Privacy Notice

PRIVACY POLICY

I. General provisions

Details of the data controller:

full company name: KORZÓ HÁZ KFT.

abbreviated name: KORZÓ HÁZ KFT.

registered office: 4025 DEBRECEN MESTER U. 28.

tax number: 12575086-2-09

company registration number: 09-09-007701

registering company court: Company Registry Court of the Debrecen Regional Court

language of the contract: Hungarian

electronic contact: info@belgaetterem.hu, www.belgaetterem.hu (email and other online contact options)

phone contact: 52/536-373 (hereinafter the Company), as data controller.

With this Policy, the Company wishes to ensure the realisation of the data subject's right to information laid down in Section 15 of the Info Act and Article 12 of the GDPR.

The aim of the Policy is that data subjects – including the Company's employees – can receive appropriate information about the data processed by the Company, their source, the purpose, legal basis and duration of the data processing, and the activities connected with the data processing, and furthermore

in the event of the transfer of the data subject's personal data – about the legal basis and recipient of the data transfer.

The Company processes only such personal data as are necessary from the point of view of the given specific data-processing purpose.

With the Policy, the Company provides information about the organisational and technical measures taken to protect personal data, as well as about the manner and possibilities of exercising their rights.

II. Basic concepts of data protection

Personal data: data that can be associated with the data subject – in particular the data subject's name, identifier, and knowledge characteristic of one or more of their physical, physiological, mental, economic, cultural or social identity –, as well as any conclusion regarding the data subject that can be drawn from the data;

Special data:

personal data relating to racial origin, belonging to a nationality, political opinion or party affiliation, religious or other philosophical conviction, membership of an interest-representation organisation, or sexual life,

personal data relating to state of health or pathological addiction, as well as criminal personal data;

Consent: the voluntary and definite expression of the data subject's will, which is based on appropriate information and by which they give their unambiguous consent to the processing – full or extending to individual operations – of personal data relating to them;

Objection: a statement by the data subject in which they object to the processing of their personal data and request the termination of the processing or the deletion of the processed data;

Data controller: the natural or legal person, or organisation without legal personality, who or which, alone or together with others, determines the purpose of the processing of the data, and concerning the data processing (including the means used)

makes and executes the relevant decisions, or has them executed by the data processor;

Data processing: regardless of the procedure applied, any operation or set of operations performed on the data, in particular its collection, recording, capture, organisation, storage, alteration, use, querying, transfer, disclosure, alignment or linking, blocking, deletion and destruction, as well as preventing the further use of the data, taking a photograph or an audio or video recording, and recording physical characteristics suitable for identifying a person (e.g. fingerprint or palm print, DNA sample, iris image);

Data transfer: making the data accessible to a specified third party;

Disclosure: making the data accessible to anyone;

Data deletion: rendering the data unrecognisable in such a way that its restoration is no longer possible;

Data blocking: marking the data with an identifier for the purpose of limiting its further processing definitively or for a specified period;

Data marking: marking the data with an identifier in order to distinguish it;

Data destruction: the complete physical destruction of the data carrier containing the data;

Data processing on behalf: carrying out the technical tasks connected with the data-processing operations, regardless of the method and means used to perform the operations and the place of application, provided that the technical task is performed on the data;

Data processor: the natural or legal person, or organisation without legal personality, who or which processes data on the basis of a contract – including a contract concluded pursuant to a provision of law;

Data file: the totality of data managed in one register;

Third person: a natural or legal person, or organisation without legal personality, who or which is not identical to the data subject, the data controller or the data processor;

Data protection incident: the unlawful processing or handling of personal data, in particular unauthorised access, alteration, transfer, disclosure, deletion or destruction, as well as accidental destruction and damage;

Restriction of processing: the marking of stored personal data with the aim of limiting their processing in the future;

Pseudonymisation: the processing of personal data in such a way that the personal data can no longer be attributed to a specific natural person without the use of additional information, provided that such additional information is stored separately and, through technical and organisational measures, it is ensured that this personal data cannot be linked to identified or identifiable natural persons;

