DATA MANAGER: Salon Tools Kft.
Company name, representative: Salon Tools Kft.
THE CONTROLLER'S WEBSITE:
https://mirplay.hu
THE PURPOSE OF THE PROCESSING:
Contract performance, business relations, marketing.
THE LEGAL BASIS FOR THE PROCESSING:
Consent of the data subject.
THE RECIPIENTS OF THE PERSONAL DATA:
Employees of the Company performing customer service related tasks;
THE DURATION OF THE STORAGE OF PERSONAL DATA:
For 5 years after the business relationship or the person's capacity as a representative has been established.

INFORMATION ON THE RIGHTS OF THE DATA SUBJECT
You have the right to request the controller to disclose personal data concerning you. access, rectify, erase or block the processing of personal data concerning you. restrict the processing of such personal data, and to object to the processing of such personal data; and have the right to data portability.
You have the right to withdraw your consent at any time which is not affect the processing carried out on the basis of consent before its withdrawal lawfulness of the consent.
You have the right to apply to the supervisory authority (National Authority for Data Protection and Freedom of Information Authority) to lodge a complaint Data provision is not a prerequisite contract conclusion, you are not obliged to provide personal data. The Failure to provide data may make it difficult to maintain contact.
I have taken note of the above information and information, my personal data to the processing of my personal data for the above purposes.

THE RIGHTS OF THE PERSON CONCERNED
§ 39 Summary information on the rights of the data subject For prior information right to information
The data subject shall have the right to obtain information about the facts and information relating to the data processing prior to the start of the processing.
(Articles 13-14 of the Regulation)Detailed rules are set out in the next chapter. information in the next section.
Right of access of the data subject
The data subject shall have the right to receive feedback from the controller on. whether or not his personal data are being processed and, if so, whether or not processing is in progress, he or she has the right to access his or her personal data and access to the data and related information specified in the Regulation. (Article 15 of the Regulation).The detailed rules are set out in the next chapter. Information on the rules is provided in the next section.
The right to rectification
The data subject shall have the right to obtain, at his or her request and without undue delay. to correct inaccurate personal data relating to him or her without undue delay. Taking into account the purpose of the processing, the data subject shall have the right to obtain the rectification of inaccurate personal data, inter alia by means of a supplementary declaration, to rectify incomplete personal data. (Article 16 of the Regulation).
Right to erasure ("right to be forgotten")1.The data subject has the right to. right to obtain, at his or her request, the erasure of personal data relating to him or her without undue delay. personal data concerning him or her without undue delay and the Controller shall be obliged to delete the personal data without undue delay. to delete personal data relating to the data subject without undue delay, (Article 17 of the Regulation). detailed rules are set out in the next chapter.

Right to restriction of processing
The data subject shall have the right to obtain from the controller, at his or her request, the restriction of the processing if the conditions set out in the Regulation are met. (Article 18 of the Regulation)
Detailed rules are explained in the next chapter.
To rectify or erase personal data or to object to the processing of personal data restriction of processing
The Data Controller shall inform each recipient of any rectification, deletion or restriction of processing with whom or with which the personal data have been processed. data have been disclosed to, unless this proves impossible or involves a manifestly excessive burden. requires a disproportionate effort. The Controller shall, upon request, inform the data subject of any such recipients.
(Article 19 of the Regulation)
The right to data portability
Subject to the conditions set out in the Regulation, the data subject is entitled to have the following rights concerning him or her, personal data which he or she has provided to a Data Controller, in a commonly used, machine-readable format, and to to transmit these data to another controller without prevented from doing so by the Data Controller to whom the personal data have been disclosed. (Article 20 of the Regulation) The detailed rules are set out in the details are set out in the next chapter.
Right to object The data subject has the right to object to his or her situation to object at any time, on grounds relating to his or her personal data, to the processing of personal data in accordance with Article 6 of the Regulation. (processing is in the public interest or in the interest of the controller). or for the exercise of official authority vested in the controller necessary for the performance of a task carried out by the controller or by the the legitimate interests of a third party.
(Article 21 of the Regulation)
Detailed rules are explained in the next chapter.
Automated decision-making on individual cases, including profiling
The data subject shall have the right not to be subject to the processing of personal data processing, including profiling, which is based on automated processing, which which would have legal effects concerning him or her or similarly significantly affect him or her.
