1. Purpose and scope of this notice
2001 volt Bt. (hereinafter: the Controller or the Service Provider) processes personal data in the course of operating the ledekura.com website (hereinafter: the Website) and in the course of its business activity. The purpose of this notice is to provide data subjects, before processing begins, with clear and plain information on what personal data the Controller processes, for what purpose, on what legal basis and for how long, and on the rights available to data subjects.
This notice is based on the following legislation:
- Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (hereinafter: GDPR), in particular Articles 13 and 14 thereof,
- Act CXII of 2011 on the right to informational self-determination and freedom of information (the Hungarian Information Act),
- Act CVIII of 2001 on certain issues of electronic commerce services and information society services (the Hungarian E-Commerce Act),
- Act XLVIII of 2008 on the basic requirements and certain restrictions of commercial advertising activity (the Hungarian Advertising Act),
- Act C of 2000 on accounting,
- Act CL of 2017 on the rules of taxation.
Chapter 5 of this notice describes the processing operations connected with the current operation of the Website. Chapter 6 describes the processing operations connected with the planned webshop, which will apply only from the opening of the webshop, that is from the date it actually goes into service.
2. The Controller and its contact details
| Item | Data |
|---|---|
| Name of the Controller | 2001 volt Bt. |
| Brand name used | Ledekura |
| Registered seat and mailing address | Ezredév u. 19., 7400 Kaposvár, Hungary |
| Company registration number | 14-06-304565 |
| Court of registration | Company Registry Court of the Kaposvár Regional Court |
| Tax number | 20183286-2-14 |
| EU VAT number | HU20183286 |
| ledekura@ledekura.com | |
| Phone | +36 30 182 7953 |
| Website | https://ledekura.com |
| Contact person for data protection matters | Péter Szücs |
The Controller is not required to designate a data protection officer under Article 37 of the GDPR and has not designated one.
[PLACEHOLDER: to be verified that the Controller’s activity does not in fact fall within the mandatory cases listed in Article 37 (1) of the GDPR. If the service provider later designates a data protection officer, the contact details must be stated here.]
3. Definitions
Personal data: any information relating to an identified or identifiable natural person.
Data subject: the natural person whose personal data are processed by the Controller.
Processing: any operation performed on personal data, in particular collection, recording, organisation, storage, use, transfer and erasure.
Controller: the party which determines the purposes and means of the processing of personal data.
Processor: the party which processes personal data on behalf of and on the instructions of the Controller.
Recipient: a natural or legal person to which personal data are disclosed.
Consent: a freely given, specific, informed and unambiguous indication of the data subject’s wishes.
4. Principles of processing
The Controller processes personal data lawfully, fairly and in a transparent manner. Data are collected only for specified, explicit and legitimate purposes and are not further processed in a manner incompatible with those purposes. The Controller processes only data that are necessary to achieve the purposes, ensures their accuracy, and stores them only for as long as necessary. The Controller ensures the security of the data by appropriate technical and organisational measures.
The Controller does not request and does not process special categories of personal data within the meaning of Article 9 of the GDPR.
5. Processing operations connected with the operation of the Website
5.1. Contact form
| Item | Content |
|---|---|
| Purpose of processing | answering the data subject’s enquiry, keeping in contact |
| Categories of data | name, e-mail address, phone number (if provided), the text of the enquiry, the time of submission |
| Legal basis | consent of the data subject under Article 6 (1) point a) of the GDPR; where the enquiry is aimed at concluding a contract, steps prior to entering into a contract under Article 6 (1) point b) of the GDPR |
| Duration of processing | 1 year from answering the enquiry, or until consent is withdrawn |
| Nature of the data provision | providing the data is voluntary, however the enquiry cannot be answered without a name and an e-mail address |
5.2. Quotation request form
| Item | Content |
|---|---|
| Purpose of processing | preparing an individual quotation, technical consultation, preparing the contract |
| Categories of data | name, e-mail address, phone number, the name and seat of the represented organisation (if provided), project description, technical parameters of the requested display, installation site, time of submission |
| Legal basis | steps prior to entering into a contract under Article 6 (1) point b) of the GDPR; where a natural person acts as the representative of an organisation, legitimate interest under Article 6 (1) point f) of the GDPR, namely the Controller’s interest in maintaining business contact |
| Duration of processing | 1 year following the expiry of the validity of the quotation; where a contract is concluded, as set out in point 5.4. |
| Nature of the data provision | providing the data is voluntary, however no quotation can be given without the indicated data |
5.3. Enquiries by e-mail and telephone
| Item | Content |
|---|---|
| Purpose of processing | answering the enquiry, keeping in contact, preparing a quotation |
| Categories of data | name, e-mail address, phone number, content of the enquiry |
| Legal basis | Article 6 (1) point b) or f) of the GDPR, as set out in point 5.2. |
| Duration of processing | 1 year from the closure of the enquiry |
The Controller does not record telephone conversations.
