Privacy Policy 

The purpose of this Privacy Notice is to ensure that, prior to the commencement of data processing, persons concerned by such processing are given the opportunity to become acquainted with the information relating to the processing of their personal data, as well as their rights and available legal remedies.
The Data Controller operates several websites (https://prosilva.hu/, https://tudastar-prosilva.hu/), as well as a social media page (https://www.facebook.com/prosilvahungaria/). In addition, as a professional forestry organization, it organizes forestry-related events, further training courses, and lectures, and communicates with its members and other audiences.
Name and Contact Details of the Data Controller
Name of the Data Controller
Pro Silva Hungaria Association
Registered Office of the Data Controller
1021 Budapest, Budakeszi út 91.
Registration Number of the Data Controller
00 18 581034
Tax Number of the Data Controller
18581034141
Postal Address of the Data Controller
1021 Budapest, Budakeszi út 91.
Customer Service Email Address of the Data Controller
hello@tudastar-prosilva.hu
Customer Service Telephone Number of the Data Controller
+36-30-505-36-48
Definitions
Personal Data: any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Data Subject: the identified or identifiable person to whom the Personal Data relates. If we process your data, then you are also a Data Subject.
Data Processing: any operation or set of operations which is performed on Personal Data or on sets of data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
Profiling: any form of automated processing of Personal Data consisting of the use of Personal Data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
Pseudonymisation: the processing of Personal Data in such a manner that the Personal Data can no longer be attributed to a specific natural person without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the Personal Data is not attributed to an identified or identifiable natural person.
Filing System: any structured set of Personal Data which is accessible according to specific criteria, whether centralized, decentralized, or dispersed on a functional or geographical basis.
Data Controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data; where the purposes and means of such processing are determined by Union or Member State law, the Data Controller or the specific criteria for its designation may be provided for by Union or Member State law.
Data Processor: a natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Data Controller.
Data Processing by a Processor: all data processing activities carried out by the Data Processor on behalf of the Data Controller.
Recipient: a natural or legal person, public authority, agency or another body, to which the Personal Data are disclosed, whether a third party or not. However, public authorities which may receive Personal Data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as Recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing.
Third Party: a natural or legal person, public authority, agency or body other than the Data Subject, the Data Controller, the Data Processor, and persons who, under the direct authority of the Data Controller or Data Processor, are authorized to process Personal Data.
Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed.
GDPR: REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (27 April 2016) on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
Data Protection Legislation: the GDPR and all other Union or Member State legislation applicable to data processing.
Supervisory Authority: an independent public authority established by a Member State pursuant to Article 51 of the GDPR.
Special Categories of Data: Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation.
Genetic Data: all Personal Data relating to the inherited or acquired genetic characteristics of a natural person which provide unique information about the physiology or health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person concerned.
Biometric Data: Personal Data resulting from specific technical processing relating to the physical, physiological or behavioral characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data.
Health Data: Personal Data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status.
Main Establishment:
• a) as regards a Data Controller with establishments in more than one Member State, the place of its central administration in the Union, unless the decisions on the purposes and means of the processing of Personal Data are taken in another establishment of the Data Controller in the Union and that establishment has the power to have such decisions implemented, in which case the establishment having taken such decisions is to be considered the main establishment;
• b) as regards a Data Processor with establishments in more than one Member State, the place of its central administration in the Union, or, if the Data Processor has no central administration in the Union, the establishment of the Data Processor in the Union where the main processing activities in the context of the activities of an establishment of the Data Processor take place, insofar as the Data Processor is subject to specific obligations under the GDPR.
Representative: a natural or legal person established in the Union who, designated in writing by the Data Controller or Data Processor pursuant to Article 27 of the GDPR, represents the Data Controller or Processor with regard to their respective obligations under the GDPR.
Undertaking: a natural or legal person engaged in an economic activity, irrespective of its legal form, including partnerships or associations regularly engaged in an economic activity.
Group of Undertakings: a controlling undertaking and its controlled undertakings.
Binding Corporate Rules: Personal Data protection policies adhered to by a Data Controller or Data Processor established in the territory of a Member State for transfers or a set of transfers of Personal Data to a Data Controller or Processor in one or more third countries within a group of undertakings, or group of enterprises engaged in a joint economic activity.
Cross-border Processing of Personal Data:
• a) processing of Personal Data which takes place in the context of the activities of establishments in more than one Member State of a Data Controller or Data Processor in the Union where the Data Controller or Processor is established in more than one Member State; or
• b) processing of Personal Data which takes place in the context of the activities of a single establishment of a Data Controller or Data Processor in the Union but which substantially affects or is likely to substantially affect Data Subjects in more than one Member State.
