Privacy Policy

1. INTRODUCTION

This Data Processing Information Notice (hereinafter: “Notice”) applies to the processing of personal data arising from the operation of the website www.bonitasit.hu by Bonitás IT Kft. (hereinafter: “Data Controller”). The Data Controller pays special attention to the protection of personal data, compliance with mandatory legal provisions, and secure and fair data processing.

Details of the Data Controller

Contact details of the Data Controller’s representative

  • Name: Péter Ábrahám
  • Postal address: 1123 Budapest, Alkotás u. 53., MOM PARK, Tower B, 4th floor
  • E-mail: info@bonitasit.hu

This Notice has been prepared in particular on the basis of the following applicable legislation:

  • Act CXII of 2011 on the Right to Informational Self-Determination and on Freedom of Information (hereinafter: “Infotv.”);
  • Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services (hereinafter: “Ektv.”);
  • Act XLVIII of 2008 on the Basic Conditions and Certain Restrictions of Economic Advertising Activities (hereinafter: “Grt.”);
  • Act C of 2003 on Electronic Communications (hereinafter: “Ehtv.”);
  • Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation; hereinafter: “Regulation” or “GDPR”).

This Notice is available at: www.bonitasit.hu/en/adatkezelesi_tajekoztato.php

The Data Controller reserves the right to amend this Notice. In such case, amendments enter into force upon publication at the following page: www.bonitasit.hu/en/adatkezelesi_tajekoztato.php

2. INTERPRETATIVE PROVISIONS (DEFINITIONS)

The terms used in this Notice have the following meanings:

  • data subject: an identified or identifiable natural person (GDPR Article 4(1)). In this case: visitors and users of www.bonitasit.hu.
  • personal data: any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (GDPR Article 4(1)).
  • processing: any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction (GDPR Article 4(2)).
  • restriction of processing: the marking of stored personal data with the aim of limiting their processing in the future (GDPR Article 4(3)).
  • profiling: any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements (GDPR Article 4(4)).
  • pseudonymisation: the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure non-attribution (GDPR Article 4(5)).
  • filing system: any structured set of personal data accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis (GDPR Article 4(6)).
  • controller (data controller): the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data (GDPR Article 4(7)).
  • processor (data processor): a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller (GDPR Article 4(8)).
  • recipient: a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not (GDPR Article 4(9)).
  • third party: a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons authorised to process personal data under the direct authority of the controller or processor (GDPR Article 4(10)).
  • data subject’s consent: any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them (GDPR Article 4(11)).
  • personal data breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed (GDPR Article 4(12)).
  • health data: personal data related to the physical or mental health of a natural person, including data revealing information about the data subject’s health status (GDPR Article 4(15)).
  • representative: a natural or legal person established in the Union designated in writing by the controller or processor (GDPR Article 4(17)).
  • undertaking: a natural or legal person engaged in an economic activity, regardless of legal form (GDPR Article 4(18)).
  • group of undertakings: a controlling undertaking and its controlled undertakings (GDPR Article 4(19)).
  • special data: data falling into special categories of personal data, i.e., personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and genetic data, biometric data for unique identification, health data, or data concerning sex life or sexual orientation (Infotv. Section 3(3)).
  • data transfer: making data accessible to a specified third person (Infotv. Section 3(11)).
  • disclosure/publication: making data accessible to anyone (Infotv. Section 3(12)).
  • erasure: making data unrecognisable so that restoration is no longer possible (Infotv. Section 3(13)).
  • destruction: complete physical destruction of the data medium containing the data (Infotv. Section 3(16)).
  • data processing (by a processor): processing operations carried out by a processor acting on the controller’s behalf or under the controller’s instructions (Infotv. Section 3(17)).
  • data set: the totality of data managed in one registry/filing system (Infotv. Section 3(21)).
  • EEA State: an EU Member State, an EEA Agreement state, and a state whose nationals enjoy equal legal status under an international treaty (Infotv. Section 3(23)).
  • third country: any state that is not an EEA State (Infotv. Section 3(24)).