[PLACEHOLDER: to be confirmed that the service provider does not in fact record telephone conversations. If it does, a separate processing entry must be added and information must be given at the beginning of the call.]
5.4. Contractual partners and their contact persons
| Item | Content |
|---|---|
| Purpose of processing | concluding and performing the contract, evidencing performance, keeping in contact, enforcing claims |
| Categories of data | name, position, e-mail address and phone number of the partner’s representative and contact persons; where the partner is a sole trader or natural person, their name, address, tax identification data and bank account number |
| Legal basis | where the partner is a natural person, Article 6 (1) point b) of the GDPR; where the contact person acts for an organisation, legitimate interest under Article 6 (1) point f) of the GDPR, namely the interest in the undisturbed performance of the contract |
| Duration of processing | 5 years from the termination of the contract, being the general limitation period under Act V of 2013 on the Civil Code |
5.5. Invoicing and accounting retention
| Item | Content |
|---|---|
| Purpose of processing | issuing invoices as required by law, retaining accounting vouchers |
| Categories of data | name, billing address, tax number or tax identification code, performance data, amount paid |
| Legal basis | compliance with a legal obligation under Article 6 (1) point c) of the GDPR, on the basis of Section 169 (2) of the Hungarian Accounting Act and the rules of taxation |
| Duration of processing | 8 years from the issuance of the voucher |
As this processing is based on a legal obligation, the data subject cannot request the erasure of data appearing on accounting vouchers during the retention period.
5.6. Cookies and technical data necessary for the operation of the Website
The Controller uses cookies on the Website. Cookies are small data files stored by the browser on the data subject’s device.
Cookies necessary for operation. These cookies are necessary for the basic functioning of the Website, including secure browsing and remembering the cookie consent decision. Legal basis: Section 13/A (3) of the Hungarian E-Commerce Act and legitimate interest under Article 6 (1) point f) of the GDPR, namely ensuring the operability and security of the Website. These cookies cannot be disabled without impairing the operation of the Website.
Statistical and performance cookies. These cookies serve the aggregated analysis of visitor behaviour. Legal basis: consent of the data subject under Article 6 (1) point a) of the GDPR. These cookies are placed only where consent has been given on the cookie management interface.
Marketing and tracking cookies. The Controller does not currently use such cookies.
| Item | Content |
|---|---|
| Categories of data | IP address, type of browser and operating system, pages viewed, time and duration of the visit, referring page |
| Duration of processing | according to the expiry time of each cookie, at most [PLACEHOLDER: the longest expiry time configured] |
| Withdrawal of consent | on the cookie management interface of the Website, or by deleting cookies in the browser settings |
PLACEHOLDER, TO BE COMPLETED BEFORE GO LIVE
The actual cookie list can be compiled on the basis of the finished website. The table will state the name of the cookie, the issuer, its purpose, its type and its expiry time. It must also be recorded whether the Website uses Google Analytics or another statistical tool, and if so which version and with what settings.
5.7. Technical operation of the Website, server logs
| Item | Content |
|---|---|
| Purpose of processing | operating the Website, ensuring availability, detecting abuse and attacks, troubleshooting |
| Categories of data | IP address, time of the request, resource requested, response status code, browser identifier |
| Legal basis | legitimate interest under Article 6 (1) point f) of the GDPR, namely the secure and undisturbed operation of the system |
| Duration of processing | [PLACEHOLDER: the log retention period configured at the hosting provider] |
5.8. Newsletter
At the time this notice enters into force the Controller does not send newsletters and does not offer newsletter subscription on the Website.
PLACEHOLDER
If the Controller launches a newsletter, this point must be supplemented and the notice must be updated with the following: purpose (sending a newsletter containing commercial advertising), categories of data (name, e-mail address, time and IP address of the subscription), legal basis (prior express consent under Section 6 of the Hungarian Advertising Act and Article 6 (1) point a) of the GDPR), duration (until consent is withdrawn), the method of unsubscribing, and the operator of the newsletter system as a processor. Newsletter subscription may not be tied to placing an order and the checkbox may not be pre-ticked.