3. Principles, Purposes and Legal Bases of Data Processing, and Rules for Determining the Storage Period
3.1. Principles of Data Processing
The Data Controller processes Personal Data in accordance with the following principles:
Lawfulness, fairness and transparency
Personal Data are processed lawfully, fairly and in a transparent manner for the Data Subject (you).
Purpose limitation
Personal Data may only be collected and processed for specified, explicit and legitimate purposes, and may not be processed in a manner incompatible with those purposes.
Further processing for archiving purposes in the public interest, scientific and historical research purposes or statistical purposes shall not be considered incompatible with the original purposes.
Data minimisation
We only process Personal Data that are adequate, relevant and limited to what is necessary in relation to the purposes of the processing.
Accuracy
Personal Data must be accurate and, where necessary, kept up to date.
We take every reasonable step to ensure that inaccurate Personal Data are erased or rectified without delay.
Storage limitation
Personal Data shall be kept only for as long as necessary to identify Data Subjects for the purposes of processing.
Personal Data may be stored for longer periods only where the Personal Data are processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to appropriate technical and organizational measures required to safeguard the rights and freedoms of Data Subjects.
Integrity and confidentiality
We ensure appropriate security of Personal Data through appropriate technical and organizational measures, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage.
Accountability
We take responsibility for compliance with the principles listed above.
3.2. Purpose of Data Processing
Each of our processing activities is carried out in order to achieve a specific purpose; the lawfulness of the purpose is examined in accordance with the rules described below regarding legal bases.
We ensure that our processing complies with this purpose at every stage.
The purpose of processing also affects the categories of processed data, because under the principle of purpose limitation, Personal Data may only be processed to the extent and for the duration necessary to achieve the purpose.
Change in the purpose of processing: the processing of Personal Data for a purpose other than that for which they were originally collected is only permitted if such processing is compatible with the original purposes for which the Personal Data were collected. In that case, no separate legal basis is required beyond the one that originally permitted the collection of the Personal Data.
3.3. Legal Bases of Data Processing
The legal bases for processing may be the following:
• the Data Subject (for example, you) has given consent for one or more specific purposes;
• performance of a contract:
• the processing is necessary for the performance of a contract to which the Data Subject (for example, you) is party;
• the processing is necessary in order to take steps at the request of the Data Subject prior to entering into such a contract;
• the processing is necessary for compliance with a legal obligation to which the Data Controller is subject;
• the processing is necessary in order to protect the vital interests of the Data Subject (for example, you) or of another natural person;
• the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller;
• the processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party.
An exception applies where such legitimate interests are overridden by the interests or fundamental rights and freedoms of the Data Subject which require protection of Personal Data.
This exception particularly applies if the Data Subject is a child.
Special Categories of Data may be processed in cases defined by Data Protection Legislation, as well as where the Data Subject gives written consent to the processing.
3.4. Rules for Determining the Duration of Data Processing
As a general rule, the Data Controller is obliged to erase all Personal Data:
• where the purpose of processing has ceased to exist; or
• where the sole legal basis for processing is the consent of the Data Subject (for example, your consent), and the Data Subject has withdrawn such consent; and
• where there is no legal basis for the processing;
• where the processing is not necessary for compliance with legal obligations;
• where the processing is not necessary for the protection of the vital interests or legitimate interests of the Data Controller (subject to the restrictions set out above).
4. Individual Data Processing Activities
The Data Controller may process your data for the following purposes. For each purpose, the legal basis, the categories of processed data and the duration of processing are also indicated.
Please note in advance that in the case of natural person contact persons of legal entities, regardless of the legal basis indicated below, the legal basis for processing shall be considered the legitimate interest of the Data Controller.
Contact
Categories of processed data
Name, telephone number, email address, postal address; in the case of a legal entity, the name, telephone number and email address of the natural person contact person.
Legal basis of processing
Your consent.
Purpose of processing
The listed data are necessary so that the Data Controller can respond to you.
Source of the data
You (as the person requesting contact) provide the data.
Duration of processing
The processed data are deleted after contact has been established with you, unless further processing takes place as described below.
Possible consequences of refusing to provide data
You will not be able to contact the Data Controller.
Services of the websites www.prosilva.hu and www.tudastar-prosilva.hu are only available upon registration
Categories of processed data
Name, email address, billing address, telephone number, selected Service, in the case of professional further training the professional staff code, date of birth, mother’s name, and the fact of acceptance of the General Terms and Conditions and this Privacy Notice.
Legal basis of processing
Necessary for taking steps prior to entering into a contract, and for issuing certificates.
Purpose of processing
The Services described in the GTC are made available through the website and are subject to payment; the processing is necessary for establishing eligibility, and the data required for billing are also collected.
Source of the data
You provide the Personal Data during registration.
Duration of processing
Until you request deletion of the registration and/or termination of the contract.
