The purpose of this document is for DES Hungary Kft., as data controller (hereinafter referred to as the "Controller"), to describe the data protection rules, procedures, and security measures applied and operated within the Controller's organization regarding data qualifying as personal data. Furthermore, through this document, the Controller informs its clients, partners, and all natural and legal persons who have any legally relevant relationship with the Controller and are affected by the processing of personal data, about the rules governing the processing of personal data handled by the Controller, the applied protective measures and procedures, and the manner of data processing. The Controller considers the rules, provisions, and obligations described in this Privacy Notice to be legally binding upon itself and applies them in its operations, and declares that the data protection rules and procedures described and applied in this document comply with applicable national and European Union data protection legislation. The Controller further declares that it considers the right to informational self-determination to be paramount, with particular regard to personal data, and undertakes all available organizational, operational, regulatory, and technological measures within its scope to ensure and enforce compliance with these rights. The Controller may amend this Privacy Notice at any time, subject to the obligation of publishing the update and informing the Data Subjects.
Name: DES Hungary Kft.
Tax number: 33057420-2-13
Registered office: 2040 Budaörs, Ébner György köz 4.
Email: info@deshungary.hu
Phone number: +36305397304
For data protection inquiries, the Controller may be contacted via the following details:
Email: info@deshungary.hu
Phone number: +36305397304
The Controller retains data protection inquiries submitted to it for a specified period applicable to such data processing. Upon the expiration of this period, these inquiries are irrevocably deleted.
Name: Nagy István
Email address: info@deshungary.hu
Purpose of data processing: Contact
Possible consequences of failure to provide data: Contacting or providing information is not possible.
Data processed during data processing:
Name
Email address
Phone number
Message
Retention period of the processed data: The provided data is stored indefinitely.
The Controller also utilizes third-party cookies from Google Analytics and Microsoft Clarity on its website. By using Google Analytics and Microsoft Clarity for statistical purposes, the Controller's server gathers information regarding how visitors use the website. This data is used to develop the website and improve user experience. These cookies also remain on the visitor's computer or other browsing device, within their browser, until they expire or until the visitor deletes them.
In the listed data processing activities, the Controller processes personal data in all cases for the purpose and on the legal basis specified for that activity, in compliance with the legislation listed below. The processing of personal data takes place in all cases based on the voluntary consent of the Data Subject, which consent the Data Subject is entitled to withdraw at any time. Due to legal obligations, in certain cases and under specific exceptional conditions, the Controller is obliged to process, transfer, transmit, or store certain personal data in a manner differing from what is described in this Policy. In such cases, the Controller ensures that Data Subjects are notified, provided that the provisions of the relevant legislation permit or do not explicitly prohibit it.
The Controller processes personal data based on the following legislation: GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council (27 April 2016); Act V of 2013 on the Hungarian Civil Code (Ptk.);
The Controller stores personal data in its integrated IT system. The system components are located at the following geographic and physical locations:
Controller's primary hosting site: Rackhost Zrt.
Address: 1132 Budapest, Victor Hugo utca 18-22.
Brief description: Web hosting service
The Controller processes personal data primarily on its properly established and protected IT system. During the operation of the IT system, it ensures an adequate level of basic information security attributes for data stored, processed, and transmitted thereon, such as: Integrity of the processed data (ensuring the authenticity and unalterability of data); Confidentiality (ensuring that only authorized persons access it and only to the extent of their authorization); Availability (ensuring that data is accessible and available to authorized persons within the expected availability period). The necessary IT infrastructure is maintained in operational readiness.
organizational and operational,
physical security,
information security
structured protective measures. The Controller establishes and operates the system of protective measures and the security levels of individual measures in proportion to the risks arising from threats to the data to be protected. From a data protection perspective, the security measures primarily aim to protect against accidental or intentional deletion, unauthorized access, intentional and malicious disclosure, accidental exposure, data loss, and data destruction.
