Privacy and cookie policy
1. Data controller, data protection officer and data processors
1.1. Data controller
ENERGOTEST Diagnostic and Automation Limited Liability Company
Registered office and mailing address: 2330 Dunaharaszti, Gomba u. 4.
Regularly used electronic mail address for contact: kereskedelmi@energotest.hu
Company registration number: 13-09-075580
Tax number: 10349258-2-13
Name of the registering authority: Budapest Regional Court of Registration Court
Telephone number: +36 24 501 150
Website: https://energotest.hu
1.2. Data Protection Officer
The Data Controller considered the possibility of appointing a data protection officer based on Article 37 of the GDPR and concluded that the operation of the webshop and the data processing occurring during the purchase within its framework do not justify the appointment of a data protection officer.
1.3. Data Processors
The Data Controller uses the following data processors:
| Name | Activity | Contact |
| AWS | hosting service | 5. Rue Plaetis, 2338, Luxembourg |
| Magyar Posta Zrt. | courier service | Budapest, 1138 Budapest, Dunavirág utca 2-6. |
2. General (introductory) provisions
2.1. The purpose of this information is to provide understandable, up-to-date and transparent information regarding the processing of personal data carried out during the webshop services. This information may be unilaterally modified and/or withdrawn by the Data Controller at any time, with simultaneous information to the data subjects. The information is provided by publishing it on the webshop website.
2.2. The purpose of this information is also to record the data protection and data management principles applied by ENERGOTEST Kft. and the company’s data protection and data management policy, as well as to fulfill the information obligation pursuant to Articles 13-14 of REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as: GDPR).
2.3. The data protection terms used in this information are to be interpreted in accordance with the concepts defined in Article 4 of the GDPR Regulation and supplemented by Act CXII of 2011 on the right to informational self-determination and freedom of information (Infotv.). This Data Protection Notice applies to all natural persons (data subjects) whose personal data are processed by the Data Controller, if the data processing is related to the performance of the activities specified in this Data Protection Notice.
Principles
During the data processing activities of ENERGOTEST Kft., compliance with the following principles, also prescribed by the GDPR, is considered to be the guiding principle:
- We process personal data lawfully, fairly and in a manner transparent to the data subjects.
- Data processing is carried out exclusively for specified, clear and legitimate purposes and does not extend in a manner that would be incompatible with these purposes.
- The amount and content of the processed personal data are aligned with the purposes of the data processing, are limited to them, and are relevant and necessary.
- We take all reasonable measures to ensure that the processed personal data are accurate and – where necessary – up-to-date.
- We will delete or correct inaccurate or incorrect data without delay. We store personal data in a form that allows the identification of data subjects only for the time necessary to achieve the purpose of the data processing.
- During data processing, we apply appropriate technical and organizational measures to guarantee the security of personal data, in particular to prevent unauthorized access, unlawful processing, accidental loss, destruction or damage.
As a data controller, we process personal data in all cases:
- based on the prior information of the data subject, on the basis of voluntary consent, for a specific purpose and only to the extent necessary;
- or we process it in order to fulfill a legal obligation, in which case we separately inform the data subjects about this;
- or – in certain cases – the data processing is based on the legitimate interests of the Data Controller or a third party, in particular in order to ensure the operation, security or development of the webshop.
3. Definitions
Personal data: any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the natural person;
Data processing: any operation or set of operations which is performed on personal data or on data files, whether or not by automated means, such as collection, recording, structuring, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
Restriction of processing: the marking of stored personal data with a view to restricting their future processing;
Data controller: the natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of the processing are determined by Union or Member State law, the controller or the specific aspects relating to the designation of the controller may also be determined by Union or Member State law;
Data processor: the natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller;
Data subject consent: a voluntary, specific, adequately informed and unambiguous indication of the data subject’s will by which the data subject, by a statement or by a clear and unambiguous act, signifies agreement to the processing of personal data concerning him or her;
Data protection incident: a breach of security that results in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;
4. Detailed information on the circumstances of data processing
4.1. Shopping in the webshop
4.1.1. You have the option of using the services of the webshop without or with registration, i.e. you can buy products from the webshop’s offer. The purchased products will be delivered to your home. Within this framework, we process your personal data as follows:
Scope of processed personal data: surname and first name, address, e-mail address, delivery data in the case of home delivery (surname and first name, address, if different from the data provided during the purchase).