Possible consequences of refusing to provide data
The Services provided by the website www.tudastar-prosilva.hu cannot be used.
Redirection to the payment service provider’s page
Certain services available on the website www.tudastar-prosilva.hu are provided against payment.
For the purpose of payment, you are redirected to the website of a service provider enabling card payments.
Categories of processed data
Data sent by the Data Controller to the card payment service provider:
• the amount to be credited,
• the frequency / due date of recurring payments.
After the payment transaction, the Data Controller receives notification as to whether the payment was successful and with what parameters the recurring payment was set up. The card payment service provider transfers the following data to the Data Controller:
• the amount of the transaction,
• if the payment was unsuccessful, information on that fact.
Legal basis of processing
Necessary for taking steps prior to entering into a contract.
Purpose of processing
Processing of the payment.
Source of the data
You provide your data on the page of the card payment service provider.
Duration of processing
Recurring payments may be cancelled both on the website www.tudastar-prosilva.hu and on the website of the card payment service provider. Following cancellation, the Data Controller deletes the Personal Data related to the payment after the expiry of the retention period required by tax and accounting legislation.
Possible consequences of refusing to provide data
The services provided by the website www.tudastar-prosilva.hu cannot be used.
Website visit data (“Cookies”)
Some of the so-called “cookies” stored on the websites collect anonymized statistical data, while others are capable of assessing the personality profile of the visitor to the given website. Customers are informed about the use of cookies by means of a clearly visible notice displayed on the relevant website of the Data Controller, next to which a link is provided through which the more detailed information referred to in the above annex can be accessed.
Cookies are placed on your computer through the use of the website, by being downloaded and stored by your internet browser. Most commonly used internet browsers accept and enable the download and use of cookies by default, but it is up to you to reject or disable them by changing your browser settings, and you may also delete cookies already stored on your computer.
Detailed information on cookies can be found on each website operated by the Data Controller.
Data processing related to lectures and events
The Data Controller makes participation in its lectures subject to prior registration.
Categories of processed data
Name, billing address, telephone number, email address,
date, location and fee of the lecture,
date of registration.
Legal basis of processing
Necessary for taking steps prior to concluding a “contract” (more precisely, making a reservation for participation in the lecture).
The processing of contact details is in the joint legitimate interest of the Data Controller and the person wishing to participate in the lecture.
Purpose of processing
Conclusion of the “contract” (reservation of participation), identification of the participant. Collection of contact data serves communication between the Data Controller and the participant.
Source of the data
The person registering for the lecture provides the data.
Duration of processing
Contracts containing the above data are destroyed after the expiry of the retention period prescribed by the applicable tax and accounting legislation in force at any given time (at the time of issuing this Privacy Notice, the retention period is 8 years after the termination of the contract).
Possible consequences of refusing to provide data
Participation in the lecture held by the Data Controller is not possible.
Issuing invoices
Categories of processed data
name,
address,
email address,
type of service (e.g. lecture, professional further training, or other service, etc.),
in the case of providing access to the Pro Silva Knowledge Base, the relevant payment period,
method and due date of payment.
Legal basis of processing
Legal obligation.
Purpose of processing
Necessary in order to ensure compliance with obligations set out in tax and accounting legislation.
The email address is required for sending the electronic invoice.
Source of the data
You provide the data, for example during registration for a program and completion of the participation agreement, or in the case of other services by registering on the website www.tudastar-prosilva.hu or when applying for programs, etc.
In the case of registration on the website www.tudastar-prosilva.hu, data may later be modified through the user profile.
Duration of processing
The above data are deleted after the expiry of the retention period prescribed by the tax and accounting legislation in force at the time (at the time of issuing this Privacy Notice, this period is 8 years after the termination of the contract).
Possible consequences of refusing to provide data
Refusal to provide such data is conceptually excluded, since invoicing is always preceded by some other act by the Data Subject during which such data are provided (e.g. applying for a seminar, registering on the Data Controller’s website, etc.).
Communication with the Data Controller’s suppliers and subcontractors
Categories of processed data
Identification data (e.g. the name of a sole proprietor, registration number and tax number serving identification), contact data (mailing address, email, telephone number), professional staff identification number, birth data, and in the case of a legal entity the name and contact details of the private individual contact person as listed above; payment data (e.g. bank account number, name of the account-holding bank).
Legal basis of processing
The legal basis is partly that the processing is necessary for the performance of the contract (e.g. payment), and partly compliance with a legal obligation, since the Data Controller is obliged to retain contracts under applicable accounting legislation.
Purpose of processing
Performance of obligations arising from the contract (payment and other obligations), as well as compliance with accounting legislation.
Source of the data
You (as supplier or subcontractor) provide the data.