6. Processing operations connected with the operation of the webshop
The processing operations described in this chapter apply only from the opening of the webshop, that is from the date it actually goes into service. The webshop runs on WooCommerce.
6.1. Customer account and guest purchase
PLACEHOLDER, REQUIRES A CLIENT DECISION
It is to be clarified whether the webshop will offer registration and a customer account, or guest purchase only. According to the guidance of the Hungarian data protection authority, the provision of a service may not be made conditional on providing more data than is technically necessary, therefore offering guest purchase is recommended. Once the decision is made, this point must be completed with the categories of data processed for creating an account, the legal basis (consent or performance of a contract), the method of deleting the account and the retention period.
6.2. Performance of the order
| Item | Content |
|---|---|
| Purpose of processing | receiving and confirming the order, performing the contract, arranging delivery, keeping in contact with the customer, enforcing claims |
| Categories of data | name, e-mail address, phone number, billing name and address, delivery name and address, products ordered and their quantity, order identifier and time, payment and delivery method, order value |
| Legal basis | performance of a contract under Article 6 (1) point b) of the GDPR |
| Duration of processing | 5 years from the performance of the contract, being the general limitation period under the Civil Code; for data appearing on accounting vouchers, the 8 years set out in point 5.5. |
| Nature of the data provision | providing the data is necessary for concluding the contract, without them the order cannot be performed |
6.3. Card payment, SimplePay
Card payment in the webshop is provided by the SimplePay service operated by OTP Mobil Kft. The data subject enters the card details directly on the SimplePay payment interface. The Controller does not gain access to and does not store such details.
| Item | Content |
|---|---|
| Purpose of processing | secure electronic settlement of the purchase price, identification of the transaction, prevention of fraud |
| Categories of data transferred | name, e-mail address, phone number, billing data, delivery data, order identifier and amount |
| Legal basis | performance of a contract under Article 6 (1) point b) of the GDPR |
| Recipient of the transfer | OTP Mobil Szolgáltató Kft. |
Data transfer statement. I acknowledge that the following personal data of mine stored in the user database of ledekura.com by the controller 2001 volt Bt. (Ezredév u. 19., 7400 Kaposvár, Hungary) will be transferred to OTP Mobil Kft. (Hungária krt. 17-19., 1143 Budapest, Hungary) as processor. The data transferred by the controller are the following: name, phone number, e-mail address, billing data, delivery data. The nature and purpose of the processing activity carried out by the processor can be viewed in the SimplePay privacy notice at the following link: https://simplepay.hu/adatkezelesi-tajekoztatok/
6.4. Delivery
Products that can be sent as parcels are delivered by GLS General Logistics Systems Hungary Kft.
| Item | Content |
|---|---|
| Purpose of processing | delivering the ordered product, arranging delivery, parcel tracking, and in the case of cash on delivery, collecting the purchase price |
| Categories of data transferred | name of the addressee, delivery address, phone number, e-mail address, parcel identifier and parcel data, and in the case of cash on delivery, the amount to be collected |
| Legal basis | performance of a contract under Article 6 (1) point b) of the GDPR |
| Recipient of the transfer | GLS General Logistics Systems Hungary Kft. |
In the case of large, palletised items, delivery takes place on the basis of individual consultation, using a carrier agreed by the parties. In such cases the Controller transfers to the carrier data corresponding to the categories set out above, together with data relating to the place of unloading.
[PLACEHOLDER: the name and company data of the carrier or carriers used for individual, palletised delivery, once the client provides them. If the carrier varies from case to case, this must be stated, and the specific carrier must be identified in the order confirmation.]
6.5. Invoicing
Invoices are issued in the Számlázz.hu system operated by KBOSS.hu Kft.
