DATA MANAGEMENT POLICY
PRIVACY AND DATA PROCESSING POLICY
I, the undersigned Balázs Andorkó, sole proprietor, as the operator of https://andorkophoto.com/ (hereinafter referred to as the “Website”), hereby declare that:
In operating the Website, I, as the Data Controller, respect the fundamental rights and freedoms of users, in particular the right to privacy, in the processing of their personal data, and comply in all respects with the provisions of Act CXII of 2011 on Informational Self-Determination and Freedom of Information (hereinafter referred to as the “Infotv.”).
This Data Processing Policy shall remain in force from 2 July 2019 until its withdrawal.
We hereby inform our users of the following:
1. The Data Controller
1.1. Pursuant to Section 3, Point 9 of the Infotv., the Data Controller is the natural or legal person, or organisation without legal personality, who or which independently or jointly with others determines the purpose of data processing, makes decisions concerning data processing (including the means used), and implements such decisions or has them implemented through a data processor appointed by them.
1.2. The details of Balázs Andorkó, sole proprietor, as the Data Controller (hereinafter referred to as the “Data Controller”) are as follows:
Name: Balázs Andorkó
Registered office: Budapest
(The place of central administration is the same as the registered office.)
Sole proprietor registration number: 57063034
Tax number: 58716216-1-42
Telephone: +36 20 447 7949
Email: andorkobalazs@gmail.com
2. Data Processed by the Data Controller
2.1. When contacting us, you provide us with information that qualifies as personal data pursuant to Section 3, Point 2 of the Infotv. Providing such data is voluntary.
Personal data means any data that can be associated with the data subject, in particular the name, identification mark, or one or more characteristics relating to the data subject's physical, physiological, mental, economic, cultural or social identity, as well as any conclusions that may be drawn from such data concerning the data subject.
2.2. No external organisation (data processor) is engaged for the operation of the Website or for the processing of visitors' data.
2.3. We do not request any special categories of personal data as defined in Section 3, Point 3 of the Infotv. when you contact us.
2.4. The following data may be requested when contacting us:
Name
Email address
Telephone number
2.5. Certain data generated by the computer you use to access the service is automatically recorded. Such data is automatically logged by the Data Controller's system. Only the Data Controller has access to this data.
3. Purpose and Duration of Data Processing
3.1. The data collected when you contact us is stored and used solely for the purpose of contacting you.
The purpose of automatically recorded data is to compile statistics and improve the information technology system.
Personal data may only be disclosed to third parties or authorities with your express consent, unless otherwise provided for by law.
3.2. The Data Controller is primarily entitled to access the data to the extent necessary to fulfil the purpose of contacting you.
We do not make your data accessible to third parties, except where the involvement of another member of staff is necessary to fulfil the purpose of the contact. In such cases, by acknowledging our data protection principles, you consent to the disclosure of the data necessary for the performance of the contractual task to our contracted staff members.
3.3. Contracted staff members are, in all cases, bound by the terms specified in their contracts and may only use your data for the performance of their contractual duties. They are not entitled to retain the data for any other purpose or to disclose it to any third party in any form.
3.4. Personal data provided during registration shall be processed until the data is deleted.
Automatically recorded data shall be stored by the system for 12 months.
4. Legal Basis for Data Processing
4.1. The legal basis for the processing of data is Act CVIII of 2001 on Certain Issues of Electronic Commerce and Information Society Services, Act CXIX of 1995 on the Processing of Name and Address Data for the Purposes of Research and Direct Marketing, as well as the Infotv.
4.4. Pursuant to Section 13/A of Act CVIII of 2001 on Certain Issues of Electronic Commerce and Information Society Services:
(1) The service provider may process the natural identification data and address of the user necessary for identification for the purposes of establishing and determining the content of a contract for the provision of an information society service, modifying such contract, monitoring its performance, invoicing fees arising from the contract, and enforcing claims arising from the contract.
(2) For the purpose of invoicing fees arising from a contract for the provision of an information society service, the service provider may process the natural identification data and address of the user, as well as data relating to the time, duration and location of the use of the service.
