Privacy Notice

The purpose of this Privacy Notice is to give data subjects adequate information about the processing of personal data by V&T Global Szolgáltató Kft. (the Controller) through the website operated under the domain name www.orsys.hu (the Website), including its purposes, legal bases, duration and recipients of data transfers.

Applicable legislation

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation, GDPR).
• Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Infotv.).

Controller details

Name: V&T Global Szolgáltató Kft.

Registered office: 1158 Budapest, Thököly út 23. Company registration number: 01-09-282296 Tax number: 25561399-2-42

Website: www.orsys.hu

Email: info@orsys.hu

Hosting provider: netcup GmbH (Daimlerstraße 25, 76185 Karlsruhe, Germany)

Definitions

• Data subject: a natural person identified or identifiable on the basis of any information.
• Personal data: any information relating to the data subject.
• Consent: a freely given, specific, informed and unambiguous indication of the data subject's wishes by which they signify agreement to the processing of their personal data through a statement or other conduct clearly expressing that intention.
• Controller: a natural or legal person or an organisation without legal personality that, within the limits of legislation or a binding EU legal act, alone or jointly with others determines the purpose of processing, makes decisions about processing, including the tools used, and implements them or has a processor implement them.
• Processing: any operation or set of operations performed on data, regardless of the procedure used, including collection, recording, registration, organisation, storage, alteration, use, retrieval, transmission, disclosure, alignment or combination, blocking, erasure and destruction, and preventing further use; taking photographs or making audio or video recordings; and recording physical characteristics suitable for identifying a person, such as fingerprints, palm prints, DNA samples or iris images.
• Data transfer: making data available to a specified third party.
• Third party: a natural or legal person or organisation without legal personality other than the data subject, controller, processor or persons who process personal data under the controller's or processor's direct authority.
• Personal data breach: a breach of security resulting in accidental or unlawful destruction, loss, alteration, unauthorised transmission or disclosure of, or access to, personal data transmitted, stored or otherwise processed.

Processing principles

The Controller follows these principles:

• Personal data is processed lawfully, fairly and transparently to data subjects (lawfulness, fairness and transparency).
• Personal data is collected only for specified, explicit and lawful purposes and is not processed incompatibly with those purposes (purpose limitation).
• Personal data collected and processed is adequate, relevant and limited to what is necessary for the purposes (data minimisation).
• The Controller takes every reasonable measure to keep data accurate and up to date and promptly erases or corrects inaccurate personal data (accuracy).
• Personal data is stored in a form permitting identification of the data subject only for as long as necessary for the purposes of processing (storage limitation).
• The Controller uses appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and accidental loss, destruction or damage (integrity and confidentiality).

Processing activities

Ordering the Service

Purpose of processing
Handling and fulfilling orders, maintaining contact.

Data processed
Contact person's name, email address, phone number, username and password.

Retention period
Five years after performance of the contract.

Legal basis
Processing is necessary to perform a contract to which the data subject is a party, Article 6(1)(b) GDPR.

Data transfer

• Name: Barion Payment Zrt.
  Address: 1117 Budapest Irinyi József u. 4-20.
  Purpose: bank card payment.

Invoicing and accounting

Purpose of processing
Compliance with statutory requirements.

Data processed
Billing name and address, transaction amount and transaction date.

Retention period
Eight years under section 169 of Act C of 2000.

Legal basis
Processing is necessary to comply with a legal obligation of the Controller, Article 6(1)(c) GDPR.

Data transfer

• Name: Szeratics Ildikó EV
  Address: 1152 Budapest, Báthory utca 6.
  Purpose: bookkeeping and tax services.
• Name: Billingo Technologies Zrt.
  Address: 1133 Budapest, Árbóc utca 6.
  Purpose: invoicing.

Contact enquiries

Purpose of processing
Handling contact initiated by the data subject and responding to enquiries.

Data processed
Name, email address and phone number.

Retention period
Until the enquiry is concluded.

Legal basis
The data subject's consent, Article 6(1)(a) GDPR.

