THE PURPOSE OF THIS INFORMATION SHEET
This information leaflet is published by Wolf Beauty Ltd. by visitors and customers at the www.wolfbeauty.hu contains all information relating to the processing of personal data provided on this website, so that you are fully aware of the purpose and conditions of data processing, the associated risks and safeguards, and the rights to which you are entitled (hereinafter: „Information Leaflet”).
This Information Notice is based on Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, hereinafter: „GDPR”), as well as in Act CXII of 2011 on the right to informational self-determination and freedom of information (hereinafter: „Information Act.”) ensures compliance with the principles of lawful, fair and transparent data processing, as well as the respect for your right to informational self-determination.
NAME OF THE DATA CONTROLLER
The data controller for the personal data you have provided is:
Wolf Beauty Limited Liability Company
Registered office: 2730 Albertirsa, Mikebudai u. 34/A
Email: wolfbeautykft@gmail.com
Telephone: +36 30 758 2612
Data Protection Officer: István Farkas, Managing Director (hereinafter: „Data Controller”).
THE PURPOSE AND LEGAL BASIS OF DATA PROCESSING, THE SCOPE OF DATA PROCESSED, AND THE DURATION OF PROCESSING
|
3.1. Data processing in connection with the conclusion and performance of the contract
|
|
|
Purpose of data processing |
The Data Controller records and stores the personal data provided by the Customer when ordering products for the purposes of identifying the order, fulfilling the contract, and subsequently providing evidence of the conclusion and content of the contract. |
|
Legal basis for data processing |
Performance of the contract concluded between the Data Controller and the Customer [GDPR] Article 6(1)(b)] |
|
Scope of data processed |
surname, first name, email address, company name (compulsory if a company), street, house number, town, postcode, country, telephone number |
|
Duration of data processing |
until the expiry of the limitation period for claims arising from the contract (5 years) |
|
3.2. Data processing for the purposes of maintaining contact
|
|
|
Purpose of data processing |
Communication between the Data Controller and the Customer in connection with providing information about products, placing orders, and the conclusion and performance of contracts |
|
Legal basis for data processing |
the data subject’s consent [Article 6(1)(a) of the GDPR] |
|
Scope of data processed |
the name and email address of the person concerned |
|
Duration of data processing |
until the data subject withdraws their consent, but no later than the cessation of the Data Controller’s business activities |
|
3.3. Data processing for invoicing purposes
|
|
|
Purpose of data processing |
Invoicing the purchase price of products |
|
Legal basis for data processing |
compliance with a legal obligation to which the Data Controller is subject [Article 6 of the GDPR] [paragraph (1)(c)] |
|
Scope of data processed |
surname, first name, address, company name, registered office, tax registration number (compulsory for companies) |
|
Duration of data processing |
until the expiry of the limitation period for claims arising from the contract (5 years) |
|
3.4. Data processing in relation to the obligation to retain documents
|
|
|
Purpose of data processing |
Fulfilment of the Data Controller’s obligation to retain documents |
|
Legal basis for data processing |
compliance with a legal obligation to which the Data Controller is subject [Article 6 of the GDPR] [paragraph (1)(c)] |
|
Scope of data processed |
accounting records, supporting accounting documents and contracts |
|
Duration of data processing |
Accounting documents arising in connection with the sale of the Data Controller’s products, which directly or indirectly support the accounting records, and thus personal data relating to the Data Controller’s compliance with its obligation to retain such documents, for a period of 8 years [Section 169(2) of the Accounting Act] |
|
3.5. Data processing in connection with the recovery of debts
|
|
|
Purpose of data processing |
Enforcement of a payment obligation arising from a contract |
|
Legal basis for data processing |
compliance with a legal obligation to which the Data Controller is subject [Article 6 of the GDPR] [paragraph (1)(c)] |
|
Scope of data processed |
surname, first name, address, company name, registered office, tax registration number (compulsory for companies) |
|
Duration of data processing |
until the expiry of the limitation period for claims arising from the contract (5 years) |
|
3.6. Data processing for marketing purposes
|
|
|
Purpose of data processing |
To promote the sale of products, the Data Controller may send newsletters, advertising messages, questionnaires and other marketing content to customers regarding news, events, special offers and promotions relating to the products it distributes. |
|
Legal basis for data processing |
the data subject’s consent [Article 6(1)(a) of the GDPR] |
|
Scope of data processed |
the name and email address of the person concerned |
|
Duration of data processing |
until the data subject withdraws their consent, but no later than the cessation of the Data Controller’s business activities |
|
3.7. Data processing in relation to complaints and other requests
|
|
|
Purpose of data processing |
investigating, resolving and addressing any complaints or other requests submitted by the Customer |
|
Legal basis for data processing |
The legitimate interest of the Data Controller and the Customer, as reflected in the fact that the Data Controller must be able to perform the services in accordance with the contract and to remedy any defects in the products or address any complaints appropriately [Article 6(1)(f) of the GDPR] |
|
Scope of data processed |
