Privacy Notice
1. General provisions
Szinergia Projekt-, Működés- és Változásmenedzsment Kft. (registered office: 1022 Budapest, Bimbó út 1–5., Building C, 1st floor, Door 1; company registration number: 01 09 364617; hereinafter: “Szinergia Kft.”, the “service provider” or the “data controller”), acting as data controller, considers the contents of this Privacy Notice binding upon itself. It undertakes to ensure that the processing of personal data in connection with its services complies with the requirements set out in this Notice.
The legal policies applicable to the www.szinergia.hu website are continuously available. Szinergia Kft. reserves the right to amend this Notice at any time and will inform its audience of any changes in due time. If you have a question that is not clearly answered by this Notice, please contact us and one of our colleagues will respond.
We process personal data in the course of our business activities. We ensure that the processing of personal data is lawful and appropriate in every case. The purpose of this Notice is to provide data subjects, before they provide their personal data, with appropriate information about the purposes for which, the conditions and safeguards under which, and the period for which our company processes their personal data.
Our company complies with the provisions of this Notice in all cases involving the processing of personal data and considers the provisions set out herein binding upon itself. At the same time, we reserve the right to amend the provisions contained in this unilateral declaration, subject to providing appropriate information to data subjects.
Our data processing activities have been designed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, hereinafter: “GDPR”) and Act CXII of 2011 on Informational Self-Determination and Freedom of Information (“Info Act”).
2. DEFINITIONS
2.1. Data subject: any identified natural person or natural person who can be identified, directly or indirectly, on the basis of personal data;
2.2. Personal data: any data relating to a data subject, in particular the data subject’s name, identification details and information relating to one or more factors specific to their physical, physiological, mental, economic, cultural or social identity, as well as any conclusion relating to the data subject that may be drawn from such data;
2.3. Consent: a voluntary and specific indication of the data subject’s wishes, based on appropriate information, by which the data subject gives unambiguous consent to the processing of personal data relating to them, either in full or in relation to specific operations;
2.4. Objection: a declaration by the data subject objecting to the processing of their personal data and requesting that the processing be terminated or that the processed data be erased;
2.5. Data controller: the natural or legal person, or organisation without legal personality, which, alone or jointly with others, determines the purposes of data processing, takes and implements decisions concerning data processing, including the means used, or has such decisions implemented by a data processor;
2.6. Data processing: any operation or set of operations performed on data, irrespective of the procedure used, including in particular collection, recording, organisation, storage, alteration, use, retrieval, transmission, disclosure, alignment or combination, blocking, erasure and destruction, as well as preventing further use of the data, taking photographs, audio or video recordings, and recording physical characteristics suitable for identifying a person, such as fingerprints, palm prints, DNA samples or iris images;
2.7. Data transfer: making data accessible to a specified third party;
2.8. Disclosure: making data accessible to anyone;
2.9. Data erasure: rendering data unrecognisable in such a way that it can no longer be restored;
2.10. Data blocking: marking data with an identification code in order to restrict its further processing permanently or for a specified period;
2.11. Data destruction: the complete physical destruction of the data carrier containing the data;
2.12. Data processing activities: the performance of technical tasks related to data processing operations, irrespective of the method and means used to perform such operations and the place where they are performed, provided that the technical task is carried out on the data;
2.13. Data processor: the natural or legal person, or organisation without legal personality, which processes data on the basis of a contract, including a contract concluded pursuant to a statutory provision;
2.14. Third party: a natural or legal person, or organisation without legal personality, other than the data subject, the data controller or the data processor;
2.15. Third country: any country that is not a member of the European Economic Area.
2.16. Cookie: a text file no larger than 4 kilobytes that an internet browser stores on a computer from servers visited by the user. Its purpose is to make browsing more convenient, as it can store various personal data, passwords, etc. Cookies can be used to personalise websites and, based on browsing history, may also be used for targeted advertising campaigns.
