6. Rights of data subjects and how to exercise them
According to the provisions of the GDPR, you have the following rights in relation to the data processing. You may exercise these rights at any time by contacting us at the contact details indicated in point 1 above.

We will consider your request without delay and, if necessary, take the appropriate measures. We will then provide you with a detailed response within max. 1 month as of receiving your request, explaining the taken measures or, if no measure has been taken, the reasons. If it is necessary due to the complexity of the request and the number of requests, the above deadline may be prolonged with two months. In such a case, the prolongation will be communicated within one month as of the receipt of the request, explaining the reasons for the delay.

Please make your request briefly, clearly and in your own words. All requests will be dealt with individually.

A) Right to access
At any time, you have the right to request information about whether and how we process your personal data, including the purposes of the processing, the recipients to whom your data have been disclosed or the source from which the data were obtained, the retention period, your rights in relation to the processing and, in the case of transfers to third countries or international organisations, information about the safeguards relating to the transfer. In exercising your right of access, you also have the right to request a copy of the personal data being processed by us. Where your right of access adversely affects the rights and freedoms of others, in particular the trade secrets or intellectual property rights of others, we are entitled to refuse to fulfil your request to the extent necessary and proportionate. In the event that you request more than one copy of the above information, we will charge you a reasonable fee proportionate to the administrative costs of producing the additional copies.

B) Right to rectification
We will correct the personal data we store about you at any time at your request (e.g. in the event of a change of data). If we have previously disclosed the personal data affected by the rectification to another person (such as a recipient as data processor), we will inform such persons of the rectification without undue delay after the rectification, provided that this is not impossible or does not require a disproportionate effort. Upon your request, we will inform you of these recipients.

C) Right to erasure (‘right to be forgotten’)
If you request the erasure of any or all of your personal data, we will erase it without undue delay if:
● we no longer need the personal data for the purposes for which it was processed;
● the data processing was based on your consent, but you have withdrawn your consent and there is no other legal basis for the data processing;
● the data processing is based on our legitimate interests, but you have objected to the data processing and there are no primary legitimate grounds for us to continue the processing (the burden of proof in this context is on us);
● we have unlawfully processed the personal data despite our best efforts; or
● the erasure of personal data is necessary to comply with a legal obligation.

If we have disclosed the personal data affected by the erasure to another person (such as a recipient as data processor), we will inform such persons of the fact of erasure without undue delay after the erasure, provided that this is not impossible or does not require a disproportionate effort. Upon your request, we will inform you of these recipients.

Please note that we may not be obliged to erase your personal data, in particular if the processing is necessary for the establishment, exercise or defence of legal claims.

D) Right to restriction of processing
You can also request the restriction of the processing of your personal data in the following cases. Restriction means that we will not perform any operation on the data concerned, except for storage, and we will not use the personal data:
● if you contest the accuracy of the personal data we process about you – in this case, the restriction applies for the period of time that allows us to verify the accuracy of the personal data;
● the data processing is unlawful, but you do not want the personal data concerned to be erased and instead you want the processing to be restricted;
● the purpose for which we carried out the processing no longer exists, but you require such data for the establishment, exercise, or defense of legal claims; or
● you have objected to the processing – in this case, the restriction will remain in place until it is determined whether there are any compelling legitimate grounds that overrides your objection, in other words, until it is decided whether the processing may continue despite the objection or not.

If the personal data affected by this right have been disclosed to another person (i.e. a recipient, such as a data processor), we will inform such persons of the fact of the restriction without undue delay after the restriction, provided that this is not impossible or doe not require a disproportionate effort. Upon your request, we will inform you of these recipients.

E) Right to object
If the legal basis for processing is our legitimate interest, you have the right to object to the processing. In this case, we have the burden of proof and we are not obliged to uphold your objection if:
● the data processing is justified by a compelling legitimate grounds which prevail your right to object, or
● the data processing relates to the establishment, exercise or defence of legal claims.
Otherwise, in the event of your objection, the data processing will be stopped immediately.

F) Right to data portability

You have the right to request that the personal data that you have provided to us on the basis of your consent be provided to you in a structured, machine-readable format (e.g. as an email attachment) or, where technically feasible, transferred directly to another data controller designated by you at your request. Where the exercise of your right to data portability would adversely affect the rights and freedoms of others, we are entitled to refuse to comply with your request to the extent necessary and justified.

G) Right to complain, right to remedy
We will do our best to ensure that we never give you cause for complaint. However, if you consider that our processing of your personal data violates the provisions of the applicable data protection legislation, in particular the General Data Protection Regulation, you have the right to lodge a complaint with the National Authority for Data Protection and Freedom of Information (“NAIH”). Contact details of the NAIH:

Website: http://naih.hu/
Address: 1055 Budapest, Falk Miksa utca 9-11.
Postal address: 1363 Budapest, Pf.: 9.
Phone: +36-1-391-1400
Fax: +36-1-391-1410
E-mail: ugyfelszolgalat@naih.hu

You also have the right to appeal against a legally binding decision of the NAIH that applies to you. You also have the right to a judicial remedy if the NAIH does not deal with your complaint or does not inform you within three months of the procedural developments or outcome of your complaint.

Effective: 14 February 2024.