(Article 22 of the Regulation)
Detailed rules are explained in the next chapter.
Restrictions
EU or Member State law applicable to the controller or processor may, by legislative measures, restrict the rights and obligations referred to in Articles 12 to 22 and Article 34 and the rights and obligations set out in Articles 12 to 22 (Article 23 of the Regulation).
Detailed rules are explained in the next chapter.
Informing the data subject about the personal data breach
If the data breach is likely to pose a high risk to the to the rights and freedoms of natural persons, the Data Controller shall shall inform the data subject without undue delay of the data protection of the personal data breach.
(Article 34 of the Regulation)
Detailed rules are explained in the next chapter.
The right to lodge a complaint with a supervisory authority (official redress) right to administrative redress)
The data subject has the right to lodge a complaint with a supervisory authority - in particular at the place of his habitual residence, place of work or alleged of the place of the alleged infringement, if the data subject considers that the
the processing of personal data relating to him or her is in breach of the Regulation (Regulation No 77. The detailed rules are set out in the next chapter.
Right to an effective judicial remedy against the supervisory authority
All natural and legal persons have the right to an effective judicial remedy in the courts of against a legally binding decision of the supervisory authority which is binding on him or her, or, if the supervisory authority does not deal with the complaint, or, within three months the supervisory authority fails to inform the data subject within three months of the procedural developments or the outcome of the complaint lodged (Article 78 of the Regulation). The detailed rules are set out in the next chapter.
Effective judicial remedies against the controller or processor may be Right to an effective judicial remedy Every data subject shall have the right to an effective judicial remedy to a judicial remedy if he or she considers that his or her personal data are not processing of personal data not in accordance with this Regulation has infringed his or her rights under this Regulation. (Article 79 of the Regulation)
Detailed rules are explained in the next chapter.
§ 40 Detailed information on the rights of the data subject For prior information right to information
The data subject shall have the right to obtain information about the facts and information about the facts and circumstances relating to the processing prior to the processing
A) Information to be provided where the personal data are obtained from the data subject collected from
1. Where personal data relating to the data subject are collected from the data subject, the data subject shall. personal data is collected from the data subject. provide the data subject with all of the following information:
(a) the identity of the controller and, if any, the controller's representative and contact details of the data controller and the data controller's representative;
(b) the contact details of the Data Protection Officer, if any;
(c) the purposes for which the personal data are intended to be processed and the legal basis for the processing;
d) Article 6(1)(f) of the Regulation (legitimate interest) legitimate interests of the controller or a third party;
(e) where applicable, the recipients or categories of recipients of the personal data, if any;
(f) where applicable, the fact that the controller has moved to a third country or an international organisation; and the existence or absence of an adequacy decision by the Commission, or the Regulation Article 46, Article 47 or the second subparagraph of Article 49(1) of the Regulation the existence of adequate and appropriate safeguards and the means of obtaining a copy thereof, or a reference to their availability.
2. In addition to the information referred to in point 1, the controller shall also at the time of acquisition, in order to ensure fair and transparent processing, the data subject shall be informed of the following additional information inform the data subject of additional information:
(a) the duration of the storage of the personal data or, where this is not possible, the criteria for determining that period;
(b) the data subject's right to obtain from the controller information relating to him or her access to, rectification, erasure or blocking of personal data concerning him or her. restrict the processing of such personal data, and to object to the processing of such personal data; and the data subject's right to data portability;
(c) Article 6(1)(a) of the Regulation (consent of the data subject) or Article 9(2)(a) (consent of the data subject) the withdrawal of consent at any time at any time, without prejudice to the right to obtain the consent of the data subject on the basis of the lawfulness of the processing carried out prior to the withdrawal;
(d) the right to lodge a complaint with a supervisory authority;
e) that the provision of the personal data is based on law or contractual or a contractual obligation or a precondition for the conclusion of a contract, and whether the data subject is under an obligation to provide the personal data, and the possible possible consequences of not providing the data;
(f) the automated processing referred to in Article 22(1) and (4) of the Regulation decision making, including profiling, and at least in these in these cases, clear information on the logic used and on whether the significance of such processing and its implications for the data subject likely consequences for the data subject.
