Table of Contents
0. Introduction
1. Definitions – What do the terms mean?
2. Legislation governing data processing – Under which laws does the Data Controller process data?
3. Purpose of data processing – Why does the Data Controller process data?
4. Categories of data processed – What data does the Data Controller process?
5. Legal basis for data processing – On what legal basis does the Data Controller process data?
6. Data processing procedures – How and for how long does the Data Controller process data?
7. Data security – How does the Data Controller protect the data it processes?
8. Data Controllers and Data Processors – Who processes data provided to Mozgásvilág Kft.?
9. Rights of Data Subjects, Non-Personal Data Data Subjects and Employees – What rights do you have in relation to data processing by the Data Controller and the Data Processor?
10. Miscellaneous and final provisions
Introduction
The purpose of this Privacy Notice (hereinafter: the “Notice”) is to set out the main requirements relating to the data-processing activities of Mozgásvilág Szolgáltató Kft. (registered office: 1119 Budapest, Gerezd utca 4., company registration number: 01-09-865953, tax number: 13645395-2-43) (hereinafter: “Mozgásvilág Kft.”), in accordance with the applicable legislation, with particular regard, but not limited, to the GDPR and the Hungarian Information Act.
A key purpose of the Notice is also to provide Data Subjects with concise, transparent, understandable, clear and easily accessible information about the processing of personal data, in a form that complies with the applicable legal requirements.
1. Definitions – What do the terms mean?
a.) Types of data processed by the Data Controller:
a/1.) Personal Data: any information relating to a Data Subject.
a/2.) Non-Personal Data: any data that does not qualify as Personal Data.
b.) Persons whose data is processed by the Data Controller:
b/1.) Data Controller: a natural or legal person, or an organisation without legal personality, which, alone or jointly with others, determines the purposes of and makes decisions concerning the processing of data (including the means used), carries out the processing, or has it carried out by a Data Processor.
b/2.) Client: a person who uses, enquires about, requests a quotation for, submits an offer concerning, or uses the websites in connection with Mozgásvilág Kft.’s advertising or content services. Clients may be Data Subjects in relation to Personal Data or Data Subjects in relation to Non-Personal Data.
b/3.) Visitor: a person acting for non-business purposes who uses Mozgásvilág Kft.’s websites or Facebook page, enquires about content displayed there, or subscribes to the newsletter.
b/4.) Employee: a natural person employed by Mozgásvilág Kft. or engaged by it under another legal relationship involving work.
b/5.) Data Subject in relation to Personal Data: a natural person who is identified or identifiable, directly or indirectly, by reference to any information. For the purposes of this Notice, a Data Subject in relation to Personal Data includes a natural person whose Personal Data is provided to the Data Controller by a Visitor, Client or Employee entering into a contract with it. An Employee whose Personal Data is processed by Mozgásvilág Kft. as their employer is also a Data Subject in relation to Personal Data. Data Subjects in relation to Personal Data may include Visitors, Clients, Employees and other persons.
b/6.) Data Subject in relation to Non-Personal Data: a natural person, legal person or organisation without legal personality to whom or which Non-Personal Data relates, or with whom or which it can be associated. Data Subjects in relation to Non-Personal Data may include Visitors, Clients, Employees and other persons.
c.) Activities relating to the Data Controller’s processing of data:
c/1.) Data processing by a processor: carrying out technical tasks related to data-processing operations, regardless of the method or means used to perform those operations or where they are performed, provided that the technical task is carried out on the data.
c/2.) Data processing: any operation or set of operations performed on data, regardless of the procedure used, including in particular, but not exclusively, collecting, obtaining, recording, organising, storing, altering, using, retrieving, transmitting, disclosing, aligning or combining, blocking, erasing and destroying data, as well as preventing their further use.
c/3.) Consent: a freely given, specific, informed and unambiguous indication of the wishes of a Data Subject in relation to Personal Data, a Data Subject in relation to Non-Personal Data, or an Employee, by which they signify agreement to the processing of Personal Data or Non-Personal Data relating to them through a statement or another action that clearly expresses their wishes.