| Item | Content |
|---|---|
| Purpose of processing | issuing and delivering invoices as required by law |
| Categories of data transferred | name of the customer, billing address, tax number or tax identification code, e-mail address, invoice items and amount |
| Legal basis | compliance with a legal obligation under Article 6 (1) point c) of the GDPR |
| Duration of processing | the 8 years set out in point 5.5. |
6.6. Withdrawal, warranty and guarantee claims
| Item | Content |
|---|---|
| Purpose of processing | receiving and confirming the consumer’s withdrawal statement, refunding the purchase price, assessing warranty and guarantee claims, taking the required record |
| Categories of data | name, address, e-mail address, phone number, identification data of the contract and the product, date of performance and of the notification of the defect, description of the defect, the claim asserted, the bank account number given for the refund, the date and time of sending the withdrawal statement |
| Legal basis | compliance with a legal obligation under Article 6 (1) point c) of the GDPR, on the basis of Government Decree 45/2014. (II. 26.) on the detailed rules of contracts between consumers and businesses and Ministerial Decree 19/2014. (IV. 29.) NGM on the procedural rules for handling warranty and guarantee claims |
| Duration of processing | 3 years from the taking of the record, under Section 4 (6) of Ministerial Decree 19/2014. (IV. 29.) NGM; for financial vouchers connected with withdrawal, the 8 years set out in point 5.5. |
The Controller provides in the webshop the online withdrawal function required by Section 22 of Government Decree 45/2014. (II. 26.). When the function is used, the Controller records the content of the withdrawal and the date and time of its sending, and confirms this to the data subject on a durable medium.
6.7. Complaint handling
| Item | Content |
|---|---|
| Purpose of processing | investigating and answering a consumer complaint, taking a record of the complaint |
| Categories of data | name, address, e-mail address, phone number, content of the complaint, date and manner of the complaint, the Controller’s reply |
| Legal basis | compliance with a legal obligation under Article 6 (1) point c) of the GDPR, on the basis of Section 17/A of Act CLV of 1997 on consumer protection |
| Duration of processing | 3 years, being the retention period for the record of the complaint and the copy of the reply under Section 17/A (7) of Act CLV of 1997 on consumer protection. Where the Service Provider operates a telephone customer service within the meaning of the Hungarian consumer protection act, the retention period for the call recording is 5 years under Section 17/B (3) of that act |
[PLACEHOLDER: to be clarified whether the service provider operates a telephone customer service within the meaning of the Hungarian consumer protection act, in which case recording calls and retaining the recording for 5 years may be a statutory obligation. This question is to be decided together with the clarification of the complaint handling procedure.]
7. Processors and recipients
The Controller uses the processors listed below. Processors process personal data solely on the instructions of the Controller and do not use them for their own purposes.
| Processor | Activity | Categories of data |
|---|---|---|
| [PLACEHOLDER: name, seat, registration number and tax number of the hosting provider] | hosting, storage of the data of the Website and the webshop | all data processed on the Website and in the webshop |
| OTP Mobil Szolgáltató Kft. (Hungária krt. 17-19., 1143 Budapest, registration number: 01-09-174466, tax number: 24386106-2-42) | handling card payment in the SimplePay system, from the opening of the webshop | the data set out in point 6.3. |
| GLS General Logistics Systems Hungary Kft. (GLS Európa utca 2., 2351 Alsónémedi, tax number: 12369410-2-44) | parcel delivery, from the opening of the webshop | the data set out in point 6.4. |
| KBOSS.hu Kft. (Záhony utca 7., 1031 Budapest, registration number: 01-09-303201, tax number: 13421739-2-41) | invoicing service in the Számlázz.hu system | the data set out in point 6.5. |
| [PLACEHOLDER: name and seat of the bookkeeping service provider] | bookkeeping services | data appearing on accounting vouchers |
| [PLACEHOLDER: operator of the statistical tool, if the Website uses one] | preparing visitor statistics | the data set out in point 5.6. |
| [PLACEHOLDER: provider of the e-mail and mail system] | providing electronic mail | data contained in the correspondence |
| [PLACEHOLDER: the provider carrying out development and operational support of the website, typically Nordhanger, with company data] | development, maintenance, operational support | data stored in the system, on an ad hoc basis and to the technically necessary extent |
In addition, the Controller transfers personal data to acting authorities and courts where required by law, and to its legal representative for the purposes of enforcing claims or legal defence.
The Controller does not transfer personal data to third parties for marketing purposes and does not trade in such data.
8. Transfer of data to a third country
The Controller processes personal data within the territory of the European Economic Area and, at the time this notice enters into force, does not transfer data to a third country.
[PLACEHOLDER: to be verified whether the data held by the hosting provider, the mail system and the statistical and development support tools remain within the European Economic Area. If any provider transfers data to a third country, this must be stated here together with the safeguard under Articles 44 to 49 of the GDPR, in particular an adequacy decision or standard contractual clauses.]
The planned delivery of webshop orders abroad within the European Union does not constitute a transfer of data to a third country.
