Privacy Statement
Pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, GDPR) and Act CXII of 2011 on informational self-determination and freedom of information (hereinafter “Info Act”)
Data controller: Maximum Business Kft.
Represented by: Gergő Berta
Registered office: H-1156 Budapest, Nádastó Park 35. fsz. 2/A.
Mailing address: H-1156 Budapest, Nádastó Park 35. fsz. 2/A.
E-mail: hello@eshopaward.com
Phone number (non-fixed line): +36 30 386 26 27
webpage operated by the Company: www.eshopaward.com (not made accessible for the blind and partially sighted)
Data Protection Officer contact details: hello@eshopaward.com
The Company processes the personal data referred to in the categories of data subjects, the purposes and the duration of the processing.
Profiling: the Company does not use profiling data management.
The Company uses cookies on its website. When visiting the Website, one or more cookies – small files containing a string of characters – are sent to the visitor’s computer, which will allow the visitor’s browser to be uniquely identified. These cookies are provided by Google and are used via the Google Adwords system. These cookies are only sent to the visitor’s computer when certain sub-sites are visited, so they only store the fact and time of the visit to the subpage and no other information.
The use of the cookies thus sent is this: Third-party service providers, including Google, use these cookies to store if the user has previously visited the advertiser’s website and, based on this, display ads to the user on the websites of partners of third-party service providers, including Google. Users can opt out of Google cookies on the Google ads opt-out page. (It may also indicate to users that they can opt-out of cookies from third-party service providers on the Network Advertising Initiative unsubscribe page.)
Cookies applied:
Analytics, tracking cookie
Tracking through website
Login cookie, user identifying session cookie
The “Help” feature in the menu bar of most browsers provides information on how to disable cookies in your browser, how to accept new cookies, or how to instruct your browser to set a new cookie or turn off other cookies.
The Company collects no personal data on its website.
I. Legal basis for processing
1. In the case of a contract, the processing is necessary for the performance of the contract or is required by law. Provision of data is voluntary, the data subject is not obliged to give their consent to data processing, however, they acknowledge that the Company cannot start or continue the business relationship with them without the provision of their data.
2. In other cases, the provision of data is voluntary and the withdrawal of consent does not affect the lawfulness of the previous processing.
II. Categories of data subjects, purposes and the duration of the processing (Revised on 17 March 2020)
The data processing covers the data of all customers, clients, agents, visitors (data subjects).
The Company processes personal data for the sole purpose (assignment of data) of providing the services and payments to the data subjects as specified in the agency contract.
Principles and methods of data processing
1. The Company shall act in accordance with the requirements of good faith, fairness and transparency, in cooperation with the data subjects in the processing. The Company processes only the data specified by law or provided by the data subjects for the purposes set out below. The scope of the personal data processed shall be proportionate to the purpose of the processing and shall not go beyond that purpose.
2. In any cases where the Company intends to use the personal data for a purpose other than that for which they were originally collected, the Company shall inform the data subject and obtain his or her prior explicit consent or give him or her the opportunity to object to the use.
3. The Company does not control the personal data provided. The person providing the personal data is solely responsible for the adequacy of the personal data provided.
4. The personal data of a person under the age of 16 may be processed only with the consent of the person who has parental authority over him or her. The Company is not in a position to verify the eligibility of the person giving consent or the content of his or her declaration, so the person concerned or the person having parental authority over him or her guarantees that the consent is in accordance with the law. In the absence of a declaration of consent, the Company shall process the data of natural persons under the age of 16 only on the basis of a legal provision and if the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Company, and if the Company has a legitimate interest in doing so.
