Privacy Policy

FOBER.HU PRIVACY NOTICE

FŐBER Nemzetközi Ingatlanfejlesztő és Mérnöki Zrt.
(FŐBER International Real Estate and Engineering Company Limited)

Introduction

FŐBER Nemzetközi Ingatlanfejlesztő és Mérnöki Zrt. (1138 Budapest, Faludi utca 3., tax number: 12037984-2-41, company registration number: 0110042812) (hereinafter: Service Provider, controller) carries out the processing operations described in this notice as set out below.

We provide the following information in accordance with REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

This privacy notice governs the processing of personal data on the following pages/mobile applications: https://fober.hu/en/contact/

The privacy notice is available at the following page: https://fober.hu/en/privacy-policy/

Amendments to this notice take effect upon publication at the above address.

The controller and its contact details

Name: FŐBER Nemzetközi Ingatlanfejlesztő és Mérnöki Zrt.

Registered office: 1138 Budapest, Faludi utca 3.

E-mail: babay.viktoria@fober.hu

Phone: 06302610377

Definitions

1. „personal data”: any information relating to an identified or identifiable natural person („data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
2. „processing”: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
3. „controller”: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;
4. „processor”: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
5. „recipient”: a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;
6. „consent” of the data subject: any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
7. „personal data breach”: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.
8. „profiling”: any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
9. „third party”: a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

Principles relating to processing of personal data

Personal data shall be:

1. processed lawfully, fairly and in a transparent manner in relation to the data subject („lawfulness, fairness and transparency”);
2. collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes („purpose limitation”);
3. adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed („data minimisation”);
4. accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay („accuracy”);
5. kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject („storage limitation”);
6. processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures („integrity and confidentiality”).

The controller shall be responsible for, and be able to demonstrate compliance with, the above („accountability”).

The controller declares that its processing operations are carried out in accordance with the principles set out in this section.

Contact

The fact of data collection, the scope of the data processed and the purpose of the processing:

The e-mail address is not required to contain personal data.

2. Scope of data subjects: All data subjects sending a message through the contact form.

3. Duration of the processing, deadline for erasure: The controller processes the personal data until the purpose of the processing is achieved, but for a maximum of 2 years. If any of the conditions set out in Article 17(1) GDPR applies, the processing lasts until the data subject’s request for erasure.

4. Description of the data subjects’ rights relating to the processing:

• The data subject may request from the controller access to, rectification or erasure of, or restriction of the processing of, personal data concerning him or her, and
• the data subject has the right to data portability and to withdraw consent at any time.

5. The data subject may initiate access to, erasure or rectification of, or restriction of the processing of, personal data, as well as data portability, in the following ways:

• by post at 1138 Budapest, Faludi utca 3.,
• by e-mail at babay.viktoria@fober.hu,
• by phone at 06302610377.

6. Legal basis of the processing: the consent of the data subject, Article 6(1)(a). If you contact us, you consent to our processing of the personal data provided to us during the contact (name, phone number, e-mail address) in accordance with this notice.

7. Please note that

• this processing is based on your consent and is necessary for providing an offer.
• you are required to provide the personal data in order to be able to contact us.
• failure to provide the data results in your being unable to contact the controller.
• the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Customer relations

1. The fact of data collection, the scope of the data processed and the purpose of the processing:

2. Scope of data subjects: All data subjects who keep contact with the controller by phone/e-mail/in person, or who are in a contractual relationship with the controller.

3. Duration of the processing, deadline for erasure: Letters containing enquiries are processed until the data subject’s request for erasure, but for a maximum of 2 years.

4. Possible controllers entitled to access the data, recipients of the personal data: The personal data may be processed by the controller’s duly authorised staff, observing the principles set out above.

5. Description of the data subjects’ rights relating to the processing:

• The data subject may request from the controller access to, rectification or erasure of, or restriction of the processing of, personal data concerning him or her, and
• the data subject has the right to data portability and to withdraw consent at any time.

6. The data subject may initiate access to, erasure or rectification of, or restriction of the processing of, personal data, as well as data portability, in the following ways:

• by post at 1138 Budapest, Faludi utca 3.,
• by e-mail at babay.viktoria@fober.hu,
• by phone at 06302610377.

7. Please note that

• the processing is necessary for the performance of a contract and for providing an offer.
• you are required to provide the personal data so that we can perform the contract / fulfil your other request.
• failure to provide the data results in our being unable to perform the contract / process your request.