Purpose of data processing: identification of you, creation and performance of a purchase contract between you and the Data Controller.
Legal basis for data processing: creation and performance of a contract (GDPR Article 6 (1) point b).
Duration of data processing: for the time necessary to perform the purchase contract between you and the Data Controller, up to the time limit for civil law claims (5 years).
4.1.2. Providing a telephone number:
Purpose of data processing: Although the processing of the telephone number – as personal data – is not a condition for the performance of the purchase contract, it would be difficult to resolve any delivery/receipt difficulties or problems that may arise in connection with the order without knowing the telephone number. In the event that you have ordered the product and paid the purchase price, but the delivery is unsuccessful, it is necessary to ensure that we notify you by phone about the availability of the product before we classify the order as unsuccessful and take action to refund the purchase price paid. Legal basis for data processing: voluntary consent of the data subject (Article 6 (1) point a) of the GDPR).
Duration of data processing: for the time necessary to fulfill the purchase contract between you and the Data Controller, up to the time limit for civil law claims (5 years).
The Data Controller has primary access to personal data processed for the purpose of purchase. We transfer the personal data necessary for home delivery to the chosen service provider.
Data subject rights: in addition to the data subject rights set out in point 7 of the Data Processing Information, the data subject has the right to withdraw their consent to the processing of their personal data at any time; in this case, the Data Controller will no longer process your personal data and will delete your personal data processed on this legal basis, unless another legal basis allows the processing of these data. The withdrawal does not affect the lawfulness of the data processing carried out on the basis of consent before the withdrawal.
4.1.3. Data transfer
We use external service providers to fulfill orders:
courier service: The courier service participates in the delivery of the ordered goods based on a contract concluded with the Data Controller. The courier service processes the personal data received in accordance with the data processing information available on its website. In the event of delivery of products, the name, address of the recipient, and the value of the order are transmitted. The courier service is an independent data controller with regard to postal services and cannot be considered a data processor.
The legal basis for the data transfer: data processing is necessary for the performance of the contract [Article 6 (1) (b) of the GDPR].
4.2. Personal data processed for the purpose of paying the price of the ordered product
You can pay the price of the products ordered in the Webshop by choosing from the following payment methods: bank transfer in advance, payment upon request, cash on delivery or personal payment with a bank card/cash.
Scope of processed personal data: last and first name, bank account number, order identifier, price of the ordered product, transfer time. In the case of a bank transfer, the processed personal data is primarily accessible to the Data Controller or the Data Controller’s account-keeping bank.
Purpose of data processing: identification of you, performance of the purchase contract between you and the Data Controller.
Legal basis for data processing: performance of a contract (Article 6 (1) b) of the GDPR).
Duration of data processing: 8 years in order to fulfill the obligation to preserve accounting documents (Accounting Act, Section 169 (2)).
a) Payment by bank card: Data processing information, point 3.1.1.
4.3. Personal data processed for the purpose of information related to purchases
The operation of the Webshop requires contact and communication between the Data Controller and you. On the one hand, you will receive confirmation of the fact of purchase in the form of an electronic mail. On the other hand, the Data Controller, or with regard to delivery by home delivery, the company that carries out the delivery to you, is obliged to inform you about the data processing. In this context, we process your personal data as follows:
Scope of processed personal data: surname and first name, e-mail address, telephone number.
Purpose of data processing: identification of you, performance of the purchase contract between you and the Data Controller.
Legal basis for data processing: performance of a contract (GDPR Article 6 (1) paragraph b)).
Duration of data processing: the time necessary to perform the contract, up to the statute of limitations for civil law claims (5 years).
Personal data processed for the purpose of providing information about the use of the Webshop may be accessed primarily by the Data Controller or – in the case of home delivery – by the Company performing the delivery.
4.4. Personal data processed for the purpose of accounting obligations
Pursuant to Section 169 (2) of the Accounting Act, the Data Controller is obliged to retain the accounting documents directly and indirectly supporting the accounting settlement, including general ledger accounts, analytical and detailed records, in a readable form for 8 years. To this end, we process your personal data as follows:
Scope of processed personal data: surname and first name, address.
Purpose of data processing: fulfillment of the obligation to preserve accounting documents directly and indirectly supporting the accounting settlement as specified in the Accounting Act.