5. The Company does not transfer the personal data it processes to third parties other than the data processors specified in this Policy and, in certain cases referred to in this Statement, to external service providers. An exception to this provision is the use of data in aggregate statistical form, which shall not include any other form of data that can be used to identify the data subject, and shall therefore not constitute processing or transfer of data. In certain cases, the Company may disclose to third parties the personal data of the data subject that are available to it, in response to a formal judicial or police request, legal proceedings, or in the case of a breach of copyright, property rights or other infringements or a reasonable suspicion that such infringements may harm the interests of the Company, jeopardize the provision of the service, etc. The Company shall notify the data subject and all those to whom it has previously transmitted the personal data for processing purposes of the rectification, restriction or deletion of the personal data it processes. Notification may be omitted if this does not harm the legitimate interests of the data subject having regard to the purposes of the processing.
The Company processes personal data only for specific purposes, for the exercise of rights and the performance of obligations. The purpose of the processing is fulfilled at all stages of the processing. Data are collected and processed fairly and lawfully. The Company shall endeavour to process only personal data that is necessary for the purpose of the processing and that is suitable for achieving that purpose. Personal data may only be processed to the extent and for the duration necessary to achieve the purpose.
The Company processes the data as follows:
| Data type | Purpose and reason of data processing | Duration of the processing |
|---|---|---|
| individual principal’s / agent’s name and surname, name at birth, date and place of birth, type and number of identity documents, address, mother’s name, email address, telephone number | the creation of the contract, liaising | 8 years after the termination of a framework contract or, in the case of ad hoc assignments, 8 years after its completion (Accounting preservation) |
| the name, email address, telephone number of the individual representing the entrepreneurship | the creation of the contract, liaising | in case of a framework contract, 8 years after its completion, the termination of the representation, or, in case of ad hoc assignments, 8 years after its performance (Accounting preservation) |
| entrepreneur’s name, registered office, individual enterpreneur registration number, bank account number, email address, telephone number | the creation of the contract, liaising | 8 years after the termination of a framework contract or, in the case of ad hoc assignments, 8 years after its completion (Accounting preservation) |
| individual interested party’s last and first name, telephone number, email address | based on voluntary consent, sale, contract creation, liaising | if the enquiry fails to conclude into a purchase / contract or any registered contact (e.g. newsletter subscription), it is 12 months following the response email sent or the callback |
| community space surveillance device – security camera | based on voluntary consent and the legitimate interest of the company, protection of persons and property | 15 days |
| personal data processed for presenting the Webshop of the Year award: individuals representing the applicant companies – name, telephone number, e-mail address | based on voluntary consent, liasing | 12 months after tender and its closing |
| personal data processed for presenting the Webshop of the Year award: personal data of persons assessing the tender – name, telephone number, e-mail address | based on voluntary consent, liasing | 12 months after tender and its closing |
| photos, videos on the presentation of the award | based on voluntary consent, documenting, presenting the winners to the interested parties | until the revocation of the applicnats’ and the committee members’ consent |
| representants of the press – name, phone number, e-mail address | based on voluntary consent, liasing | 1 year from the end of the professional relationship |
| the name, address, email address and telephone number of the person(s) who entered any reflection, complaint or request in the book of complaints | investigation of consumer complaints, redress | 2 years from the entry |
| the name, email address and date of subscription of those subscribed to the newsletter | providing information based on voluntary consent, liaising | from subscription to unsubscription, or, if the email sent for data accuracy purposes remains without an active reply, for 3 months from the date of sending the data correction email |
| database of newsletter maintenance calls (name, phone number) | based on voluntary consent and the legitimate interest of the company for service development, providing information, liasing | from subscription to unsubscription, and the expiration of the legal claim |