3. PRINCIPLES APPLICABLE TO DATA PROCESSING BY SZINERGIA KFT.
3.1. Personal data may be processed if:
a) the data subject has given consent; or
b) processing is ordered by law or, on the basis of authorisation granted by law and within the scope specified therein, by a local government decree for a purpose based on the public interest.
The validity of a declaration of consent made by a minor who has reached the age of 16 does not require the consent or subsequent approval of their legal representative.
3.2. Personal data may only be processed for a specified purpose, in order to exercise a right or fulfil an obligation. Processing must comply with this purpose at every stage, and the collection and processing of data must be fair and lawful. Only personal data that is essential and suitable for achieving the purpose of processing may be processed, and only to the extent and for the period necessary to achieve that purpose.
3.3. Personal data may only be processed on the basis of informed consent. The data subject must be informed clearly, comprehensibly and in detail of all facts relating to the processing of their data, in particular the purpose and legal basis of processing, the person authorised to carry out the processing and data processing activities, the duration of processing and the persons who may access the data. The information must also cover the data subject’s rights and available remedies in relation to data processing.
4. RULES APPLICABLE TO DATA PROCESSING BY SZINERGIA KFT.
4.1. Legal basis for processing
Pursuant to Section 5(1)(a) of Act CXII of 2011 on Informational Self-Determination and Freedom of Information (hereinafter: the “Data Protection Act”), the legal basis for processing is your informed consent. Providing consent is voluntary.
By giving your consent, you agree that Szinergia Kft., in compliance with the provisions set out in this Privacy Notice, may process personal data relating to you, including images taken of you (collectively, the “Data”), for a predefined purpose and may perform operations on such Data, including in particular collecting, recording, organising, storing, using and erasing the Data.
Where processing is based on the data subject’s consent, the data subject may provide consent electronically by an explicit action performed on the Szinergia Kft. website, by ticking a checkbox, by applying relevant technical settings when using information society services, or by any other statement or action which, in the given context, clearly indicates the data subject’s consent to the intended processing of their personal data.
Silence, pre-ticked boxes or inactivity do not constitute consent.
Consent covers all processing activities carried out for the same purpose or purposes. Where processing serves several purposes, Szinergia Kft. requests consent for all processing purposes. Where a data subject gives consent following an electronic request from Szinergia Kft., the request must in all cases be clear and concise and must not unnecessarily interfere with the use of the service in relation to which consent is requested.
The data subject has the right to withdraw consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. Szinergia Kft. informs the data subject of this before consent is given. Szinergia Kft. makes it as easy to withdraw consent as to give it.
Where personal data has been collected with the data subject’s consent, Szinergia Kft. may, unless otherwise provided by law, continue to process such data without further consent in order to comply with a legal obligation applicable to it, including after the withdrawal of the data subject’s consent.
4.2. Data controller and data processor
The Data is processed by Szinergia Kft. as data controller.
Use of a data processor: our company uses a data processor in connection with the provision of marketing services as described below.
4.3. Duration of processing
Processing continues for an indefinite period, but no longer than until you prohibit the use of the Data for the relevant processing purpose or request the termination of processing.
4.4. Persons with access to the Data
Employees of Szinergia Kft. and its representatives authorised to sign on behalf of the company have access to the Data.
4.5. Rights of data subjects
I. Right to information
1.1. The data subject has the right to receive information from Szinergia Kft. concerning the processing of their data before such processing begins.
1.2. When collecting personal data, Szinergia Kft. provides the data subject with the following information:
the identity and contact details of Szinergia Kft. and its representative;
the purposes of the intended processing of personal data and the legal basis for processing;
where processing is based on legitimate interests, the legitimate interests pursued by Szinergia Kft. or a third party;
where applicable, the recipients or categories of recipients of the personal data;
where applicable, the fact that Szinergia Kft. intends to transfer personal data to a third country or international organisation.