(3) In addition to the purposes specified in paragraph (2), the service provider may process personal data that is technically indispensable for the provision of the service.
Where other conditions are equal, the service provider must select and operate the means used for providing the information society service in such a way that personal data is processed only where this is strictly necessary for the provision of the service and the fulfilment of the other purposes specified by law, and even in such cases only to the extent and for the period necessary.
(4) In addition to the purposes specified in paragraph (3), data relating to the use of the service may only be processed for other purposes — including, in particular, improving the efficiency of the service, delivering electronic advertising or other targeted content to the user, or conducting market research — if the purpose of the data processing has been determined in advance and the user has given their consent.
(5) The user must be continuously provided with the opportunity, both before and during the use of the information society service, to prohibit the data processing referred to in paragraph (4).
(6) Data processed for the purposes specified in paragraph (4) may not be combined with the user's identification data and may not be disclosed to third parties without the user's consent.
(7) Data processed for the purposes specified in paragraphs (1)–(3) must be deleted following the failure to conclude a contract, the termination of the contract, and the completion of invoicing.
Data processed for the purpose specified in paragraph (4) must be deleted when the purpose of the processing ceases to exist or when the user so requests.
Unless otherwise provided by law, such deletion must be carried out without delay.
(8) The provision of an information society service may not be made conditional upon the user's consent to data processing for a purpose not specified in paragraphs (1)–(3), provided that the service cannot be obtained from another service provider.
(9) In addition to the information required by separate legislation, the service provider must ensure that, before and during the use of the information society service, the user may at any time obtain information regarding which categories of data are processed for which purposes, including the processing of data that cannot be directly associated with the user.
5. Access to, Modification, Rectification, Deletion and Blocking of Data
5.1. As a user who has completed the contact form, you have the right to request the modification or rectification of your data.
If your request for modification or rectification cannot be fulfilled, we shall notify you within 30 days of receiving the request of the factual and legal grounds for the refusal, as well as the available legal remedies.
5.2. If any data provided during contact is inaccurate and accurate data is available to us, we shall rectify the data.
5.3. Data must be deleted if:
its processing is unlawful;
you request its deletion;
the data is incomplete or incorrect and cannot be lawfully remedied;
the purpose of the data processing has ceased to exist or the legally prescribed retention period has expired;
a court or the Hungarian National Authority for Data Protection and Freedom of Information has ordered its deletion.
5.4. Instead of deleting the data, we shall block it if you request this, or if, based on the available information, it can be assumed that deletion would violate your legitimate interests.
Blocked personal data may only be processed for as long as the purpose of the data processing that prevented its deletion continues to exist.
5.5. Requests for modification and deletion shall be implemented within 1 working day of receipt.
5.6. We shall notify you of any rectification, blocking or deletion, unless omitting such notification does not prejudice your legitimate interests in view of the purpose of the data processing.
6. Information
6.1. Upon your request, we shall provide information within 30 days of receiving your request regarding the data processed by us or by a data processor appointed by us, the source of such data, the purpose, legal basis and duration of the processing, as well as the name and address of the data processor and the activities it performs in connection with data processing.
Where your personal data has been transferred, we shall also provide information regarding the legal basis and recipient of such transfer.
6.2. If you have any questions or comments concerning data processing, please contact our representative using the contact details specified in Section 1.2.
6.3. Your rights and available legal remedies in relation to data processing are governed by the Infotv.
If you have a complaint regarding our data processing practices, you may contact the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):
Address: 1125 Budapest, Szilágyi Erzsébet fasor 22/c., Hungary
Postal address: 1530 Budapest, Pf. 5, Hungary
Telephone: +36 (1) 391-1400
Fax: +36 (1) 391-1410
Email: ugyfelszolgalat@naih.hu
You may also seek judicial remedy. The proceedings shall fall within the jurisdiction of the competent Regional Court.
7. Miscellaneous
7.1. The Data Controller shall take all necessary measures to ensure the security of the data collected, stored and processed, and shall take all measures available to prevent unauthorised use, alteration or potential destruction of such data.
7.2. Please note that if you provide the personal data of a third party during registration, we shall cooperate with the competent authorities in identifying the person responsible for the unlawful conduct.