For the purposes of this Notice, consent also includes a statement by a Visitor, Client or Employee confirming that they provide the Personal Data and Non-Personal Data they transfer to the Data Controller in accordance with the applicable legal requirements and assuring the Data Controller that it may lawfully process the data so provided without taking any further steps, even if the data does not relate to the Visitor, Client or Employee.
c/4.) Destruction of data: the complete physical destruction of a data carrier containing data.
c/5.) Erasure of data: rendering data unrecognisable in such a way that it can no longer be restored.
d.) Other terms relating to the Data Controller’s processing of data:
d/1.) Data set: the totality of data processed in a given register.
d/2.) Contract: a mutual and matching declaration of intent made by Mozgásvilág Kft. and a Client, attributable to Mozgásvilág Kft. and the Client, which gives rise to an obligation to perform a task and a right to demand performance.
d/3.) Employment contract: a mutual and matching declaration of intent made by Mozgásvilág Kft. and an Employee, attributable to Mozgásvilág Kft. and the Employee, which establishes an employment relationship or another legal relationship involving work.
d/4.) Advertising service: a service under which Mozgásvilág Kft. provides the Client with advertising space on websites operated by Mozgásvilág Kft.
d/5.) Content service: a service under which Mozgásvilág Kft. uploads content to a website or Facebook page designated by the Client.
d/6.) Newsletter database: a closed data set operated by the Data Controller, containing primarily email addresses, whose purpose is to store and organise, over the long term, the contact details of recipients and prospective recipients of newsletters about the Data Controller’s services.
d/7.) Websites: a collection of pages belonging to a particular domain name, created in coded form and hosted on a server. For the purposes of this Notice, “websites” means https://www.mozgasvilag.hu/.
2. Legislation governing data processing – Under which laws does the Data Controller process data?
2.1. The Data Controller has prepared this Notice in accordance with the following legislation, with particular regard, but not limited, to:
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: the “GDPR”);
- The Fundamental Law of Hungary;
- Act V of 2013 on the Civil Code (hereinafter: the “Civil Code”);
- Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (hereinafter: the “Hungarian Information Act”);
- Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities (hereinafter: the “Advertising Act”);
- Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services (hereinafter: the “E-Commerce Act”);
- Act I of 2012 on the Labour Code (hereinafter: the “Labour Code”).
3. Purpose of data processing – Why does the Data Controller process data?
3.1. The purposes of processing data relating to Clients are:
- providing information requested by a Client or Visitor;
- identifying the Client, as necessary to conclude and perform a contract;
- collecting and processing the data, information and documents required for Mozgásvilág Kft. to perform its contractual obligations, and using them as part of that performance;
- documenting contractual performance;
- keeping the information required for invoicing;
- minimising the data that a Client must provide again for the conclusion and performance of future contracts;
- where the Visitor has given consent, adding them to the newsletter database and keeping the data needed to send newsletters;
- preparing statistical reports and developing Mozgásvilág Kft.’s marketing activities and website by evaluating the related data.
3.2. The purposes of processing data relating to Employees are:
- identifying an Employee, as necessary to conclude and perform an employment contract;
- providing data and making payments required by law to the competent authorities, and fulfilling other legal obligations relating to employment.
4. Categories of data processed – What data does the Data Controller process?
4.1. Visitors
4.1.1. Cookies and logged activity data:
When certain parts of the websites are downloaded, cookies are placed on the Visitor’s computer. Cookies are small text files saved by the computer and browser which record the Visitor’s activity on the websites and make it possible to identify activities associated with the Visitor’s computer (hereinafter: “activity data”). Visitors receive a separate notice about the use of cookies when using the websites and may consent to their use. Cookies are also necessary for certain website functions to operate. Cookies do not harm your computer and do not contain viruses.
Activity data is stored in a closed system protected by IT algorithms. Only the Data Controller and the other persons identified in section 8.1 have access rights. The Data Controller expressly undertakes to use activity data solely to develop the websites, develop its marketing strategy and marketing activities, and prepare statistical reports.
4.1.2. Data processed in the newsletter database:
When using the websites or placing an order, a Visitor may subscribe to Mozgásvilág Kft.’s newsletter list. They must provide the following data:
- name;
- email address.