3. Where the controller has processed the personal data for purposes other than the purpose for which they were collected further processing of the personal data collected for a purpose other than that for which it was collected inform the data subject of that other purpose and of the conditions referred to in paragraph 2 any relevant additional information referred to in paragraph 2.
4. Points 1-3 shall not apply if and to the extent that the data subject has already (Article 13 of the Regulation).

B) Information to be provided if the personal data are not obtained from the data subject 1. Where the personal data are not obtained from the data subject the controller shall provide the data subject with the following information information to the data subject:
(a) the identity of the controller and, if any, the controller's representative and contact details of the data controller and the data controller's representative;
(b) the contact details of the Data Protection Officer, if any;
(c) the purposes for which the personal data are intended to be processed and the processing legal basis of the processing;
d) the categories of personal data concerned;
e) the recipients of the personal data or categories of recipients, if any;
(f) where applicable, the fact that the controller is a third country to a third country recipient or an international organisation the existence of an adequacy decision of the Commission or or the absence thereof, or the existence or otherwise of a need for a data controller to comply with Article 46, Article 47 or Article 49(1) of the Regulation the second subparagraph of Article 49(1) or the second subparagraph of Article 49(2), the adequacy and appropriate and suitable safeguards and the means of obtaining a copy thereof or a reference to the means of obtaining them or their availability.
2. In addition to the information referred to in point 1, the controller shall provide the data subject with. to the data subject in a fair and transparent manner for the data subject. fair processing of personal data:
(a) the period for which the personal data are stored or, if that is not possible, the criteria for determining the duration of the personal data;
(b) if the processing is based on Article 6(1)(f) of the Regulation (legitimate expectations) legitimate interest), the legitimate interests of the controller or of a third party;
(c) the right of the data subject to request the controller to disclose to him or her access, rectification, erasure or blocking of personal data concerning him or her restriction of processing, and to object to the processing of personal data, and the right of the data subject to data portability;
d) Article 6(1)(a) of the Regulation (consent of the data subject) or Article 9(2)(a) (consent of the data subject) the right to withdraw consent at any time in the case of processing which does not affect the processing carried out on the basis of consent prior to its withdrawal. the lawfulness of the processing carried out on the basis of the consent;
(e) the right to lodge a complaint with a supervisory authority;
f) the source of the personal data and, where applicable, whether the data are publicly available publicly available sources; and
(g) the automated processing referred to in Article 22(1) and (4) of the Regulation decision making, including profiling, and at least in these in these cases, clear information on the logic used and on whether the significance of such processing and its implications for the data subject likely consequences for the data subject.
3. The controller shall provide the information referred to in points 1 and 2 as follows shall provide the following information:
(a) having regard to the specific circumstances in which the personal data are processed, the within a reasonable period from the date on which the personal data were obtained, but no later than one not later than one month;
b) if the personal data are used for the purpose of contacting the data subject at least at the time of the first contact with the data subject; or
(c) if the data are likely to be communicated to another address, no later than the date of the personal the first time the personal data are disclosed.
4. Where the controller has processed the personal data for purposes other than the purpose for which they were obtained further processing of the personal data for the purposes for which they were obtained inform the data subject of that different purpose and of the conditions set out in point 2 any relevant additional information referred to in point 2.