Legal basis for data processing: fulfillment of the legal obligation applicable to the Data Controller (Article 6 (1) (c) of the GDPR).
Duration of data processing: 8 years in order to fulfill the obligation to preserve accounting documents (Accounting Act, Section 169 (2)).
The Data Controller may access personal data processed in order to fulfill the obligation to preserve accounting documents directly and indirectly supporting accounting settlements, as specified in the Accounting Act.
4.5. Complaints handling
If you are not satisfied with the ordered product or if you have any other objections regarding the webshop, the Data Controller – with regard to Sections 17/A-17/C of the Fgytv. – provides you with the opportunity to submit a complaint. In this case, your personal data will be processed as follows:
Scope of processed personal data: surname and first name, address, e-mail address, product data (description, purchase price), the claim sought by the consumer, the determination of the error, the method of resolving the objection, the date of recording the report.
Purpose of data processing: handling customer complaints and objections.
Legal basis for data processing: fulfillment of the legal obligation of the Data Controller regarding the handling of consumer complaints (GDPR Article 6 (1) (c)).
Duration of data processing: 3 years for recorded minutes, 2 years for duplicates of entries in the customer book, and 3 years for copies of responses to written complaints.
The Data Controller has access to personal data processed for the purpose of handling complaints.
4.6. E-mail customer service – support for customers and interested parties
The webshop provides the opportunity for customers or other interested parties to send a message to the Data Controller and report their interest in a message or ask questions to the Data Controller.
Purpose of data processing: fulfillment of requests for information related to purchases and products.
Scope of data processed: name, e-mail address, personal data that may appear in the message.
Legal basis for data processing: Necessary for the performance of a contract/taking steps prior to entering into a contract [GDPR Article 6 (1) (b)].
Duration of data processing: 60 days
4.7. Customer service (contact) via web form
Personal data processed: name, e-mail address, personal data that may appear in the message.
Purpose of data processing: fulfillment of information requests related to purchases and products
Legal basis for data processing: Necessary for the performance of a contract / taking steps prior to concluding a contract [GDPR Article 6 (1) (b)].
Duration of data processing: 60 days.
4.8. Data processing related to newsletter subscription
The Data Controller pays special attention to the legality of the use of the electronic mail addresses it manages, so it only uses them in the manner specified below to send (informational or advertising) emails.
The management of e-mail addresses primarily serves the identification of the Data Subject, contact and information during the fulfillment of orders, so emails are sent primarily for this purpose.
The Data Controller will only send letters containing advertisements or commercials (newsletters) to the e-mail addresses provided during subscription, in cases and in a manner that complies with legal requirements, with the express consent of the Data Subject.
The newsletter has direct marketing elements and contains advertising. The Data Controller processes the data provided by the Data Subject when using the newsletter. In the case of a newsletter, the Data Controller processes the data provided by the Data Subject when subscribing to the newsletter until the Data Subject unsubscribes from the newsletter by clicking the “Unsubscribe” button at the bottom of the newsletter or requests to be removed from the list of subscribers to the newsletter by email or by post. In the event of unsubscribing, the Data Controller will not contact the Data Subject with further newsletters or offers. The Data Subject may unsubscribe from the newsletter and withdraw their consent at any time free of charge.
Legal basis for data processing: voluntary consent of the data subject (GDPR Article 6 (1) (a)) The consent is voluntarily provided by the Data Subject in relation to individual data processing, including data related to subscribing to the newsletter.
Scope of personal data processed:
– name
– email address
The purpose of data processing is for the Data Controller to contact the Data Subject by email, in a newsletter, and to inform them about its products.
4.9. Use of cookies
The website uses so-called cookies in order to provide the best possible user experience. Cookies store information in your browser, their task is to recognize you when you return to this website later. Cookies help us by providing information about the use of the website by the user and thereby learning which elements of the website the user finds most useful or worst. The system stores cookies on your computer. Regarding cookie settings, we would like to draw your attention to the fact that the use of cookies is permitted by default in browsers. You can delete cookies from your computer or even set your browser to block their use. In the latter case, we would like to point out that the operation of the site will not be fully functional.
