Data Management Information - Suppliers

Kifli.hu Shop Kft., 1106 Budapest, Jászberényi út 45., Company registration number: 01-09-339560 (also referred to as "we"), as the data controller, informs you, as our contractual partner or potential contractual partner, about the processing and protection of personal data as follows:

From the following, you can learn:

1.         which of your personal data is processed;

2.         for what purpose and by what means we will process your personal data;

3.         to whom we may transfer your personal data;

4.         how long we will process your personal data;

5.         what rights you have regarding the protection of your personal data.

Please feel free to contact us at any time at info@kifli.hu if you need an explanation or advice on any part of the information, or if you wish to discuss further processing of your data.

1. Scope of personal data processing

1.1. If you are our business partner (natural person), we process your personal data that is necessary for fulfilling our contractual obligations and legal obligations related to the performance of the contract (tax and accounting obligations under Act CL of 2017 on the Rules of Taxation, Section 78 (3) and Section 202, and Act C of 2000 on Accounting, Section 169 (2)). These data particularly include:

a. name and surname;

b. contact address;

c. company name;

d. registered office address;

e. identification number and tax identification number;

f. phone number; or

g. email address.

The processing of personal data according to points a)-g) is based on Article 6(1)(b) of the GDPR (performance of a contract), and the processing of personal data according to points a), c)-e) is based on Article 6(1)(c) of the GDPR (compliance with legal obligations). If you do not provide the above data, the contract cannot be concluded.

1.2. If you are our business partner (legal entity), we process the personal data of your contacts that you voluntarily provide to us and that are necessary for fulfilling our contractual obligations. These data include:

a. name and surname;

b. phone number;

c. email address.

The processing of personal data is based on Article 6(1)(f) of the GDPR (our and our contractual partner's legitimate interest). Our legitimate interest lies in fulfilling the contract (through contact with the contact person). The relevant balancing test has been prepared.

1.3. If you wish to become our business partner and provide us with your data for this purpose, for example through the electronic form on the website, we process all the data you voluntarily provide to us for the purpose of future contract conclusion based on your request. This typically includes the following data:

a. (contact person's) name and surname;

b. address;

c. company name;

d. registered office;

e. identification number and tax identification number;

f. phone number;

g. email address;

h. comments and messages, if any.

The processing of personal data is based on Article 6(1)(b) of the GDPR (steps taken at the request of the data subject prior to entering into a contract).

2. Who can access your personal data

We, as the data controller, process your personal data. We only disclose your personal data to authorized employees and cooperating persons, or to processors or other data controllers we commission, but only to the extent necessary to achieve the specific purposes and if there is a proper legal basis for processing personal data. These include, for example:

• Contracted accounting service providers
• Contracted legal service providers
• Contracted processors who operate our servers, websites, and provide IT or marketing services to us.

 

3. Duration of personal data processing

We process your personal data for the period determined by the purpose of the data processing.

3.1. If we conclude a contract with natural persons, we process the data for the duration of the contract. Subsequently, we only retain the data and only for the period necessary to fulfill our legal obligations. According to tax laws, the tax limitation period is 5 years, according to the accounting law it is 8 years, and the general civil law limitation period is 5 years. If there is a legal dispute between the parties, the data processing lasts until the final resolution of the matter.

3.2. If we conclude a contract with a legal entity, we process the contact person's relevant contact data for 12 months after the termination of the contract or for 12 months after the change of the contact person.

If there is a dispute between the parties, the relevant data is processed until the final resolution of the matter.

3.3. For the purpose of contract negotiation (point 1.3), if the negotiations result in the conclusion of a contract, we process the data for the period specified in point 3.1 above. If the negotiations do not result in the conclusion of a contract, we process the data for 6 months from the end of the negotiations (the relevant balancing test has been prepared). If there is a legal dispute, the data processing lasts until the final resolution of the matter.