Use of Google Ads conversion tracking

1. The controller uses the online advertising programme called „Google Ads” and, within its framework, uses Google’s conversion tracking service. Google conversion tracking is an analytics service of Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; „Google”).
2. When a User reaches a website via a Google advertisement, a cookie required for conversion tracking is placed on their computer. These cookies have a limited validity and contain no personal data, so the User cannot be identified by them.
3. When the User browses certain pages of the website and the cookie has not yet expired, both Google and the controller can see that the User clicked on the advertisement.
4. Every Google Ads customer receives a different cookie, so cookies cannot be tracked across the websites of Ads customers.
5. The information obtained by means of the conversion tracking cookies serves to produce conversion statistics for those Ads customers who have opted for conversion tracking. Customers thus learn the number of users who clicked on their advertisement and were forwarded to a page bearing a conversion tracking tag. However, they do not obtain any information by which any user could be identified.
6. If you do not wish to take part in conversion tracking, you may refuse it by disabling the installation of cookies in your browser. You will then not appear in the conversion tracking statistics.
7. Under Google Consent Mode v2, Google also uses two new cookie types: ad_user_data and ad_personalization, which are based on the data subject’s consent and relate to the use and sharing of data. ad_user_data serves to grant consent to sending user data to Google for advertising purposes. ad_personalization governs whether the data may be used for personalising advertisements (e.g. remarketing). The controller ensures, through its cookie banner/panel, that the appropriate consents are obtained and may be withdrawn. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
8. Further information and Google’s privacy policy are available at the following page: https://policies.google.com/privacy

Use of Google Analytics

1. This website uses Google Analytics, a web analytics service of Google Inc. („Google”). Google Analytics uses so-called „cookies”, text files stored on your computer, which help analyse the User’s use of the website visited.
2. The information created by the cookies relating to the website used by the User is usually transmitted to and stored on one of Google’s servers in the USA. By activating IP anonymisation on the website, Google truncates the User’s IP address beforehand within the Member States of the European Union or in other states party to the Agreement on the European Economic Area.
3. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to evaluate how the User used the website, to compile reports on website activity for the website operator, and to provide further services relating to website and internet use.
4. Within the framework of Google Analytics, the IP address transmitted by the User’s browser is not combined with other Google data. The User may prevent the storage of cookies by setting their browser accordingly; however, please note that in this case not all functions of this website may be fully usable. You may also prevent Google from collecting and processing the data generated by the cookies relating to your use of the website (including your IP address) by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en

Management of cookies

1. No prior consent is required from data subjects for the use of so-called „cookies used for a password-protected session”, „cookies necessary for a shopping basket”, „security cookies”, „strictly necessary cookies” and „functional cookies”.

2. The fact of the processing, the scope of the data processed: Unique identification number, dates, times.

3. Scope of data subjects: All data subjects visiting the website.

4. Purpose of the processing: Identification of users, tracking of visitors, ensuring customised operation.

5. Duration of the processing, deadline for erasure:

6. Description of the data subjects’ rights relating to the processing: Data subjects have the option to delete cookies in the Tools/Settings menu of their browser, generally under the settings of the Privacy menu item.

7. Most browsers used by our users allow you to set which cookies should be stored and allow (specific) cookies to be deleted again. If you restrict the storage of cookies on certain websites or do not allow third-party cookies, this may under certain circumstances lead to our website no longer being usable in full. Here you will find information on how to customise cookie settings in common browsers:

Google Chrome (https://support.google.com/chrome/answer/95647)

Microsoft Edge (https://support.microsoft.com/)

Firefox (https://support.mozilla.org/kb/enable-and-disable-cookies-website-preferences)

Safari (https://support.apple.com/guide/safari/sfri11471/mac)

The processors engaged

Hosting provider

1. Activity performed by the processor: Hosting service

2. Name and contact details of the processor:

Sybell Informatika Kft. 1138 Budapest, Tomori utca 34. 2nd floor, info@sybell.hu

3. The fact of the processing, the scope of the data processed: All personal data provided by the data subject.

4. Scope of data subjects: All data subjects using the website/mobile application.

5. Purpose of the processing: Making the website/mobile application available and ensuring its proper operation.

6. Duration of the processing, deadline for erasure: The processing lasts until the agreement between the controller and the hosting provider terminates, or until the data subject’s request for erasure addressed to the hosting provider.

7. Legal basis of the processing: Article 6(1)(c) and (f), and Section 13/A(3) of Act CVIII of 2001 on certain issues of electronic commerce services and information society services. The legitimate interest is the proper operation of the website and protection against attacks and fraud.