By clicking the “I accept cookie settings” button on the website, you consent to the use of cookies managed by our own or external service providers (“third parties”) necessary to record the data and information described in this notice. Such data is the data on your computer that is generated when you use our website or that is recorded as an automatic result of technical processes by the cookies used on our website. The automatically recorded data is automatically logged by the system – without your separate consent – when you visit or exit the website. We do not link this data with any other personal data, and you cannot be identified. Only we and the service provider managing the cookies have access to this data.
Cookies supporting basic functionality: These are essential for navigating the website, for the operation of key website functions and for accessing protected content. These cookies do not collect information that could be used for marketing purposes or that would remember what other websites the visitor has visited. After closing the website, these cookies are automatically deleted and the session is closed. If the visitor does not accept these cookies, the website or some parts of it may not be displayed or may be displayed incorrectly, making it impossible to use the website or fill in forms.
Legal basis for data processing: the legitimate interest of the Data Controller acting as an SME pursuant to Article 6(1)(f) of the GDPR.
As a data subject, you have the right to access, rectify, erase, restrict data processing and object in connection with technical cookies.
We would like to draw the attention of our visitors to the fact that since the purpose of cookies is to support and facilitate the usability and processes of the website, if cookies are disabled, we cannot guarantee that the visitor will be able to fully use all the functions of the website. In this case, the website may function differently in the browser than intended.
Convenience cookies supporting use: These cookies allow our website to remember which operating mode you have chosen (for example: you have accepted the cookie policy and the sorting method in which the results in the search results list are displayed). This is done so that on your next visit you do not have to accept the cookie policy again and again or set the sorting principle according to which you would like to view the content displayed on the site. Without the information contained in cookies that store preferences, our website may function less smoothly.
We do not record personal data in convenience cookies, we only store an identification number, from which the site is informed that the cookie policy has been previously accepted. The convenience cookie is stored by the client’s browser with an expiration date of 1 month. If cookies are allowed, the Data Controller does not record any identifiers. The visitor can use the site and services in complete safety when accepting cookies.
Statistical cookies: Statistical data is automatically generated from the data generated by viewing the website. Legal basis and duration of data processing: Based on the information appearing in the pop-up window, by clicking the “I accept” button, you authorize the Data Controller to use cookies on the website and thereby process your personal data above.
Clicking the “I accept” button constitutes voluntary consent pursuant to Article 6 (1) a) of the GDPR, whereby the Data Controller will process your data until you withdraw your consent. Based on the information appearing in the pop-up window, by clicking the “I do not accept” button, you do not authorize the Data Controller to use cookies on the website and thus process your personal data above. If you do not allow the use of cookies, the website is limited to the use of cookies and technologies essential for its operation, and no personal data is processed.
| Cookie classification | Purpose of data processing | Scope of data processed (examples) | Legal basis | Retention period |
| Cookies ensuring basic functionality | Ensuring the proper functioning of the website (e.g. session management, login, form functionality) | JSESSIONID, csrf_token, cookieConsent, gdpr_level, gdpr_time | GDPR Article 6 (1) para. f) – legitimate interest | Until the end of the session |
| Cookies facilitating use | Remembering user settings (e.g. language, view, cookie consent status) | lang, display_mode, search_sort_order, cookie_consent_status | GDPR Article 6 (1) para. a) – | consent for 6 months |
| Cookies for statistical purposes | Collecting information about how visitors use the site – e.g. visits, clicks | Google Analytics: _ga, _gid, _gat | GDPR Article 6 (1) para. a) – consent | Depending on the cookie: – until the end of the session – 1 minute – 24 hours – 90 days – 2 years – 365 days |
With the exception of cookies that are absolutely necessary for the operation of the website (which do not collect information that is considered personal data), the use of cookies is based on your explicit and informed consent, which constitutes the legal basis for the related data processing. Cookies are only used if you expressly allow their use on the dedicated interface. You can change the settings – and in this context withdraw your consent – at any time.
In addition to the website’s cookie settings, most browsers also provide the ability to view, manage, delete and block cookies from a given website. Please note that if you delete all cookies, any settings stored in them will also be lost, including the option to opt out of receiving cookies, as this feature also requires cookies to be placed on your device. Below you will find instructions on how to control the use of cookies in the most common browsers.