4. Personal data of third parties

We process the personal data of third parties, i.e., the employees and customers of our suppliers, as well as other persons involved in cooperation with us (such as the following data: name and surname, email address, phone number), and other data received in connection with the conclusion or performance of the contract, in accordance with applicable data protection laws. We use these personal data based on our own (and our contractual partner's) legitimate interest (Article 6(1)(f) of the GDPR) for the purpose of fulfilling contracts. Our legitimate interest lies in fulfilling the contract (we only process personal data that is necessary for the performance of the contract). The relevant balancing test has been prepared. We process the personal data of third parties for the period necessary under the relevant contract, typically for the duration of the contractual relationship and for the period specified in separate laws (8 years according to Section 169 (2) of the Accounting Act). Subsequently, the data is retained for a longer period if the retention of the data is reasonably necessary in connection with a specific matter (e.g., if there is a legal dispute or administrative procedure, the data processing lasts until the final resolution of the matter). The source of such data is our contractual partner. We only disclose the data to the following organizations: __.

5. Cookies

Cookies are small text files containing short data that can be stored on the user's device when visiting a website. We use cookies on our website for the following purposes:

o remembering the logged-in user;

o convenient web features;

o anonymized evaluation of users' movements on the website;

o collecting voluntary feedback from users; and

o personalizing advertisements.

All personal data is processed lawfully and transparently, and we only request data that is appropriate, relevant, and necessary for the purposes of data processing.

You can reject cookies or allow only certain cookies in your internet browser settings. The most commonly used browsers' cookie settings can be found at the following links:

• Chrome
• Firefox
• Internet Explorer
• Opera
• Microsoft Edge

6. Your rights regarding personal data processing

As a data subject, you have certain rights regarding the processing of personal data, which arise from applicable laws and can be exercised at any time. These rights include:

(i) the right to access personal data,

(ii) the right to rectify inaccurate personal data and to complete incomplete personal data,

(iii) the right to delete personal data if the personal data is no longer needed for the purposes for which it was collected or otherwise processed, or if it is found that the personal data has been processed unlawfully,

(iv) the right to restrict data processing,

(v) the right to data portability,

(vi) the right to object to the processing of personal data, in which case the data processing will be terminated unless the data processing has demonstrably compelling legitimate grounds that override the interests, rights, and freedoms of the data subject, particularly if these grounds are related to the enforcement of legal claims, and

(vii) the right to contact the data protection authority.

 

Right to access personal data: If you want to know whether we process your personal data, you have the right to be informed whether we process your personal data or not, and if this is the case, you also have the right to access your personal data.

Right to rectify inaccurate personal data and to complete incomplete personal data: If you believe that we process inaccurate or incomplete personal data about you, you have the right to request their rectification and/or completion. We will rectify or complete the data without undue delay, taking into account technological capabilities.

Right to delete personal data: If you request deletion, we will delete your personal data if (i) the personal data is no longer needed for the purposes for which it was collected or otherwise processed, (ii) the personal data has been processed unlawfully, (iii) you object to the processing, and there are no overriding legitimate grounds for processing your personal data, or (iv) the legal obligation to process personal data under EU or national law no longer exists.

Right to restrict data processing: You can request the restriction of data processing, for example, if you dispute the accuracy of personal data (in this case, the restriction applies for a period that allows us to verify the accuracy of personal data), we no longer need the personal data for the purposes of data processing, but you require it for the establishment, exercise, or defense of legal claims, or you have objected to the processing (in this case, the restriction applies until it is verified whether our legitimate grounds override your legitimate grounds).

Right to data portability: If you want us to transfer your personal data processed electronically based on a contract or your consent to a third party, you can exercise your right to data portability. If exercising this right adversely affects the rights and freedoms of others, we will not be able to fulfill your request.

Right to object: You can object to the processing of personal data for the performance of a task carried out in the public interest or for the protection of legitimate interests. Unless we can demonstrate that the data processing has compelling legitimate grounds that override the interests, rights, and freedoms of the data subject, we will terminate the data processing without undue delay.

 

If the requests to exercise the above rights are repetitive or manifestly unfounded, we may charge a reasonable fee for exercising the relevant right or refuse to fulfill the request. If this is the case, we will inform you accordingly.

You can exercise all your rights by contacting us at info@kifli.hu.

You can file a complaint with the supervisory authority, which is: National Authority for Data Protection and Freedom of Information (website: https://naih.hu/, postal address: 1363 Budapest, Pf.: 9., phone: 1363 Budapest, Pf.: 9., tel: (+36 (1) 391 1400), email: ugyfelszolgalat@naih.hu)

 

This data protection information came into effect on May 25, 2018, and is regularly updated.