CENTRO – MEDICAL HUNGARY KFT. DATA PROCESSING STATEMENT

DATA PROCESSOR

Name of data controller: Centro – Medical Hungary Kft.
Headquarters: 2045 Törökbálint, Lehel Street 5.
Tax number: 29192339-1-13

DATA PROCESSORS

By accepting this Data Protection Policy, the Data Subject expressly consents to the transfer of the following personal data to the recipient specified below:

DATA PROCESSORS

Activecampaign

DokDok, Inc.
420 rue Guy
Montreal, QC H3J 2L2
Canada
Mailchimp

c/o The Rocket Science
Group, LLC
675 Ponce de Leon Ave NE
Suite 5000
Atlanta, GA 30308
MOSS No. EU 826 477 914
SiteGround.com hosting

SG Hosting Inc. – Delaware, USA, address: 901 N. Pitt St, Suite 325, Alexandria 22314 VA, USA,
SiteGround Spain S.L. – Spain (CIF: B87194171), address: Calle de Prim 19, 28004 Madrid, Spain
SiteGround Italia Srl. – Italy, Tax number: 09659420963, Milan Companies Register, Italy, address: Via Agnello 8, Milan 20121, Italy,
SiteGround Hosting Ltd - England and Wales (09348602), 3rd Floor, 11-12 St James' Square, London, SW1Y 4LB
SiteGround Hosting EOOD, – Bulgaria UIC 204181297, address: 8 Racho Petkov Kazandziata str., Sofia, Bulgaria.
Productive.io

Infinum Inc
340 S Lemon Ave 9714
Walnut, CA 91789
USA

YOU HAVE THE FOLLOWING RIGHTS IN RELATION TO DATA PROCESSING:

RIGHT TO PRIOR INFORMATION

The data subject has the right to be informed about the facts and information related to data processing before the start of data processing.

(Articles 13-14 of the Regulation)

RIGHT OF ACCESS OF THE DATA SUBJECT

The data subject has the right to receive feedback from the Data Controller as to whether his or her personal data is being processed and, if such processing is taking place, has the right to access the personal data and related information as specified in the Regulation.

(Article 15 of the Regulation).

RIGHT TO CORRECTION

The data subject shall have the right to obtain from the Controller, at his/her request, the rectification of inaccurate personal data concerning him/her without undue delay. Taking into account the purpose of the processing, the data subject shall have the right to request the completion of incomplete personal data, including by means of a supplementary statement.

(Article 16 of the Regulation).

RIGHT TO DELETION (“RIGHT TO BE FORGOTTEN”)

1. The data subject has the right to request that the Data Controller erase personal data concerning him or her without undue delay, and the Data Controller is obliged to erase personal data concerning the data subject without undue delay if one of the grounds specified in the Regulation applies.

(Article 17 of the Regulation)

RIGHT TO RESTRICT DATA PROCESSING

The data subject has the right to request that the Data Controller restrict data processing if the conditions specified in the regulation are met.

(Article 18 of the Regulation)

NOTIFICATION OBLIGATION RELATED TO THE CORRECTION OR DELETION OF PERSONAL DATA OR THE RESTRICTION OF DATA PROCESSING

The Data Controller shall inform all recipients to whom the personal data have been disclosed of any rectification, erasure or restriction of processing, unless this proves impossible or involves a disproportionate effort. Upon request, the Data Controller shall inform the data subject of these recipients.

(Article 19 of the Regulation)

RIGHT TO DATA PORTABILITY

Under the conditions set out in the Regulation, the data subject has the right to receive the personal data concerning him or her, which he or she has provided to a Data Controller, in a structured, commonly used and machine-readable format, and has the right to transmit these data to another Data Controller without hindrance from the Data Controller to whom the personal data have been provided.

(Article 20 of the Regulation)

RIGHT TO OBJECT

The data subject has the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her based on point (e) of Article 6(1) of the Regulation (processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller) or point (f) of Article 6(1) of the Regulation (processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party).