Recipient: the natural or legal person, public authority, agency or any other body to whom or which the personal data is disclosed, whether or not a third party. Public authorities that may access personal data within the framework of an individual investigation in accordance with Union or Member State law are not deemed recipients; the processing of the said data by these public authorities must comply with the applicable data protection rules in accordance with the purposes of the processing;

Health data: personal data relating to the physical or mental health of a natural person, including data on the healthcare services provided to the natural person that carries information about the natural person's state of health;

Data subject: any specified natural person identified or – directly or indirectly – identifiable on the basis of personal data;

Third party: the natural or legal person, public authority, agency or any other body that is not identical to the data subject, the data controller, the data processor, or the persons who, under the direct authority of the data controller or data processor, are authorised to process the personal data;

Genetic data: all personal data relating to the inherited or acquired genetic characteristics of a natural person that carries unique information about the physiology or state of health of the person concerned and that results primarily from the analysis of a biological sample taken from the said natural person;

Representative: the natural or legal person established or resident in the Union and designated in writing by the data controller or data processor, who or which represents the data controller or data processor with respect to the obligations incumbent on the data controller or data processor under the Regulation;

Filing system: any set of personal data structured in any way – according to centralised, decentralised, functional or geographical criteria – which is accessible according to specific criteria;

Relevant and reasoned objection: an objection submitted against the draft decision, regarding whether the Regulation has been infringed, or whether the intended measure concerning the data controller or data processor complies with the Regulation; the objection must clearly demonstrate the significance of the risks posed by the draft decision to the fundamental rights and freedoms of data subjects and, where applicable, to the free flow of personal data within the Union;

Undertaking: a natural or legal person engaged in economic activity, regardless of its legal form, including partnerships and associations that engage in regular economic activity;

Group of undertakings: a controlling undertaking and the undertakings controlled by it;

If the definitions laid down above in the data protection legislation in force from time to time differ, or are amended, then in that case the concepts defined by the legislation are governing.

III. Principles of data protection, applicable legislation

The Company carries out data processing exclusively on the basis of the provisions of the legislation in force, to the extent and for the time absolutely necessary to achieve the purpose. The Company processes personal data only on the basis of the data subject's prior consent or of legislation.

As data controller, the Company, in the course of its activity, does everything to ensure that the legislation on data processing, as well as the provisions of this privacy policy – in particular the principle of the purpose limitation of data processing – are continuously and fully enforced.

The Company's data-processing principles are in line with the data protection legislation in force, in particular the following:

Regulation (EU) 2016/679 of the European Parliament and of the Council (27 April 2016) – on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Regulation 95/46/EC (General Data Protection Regulation, GDPR);

Act CXII of 2011 – on the right to informational self-determination and on freedom of information (Info Act);

Act V of 2013 – on the Civil Code (Ptk.);

Act XIX of 1998 – on criminal proceedings (Be.);

Act C of 2000 – on accounting (Accounting Act);

Act I of 2012 – on the Labour Code (Mt.);

Act CLXV of 2013 – on complaints and public-interest disclosures (Complaints Act).

IV. Data processing at the Company

4.1 Data processing relating to visitors of the Website

The Company currently operates the www.belgaetterem.hu website (hereinafter: the Website). The Website can be used without providing data; it is possible to request offers and to subscribe to the newsletter. The hosting for the Company's Website is provided by an external provider.

Anyone may use the Company's website without providing their personal data, and may obtain information on it. For the operation of the Website, the Company uses external web-analytics and ad-serving companies that carry out their activity independently of the Company.

Certain data and IP addresses of the computers and other devices of visitors to the Website are logged for the purpose of recording the visit. The Company uses this data exclusively to compile statistics, for example to determine how often the Website is visited and how much time individual visitors spend there on each occasion. The Company does not link the IP addresses to any other data on the basis of which the visitor could be personally identified.

When certain parts of the Website are downloaded, the Company places small data files (cookies) – which may in some cases also contain personal data – on the visitor's computer or other device for the purpose of recording data, identifying the visitor and facilitating their further visits. In the browser used for internet access, the visitor can set to receive a notification when the Company wishes to place a cookie on their computer or other device, and can prohibit the sending of cookies at any time. At the same time, when cookies are not accepted, certain pages do not work perfectly, or it may occur that the visitor does not receive permission to access certain data.