3. HANDLING OF COOKIES

When visiting the website www.bonitasit.hu, the Data Controller does not use cookies (hereinafter: “cookies”). Nevertheless, the HTML code of the website may contain links originating from external servers and pointing to external servers. The servers of external service providers may communicate directly with the visitor’s computer. We draw visitors’ attention to the fact that, due to direct connection to their servers and direct communication with the visitor’s browser, the providers of these links may collect visitor data. Any personalised content for the visitor may be served by the servers of external providers. Cookies used by external providers may include in particular Google Adwords cookies, Google Analytics cookies, or cookies used by Facebook.

More information about Google cookies is available here:
https://policies.google.com/technologies/types?hl=hu

More information about Facebook cookies is available here:
https://hu-hu.facebook.com/policies/cookies/

More information about the cookie settings of external providers, and about deleting or disabling cookies, can be found at the following links:

4. QUESTION, SUGGESTION, ENQUIRY

Visitors to www.bonitasit.hu have the opportunity to send their questions and suggestions to the Data Controller by e-mail to info@bonitasit.hu.

4.1. Purpose of processing

The purpose of processing is to inform visitors of www.bonitasit.hu (by responding to e-mails), answer questions asked, consider suggestions, facilitate more effective coordination, simplify administration, satisfy needs to the maximum extent possible, and increase customer satisfaction.

4.2. Legal basis of processing

Voluntary consent of the data subject pursuant to Article 6(1)(a) of the Regulation (GDPR).

Visitors can submit their questions and suggestions by sending an electronic message; by sending the message they accept the content of this Notice.

The data subject may withdraw their consent at any time; however, in this case the Data Controller may not be able to provide information and answer questions that have not yet been answered by the time of the withdrawal.

4.3. Categories of data subjects

Visitors who send an electronic message.

4.4. Categories of personal data processed

Visitors of www.bonitasit.hu and persons who send an e-mail to info@bonitasit.hu provide their personal data voluntarily. The person providing the data is responsible for the accuracy of the personal data provided. Senders of electronic messages typically provide the following personal data, which are necessary for the purposes below:

  • Name: contact; answering and handling user questions
  • E-mail address: contact; answering and handling user questions
  • Telephone number: contact; answering and handling user questions

4.5. Duration of processing

Processing continues until the withdrawal of consent, but no later than until the question is answered. The Data Controller keeps a register of persons who have consented to processing by sending an electronic message. If consent is withdrawn, the Data Controller deletes the data subject’s personal data from its register and any existing database.

4.6. Recipients / categories of recipients

Relevant employees of the Data Controller and the data processor(s).

4.7. Controller(s)

The company specified in Section 1 of this Notice.

4.8. Processor(s)

a) Bonitás IT Kft. (postal address: 6725 Szeged, Szabadkai út 18.; e-mail: info@bonitasit.hu; website: www.bonitasit.hu), as the company responsible for website development and operation.
b) Invitech ICT Services Kft. (postal address: 1013 Budapest, Krisztina krt. 39.; e-mail: infra_jog@invitech.hu; website: www.invitech.hu), as the hosting service provider.

5. OBSERVATION, COMPLAINT, GRIEVANCE

Visitors to www.bonitasit.hu may also send their observations/complaints or any problems related to the Data Controller’s products by e-mail to info@bonitasit.hu.

A complaint communicated by telephone or using an electronic communications service qualifies as a verbal complaint (hereinafter: “verbal complaint”) pursuant to Section 17/A(4) of Act CLV of 1997 on Consumer Protection (hereinafter: “Fgy.tv.”).

5.1. Purpose of processing

To inform visitors (electronically), take into account their observations, resolve any problems, facilitate more effective coordination, satisfy needs to the maximum extent possible, and increase customer satisfaction.

5.2. Legal basis of processing

Primarily the data subject’s voluntary consent under GDPR Article 6(1)(a).

Visitors can submit their complaints/problems by sending an electronic message; by sending the message they accept the content of this Notice.

Consent can be withdrawn at any time; however, in that case the Data Controller may not be able to inform data subjects or answer questions that remain unanswered up to the withdrawal.

If, in the case of a verbal complaint, the consumer does not agree with the handling of the complaint or immediate investigation is not possible, the Data Controller must draw up minutes of the complaint and its position. In such cases processing is carried out to comply with a legal obligation under GDPR Article 6(1)(c), pursuant to Section 17/A(3) of Fgy.tv.

If the Data Controller is required under Section 17/B(3) of Fgy.tv. to record all verbal complaints made by phone and the telephone communication between customer service and the consumer, then processing is carried out to comply with a legal obligation under GDPR Article 6(1)(c).