Direct marketing

Purpose of processing
Sending marketing offers by email.

Data processed
Name and email address.

Retention period
Until the data subject withdraws consent.

Legal basis
The data subject's consent, Article 6(1)(a) GDPR.

Using the Website

Purpose of processing
Ensuring proper operation of the Website, measuring visits and statistical purposes.

Data processed
IP address, time of visit, pages visited, operating system and browser type.

Retention period
A maximum of two years from the visit.

Legal basis
Processing is necessary for the Controller's legitimate interests, Article 6(1)(f) GDPR.

Data transfer

• Name: netcup GmbH
  Address: Daimlerstraße 25, 76185 Karlsruhe, Germany
  Purpose: hosting.
• Name: Webflow Inc.
  Address: 398 11^th Street, Floor 2, San Francisco, CA 94103
  Purpose: collecting statistical information.
• Name: Google LLC
  Address: 1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA
  Purpose: collecting statistical information.
• Name: Facebook Inc.
  Address: Menlo Park, California, USA
  Purpose: collecting statistical information.
• Name: Hotjar ltd.
  Address: 5th Floor, Dragonara Road, Paceville St Julian's STJ 3141 Malta
  Purpose: collecting statistical information.

Cookies on the Website

The Controller uses cookies when operating the Website. A cookie is a short text file stored on a computer's or mobile device's drive and activated on later visits.

Cookies facilitate and enable use of the Website, save certain user settings and help collect relevant statistical information about visitors.

Some cookies contain no personal information and cannot identify individual users. Others contain a unique identifier stored on the data subject's device, enabling identification.

Most browsers accept cookies by default, but the data subject may configure their browser to reject cookies or notify them when cookies arrive. Cookies can be deleted using the browser.

Cookies containing no personal information that are strictly necessary for the Website to function do not require consent. Data collection or statistical cookies load only after the data subject accepts the notice about them.

Accepting cookies is optional, but the Controller accepts no responsibility if the Website does not work as expected without cookies enabled.

Cookies used by the Website:

Google Analytics: Google's analytics tool helps website owners understand visitor activity. It may use cookies to collect information and report website usage statistics without identifying individual visitors to Google. Further information: https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage?hl=hu

Google Ads: Google uses cookies to personalise advertisements in Google products, including Google Search. Google Ads conversion tracking uses cookies, storing them on a user's computer when they click an advertisement to track resulting conversions. Further information: https://policies.google.com/technologies/types?hl=en-US

Facebook Pixel: The Facebook pixel is code that provides website owners with analytics on visitors' website usage and conversions. It can be used to display personalised offers and advertisements to website visitors on Facebook. Further information: https://www.facebook.com/policies/cookies/

Data subject rights

In relation to their personal data, the data subject has the right to:

• receive information about the circumstances of processing before processing begins, the right to prior information;
• receive their personal data and information about its processing from the Controller on request, the right of access;
• have the Controller correct or supplement personal data on request, the right to rectification;
• have the Controller restrict processing on request, the right to restriction of processing;
• have the Controller erase personal data on request, the right to erasure;
• receive personal data concerning them that they supplied to the Controller in machine-readable form and transmit it to another controller, the right to data portability;
• object at any time to processing based on the Controller's legitimate interests, the right to object. The Controller must then stop processing unless it demonstrates compelling legitimate grounds overriding the data subject's interests, rights and freedoms, or grounds relating to establishing, exercising or defending legal claims.

The Controller provides for these rights as follows:

• To provide the right to information, the Controller makes this Privacy Notice available on the Website.
• To provide the right to rectification, the Controller promptly clarifies, corrects or supplements inaccurate, incorrect or incomplete personal data, particularly at the data subject's request.

• To provide the right to restriction, the Controller restricts processing:

  • if the data subject disputes the accuracy, correctness or completeness of personal data and these cannot be established beyond doubt, for the time needed to resolve that doubt;
  • if data would otherwise be erased, but the data subject's written statement or information available to the Controller gives reasonable grounds to believe erasure would harm the data subject's legitimate interests, for as long as those interests justify not erasing it;
  • if data would otherwise be erased but must be preserved as evidence in statutory investigations or proceedings, especially criminal proceedings, conducted by or involving the Controller or another public body, until their final or legally binding conclusion.