the name, email address, residential address, postal address and telephone number of the person making the report; the content of the report; where a power of attorney has been granted, the same details of the authorised representative; and any other information provided by the person making the report, |
|
|
the unique reference number of the complaint, the place and date on which the complaint was lodged, any other documents provided by the complainant, any other information required to respond to the complaint, and the response to the complaint. |
|
Duration of data processing |
until the expiry of the limitation period for claims arising from the contract (5 years) |
|
3.8. Data processing relating to cookies
|
|
|
Purpose of data processing |
The collection and storage of information relating to a website visitor’s browsing activity on the website, their personal settings and identification, in order to tailor the services provided by the Data Controller on the website to the visitor’s needs |
|
Legal basis for data processing |
The data subject’s consent [Article 6(1)(a) of the GDPR] |
|
Scope of data processed |
the date and time of the visit, the IP address of the user’s computer, the type of browser, and the addresses of the web pages viewed and previously visited |
|
Duration of data processing |
until the data subject withdraws their consent, but no later than the closure of the website |
PERSONS ENTITLED TO ACCESS THE DATA AND DATA PROCESSORS
The personal data you provide may be accessed by staff members under the direct supervision of the Data Controller for the purposes of carrying out their duties; such staff members shall treat the data as confidential in accordance with the Data Controller’s internal rules and procedures in force at any given time. In processing your personal data, the Data Controller engages the following data processors for the data processing operations listed below:
Vitarex Studio Ltd. (web hosting service)
Foxpost-Packeta GROUP (product delivery)
Andrea Gaál (accounting)
Barion Payment Zrt. (1117 Budapest, 1 Neumann János Street, 4th floor – online payment processing, fraud detection)
DATA TRANSFER TO THIRD PARTIES, DISCLOSURE OF DATA TO REGULATORY AUTHORITIES
Apart from the data transfers specified in this Notice, the Data Controller may only disclose your personal data to third parties in exceptional cases, where such disclosure is necessary to comply with a legal obligation to which the Data Controller is subject.For example, if legal proceedings are initiated in a matter concerning you and the court hearing the case requires the transfer of documents containing your personal data, or if the police contact the Data Controller and request the transfer of documents containing your personal data for the purposes of an investigation.
TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE DATA SECURITY
The Data Controller ensures the security of your personal data by implementing technical and organisational measures commensurate with the level of risk, and protects it against unauthorised or unlawful processing, accidental loss, destruction or damage, including ensuring the confidentiality, integrity, availability and resilience of the IT systems and equipment used for the processing of personal data.
RIGHTS RELATING TO DATA PROCESSING
The right to information/access
You may request information from the Data Controller, in writing or by email, using the contact details provided above, as to whether your personal data is currently being processed by the Data Controller.
If such data processing is taking place, you are entitled to request information from the Data Controller regarding which of your personal data is being processed, on what legal basis, for what purpose, from what source and for how long, as well as to whom, when, under which legislation, and to whom it has granted access to or disclosed your personal data, including, in particular, recipients in third countries and international organisations.
The Data Controller will respond to your request for information within a maximum of 30 days, by post or email sent to the contact details you have provided.
You have the right to access your personal data, whereby the Data Controller will send you the relevant personal data in writing or by email.
The right to rectification
You may request, in writing or by email, using the contact details of the Data Controller set out above, that the Data Controller rectify any of your personal data without delay, or that any incomplete personal data be completed. For example, you may change your email address or password at any time.
The Data Controller will process your request within a maximum of 30 days and will notify you of this by post or email sent to the contact details you have provided.
The right to erasure/to be forgotten
You may request, in writing or by email, using the contact details of the Data Controller provided above, that the Data Controller erases your personal data without delay if any of the following grounds apply:
- his or her personal data are no longer required for the purpose for which the Data Controller processed them;
- You withdraw your consent, which forms the basis for the processing of your personal data, and there is no other legal basis for such processing;
- You object to the processing of your data, and there is no other lawful basis for such processing,
- the Data Controller has processed your personal data unlawfully;
- your personal data must be erased in order to comply with a legal obligation to which the Data Controller is subject;
- The personal data was collected in connection with the provision of information society services to children.
The Data Controller will comply with your request within a maximum of 30 days and will notify you of this by letter sent to the contact details you have provided.
If the Data Controller has also disclosed your personal data to other parties, the Data Controller shall, within 30 days, inform those other data controllers/data processors that you have requested the erasure of a copy of your personal data.