By viewing the Website, the visitor and the Company have established contact with each other via a telecommunications device; the provision of information takes place over an open network (the internet). This makes it necessary for the Company to observe enhanced control and security requirements. Accordingly, the Company, in accordance with the applicable provisions of data protection law, strives to ensure that its service is also considered secure from a technical point of view. The same applies to the provider that makes the Website accessible, who is obliged to treat the personal data and other information that comes into its possession as a business secret.

The Company excludes all liability for information published on the internet by the visitor through the use of the Website.

With respect to content made accessible on the Website and content shared via links that may be found on the Website, the operator of the external services enabling the sharing of the content qualifies as the data controller of the personal data; its own terms of use and privacy policy are governing for its activity, and the Company assumes no responsibility for them.

For the operation of the Website, the Company uses external web-analytics and ad-serving companies that carry out their activity independently of the Company. The Company uses the services of Google Inc. Google Analytics, Google Adwords and Facebook. Google Inc. and Facebook use cookies and web beacons in order to collect information and to help analyse the use of the Website. The information stored by the cookie (including the User's IP address) is stored by Google Inc. and Facebook on their servers in the United States. Google Inc. and Facebook may transfer the collected information to third parties where required by law, or where such third parties process the information on behalf of Google Inc. or Facebook.

Within the framework of Google Adwords and Facebook remarketing, Google Inc. and Facebook place tracking cookies on Users' devices that monitor Users' online behaviour, on the basis of which Google Inc. and Facebook make advertising based on user behaviour and interests available to them on other websites. The tracking cookie enables Google Inc. and Facebook to identify the User on other websites too. Google Inc.'s "Privacy Policy" is available at http://www.google.hu/intl/hu/policies/privacy/, while Facebook's "Privacy Policy" is available at https://www.facebook.com/policy.php. Further useful information about Google Inc.'s activities relating to data, about disabling cookies and about personalising ads can be found on Google Inc.'s website at the following page: http://www.google.com/intl/hu/policies/privacy/ads/. There is no option to refuse the web beacon. Facebook's so-called like buttons are available on the Website. These buttons also place cookies in the visitor's browser.

In the case of those who use the Website solely for the purpose of visiting, the data processing takes place exclusively in order to ensure their information, during which the Company records the start and end time of their visit, as well as cookies, which it preserves electronically until the purpose of the data processing is fulfilled, but for no more than 2 years. In the case of visitors to the Website, the legal basis of the data processing is the data subject's consent under Article 6(1)(a) of the GDPR.

If the Company becomes aware that the visitor provides the personal data of a third party, or otherwise in a manner that violates the law, uses personal or non-personal data publicly accessible on the Website or unlawfully obtained in a manner that violates the rights of a third party or the law (e.g. spam), or otherwise breaches these privacy rules, or has caused damage during the use of the Website, the Company takes the necessary legal measures in order to obtain compensation for the damage caused and to hold the person carrying out the above conduct legally accountable.

Newsletter

In the case of subscribing to the newsletter on the Website, the following data is recorded by the Company: name and email address. The purpose of the data processing is the sending of newsletters by the Company to the data subjects.

The legal basis of the data processing is the data subject's consent under Article 6(1)(a) of the GDPR (newsletter subscription), which takes place by subscribing to the newsletter. The duration of the data processing lasts until the user registered for the newsletter unsubscribes from the newsletter, for which they have the option via the link found in the newsletters.

Requesting an offer and sending a message

In the case of requesting an offer and sending a message on the Website, the following data is recorded by the Company: name and email address. The purpose of the data processing is keeping in touch with customers, and facilitating contact and the request for an offer.

The legal basis of the data processing is the data subject's consent under Article 6(1)(a) of the GDPR, which takes place by sending the offer request. The duration of the data processing is at most one year.

Table reservation

On the Website it is possible to reserve a table, during which the following personal data is recorded: name and email address. The purpose of the data processing is keeping in touch with guests, and facilitating contact.