1.3. In addition to the information referred to in point 1.2, at the time the personal data is obtained Szinergia Kft. provides the following additional information to ensure fair and transparent processing:
the period for which the personal data will be stored or, where this is not possible, the criteria used to determine that period;
the data subject’s right to request access to, rectification or erasure of personal data relating to them, restriction of processing and to object to processing, as well as the right to data portability;
where processing is based on consent, the right to withdraw consent at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal;
the right to lodge a complaint with a supervisory authority;
whether the provision of personal data is a statutory or contractual requirement or a requirement necessary to enter into a contract, whether the data subject is obliged to provide the personal data, and the possible consequences of failing to provide such data;
the existence of automated decision-making referred to in Article 22(1) and (4) of the GDPR, including profiling, and, at least in those cases, meaningful information about the logic involved and the significance and envisaged consequences of such processing for the data subject;
where Szinergia Kft. intends to further process personal data for a purpose other than that for which it was collected, it informs the data subject of that other purpose and provides all relevant additional information referred to in points 1.2 and 1.3 before such further processing.
II. Right of access
2.1. The data subject has the right to obtain confirmation from Szinergia Kft. as to whether or not personal data concerning them is being processed and, where such personal data is being processed, to obtain access to the personal data and the following information in accordance with Article 15 of the GDPR:
the purposes of processing;
the categories of personal data concerned;
the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organisations;
where possible, the envisaged period for which the personal data will be stored or, where this is not possible, the criteria used to determine that period;
the right to request rectification or erasure of personal data, restriction of processing or to object to such processing;
the right to lodge a complaint with a supervisory authority;
where the personal data was not collected from the data subject, any available information as to its source;
the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the GDPR and, at least in those cases, meaningful information about the logic involved and the significance and envisaged consequences of such processing for the data subject.
2.2. Where personal data is transferred to a third country or an international organisation, the data subject has the right to be informed of the appropriate safeguards relating to the transfer pursuant to Article 46 of the GDPR.
2.3. Szinergia Kft. provides the data subject with a copy of the personal data undergoing processing. For any further copies requested by the data subject, Szinergia Kft. may charge a reasonable fee based on administrative costs. Where the request is made electronically, the information will be provided in a commonly used electronic format unless otherwise requested by the data subject.
III. Right to rectification
3.1. The data subject has the right to obtain from Szinergia Kft., without undue delay, the rectification of inaccurate personal data concerning them.
3.2. Taking into account the purposes of processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.
IV. Right to erasure (“right to be forgotten”)
4.1. The data subject has the right to obtain from Szinergia Kft. the erasure of personal data concerning them without undue delay, and Szinergia Kft. is obliged to erase such personal data without undue delay where:
the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
the data subject withdraws the consent on which processing is based and there is no other legal ground for processing;
the data subject objects to the processing and there are no overriding legitimate grounds for the processing;
the personal data has been unlawfully processed;
the personal data must be erased in order to comply with a legal obligation under EU or Member State law applicable to Szinergia Kft.;
the personal data was collected in connection with the offer of information society services referred to in Article 8(1) of the GDPR.
4.2. The right to erasure does not apply where processing is necessary:
for exercising the right of freedom of expression and information;
for compliance with a legal obligation under EU or Hungarian law applicable to Szinergia Kft. or for reasons of public interest;
for reasons of public interest in the area of public health;
for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, where the right to erasure would be likely to render impossible or seriously impair the achievement of the objectives of that processing; or
for the establishment, exercise or defence of legal claims.
V. Right to restriction of processing
5.1. Where processing has been restricted, such personal data may, with the exception of storage, only be processed with the data subject’s consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.
5.2. The data subject has the right to obtain restriction of processing from Szinergia Kft. where one of the following applies:
the data subject contests the accuracy of the personal data, for a period enabling Szinergia Kft. to verify its accuracy;
the processing by Szinergia Kft. is unlawful and the data subject opposes erasure of the data and requests restriction of its use instead;
Szinergia Kft. no longer needs the personal data for the purposes of processing, but the data subject requires it for the establishment, exercise or defence of legal claims; or
the data subject has objected to processing, pending verification as to whether the legitimate grounds of Szinergia Kft. override those of the data subject.