4.1.3. Data provided when making contact:
The websites allow Visitors to contact Mozgásvilág Kft. directly. In doing so, Visitors must provide the following data:
- name;
- email address;
- any additional data that may be necessary for the communication.
In addition, a Visitor may contact Mozgásvilág Kft. by telephone, email or Facebook. In such cases, the following data may be provided:
- name;
- telephone number, email address, Facebook profile name and public profile data;
- any additional data that may be necessary for the communication.
4.1.4. Data provided in connection with prize promotions:
Visitors may occasionally take part in prize promotions organised by Mozgásvilág Kft. In this connection, the Data Controller processes the following data:
a.) Participation on https://www.mozgasvilag.hu/:
- name;
- email address;
- any additional data that may be required to participate.
4.2. Clients
4.2.1. Cookies and logged activity data:
When certain parts of the websites are downloaded, cookies are placed on the Client’s computer. Cookies are small text files saved by the computer and browser which record the Client’s activity on the websites and make it possible to identify activities associated with the Client’s computer (hereinafter: “activity data”). Clients receive a separate notice about the use of cookies when using the websites and may consent to their use. Cookies are also necessary for certain website functions to operate. Cookies do not harm your computer and do not contain viruses.
For Clients logged in to the relevant website, the activity data described above is associated with the following data:
- user ID;
- full name;
- email address;
- company name;
- telephone number;
- website address.
Activity data is stored in a closed system protected by IT algorithms. Only the Data Controller and the other persons identified in section 8.1 have access rights. The Data Controller expressly undertakes to use activity data solely to develop the websites, develop its marketing strategy and marketing activities, and prepare statistical reports.
4.2.2. Data provided when making contact:
The websites allow Clients to contact Mozgásvilág Kft. directly. In doing so, Clients must provide the following data:
- name;
- email address;
- any additional data that may be necessary for the communication.
In addition, a Client may contact Mozgásvilág Kft. by telephone, email or Facebook. In such cases, the following data may be provided:
- name;
- telephone number, email address, Facebook profile name and public profile data;
- any additional data that may be necessary for the communication.
4.2.3. Data provided during registration:
When using https://www.mozgasvilag.hu/, a Client may register for the website’s advertiser area. In this case, they must provide the following data:
- user ID;
- full name;
- nickname;
- email address;
- company name;
- role/authority;
- address;
- telephone number;
- county;
- password;
- whether they wish to subscribe to the newsletter.
After registration, the Data Controller also processes the following data relating to registered Clients:
- date and content of the last data modification;
- date of the last login;
- registration date.
4.2.4. Client data stored in the business administration system and its sales interface:
The Data Controller stores the following Client data in its own business administration system:
- company name;
- address;
- contact person’s name;
- contact person’s telephone number;
- contact person’s email address;
- other data required to conclude a contract.
4.3. Employees
4.3.1. Mozgásvilág Kft. processes the following data of persons applying for a job advertised by the company:
- name;
- place and date of birth;
- email address;
- telephone number;
- CV;
- cover letter;
- other data contained in the CV and cover letter (for example, information about previous employment).
4.3.2. Mozgásvilág Kft. processes the following data relating to Employees and their employment:
- name;
- birth name;
- place and date of birth;
- mother’s name;
- permanent address;
- place of residence;
- tax identification number;
- identity card number;
- social security number;
- copies, where applicable, of documents (identity card, address card, tax card, social security card, driving licence, certificates of qualifications, social security booklet, and the Employee’s child’s social security card);
- bank account number;
- data concerning wages and the payment of wages, taxes and contributions;
- data contained in any information provided by an authority.
5. Legal basis for data processing – On what legal basis does the Data Controller process data?
5.1. Personal Data: The Data Controller’s authority to process Personal Data is based on the consent of the Data Subject in relation to Personal Data. The Data Subject may withdraw their consent at any time.
The legal basis for processing certain Personal Data is also that the processing is necessary for the performance of a contract to which the Data Subject in relation to Personal Data is a party, or in order to take steps at their request before entering into a contract.
