Download in PDF format

INFORMATION ON DATA PROCESSING

I. THE PURPOSE OF THE INFORMATION

 

When submitting your recipes and product ideas, signing up for a newsletter and entering into a contract later, you will be required to provide certain personal information. In this Information, we summarize important info about what personal information we collect about you, for what purposes and under what conditions, how we protect it, and what rights you have in this context.

This Information ensures you the enforcement of the legal, fair and transparent data processing and the right of informational self-determination in accordance with the principles of Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, “GDPR”) and of Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (“Info Act”).

II. THE CONTROLLER

 

Your personal data is processed by Hunorganic Gyártó és Nagykereskedelmi Korlátolt Felelősségű Társaság (seat: 1037 Budapest, Bécsi út 269., company registration number: 01-09-354762, represented by: György Fider, managing director, e-mail: info@itsusfood.com, phone: +36-30-425-3853, hereinafter referred to as: “Controller”).

III. THE PURPOSE, LEGAL BASIS AND TERM OF DATA PROCESSING

 

1. The submission of the recipe and product idea

 

1.1. The purpose of data processing

 

The Controller records, processes, analyses, and in case of entering into a contract, uses the recipe or product idea submitted by you in the course of submitting recipes and ideas to the implementation of the product.

1.2. The range of data processed

 

The data requested during the submission of the recipe and idea is necessary for your identification in the database (surname, first name), for contacting you (e-mail, phone number, address for service), for the assessment of your personal abilities and skills (gender, introduction) and for the assessment of the idea’s suitability for implementation (description of the specific idea).

1.3. The legal basis of data processing

 

The legal basis of data processing is your voluntary consent prior to the conclusion of the contract, which you may withdraw at any time [Article 6 (1) a) of the GDPR].

1.4. The term of data processing

 

The Controller processes your personal data until your consent is withdrawn, but at most up to one year after submitting your recipe or idea. You may withdraw your consent at any time by sending an email to the address of the Controller mentioned above. The withdrawal of your consent shall not affect the lawfulness of processing based on your consent before its withdrawal.

2. The conclusion and performance of the contract

 

2.1. The purpose of data processing

 

Should the Controller find the recipe or idea submitted by you worthy of implementation, you will be required to provide additional personal information in order to conclude and perform the contract.

2.2. The range of data processed

 

The information requested during the conclusion of the contract is necessary for your identification, contact, performance of the contract and enforcement of certain claims arising from the contract (name, address, mother’s name, place and date of birth, citizenship).

2.3. The legal basis of data processing

 

The data processing is needed for the appropriate measures to be taken prior to the conclusion of the contract, to the performance of the contract and to the enforcement of legitimate claims of the Controller arising from the contract [Article 6 (1) b) and f) of the GDPR].

2.4. The term of data processing

 

In case of entering into a contract, the Controller shall process your personal data during the legal relationship or after the expiry of the legal relationship until the statutory limitation period has expired.

3. The advertising of the product

 

3.1. The purpose of data processing

 

When entering into a contract, the Controller will also ask you for additional personal information in order to indicate it on the packaging of the product and to use it for its advertising.

3.2. The range of data processed

 

This data is necessary for the promotion and advertising of the product (first name, age, citizenship, nationality, place of residence (country, city), photo, video recording, quote of your choice, product description, user instructions, hobby, marital status, autograph, signature).

3.3. The legal basis of data processing

 

The legal basis of data processing is your voluntary consent, however, once a product has been placed on the market, you may not withdraw your consent or usage license [Article 6 (1) a) of the GDPR].

3.4. The term of data processing

 

The Controller shall process your personal data during the distribution of the product.

4. Data processing regarding newsletter subscription

 

4.1. The purpose of data processing

 

The Controller uses the personal data provided by you at the subscription to newsletters to send you newsletters, advertising letters and questionnaires electronically, in order to inform you of the latest news, events, promotions or to estimate your interests, expectations of the development of their private label products.

