Privacy Policy

1. General guidelines

• We collect and process personal data only in accordance with applicable laws.
• We disclose personal data to third parties only with the consent of the data subject.
• Under no circumstances do we sell the personal data we process to third parties.
• We store data as securely as possible.
• We send newsletters only to persons who have given their prior and explicit consent to receive them.
• Data subjects may request access to, modification or deletion of the data stored about them at any time.

2. Details and contact information of our Company (data controller, Service Provider]

Name of the data controller: InfoNetfort Kft.
Contact details of the data controller:
Phone: +36305302953
E-mail: kapcsolat@netfort.hu
Web: www.netfort.hu
Tax number: 

The Service Provider reserves the right to amend this Privacy Policy and shall inform data subjects of such amendments in an appropriate manner. Information relating to data processing is published on the LINK GOES HERE website.

3. Definitions according to the GDPR (Regulation]

3.1. data subject/User:any identified or identifiable natural person whose identity can be determined on the basis of personal data, directly or indirectly;

3.2. personal data: any information relating to the data subject – in particular the name, identification mark, and one or more factors specific to their physical, physiological, mental, economic, cultural or social identity – as well as any conclusion that can be drawn from such information relating to the data subject;

3.3. consent: any freely given and specific indication of the data subject's wishes, based on appropriate information, by which the data subject gives their unambiguous consent to the processing of personal data concerning them, either in full or in relation to specific processing operations;

3.4.data controller:the natural or legal person or organisation without legal personality who or which, alone or jointly with others, determines the purpose of the processing of data, makes and implements decisions concerning the processing of data (including the means used for such processing], or has such decisions implemented by the data processor;

3.5. processing: any operation or set of operations performed on data, regardless of the procedure used, including in particular the collection, recording, organisation, storage, alteration, use, retrieval, transmission, disclosure, coordination or combination, restriction, erasure and destruction of data, as well as preventing further use of the data, taking photographs, audio or video recordings, and recording physical characteristics suitable for identifying a person (e.g. fingerprints, palm prints, DNA samples, iris images];

3.6.data transfer: making data available to a specific third party;

3.7. disclosure: making data available to anyone;

3.8. data erasure:making data unrecognisable in such a way that it can no longer be restored;

3.9.data processing: carrying out technical tasks related to data processing operations, regardless of the method and means used to perform the operations and the place of application, provided that the technical task is performed on the data;

3.10. data processor: the natural or legal person or organisation without legal personality who or which processes data on the basis of a contract, including a contract concluded pursuant to legislation;

3.11. personal data breach: unlawful processing or processing of personal data, including in particular unauthorised access, alteration, transmission, disclosure, erasure or destruction, as well as accidental destruction or damage.

4. Scope of data processed, purpose and duration of processing, and data processors

Data subjects concerned: All data subjects registered on/purchasing from the webshop website.

Personal data are shared only and exclusively with the third party indicated in the “Processor of the respective personal data” column, for the purpose of fulfilling the obligations set out in the contract.

Details and tasks of data processors used during data processing

Hosting provider
Name: InfoNetfort Kft.
Address: 7900 Szigetvár, Szent István ltp 17. IV/25.
Phone: +36-30/530-2953
E-mail: kapcsolat@netfort.hu
Web: www.netfort.hu
Tax number: 26648082-2-02
Company registration number: 02 09 084205

Accounting tasks
 

Courier service
 

Direct marketing, newsletter
Name: 
Address: 

4.1 Contact form:

Data subjects concerned: Persons who contact us by telephone, e-mail or via the contact form.

Personal data are not shared with third parties.

5. Newsletter and direct marketing activities

We send newsletters only to Users who have given their prior and explicit consent to receive them. Consent is given using the “Subscribe to newsletter” form.

Data subjects concerned: All data subjects subscribed to the newsletter.

