Legal Notice

Privacy Policy

Please note: this is a courtesy translation of our Hungarian privacy policy, provided for information only. In the event of any discrepancy, the Hungarian version shall prevail. Statutory references are to Hungarian law and to Regulation (EU) 2016/679 (GDPR).

In force from 17 March 2019 until revoked

The purpose of this Policy is to ensure that the data processing carried out by the Data Controller respects the privacy of natural persons and gives effect to the constitutional principles of data protection and to the requirements of data security.

It further serves to give Data Subjects advance information in connection with the processing of their personal data by the Data Controller, and to indicate where the detailed notices relating to that processing can be found.

Company name:	Pannon Lighting Kft
Company registration number:	01-09-988176
Registered office:	1222 Budapest, Hollandi u.13
Tax number:	23993015-2-43
Website:	pannonlighting.hu
E-mail:	info@pannonlighting.hu
Telephone:	+36305183412
Legal representative:	Tamás Fodor, Managing Director

Purposes, legal bases, data subjects and retention periods:

Process	Data subject	Data category	Personal data	Legal basis	Legislation	Retention period
Newsletter subscription / request for a quotation	Client, website visitor	Personal data	E-mail address, Name, Telephone number (landline or mobile)	The data subject has given consent	(EU) 2016/679 – Article 6(1)(a)	Until withdrawn by the data subject
General marketing communications	Client	Personal data	Permanent address, E-mail address, Name, Telephone number (landline or mobile)	The data subject has given consent	(EU) 2016/679 – Article 6(1)(a)	Until withdrawn by the data subject
General marketing communications	Website visitor	Personal data	E-mail address, Name, Telephone number (landline or mobile)	The data subject has given consent	(EU) 2016/679 – Article 6(1)(a)	Until withdrawn by the data subject
Electronic commerce	Client	Personal data	Permanent address, E-mail address, Name, Telephone number (landline or mobile)	The data subject has given consent	(EU) 2016/679 – Article 6(1)(a)	Until withdrawn by the data subject
Personalised marketing communications	Client	Personal data	Permanent address, E-mail address, Name, Telephone number (landline or mobile)	The data subject has given consent	(EU) 2016/679 – Article 6(1)(a)	Until withdrawn by the data subject

Voluntary consent

The Data Controller also processes the personal data of Data Subjects on the basis of voluntary consent. Such consent may be withdrawn at any time.

Amendment of this Privacy Policy

The General Privacy Policy is available at https://pannonlighting.hu/en/legal-notice.

The Data Controller reserves the right to amend this Privacy Policy unilaterally with future effect.

Definitions

Data Subject: any specified natural person identified, directly or indirectly identifiable, on the basis of personal data.

Consent: the voluntary and definite expression of the Data Subject's will, based on adequate information, by which they give their unambiguous agreement to the processing — whether in full or in respect of individual operations — of personal data relating to them.

Personal data: data that can be associated with the Data Subject — in particular their name, identification number, and information characteristic of one or more aspects of their physical, physiological, mental, economic, cultural or social identity — as well as any inference relating to the Data Subject that can be drawn from such data.

Data Controller: the natural or legal person, or organisation without legal personality, who or which, alone or jointly with others, determines the purpose of the processing of data, takes and implements decisions on the processing (including the means used), or has them implemented by a data processor.

Processing: irrespective of the procedure applied, any operation or set of operations performed on data, in particular their collection, capture, recording, organisation, storage, alteration, use, retrieval, transmission, disclosure, alignment or combination, blocking, erasure and destruction, as well as the prevention of further use of the data, the taking of photographs, audio or video recordings, and the recording of physical characteristics suitable for identifying a person (such as fingerprints or palm prints, DNA samples or iris images).

Transfer of data: making data accessible to a specified third party.

Data Processor: the natural or legal person, or organisation without legal personality, who or which processes personal data on behalf of the data controller.

Data processing (technical): the performance of technical tasks connected with processing operations, irrespective of the method and means applied and of the place of application.

Disclosure: making data accessible to anyone.