5.3. Szinergia Kft. informs the data subject before the restriction of processing is lifted.
6.1. Szinergia Kft. communicates any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate effort.
VII. Right to data portability
7.1. The data subject has the right to receive personal data concerning them which they have provided to Szinergia Kft. in a structured, commonly used and machine-readable format and has the right to transmit that data to another data controller without hindrance from Szinergia Kft., where:
processing is based on consent or a contract; and
processing is carried out by automated means.
7.2. When exercising the right to data portability under point 7.1, the data subject has the right to have the personal data transmitted directly from one controller to another where technically feasible.
7.3. The exercise of the right to data portability is without prejudice to Article 17 of the GDPR concerning the right to erasure. The right to data portability does not apply where processing is necessary for the performance of a task carried out in the public interest. This right must not adversely affect the rights and freedoms of others.
VIII. Right to object
8.1. The data subject has the right, on grounds relating to their particular situation, to object at any time to processing of personal data concerning them carried out in the public interest or in the exercise of official authority, or processing necessary for the purposes of the legitimate interests pursued by Szinergia Kft. or a third party pursuant to Article 6(1)(e) or (f) of the GDPR, including profiling based on those provisions.
In such cases, Szinergia Kft. will no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing is necessary for the establishment, exercise or defence of legal claims.
8.2. Where Szinergia Kft. processes personal data for direct marketing purposes, the data subject has the right to object at any time to processing of personal data concerning them for such marketing, including profiling to the extent that it is related to such direct marketing.
Where the data subject objects to processing for direct marketing purposes, Szinergia Kft. will no longer process the personal data for such purposes.
8.3. Szinergia Kft. explicitly brings the rights referred to in points 8.1 and 8.2 to the attention of the data subject, separately from other information, at the latest at the time of the first communication with the data subject.
8.4. The data subject may exercise the right to object by automated means using technical specifications.
8.5. Where personal data is processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1) of the GDPR, the data subject has the right, on grounds relating to their particular situation, to object to processing of personal data concerning them, unless processing is necessary for the performance of a task carried out for reasons of public interest.
IX. Right not to be subject to automated decision-making
9.1. The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.
9.2. Point 9.1 does not apply where the decision:
is necessary for entering into or performing a contract between the data subject and Szinergia Kft.;
is authorised by EU or Hungarian law applicable to the data controller, which also lays down suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests; or
is based on the data subject’s explicit consent.
9.3. In the cases referred to in points (a) and (c) of section 9.2, Szinergia Kft. implements appropriate measures to safeguard the data subject’s rights, freedoms and legitimate interests, including the right to obtain human intervention from Szinergia Kft., to express their point of view and to contest the decision.
X. Right to lodge a complaint and seek legal remedy
10.1. Right to lodge a complaint with a supervisory authority
Under Article 77 of the GDPR, the data subject has the right to lodge a complaint with a supervisory authority if they consider that the processing of personal data relating to them infringes the GDPR.
The supervisory authority with which the complaint has been lodged is required to inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy under Article 78 of the GDPR.
The data subject may exercise the right to lodge a complaint using the following contact details:
Hungarian National Authority for Data Protection and Freedom of Information
Address: 1125 Budapest, Szilágyi Erzsébet fasor 22/cTelephone: +36 (1) 391-1400Fax: +36 (1) 391-1410Website: http://www.naih.huEmail: ugyfelszolgalat@naih.hu
10.2. Right to an effective judicial remedy against a supervisory authority
Without prejudice to any other administrative or non-judicial remedy, every natural or legal person has the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.
Without prejudice to any other administrative or non-judicial remedy, every data subject has the right to an effective judicial remedy where the competent supervisory authority does not handle a complaint or does not inform the data subject within three months of the progress or outcome of the complaint lodged pursuant to Article 77 of the GDPR.
Proceedings against a supervisory authority must be brought before the courts of the Member State where the supervisory authority is established.
10.3. Right to an effective judicial remedy against a controller or processor
Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, every data subject has the right to an effective judicial remedy where they consider that their rights under the GDPR have been infringed as a result of the processing of their personal data in breach of the GDPR.