4.2. The range of data processed

 

This information is required to identify you in the database (name) and to send out newsletters (email address).

 

4.3. The legal basis of data processing

 

The legal basis of data processing is your voluntary consent prior to the conclusion of the contract, which you may withdraw at any time [Article 6 (1) a) of the GDPR].

4.4. The term of data processing

 

The Controller may process your personal data until your consent is withdrawn.

IV. ENTITLED PERSONS TO BE APPRISED OF DATA, PROCESSORS

 

Your personal data may be accessed by the employees of the Controller and under its direct control in order to perform their job duties, who shall treat the data confidentially in accordance with the internal rules and procedures in force at any time at the Controller.

When processing your personal data, the Controller uses the following processors:

Operation of website: Face Média Kft. (Budapest)

Marketing and creative agencies who may also have access to data when performing their contractual tasks: Bake & Company (Gent), Ollie – Design & Strategy (Gent)

V. DATA TRANSFER, OFFICIAL DATA PROVISION

 

In addition to this, the Controller may only, in exceptional cases, transfer your personal data to another person, if the transfer is necessary to fulfil the Controller’s legal obligation. For example, if a court proceeding that affects you is initiated and the court requires the transfer of documents including your personal data to them, or the police visits the Controller and calls upon the Controller to the transfer of documents including your personal data necessary for the investigation.

VI. TECHNICAL AND ORGANIZATIONAL MEASURES FOR DATA SECURITY

 

The Controller stores your personal data on a server located at its seat. The Controller ensures the security of your personal data by taking appropriate technical and organizational measures to the level of risk, the protection against unlawful or illegal data processing, accidental loss, destruction or damage, including the security of confidentiality, integrity, availability and resilience regarding IT systems needed for the processing of your personal data.

VII. RIGHTS RELATED TO DATA PROCESSING

 

1. Right of information / right of access

 

Through the contact details of the Controller provided above, you may, at any time, have the right to obtain from the Controller confirmation as to whether or not personal data concerning you are being processed. If such data processing is in progress, you have the right to request information from the Controller, on what personal data, on what legal basis, for what purpose, from what source and for how long it is processed, and to whom, when, under what law, or what personal data of yours have been disclosed, including in particular recipients in third countries or international organisations. The Controller will respond to your request for information within a maximum of 30 days by sending a letter or email to the contact details you provided. You also have the right to have access to your personal information in such a way, that the Controller sends you the relevant personal information in writing or by email.

 

2. Right to rectification

 

Through the contact details of the Controller defined above, you have the right to obtain from the Controller without undue delay the rectification of inaccurate personal data concerning you in writing or by e-mail, or the completion of your incomplete personal data. For example, you can change your email address at any time. The Controller will fulfil the request within a maximum of 30 days and will notify you by letter or email sent to the contact details you have provided.

3. Right to erasure / right to be forgotten

 

Through the contact details of the Controller defined above, you have the right to obtain from the Controller the erasure of personal data concerning you without undue delay in writing or by e-mail, where one of the following grounds applies:

  1. a) your personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed by the Controller;
  2. b) you withdraw your consent on which the processing is based and there is no other legal ground for the processing
  3. c) you object to the processing and there are no overriding legitimate grounds for the processing,
  4. d) your personal data have been unlawfully processed by the Controller;
  5. e) your personal data have to be erased for compliance with a legal obligation applicable to the Controller;
  6. f) the personal data have been collected in relation to the offer of information society services to children.

 

The Controller will respond to your request within a maximum of 30 days and will notify you by the contact details you have provided. If the Controller has forwarded your personal data to another person, the Controller shall inform the other controllers / processors within 30 days that you have requested the deletion of a copy of your personal data.