Erasure of data: rendering data unrecognisable in such a way that its restoration is no longer possible.

Automated processing: comprises the following operations where carried out in whole or in part by automated means: the storage of data, logical or arithmetical operations performed on data, and the alteration, erasure, retrieval and dissemination of data.

System: the totality of technical solutions operating the Data Controller's automated processing and — where applicable — the internet-accessible pages and services of its partners (hereinafter: the “System”).

Principles of processing

Personal data may only be obtained and processed fairly and lawfully.

Personal data may only be stored for specified and lawful purposes, and may not be used in a manner incompatible with those purposes.

The scope of the personal data processed must be proportionate to the purpose of their storage and must be adequate for that purpose, and must not go beyond it.

Appropriate security measures must be taken to protect personal data stored in automated data files against accidental or unlawful destruction or accidental loss, and against unauthorised access, alteration or dissemination.

Transfer of data

The Data Controller is entitled and obliged to transfer to the competent authorities any personal data available to it and lawfully stored by it where it is required to do so by law or by a final official decision, or where a criminal offence or infraction is suspected. The Data Controller cannot be held liable for such transfers or for their consequences.

Beyond the above, the Data Controller transfers data exclusively to its joint controllers and/or data processors with whom it has a contractual relationship, and among those exclusively to parties bound by contractual obligations in respect of the Data Subject. Accordingly, the Data Controller transfers data to third parties only for the purposes set out in this Policy and only to the extent necessary. Such transfers may not place the Data Subject in a position less favourable than the data processing and data security rules set out in the version of this Policy in force at the time.

Security of processing

In accordance with its obligations under Article 32 GDPR, the Data Controller does everything in its power to ensure the security of Data Subjects' data. It further takes the necessary technical and organisational measures and establishes the procedural rules required to give effect to the GDPR and to other data protection and confidentiality rules, taking into account the reasonable expectations of the Data Subject arising from their relationship with the controller, the state of the art, the costs of implementation, the risks involved and the nature of the personal data to be protected.

The Data Controller processes data both on paper and by automated means. Where processing is automated, any handling of data involving human intervention may take place only exceptionally and to the extent duly justified.

The Data Controller protects data in particular against unauthorised access, alteration, transmission, disclosure, erasure or destruction, and against accidental destruction and damage. Data recorded automatically and by technical means during the operation of the Data Controller's system(s) are stored from the moment they are generated for the period justified by the need to ensure the operation of the system. The Data Controller ensures that such automatically recorded data cannot be linked with other personal data, except in cases made mandatory by law.

Where such linking does occur, employees carrying out processing at the Data Controller's organisational units are obliged to keep the personal data they learn of as a business secret. To this end the Data Controller's staff are separately obliged to ensure, and do ensure in the course of their work, that unauthorised persons cannot gain sight of personal data. The storage and location of personal data have been arranged so that they are not accessible to, knowable by, alterable by or destructible by unauthorised persons.

The senior officer of the Data Controller holding decision-making competence at any given time determines, taking into account the characteristics of the Data Controller, the organisation of data protection and the duties and powers relating to data protection and related activities, and designates the person responsible for supervising the processing.

How data are obtained

The Data Controller obtains the data of Data Subjects covered by this Policy on the basis of their voluntary consent, through a legal representative or authorised agent or from public sources; in all other cases directly from the Data Subject, on the basis of an obligation necessary for the performance of a contract, a legal obligation or a legitimate interest.

The Data Subject is in every case responsible for the accuracy of the personal data provided. The Data Controller does not verify the personal data provided to it.

Unless they declare otherwise, the Data Subject has consented to the processing of the data indicated in this Policy in accordance with the Privacy Policy and this Policy.