Operator of the newsletter sending system and processor of the data:
Name: 
Address: 

5.1 Procedure for withdrawing consent (unsubscription]
The data subject may unsubscribe from the newsletter at any time and free of charge. Unsubscription may be carried out using the link included in the newsletters or by sending an e-mail to EMAIL ADDRESS GOES HERE.

6. Cookie management

6.1 What is a cookie?

The Data Controller uses so-called cookies when visiting the website. A cookie is a package of information consisting of letters and numbers that our website sends to the data subject's browser in order to save certain settings, make our website easier to use, and help us collect certain relevant statistical information about our visitors. Cookies do not contain personal information and are not suitable for identifying individual users. Cookies often contain a unique identifier – a secret, randomly generated sequence of numbers – which is stored by the data subject's device.
Some cookies expire after the website is closed, while others are stored on your computer for a longer period.

6.2. Legal background and legal basis for cookie management

Cookies typically used by online stores include “password-protected session cookies”, “shopping cart cookies” and “security cookies”, for the use of which it is not necessary to request prior consent from data subjects.

Processing activity and scope of data processed: Unique identifier, dates, times

Data subjects concerned: All data subjects visiting the website.

Purpose of processing: Identification of users and tracking of visitors.

Legal basis for processing: Consent of the data subject in accordance with Section 5 (1] (a] of the Information Act.

6.3 Duration of processing and deadline for deletion of data: the website uses the following cookies:

• Security cookies: __cfduid, _biz_flagsA, _biz_nA3, _biz_pendingA, _biz_sid, _biz_uid
• Google Analytics cookies: _ga, _gid
• Cookies necessary for the proper use of the website: 

Persons authorised to access the data: The data controller does not process personal data through the use of cookies.

Information on the rights of data subjects regarding data processing: Data subjects may delete cookies in the Tools/Settings menu of their browsers, generally under the Privacy settings.
If the data subject does not accept the use of cookies, certain functions may not be available to them. Further information on deleting cookies can be found at the following links:
     • Internet Explorer: http://windows.microsoft.com/en-us/internet-explorer/delete-managecookies#ie=ie-11
    • Firefox: https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-yourcomputer
    • Chrome: https://support.google.com/chrome/answer/95647?hl=en
    • Safari: https://support.apple.com/kb/ph21411?locale=en_US

7. Google Analytics

7.1. This website uses Google Analytics, a web analytics service provided by Google Inc. ("Google"]. Google Analytics uses so-called "cookies", text files that are stored on your computer and enable an analysis of how the website is used by the User.
7.2. The information generated by cookies relating to the website used by the User is generally transmitted to and stored on one of Google's servers in the USA. By activating IP anonymisation on the website, Google shortens the User's IP address beforehand within Member States of the European Union or other states party to the Agreement on the European Economic Area.
7.3. Only in exceptional cases is the full IP address transmitted to and shortened on Google's server in the USA. On behalf of the operator of this website, Google will use this information to evaluate how the User has used the website, to compile reports for the website operator concerning website activity, and to provide further services relating to website and internet use.
7.4. Within Google Analytics, the IP address transmitted by the User's browser is not combined with other data held by Google. The User may prevent the storage of cookies by configuring their browser accordingly; however, please note that in this case not all functions of this website may be fully available. The User may also prevent Google from collecting and processing data generated by cookies relating to their use of the website (including the IP address] by downloading and installing the browser plugin available at the following link. https://tools.google.com/dlpage/gaoptout?hl=hu

