Privacy Policy
adriennherendi.com

5. The possible data controllers authorized to access the data: The data controller does not handle personal data through the use of cookies.

6. Explanation of the data subject's rights related to data processing: Data subjects have the option to delete cookies in the browser's Tools/Settings menu, generally under the Privacy settings.

7. Legal basis for data processing: Consent from the data subject is not required if the sole purpose of using cookies is the transmission of communication via an electronic communications network or when the provider absolutely needs it to provide a service explicitly requested by the subscriber or user related to the information society.

8. Most browsers used by our users allow the customization of which cookies to save and enable the deletion of (specific) cookies. If you restrict the saving of cookies on specific websites or do not allow third-party cookies, under certain circumstances, this may result in our website not being fully usable. Here you can find information on how to customize cookie settings for common browsers:

​

Google Chrome (https://support.google.com/chrome/answer/95647?hl=hu)

Internet Explorer (https://support.microsoft.com/hu-hu/help/17442/windows-internet-explorer-delete-manage-cookies)

Firefox (https://support.mozilla.org/hu/kb/sutik-engedelyezese-es-tiltasa-amit-weboldak-haszn

Safari (https://support.apple.com/kb/PH21411?locale=hu_HU)

​

7. USE OF GOOGLE ANALYTICS

​

1. This website uses Google Analytics, a web analytics service provided by Google Inc. (“Google”). Google Analytics uses “cookies,” which are text files stored on your computer, to help analyze how users interact with the website.

2. Information generated by the cookies about your use of this website is typically transmitted to and stored on a Google server in the United States. With IP anonymization activated on this website, Google will truncate your IP address within member states of the European Union or other parties to the Agreement on the European Economic Area before transmission.

3. Only in exceptional cases will the full IP address be transmitted to a Google server in the United States and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, compile reports on website activity for the website operator, and provide additional services related to website and internet usage.

4. The IP address transmitted by your browser through Google Analytics will not be merged with other Google data. You can prevent the storage of cookies by configuring your browser settings accordingly; however, please note that this may limit your ability to use the full functionality of this website. You can also prevent Google from collecting and processing data related to your website use (including your IP address) through cookies by downloading and installing the plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en.

8. USE OF SOCIAL SERVICES

8.1. SOCIAL MEDIA

1. The fact of data collection, the scope of processed data: Names registered on Meta/Twitter/Pinterest/YouTube/Instagram, etc. social media platforms, as well as the user's public profile picture.

2. The scope of data subjects: All individuals who have registered on Meta/Twitter/Pinterest/YouTube/Instagram, etc. social media platforms and have 'liked' the Service Provider's social media page or have contacted the data controller through the social media platform.

3. The purpose of data collection: Sharing, 'liking,' following, and promoting certain content elements, products, promotions, or the website itself on social media platforms.

4. Duration of data processing, deadline for data deletion, identity of possible data controllers authorized to access the data, and explanation of data subjects' rights related to data processing: Information about the source of data, its processing, transfer methods, and legal basis can be found on the respective social media platform. Since data processing occurs on social media platforms, the regulations of the specific social media platform apply to the duration, method of processing, and options for deleting and modifying data.

5. Legal basis for data processing: The voluntary consent of the data subject to the processing of personal data on social media platforms.

​

9. CUSTOMER RELATIONS AND OTHER DATA PROCESSING

1. In case questions arise or issues occur during the utilization of the data controller's services, the data subject can contact the data controller through the provided methods on the website (phone, email, social media, etc.).

2. The data controller deletes received emails, messages, phone calls, Facebook, etc., provided data with the inquirer's name and email address, and any other voluntarily provided personal data, within a maximum of 2 years from the date of communication.

3. Information regarding data processing not listed in this notice will be provided at the time of data collection.

4. In exceptional cases of authority requests or inquiries from other entities based on legal authorization, the Service Provider is obligated to provide information, disclose data, transfer information, or make documents available.

5. In such cases, the Service Provider only discloses personal data to the inquirer to the extent necessary for the precise purpose and scope of the inquiry.