5. points 1 to 5 do not apply if and to the extent that:
(a) the data subject already has the information;
(b) it proves impossible to provide the information in question, or would require a disproportionate effort, in particular in the case of archiving in the public interest for scientific or historical research purposes or for statistical purposes, for the conditions and guarantees referred to in Article 89(1) of the Regulation the conditions and guarantees laid down in Article 89(1), or where the processing is carried out paragraph 1 would be likely to render impossible or seriously jeopardise the achievement of the purposes of such processing. In such cases, the the controller shall take appropriate measures to ensure that the information is made publicly available including by making the public available, to safeguard the rights, freedoms and legitimate interests of the data subject. rights and legitimate interests of the data subject;
(c) expressly requires the controller to obtain or disclose the data Union or Member State law applicable to the data subject which is necessary to protect the legitimate interests of the data subject appropriate measures to protect the legitimate interests of the data subject; or
(d) the personal data are processed for the purposes of a professional activity required by Union or Member State law obligation of professional secrecy, including on the basis of (Article 14 of the Regulation)
Right of access of the data subject
1.The data subject has the right to receive feedback from the Data Controller on. whether or not his personal data are being processed, and if so and, if such processing is ongoing, the right to access the personal data and access to the following information:
a) the purposes of the processing;
b) the categories of personal data concerned;
(c) the addressees or categories of addressees with whom or with which the to whom or to which personal data have been or will be disclosed, including in particular recipients or international organisations;
(d) where applicable, the envisaged period of storage of the personal data, or if where this is not possible, the criteria for determining that period;
(e) the right of the data subject to request the controller to obtain from the controller information relating to him or her rectification, erasure or restriction of the processing of personal data concerning him or her; and object to the processing of such personal data;
(f) the right to lodge a complaint with a supervisory authority;
(g) where the data have not been collected from the data subject, any information concerning their source available information about their source;
(h) the automated processing referred to in Article 22(1) and (4) of the Regulation including profiling, and at least in these cases in these cases, clear information on the logic used and on whether the relevance of such processing and its implications for the data subject likely consequences for the data subject.
2. If personal data is transferred to a third country or international organisation to an international organisation, the data subject shall have the right to obtain information of the transfer in accordance with Article 46 of the Regulation. Article 46 of the Regulation.
3. the data subject. For additional copies requested by the data subject the Controller shall charge a reasonable fee based on the administrative costs charge a reasonable fee. Where the data subject has made the request by electronic means, the information must be provided in a commonly used electronic format. unless the data subject requests otherwise. For the purposes of requesting a copy right to a copy shall not adversely affect the rights and freedoms of others.
(Article 15 of the Regulation)
Right to erasure ("right to be forgotten")
1. The data subject shall have the right to obtain from the controller, at his or her request, the following without undue delay, and the Data Controller shall be entitled to to delete personal data relating to the data subject without undue delay. the data subject without undue delay where one of the following grounds applies:
(a) the personal data are no longer necessary for the purposes for which they were collected collected or otherwise processed;
(b) the person concerned withdraws the consent referred to in Article 6(1)(a) of the Regulation or Article 9(2)
consent to the basis of processing within the meaning of point (a), and there is no other legal basis for the processing;
(c) the data subject objects on the basis of Article 21(1) of the Regulation to the processing and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing on the basis of Article 21(2) objection;
d) the personal data have been unlawfully processed;
(e) the personal data are processed in accordance with the law of the Union or of a Member State legal obligation under Union or Member State law;
(f) the collection of personal data referred to in Article 8(1) of the Regulation, in connection with the provision of information society services services.
2. If the controller has disclosed the personal data and the data subject has not 1, the controller shall take into account the available technology and the reasonably practicable in the light of the available technology and the cost of implementation. reasonable steps, including technical measures, to ensure that inform the data controllers which process the data that the data subject has requested it links to the personal data in question or to the processing of those personal data copies or duplicates of those personal data.
3.Points 1 and 2 do not apply where the processing is necessary:
a) the exercise of the right to freedom of expression and information to;
(b) the Union or national law applicable to the controller which provides for the processing of personal data Member State law, or in the public interest or in the interest of the or in the exercise of official authority vested in the Controller or for the performance of a task carried out by the Data Controller
(c) Article 9(2)(h) and (i) and Article 9(3) of the Regulation on grounds of public interest in the field of public health;
(d) archiving in the public interest in accordance with Article 89(1) of the Regulation for scientific or historical research purposes or for statistical purposes, where the right referred to in point 1 would be likely to make it impossible or seriously jeopardise such processing; or (e) for legal claims (Article 17 of the Regulation)
Right to restriction of processing
1. The data subject shall have the right to obtain from the controller, at his or her request, the restriction of the processing if one of the following conditions is met:
(a) the data subject contests the accuracy of the personal data, in which case the restriction shall apply for the period of time necessary to enable the Controller to to verify the accuracy of the personal data;
(b) the processing is unlawful and the data subject opposes the erasure of the data; and requests instead that the use of the data be restricted;
(c) the Controller no longer needs the personal data for processing for the purposes of the processing, but the data subject requires them for the establishment of legal claims, assert or defend legal claims; or
(d) the person concerned has objected in accordance with Article 21(1) of the Regulation to the the processing; in this case, the restriction shall apply for the period during which it is established that the legitimate grounds of the Controller override the over the legitimate grounds of the data subject.