8. Google AdWords conversion tracking and remarketing

8.1. The Data Controller uses the online advertising programme called "Google AdWords" and, within this framework, also uses Google's conversion tracking service. Google conversion tracking is an analytics service provided by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google"].
8.2. When a User reaches a website through a Google advertisement, a cookie required for conversion tracking is placed on their computer. These cookies have a limited validity period and do not contain any personal data, so the User cannot be identified through them.
8.3. When the User browses certain pages of the website and the cookie has not yet expired, both Google and the Data Controller can see that the User clicked on the advertisement.
8.4. Each Google AdWords customer receives a different cookie, so users cannot be tracked across the websites of AdWords customers.
8.5. The information obtained using conversion tracking cookies is used to create conversion statistics for customers who have chosen AdWords conversion tracking. This allows customers to determine the number of users who clicked on their advertisement and were redirected to a page equipped with a conversion tracking tag. However, they do not receive any information that could be used to identify individual users.
8.6. If you do not wish to participate in conversion tracking, you may opt out by disabling the installation of cookies in your browser. The data subject will then not be included in the conversion tracking statistics.
8.7. Further information and Google's privacy policy are available at: www.google.de/policies/privacy/

8.8. Google AdWords Remarketing

8.9. Processing as part of remarketing activities is carried out using cookies.

Data processed
Data processed by the cookies specified in the cookie notice.
Duration of processing
The data storage period of the respective cookie; further information is available here:
Google general cookie information: https://www.google.com/policies/technologies/types/
Google Analytics information:
https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage?hl=hu
Legal basis for processing
The voluntary consent of the data subject, which the data subject provides to the Service Provider through the use of the website.

9. Rights of data subjects

9.1 Right to information
Upon the request of the data subject, the Service Provider, as data controller, shall provide information about the data processed by it or by a processor appointed by it, the source of such data, the purpose and legal basis of processing, the duration of processing, the name and address of the data processor and its activities related to data processing, the circumstances and effects of any personal data breach and the measures taken to remedy it, and, in the event of data transfer, the legal basis and recipient of such transfer. The data controller shall provide the information in an understandable form within the shortest possible period from the submission of the request, but no later than 30 days, in writing if requested by the data subject. This information is free of charge if the person requesting the information has not submitted a request concerning the same category of data to the data controller during the current year. In other cases, the Service Provider may charge a fee to cover the costs.

9.2 Right to rectification
The Service Provider shall rectify personal data if they are inaccurate and accurate personal data are available to it.

9.3 Right to restriction
The Service Provider shall restrict the processing of personal data if requested by the data subject or if, based on the information available to it, it can be assumed that erasure would harm the legitimate interests of the data subject. Restricted personal data may only be processed for as long as the processing purpose that prevented the erasure of the personal data continues to exist. The Service Provider shall mark personal data it processes if the data subject disputes their correctness or accuracy, but the incorrectness or inaccuracy of the disputed personal data cannot be clearly established.

9.4 Right to erasure
The Service Provider shall erase personal data if their processing is unlawful, if requested by the data subject, if the processed data are incomplete or incorrect – and this situation cannot be lawfully remedied – provided that erasure is not excluded by law, if the purpose of processing has ceased to exist, if the statutory retention period for the data has expired, or if erasure has been ordered by a court or by the National Authority for Data Protection and Freedom of Information.

9.5 Procedural rules
The data controller has 30 days to erase, restrict or rectify personal data. If the data controller does not comply with the data subject's request for rectification, restriction or erasure, it shall communicate the reasons for the refusal in writing or, with the consent of the data subject, electronically within 30 days. The Service Provider shall notify the data subject, as well as all persons to whom the data were previously transferred for processing purposes, of the rectification, restriction, marking and erasure. Notification may be omitted if, taking into account the purpose of processing, this does not harm the legitimate interests of the data subject.

9.6 Right to object
The data subject may object to the processing of their personal data if

a] the processing or transfer of personal data is necessary solely for the fulfilment of a legal obligation applicable to the data controller or for the enforcement of the legitimate interest of the data controller, data recipient or third party, unless the processing is required by law;

b] in other cases specified by law.

The Service Provider shall examine the objection within the shortest possible period from the submission of the request, but no later than 15 days, decide whether it is justified, and inform the applicant of its decision in writing. If the data controller establishes that the data subject's objection is justified, it shall terminate the processing, including any further collection and transfer of data, and shall restrict the data, as well as notify all persons to whom the personal data concerned by the objection were previously transferred of the objection and the measures taken on the basis thereof; such persons shall take the necessary measures to ensure the exercise of the right to object.