In fulfilment of its obligation under Article 14(3) of Chapter III of the GDPR, where the Data Controller has not obtained the personal data from the Data Subject — in particular where they were provided by a registered user in respect of a Data Subject entitled to use the Service — the Data Controller informs the Data Subject, using the contact details known to it (where known, preferably by e-mail), without delay and at the latest within one month, of the following:

• the identity and contact details of the Data Controller and, where applicable, of its representative;
• the purposes of the intended processing of the personal data and the legal basis for the processing;
• the categories of personal data concerned;
• the recipients or categories of recipients of the personal data, if any;
• where applicable, the fact that the Data Controller intends to transfer the personal data to a recipient in a third country or to an international organisation, together with the existence or absence of an adequacy decision by the Commission, or in the case of a transfer referred to in Article 46, Article 47 or the second subparagraph of Article 49(1) GDPR, a reference to the appropriate and suitable safeguards and the means by which to obtain a copy of them or where they have been made available;
• the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
• where the processing is based on Article 6(1)(f) GDPR, the legitimate interests pursued by the controller or by a third party;
• the right of the Data Subject to request from the Data Controller access to, rectification or erasure of the personal data concerning them, or restriction of processing, and to object to the processing of personal data, as well as the Data Subject's right to data portability;
• where the processing is based on Article 6(1)(a) or Article 9(2)(a) GDPR, the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
• the right to lodge a complaint with a supervisory authority;
• the source of the personal data and, where applicable, whether the data came from publicly accessible sources;
• the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR, and at least in those cases meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the Data Subject.

Records of processing activities

The Data Controller and, where applicable, its representative maintain a record of the processing activities carried out under their responsibility. This record contains the following information:

• the name and contact details of the controller and of the data protection officer;
• the purposes of the processing;
• a description of the categories of data subjects and of the categories of personal data;
• the categories of recipients to whom the personal data are or will be disclosed, including recipients in third countries or international organisations;
• where applicable, information on transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1) GDPR, the documentation of suitable safeguards;
• where possible, the envisaged time limits for erasure of the different categories of data;
• where possible, a general description of the technical and organisational measures referred to in Article 32(1).

On request, the Data Controller makes the record available to the supervisory authority.

Data protection officer

Given that none of the mandatory cases set out in Article 37 GDPR applies — processing of special categories of data, regular and systematic monitoring of data subjects on a large scale, or the performance of a public task — no data protection officer has been appointed.

Rights of the Data Subject

Right to information

Before processing begins, the Data Subject must be informed clearly and in detail of all facts relating to the processing of their data.

The Data Subject may

• request information about the processing of their personal data,
• request the rectification of their personal data,
• request the erasure or restriction of their personal data,
• exercise their right to data portability,
• object to the processing of their personal data,
• withdraw the consent given to the processing,
• in the event of an infringement of their rights, turn to the Data Controller, to the data protection authority and to the courts.

Right of access

Upon a request submitted by the Data Subject, and provided that the information may not be withheld under the law, the Data Controller provides information concerning the Data Subject about

• the purpose of the processing,
• the legal basis of the processing,
• the categories of personal data concerned,
• the name and address of any data processors and their activities relating to the processing,
• the duration of the processing,
• the circumstances and effects of any personal data breach and the measures taken to address it,
• their right to request from the Data Controller the rectification or erasure of the personal data relating to them, or the restriction of processing, and to object to such processing,
• the right to lodge a complaint with a supervisory authority,
• where the personal data were not collected from the data subject, all available information about their source,
• the existence of automated decision-making, including profiling, and at least in those cases meaningful information about the logic involved, the significance of such processing and the consequences it has for the Data Subject,
• where applicable, the transfer of the Data Subject's personal data to a third country.

The Data Controller is obliged to provide this information in writing and in an intelligible form within the shortest possible time from the submission of the request, and in any event within thirty (30) days.

Right to rectification

At the Data Subject's request, the Data Controller is obliged to rectify inaccurate personal data relating to them that do not correspond to the facts. Taking into account the purposes of the processing, the Data Subject may request that incomplete personal data be completed, including by means of a supplementary statement. Until the data can be corrected or completed, the Data Controller restricts the processing of the personal data and temporarily suspends processing operations, with the exception of storage.