5.3. Categories of data subjects

Visitors who send an electronic message.

5.4. Categories of personal data processed

A complaint is submitted by providing the following personal data, necessary for the purposes below:

  • Name: contact; answering and handling user questions
  • Postal address (postcode, city, street, house number): contact; answering and handling user questions
  • E-mail address: contact; answering and handling user questions
  • Telephone number: contact; answering and handling user questions

If the Data Controller must take minutes of the verbal complaint under Section 17/A(3) of Fgy.tv., the mandatory contents of the minutes are set out in Section 17/A(5) of Fgy.tv., including:

  • the consumer’s name and address;
  • the place, time and method of submitting the complaint;
  • a detailed description of the complaint and a list of documents and other evidence presented;
  • the undertaking’s statement on its position regarding the complaint, if immediate investigation is possible;
  • the name of the person taking the minutes and—except for complaints made by phone or other electronic communications service—the consumer’s signature;
  • the place and time of taking the minutes;
  • in the case of a complaint made by phone or other electronic communications service, the unique identifier number of the complaint.

If the Data Controller is required under Section 17/B(3) of Fgy.tv. to make an audio recording, the Data Controller will also process the data subject’s voice as personal data.

The visitor providing the data is responsible for the accuracy of the data provided.

5.5. Duration of processing

If the Data Controller is not required to take minutes of the verbal complaint because the complaint can be investigated immediately and the data subject agrees with the handling, then processing of the voluntarily provided personal data continues until consent is withdrawn. The Data Controller keeps a register of those who consented; upon withdrawal, personal data are deleted from the register and any existing database.

If the Data Controller is required to take minutes under Section 17/A(3) of Fgy.tv. (including the personal data listed in Section 17/A(5)), then the minutes and a copy of the response must be kept for 5 years under Section 17/A(7) of Fgy.tv. If an audio recording must be made under Section 17/B(3), the audio recording with a unique identifier must also be kept for 5 years.

5.6. Recipients / categories of recipients

Relevant employees of the Data Controller and the data processor(s).

5.7. Controller(s)

The company specified in Section 1 of this Notice.

5.8. Processor(s)

a) Bonitás IT Kft. (postal address: 6725 Szeged, Szabadkai út 18.; e-mail: info@bonitasit.hu; website: www.bonitasit.hu), responsible for website development and operation.
b) Invitech ICT Services Kft. (postal address: 1013 Budapest, Krisztina krt. 39.; e-mail: infra_jog@invitech.hu; website: www.invitech.hu), hosting service provider.

6. NEWSLETTER

The Data Controller does not operate a newsletter service on www.bonitasit.hu.

7. AUTOMATED DECISION-MAKING, PROFILING

The Data Controller does not carry out automated decision-making and/or profiling on the website www.bonitasit.hu.

8. USE OF ELECTRONIC SURVEILLANCE SYSTEM (CCTV)

8.1. Purpose of processing

For security purposes, the Data Controller uses an electronic surveillance system (hereinafter: “camera”) in the areas of the company’s sites.

8.2. Legal basis of processing

Legitimate interests of the Data Controller or a third party pursuant to GDPR Article 6(1)(f).

8.3. Categories of data subjects

Persons entering the areas of the company’s sites.

8.4. Categories of personal data processed

The data subject’s image (likeness) and any conclusions that can be drawn from it.

8.5. Duration of processing

Three working days.

8.6. Recipients / categories of recipients

Relevant employees of the Data Controller and the data processor(s).

8.7. Controller(s)

The company specified in Section 1 of this Notice.

8.8. Processor(s)

BonSec Vagyonvédelmi Kft. (postal address: 1142 Budapest, Szőnyi út 25/A; e-mail: info@bonsec.hu; website: www.bonsec.hu), as the company operating the electronic surveillance system and performing monitoring.

9. DATA SECURITY

The Data Controller stores personal data in electronic form.

The Data Controller and the processor(s), taking into account the state of the art, costs of implementation, the nature, scope, context and purposes of processing, and the varying likelihood and severity of risks to the rights and freedoms of natural persons, implement technical and organisational measures that ensure a level of security appropriate to the risk.

When determining the appropriate level of security, the Data Controller takes into account risks arising in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to personal data transmitted, stored or otherwise processed.