Proceedings against a controller or processor must be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has their habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers.
XI. Information concerning a personal data breach
11.1. Where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, Szinergia Kft. informs the data subject of the personal data breach without undue delay.
11.2. The information provided to the data subject under point 11.1 describes the nature of the personal data breach in clear and plain language and includes at least:
the name of the data protection officer or other contact point from whom further information can be obtained;
the likely consequences of the personal data breach;
the measures taken or proposed by Szinergia Kft. to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
11.3. Szinergia Kft. does not inform the data subject if any of the following conditions are met:
Szinergia Kft. has implemented appropriate technical and organisational protection measures and those measures have been applied to the personal data affected by the breach, in particular measures such as encryption which render the personal data unintelligible to persons not authorised to access it;
Szinergia Kft. has taken subsequent measures which ensure that the high risk to the rights and freedoms of the data subject referred to in point 11.1 is no longer likely to materialise;
providing the information would involve disproportionate effort. In such cases, data subjects are informed by means of a public communication or a similar measure which ensures that they are informed in an equally effective manner.
XII. Procedure applicable to requests from data subjects
12.1. Szinergia Kft. facilitates the exercise of data subjects’ rights and may not refuse to act on a request to exercise the rights set out in this Policy unless it demonstrates that it is unable to identify the data subject.
Data subjects may send requests or questions relating to data processing:
by post to:1022 Budapest, Bimbó út 1–5., Building C, 1st floor, Door 1
by email to:szinergia@szinergia.hu
Szinergia Kft. sends its response without delay and no later than within 30 days to the address specified by the data subject.
12.2. Szinergia Kft. provides information on action taken on a request without undue delay and in any event within one month of receipt of the request.
Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months. Szinergia Kft. informs the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay.
12.3. Where the data subject submits the request electronically, Szinergia Kft. provides the information electronically unless otherwise requested by the data subject.
12.4. Where Szinergia Kft. does not take action on the data subject’s request, it informs the data subject without delay and no later than within one month of receipt of the request of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking judicial remedy.
12.5. Szinergia Kft. provides free of charge the information required under Articles 13 and 14 of the GDPR and detailed in this Policy, as well as communications and actions under Articles 15–22 and 34 of the GDPR, including confirmation concerning the processing of personal data, access to personal data, rectification, completion and erasure of data, restriction of processing, data portability, objection to processing and notification of a personal data breach.
12.6. Where a data subject’s request is manifestly unfounded or excessive, in particular because of its repetitive nature, Szinergia Kft. may, taking into account the administrative costs of providing the information or communication or taking the requested action:
charge a fee of HUF 10,000; or
refuse to act on the request.
Szinergia Kft. bears the burden of demonstrating the manifestly unfounded or excessive nature of the request.
Where Szinergia Kft. has reasonable doubts concerning the identity of the natural person making a request under Articles 15–21 of the GDPR, it may request additional information necessary to confirm the identity of the data subject.
12.7. Purposes of data processing
A.) EVENT REGISTRATION
From time to time, Szinergia Kft. sends information and promotional offers relating to available training courses to persons registering for events by email and by post.
Registration for events is available periodically through registration on the www.szinergia.hu website.
By registering for an event, you consent to Szinergia Kft. taking photographs or other images of you during the event and using, publishing and distributing such images without remuneration, for an indefinite period, without territorial limitation and in any manner, including in particular in online advertising, printed media and other promotional materials, as part of its training and promotional materials.
We would like to inform you that, under the amendment to Act LXXVII of 2013 on Adult Education, adult education providers are required to collect identification data from every participant attending a training course.
We are required by law to report the data received to the Adult Education Data Reporting System. The requested data must be provided to Szinergia Kft., which processes such personal data until the last day of the eighth year following the date of the training course.
With the exception of “gender” and “highest level of education”, you may prohibit us from reporting the data to the Adult Education Data Reporting System if you submit a declaration to us to that effect. Data reporting can be restricted in this way where the participant has an education identification number.