​

10. RIGHTS OF THE DATA SUBJECT

1. Right of access:

You have the right to receive feedback from the data controller regarding whether your personal data is being processed, and if such processing is in progress, you are entitled to access the personal data and information listed in the regulation.

2. Right to rectification:

You have the right to request the data controller to promptly rectify inaccurate personal data concerning you. Considering the purpose of data processing, you are entitled to request the completion of incomplete personal data, among other things, through a supplementary statement.

3. Right to erasure:

You have the right to request the data controller to erase your personal data without undue delay, and the data controller is obliged to delete your personal data without undue delay under specific conditions.

4. Right to be forgotten:

If the data controller has made your personal data public and is obligated to erase it, taking into account the available technology and implementation costs, reasonable steps, including technical measures, are taken to inform the data controllers processing the data that you have requested the deletion of the links to, or copies or reproductions of, the personal data in question.

​

5. Right to restriction of processing:

You have the right to request the data controller to restrict processing if one of the following conditions is met:

• You contest the accuracy of the personal data, in which case the restriction applies for a period allowing the data controller to verify the accuracy of the personal data;

• The processing is unlawful, and you oppose the erasure of the data, instead requesting the restriction of their use;

• The data controller no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise, or defense of legal claims; or

• You have objected to processing; in this case, the restriction applies for the time it takes to determine whether the legitimate grounds of the data controller override your legitimate grounds.

​

6. Right to data portability:

You have the right to receive your personal data, which you have provided to a data controller, in a structured, commonly used, and machine-readable format, and have the right to transmit this data to another data controller without hindrance from the initial data controller (...)

7. Right to object:

In cases of data processing based on legitimate interests or the exercise of public authority, including profiling based on these provisions, you have the right to object to the processing of your personal data for reasons related to your particular situation, at any time.

​

8. Right to object to direct marketing:

If personal data processing is carried out for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing, including profiling related to such direct marketing. If you object to the processing of personal data for direct marketing, the personal data may no longer be processed for these purposes.

9. Automated individual decision-making, including profiling:

​

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. The preceding paragraph does not apply if the decision:

• Is necessary for entering into, or performance of, a contract between you and the data controller;

• Is authorized by union or member state law applicable to the data controller, which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or

• Is based on your explicit consent.

​

11. ENFORCEMENT DEADLINE

​

The data controller will inform you without undue delay, but in any case within 1 month from the receipt of the request, about the measures taken following the requests mentioned above. If necessary, this period can be extended by 2 months. The data controller will inform you of the extension, stating the reasons for the delay, within 1 month of receiving the request. If the data controller does not take measures following your request, you will be informed without undue delay, but no later than 1 month from the receipt of the request, about the reasons for the lack of action, and you have the right to lodge a complaint with a supervisory authority and seek judicial remedy.

​

12. SECURITY OF DATA PROCESSING

The data controller and the data processor shall implement appropriate technical and organizational measures, taking into account the state of the art, implementation costs, the nature, scope, context, and purposes of processing, as well as the varying likelihood and severity of risks to the rights and freedoms of natural persons, to ensure a level of data security appropriate to the risk, including, where applicable:

​

a) Pseudonymization and encryption of personal data;

b) Ensuring the ongoing confidentiality, integrity, availability, and resilience of processing systems and services used for personal data processing;

c) The ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;

d) A procedure for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures for ensuring the security of processing;

e) Storing processed data in a way that prevents unauthorized access. For paper-based records, this involves establishing the order of physical storage and filing, while electronic data should be managed through a central authorization control system.

f) Selecting a method of storing data electronically that allows for deletion, considering the specified deletion deadlines or other requirements. The deletion must be irreversible.

g) Physically destroying paper-based records using a document shredder or, if necessary, arranging for the secure and irreversible deletion of electronic data in accordance with the rules for the disposal of electronic records.

h) The data controller implements the following specific security measures:

a. For paper-based personal data security, the Service Provider applies the following measures (physical protection):

​

i. Place documents in a secure, well-lockable, dry area. ii. The Service Provider's building and premises are equipped with fire and security equipment. iii. Only authorized personnel may have access to personal data, and third parties may not access them. iv. The Service Provider's employee performing data processing can only leave the room where data processing takes place by securing the entrusted data carriers or closing the room. v. If paper-based personal data is digitized, the rules applicable to digitally stored documents must be followed.

b. Information security

i. Computers and mobile devices (other data carriers) used in data processing belong to the Service Provider. ii. Data on computers can only be accessed with a username and password. iii. The central server machine can only be accessed with the appropriate authorization and only by designated individuals. iv. For the security of digitally stored data, the Service Provider uses data backups and archives. v. The computer system used by the Service Provider containing personal data is equipped with antivirus protection.