2. Where processing is subject to restriction pursuant to point 1, the processing of such personal data data, with the exception of storage, only with the consent of the data subject or the establishment, exercise or defence of legal claims or for other or the protection of the rights of another natural or legal person, or for the purposes of the Union or important public interest of a Member State.
3. The Data Controller shall inform the data subject, at whose request pursuant to point 1. the restriction of processing, to lift the restriction of processing inform the controller in advance of the lifting of the restriction.
(Article 18 of the Regulation)
The right to data portability
1.The data subject shall have the right to obtain the information concerning him or her which he or she has provided to a Data Controller. personal data provided to a Data Controller by a Data Controller, machine-readable format, and to receive such data in a commonly used and widely readable format. data to another controller without being prevented from doing so by the controller's consent. Controller to whom he has disclosed the personal data, if:
(a) processing pursuant to Article 6(1)(a) or Article 9 of the Regulation; (2)(a) of Regulation (EC) No 1092/1999, or Article 6(1) (b) the processing is based on consent or on a contract within the meaning of is carried out by automated means.
2. In the exercise of the right to data portability under point 1, the data subject shall. the data subject shall have the right to request, where technically feasible, the direct transfer of personal data between Data Controllers.
3. The exercise of this right shall be without prejudice to Article 17 of the Regulation. shall apply where the processing is in the public interest or is in the interest of the controller. the exercise of official authority vested in the controller the performance of a task entrusted to the controller.
4. The right referred to in paragraph 1 must not adversely affect the rights of others and freedoms of others.
(Article 20 of the Regulation)
The right to protest
1. The data subject shall have the right, on grounds relating to his or her particular situation, to to object at any time to the processing of personal data in accordance with Article 6(1)(e) of the Regulation. (processing operations carried out in the public interest or in the exercise of official authority vested in the controller). in the exercise of a public authority vested in the controller) or (f) (processing is necessary for the legitimate interests of the controller or of a third party) interests of a third party or a third party), including profiling based on those provisions. In this case, the controller may no longer process the personal data, unless the controller proves that the processing is justified by compelling legitimate grounds, which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims or or the defence of legitimate interests.
2. If the processing of personal data is carried out for direct marketing purposes, the the data subject has the right to object at any time to the processing of personal data concerning him or her processing of personal data concerning you, including profiling, for that purpose, where it is necessary for the direct marketing.
3. If the data subject objects to the direct marketing of personal data processing of personal data for direct marketing purposes, the personal data will be further processed for the purposes of this no longer be processed for that purpose.
4. The right referred to in points 1 and 2 shall be exercised at the latest on the first the first contact with the data subject, and shall be expressly brought to the clearly and separately from any other information displayed separately from any other information.
5. To access information society services and by way of derogation from Directive 2002/58/EC, the data subject shall have the right to object by automated means based on technical specifications.
6. If the processing of personal data is carried out in accordance with Article 89(1) of the Regulation for scientific or historical research purposes or statistical purposes for statistical purposes, the data subject shall have the right to obtain, in relation to his or her the processing of personal data concerning him or her, except, if the processing is necessary for the performance of a task carried out for reasons of public interest necessary for the performance of a specific task.
(Article 21 of the Regulation)
§ 19 Visitor data management on the Company's website - Information about cookies (cookies)
(1) Cookies are short data files that are stored on the website you visit. placed on the user's computer by the website visited. The purpose of a cookie is to remember the specific The purpose of the cookie is to make the particular infocommunication, Internet service easier and more convenient. There are several types, but they can generally be divided into two broad categories. temporary cookie, which is only used by the website during a particular session (e.g. for example, during a secure identification process during an online banking transaction) the other type is the persistent cookie (e.g.: a cookie used by a website to identify a user's which remains on the computer until the user deletes it it is retained for a fixed period of time until the user deletes it. According to the European Commission's guidelines, cookies [unless they are necessary for the use of a particular service] only by the user's device only with the user's permission.