Right to erasure

The Data Subject has the right to obtain from the Data Controller the erasure of personal data concerning them without undue delay where

• the personal data are no longer necessary for the purposes for which they were collected or otherwise processed,
• the data subject withdraws consent and there is no other legal ground for the processing,
• the data subject objects to the processing of their personal data and the Data Controller has no overriding legitimate grounds for the processing, or the data subject objects to processing for direct marketing purposes,
• the personal data have been unlawfully processed,
• the personal data have to be erased for compliance with a legal obligation under Union or Member State law to which the Data Controller is subject,
• the personal data were collected in relation to the offer of information society services directly to children, in the absence of the consent of the holder of parental responsibility.

Where the Data Controller establishes that an obligation to erase the personal data it processes exists, it ceases the processing and destroys the personal data previously processed.

Where the Data Controller has made the personal data public and is obliged to erase them, it takes reasonable steps and technical measures, taking account of available technology and the cost of implementation, to inform controllers processing the personal data that the data subject has requested the erasure of any links to, or copy or replication of, those personal data.

The Data Controller may not erase personal data where the processing is necessary

• for exercising the right of freedom of expression and information,
• for compliance with an obligation under Union or Member State law or for the performance of a task carried out in the exercise of official authority,
• for reasons of public interest in the area of public health,
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, where erasure is likely to render impossible or seriously impair the achievement of that processing,
• for the establishment, exercise or defence of legal claims.

Right to restriction of processing

At the Data Subject's request, the Data Controller restricts the processing of personal data where

• the Data Subject contests the accuracy of the personal data,
• the processing is unlawful and the Data Subject opposes the erasure of the data and requests the restriction of their use instead,
• the Data Controller no longer needs the personal data, but the Data Subject requires them for the establishment, exercise or defence of legal claims,
• the Data Subject has objected to the processing and the Data Controller's examination is still pending.

Personal data subject to restriction may, with the exception of storage, be processed only in the following cases:

• with the data subject's consent,
• for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person,
• for reasons of important public interest of the Union or of a Member State.

The Data Controller is obliged to inform the data subject who requested the restriction before the restriction is lifted.

Right to data portability

Where the processing is based on consent, on the performance of a contract or on automated decision-making, the Data Subject has the right to

• receive the data they provided to the Data Controller in a structured, commonly used, machine-readable format,
• transmit those data to another controller,
• have the data transmitted directly to another controller, where technically feasible.

The Data Subject may not exercise the right to data portability where the processing is carried out in the public interest or in the exercise of official authority.

Right to object

The Data Subject has the right to object at any time to processing carried out by the Data Controller on the basis of legitimate interest and to processing related to profiling, in particular where the personal data are used for direct marketing, opinion polling or scientific research purposes.

The Data Controller examines the objection within thirty (30) days at the latest from the submission of the request and informs the Data Subject of its decision in writing. For the duration of the examination, but for no more than five (5) days, the Data Controller suspends the processing.

Where the Data Subject's objection is found to be justified, the Data Controller ceases the processing — including any further collection and transfer of data — blocks the data, and notifies of the objection and its consequences everyone to whom the data were transferred and who is obliged to act in order to give effect to the right to object.

Where the Data Subject does not agree with the Data Controller's decision, they are entitled to bring an action before the courts within thirty (30) days of the notification of the decision or of the last day of the time limit.

General notification obligation

The Data Controller communicates any rectification, erasure, objection or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The Data Controller informs the Data Subject about those recipients if the Data Subject requests it.

Remedies

For questions, comments, requests and complaints, and in order to enforce their rights, Data Subjects may turn to the Data Controller, primarily using the following contact details:

Pannon Lighting Kft
Telephone: +36305183412
E-mail: info@pannonlighting.hu

Hosting provider:

Gábor Polonkai, sole trader. Registered office: 3600 Ózd, Búzás völgy 11. Registration number: 11529671. Tax number: 64747000-1-25

Information on the use of cookies

The Data Controller uses cookies when you visit the website. A cookie is a package of information consisting of letters and numbers that our website sends to your browser in order to save certain settings, make the use of our website easier and help us collect some relevant statistical information about our visitors.