In addition, certain Personal Data must be processed under applicable legislation (for example, data required for invoicing).
In many cases, the processing of Personal Data relating to Employees is also based on legal requirements.
5.2. Non-Personal Data: Processing is based on a statement by the Visitor, Client or Employee that the Data Controller may lawfully process the data provided.
6. Data processing procedures – How and for how long does the Data Controller process data?
6.1. Processing data provided by Visitors
6.1.1. Processing data recorded by cookies:
Activity data recorded by cookies is stored in the Data Controller’s closed system protected by IT algorithms. Only the persons identified in section 8.1 have access rights.
The Data Controller processes this data until the purpose of the processing has been fulfilled and documents a review of the necessity of processing at least once every three years. The Data Controller retains the resulting review documentation for 10 years.
6.1.2. Processing data held in the newsletter database:
By making a voluntary, unilateral and explicit statement while using the websites, a Visitor may consent to the recording of the above data in the newsletter database.
As with the data described in section 6.1.1, newsletter database data is stored in a separate, closed system. The Data Controller expressly undertakes not to disclose the data set in the newsletter database or make it available to unauthorised third parties. Data relating to a Visitor that is recorded in the newsletter database will be deleted from the Data Controller’s newsletter database as soon as possible after the Visitor unsubscribes.
6.1.3. Processing data provided when making contact:
Visitors may contact Mozgásvilág Kft. through the contact forms on the websites, by telephone, email or Facebook.
The legal basis for processing data provided through the websites’ contact forms is the Data Subject’s consent. Once provided to the Data Controller, this data is recorded in the Data Controller’s closed system protected by IT algorithms. Only the persons identified in section 8.1 have access rights.
If data provided by a Visitor is recorded on paper, the Data Controller keeps it in an organised manner in a room in a building that can be securely locked, with access limited to the persons identified in section 8.1.
The Data Controller processes this data until the purpose of the processing has been fulfilled and documents a review of the necessity of processing at least once every three years. The Data Controller retains the resulting review documentation for 10 years.
For contact by telephone, email or Facebook, the legal basis for processing is that the data is necessary to take steps requested by the Visitor before entering into a contract. The Data Controller deletes or destroys such data after providing a response.
6.1.4. Processing data provided in prize promotions:
Visitors may take part in prize promotions announced on Mozgásvilág Kft.’s websites or Facebook page by providing the data listed above.
The data provided in this way is recorded in the Data Controller’s closed system protected by IT algorithms. Only the persons identified in section 8.1 have access rights.
The Data Controller processes this data until the purpose of the processing has been fulfilled and documents a review of the necessity of processing at least once every three years. The Data Controller retains the resulting review documentation for 10 years.
6.2. Processing data provided by Clients
6.2.1. Processing data recorded by cookies:
Activity data recorded by cookies is stored in the Data Controller’s closed system protected by IT algorithms. Only the persons identified in section 8.1 have access rights.
The Data Controller processes this data until the purpose of the processing has been fulfilled and documents a review of the necessity of processing at least once every three years. The Data Controller retains the resulting review documentation for 10 years.
6.2.2. Processing data provided when making contact:
Clients may contact Mozgásvilág Kft. through the contact forms on the websites, by telephone, email or Facebook.
The legal basis for processing data provided through the websites’ contact forms is the Data Subject’s consent. Once provided to the Data Controller, this data is recorded in the Data Controller’s closed system protected by IT algorithms. Only the persons identified in section 8.1 have access rights.
If data provided by a Client is recorded on paper, the Data Controller keeps it in an organised manner in a room in a building that can be securely locked, with access limited to the persons identified in section 8.1.
The Data Controller processes this data until the purpose of the processing has been fulfilled and documents a review of the necessity of processing at least once every three years. The Data Controller retains the resulting review documentation for 10 years.
For contact by telephone, email or Facebook, the legal basis for processing is that the data is necessary to take steps requested by the Client before entering into a contract. The Data Controller deletes or destroys such data after providing a response.