The Data Controller and the processor(s) ensure that natural persons who have access to personal data and act under the authority of the controller or processor process such data only on the controller’s instructions, unless otherwise required by Union or Member State law.

The personal data affected by processing are stored on servers operated within the infrastructure of Bonitás IT Kft. Operation is performed by Bonitás IT Kft. under a management agreement concluded with subsidiaries. The organisational and technical measures for operation are contained in the organisation’s Information Security Policy (IBSZ).

Accordingly, the controller/processor ensures:

  • physical security, including physical protection of all elements of the IT infrastructure and guarding of facilities, with full supervision and control of access to relevant premises;
  • logical security, including least-privilege allocation of access rights, with full supervision and control, ensuring confidentiality and integrity of stored data;
  • availability of systems, ensuring continuity and uninterrupted provision of services as specified in the SLA (Service Level Agreement);
  • risk analyses to identify possible internal and external risks related to processing (e.g., unauthorised access);
  • reliable backups ensuring the maximum data loss level set out in the contract;
  • patch management, ensuring the hosting environment (OS, application backend, database) is kept up to date, thereby minimising vulnerability exploitation risk;
  • vulnerability assessments, at least every two years, to check whether patch-management tasks are performed regularly and whether any known vulnerabilities have not been fixed or only partially fixed;
  • escalation, ensuring the shortest possible resolution path in case of an error.

10. EXERCISING RIGHTS, ENFORCEMENT OF RIGHTS AND REMEDIES

The data subject may exercise the GDPR rights below, taking into account the nature of the legal bases described above.

10.1. Rights of the data subject

10.1.1. Transparent information

The Data Controller provides all information required by the Regulation in a concise, transparent, intelligible and easily accessible form, in clear and plain language, especially when information is addressed to children. Information is provided in writing or by other means, including electronically; at the data subject’s request, information may be provided orally, provided the data subject’s identity has been verified by other means.

10.1.2. Right of access to personal data

Upon request, the Data Controller confirms whether personal data concerning the data subject are being processed. If processing is ongoing, the data subject may request access to their personal data and to the following information:

  • purposes of processing;
  • categories of personal data concerned;
  • recipients or categories of recipients to whom personal data have been or will be disclosed, especially recipients in non-EU countries;
  • envisaged storage period, or criteria used to determine it;
  • right to request rectification, erasure or restriction, and to object to processing;
  • right to lodge a complaint with a supervisory authority;
  • where data were not collected from the data subject, information on their source;
  • whether automated decision-making, including profiling, is used and, if so, meaningful information about the logic involved and the significance and envisaged consequences for the data subject;
  • where data are transferred to a non-EU country or international organisation, information about the transfer.

10.1.3. Rectification of inaccurate personal data

If the Data Controller processes inaccurate or incomplete personal data, it rectifies them without undue delay after receiving the request. The data subject may also request completion of incomplete personal data.

10.1.4. Right to erasure (“right to be forgotten”)

The data subject has the right to request erasure of personal data and to have the Data Controller comply without undue delay if one of the following grounds applies:

  • personal data are no longer necessary for the original purposes;
  • the data subject withdraws consent and there is no other legal basis for processing;
  • processing is based on the controller’s legitimate interests and the data subject objects, and there are no overriding legitimate grounds;
  • processing is for direct marketing purposes and the data subject objects;
  • personal data were processed unlawfully;
  • erasure is required to comply with a legal obligation under Union or Member State law;
  • processing is based on consent given by a child’s guardian and either
    • the data subject is the child’s guardian and the child has not reached age 16, or
    • the data subject is the child who has reached age 16.

The Data Controller may not erase personal data if processing is necessary:

  • for exercising freedom of expression and information;
  • for compliance with a legal obligation, or for performance of a task carried out in the public interest or in the exercise of official authority;
  • for preventive occupational medicine purposes, medical diagnosis, provision of health or social care/treatment, or management of systems and services, under Union or Member State law or pursuant to a contract with a health professional;
  • for reasons of public interest in the area of public health (e.g., protection against serious cross-border threats) under Union or Member State law with appropriate safeguards;
  • for archiving in the public interest, scientific or historical research or statistical purposes, where erasure would likely render impossible or seriously impair the objectives;
  • for establishment, exercise or defence of legal claims.