Other processors (if any)

Social media platforms

The controller is also present on social media platforms in order to present its services and to keep contact with interested parties and clients.

The scope of the data processed: Data publicly available on the data subject’s social media profile, in particular:

– name (user name)

– public profile picture

– content published by the data subject and interactions relating to the controller’s page (e.g. comment, message).

Scope of data subjects: Natural persons who follow the controller’s social media page, get in contact with it, or send a message through it.

Purpose of the processing:

– presentation of the controller’s activities and services,

– marketing and communication on social media platforms,

– keeping contact with interested parties and clients.

Legal basis of the processing: The data subject’s voluntary consent to the processing of their personal data on social media sites.

Duration of the processing: The processing lasts as long as the data subject’s interaction subsists, or until the content published by the data subject is deleted. The controller retains messages and communications for a maximum of 2 years.

Further controllers: Social media platforms process users’ data as controllers in their own right, in accordance with their own privacy policies.

Facebook / Meta joint controllership

The controller has a Facebook / Meta profile relating to its activities. The processing for statistical purposes carried out on the Facebook social media site is a joint processing operation of the Controller and Facebook Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, Ireland). Detailed information on the joint controllership arrangement is provided by the controller addendum of the Facebook Page Insights function. The addendum is available at the following link: https://www.facebook.com/legal/terms/page_controller_addendum

The Controller communicates by private message on the social media site only if you contact us there.

1. Categories of data subjects

• the data subject who has registered on the social media site and has „liked” the Controller’s profile page,
• the data subject who contacts the Controller by private message on the social media site.

2. Purpose of the processing

The purpose of the processing is to share and promote the controller’s activities and services on the Facebook social media site. The Controller may use the data provided by the data subject in a private message in order to reply to the message; otherwise the Controller does not collect data through social media sites and does not extract data from them.

3. Legal basis of the processing

The processing is based on Article 6(1)(a) GDPR; the legal basis of the processing is the data subject’s consent to the processing of their personal data on the Facebook social media site.

4. The scope of the data processed

• the data subject’s registered name,
• the data subject user’s public profile picture,
• other public data provided or shared by the data subject on the social media site.

5. Source of the personal data processed: The source of the data processed is the data subject.

6. Withdrawal of consent: You may withdraw your consent to the processing at any time and delete your post or comment. The processing takes place through social media sites operated by a third party. If you withdraw your consent, the Controller deletes the conversation conducted with you. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

The data subject may initiate access to, erasure or rectification of, or restriction of the processing of, personal data, as well as data portability, in the following ways:

• by post at 1138 Budapest, Faludi utca 3.,
• by e-mail at babay.viktoria@fober.hu,
• by phone at 06302610377.

7. Duration of the processing

• until the data subject withdraws consent,
• in the event of an exchange of messages, 2 years.

8. Transfer of personal data, its recipients and the categories of recipients: For the definition of recipient, see Article 4(9) GDPR. The Controller discloses the data subject’s personal data to state bodies and authorities – in particular courts, public prosecutors, investigating authorities and misdemeanour authorities, and the Hungarian National Authority for Data Protection and Freedom of Information – only in exceptional cases and on the basis of a statutory obligation.

9. Possible consequences of failure to provide the data

If the data are not provided, the data subject cannot obtain information about the Controller’s activities and services via the Facebook social media site, and cannot send a message to the Controller via Facebook Messenger.

10. Automated decision-making (including profiling): No automated decision-making, including profiling, takes place during the processing.

11. Joint controllership agreement concluded with Facebook Ireland Ltd.:

The Page Insights function displays aggregated data which makes it possible to understand how data subjects use the Facebook page. Facebook Ireland Limited („Facebook Ireland”) and the Controller are joint controllers with regard to the processing of insights data. The Page Insights addendum sets out Facebook’s responsibilities and the Controller’s responsibilities in relation to the processing of insights data. Facebook Ireland assumes primary responsibility under the GDPR for the processing of insights data, and undertakes to comply with all relevant obligations laid down in the GDPR in relation to the processing of insights data. Facebook Ireland also makes available to all data subjects an extract of the Page Insights addendum. The Controller ensures that it has an appropriate legal basis under the GDPR for the processing of insights data, identifies the controller of the page, and complies with all other applicable legal obligations. Facebook Ireland bears sole responsibility for the processing of personal data in connection with the Page Insights function, except for data falling within the scope of the Page Insights addendum. The Page Insights addendum does not grant the Controller the right to request the personal data of Facebook users which Facebook Ireland processes in connection with Facebook, including page insights data. The Controller may not act on behalf of Facebook Ireland, and may not provide replies, when handling data protection requests.