Further detailed information about the cookie settings of the following browsers:
https://support.google.com/accounts/answer/61416?hl=hu https://support.mozilla.org/hu/kb/sutik-informacio-amelyet-weboldalak-tarolnak-szami?redirectlocale=hu&redirectslug=S%C3%BCtik+kezel%C3%A9se https://support.microsoft.com/hu-hu/help/17442/windows-internet-explorer-delete-manage-cookies
https://privacy.microsoft.com/en-us/windows-10-microsoft-edge-and-privacy https://support.apple.com/hu-hu/guide/safari/sfri11471/mac
If you do not accept the use of cookies, certain functions will not be available to you. You can find more information about deleting cookies at the following links:
Mozilla Firefox: Enabling and disabling cookies that websites use to save settings
Google Chrome: Turning cookies on and off
Microsoft Internet Explorer: Deleting and managing cookies
Microsoft Edge: Microsoft Edge, browsing data and data protection
Apple Safari: Managing cookies and website data in Safari on Mac
5. How personal data is stored, security measures
The data controller implements appropriate technical, administrative and organizational measures, taking into account the state of science and technology, to guarantee data security:
– personal data is only accessed by our employees and partners who have been authorized to do so;
– Our web store receives data encrypted via a secure HTTPS protocol, so it is not possible for unauthorized persons to access personal data via any network device between the destination server;
– Our employees use operating systems and software with the latest security updates when performing their tasks;
– We encrypt our backups;
– We delete personal data that is no longer needed or anonymize it for statistical purposes;
– Our hosting provider’s servers operate in a secure data center;
– Our web store stores personal data on its IT equipment located at its headquarters and on the hosting provider’s servers located in a secure data center.
The Data Controller shall keep records of any data protection incidents, indicating the facts related to the data protection incident, its effects and the measures taken to remedy it.
The Data Controller shall report any data protection incident to the National Data Protection and Freedom of Information Authority without delay and, if possible, no later than 72 hours after it has become aware of the data protection incident, unless the data protection incident is unlikely to result in a risk to the rights and freedoms of natural persons. We regularly review our security measures, record the necessary actions in our internal Incident Management Policy and our employees always perform their duties in accordance with the current policy.
6. Automatic decision-making
The Data Controller does not carry out automatic decision-making and profiling with the personal data of the data subject.
7. Data subject rights, legal remedies
The data subject may request information about the processing of his or her personal data, and may request the correction of his or her personal data, or – with the exception of mandatory data processing – the deletion, withdrawal, restriction of data processing, and may exercise his or her right to data portability and objection at one of the contact details set out in point 1 of this Data Processing Information, or via the customer service set out in points 6 and 7 of the Data Processing Information.
7.1. Right to information
The data subject has the right to contact the Data Controller in writing with a request for information regarding the processing of his or her personal data at the above contact details of the Data Controller. The Data Controller shall inform the data subject without undue delay, but in any case within one month of receipt of the request, of the measures taken following the data subject’s request. If necessary, taking into account the complexity of the request and the number of requests, the 30-day deadline may be extended by a further two months. The Data Controller shall inform the data subject of the extension of the deadline within one month of receipt of the request, indicating the reasons for the delay. If the data subject submitted the request electronically, the Data Controller shall provide the information electronically, unless the data subject requests otherwise. The Data Controller shall provide the information and the action free of charge. If the data subject’s request is manifestly unfounded or, in particular, excessive, due to its repetitive nature, the Data Controller may charge a reasonable fee, taking into account the administrative costs of providing the requested information or taking the requested action, or may refuse to take action on the basis of the request.
7.2. Right of access
The data subject has the right to obtain from the Controller whether or not personal data concerning him or her are being processed and, where such processing is taking place, to have access to the personal data and to the following information: the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipients to whom the personal data have been or will be disclosed, including in particular recipients in third countries or international organisations; the planned storage period of the personal data; the right to rectification, erasure or restriction of processing and to object; the right to lodge a complaint with a supervisory authority; information on the sources of the data; the fact of automated decision-making, including profiling, as well as intelligible information on the logic involved and the significance of such processing and the foreseeable consequences for the data subject. The Controller shall provide the data subject with a copy of the personal data subject to the processing. For additional copies requested by the data subject, the data controller may charge a reasonable fee based on administrative costs. At the data subject’s request, the Data Controller shall provide the information in electronic form.