If you no longer wish to receive information or promotional offers from Szinergia Kft., you may unsubscribe by clicking the relevant unsubscribe link in the footer of the newsletter or by sending a statement to kepzes@szinergia.hu.
Applicants are responsible for the accuracy of the personal data they provide. Providing false information or another person’s personal data may cause harm to the data subject, who may in such cases initiate civil, criminal or administrative offence proceedings.
B.) REGISTRATION FOR TRAINING COURSES
Training courses can be booked through the TRAINING section of the www.szinergia.hu website.
Registration requires the provision of certain personal data as described in section 12.7/A. In addition, in the case of a job advertisement it may be necessary to upload a CV.
From time to time, Szinergia Kft. may send persons registering for training courses information and promotional offers relating to available courses by email or post.
The personal data provided at registration is necessary for communication, for sending information and offers relating to the training course, for preparing any admission interview and for the completion of the training.
By registering for a training course, you consent to Szinergia Kft. taking photographs or other images of you during the training and using, publishing and distributing such images without remuneration, for an indefinite period, without territorial limitation and in any manner, including in particular in online advertising, printed media and other promotional materials, as part of its educational and promotional materials.
If you no longer wish to receive information or promotional offers from Szinergia Kft., you may unsubscribe using the unsubscribe link in the footer of the newsletter or by sending a statement to kepzes@szinergia.hu.
Users are responsible for the accuracy of the personal data they provide. Providing false information or another person’s personal data may cause harm to the data subject, who may in such cases initiate civil, criminal or administrative offence proceedings.
C.) DATA PROCESSING IN CONNECTION WITH ORDERS, REQUESTS FOR QUOTATIONS AND CONTACT THROUGH THE SZINERGIA KFT. WEBSITE
The use of certain services available on the website, including placing orders or requesting quotations, and contacting Szinergia Kft. requires the data subject to provide personal data voluntarily.
In the case of an order, the additional data referred to in section 12.7/A may also be required.
Accordingly, submitting an order or request for quotation to Szinergia Kft., or providing personal data when contacting the company, constitutes voluntary acceptance of the provisions of this Policy and consent to processing.
The legal basis for processing is the consent given by the data subject through the voluntary provision of personal data. The data subject provides consent on the Szinergia Kft. website by ticking the checkbox next to the wording concerning orders, requests for quotations or contact after receiving information on the processing of their data.
Data subjects: all natural persons who consent to the processing of their personal data on the Szinergia Kft. website.
Categories of data processed: the natural person’s name, email address and telephone number.
Purpose of processing: provision of services available on the website, fulfilment of orders and requests for quotations, contact for the preparation of a contract or for other purposes, including providing information concerning Szinergia Kft.’s products, services, contractual terms and promotions.
Recipients or categories of recipients: executive officers of Szinergia Kft.; employees responsible for customer service and marketing activities; and employees of the service provider operating the Szinergia Kft. website acting as data processor.
Retention period: until the order or request for quotation has been fulfilled or until the data subject withdraws consent and requests erasure.
D.) DATA PROCESSING IN CONNECTION WITH DIRECT MARKETING
The legal basis for Szinergia Kft.’s processing of personal data for direct marketing purposes is the data subject’s clear and explicit consent.
The data subject gives clear, explicit prior consent on the Szinergia Kft. website by ticking the checkbox next to the wording concerning consent to direct marketing communications or in the relevant service agreement, after receiving information regarding the processing of their data.
Data subjects: all natural persons who give clear and explicit consent for their personal data to be processed for direct marketing purposes.
Purpose of processing: carrying out direct marketing activities relating to the activities of Szinergia Kft., including the regular or occasional sending of advertising materials, newsletters and current offers in printed form by post or electronically by email to the contact details provided at registration or when entering into a contract.
Recipients or categories of recipients: executive officers of Szinergia Kft.; employees whose duties include customer service or marketing; and employees of the provider operating the Szinergia Kft. website acting as data processor.
Categories of personal data processed: name, address, telephone number and email address.