6.2.3. Processing data provided during registration:
When using https://www.mozgasvilag.hu/, a Client may register for the website’s advertiser area. In this connection, the Data Controller processes the data listed above.
This data is recorded in the Data Controller’s closed system protected by IT algorithms. Only the persons identified in section 8.1 have access rights.
The Data Controller processes this data until the purpose of the processing has been fulfilled and documents a review of the necessity of processing at least once every three years. The Data Controller retains the resulting review documentation for 10 years.
6.2.4. Data stored in the business administration system and its sales interface:
To facilitate the conclusion of contracts, the Data Controller operates a business administration system in which it stores the data listed above.
A Client may provide the Data Controller, in person, by telephone or by email, with data required to conclude a particular contract that was not provided during registration.
The Data Controller may process this data until the contract is concluded because it is necessary to take steps requested by the Client before entering into a contract.
When concluding the contract, the Client may consent to the processing of the data. If no contract is concluded between the Client and the Data Controller, the Data Controller deletes the data.
This data is recorded in the Data Controller’s closed system protected by IT algorithms. Only the persons identified in section 8.1 have access rights.
The Data Controller processes this data until the purpose of the processing has been fulfilled and documents a review of the necessity of processing at least once every three years. The Data Controller retains the resulting review documentation for 10 years.
6.3. Processing data provided by Employees and data relating to employment
6.3.1. Processing data relating to job interviews:
The Data Controller processes the data listed above in relation to persons applying for a job interview.
This data is recorded in the Data Controller’s closed system protected by IT algorithms. Only the persons identified in section 8.1 have access rights.
If data provided by an applicant is recorded on paper, the Data Controller keeps it in an organised manner in a room in a building that can be securely locked, with access limited to the persons identified in section 8.1.
The Data Controller processes this data until the position has been filled, unless the applicant asks for their data to be retained in the Data Controller’s system for a longer period to facilitate applications for future vacancies. The Data Controller documents a review of the necessity of processing such data at least once every three years and retains the resulting review documentation for 10 years.
6.3.2. Data provided by an Employee and processed in connection with employment:
The primary purposes of processing data provided by an Employee are to conclude and perform the employment contract and to fulfil the Employer’s legal obligations relating to employment.
When establishing the employment relationship, the Data Controller obtains employment-related data from the Employee. During the employment relationship, it obtains such data from the Employee, its own organisation and the competent authorities.
This data is recorded in the Data Controller’s closed system protected by IT algorithms. Only the persons identified in section 8.1 have access rights.
In addition, data received on paper is kept in an organised manner in a room in a building that can be securely locked, with access limited to the persons identified in section 8.1.
The Data Controller processes data whose legal basis is solely the Employee’s consent until the purpose of the processing has been fulfilled. It documents a review of the necessity of processing at least once every three years and retains the resulting review documentation for 10 years.
The Data Controller processes or retains data whose processing is required or authorised by law for the period specified in the relevant legislation.
7. Data security – How does the Data Controller protect the data it processes?
7.1. The Data Controller stores the data specified in section 4 (hereinafter: “processed data”) in a closed system protected by IT algorithms and processes it using secure, closed software protected by IT algorithms.
The Data Controller keeps data held on paper in an organised manner in a room in a building that can be securely locked.
The Data Controller undertakes to take all necessary and reasonable steps to protect processed data, both during network communication and while it is stored and kept, against unauthorised access, alteration, transmission, disclosure, erasure or destruction, as well as accidental destruction or damage and loss of access resulting from changes in the technology used.
8. Data Controllers and Data Processors – Who processes data provided to Mozgásvilág Kft.?
8.1. Data Controller: Only Mozgásvilág Kft. and persons employed by it or engaged by it under another legal relationship involving work are authorised to process and access the data specified in section 4 (hereinafter collectively: the “Data Controller”). The Data Controller processes data for specified purposes and does not use it for purposes other than those set out in section 3.
8.2. Data Processor: The Data Controller engages Data Processors to fulfil certain obligations set out in legislation and contracts.
8.2.1. To fulfil its statutory bookkeeping obligations, the Data Controller engages the following accountant (hereinafter: the “Accountant”):
Name: Adóterv Kft.