The legal basis of the data processing is the data subject's consent under Article 6(1)(a) of the GDPR, which takes place by sending the offer request. The duration of the data processing is at most one year.

4.2 Applying for a job at the Company

The Company provides the option to submit CVs on its Website, electronically, as well as on paper. After the CV is received, the Company informs the data subject of the fact of the data processing, its legal basis and the forms of objecting to the data processing. The consent given to the data processing may be withdrawn at any time by the job-seeking data subject.

The Company stores the CVs for the purpose of possible later use, in the interest of the data subject, in order to notify the data subject in the event of a vacant position. The Company stores the data subject's data for at most half a year, after which it destroys them. The Company assumes that, after the lapse of this half year, the job search becomes moot. The consent given to the data processing is revocable, so the data subject may withdraw their consent on the basis of what is set out in this policy.

Only the Company's managing director, and the person designated by them, are entitled to become acquainted with the data of the CVs received by the Company.

For job seekers, for the sake of easier transparency, the Company records the information related to the data processing as follows: The purpose of the data processing: selecting suitable future employees to fill vacant positions, and the Company stores the CVs for the purpose of possible later use, in the interest of the data subject, in order to notify the data subject in the event of a vacant position.

Info Act.

The legal basis of the data processing: the data subject's consent under Section 5(1)(a) and Section 6(6).

Info Act.

The designation of the legal basis of the data processing: the data subject's consent under Section 5(1)(a) and Section 6(6). The scope of data subjects: persons who submit their CV to the Company. Data relating to the data subjects: name/birth name, permanent and temporary address, phone number, email address, place and date of birth, citizenship, highest educational qualification (name of school, field, year of graduation), data of ongoing studies, data on language skills, data of the most recent workplace (name, position, duration of employment, reason for leaving), the acceptable net salary, characteristics connected with the work and its performance, as well as the cover letters, CVs, applications and other personal data provided in them.

The source of the data: the data subject. The duration of processing the data: we destroy the data entered into the database after the lapse of half a year. The technical nature of the data processing: on paper and electronically.

No data processing on behalf and no data transfer is connected with this data processing.

4.3 Data processing relating to the establishment of an employment relationship

The purpose of the data processing connected with the employment relationship is the establishment and maintenance of the employment relationship, as well as the fulfilment of obligations arising from the employment contract and legislation. The Company keeps payroll and labour records of its employees, which it uses in respect of the employee's employment-related data for payroll, social-security and statistical data provision, as well as, on the basis of Act CXVII of 1995, in connection with the employer's tax assessment. The legal basis of the employees' data processing is the statutory authorisation (Mt. Section 10(1), Section 10(3)), as well as the consent of the data subject (Article 6(1)(b) and (c) of the GDPR). The Company processes the employee's data until the termination of the employment relationship, and for the duration set out in the legislation in force from time to time.

For employees, for the sake of easier transparency, the Company records the information related to the data processing as follows: The purpose of the data processing: the establishment, performance or termination of the employment relationship, as well as the fulfilment of obligations arising from the employment contract and legislation. The legal basis of the data processing: the data processing is necessary for the fulfilment of obligations arising from the employment contract and legislation [Article 6(1)(b) and (c) of the GDPR], as well as Section 10(1) of the Labour Code. The designation of the legal basis of the data processing: statutory authorisation [Labour Code Section 10(1) and (3)] and the data subject's consent, as well as Article 6(1)(b) and (c) of the GDPR. The scope of data subjects: employees. The data processed: Employee's name, Birth name, Place and date of birth, Citizenship, Mother's name, Place of residence, Social security number, Tax identification number, Bank account number, Private pension fund membership, Pensioner's registration number.