(Article 21 of the Regulation)

AUTOMATED DECISION-MAKING IN INDIVIDUAL CASES, INCLUDING PROFILING

The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

(Article 22 of the Regulation)

RESTRICTIONS

Union or Member State law applicable to the controller or processor may restrict, by means of legislative measures, the rights and obligations set out in Articles 12 to 22 and Article 34 and in accordance with Articles 12 to 22.

(Article 23 of the Regulation)

INFORMING THE DATA SUBJECT ABOUT THE DATA PROTECTION INCIDENT

If the data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall inform the data subject of the data breach without undue delay.

(Article 34 of the Regulation)

REPORTING A DATA PROTECTION INCIDENT TO THE SUPERVISORY AUTHORITY

The data controller shall notify the data protection incident to the NAIH without undue delay and, where possible, no later than 72 hours after having become aware of the data protection incident, unless the data protection incident is unlikely to result in a risk to the rights and freedoms of natural persons.

If the notification is not made within 72 hours, the reasons justifying the delay must be attached.

The data processor shall notify the data controller of the data protection incident without undue delay after becoming aware of it.

A data protection incident can be reported online on the following interface:

https://naih.hu/adatvedelmi-incidensbejelent–rendszer.html

INFORMING THE DATA SUBJECT ABOUT THE DATA PROTECTION INCIDENT

If the data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall inform the data subject of the data breach without undue delay.

The information provided to the data subject must clearly and intelligibly describe: the nature of the data protection incident, the name and contact details of the data protection officer/contact person; the likely consequences of the incident; the measures taken to remedy the incident.

The data subject does not need to be informed if any of the following conditions are met:

(a) the controller has implemented appropriate technical and organisational protection measures and these measures have been applied to the data affected by the data breach, in particular measures that render the data unintelligible to persons not authorised to access the personal data, such as the use of encryption;

b) the controller has taken further measures following the data protection incident to ensure that the high risk to the rights and freedoms of the data subject is no longer likely to materialise;

(c) the provision of information would involve a disproportionate effort. In such cases, the data subjects shall be informed by means of publicly available information or a similar measure shall be taken which ensures that the data subjects are informed in a similarly effective manner.

RIGHT TO FILING A COMPLAINT WITH A SUPERVISORY AUTHORITY (RIGHT TO A LEGAL REMEDY)

The data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement, if the data subject considers that the processing of personal data concerning him or her infringes the Regulation.

(Article 77 of the Regulation)

RIGHT TO AN EFFECTIVE COURT REMEDY AGAINST THE SUPERVISORY AUTHORITY

Every natural and legal person has the right to an effective judicial remedy against a legally binding decision of the supervisory authority concerning him or her, or if the supervisory authority does not deal with the complaint or does not inform the data subject within three months about the procedural developments related to the complaint submitted or its outcome. You can contact the National Data Protection and Freedom of Information Authority (Registered office: 1125 Budapest, Szilágyi Erzsébet fasor 22/c Postal address: 1530 Budapest, P.O. Box: 5. Telephone: +36 (1) 391-1400)

(Article 78 of the Regulation)

RIGHT TO AN EFFECTIVE COURT REMEDY AGAINST THE DATA CONTROLLER OR DATA PROCESSOR

Every data subject shall have the right to an effective judicial remedy if he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data not in accordance with this Regulation.

(Article 79 of the Regulation)

If you would like to exercise any of the above rights, please contact us at elod.czako@marketingastro.com or office@marketingastro.com.

WHAT DATA PROCESSING IS TAKEN?

The Company's website uses software that analyzes website traffic data. However, the software does not process personal data in accordance with the provisions of the Information Technology Act, but it does record data about visits. The Company receives automatically generated information about visitors to its website: the visitor's Internet Protocol address (IP address), the time of the visit, the data of the pages viewed, and the name of the browser used.

Since, based on the National Data Protection and Freedom of Information Authority and internationally accepted practice, the IP address may even become relatively personal data, the Company protects all data obtained during the data processing of the website with the protection due to personal data in accordance with this regulation.