Duration of processing
The above data are deleted after the expiry of the retention period prescribed by the accounting legislation in force at any given time. At the time of issuing this Notice, this is 8 years after the termination of the contractual relationship / placement of the individual order. The contact details of sole proprietors and the name and contact details of private individual contact persons of legal entities may be deleted at their request after performance of the contract, provided that the supplier has also fulfilled all of its obligations.
If the contract is ultimately not concluded, the collected data are deleted by the Data Controller after the expiry of the offer validity period.
Possible consequences of refusing to provide data
No contract will be concluded with the supplier or subcontractor.
Operation of the Facebook page
The Data Controller maintains a fan page on Facebook at https://www.facebook.com/prosilvahungaria/.
Categories of processed data
The Data Controller, as a Facebook user, may see the list of persons who like and follow the page, and by clicking on their profile can view their public profile, comments or likes made on certain posts, and may receive messages sent to it through the fan page.
The Data Controller draws your attention to the fact that activities carried out by commenters and users liking the page are also visible to other Facebook users.
Legal basis of processing
By clicking the “Like” or “Follow” button on the Data Controller’s Facebook page, you consent to the Data Controller’s news and offers being displayed on your own news feed.
Purpose of processing
The Data Controller maintains its own page on the Facebook social media platform. The purpose of processing is to increase the Data Controller’s visibility, publish marketing advertisements and promote prize games.
Source of the data
The data become accessible to the Data Controller and to other Facebook users through your actions (pressing the Like button, pressing the Follow button, posting, etc.).
Duration of processing
When you click on the unfollow or unlike function of the Data Controller’s Facebook page, your relationship with the Data Controller on the Facebook platform ceases.
To delete comments you previously posted on the Data Controller’s Facebook page, please delete those comments yourself using the appropriate Facebook functions.
Possible consequences of refusing to provide data
You will not receive automatic notifications from Facebook about new information posted by the Data Controller on its page.
Information about Facebook’s own data processing can be found in Facebook’s privacy policy at www.facebook.com or https://www.facebook.com/privacy/explanation. Facebook may continue to process data concerning your activity related to the Data Controller’s Facebook page even after you have withdrawn your following of the page. The Data Controller excludes liability for Facebook’s own data processing concerning your activities in relation to the Data Controller’s Facebook page, as it has no control over such processing.
Information about Facebook’s own data processing can also be found in Facebook’s privacy policy at www.facebook.com or https://www.facebook.com/privacy/explanation. Facebook may continue to process data related to your activities concerning the Data Controller’s Facebook group even after you have left the group, or even after you have already deleted your previous comments or posts or had them deleted by the Data Controller. The Data Controller excludes liability for Facebook’s own data processing regarding your activities related to the Data Controller’s Facebook groups, as it has no control over such processing.
Newsletter
Please note that the following do not qualify as newsletters: cases where the processing of the email address primarily serves the identification of the Data Subject, for example during registration, in the case of an order, at the time of payment, or serves communication during the performance of orders or the use of services. In addition, in the event of changes to the services provided by the Data Controller or to the GTC, the Data Controller may in certain cases send information about such changes electronically by email to recipients.
Categories of processed data
email address, name
Legal basis of processing
Your consent.
Purpose of processing
The purpose of processing is communication and to enable the Data Controller to inform you about its offers, i.e. to send you marketing messages by email.
Source of the data
You provide the data.
Duration of processing
Until withdrawal of consent, but no longer than 5 years. If the Data Controller and you are also in another type of relationship besides newsletter distribution (e.g. due to your prior use of one of its services), then even after you unsubscribe from the newsletter your data may continue to be processed where necessary (due to accounting legislation), but no further newsletters will be sent to you.
Unsubscribing from the newsletter is not considered to mean that you also wish to terminate your registration in the magabiztosthetas.hu webshop. If that is your intention, please indicate this separately in the system or via the contact details provided above.
Possible consequences of refusing to provide data
The Data Controller will not be able to send you information about favorable offers and promotions.
Complaint handling
Categories of processed data
Identification data (e.g. name, etc.),
contact data (mailing address, email, telephone number),
name of the service used,
date of use of the service,
subject matter of the complaint and action taken in relation thereto.
Legal basis of processing
The data contained in the complaint are provided by you voluntarily; however, thereafter the retention of documentation relating to the complaint constitutes a legal obligation for the Data Controller pursuant to Section 17/A of Act CLV of 1997 on Consumer Protection.
Purpose of processing
Complaint handling.
Source of the data
You provide the data. Data generated in connection with the response to the complaint written by the Data Controller originate from the Data Controller.
Duration of processing
The Data Controller deletes the data 5 years after the complaint has been investigated.
Thereafter, the opinions thus received, and any related data provided which cannot be traced back to or linked with the given Data Subject, may also be used by the Data Controller for statistical purposes.