Current account number, Start of employment, Number of weekly working hours, Copy of the certificate proving educational qualification, Fitness-for-work certificate, Job title, Data and number of children, Phone numbers of persons to be notified in the event of an accident, Possession of driving licences, Health booklet. The source of the data: the data subject.

in general, in accordance with Section 286(1) of the Labour Code,

the data-processing duration is aligned with the three-year limitation period.

in respect of data that are documents serving as supporting evidence for accounting vouchers (e.g. time and leave records, records of wages, payments and deductions), pursuant to Section 169(2) of the Accounting Act, eight The duration of processing the data: years,

in the case of persons employed solely under the Labour Code, furthermore: data that are also documents relevant for the purpose of establishing entitlement to social-security benefits (e.g. employment contract, documents made for the purpose of data provision to the pension insurer) – one hundred years after the termination of the employment relationship.

The technical nature of the data processing: on paper and electronically.

Data transfer to state bodies as prescribed by law; The type of the transferred data, their listing: name, tax identification number, mother's name, place and date of birth, permanent residence.

The legal basis of the data transfer: the data subject's consent.

The type of the transferred data, their listing:

The time of the data transfer: only for the period prescribed by law. The name of the recipient of the transfer: Aranykor Voluntary Pension Fund

1051 Budapest, József nádor tér 5-6.

In addition to the above, it may become necessary to keep records of the employee's relatives' data prescribed by law. The legal basis of the data transfer: the data subject's consent. The provision of data is voluntary; the provision of data may in all cases take place with the case-by-case obtaining of the data subject's consent.

The time of the data transfer: at each pension-fund payment.

In the event that the employee provides the data of a third person, they are obliged to declare that they have authorisation to provide the third person's data. The legal basis of processing the data is Article 6(1)(a) of the GDPR.

The email program and the internet may be used exclusively for the fulfilment of obligations arising from the employment relationship, for a purpose connected therewith. The Company's IT system and the corporate network may not be used for private-nature business and political activity.

The traffic of the email mailbox may be checked by the employer.

The Company provides mobile phones to certain of its employees, which are work tools serving to support work performance. The use of the mobile phones may be checked by the Company.

4.4 Electronic monitoring system

An electronic monitoring and recording system operates in the Company's restaurant/premises, as part of which cameras have been placed in the area of the restaurant/premises.

The purpose of the data processing: the protection of human life, physical integrity, property and significant amounts of cash, and the guarding of hazardous materials, the prevention and detection of infringements, catching the perpetrator in the act, and proving infringements, identifying those who enter the area of the restaurant/premises without permission, recording the fact of entry, documenting the activity of those staying inside without authorisation, and investigating the circumstances of any workplace and other accidents that may occur.

The legal basis of the data processing: the data subject's consent by entering the area of the restaurant/premises; in the case of employees, Section 11 of Act I of 2012 on the Labour Code (Mt.), as well as Article 6(1)(f) of the GDPR, since the company has a legitimate interest in property protection.

The type of personal data processed: the facial image, visible on the recordings, of persons entering the area of the restaurant/premises operated by the Company, and other personal data recorded by the monitoring system.

The duration of the data processing: in the absence of use, at most 90 days [Act CXXXIII of 2005

Section 31(3)(c) and (d)].

Information related to the storage of the data: the recordings are stored on servers located at the restaurant/premises, with enhanced data-security measures, thus ensuring that unauthorised persons cannot view and copy the recordings.

Access to the images: employees of the company with the appropriate authorisation are entitled to view the current image of the cameras and the recordings. A data subject whose right or legitimate interest is affected by the recording of the image may, by proving their right or legitimate interest, request that the data controller not destroy or delete the recording until the request of the court or the authority, but for at most 30 days. The person appearing on the recording may furthermore request that the data controller inform them in writing about what is visible on the recording containing them. The data subject may receive a copy only of a recording on which another person does not appear, or appears only in an unrecognisable manner. If the above cannot be fulfilled, the data controller ensures that the data subject can view the recording containing them (as well).

Data transfer: to the authorities and courts conducting them, in the case of a misdemeanour or criminal proceeding.

The scope of the data handed over: recordings made by the camera system that contain relevant information.

The legal basis of the data transfers: Section 71(1), Section 151(2)(a) and Section 171(2) of the Criminal Procedure Act, as well as Section 75(1)(a) and Section 78(3) of the Misdemeanour Act.