9. Data security
In order to ensure the security of personal data the Controller applies the following measures:
- the Website and the webshop are accessible over an encrypted HTTPS connection,
- access to the systems is protected by individual identifiers and passwords and is granted only to those who need it to perform their duties,
- regular software updates and backups,
- card details are not stored by the Controller, they are processed by the payment service provider,
- data processing agreements under Article 28 of the GDPR are concluded with processors.
[PLACEHOLDER: the frequency and retention period of backups, the use of two factor authentication and the rules of access management are to be specified on the basis of the operational practice of Nordhanger.]
10. Handling of personal data breaches
In the event of a personal data breach the Controller records the breach, assesses its impact and takes the necessary measures. Where the breach is likely to result in a risk to the rights and freedoms of natural persons, the Controller notifies it to the Hungarian National Authority for Data Protection and Freedom of Information within 72 hours of becoming aware of it, in accordance with Article 33 of the GDPR. Where the breach is likely to result in a high risk, the Controller also informs the data subjects without undue delay in accordance with Article 34 of the GDPR.
11. Automated decision making and profiling
The Controller does not apply decision making based solely on automated processing, or profiling, which would produce legal effects concerning the data subject or similarly significantly affect the data subject.
12. Rights of the data subject
The data subject may exercise the following rights.
| Right | Content | Legal basis |
|---|---|---|
| Right to information | information on the circumstances of the processing | Articles 13 and 14 of the GDPR |
| Right of access | information on whether the Controller processes data relating to the data subject, and a copy of the data | Article 15 of the GDPR |
| Right to rectification | correction of inaccurate data, completion of incomplete data | Article 16 of the GDPR |
| Right to erasure | erasure of the data where the purpose of the processing has ceased, consent has been withdrawn, or the processing is unlawful | Article 17 of the GDPR |
| Right to restriction of processing | suspension of the processing until the disputed issue is settled | Article 18 of the GDPR |
| Right to data portability | provision, in a machine readable format, of data processed by automated means on the basis of consent or a contract | Article 20 of the GDPR |
| Right to object | objection to processing based on legitimate interest | Article 21 of the GDPR |
| Right to withdraw consent | consent may be withdrawn at any time without restriction; withdrawal does not affect the lawfulness of processing carried out beforehand | Article 7 (3) of the GDPR |
The data subject may submit a request to the Controller at the e-mail address or postal address given in point 2. The Controller fulfils the request without undue delay and in any event within 1 month of its receipt. Under Article 12 (3) of the GDPR this period may be extended by a further 2 months having regard to the complexity of the request, and the Controller informs the data subject of the extension within 1 month of receipt of the request. The information is provided free of charge.
Before fulfilling a request the Controller may verify the identity of the data subject where, in the case of reasonable doubt, the requester cannot otherwise be identified.
13. Remedies
Complaint to the Controller. The data subject may address any comment or complaint relating to the processing directly to the Controller in the first instance, using the contact details given in point 2.
Complaint to the authority. Under Article 77 of the GDPR and the Hungarian Information Act the data subject may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information:
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Seat: Falk Miksa utca 9-11., 1055 Budapest, Hungary
Mailing address: 1363 Budapest, Pf.: 9., Hungary
Phone: +36 1 391 1400
E-mail: ugyfelszolgalat@naih.hu
Website: https://naih.hu
Judicial remedy. Under Article 79 of the GDPR and Section 23 of the Hungarian Information Act the data subject may bring proceedings before a court. At the data subject’s choice the action may also be brought before the regional court of the data subject’s place of residence or place of stay. Under Article 82 of the GDPR the data subject may also be entitled to compensation.
14. Personal data of children
The Controller’s services are addressed to business and professional users and to adult private individuals. The Controller does not knowingly collect personal data from persons under the age of 16. If the Controller becomes aware that it is processing the data of a person under the age of 16 without the consent of the legal representative, it erases such data without delay.
15. Amendment of this notice
The Controller is entitled to amend this notice unilaterally, in particular in the event of a change in legislation, a new service or the engagement of a new processor. The Controller publishes the amended notice on the Website. Upon the opening of the webshop the processing operations set out in Chapter 6 enter into force, of which the Controller will give notice on the Website.
Effective date of this notice: [PLACEHOLDER: date of go live].
Version number of this notice: [PLACEHOLDER: version number].
[Internal note for the client: this text is preparatory work by the web design service provider and does not constitute legal advice. Before go live the document must be reviewed and approved by the client’s legal counsel or data protection adviser, with particular regard to the list of processors, the retention periods and the cookie list. Responsibility for the content and legal compliance of the published text rests with the client, 2001 volt Bt.]