• To provide the right to erasure, the Controller promptly erases personal data if:

  • processing is unlawful;
  • the data subject withdraws consent or requests erasure;
  • erasure is required by legislation, an EU legal act, the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), or a court.

Remedies

If you have comments or objections about processing your data, please contact the Controller at info@orsys.hu.

If you believe the Controller processes your personal data in breach of legislation or a binding EU legal act governing personal data processing, you may bring proceedings before the competent regional court.

You may also submit a complaint to the Hungarian National Authority for Data Protection and Freedom of Information:

Name: Nemzeti Adatvédelmi és Információszabadság Hatóság
Address: 1055 Budapest, Falk Miksa utca 9-11
Postal address: 1363 Budapest, Pf.: 9.
Phone: (+36-1) 391-1400
Email: ugyfelszolgalat@naih.hu

Data transfers

The Controller transfers personal data to third parties only to the extent strictly necessary and only to persons named in this Notice or other parties linked by contract or statutory requirements, such as legal representatives or authorities.

When transferring data, the Controller must ensure that the third party uses it only for the specified purpose and to the necessary extent and erases it once the purpose has been fulfilled.

Handling personal data

If the data subject provides another person's personal data, the Controller assumes that they have the necessary authorisation.

The data subject may withdraw consent at any time by emailing info@orsys.hu. The Controller may continue processing certain data after withdrawal to fulfil legal obligations or pursue legitimate interests.

If misleading personal data is used or the data subject commits a criminal offence, the data is erased or, where necessary, retained for the duration of proceedings to determine civil liability or conduct criminal proceedings.

To protect electronically processed data, the Controller uses solutions providing an appropriate level of security in light of current technology. The Controller must handle and store computer equipment, passwords and data storage media so that unauthorised persons cannot access data requiring protection.

Data with no specified purpose or whose purpose has ceased must be destroyed promptly or when the required retention period expires. Computer-recorded data must be permanently deleted when it has fulfilled its purpose, to prevent further use.

The Controller retains the data it processes electronically at its registered office.

Procedural rules

The data subject may request erasure or amendment of personal data or information about processing at info@orsys.hu.

On request, the Controller must provide information about the data it processes and the legal basis, purpose and duration of processing. It must respond in writing as soon as possible and no later than one month after the request is submitted.

Where necessary, taking account of the complexity and number of requests, this period may be extended by two further months. The Controller informs the data subject of the extension and reasons for the delay within one month of receiving the request.

If the request was submitted electronically, information should be provided electronically where possible, unless the data subject requests otherwise.

Information must be concise, transparent, intelligible, easily accessible and written in clear, plain language.

If the Controller takes no action on the request, it informs the data subject without delay and no later than one month after receipt of the reasons and of the right to complain to a supervisory authority and seek a judicial remedy.

The Controller provides information free of charge except where:

• the data subject repeatedly requests information or action on substantially unchanged content;
• the request is clearly unfounded and excessive.

Handling personal data breaches

The Controller reports a personal data breach involving data it processes to NAIH promptly and no later than 72 hours after becoming aware of it. Reporting is not required if the breach is unlikely to pose a risk to data subjects' rights.

If the breach is likely to pose a high risk to natural persons' rights and freedoms, the Controller informs the data subject without undue delay.

The data subject need not be informed if any of the following conditions applies:

• The Controller implemented appropriate technical and organisational safeguards and applied them to the affected data, particularly measures such as encryption that render the data unintelligible to persons not authorised to access it.
• Following the breach, the Controller took further measures ensuring that the high risk to the data subject's rights and freedoms is unlikely to materialise.
• Informing data subjects would require disproportionate effort. In that case, public communication or similarly effective measures must inform them.

The Controller reserves the right to amend this Privacy Notice. The current Notice is always available to data subjects at www.orsys.hu.

10 September 2022