Adatkezelési tájékoztató

PRIVACY NOTICE

SUPPLIERS

Kifli.hu Shop Kft. (registered seat: 1106 Budapest, Jászberényi út 45.; company registration number: 01-09-339560; hereinafter: the “Company”, “we” or the “Controller”), acting as data controller, hereby informs its contractual partners and prospective contractual partners, as well as the natural persons acting on their behalf or in their interest (hereinafter jointly: “you” or the “Data Subject”), about the processing and protection of personal data.

From this notice you can learn in particular:

· what personal data we process, for what purposes and on what legal basis;

· who may access the personal data and to whom we may transfer them;

· for how long we process and retain the personal data;

· how we process the personal data of third parties;

· what rules we apply in connection with our online services and the use of cookies; and

· what rights you have in relation to the processing of your personal data.

Contact: If you have any questions about this notice or about the processing of your personal data, you may contact us at info@kifli.hu or via the contact details of the data protection officer set out in Section 6.1 of this notice.

1. SCOPE, PURPOSE AND LEGAL BASIS OF THE PROCESSING OF PERSONAL DATA

1.1 Natural person business partners

If you are our business partner as a natural person, we process those personal data of yours that are necessary for the conclusion and performance of the contract, for contractual communication, and for the fulfilment of the legal obligations incumbent on the Controller. The data processed are in particular:

· first name and surname;

· contact address;

· business name or sole trader name;

· address of the registered seat or place of business;

· registration number, tax identification number or tax number;

· telephone number;

· email address;

· any other identification, contact or invoicing data necessary for the performance of the contract.

Purpose of the processing: the conclusion and performance of the contract, communication between the parties, certification of performance, invoicing, accounting, the fulfilment of tax and other legal obligations, and, where necessary, the establishment, exercise or defence of legal claims.

Legal basis of the processing: Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(c) GDPR (compliance with a legal obligation), in particular on the basis of the relevant provisions of Act CL of 2017 on the Rules of Taxation and Act C of 2000 on Accounting. Where legal claims are handled, the legal basis of the processing may also be the legitimate interest under Article 6(1)(f) GDPR.

Without providing the data necessary for the conclusion or performance of the contract, the conclusion or performance of the contract may become partly or entirely impossible.

1.2 Contact persons and representatives of legal person business partners

If our business partner is a legal person or an organisation without legal personality, we process those data of the contact persons, representatives and persons involved in the performance of the contract made available to us by you which are necessary for the contractual cooperation. These are in particular:

· first name and surname;

· job title, position or capacity of representation;

· telephone number;

· email address;

· any other data necessary for keeping in contact or for evidencing the right of representation.

Purpose of the processing: the preparation and performance of the contract, business communication, the exercise of the rights and obligations of the parties, and the documentation of performance.

Legal basis of the processing: the legitimate interest under Article 6(1)(f) GDPR. It is our legitimate interest and the legitimate interest of our contractual partner that efficient communication necessary for the performance of the contract is ensured. The relevant balancing test has been carried out.

1.3 Prospective business partners and pre-contractual contact

If you wish to become our business partner and provide data for this purpose – for example via an electronic form, by email, by telephone or in any other way – we process such data at your request for the purpose of preparing and concluding a future contract. The data processed are typically:

· the first name and surname of the contact person;

· address;

· company name;

· registered seat;

· company registration number, registration number and tax number;

· website;

· telephone number;

· email address;

· the comments, messages and other information provided by you.

Legal basis of the processing: Article 6(1)(b) GDPR, i.e. taking steps prior to the conclusion of a contract at the request of the data subject. If the contact is made on behalf of a legal person, the processing of the contact person's data may also be based on the legitimate interest under Article 6(1)(f) GDPR.

1.4 Handling of communication and enquiries

If you contact us with a question, request, complaint or other enquiry, we process the personal data provided in the enquiry, the content of the communication, and the related data necessary for responding to the enquiry.

Purpose of the processing: receiving, investigating, answering and documenting the enquiry.

Legal basis of the processing: depending on the subject matter of the enquiry, Article 6(1)(b), (c) or (f) GDPR. It is our legitimate interest to conduct our business communication and the handling of data subject requests in a documented and verifiable manner.

2. WHO MAY ACCESS YOUR PERSONAL DATA

Your personal data are processed primarily by Kifli.hu Shop Kft. as controller. The personal data may be accessed exclusively by those of our employees, executive officers, agents and cooperating persons for whom this is necessary in order to perform their duties and who are subject to appropriate confidentiality, data security and access management obligations.