4. Right to blocking of data / right to restriction of processing

 

Through the contact details of the Controller defined above, you may call the Controller for the blocking of your personal data or for the restriction of processing in writing or by e-mail, where one of the following applies:

  1. a) the accuracy of the personal data is contested by you, in this case the blocking/restriction applies to a period enabling the Controller to verify the accuracy of the personal data;
  2. b) the processing is unlawful, and you oppose the erasure of the personal data and request the restriction of their use instead;
  3. c) the Controller no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims;
  4. d) you have objected to processing; in this case the restriction applies to that period until it turns out whether the legitimate grounds of the Controller override those of the data subject.

 

In case of blocking or restricting data, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest. The blocking / restriction of data will last as long as the reason you have specified makes it necessary to store them.

 

5. Right to data portability

 

Through the contact details of the Controller defined above, you may call the Controller to receive the personal data concerning you in writing or by e-mail, which you have provided to the Controller, in a structured, commonly used and machine-readable format and to transmit those data to another controller, if the data processing is grounded on your consent. In exercising your right to data portability, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible. The Controller will fulfil your request within a maximum of 30 days and will notify you by letter or email sent to the contact details you have provided.

6. Right to object

 

Through the contact details of the Controller defined above, you have the right to object to the processing of your personal data based on the legitimate interests of the Controller or a third party. In such case, the Controller shall no longer process the personal data unless the Controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of yours or for the establishment, exercise or defence of legal claims. Through the contact details of the Controller defined above, you may, at any time, in writing or by e-mail object to the processing of your personal data for direct marketing purposes, in which case your personal data shall no longer be processed for such purposes.

7. Automated individual decision-making, including profiling

 

The Controller does not apply a decision based on solely automated processing, including profiling. Should the Controller introduce a decision-making process based on such processing in the future, it will inform you in advance, by e-mail, of the applied logic, method and its essential elements and will provide opportunity to ask for human intervention from the Controller’s part, to express your point of view and to challenge the decision.

 

VIII. ENFORCEMENT OPTIONS RELATED TO DATA PROCESSING

 

If you experience unlawful data processing, you should first send your complaint to the Controller before initiating legal proceedings, as this will allow the Controller to restore the lawful state by itself.

By submitting a complaint to the supervisory authority, you can initiate an investigation by referring to that through the processing of your personal data your rights have been impaired, or its imminent danger exists. The name and contact details of the supervisory authority are as follows:

Nemzeti Adatvédelmi és Információszabadság Hatóság

Seat: 1125 Budapest, Szilágyi Erzsébet fasor 22/c

Address: 1530 Budapest, Pf.: 5

E-mail: ugyfelszolgalat@naih.hu

Phone: +36 (1) 391-1400

Fax: +36 (1) 391-1410

Website: www.naih.hu

Should you experience any illegal data processing, you may file a civil lawsuit before court. The adjudication of the dispute falls under the scope of the tribunal. The lawsuit may, at your option, be brought before the court of your place of residence as well. You can view the list and contact details of the courts through the following link: http://birosag.hu/torvenyszekek.

 

IX. THE SUPERVISION AND AMENDMENT OF THE INFORMATION

 

The circumstances of data processing may change from time to time and the Controller may at any time decide to supplement its ongoing data processing with a new data processing purpose, therefore the Controller reserves the right to amend or supplement this Information at any time. The Controller will notify you by e-mail of any amendments or supplements to this Information through the contact details provided by you.

 

X. LEGISLATION ON DATA PROCESSING

 

The following legislation applies to the processing of personal data:

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) the current text of which can be found here:

http://eur-lex.europa.eu/legal-content/HU/TXT/PDF/?uri=CELEX:32016R0679&rid=1

Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (“Info Act”) the current text of which can be found on the following link:

http://net.jogtar.hu/jr/gen/hjegy_doc.cgi?docid=A1100112.TV

Act CVIII of 2001 on Electronic Commerce and on Information Society Services (“Ektv.”) the current text of which can be found on the following link:

https://net.jogtar.hu/jogszabaly?docid=a0100108.tv