4.5. Office/restaurant WIFI

The Company provides internet access to its guests and employees via a wifi connection.

The Company logs the unique network identifier (MAC address) of the devices connected to the wifi network and the time of connection, on the basis of its legitimate interest in providing the service to a high standard.

The Company does not record the wifi traffic or the information relating to the pages viewed.

V. Rules of data processing

The data is processed by the Company, as data controller. The place of the data processing is the Company's premises.

The company's managing director, and the employees authorised by the managing director, have access to the data, for the purpose of performing the service. The Company does not use a data processor.

If any authority contacts the Company for the purpose of providing information, disclosing or handing over data, or making documents available, then the Company makes available to the requesting body – provided that the authority has specified the exact purpose and the scope of the data – the personal data indispensably necessary to achieve the purpose of the request.

The Company's data protection register contains at least the following: the purpose of the data processing, the type of data, the legal basis of its processing, the scope of data subjects, the source of the data, the type, recipient and legal basis of any transfer relating to the data, the deadline for the deletion of the given type of data.

VI. Information and the right of access

The data subject may at any time request information about the processing of their personal data from the Company via the email address info@belgaetterem.hu, thus about the data processed by the Company, their source, the purpose, legal basis and duration of the data processing, and furthermore – in the event of the transfer of the data subject's personal data – about the legal basis and recipient of the data transfer. The Company provides the requested information in the shortest possible time from the submission of the information request, but at most within 30 days, in an intelligible form, in writing or in electronic form at the data subject's request to that effect.

The above information is free of charge if the person requesting the information has not yet submitted an information request to the Company for the same scope of data in the same year. In other cases, a cost reimbursement is set, the amount of which is HUF 5,000.

In the event of refusing the information, the Company communicates to the data subject in writing on the basis of which provision of the Info Act the provision of information was refused. In the event of refusing the information, the Company informs the data subject about the possibility of a judicial remedy and of turning to the National Authority for Data Protection and Freedom of Information.

The Company notifies the National Authority for Data Protection and Freedom of Information of the rejected requests annually, by 31 January of the year following the reference year.

The Company is obliged to make available to the data subject, free of charge, a copy of the personal data being processed. For further copies requested by the data subject, the data controller may charge a reasonable fee based on administrative costs. If the data subject submitted the request electronically, the information must be made available in a widely used electronic format. All this may not adversely affect the rights and freedoms of others.

VII. Rectification, deletion (right to be forgotten) of data, restriction of processing,

the right to data portability. In the event of a change of data, or the detection of erroneous data recording, the data subject may request the rectification of their processed data. The Company rectifies the erroneous data without undue delay. If the personal data does not correspond to reality and the personal data corresponding to reality is available to the Company, the Company rectifies the personal data.

The personal data must be deleted if

the personal data is no longer needed for the purpose for which it was collected or otherwise processed;

the data subject withdraws the consent forming the basis of the data processing, and there is no other legal basis for the data processing;

the data subject objects to the data processing, and there is no overriding legitimate reason for the data processing;

the personal data has been unlawfully processed;

the personal data must be deleted in order to fulfil a legal obligation prescribed in Union or Member State law applicable to the data controller;

the personal data was collected in connection with the offering of information-society services.

The deletion of data may not be initiated if the data processing is necessary: for the purpose of exercising the right to freedom of expression and information; for the fulfilment of an obligation under Union or Member State law applicable to the data controller that prescribes the processing of the personal data, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller; for reasons of public interest in the area of public health, or for archiving, scientific and historical research purposes or statistical purposes, on grounds of public interest; or for the establishment, exercise or defence of legal claims.

The right to restriction of processing:

At the data subject's request, the Company restricts the data processing if one of the following conditions is met:

the data subject contests the accuracy of the personal data, in which case the restriction applies to the period that enables the accuracy of the personal data to be verified;

the data processing is unlawful, and the data subject opposes the deletion of the data and instead requests the restriction of their use;

the data controller no longer needs the personal data for the purpose of data processing, but the data subject requires it for the establishment, exercise or defence of legal claims; or

the data subject has objected to the data processing; in which case the restriction applies to the period until it is established whether the data controller's legitimate reasons override the data subject's legitimate reasons.