The Company therefore informs visitors about data collection by publishing this policy on its website.

The legal basis for this data processing is the consent of the data subject [Infotv. Section 5 (1) a) and Section 6 (6)], according to which “in other cases initiated at the request of the data subject, the consent of the data subject shall be presumed with regard to the personal data provided by him/her”.

purpose of data processing: examination of website visiting habits
Scope of data processed: the visitor's Internet Protocol address (IP address), time of visit, data on the pages viewed, name of the browser used, device used
Legal basis for data processing: consent of the data subject pursuant to Section 5 (1) a) of the Privacy Act.
data storage period: one year from the date of data collection
data storage method: electronic

CONTACT REGISTRATION

The visitor has the opportunity to register for contact on the Company's website. By filling out the form, the visitor provides the relevant data necessary for contact. However, the data subject only has the opportunity to send the data if he accepts the Company's data protection policy, which he can do by checking a checkbox, otherwise he will not be able to finalize the registration.

purpose of data processing: contacting, sending messages
scope of processed data: name, e-mail address, telephone number of the data subject
Legal basis for data processing: data subject consent pursuant to Section 5 (1) a) of the Privacy Act.
data storage period: until the Company ceases to exist or until deletion at the request of the data subject
data storage method: electronic
Newsletter-related data processing

The Company sends a newsletter about the Company's promotions at the request of the data subject, so only those who have registered for this service on the Company's website or have personally consented to the sending of the newsletter will receive the newsletter. If the data subject can subscribe to the newsletter on the website, he or she must accept the data protection policy at the point of subscription. You can do this by checking a box.

The Company analyzes the data and user habits of interested parties in order to deliver its own and its business partners' advertisements to its users in a personalized manner via the contact details provided by them.

The Company provides an unsubscribe option at the bottom of each newsletter.

purpose of data management: to inform data subjects about the most important news of the Company
scope of processed data: name of the data subject, e-mail address
Legal basis for data processing: data subject consent pursuant to Section 5 (1) a) of the Information Act, Section 13/A of the Administrative Procedure Act and Section 6 (5) of the Corporate Governance Act
data storage period: until the end of the operation of the newsletter service, but if the data subject requests the deletion of their data (unsubscribes from the newsletter), immediately after their deletion request
data storage method: electronic

DATA PROCESSING IN THE FUNCTIONING OF THE COMPANY

Place of data processing:

For contact requests: Activecampaign software, Productive.io, Mailchimp

For downloaded content: Siteground.com hosting provider

Customer records

The Company's business management system records data about customers and partners.

Purpose of data management: maintaining contact with customers and partners to fulfill their order requirements.
Scope of processed data: customer name, e-mail address, telephone number, address, shopping habits
Legal basis for data processing: data subject's consent pursuant to Section 5 (1) a) of the Privacy Act.
data storage period: until the Company ceases to exist or until deletion at the request of the data subject
data storage method: electronic
The data processors and recipients of data transfers that may be related to data processing are included in this Policy.

CUSTOMER SERVICE

In order to serve the needs of customers as fully as possible, the Company sends e-mails to the data subject for direct offer or informal purposes based on the prior clear and express consent of the data subject. The Company ensures that the data subject can unsubscribe from marketing e-mails at any time free of charge. The Company also transmits such information to customers in person or by telephone.

The Company defines customer management as the enforcement of rights related to the sold product, settlement, and the implementation of marketing purposes. Customer management therefore includes, in particular, consent to the use of the personal data provided by the data subject for this purpose, in particular for notification of new products and new services related to products previously purchased by the data subject (exclusively by e-mail).

If you request the deletion of your data, the Company maintains a blacklist in accordance with the provisions of Act CXIX of 1995 on the processing of name and address data for the purpose of research and direct marketing (hereinafter referred to as the “Act”). The Company undertakes to check whether the data subject is on the blacklist before making an advertising request.

purpose of data processing: customer management, direct marketing
Scope of processed data: customer name, address, e-mail address, telephone number, residential address, gender, date of birth
Legal basis for data processing: data subject's consent pursuant to Section 5 (1) a) of the Privacy Act.
data storage period: until the company is dissolved or until deletion at the request of the data subject
data storage method: electronic
This Policy includes the data processors and recipients of data transfers that may be related to data processing.