(2) In the case of cookies that do not require the user's consent, the first information must be provided on the first visit. It is not necessary for cookies the full text of the information on cookies on the website, it is sufficient if the website operators to briefly summarise the substance of the information and provide a a link to the full information.
(3) In the case of cookies requiring consent, the information may relate to the the first visit to the website in the event that the use of cookies data processing that is associated with the use of cookies. If the cookie to use the cookie for a function explicitly requested by the user the information may also be displayed in connection with the use of that function in connection with the use of this cookie. Even in this case, it is not necessary to provide the information on cookies should be displayed on the website, but a short a brief summary of the substance of the information and a link to the full text of the full information.
(4) Visitors to the website are informed about the use of cookies in accordance with Annex 2. information on the use of cookies. By means of this notice, the Company ensures that the visitor is informed of the information society-related services and at any time before and during the use of the to be informed of the data processing purposes for which the Company processed, including data which cannot be directly linked to the user § 20 Registration on the Company's website
(1) On the website, the natural person registering must tick the box tick the box below to give his/her consent to the processing of his/her personal data. It is forbidden to use the tick the box in advance.
(2) The scope of personal data processed: the name of the natural person (surname, first name), address, telephone number, e-mail address, online identifier.
(3) Purpose of the processing of personal data:
1. Provision of services on the website.
2. Contacting you by email, telephone, SMS, and post.
3. Information about the Company's products, services, contractual terms and conditions, promotions.
4. Promotional mailings in the course of information by electronic means and by post by post or e-mail.
5. Analysis of the use of the website.
(4) The legal basis for processing is the consent of the data subject.
(5) Recipients or categories of recipients of personal data: the Company customer service and marketing activities marketing activities, the Company's IT service provider as data processor employees providing hosting services.
(6) Duration of storage of personal data: registration/service or until the data subject's consent is withdrawn (deletion 21 § Processing of data related to the newsletter service
(1) A natural person who registers for the newsletter service on the website may tick the relevant box to give his/her consent to the processing of his/her personal data. It is prohibited to tick the box in advance. When subscribing to the newsletter, the user may The Privacy Notice (Annex 2) must be made available by means of a link. A newsletter by using the "Unsubscribe" application of the newsletter, or by a written declaration or by e-mail, which may be sent to the consent is withdrawn. In such a case, all data of the unsubscriber shall be deleted immediately.
(2) The scope of personal data processed: the name of the natural person (surname, first name), e-mail address.
(3) Purpose of the processing of personal data:
1. Sending newsletters about the Company's products and services 2. Sending promotional material
(4) Legal basis for processing: consent of the data subject.
(5) Recipients or categories of recipients of personal data: the Company customer service and marketing activities marketing activities, the Company's IT service provider as data processor employees for the purpose of providing hosting services,
(6) Duration of storage of personal data: the newsletter service or until the data subject's consent is withdrawn (deletion (or until the cancellation or withdrawal of the newsletter).
§ 22 Community Guidelines / Data Management on the Company's Facebook page
(1) For the purpose of publicising and promoting the Company's products and services. maintains a Facebook page.
(2) The Company's Facebook page above the question does not constitute an official officially filed complaint.
(3) Personal data posted by visitors to the Company's Facebook page will not be processed by the Company.
(4) Visitors are subject to the Facebook Privacy and Terms of Service and Terms of Use.
(5) In the event of publication of illegal or offensive content, the Company may. exclude the person concerned from membership without prior notice, or delete his/her postings.
(6) The Company is not liable for any legal provisions posted by Facebook users violating the law by Facebook users. The Company is not liable for any, Facebook for any errors, malfunctions, or failure of the system to function properly system of the Facebook system.
§ 23 Data management in the Company's webshop
(1) A purchase contract in the webshop operated by the Company shall be shall be deemed to be a contract for the sale of goods and certain aspects of information society services Act CVIII of 2001 on electronic commerce and services and on information society services, and the contract between the consumer and the business (II. 26.) of the Government Decree No. In the case of a purchase in a webshop, the legal basis for the processing of data is the contract.
(2) The Company is the service provider for the information society contract for the provision of an information society service. the definition, modification, monitoring of the performance of the billing of the charges arising therefrom, and the related claims may process the data of customers registering in the webshop, registering for and address necessary to identify the customer who has registered as a CVIII of 2001, under the terms of paragraph 13/A(1) of Act CVIII of 2001, and consent telephone number, e-mail address, bank account number, online identifier.