Customer relations and other processing operations

1. If a question arises during the use of the controller’s services, or if the data subject has a problem, they may contact the controller in the ways indicated on the website (phone, e-mail, social media sites, etc.).
2. The Controller erases incoming e-mails, messages, and data provided by phone, on Meta, etc., together with the enquirer’s name and e-mail address and any other voluntarily provided personal data, no later than 2 years after the data were provided.
3. Information on processing operations not listed in this notice is provided at the time the data are collected.
4. Upon an exceptional request from an authority, or where other bodies make a request on the basis of a statutory authorisation, the Service Provider is obliged to provide information, disclose and transfer data, and make documents available.
5. In such cases the Service Provider discloses personal data to the requesting party – provided that the party has specified the exact purpose and the scope of the data – only to the extent strictly necessary for achieving the purpose of the request.

Rights of the data subject

1. The right of access

You have the right to obtain confirmation from the controller as to whether or not personal data concerning you are being processed, and, where that is the case, you have the right to obtain access to the personal data and to the information listed in the Regulation.

2. The right to rectification

You have the right to obtain from the controller, without undue delay, the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

3. The right to erasure

You have the right to obtain from the controller the erasure of personal data concerning you without undue delay, and the controller has the obligation to erase personal data concerning you without undue delay where certain conditions are met.

4. The right to be forgotten

Where the controller has made the personal data public and is obliged to erase them, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you have requested the erasure of any links to, or copy or replication of, those personal data.

5. The right to restriction of processing

You have the right to obtain from the controller restriction of processing where one of the following applies:

• you contest the accuracy of the personal data, in which case the restriction relates to the period enabling the controller to verify the accuracy of the personal data;
• the processing is unlawful and you oppose the erasure of the data and request the restriction of their use instead;
• the controller no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims;
• you have objected to the processing; in this case the restriction relates to the period pending the verification of whether the legitimate grounds of the controller override your legitimate grounds.

6. The right to data portability

You have the right to receive the personal data concerning you, which you have provided to a controller, in a structured, commonly used and machine-readable format, and you have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided (...)

7. The right to object

In the case of processing based on legitimate interests or on the exercise of official authority as legal bases, you have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you (...), including profiling based on those provisions.

8. Objection in the case of direct marketing

Where personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such purposes, including profiling, to the extent that it is related to such direct marketing. Where you object to the processing of personal data for direct marketing purposes, the personal data may no longer be processed for such purposes.

9. Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which would produce legal effects concerning you or similarly significantly affect you.

The preceding paragraph does not apply if the decision:

• is necessary for entering into, or the performance of, a contract between you and the controller;
• is authorised by Union or Member State law applicable to the controller which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
• is based on your explicit consent.

Deadline for action

The controller informs you of the action taken on the above requests without undue delay, and in any event within 1 month of receipt of the request.

If necessary, this may be extended by 2 months. The controller informs you of any such extension of the deadline, together with the reasons for the delay, within 1 month of receipt of the request.

If the controller does not take action on your request, it informs you without delay, and at the latest within one month of receipt of the request, of the reasons for not taking action and of the fact that you may lodge a complaint with a supervisory authority and exercise your right to a judicial remedy.

Security of processing

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor implement appropriate technical and organisational measures in order to guarantee a level of data security appropriate to the level of the risk, including inter alia, as appropriate:

• the pseudonymisation and encryption of personal data;
• the ability to ensure the ongoing confidentiality, integrity, availability and resilience of the systems and services used for processing personal data;
• the ability to restore the availability of and access to personal data in a timely manner in the event of a physical or technical incident;
• a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures taken to guarantee the security of the processing.

1. The data processed must be stored in such a way that they cannot be accessed by unauthorised persons. In the case of paper-based data carriers, this is achieved by establishing the order of physical storage and filing; in the case of data processed in electronic form, by applying a central authorisation management system.
2. The method of storing data by IT means must be chosen so that their erasure – having regard also to possibly differing erasure deadlines – can be carried out upon expiry of the erasure deadline, or if this is necessary for other reasons. The erasure must be irreversible.
3. Paper-based data carriers must be stripped of personal data using a document shredder or by engaging an external organisation specialised in document destruction. In the case of electronic data carriers, physical destruction must be ensured in accordance with the rules applicable to the scrapping of electronic data carriers, and, where necessary, the data must first be securely and irreversibly erased.
4. The controller takes the following specific data security measures:

In order to ensure the security of personal data processed on paper, the Service Provider applies the following measures (physical protection):

• Documents are placed in a secure, properly lockable, dry room.
• Where personal data processed on paper are digitised, the rules applicable to digitally stored documents apply.
• A member of the Service Provider’s staff carrying out processing may leave the room in which processing takes place only after locking away the data carriers entrusted to them, or locking the room concerned.
• Personal data may be accessed only by authorised persons; third parties may not access them.
• The Service Provider’s building and premises are equipped with fire protection and property protection systems.

