I.

INTRODUCTORY PROVISIONS

FAZEKAS KLAUDIA sole proprietor (hereinafter referred to as: Data Controller) establishes the following Privacy Policy (hereinafter: Policy) in order to organize internal data protection processes, ensure the rights of data subjects, and prevent data protection incidents.

1.  

PURPOSE AND SCOPE OF THE POLICY

By creating and issuing this Policy, the Data Controller ensures the enforcement of the rights of data subjects as defined in Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (hereinafter: Info Act), and Regulation (EU) 2016/679 of the European Parliament and of the Council (on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, hereinafter: GDPR).

The purpose of this Policy is to provide clear and comprehensible information to the data subjects about the personal data processed or managed by the Data Controller and its data processors, including the source of the data, the purpose, legal basis, and duration of data processing, the identity and contact details of the data controllers and processors, and the purpose, legal basis, and recipients of any data transfers.

The personal and material scope of this Policy extends to the Data Controller and all employees handling personal data, as well as all workflows involving the processing of personal data.

This Policy enters into force on July 4, 2024, and shall remain in effect until revoked by the Data Controller.

2.  

DEFINITIONS USED IN THE POLICY

The terms used in this Policy conform to the definitions and interpretations provided in the Info Act and the GDPR. The following terms are defined according to Article 4 of the GDPR:

“Personal data”: any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

“Processing”: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

“Restriction of processing”: the marking of stored personal data with the aim of limiting their processing in the future.

“Controller”: the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

“Processor”: a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.

“Recipient”: a natural or legal person, public authority, agency, or another body, to which the personal data are disclosed, whether a third party or not.

“Third party”: a natural or legal person, public authority, agency, or body other than the data subject, controller, processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

“Consent of the data subject”: any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

“Supervisory authority”: an independent public authority which is established by a Member State pursuant to Article 51 of the GDPR.

“Personal data breach”: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored, or otherwise processed.

BUDAPEST, July 4, 2024