Possible consequences of refusing to provide data
You will not be able to lodge a complaint with the Data Controller.
Registration of eligibility for discounts
Categories of processed data
identification data – name;
data necessary for establishing eligibility for a discount – e.g. membership status; or a service package purchased through the website www.tudastar-prosilva.hu that entitles the purchaser to discounts; or any other circumstance defined unilaterally by the Data Controller that gives entitlement to a discount, etc.;
the fact that the discount has been used.
Legal basis of processing
Performance of a contract, since discounts may be used on the basis of a previously used service; the terms of that earlier service include the discounts.
Purpose of processing
Registration of eligibility for discounts and the use of discounts.
Source of the data
You provide the data simply by using a service of the Data Controller that entitles you to discounts.
Duration of processing
The data are deleted 5 years after the use of the service entitling you to the discount.
Possible consequences of refusing to provide data
Conceptually excluded, since the creation of eligibility for discounts is preceded by the use of one of the Data Controller’s services.
Making image, audio or video recordings at the Data Controller’s events and seminars
The Data Controller may make image or video recordings at its own events, seminars and training sessions. These cases include:
• image or video recordings presenting the atmosphere of seminars. The recordings are primarily focused on the Data Controller or its co-speakers; they are not intended to record participants directly, or in such a way that they are identifiable. Nevertheless, if a participant turns toward the camera at the time of recording, the participant may become recognizable in the recording;
• image and audio recordings made in online closed groups: these are public only within the group;
• videos made with participants of the events in which they share their experiences and opinions about the seminar/other event. In these videos, the participant is expressly visible.
Categories of processed data
The image of the participant Data Subject (for example, your likeness), and possibly voice, if he or she also speaks.
Legal basis of processing
Image or video recordings presenting the atmosphere of seminars: legitimate interest of the Data Controller.
Audio recordings made in online closed groups: legitimate interest of the Data Controller and group members.
Opinion videos: based on a copyright agreement concluded with the Data Controller. Signing such agreement is not a condition of participation at the events or seminars.
Purpose of processing
Image or video recordings presenting the atmosphere of seminars: the purpose is to allow the Data Controller to present its events, seminars and speaking skills; to illustrate the number of participants; and to give an authentic picture of its activities.
Recordings made in online closed groups: a tool facilitating the joint meditation of the group members.
Opinion videos: sharing participants’ experiences with the public.
Source of the data
The participant provides the data through his or her presence at the event or seminar, or through participation in the group.
Duration of processing
Until the participant objects.
Possible consequences of refusing to provide data
Image or video recordings presenting the atmosphere of seminars: the participant may indicate that he or she does not wish to appear in the recordings; in that case, he or she may only participate in an event where no recording is made.
Audio recordings made in online closed groups: the group member may indicate that he or she does not wish to appear in recordings, in which case the parts relating to him or her will be cut out of the final recording; or he or she may participate actively on another occasion where no recording is made.
Opinion videos: no opinion video is made without the participant’s conscious, active cooperation.
Source of the data
The data are obtained from the Data Subject (that is, from you).
The data of the private individual contact person of a legal entity may also be provided by another contact person or representative of the legal entity.
Data processing operations and persons authorized to access the data
Data processing operations may include: collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
Data transfer
Data transfer means the transmission of data to, or making data accessible for, a third party (see the definition of Recipient among the definitions).
The Data Controller only discloses or transfers Personal Data under the conditions and to the extent permitted by Data Protection Legislation. Personal Data may be transferred if:
• you have consented to it (e.g. transfer for marketing purposes); or
• it is necessary for the performance of a contract concluded or to be concluded with you; or
• it is permitted or required by Data Protection Legislation (e.g. in response to requests from supervisory authorities, courts or the police); or
• in limited cases, if it is permitted by the legitimate interests of the Data Controller or a third party; should such a case arise, the Data Controller will carry out a balancing test and supplement this Notice accordingly with its result.
The Data Controller hereby informs you that, under applicable Data Protection Legislation, transfer of data to a Member State of the European Union is to be treated as if the transfer took place within the territory of Hungary.
Transfer of data outside the European Union
The Data Controller informs you that it does not transfer your Personal Data outside the territory of the European Union.
Data Processors
The Data Controller is entitled to engage Data Processors and transfer data to them. The Data Controller informs you that the transfer of data for processing and the engagement of a Data Processor do not require prior consent under Data Protection Legislation, but do require that Data Subjects be informed. The Data Processor may not make substantive decisions concerning data processing; it may process the Personal Data coming to its knowledge exclusively as a technical task, in accordance with the instructions of the Data Controller, may not carry out processing for its own purposes, and is obliged to store and preserve the Personal Data in accordance with the instructions of the Data Controller.