IT protection

• The computers and mobile devices (and other data carriers) used during the processing are the property of the Service Provider.
• The computer system used by the Service Provider which contains personal data is equipped with virus protection.
• In order to ensure the security of digitally stored data, the Service Provider applies backups and archiving.
• The central server may be accessed only with appropriate authorisation and only by designated persons.
• The data on the computers may be accessed only with a user name and password.

Communication of a personal data breach to the data subject

When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller informs the data subject without undue delay.

The information provided to the data subject shall describe in clear and plain language the nature of the personal data breach and shall communicate the name and contact details of the data protection officer or of the other contact point providing further information; it shall describe the likely consequences of the personal data breach; and it shall describe the measures taken or proposed to be taken by the controller to remedy the personal data breach, including, where appropriate, measures to mitigate its possible adverse consequences.

The data subject need not be informed if any of the following conditions are met:

• the controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the data affected by the personal data breach, in particular those measures – such as the use of encryption – which render the personal data unintelligible to persons who are not authorised to access them;
• following the personal data breach, the controller has taken further measures which ensure that the high risk to the rights and freedoms of the data subject is no longer likely to materialise;
• the provision of information would require disproportionate effort. In such cases, data subjects must be informed by means of publicly disclosed information, or a similar measure must be taken which ensures that data subjects are informed in an equally effective manner.

If the controller has not yet notified the data subject of the personal data breach, the supervisory authority, having considered whether the personal data breach is likely to result in a high risk, may order the data subject to be informed.

Notification of a personal data breach to the authority

The controller shall notify the personal data breach to the supervisory authority competent under Article 55 without undue delay and, where possible, not later than 72 hours after having become aware of it, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification is not made within 72 hours, it shall be accompanied by the reasons justifying the delay.

Review in the case of mandatory processing

Where the duration of mandatory processing, or the periodic review of its necessity, is not determined by an act, a decree of a local government, or a binding legal act of the European Union, the controller shall review, at least every three years from the start of the processing, whether the processing of personal data by the controller, or by a processor acting on its behalf or under its instructions, is necessary for the achievement of the purpose of the processing.

The controller shall document the circumstances and outcome of this review, retain that documentation for ten years following the review, and make it available to the Hungarian National Authority for Data Protection and Freedom of Information (hereinafter: the Authority) upon the Authority’s request.

Right to lodge a complaint

A complaint against a possible infringement by the controller may be lodged with the Hungarian National Authority for Data Protection and Freedom of Information:

Nemzeti Adatvédelmi és Információszabadság Hatóság
(Hungarian National Authority for Data Protection and Freedom of Information)
1055 Budapest, Falk Miksa utca 9-11.
Postal address: 1363 Budapest, Pf. 9.
Phone: +36-1-391-1400
Fax: +36-1-391-1410
E-mail: ugyfelszolgalat@naih.hu

Closing remarks

In preparing this notice we had regard to the following legislation and recommendations:

• REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (GDPR) (27 April 2016);
• Act CVIII of 2001 on certain issues of electronic commerce services and information society services (in particular Section 13/A);
• Act XLVII of 2008 on the prohibition of unfair commercial practices against consumers;
• Act XLVIII of 2008 on the basic conditions of and certain limitations on economic advertising activity (in particular Section 6);
• Act XC of 2005 on the freedom of electronic information;
• Act C of 2003 on electronic communications (specifically Section 155);
• Opinion 16/2011 on the EASA/IAB Best Practice Recommendation on Online Behavioural Advertising;
• Recommendation of the Hungarian National Authority for Data Protection and Freedom of Information on the data protection requirements of prior information.

This is a courtesy translation of the Hungarian privacy notice, provided for information purposes only. In the event of any discrepancy between the English and the Hungarian version, the Hungarian version prevails. The authoritative Hungarian text is available at https://fober.hu/adatkezelesi-tajekoztato/.