CONTRACT AND LEGAL OBLIGATION

Maintaining billing information and issuing invoices is our legal obligation. If our client does not provide the requested information, it is impossible for us to perform the service we have undertaken.

After ordering our services, a contract is concluded with the customers in writing or orally. Our company concludes contracts with legal and private persons, therefore, our contracts may also include personal data, such as the name, telephone number, e-mail address of the contact person, or the name of the legal entity's representative. The condition for concluding a contract is that we know this data, we need to know who the other party is, where we can reach them. Without knowing the data, the contract is not considered concluded and we cannot provide the service.

We are only able to delete this data after the period prescribed by law has expired.

ENTRY INTO FORCE OF DATA SECURITY RULES

In order to ensure the security of personal data processed on paper, the Company applies the following measures:

the data can only be viewed by those authorized to do so, no one else can access it, and it cannot be disclosed to anyone else;
the documents are stored in a lockable, dry room equipped with fire protection and property protection equipment;
Only competent persons have access to documents that are in continuous active management;
The Company's data processing employee may only leave the premises where data processing takes place during the day by locking the data carriers entrusted to him or by closing the office;
the Company's data processing employee closes the paper-based data medium after completing the work;
If personal data managed on paper is digitized, the Company applies the security rules governing digitally stored documents.
To ensure the security of personal data stored on a computer or network, the Company applies the following measures and guarantee elements:

The stored data can only be accessed with valid, personal, identifiable authorization – at least a username and password – and the Company ensures that passwords are changed regularly;
Data stored on the network server (hereinafter referred to as: server) may only be accessed by persons with appropriate authorization and designated for that purpose;
if the purpose of data management has been achieved and the data management deadline has expired, the file containing the data will be irretrievably deleted and the data cannot be recovered;
continuously ensures virus protection on the network that processes personal data;
prevents unauthorized persons from accessing the network using the available IT tools.

CHANGE OF STATEMENT

The Company reserves the right to amend the statement. If the amendment affects the use of personal data provided by the data subject, the user will be informed of the changes in the form of an e-mail notification. 

If the details of data management change due to the amendment of the statement, the Company will separately request the data subject's consent.

In matters not specified in these regulations, the rules of the Information Act shall apply.

COOKIES AND DATA PROCESSING

TECHNICALLY NECESSARY SESSION COOKIES

These cookies are necessary to enable visitors to browse the website, to use its functions smoothly and to the full extent, and to use the services available through the website, including, among other things, to remember the actions taken by the visitor on the given pages during a visit. The duration of data processing of these cookies applies only to the visitor's current visit, and this type of cookie is automatically deleted from your computer when the session ends or the browser is closed.

The data set managed is: AVChatUserId, JSESSIONID, portal_referer.

The legal basis for this data processing is Section 13/A (3) of Act CVIII of 2001 on certain issues of electronic commerce services and information society services (Elkertv.).

The purpose of data management is to ensure the proper functioning of the website.

COOKIES THAT REQUEST CONSENT:

These enable the Company to remember the user's choices regarding the website. The visitor may prohibit this data processing at any time before and during the use of the service. These data cannot be linked to the user's identification data and cannot be transferred to a third party without the user's consent.

COOKIES THAT PROMOTE USAGE:

The legal basis for data processing is the visitor's consent.

Purpose of data management: Increasing the efficiency of the service, enhancing user experience, and making the use of the website more convenient.

The duration of data management is 6 months.

PERFORMANCE COOKIES:

Google Analytics cookies – you can find out more about this here:

https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage

Google AdWords cookies – you can find out more about this here:

https://support.google.com/adwords/answer/2407785?hl=hu

Facebook cookies – you can find out more about them here:

https://www.facebook.com/policies/cookies/

Our full cookie statement by clicking on this link you can read it.