The right to have data restricted or erased
You may request, in writing or by email, using the contact details of the Data Controller provided above, that the Data Controller block your personal data or restrict the processing thereof if any of the following conditions are met:
- If you dispute the accuracy of your personal data, the restriction/blocking shall apply for a period sufficient to enable the Data Controller to verify the accuracy of the personal data;
- the processing of your data is unlawful, and you object to the erasure of your data and instead request that it be
restrictions on its use;
- the Data Controller no longer requires the personal data for the purposes of data processing, but you require it for the purpose of establishing, exercising or defending legal claims; or
- You have objected to the processing of your data; in this case, the restriction shall apply for as long as it has not been established whether the data controller’s legitimate grounds take precedence over those of the data subject.
Where data is blocked or restricted, such personal data may only be processed – apart from for storage purposes – with your consent, or for the purpose of establishing, exercising or defending legal claims, or for the protection of the rights of another natural or legal person, or for reasons of substantial public interest.
The restriction will remain in place for as long as the reason you have specified necessitates the storage of the data.
The right to data portability
You may request, in writing or by email, using the contact details of the Data Controller provided above, that the Data Controller provide you with the personal data relating to you that you have made available to the Data Controller in a structured, commonly used and machine-readable format; and you are also entitled to have this data transmitted to another data controller without the Data Controller to whom you provided the personal data preventing this, provided that the processing is based on your consent or a contract and is carried out by automated means.
When exercising your right to data portability, you are entitled – where technically feasible – to request that your personal data be transferred directly from one data controller to another.
The Data Controller will comply with your request within a maximum of 30 days and will notify you of this by letter sent to the contact details you have provided.
The right to protest
You may, at any time, object in writing or by email, using the contact details of the Data Controller provided above, to the processing of your personal data based on the legitimate interests of the Data Controller or a third party. In this case, the Data Controller may no longer process your personal data, unless the Data Controller demonstrates that the processing is justified by compelling legitimate grounds which override your interests, rights and freedoms, or which are related to the establishment, exercise or defence of legal claims.
You may object at any time, in writing or by email, via the contact details of the Data Controller provided above, to the processing of your personal data for the purposes of direct marketing; in such cases, your data may no longer be processed for this purpose.
You may also express your objection by clicking on the link included in the newsletters sent to you by the Data Controller via email, following which the Data Controller will no longer send you newsletters.
Automated decision-making in individual cases, including profiling
The Data Controller does not use decision-making based solely on automated data processing, including profiling.
Should the Data Controller introduce a decision-making process based on such data processing in the future, it will inform you in advance by email of the logic applied, method and its essence, and will provide you with the opportunity to request human intervention from the Data Controller, express your point of view, or lodge an objection to the decision.
OPTIONS FOR ENFORCING YOUR RIGHTS IN RELATION TO DATA PROCESSING
If you become aware of any unlawful data processing, it is advisable to first submit your complaint to the Data Controller before initiating legal proceedings, as this will give the Data Controller the opportunity to rectify the situation of its own accord.
You may initiate an investigation by submitting a notification (complaint) to the supervisory authority, on the grounds that your rights have been infringed, or that there is an imminent risk of such an infringement, in connection with the processing of your personal data. The name and contact details of the supervisory authority are as follows:
National Authority for Data Protection and Freedom of Information Registered office: 1055 Budapest, Falk Miksa Street 9–11. Postal address: 1363 Budapest, P.O. Box 9.
Email: ugyfelszolgalat@naih.hu
Telephone: +36 (1) 391-1400
Fax: +36 (1) 391-1410
Website: www.naih.hu
If you have experienced unlawful data processing, you may bring a civil action before a court. The court has jurisdiction to hear the case. The action may also be brought – at your discretion – before the court in your place of residence. You can view a list of regional courts and their contact details via the following link: http://birosag.hu/torvenyszekek.
REVIEW AND AMENDMENT OF THE PROSPECTUS
The circumstances of data processing may change from time to time, and the Data Controller may at any time decide to supplement its ongoing data processing with a new purpose of data processing, therefore the Data Controller reserves the right to amend this Notice at any time. The Data Controller will notify you of any amendments to this Notice by email using one of the contact details you have provided.
LEGISLATION GOVERNING DATA PROCESSING
The processing of your personal data is governed by the following legislation:
REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (27 April 2016) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) („GDPR”), the current text of which can be viewed here:
http://eur-lex.europa.eu/legal-content/HU/TXT/PDF/?uri=CELEX:32016R0679&rid=1
Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information („Infotv.”), the current version of which is available via the following link: http://net.jogtar.hu/jr/gen/hjegy_doc.cgi?docid=A1100112.TV
Act CVIII of 2001 on certain issues relating to information society services („Ektv.”), the current version of which can be accessed via the following link: https://net.jogtar.hu/jogszabaly?docid=a0100108.tv