If the data processing is subject to restriction, the personal data may, apart from storage, be processed only with the data subject's consent, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for the important public interest of the Union or a Member State.

The Company informs the data subject in advance about the lifting of the restriction of the data processing.

The data subject, and furthermore all those to whom the data was previously transferred, must be notified of the rectification, deletion and restriction. The notification may be omitted if this does not harm the data subject's legitimate interest, having regard to the purpose of the data processing.

If the Company does not fulfil the data subject's request for rectification, restriction or deletion, it communicates in writing, within 30 days of receiving the request, the factual and legal reasons for rejecting the request for rectification, restriction or deletion. In the event of rejecting the request for rectification, deletion or restriction, the Company informs the data subject about the possibility of a judicial remedy, and furthermore of turning to the National Authority for Data Protection and Freedom of Information.

The data subject is entitled to receive the personal data relating to them, which they have provided to the data controller, in a structured, widely used, machine-readable format, and to transfer this data to another data controller.

VIII. Right to object and the right of withdrawal

The data subject may object to the processing of their personal data in the cases set out in Section 21 of the Info Act, and may turn to the Company with their complaint. If the data subject does not find the decision satisfactory, or no decision is made within the above deadline, the data subject may turn to the court within 30 days of the communication of the decision, or of the last day of the deadline.

If the Company establishes that the data subject's objection is well-founded, it terminates the data processing – including further data capture and data transfer – and blocks the data, and notifies of the objection, and furthermore of the measures taken on the basis of it, all those to whom it had previously transferred the personal data affected by the objection, and who are obliged to take measures in order to enforce the right to object.

The data subject is entitled to withdraw their consent at any time. The withdrawal of consent does not affect the lawfulness of the data processing based on consent prior to the withdrawal.

IX. Automated data processing, Unlawful data processing

The data subject is entitled not to be subject to a decision based solely on automated data processing – including profiling – that would significantly affect them.

The Company is obliged to compensate for damage caused to another by the unlawful processing of the data subject's data or by breaching the requirements of data security. The Company is exempt from liability if it proves that the damage was caused by an unavoidable cause outside the scope of the data processing. The Company does not compensate for the damage if it resulted from the intentional or grossly negligent conduct of the injured party.

In such cases, the Company provides every possible assistance to the proceeding authorities in order to establish the identity of the infringing person and to hold them accountable.

X. Data security, storage of data, data protection incident

The Company treats the data subject's personal data as a secret, and does not disclose it to a third party without the data subject's consent – except where required to do so by law.

The Company is obliged to ensure the security of the data, and is furthermore obliged to take those technical and organisational measures and to establish those procedural rules that are necessary for enforcing the data- and secrecy-protection rules.

The Company does not transfer data outside the EU.

The Company stores the data exclusively on a server accessible by its managing director and the person authorised by the latter. The Company protects the data with appropriate measures against unauthorised access, alteration, transfer, disclosure, deletion or destruction, as well as against accidental destruction and damage, and furthermore against becoming inaccessible owing to changes in the applied technology.

Every employee of the Company – including persons employed in other legal relationships – is obliged to bring any data protection incident that has occurred within the Company to the managing director's knowledge without delay. The report contains the name and phone number of the reporter, as well as the subject and a brief description of the incident, and whether the incident affects the Company's IT system. After this, the Company's managing director begins the investigation and assessment of the data protection incident without delay.

The Company's managing director examines the report and, if necessary, requests further data regarding the incident from the reporter. At the request of the Company's managing director, the reporter is obliged to provide: the time and place of the occurrence of the data protection incident, its other circumstances, the scope and quantity of the affected data, the scope and number of the affected persons, its expected effects, and a list of the measures taken to prevent the data protection incident and to mitigate its consequences.

The reporter fulfils the data provision without delay, but at the latest within 24 hours, to the managing director.

If the assessment of the data protection incident requires an investigation, the managing director conducts the investigation.