7.3. Right to rectification
The data subject may request the rectification of inaccurate personal data concerning him or her and the completion of incomplete data.
7.4. Right to erasure
The data subject shall have the right to obtain from the Data Controller the erasure of personal data concerning him or her without undue delay where one of the following grounds exists:
- the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
- the data subject withdraws his or her consent on which the processing is based and there is no other legal basis for the processing;
- the data subject objects to the processing and there are no overriding legitimate grounds for the processing; the personal data have been processed unlawfully;
- the personal data must be erased for compliance with a legal obligation to which the controller is subject under Union or Member State law;
- the personal data were collected in connection with the provision of information society services.
The erasure of data cannot be initiated in the case of mandatory data processing: in the case of a legal basis based on Article 6(1)(c) of the GDPR.
7.5. Right to restriction of data processing
At the request of the data subject, the Data Controller shall restrict the processing of data where one of the following conditions is met:
- the data subject contests the accuracy of the personal data, in which case the restriction shall apply for a period enabling the accuracy of the personal data to be verified;
- the processing is unlawful and the data subject opposes the erasure of the data and requests the restriction of their use instead;
- the data controller no longer needs the personal data for the purposes of the processing, but the data subject requires them for the establishment, exercise or defence of legal claims;
- or the data subject has objected to the processing;
- in which case the restriction shall apply for a period of time until it is determined whether the legitimate grounds of the data controller override those of the data subject.
If processing is restricted, personal data may be processed, with the exception of storage, only with the consent of the data subject, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for important public interests of the Union or of a Member State. The data subject shall be informed in advance by the Data Controller of the lifting of the restriction on processing.
7.6. Right to data portability
The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to the Data Controller, in a structured, commonly used and machine-readable format and to transmit these data to another Data Controller.
7.7. Right to object
The data subject shall have the right, on grounds relating to his or her particular situation, to object at any time to processing of his or her personal data for the purposes of the legitimate interests pursued by the Data Controller or by a third party. In the event of an objection, the controller shall no longer process the personal data unless there are compelling legitimate grounds for doing so which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
7.8. Procedural rules
The controller shall inform the data subject without undue delay and in any event not later than one month from the date of receipt of the request of the measures taken in response to the request pursuant to Articles 15 to 22 of the GDPR. If necessary, taking into account the complexity of the request and the number of requests, this period may be extended by a further two months.
The controller shall inform the data subject of the extension of the period within one month from the date of receipt of the request, indicating the reasons for the delay. If the data subject has submitted the request electronically, the information shall be provided electronically, unless the data subject otherwise requests.
If the controller does not take action on the data subject’s request, it shall inform the data subject without delay, but at the latest within one month of receipt of the request, of the reasons for not taking action and of the fact that the data subject may lodge a complaint with a supervisory authority and exercise his or her right to a judicial remedy.
The controller shall provide the requested information and communication free of charge. If the data subject’s request is manifestly unfounded or, in particular, excessive due to its repetitive nature, the controller may charge a reasonable fee, taking into account the administrative costs of providing the requested information or communication or taking the requested action, or may refuse to take action on the request.
The controller shall inform any recipient to whom or by whom the personal data have been disclosed of any rectification, erasure or restriction of processing made by it, unless this proves impossible or involves a disproportionate effort. Upon request, the data controller shall inform the data subject of these recipients.
The data controller shall provide the data subject with a copy of the personal data subject to data processing. For further copies requested by the data subject, the data controller may charge a reasonable fee based on administrative costs. If the data subject has submitted the request electronically, the information shall be made available in electronic format, unless the data subject requests otherwise.
7.9. Right to appeal to court:
The data subject may appeal to court against the data controller in the event of a violation of his or her rights. The court shall proceed with the case ex officio.
7.10. Data protection authority procedure:
A complaint may be lodged with the National Data Protection and Freedom of Information Authority:
National Data Protection and Freedom of Information Authority
Registered office: 1055 Budapest, Falk Miksa u. 9-11.
Mailing address: 1363 Budapest, P.O. Box: 9.
Telephone: 06-1-391-1400
Fax: 06-1-391-1410
E-mail: ugyfelszolgalat@naih.hu
Website: http://www.naih.hu
8. Code of Conduct
The Data Controller does not submit itself to the provisions of any code of conduct.
Dated: Budapest, April 7, 2025.