| personal data of users of the Company’s social networking site (not a closed group), name of the user voluntarily registered on social networking sites like Facebook / Google+ / Twitter / Pinterest / Youtube / Instagram / Linkedin etc., or the user’s public profile image | to all data subjects who have voluntarily registered on Facebook / Google+ / Twitter / Pinterest / Youtube / Instagram / LinkedIn etc. and have liked the Company’s website, providing information, liaising | the data subject can find out about the source of the data, how they are processed, and the method and legal basis of the transfer, on the relevant Community site The data processing takes place on social networking sites, so the duration of the data processing, the method of data processing and the possibility to delete and modify the data are governed by the rules of the social networking site concerned |
| blog post on the company website: name, email address | to publish a personal diary opinion based on voluntary consent, which can be viewed by anyone through the company’s web interface, and to allow the subscriber to write comments | the processing of the data will continue until the Data Subject withdraw their consent in writing |
| blog entry notification: email address | when posting a comment, by checking the appropriate box, the subscriber has the chance, with their voluntary consent, to be notified when a new comment is added to the blog entry | the processing of the data will continue until the Data Subject withdraw their consent in writing |
| personal data of proxies: a person acting in the place of and on behalf of the data subject in relation to the company | the management of the data subject’s affairs based on voluntary consent | 5 years from the settlement of the case |
| name, address, name and number of identification cards | ||
| name, address, name and number of identification cards of the person submitting a liability claim / complaint | adjudication of the claim / complaint under the legal procedure | 5 years from sending the reply |
| the name and address of the winding-up agency / lawyer, the name and number of their identification documents, telephone number, email address | collection of debts owed by the company on the basis of legitimate interest | 8 years after the termination of a framework contract or, in the case of ad hoc assignments, 8 years after its completion (Accounting preservation) |
8 years after the termination of a framework contract or, in the case of ad hoc assignments, 8 years after its completion (Accounting preservation)
The provision of the data required for the conclusion of the contract is a condition of the provision of the Company’s contractual service, and the service cannot be used in the absence of their provision or in the event of a subsequent request for their deletion. The provision of other data is voluntary and the withdrawal of consent does not affect the lawfulness of the previous processing.
III. Scope of data controllers
Persons entitled to process data are employees/agents of the Company who are entitled to do so.
IV. Data transmission, data processing
The Company is entitled to use a data processor for the performance of its activities. Processors do not make decisions on their own, they are only entitled to act in accordance with the contract concluded with the controller and the instructions they receive. The Company, as data controller, monitors the data processors’ work. Processors are entitled to use an additional processor only with the controller’s consent.
The Company uses data processors. The Company identifies the data processors used in this Statement.
The Company uses an accountant as a data processor to perform accounting tasks: Debit 2002 Kft. (HU-1173 Budapest, Uszoda u. 1. fszt. 4.)
The developer of your customer database management system and where it runs: Kelesys Kft. Számítástechnikai Kereskedelmi és Szolgáltató Kft. HU-2083 Solymár, Panoráma u. 44.
Other customer database managers: Applion Computer Kft. (HU-1119 Budapest, Bikszádi u. 60/a)
Mini CRM (HU-1075 Budapest, Madách Imre út 14.)
Salesautopilot (HU-1024 Budapest, Margit krt. 31-33. Félemelet 4.)
Operator of the Company’s website: a Profit&Partners Kft. (HU-1096 Budapest, Thaly Kálmán u. 32.) Invoices are issued using the Számlázz.hu application. KBOSS.hu Kft. (HU-1031 Budapest, Záhony utca 7. In case of a malfunction, the developers of the program can access the data stored there.
The Company performs data transmission.
For making the Webshop of the Year award, the details of the person representing the applicant entrepreneurship to the evaluation committee.
Personal Data to the lawyer for the purposes of managing the Company’s legal affairs: Dr. Iván Rácz,HU-1143 Bp., Thököly út 106.
The name and telephone number of the addressee of the postal items to the subcontractor involved in the delivery:
SPRINTER Futárszolgálat Kft., HU-1097 Budapest, Táblás utca 39.
FedEx, Vecsés, Üllői utca 807/B, Airport City Logistic Park, Building C, 2220
TNT Express Hungary Kft., HU-1185 Budapest II. Logistics Center – Office Building BUD International Airport Building 283
TCE Logistik Hungary Korlátolt Felelősségű Társaság, HU-1211 Budapest Szikratávíró utca 17-21.
Quehenberger Logistics HU Kft., HU-1044 Budapest Ipari park utca 4.