Duration of processing: until the data subject withdraws consent to processing for direct marketing purposes.
XIII. OTHER RULES RELATING TO INTERNET USE
13.1. DATA RELATING TO WEBSITE VISITORS
Anyone may view the website without providing personal data.
When visiting the website, a small file known as a “cookie” is stored on the user’s computer or other internet-enabled device, such as a smartphone or tablet, enabling the user’s browser to be uniquely identified, provided that the user has given explicit, active consent following clear and unambiguous information.
By visiting and browsing the website, the data subject consents to Szinergia Kft. processing and recording information that is not considered personal data.
Information not considered personal data consists of technical information from which the data subject cannot be identified and therefore does not fall within the scope of the Info Act. Such information includes, in particular, the IP address, the time of the visit, the type of operating system used and the address of another website that referred the data subject to the website.
Such information is processed automatically for statistical and development purposes for no longer than 60 days following the visit.
Cookies are essential for the proper functioning of the website and also collect information about the use of the website in order to improve the user experience and make the site more convenient and useful.
Some cookies are stored only temporarily, until the browser is closed, while others remain on the computer for a longer period.
During visits to the website, Szinergia Kft. records and processes the following information concerning the visitor and the device used for browsing: the visitor’s IP address, browser type, characteristics of the operating system of the device used for browsing, including language settings, the time of the visit, the page or subpage visited, the function or service used and clicks.
The cookies used on the website do not store information suitable for identifying individuals, and Szinergia Kft. does not process personal data in this respect.
By using the website, the user consents to the use of cookies as described above. Most internet browsers allow cookies to be stored by default without separate intervention or notification by the user.
Where a user does not agree to the use of cookies, the browser settings must be adjusted accordingly. Users may change their browser settings to block cookies or request a warning when a website uses cookies. Further information and assistance in changing these settings can be found in the browser’s help section.
13.2. DATA COLLECTION BY EXTERNAL SERVICE PROVIDERS ON THE WEBSITE
The HTML code of the www.szinergia.hu website may contain links originating from and pointing to external servers independent of Szinergia Kft.
The external server assists in the independent auditing of website traffic and other web analytics data. The web analytics provider, acting on behalf of Szinergia Kft., is authorised to process only data from which information identifying individuals has been removed, and not personal data.
The web analytics service is currently provided by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043) through Google Analytics. Information: www.google.com.
Online bank card payments are processed through the Barion system. Bank card data is not disclosed to the merchant. The service provider, Barion Payment Zrt., is an institution supervised by the National Bank of Hungary under licence number H-EN-I-1064/2013.
XIV. DATA SECURITY MEASURES
Data security measures
14.1. Szinergia Kft. may process personal data only in connection with the activities specified in this Policy and exclusively in accordance with the purpose of processing.
14.2. Szinergia Kft. ensures the security of data and undertakes to implement all technical and organisational measures necessary to enforce applicable legislation concerning data security, data protection and confidentiality, and to establish the procedural rules required for compliance with the legislation referred to above.
14.3. Szinergia Kft. protects data through appropriate measures against accidental or unlawful destruction, loss, alteration, transfer, damage, unauthorised disclosure or access, as well as against becoming inaccessible as a result of technological changes.
The technical and organisational measures implemented by Szinergia Kft. are intended to ensure:
pseudonymisation and encryption of personal data;
the ongoing confidentiality, integrity, availability and resilience of systems and services used for processing personal data;
the ability to restore access to and availability of personal data in a timely manner following a physical or technical incident;
a procedure for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures designed to ensure the security of processing.
14.4. Szinergia Kft. ensures that personal data processed by it may only be accessed by employees and persons acting on behalf of Szinergia Kft. who genuinely require access in order to perform their duties.
14.5. Personal data provided in connection with individual processing activities is stored separately from other data. In accordance with the above provision, separate data sets may only be accessed by employees with the appropriate access rights.
14.6. Szinergia Kft. classifies and treats personal data as confidential. Employees who process personal data in the course of their duties are subject to confidentiality obligations concerning such processing.