We may also transfer the personal data, to the extent necessary and where an appropriate legal basis exists, to processors or other controllers. Such recipients may include in particular:

· providers of bookkeeping, accounting, tax and audit services;

· legal advisers, law firms, debt collectors and insurers;

· providers of IT, system operation, development, hosting, server, web and cloud services;

· providers of communication, electronic messaging, customer relationship and document management services;

· marketing and web analytics service providers, provided that an appropriate legal basis exists for the given processing;

· authorities, courts or other public bodies, where the transfer is required by law or is necessary for the enforcement of a legal claim;

· companies belonging to the Rohlik Group, solely to the extent necessary for the preparation or performance of the contract, the performance of group-level or central administrative tasks, the provision of IT support, or compliance with legal or regulatory obligations. Intra-group transfers always take place on an appropriate legal basis, to the extent necessary for the purpose, and with safeguards compliant with the applicable data protection legislation.

Our processors may act exclusively on the basis of our documented instructions and in accordance with the applicable data protection rules. Where a recipient acts as an independent controller, it is solely liable for its own processing activities.

If we transfer personal data to a country outside the European Economic Area or to an international organisation, we ensure the appropriate safeguards required by Chapter V of the GDPR, relying in particular on an adequacy decision, standard data protection clauses or another lawful transfer mechanism. We will provide further information about the safeguards applied upon request.

3. DURATION OF THE PROCESSING OF PERSONAL DATA

We process your personal data only for as long as is necessary to achieve the purpose of the processing, or for as long as required by law or justified by our legitimate interest. Individual documents or data categories may be subject to different retention periods; in such cases the longer, lawfully applicable retention period prevails.

3.1 Contract concluded with a natural person

We process the personal data for the duration of the contract. After the termination of the contract, we retain the data only for as long as justified by the fulfilment of our legal obligations, verifiability, or the establishment, exercise or defence of legal claims.

· data relating to tax obligations: as a general rule for the tax limitation period, typically 5 years;

· accounting documents and the data underlying them: 8 years pursuant to Act C of 2000 on Accounting;

· data relating to civil law claims: as a general rule the general limitation period of 5 years;

· in the event of a pending legal dispute, authority or court proceedings: until the final or binding conclusion of the proceedings, or for the period necessary for the enforcement of the claim.

3.2 Contact persons of legal person contractual partners

We process the data of contact persons for 12 months following the termination of the contract, or for 12 months following a change in the person of the contact person or the cessation of their capacity as contact person. If the data form part of the accounting, tax, evidentiary or legal documentation relating to the given contract, the relevant longer retention period applies. In the event of a legal dispute, the processing may continue until the final conclusion of the case.

3.3 Contract negotiations

If a contract is concluded as a result of the negotiations, we process the data in accordance with the retention rules applicable to that contract. If no contract is concluded, we retain the data processed during the negotiations for 6 months from the conclusion of the negotiations. If a legal dispute or authority proceedings commence, the retention period may be extended until the final conclusion of the case.

3.4 Enquiries and data subject requests

We retain the data relating to enquiries and data subject requests, as a general rule, for 5 years following the closure of the enquiry, where this is necessary for the purposes of responding, accountability, compliance with a legal obligation or the handling of legal claims. If the request relates to another processing purpose, the longer retention period applicable to that purpose applies.

4. PROCESSING OF THE PERSONAL DATA OF THIRD PARTIES

During the preparation or performance of the contract, we may become aware of the personal data of the employees, contact persons, subcontractors, clients or other contributing persons of our contractual partners. Such data may include in particular the name, email address, telephone number, job title, position, capacity of representation, and other information necessary for the performance of the contract.

We use these data for the purposes of preparing and performing the contract, coordinating the cooperation, keeping in contact, certifying performance and, where necessary, handling legal claims.

Legal basis of the processing: the legitimate interest under Article 6(1)(f) GDPR. It is our legitimate interest and the legitimate interest of our contractual partner that we are able to keep in contact with the persons necessary for the performance of the contract and that we process only the data necessary for such performance. The relevant balancing test has been carried out.

The source of the data is typically the data subject, the data subject's employer or principal, or the relevant contractual partner. We process the data of third parties for the duration of the contractual relationship and thereafter for the applicable statutory and claim enforcement periods. In the event of a legal dispute or authority proceedings, the processing may continue until the final conclusion of the case.

The personal data of third parties may be accessed by the group of recipients specified in Section 2 of this notice, solely to the necessary and lawful extent.

5. USE OF THE WEBSITE AND COOKIES

If, in the course of the supplier relationship, you use the Company's website, supplier portal or other electronic interface, detailed information on the cookies and similar technologies applied on that interface is contained in the website privacy notice or cookie notice available on the given website or electronic interface.

We use non-essential cookies exclusively on the basis of an appropriate legal basis under the applicable legislation, in particular your prior consent. Cookie settings can be managed in the cookie banner displayed on the given interface, and consent may be modified or withdrawn at any time.

6. YOUR RIGHTS AND FINAL PROVISIONS

6.1 Contact details of the data protection officer

You may contact our data protection officer with any questions or comments regarding the processing of personal data and in connection with exercising your data subject rights:

Data protection officer

ASC Vezetői és Informatikai Tanácsadó Kft.