For mobile parking initiated from a company mobile phone, the registration number of the company/private car to parking companies. For the use of company cars on the motorway, the registration number to the motorway operator. If need be, data concerning a complaint in the complaint book to the Conciliation Body.
V. Data subjects’ rights in relation to data processing
Right to information: at the data subject’s request, the controller shall provide information in an appropriate size, language, plain language and easy to find regarding the essential aspects of the processing (who, what, what for, how, from when, for how long).
Right of access: individuals may request information on whether data relating to them are being processed and, if so, which of their data are being processed.
Request correction of data: the data subject can indicate that the data processed are inaccurate and request that they be replaced by what they provide – the controller is responsible for the accuracy of the data, so it is advisable to check their accuracy from time to time.
Right to deletion: the data subject may request the deletion of their data at any time. Where the controller has given third parties access to the data to be deleted, it shall inform all those to whom it has disclosed the data concerned to delete all references to and personal data held by them.
The right to restriction of processing: in certain cases, the data subject may request the restriction of the processing of his or her personal data – for example, in an unclear, contentious situation or if the processing is no longer necessary but the data subject still wishes to have it restricted.
Right to data portability: the data subject may request to receive the data processed concerning him or her in a structured, commonly used, machine-readable format (e.g. .doc, .pdf, etc.) and has the right to have these data transferred to another controller without hindrance from the original controller. That is, it makes it easier for the data subject to transfer personal data from one controller to another.
Right to object: the data subject has the right to object at any time, on grounds relating to his or her particular situation, to the processing of his or her personal data for a specified reason. This typically happens when the data subject has not given their consent to the processing of their personal data.
Right to withdraw consent: the data subject has the right to withdraw their consent at any time. Withdrawal of consent shall not affect the lawfulness of processing based on consent prior to its withdrawal.
The data subject may exercise his or her rights in relation to his or her data by making a request to the controller orally, in writing, by postal address, e-mail address, website, preferably in the forum through which the data were lawfully received by the controller. In the case of an oral request, a record shall be made and a copy given to the data subject.
If the data subject has a complaint about the processing, we recommend that they first complain to the controller (i.e. the Company). The controller has 25 calendar days to investigate and respond to the complaint. If still having a complaint, they can take it to court (the competent court in their place of residence) or to the National Authority for Data Protection and Freedom of Information.
The court shall act out of turn in the case. The Controller shall prove that the processing is in compliance with the law. Should the Data Controller violate the data subject’s personal rights by unlawful processing of the data subject’s data or by breaching data security requirements, the data subject may claim damages from the Controller.
Authority acting in cases of infringement of rights relating to content offensive to minors, hate speech, exclusionary content, rectification, rights of a deceased person, defamation of reputation is: National Media and Infocommunications Authority (address: HU-1015 Budapest, Ostrom u. 23-25.; phone: +36-1-457-7100, fax: +36-1-356-5520; e-mail: info@nmhh.hu)
Contact details of the National Authority for Data Protection and Freedom of Information:
postal address: HU-1530 Budapest, Pf.: 5.
Address: HU-1125 Budapest, Szilágyi Erzsébet fasor 22/c
Phone: +36 (1) 391 1400 Fax: +36 (1) 391 1410
E-mail: ugyfelszolgalat@naih.hu
URL: http://naih.hu
coordinates: N 47°30’56”; E 18°59’57”
This Privacy Statement is a short extract of the Data Controller’s internal Privacy Statement, which has been created with the purpose of providing data subjects with concise information on the Data Controller’s specific data processing activities and relevant rules. This document is an annex to the Rules, and the provisions of the Rules and the relevant legislation shall prevail and be interpreted in conjunction with the Rules in relation to matters not covered in the Statement. The full Statement and the Rules are available during working hours at the actual place of processing. The Company may amend this Statement, the current version of which is available on the Company’s website.
Budapest, June 15, 2022
Maximum Business Kft.