(3) For billing purposes, the Company may process data relating to the information society the use of an information society service personal data, address, and the reasons for using the service time, duration and location of the service, in accordance with the CVIII. Act CVIII of 2001 on the use of personal data, the time, date and duration of the use of the service, in accordance with paragraph 13/A(2).
(4) Recipients or categories of recipients of personal data: the Company customer service and marketing activities as data processors, employees of the Company performing tax, accounting and employees of an undertaking performing tax and accounting functions, tax and accounting the Company's IT service provider employees for the purpose of providing hosting services, courier services employees of the Company's service provider in relation to delivery data (name, address, telephone number).
(5) Duration of processing of personal data: registration/service or until the data subject's consent is withdrawn (erasure In the case of a purchase, 5 years after the year of purchase.
(6) When shopping in the online store, you should read the Privacy Policy (2. Annex 2) must be made available with a link.
(7) Personal data may be transferred for processing by postal services delivery to the Magyar Posta or to the contracted courier service, for the purpose of property protection, to the company's trustee for property protection.
§ 16 Management of contracting partners' data - register of customers, suppliers
(1) The Company shall enter into a contract for the performance of a contract by virtue of, performance, termination or termination of a contract, or for the purpose of granting a contractual natural person who has entered into a contract with the Company as a buyer or supplier, date of birth, mother's name, address, tax identification number, tax number, entrepreneur's or self-employed person's identity card number, personal identity card number, address, address of registered office, place of business, telephone number, e-mail address, website address, bank account number, customer number (customer number, order number), online identification (list of customers, suppliers, master shopping lists), This processing is lawful even if the processing is carried out for the purposes of the contract to take steps at the request of the data subject prior to the conclusion of the contract necessary for the purposes of the processing of the data. Recipients of the personal data: the Company's customer service employees performing tasks related to customer service, accounting and tax tasks employees of the Company. The storage of personal data Duration of storage of personal data: 5 years after termination of the contract.
(2) To communicate to the natural person concerned before the processing starts that the processing is based on the legal basis of the performance of the contract, the information may also be given in the contract. The personal data of the data subject to a data processor. A data processing clause relating to a contract with a natural person is set out in Annex 6 to these Rules.

§ 17 Legal person Customers, buyers, suppliers natural person representatives of customers, clients, customers' and buyers' representatives (1) Scope of personal data processed: the name, address, telephone number, e-mail address, online identification number.
(2) The purpose of the processing of personal data: with the Company's legal partner. with a legal entity of the company, legal basis: the legal basis: the data subject consent of the data subject.
(3) Recipients or categories of recipients of personal data: the Company employees of the Company performing customer service related tasks.
(4) Duration of storage of personal data: the duration of the business relationship or the 5 years after the end of the business relationship or the data subject's capacity as a representative.
(5) The model of the record sheet is set out in Annex 7 to these Rules. is set out in Annex 7. This declaration in relation to the customer, buyer, supplier customer, supplier or vendor, shall present this form to the person concerned and the declaration consent to the processing of his/her personal data by signing the statement. A statement must be kept for the duration of the processing.
18.§ Making a telephone voice recording of the customer service
(1) The Company shall make telephone communications with its customer service the performance of sales and services and the provision of information shall be recorded by voice recording. The legal basis for this processing is the data subject's consent of the data subject.
(2) You must be informed at the beginning of the call that a voice recording is being made, and consent must be sought.
(3) When recording telephone conversations, we store the following data: telephone number, time of the call, audio recording of the recorded conversation, the personal data provided during the conversation.
(4) Recipients or categories of recipients of personal data: the Company employees of the Company performing customer service related tasks.
(5) Telephone conversations will be kept for 5 years. The recorded audio material can be retrieved by telephone number and date of conversation.

This Policy sets out the rules for the Company's data management activities REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL - (27 April 2016) on the processing of personal data of natural persons and on the free movement of such data, and and repealing Regulation (EC) No 95/46/EC (General Data Protection Regulation) Regulation). All its legal requirements in accordance with all its laws.