, we will inform you of this in writing without delay, stating, in addition to the fact of the rejection, its legal and factual reasons and the rights you have.

If your request is rejected, you are entitled to the following legal remedies:

1. You may initiate an investigation by the Authority on the grounds that an infringement has occurred in connection with the processing of personal data, or that there is an imminent risk of one
2. You may request the Authority to conduct a data protection authority procedure if, in your opinion, the controller, or the processor engaged by it or acting under its instructions, infringes the rules on the processing of personal data laid down in legislation or in a binding legal act of the European Union in the course of processing your personal data.
3. The data subject may also turn to a court if, in their opinion, the controller, or the processor engaged by it or acting under its instructions, processes their personal data in breach of the rules on the processing of personal data laid down in legislation or in a binding legal act of the European Union. The data subject may – at their choice – also bring the action before the regional court competent for their place of residence or place of stay.

If the court upholds the claim, it establishes the fact of the infringement and orders the Controller, or the processor acting on its behalf:

• 1. to cease the unlawful processing operation,
  2. to restore the lawfulness of the processing, or
  3. to engage in precisely specified conduct to ensure that the data subject's rights are enforced
  4. and, where necessary, at the same time decides on the claim for compensation and damages for non-pecuniary loss.

Any person who has suffered material or non-material damage as a result of an infringement of the GDPR is entitled to receive compensation from the controller or the controller's processor for the damage suffered.

Every controller involved in the processing is liable for any damage caused by processing which infringes the GDPR. A processor is liable for the damage caused by processing only where it has not complied with obligations of the GDPR specifically directed to processors, or where it has disregarded or acted contrary to the lawful instructions of the controller.

The controller or the controller's processor is exempt from liability if it proves that it is not in any way responsible for the event giving rise to the damage.

Contact details of the Hungarian National Authority for Data Protection and Freedom of Information:

Address: 1055 Budapest, Falk Miksa utca 9-11.

Postal address:1363 Budapest, Pf.: 9.

Telephone: +36 (1) 391-1400

Fax: +36 (1) 391-1410

E-mail:ugyfelszolgalat@naih.hu

URL: http://naih.hu