Representative: Pauer Dóra
Address: 1035 Budapest, Vihar u. 2/b, ground floor
The Data Controller provides the Accountant only with data necessary to fulfil its bookkeeping obligations. The Accountant stores the data provided for the period required by the applicable legislation.
8.2.2. The Data Controller has entered into a contract with the following service provider for server hosting services (hereinafter: the “Server Hosting Provider”):
Name: Integrity Kft.
Contact person: dr. Kollár Ágnes
Address: 8000 Székesfehérvár, Gyetvai u. 6.
The Server Hosting Provider provides only server hosting services in relation to data processed by the Data Controller. It cannot access the data and does not perform any other data-processing operations on it.
The Server Hosting Provider carries out data-processing activities related to server hosting for as long as necessary to perform its contract with the Data Controller.
8.2.3. In connection with newsletter software and email server services, the Data Controller has entered into a contract with the following provider (hereinafter: the “Newsletter Provider”):
Name: MailerLite Ltd.
Address: 88 Harcourt Street, Dublin 2, Co. Dublin, Ireland, D02 DK18
Contact: info@mailerlite.com
Data entered through the newsletter subscription forms on the websites is transferred directly to the Newsletter Provider’s database. When any other feature that includes newsletter subscription is used, the Data Controller enters the data provided into the Newsletter Provider’s database.
The Newsletter Provider processes data only to the extent and in the manner necessary to provide newsletter software and email server services and does not carry out any other data-processing operations on it.
The Newsletter Provider carries out its data-processing activities for as long as necessary to perform its contract with the Data Controller.
9. Rights of Data Subjects, Non-Personal Data Data Subjects and Employees – What rights do you have in relation to data processing by the Data Controller and the Data Processor?
9.1. Right of access: The persons/organisations referred to above may request at any time that the Data Controller provide them with the data relating to them and information about its processing. They also have the right to receive the data they have provided to the Data Controller in a structured, commonly used and machine-readable format and to have that data transmitted by the Data Controller to another Data Controller, provided that this does not prevent the Data Controller from achieving the purpose of the processing.
9.2. Right to rectification: The persons/organisations referred to above may request at any time that the Data Controller rectify or supplement data relating to them.
9.3. Right to restriction and erasure: The persons/organisations referred to above may request at any time the restriction of processing of data relating to them or the erasure of such data, except for data subject to mandatory processing.
9.4. The Data Controller must fulfil the requests described above as soon as possible after they are submitted, but no later than 25 days after receipt, or inform the persons/organisations concerned of the refusal, the reasons for it and the available remedies.
9.5. If the rights described above are infringed, Data Subjects in relation to Personal Data and Employees in relation to their Personal Data may contact:
- The Hungarian National Authority for Data Protection and Freedom of Information (1125 Budapest, Szilágyi Erzsébet fasor 22/C);
- The court with jurisdiction based on their place of residence or stay.
9.6. The Data Subject in relation to Non-Personal Data and the Data Controller will first seek to resolve any data-processing dispute between them by mutual agreement. If this is unsuccessful, the Data Subject in relation to Non-Personal Data may bring the matter before a court in accordance with the general rules set out in the Act on Civil Procedure.
10. Miscellaneous and final provisions
10.1. The Data Controller may unilaterally amend this Notice after notifying Visitors, Clients and Employees in advance. If a material amendment is made, the Data Controller must obtain consent again where necessary to ensure that the processing remains lawful. The Data Controller publishes the Notice currently in force on its website.
10.2. Visitors, Clients and Employees may not provide the Data Controller with data that infringes the rights or legitimate interests of a third party and/or the Data Controller.
10.3. If a Visitor, Client or Employee unlawfully provides data relating to a third party, the Data Controller may treat that person’s legal declaration as invalid and delete the data provided and their newsletter subscription.
10.4. This Notice consists of 25 numbered pages and has been adopted by Mozgásvilág Kft. as its fundamental data-protection document.
Advertisements are served through the AdGlare Ad Server. AdGlare’s Privacy Policy is available here: [Privacy Policy](https://www.adglare.com/privacy).