Some cookies contain no personal information and are not suitable for identifying the individual user; others, however, contain an individual identifier — a secret, randomly generated sequence of numbers — stored by your device, which also makes you identifiable. The operating period of each cookie is set out in the description of the cookie concerned.

Legal background and legal basis for cookies:

The legal basis for the processing is your consent under Article 6(1)(a) of the Regulation.

The main characteristics of the cookies used by the website:

• Cookie consent cookie: when you arrive at the site you accept the statement on the storage of cookies in the notification window. Lifetime: 365 days.
• Session cookies: these store the visitor's location, the browser language and the currency of payment; their lifetime is until the browser is closed, or a maximum of 2 hours.
• Referrer cookies: these record which external site the visitor arrived from. Their lifetime lasts until the browser is closed.
• Google Adwords cookie: when someone visits our site, the visitor's cookie identifier is added to the remarketing list. Google uses cookies — such as the NID and SID cookies — in Google products, for example to customise the ads shown in Google Search. It uses such cookies, for instance, to remember your most recent searches, your previous interactions with a given advertiser's ads or with search results, and your visits to advertisers' websites. The AdWords conversion tracking function uses cookies. To track sales and other conversions arising from an ad, it saves cookies to the user's computer when that person clicks on an ad. Some common uses of cookies are: selecting ads on the basis of what is relevant for the given user, improving reports on campaign performance, and avoiding showing ads the user has already seen.
• Google Analytics cookie: Google Analytics is Google's analytics tool, which helps website and application owners gain a more accurate picture of their visitors' activities. The service may use cookies to collect information and produce reports from statistical data on website use without individually identifying visitors to Google. The main cookie used by Google Analytics is the “__ga” cookie. In addition to reports produced from website usage statistics, Google Analytics — together with some of the advertising cookies described above — can also be used to display more relevant ads in Google products (such as Google Search) and across the internet. Google's privacy policy applies: https://support.google.com/analytics/answer/6004245?hl=en
• Remarketing cookies: these may be displayed to previous visitors or users when browsing other websites on the Google Display Network, or when searching for terms related to its products or services.
• Strictly necessary cookies: these cookies are indispensable to the use of the website and enable its basic functions. Without them, many functions of the site will not be available to you. The lifetime of this type of cookie is limited to the duration of the session.
• Facebook pixel (Facebook cookie): the Facebook pixel is a piece of code that allows reports on conversions to be produced on the website, audiences to be assembled, and the site owner to receive detailed analytical data on visitors' use of the site. With the Facebook pixel, personalised offers and ads can be displayed to website visitors on Facebook. Facebook's data policy can be found here: https://www.facebook.com/privacy/explanation

You can find more information about deleting cookies at the following links:

• Internet Explorer: https://support.microsoft.com/en-us/topic/delete-and-manage-cookies-168dab11-0753-043d-7c16-ede5947fc64d
• Microsoft Edge: https://support.microsoft.com/en-us/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09
• Firefox: https://support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox
• Safari: https://support.apple.com/en-gb/guide/safari/sfri11471/mac
• Chrome: https://support.google.com/chrome/answer/95647

Legal remedy:

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Registered office: 1125 Budapest, Szilágyi Erzsébet fasor 22/c.
Postal address: 1530 Budapest, PO Box 5.
Telephone: +36 1 391 1400
Fax: +36 1 391 1410
E-mail: ugyfelszolgalat@naih.hu
Website: http://www.naih.hu
Online submission: http://www.naih.hu/online-uegyinditas.html

Enforcement through the courts

In addition to an official remedy, you also have the option of bringing an action before the courts in respect of the Data Controller's activities. Proceedings are governed by the GDPR, by the Hungarian Information Act, and by the Hungarian Civil Code and Code of Civil Procedure. Such cases fall within the competence of the regional court (törvényszék). At the data subject's choice, proceedings may also be brought before the regional court of the data subject's place of residence (a list of the regional courts and their contact details is available at http://birosag.hu/torvenyszekek). For questions relating to bringing an action, please consult a lawyer.

I hereby accept this Policy and bring it into force.

Dated: Budapest, 17 March 2019

Pannon Lighting Kft.