The investigation must contain whether the data protection incident poses a high risk to the rights and freedoms of the data subjects, what kind of risk it is, and whether it is necessary to inform the data subjects about the incident. If it is not necessary to inform the data subjects, the investigation must also contain the reasons for this. The managing director, if necessary, takes the necessary measures in order to prevent further incidents.

The investigation must be completed at the latest within three working days of the report arriving at the managing director.

The Company keeps a register of the data protection incident.

The register contains:

the scope of the affected personal data,

the scope and number of those affected by the data protection incident,

the time of the data protection incident,

the circumstances and effects of the data protection incident,

the measures taken to remedy it, and

other data prescribed by law.

The managing director ensures the accurate keeping and updating of the data protection incident register.

The Company reports the data protection incident to the National Authority for Data Protection and Freedom of Information without delay after its occurrence, but at the latest within 72 hours, unless the incident is unlikely to pose a risk to the rights and freedoms of natural persons. If the report is not made within the deadline, the managing director is obliged to justify the reason for this to the National Authority for Data Protection and Freedom of Information.

The report to the authority must contain:

the scope and approximate number of the data affected by the data protection incident,

the scope and approximate number of the persons affected by the data protection incident,

the nature and circumstances of the data protection incident,

the name and contact details of the data protection officer,

the likely consequences of the data protection incident, and

the measures taken to remedy and mitigate the data protection incident.

If, as a result of the investigation, it is established that the data protection incident is likely to pose a high risk to the rights and freedoms of natural persons and it is necessary to inform the data subjects, the managing director notifies the data subjects without delay.

The data subjects do not need to be informed:

if the Company has implemented technical, organisational and protective measures with respect to the affected data that prevent access to the data by unauthorised persons or prevent the interpretability of the data;

if, after the occurrence of the data protection incident, the Company has taken measures that ensure that the revealed data-processing risk is unlikely to materialise;

if the information would require disproportionate effort. In this case, the data subjects must be informed by means of publicly disclosed information, which information may also take place electronically.

XI. Procedural rules

The data controller informs the data subject, without undue delay but in any case within one month of the receipt of the request, about the measures taken pursuant to the request under Articles 15–22 of the GDPR. If necessary, taking into account the complexity of the request and the number of requests, this deadline may be extended by a further two months.

The data controller informs the data subject about the extension of the deadline, with an indication of the reasons for the delay, within one month of receiving the request. If the data subject submitted the request electronically, the information is provided electronically, unless the data subject requests otherwise.

If the data controller does not take measures pursuant to the data subject's request, it informs the data subject, without delay but at the latest within one month of the receipt of the request, about the reasons for the failure to take measures, as well as about the fact that the data subject may lodge a complaint with a supervisory authority and may exercise their right to a judicial remedy.

The Company provides the requested information free of charge. If the data subject's request is manifestly unfounded or excessive – in particular owing to its repetitive nature – the data controller may, taking into account the administrative costs of providing the requested information or of taking the requested measure, charge a reasonable fee, or may refuse to act on the request.

The data controller informs every recipient to whom or which the personal data has been disclosed about every rectification, deletion or restriction of processing carried out by it, unless this proves impossible or requires disproportionately great effort. At the data subject's request, the data controller informs them about these recipients.

The data controller makes available to the data subject a copy of the personal data being processed. For further copies requested by the data subject, the data controller may charge a reasonable fee based on administrative costs. If the data subject submitted the request electronically, the information is made available in electronic format, unless the data subject requests otherwise.

XII. Remedy options

In the event of the infringement of their rights, the data subject may turn to the court against the data controller (at the data subject's choice, the court with jurisdiction over the registered office of the defendant or over the place of residence of the data subject).

The court proceeds in the matter as a priority. Litigation initiated in connection with the protection of personal data is exempt from duty. The data subject may initiate an investigation at the National Authority for Data Protection and Freedom of Information (1024 Budapest, Szilágyi Erzsébet fasor 22/C., ugyfelszolgalat@naih.hu, +36-1-3911400, www.naih.hu).

Dated: 25 May 2018 KORZÓ HÁZ KFT.

Mérész Ferenc, managing director