The data may primarily be accessed by the Controller and its internal staff, in accordance with authorization rules, authorization systems, and other internal policies. The Controller delegates certain operations and tasks related to the data to third-party Data Processors. The Controller does not publish the data or disclose it to other third parties.
With regard to personal data processed by the Controller, the Data Subject may exercise—among others—the rights described below.
The Data Subject has the right to obtain from the Controller confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data and the following information:
the purposes of the processing;
the categories of personal data concerned;
the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;
the envisaged period for which the personal data will be stored;
the right of the Data Subject to request rectification, erasure, or restriction of processing, and to object to such processing;
the right to lodge a complaint with a supervisory authority;
where the data is not collected from the Data Subject, any available information as to its source;
the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the Data Subject.
The Controller shall provide 1 copy of the personal data undergoing processing to the Data Subject. For any further copies requested by the Data Subject, the Controller may charge a reasonable fee based on administrative costs. Where the Data Subject submits the request by electronic means, the Controller provides the information in a commonly used electronic format, unless otherwise requested by the Data Subject, within a maximum of 30 days from submission.
The Data Subject has the right to obtain from the Controller without undue delay the rectification of inaccurate personal data concerning them, and has the right to have incomplete personal data completed, taking into account the purposes of the processing.
The Data Subject has the right to obtain from the Controller the erasure of personal data concerning them without undue delay, and the Controller has the obligation to erase personal data without undue delay where one of the following grounds applies:
the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
the Data Subject withdraws consent on which the processing is based, and there is no other legal ground for the processing;
the Data Subject objects to the processing and there are no overriding legitimate grounds for the processing;
the personal data has been unlawfully processed;
the personal data must be erased for compliance with a legal obligation in Union or Member State law to which the Controller is subject;
the personal data has been collected in relation to the offer of information society services.
Erasure of data cannot be initiated where the processing is necessary:
for exercising the right of freedom of expression and information;
for compliance with a legal obligation requiring processing under Union or Member State law to which the Controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;
on grounds of public interest in the area of public health;
for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes;
for the establishment, exercise, or defense of legal claims.
At the request of the Data Subject, the Controller restricts processing where one of the following applies: the accuracy of the personal data is contested by the Data Subject, in which case the restriction applies for a period enabling the Controller to verify the accuracy of the personal data;
the processing is unlawful and the Data Subject opposes the erasure of the personal data and requests the restriction of its use instead;
the Controller no longer needs the personal data for the purposes of the processing, but they are required by the Data Subject for the establishment, exercise, or defense of legal claims; or
the Data Subject has objected to processing; in this case, the restriction applies for a period pending the verification whether the legitimate grounds of the Controller override those of the Data Subject.
Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with the Data Subject's consent or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.
The Data Subject has the right to receive the personal data concerning them, which they have provided to the Controller, in a structured, commonly used, and machine-readable format, and has the right to transmit those data to another Controller.
The Data Subject has the right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them, including profiling based on those provisions. In this case, the Controller shall no longer process the personal data unless the Controller demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the Data Subject, or for the establishment, exercise, or defense of legal claims.
The Data Subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.
The Data Subject has the right to withdraw their consent regarding their personal data at any time.
In case of any infringement of their rights, the Data Subject may request information, remedy, or lodge a complaint via the provided contact details or with the designated Data Protection Officer. If these prove ineffective, the Data Subject has the right to apply to court or contact the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).
Contact Details of the Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Name: Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Registered office: 1125 Budapest, Szilágyi Erzsébet fasor 22/C.
Mailing address: 1530 Budapest, Pf.: 5.
Tel: +36 (1) 391-1400
Fax: +36 (1) 391-1410
Email: ugyfelszolgalat@naih.hu
Website: http://www.naih.hu
In the event of an official request by an authority or an inquiry from another entity based on a legal obligation, the Controller may be required or compelled to disclose data. In such cases, the Controller strives to disclose only the extent and nature of personal data strictly necessary to fulfill the data disclosure obligation.