Contact person

Tamás Lengré

Email

dpo@kifli.hu

Telephone

+36 30 303 6764

6.2 Data subject rights

In connection with the processing of personal data – depending on the circumstances and legal basis of the given processing – you may be entitled to the following rights:

· the right of access to the personal data;

· the right to have inaccurate data rectified and incomplete data completed;

· the right to erasure of the personal data (the “right to be forgotten”);

· the right to restriction of processing;

· the right to data portability;

· the right to object to processing based on legitimate interest or on the performance of a task carried out in the public interest;

· the right to object to processing for direct marketing purposes;

· in the case of processing based on consent, the right to withdraw consent at any time;

· the right to lodge a complaint with the supervisory authority and the right to a judicial remedy.

6.3 Right of access

You are entitled to obtain confirmation as to whether or not we process your personal data. If processing takes place, you are entitled to obtain access to the personal data and to the essential circumstances of the processing, in particular the purposes of the processing, the categories of data concerned, the recipients or categories of recipients, the envisaged retention period, your rights, the source of the data and – where applicable – information relating to automated decision-making and profiling. You are also entitled to a copy of the personal data processed. The first copy is free of charge; for further copies we may charge a reasonable fee based on the actual administrative costs.

6.4 Right to rectification

You are entitled to request the rectification without undue delay of inaccurate personal data concerning you and – taking into account the purpose of the processing – the completion of incomplete personal data.

6.5 Right to erasure

You may request the erasure of your personal data, in particular where:

· the data are no longer necessary for the purpose for which they were collected or otherwise processed;

· you withdraw your consent and there is no other legal basis for the processing;

· you object to the processing and there is no overriding legitimate ground for the continued processing;

· we have processed the personal data unlawfully; or

· erasure is required by an EU or Hungarian legal obligation.

The right to erasure is not unlimited. We will not erase the data where their processing is necessary, among other things, for compliance with a legal obligation, for archiving purposes in the public interest, or for the establishment, exercise or defence of legal claims.

6.6 Right to restriction of processing

You may request the restriction of processing where, for example, you contest the accuracy of the personal data; the processing is unlawful but you oppose the erasure of the data; we no longer need the data but you require them for legal claims; or you have objected to the processing and we have not yet established whether our legitimate grounds override yours. During the period of restriction, we may – apart from storage – as a general rule process the personal data only with your consent or for the handling of legal claims, the protection of the rights of another person, or important public interest.

6.7 Right to data portability

Where the processing is based on consent or on a contract and is carried out by automated means, you are entitled to receive the personal data concerning you that you have provided to us in a structured, commonly used, machine-readable format, and you may request their direct transmission to another controller where this is technically feasible. The exercise of this right may not adversely affect the rights and freedoms of others.

6.8 Right to object

You may object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions. In the event of an objection, we will no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims. In the case of direct marketing, we will no longer process the data for that purpose following the objection.

6.9 Manner and deadline for exercising rights

You may exercise your rights at the email addresses info@kifli.hu or dpo@kifli.hu, or via the contact details of the data protection officer set out in Section 6.1. We will respond to your request without undue delay and in any event within one month of its receipt. Where necessary – taking into account the complexity and number of the requests – this deadline may be extended by a further two months; we will inform you of the extension and of the reasons for the delay within one month.

Compliance with the request is, as a general rule, free of charge. Where the request is manifestly unfounded or excessive, in particular because of its repetitive character, we may charge a reasonable fee taking into account the administrative costs, or refuse to act on the request. We may request further information necessary to confirm the identity of the requesting person.

6.10 Complaints and remedies

If you consider that the processing of your personal data infringes the applicable data protection legislation, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):

Authority

Hungarian National Authority for Data Protection and Freedom of Information

Website

https://naih.hu/

Postal address

1363 Budapest, Pf. 9., Hungary

Telephone

+36 1 391 1400

Email

ugyfelszolgalat@naih.hu

You are also entitled to seek a judicial remedy, in particular where you consider that your rights under the GDPR have been infringed as a result of the processing.

6.11 Automated decision-making

In the course of the processing activities covered by this notice, we do not, as a general rule, apply decision-making based solely on automated processing – including profiling – which would produce legal effects concerning you or similarly significantly affect you. If we introduce such processing in the future, we will provide separate prior information about it and ensure the relevant data subject rights.

6.12 Data security

In order to protect personal data, we apply technical and organisational measures proportionate to the risks. These are aimed in particular at ensuring the confidentiality, integrity and availability of the personal data, preventing unauthorised access, alteration, disclosure, erasure, loss or destruction, and appropriately managing any personal data breaches.

6.13 Amendment of the notice

We reserve the right to amend this notice in the light of changes in the applicable legislation, authority practice, our services or our processing activities. The version in force from time to time will be published on the appropriate interface. If the amendment significantly affects the rights of data subjects or the essential circumstances of the processing, we will also provide separate information about the change in an appropriate manner.

This privacy notice entered into force on 25 May 2018. Last updated: August 2026.

Adatkezelési tájékoztató - Beszállítók