The range of Data Processors may change; their list can be found in Annex 1.
Data security
Data are stored and processed at the registered office or business premises of the Data Controller; in the case of activities involving data processing by a processor, storage and processing may also take place at the registered office or business premises of the Data Processor.
The Data Controller implements appropriate technical and organizational measures in order to guarantee an adequate level of data security, including, among other things, ensuring the ongoing confidentiality of Personal Data.
The Data Controller regularly reviews its data security measures. Such measures include the physical protection of data (storage of paper-based documents in locked premises), IT protection of the Data Controller’s websites, protection of IT devices by antivirus software, firewall and passwords, and rules relating to erasure upon request.
In its cooperation with Data Processors, the Data Controller also takes data security requirements into account. Therefore, the contracts concluded with them contain guarantees regarding the security of processing, for example technical and organizational requirements and the confidentiality obligations of employees of the Data Processor. The same purpose is served by the rule that the Data Processor may only engage an additional processor with the prior authorization of the Data Controller.
The Data Controller draws your attention to the fact that data transfer over the internet cannot be considered fully secure. However, the Data Controller cannot assume full responsibility for data transfers made through its website.
If you register on any website of the Data Controller, please keep your username and password carefully and do not share them with anyone.
The Data Controller requests that, should any of your data change, you notify the Data Controller within 8 days, as only in this case can it provide its services to you at the appropriate standard; this includes, among other things, sending invoices to the correct email address, etc.
5. Your rights and legal remedies
General rules concerning the rights of Data Subjects (including you)
You may contact the Data Controller at any time with the types of requests defined below. The Data Controller will inform you of its position or of any measures taken within 25 days of receipt of the request.
If the Data Controller does not agree with your request, it will inform you of its position and the available legal remedies no later than 25 days from receipt of the request.
The Data Controller shall comply with the below types of requests free of charge. If your request is manifestly unfounded or, in particular because of its repetitive nature, excessive, the Data Controller may charge a reasonable fee taking into account the administrative costs.
Specific rights to which you are entitled
Right of access (also called the right to information)
You have the right to obtain confirmation from the Data Controller as to whether or not your Personal Data are being processed, and, where that is the case, access to the following information:
• a) the purposes of the processing;
• b) the categories of Personal Data concerned;
• c) the recipients or categories of recipients to whom the Personal Data have been or will be disclosed;
• d) the planned period for which the Personal Data will be stored;
• e) your following rights: you may request rectification, erasure or restriction of processing of your Personal Data, and object to such processing;
• f) the right to lodge a complaint with a supervisory authority.
If Personal Data are transferred to a country outside the European Union or to an international organization, you are entitled to be informed of the appropriate safeguards relating to the transfer.
If you request it, the Data Controller shall provide you with a copy of your Personal Data. If you submitted the request electronically, the information will be provided in electronic format unless you request otherwise.
Right to rectification
You have the right to request the rectification or completion of your Personal Data.
Right to withdraw consent
Where the processing is based on your consent, you have the right to withdraw that consent at any time. Please note that where the processing has a legal basis other than consent as well, withdrawal of consent does not result in termination of the processing.
Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
In the case of registration on the website www.tudastar-prosilva.hu, you may withdraw your consent to processing free of charge at any time by deleting your user profile.
Right to erasure
You have the right to request that the Data Controller erase your Personal Data in the following cases:
• a) the Personal Data are no longer necessary in relation to the purposes for which they were collected;
• b) you withdraw your consent on which the processing is based and there is no other legal basis for the processing;
• c) you object to processing based on legitimate interests and there are no overriding legitimate grounds for the processing;
• d) you object to the processing of your Personal Data for direct marketing purposes;
• e) your Personal Data have been unlawfully processed;
• f) the Personal Data must be erased for compliance with a legal obligation under Data Protection Legislation applicable to the Data Controller;
• g) the Personal Data were collected in relation to the offer of information society services to a child under the age of 16.
The Data Controller is not required to comply with a request for erasure where processing is necessary:
• a) for exercising the right of freedom of expression and information;
• b) for compliance with a legal obligation requiring processing under legislation applicable to the Data Controller;
• c) for reasons of public interest in the area of public health as defined in the GDPR;
• d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes; or
• e) for the establishment, exercise or defense of legal claims.
Right to be forgotten
If the Data Controller is obliged, under the above, to erase any of your Personal Data at your request, it shall take reasonable steps to inform other Data Controllers processing your data that you have requested the erasure of links to, or copies of, those Personal Data.