10.1.5. Right to restriction of processing

Upon request, the Data Controller restricts processing if:

  • the data subject contests the accuracy of the data;
  • processing is unlawful and the data subject opposes erasure and requests restriction instead;
  • the controller no longer needs the data for processing purposes, but the data subject requires them for legal claims;
  • the data subject objects to processing based on legitimate interests and claims their interests override the controller’s.

When processing is restricted, such data may be processed (other than storage) only:

  • with the data subject’s consent; or
  • for establishment, exercise or defence of legal claims; or
  • for protection of the rights of another natural or legal person; or
  • for important public interest of the Union or a Member State.

The Data Controller informs the data subject in advance about lifting the restriction.

10.1.6. Right to data portability

The data subject has the right to receive personal data concerning them, which they have provided to the controller, in a structured, commonly used, machine-readable format, and to transmit those data to another controller, where:

  • processing is based on consent or a contract; and
  • processing is carried out by automated means.

The data subject also has the right to request direct transmission between controllers.

10.1.7. Right to object

The data subject has the right to object to processing of personal data where:

  • processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority; or
  • processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, including profiling; or
  • processing is for direct marketing, including related profiling.

Where processing is based on legitimate interests, the data subject may not object if the controller demonstrates:

  • compelling legitimate grounds overriding the data subject’s interests, rights and freedoms; or
  • processing relates to establishment, exercise or defence of legal claims.

If the data subject objects to direct marketing, the data shall no longer be processed for that purpose.

10.1.8. Automated decision-making in individual cases, including profiling

The data subject has the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning them or similarly significantly affects them.

This right does not apply if the decision:

  • is necessary for entering into or performing a contract;
  • is authorised by Union or Member State law with appropriate safeguards; or
  • is based on the data subject’s explicit consent.

In cases under points (a) and (c), the data subject may request human intervention, express their viewpoint, and contest the decision.

10.1.9. Withdrawal of consent

The data subject may withdraw consent at any time for processing based on consent. Withdrawal does not affect the lawfulness of processing before withdrawal. The Data Controller informs the data subject of this before consent is given. A withdrawal statement is valid if it clearly identifies the specific processing.

10.2. Enforcement of rights, lodging complaints, legal remedies

10.2.1. Exercising rights

The data subject may exercise the above rights by sending an e-mail from an identifiable e-mail address to the controller’s e-mail address, or by post in a signed letter to the controller’s registered address. The statement must clearly identify the specific processing concerned.

For requests submitted electronically, the Data Controller responds electronically or in the manner requested by the data subject.

10.2.2. Lodging a complaint

If the data subject believes that processing of personal data concerning them infringes the Regulation, they have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or the place of the alleged infringement.

In Hungary, complaints may be lodged with the National Authority for Data Protection and Freedom of Information (NAIH). Contact details:

  • E-mail: ugyfelszolgalat@naih.hu
  • Postal address: 1125 Budapest, Szilágyi Erzsébet fasor 22/C.
  • Telephone: +36 (1) 391-1400
  • Website: www.naih.hu

Names and contact details of EU data protection authorities are available at:
http://ec.europa.eu/justice/data-protection/article-29/structure/data-protection-authorities/index_en.htm

10.2.3. Legal remedies

Judicial remedy against the Supervisory Authority
Every data subject has the right to an effective judicial remedy against:

  • a legally binding decision of a supervisory authority; or
  • where the competent supervisory authority does not handle a complaint, or does not inform the data subject within three months about procedural progress or outcome.

Proceedings against the supervisory authority must be brought before the courts of the Member State where the authority is established.

Judicial remedy against the Controller or Processor
The data subject may bring proceedings against the controller or processor if they believe that their data are processed in breach of applicable data protection laws or binding EU legal acts.

Proceedings must be brought before the courts of the Member State where the controller/processor has an establishment; proceedings may also be brought before the courts of the Member State of the data subject’s habitual residence, unless the controller/processor is a public authority acting in the exercise of official authority.

In Hungary, the data subject may also initiate proceedings—at their choice—before the competent court (“törvényszék”) according to their domicile or place of residence.

 





Company name: BONITÁS IT Kft.
Registered office: 6725 Szeged, Szabadkai street 18.
Company registration number: 06-09-012933
Tax number: 14445181-4-06