​

13. INFORMING DATA SUBJECTS ABOUT DATA PROTECTION INCIDENTS

​

If a data breach is likely to result in a high risk to the rights and freedoms of natural persons, the data controller shall inform the data subject about the data breach without undue delay.

The information provided to the data subject should clearly and understandably describe the nature of the data breach. It should also provide the name and contact details of the Data Protection Officer or other contact person providing further information. The information must outline the probable consequences of the data breach and the measures taken or planned by the data controller to remedy the data breach, including, where applicable, measures to mitigate potential adverse effects arising from the data breach.

The data subject does not need to be informed if any of the following conditions are met:

• The data controller has implemented appropriate technical and organizational protection measures applied to the data affected by the data breach, making the data unintelligible to unauthorized persons, especially through encryption.

• The data controller has taken further measures after the data breach to ensure that the high risk to the rights and freedoms of the data subject is unlikely to materialize.

• Informing the data subject would require disproportionate effort. In such cases, data subjects should be informed through publicly available information or similar measures ensuring effective communication.

​

If the data controller has not notified the data subject of the data breach, the supervisory authority, after considering whether the data breach is likely to result in a high risk, may order the data subject to be informed.

14. REPORTING DATA PROTECTION INCIDENTS TO THE AUTHORITIES

The data controller shall notify the competent supervisory authority pursuant to Article 55 without undue delay and, where feasible, no later than 72 hours after becoming aware of the data breach unless the data breach is unlikely to result in a risk to the rights and freedoms of natural persons. If the notification is not made within 72 hours, the reasons for the delay must be included.

15. REVIEW IN CASE OF MANDATORY DATA PROCESSING

If the duration or periodic necessity of mandatory data processing is not determined by law, local government regulations, or mandatory legal acts of the European Union, the data controller shall review at least every three years, starting from the commencement of data processing, whether the processing of personal data managed by the data controller or by a data processor acting on its behalf or under its instructions is necessary to achieve the purpose of data processing.

​

The data controller shall document the circumstances and results of this review, keep this documentation for ten years following the review, and provide it to the National Authority for Data Protection and Freedom of Information (hereinafter: Authority) at the request of the Authority.

​

16. COMPLAINT OPTIONS​

In case of an alleged violation by the data controller, a complaint can be filed with the National Authority for Data Protection and Freedom of Information:

​

National Authority for Data Protection and Freedom of Information 1055 Budapest, Falk Miksa utca 9-11.

Mailing address: 1374 Budapest, Pf.: 603.

Phone: +36 -1-391-1400

Fax: +36-1-391-1410

Email: ugyfelszolgalat@naih.hu 

//

​Nemzeti Adatvédelmi és Információszabadság Hatóság
1055 Budapest, Falk Miksa utca 9-11.
Levelezési cím: 1374  Budapest, Pf.: 603.
Telefon: +36 -1-391-1400
Fax: +36-1-391-1410
E-mail: ugyfelszolgalat@naih.hu

​

17. CLOSING REMARKS

This document has been prepared in compliance with the following legal provisions:

• Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) of April 27, 2016, on the protection of natural persons regarding the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

• Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (Infotv.)

• Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services (particularly Section 13/A)

• Act XLVII of 2008 on the Prohibition of Unfair Commercial Practices Against Consumers

• Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities (particularly Section 6)

• Act XC of 2005 on the Freedom of Electronic Information

• Act C of 2003 on Electronic Communications (specifically Section 155)

• Opinion 16/2011 on EASA/IAB Best Practice Recommendations on Online Behavioural Advertising

• The recommendation of the Hungarian National Authority for Data Protection and Freedom of Information on the data protection requirements for prior information notices