Access to personal data is restricted by means of access levels.
14.7. With regard to its IT records, Szinergia Kft. implements the following measures to ensure data security:
continuous protection of the data sets it processes against computer viruses using real-time antivirus software;
physical protection of the hardware components of its IT systems, including protection against physical damage and natural hazards;
protection of IT systems against unauthorised access with regard to both software and hardware;
measures necessary to restore data sets, including regular backups and the separate, secure handling of backup copies.
14.8. To protect paper-based records, Szinergia Kft. takes the necessary measures, in particular with regard to physical security and fire protection.
Managers, employees and other persons acting on behalf of Szinergia Kft. are required to keep data carriers containing personal data in their possession secure, irrespective of the method used to record the data, and to protect them against unauthorised access, alteration, transmission, disclosure, erasure or destruction, as well as accidental destruction and damage.
14.9. In connection with the automated processing of personal data, Szinergia Kft. ensures:
prevention of unauthorised data entry;
prevention of unauthorised persons using automated data processing systems by means of data transmission equipment;
the ability to verify and determine the bodies to which personal data has been or may be transmitted using data transmission equipment;
the ability to verify and determine which personal data was entered into automated data processing systems, when and by whom;
the ability to restore installed systems in the event of a malfunction; and
that errors arising during automated processing are reported.
14.10. To protect personal data, Szinergia Kft. ensures the monitoring of incoming and outgoing electronic communications.
14.11. Szinergia Kft. does not permit personal data processed by it to be shared on the internet, nor does it permit visits to websites offering file-download, gaming, chat or sexual services. The use of unauthorised programs obtained or downloaded from external sources is also prohibited.
14.12. Only authorised employees may access documents relating to work in progress or documents currently being processed.
Szinergia Kft. ensures that personnel, payroll, employment and other documents containing personal data are securely stored and that appropriate physical protection is provided for the data, the devices carrying the data, IT hardware and documents.
XV. MANAGEMENT OF PERSONAL DATA BREACHES
Definition of a personal data breach
15.1. A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed. (Article 4(12) of the GDPR)
15.2. A personal data breach includes, for example:
loss of a device containing personal data, such as a laptop or mobile phone;
insecure storage of personal data, such as employment documents disposed of in general waste;
insecure transmission of data;
unauthorised copying, transmission or disclosure of customer or partner lists;
an attack on the IT system;
an email containing personal data being sent to an incorrect recipient.
Handling and remediation of personal data breaches
15.3. The prevention and management of personal data breaches and compliance with the relevant legal requirements are the responsibility of an executive officer of Szinergia Kft.
15.4. Where a personal data breach is detected, an executive officer of Szinergia Kft. immediately conducts an investigation to identify the breach and determine its possible consequences.
Szinergia Kft. examines and establishes:
the time and place of the incident;
a description of the incident, its circumstances and effects;
the categories and volume of data compromised;
the persons affected by the compromised data;
the measures taken to contain the incident;
the measures taken to prevent, remedy or mitigate damage.
In the event of a personal data breach, Szinergia Kft. identifies and isolates the affected systems, persons and data and ensures that evidence supporting the occurrence of the incident is collected and preserved. Szinergia Kft. then begins remediation of the damage and restoration of lawful operations.
15.5. Szinergia Kft. notifies the competent supervisory authority of a personal data breach without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.
Records of personal data breaches
15.6. Szinergia Kft. maintains records of personal data breaches containing:
the categories of personal data concerned;
the categories and number of data subjects affected;
the date of the personal data breach;
the circumstances and effects of the personal data breach;
the measures taken to remedy the personal data breach;
any other information required by legislation governing the processing.
15.7. Szinergia Kft. retains the information relating to personal data breaches contained in the records for five years.
XVI. AMENDMENTS TO THE WEBSITE AND THIS PRIVACY NOTICE
Szinergia Kft. expressly reserves the right to amend unilaterally, without limitation or prior notice, the content of the website operated by it and this Privacy Notice at any time, and to discontinue or suspend any service.
SZINERGIA KFT.