Right to restriction of processing
You may request that the Data Controller restrict processing in the following cases:
• a) you contest the accuracy of the Personal Data – in this case the restriction applies for a period enabling the Data Controller to verify the accuracy of the Personal Data;
• b) the processing is unlawful and you oppose the erasure of the data and request the restriction of their use instead;
• c) the Data Controller no longer needs your Personal Data for processing purposes, but you require them for the establishment, exercise or defense of legal claims; or
• d) you have objected to processing based on legitimate interests; in this case the restriction applies for the period until it is determined whether the legitimate grounds of the Data Controller override your grounds.
Where processing has been restricted, such Personal Data may, with the exception of storage, only be processed with your consent or for the establishment, exercise or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.
Right to data portability
You may request that the Personal Data you have provided to the Data Controller:
• be provided to you by the Data Controller in a structured, commonly used and machine-readable format; and
• be transmitted by the Data Controller to another Data Controller,
if:
• a) the legal basis for the processing is your consent or the processing is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract; and
• b) the processing is carried out by automated means.
Right to object
You have the right to object to the processing of your Personal Data where the processing is based on the legitimate interests of the Data Controller.
In such case, the Data Controller may continue to process the Personal Data only if it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or which relate to the establishment, exercise or defense of legal claims.
Where Personal Data are processed for direct marketing purposes, you have the right to object to processing of your Personal Data for such purposes. In that case, the Personal Data may no longer be processed for such purposes.
Rights related to automated decision-making
If the Data Controller uses a procedure based on automated processing, you have the right to:
• receive information about how this may affect you;
• request that the Data Controller arrange for a person to carry out the operation concerning you instead of an automated decision;
• object to automated decision-making.
This right does not apply where the decision:
• a) is necessary for entering into, or performance of, a contract between you and the Data Controller;
• b) is authorized by Data Protection Legislation applicable to the Data Controller, which also lays down suitable measures to safeguard your legitimate interests; or
• c) is based on your explicit consent.
The Data Controller informs you that it does not apply either automated decision-making or profiling.
Legal remedies available to the Data Subject
If:
• your request regarding the rights described above is rejected and you do not agree with that decision; or
• the deadline described in connection with the exercise of your rights has not been complied with,
then you, as the Data Subject, may turn to a court.
Data protection lawsuits fall within the jurisdiction of the tribunal. At your choice, the action may also be brought before the competent county court of your place of residence or stay.
You may also initiate proceedings before the data protection authority:
National Authority for Data Protection and Freedom of Information
1055 Budapest, Falk Miksa utca 9-11.
Postal address: 1374 Budapest, P.O. Box 603
Email: ugyfelszolgalat@naih.hu
Telephone: +36 1 391 1400
Fax: +36 1 391 1410
A foreign national may also lodge a complaint with the supervisory authority competent according to his or her place of residence.
We recommend that before initiating proceedings before an authority or court, you first use the possibility of filing an objection or complaint with the Data Controller.
Amendment of the Privacy Notice
The Data Controller reserves the right to amend this Privacy Notice, about which Data Subjects shall be informed in an appropriate manner.
Annexes
• List of Data Processors and other Recipients
• List of the most important legal acts applicable to data processing
Annex No. 1
List of Data Processors and Other Recipients
1. Hosting provider
Activity performed by the Data Processor: hosting service
Name of the Data Processor: CWeb Hosting Kft.
Company registration number: Cg.01-09-405273
Registered office: 1173 Budapest, Borsó utca 12-32
Email: info@cweb.hu
CWeb Hosting Kft.’s privacy notice is available at:
https://cweb.hu/adatkezelesi-tajekoztato/
Categories of processed data: all Personal Data provided by the Data Subject.
Categories of Data Subjects: all Data Subjects using the websites.
Purpose of processing: making the website available and ensuring its proper operation.
Duration of processing / deadline for erasure: as described in the above-mentioned Privacy Notice.
2. Invoicing
Activity performed by the Data Processor: provision of invoicing software.
Name of the Data Processor: Billingo Technologies Zrt.
Company registration number: 01 10 140802
Registered office: 1133 Budapest, Árbóc utca 6.
Email: hello@billingo.hu
Telephone: +36-1/500-9491
Its privacy notice is available at:
https://www.billingo.hu/adatkezelesi-tajekoztato
Fact of processing / categories of processed data: data necessary for issuing invoices (billing and mailing name, address, and email address of the Data Subject to which the invoice is sent).
Categories of Data Subjects: persons placing orders in the webshop.
Purpose of processing: issuing invoices.
Duration of processing / deadline for erasure: pursuant to Section 169(2) of Act C of 2000 on Accounting, therefore data necessary for invoicing must be retained for 8 years following the order.
3. Accounting
Activity performed by the Data Processor: accounting
Name and contact details of the Data Processor:
Postal address:
Email:
Telephone:
Categories of processed data: all data appearing on accounting documents.
Categories of Data Subjects: customers, business partners and suppliers of the Data Controller.