If the data subject does not agree with the decision made by the data controller, they may bring an action before a court within 30 days of the communication of the decision.

The Service Provider may not erase the data of the data subject if the processing of the data is required by law. However, the data may not be transferred to the recipient if the data controller has agreed with the objection or if a court has established that the objection was justified.

9.7. Right to data portability
Where processing is carried out by automated means, or where processing is based on the voluntary consent of the data subject, the data subject has the right to request the Data Controller to provide the data provided by the data subject to the Data Controller, which the Data Controller shall make available to the data subject in XML, JSON or CSV format; where technically feasible, the data subject may request that the Data Controller transmit the data in this format to another data controller.

9.8 Compensation and damages for non-material harm
The Service Provider shall compensate any person for damage caused by the unlawful processing of the data of the data subject or by a breach of data security requirements. In the event of infringement of the personality rights of the data subject, the data subject may claim damages for non-material harm (Section 2:52 of the Civil Code]. The data controller shall also be liable to the data subject for damage caused by the data processor. The data controller shall be exempt from liability if the damage was caused by an unavoidable event outside the scope of data processing.

The data controller shall not compensate the damage and no damages for non-material harm may be claimed to the extent that the damage or infringement of personality rights was caused by the intentional or grossly negligent conduct of the injured party or data subject.

9.9 Right to bring an action before a court
In the event of infringement of their rights, the data subject may bring an action against the data controller before a court. The court shall proceed with the case as a matter of priority.

9.10 Complaint
Complaints may be submitted to the National Authority for Data Protection and Freedom of Information:

Name: National Authority for Data Protection and Freedom of Information
Registered office: 1125 Budapest, Szilágyi Erzsébet fasor 22/C.
Postal address: 1530 Budapest, Pf.: 5.
Phone: +361/391-1400
Fax: +361/391-1410
E-mail: ugyfelszolgalat@naih.hu
Website: http://www.naih.hu

10. Data security

The Service Provider designs and carries out data processing operations in such a way as to ensure the protection of the privacy of data subjects.

The Service Provider, and the data processor within the scope of its activities, shall ensure the security of the data, take the technical and organisational measures and establish the procedural rules necessary to enforce the provisions of the Information Act and other data and confidentiality protection rules.

The Service Provider shall protect the data through appropriate measures, in particular against unauthorised access, alteration, transmission, disclosure, erasure or destruction, accidental destruction or damage, as well as loss of accessibility resulting from changes in the technology used.

During data processing, the Service Provider shall maintain:
     • confidentiality: protecting information so that only those authorised to access it can do so
     • integrity: protecting the accuracy and completeness of the information and the processing method
     • availability: ensuring that when an authorised user needs the information, they can actually access the required information and that the related resources are available.

The IT systems and networks of the Service Provider and its partners involved in data processing are protected against computer-assisted fraud, espionage, sabotage, vandalism, fire and flooding, as well as computer viruses, computer intrusions and denial-of-service attacks. The operator ensures security through server-level and application-level protection procedures.

11. Applicable legislation used for this Privacy Policy

    • Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Information Act]
    • Act V of 2013 on the Civil Code (Civil Code]
    • Act CLV of 1997 on Consumer Protection (Consumer Protection Act]
    • Act XIX of 1998 on Criminal Proceedings (Criminal Procedure Act]
    • Act CVIII of 2001 on Certain Issues of Electronic Commerce and Information Society Services (E-Commerce Act]
    • Act C of 2003 on Electronic Communications (Electronic Communications Act]
    • Act XLVIII of 2008 on the Basic Conditions and Certain Limitations of Economic Advertising Activities (Advertising Act]
    • Recommendation of the National Authority for Data Protection and Freedom of Information on the data protection requirements for prior information
    • GDPR, Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data

DATE