Purpose of processing: compliance with accounting legislation.
Duration of processing / deadline for erasure: pursuant to Section 169(2) of Act C of 2000 on Accounting, therefore data necessary for invoicing must be retained for 8 years following the order.
4. Newsletter distribution
Activity performed by the Data Processor: sending automated emails
Name of the Data Processor: Sendinblue Inc.
Website: https://www.sendinblue.com
Categories of processed data: name and email address of the Data Subject.
Categories of Data Subjects: all Data Subjects registering in the webshop / subscribing to the newsletter.
Purpose of processing: sending automated emails.
Duration of processing / deadline for erasure: until unsubscribing on the Data Controller’s website and in accordance with Sendinblue Inc.’s privacy notice available at:
https://www.sendinblue.com/legal/termsofuse/#annex
5. Facebook fan page and Facebook groups
Activity performed by the Data Processor: sending notifications.
Name and contact details of the Data Processor: Facebook Inc.
Postal address: Facebook, Inc., 1601 Willow Road, Menlo Park, California 94025
Telephone: (650) 313-3241
Email: privacyshield@support.facebook.com
Contact with the European (Ireland) data protection officer:
https://www.facebook.com/help/contact/540977946302970
Facebook Inc.’s privacy policy can be found at:
https://www.facebook.com/policy.php
Facebook Inc. has undertaken to comply with the data protection requirements set out in the so-called “Privacy Shield” agreement concluded between the U.S. government and the EU. Further information can be found at:
https://www.facebook.com/about/privacyshield
Categories of processed data: as described in the section of this Privacy Notice relating to the Facebook subpage and Facebook groups.
Categories of Data Subjects: as described in the section of this Privacy Notice relating to the Facebook subpage and Facebook groups.
Purpose of processing: as described in the section of this Privacy Notice relating to the Facebook subpage and Facebook groups.
Duration of processing / deadline for erasure: as described in the section of this Privacy Notice relating to the Facebook subpage and Facebook groups, and in Facebook Inc.’s privacy policy referred to above.
6. IT service provider
Activity performed by the Data Processor: provision of IT tasks and support.
Name and contact details of the Data Processor:
Company data: Márkus Péter and Simon Bernadett
Registered office: 4432 Nyíregyháza, Kincs utca 39
Telephone number: +36 308991465
Email: info@mmteamco.
The IT service provider’s privacy policy can be found at:
https://mmteamco.hu/wp-content/uploads/2021/12/mmteam-ASZF.pdf
Categories of processed data: the IT service provider has access to all Personal Data referred to in this Privacy Notice.
Categories of Data Subjects: any subscriber, person subscribing to the Training, or person expressing interest therein.
Purpose of processing: operation of the Data Controller’s services.
Duration of processing / deadline for erasure: processing lasts until the Data Subject requests unsubscribing from the newsletter / deletion of the subscription.
7. Card payment
Activity performed by the Data Processor: card payment
Name and contact details of the Data Processor: Stripe
Stripe’s privacy notice can be found at:
https://stripe.com/en-hu/privacy
Duration of processing / deadline for erasure: in accordance with this Privacy Notice and Stripe’s privacy notice referred to above.
Other Recipients
1. NAV – National Tax and Customs Administration of Hungary
Registered office:
1054 Budapest, Széchenyi utca 2.
Postal address:
1373 Budapest, P.O. Box 561.
Email:
nav_kozpont@nav.gov.hu
Telephone:
+36 (1) 428-5100
NAV’s privacy notice is available at:
https://nav.gov.hu/footer-tartalmak/adatvedelem
Categories of processed data: data related to invoicing.
Categories of Data Subjects: all Data Subjects via the invoicing software (Billingo).
Purpose of processing: ensuring the lawfulness of online payment.
Duration of processing / deadline for erasure: according to NAV’s above-mentioned Privacy Notice.
Annex No. 2
List of the most important legislation relating to data processing (non-exhaustive)
• GDPR: REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (27 April 2016) on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
• Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information
• Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities
• Act CXIX of 1995 on the Processing of Name and Address Data Serving Research and Direct Business Acquisition
• Act C of 2000 on Accounting
• Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services
• Act XLVII of 2008 on the Prohibition of Unfair Commercial Practices against Consumers
• Act CLV of 1997 on Consumer Protection
• Act C of 2003 on Electronic Communications
• Act XX of 1996 on Identification Methods Replacing the Personal Identification Number and on the Use of Identification Codes
• Act LXVI of 1992 on the Registration of Citizens’ Personal Data and Address
• Act CXXXIII of 2005 on the Rules of Personal and Property Protection and Private Investigation Activities
• Government Decree 45/2014 (II.26.) on the Detailed Rules of Contracts between Consumers and Businesses