| HUN

Privacy policy

The Data Controller and Its Contact Details

Name of the data controller (hereinafter referred to as the “Data Controller”): RoBa Group Kft. Registered office: 8400 Ajka, Dobó Katica utca 11.

Website: www.robagroup.hu / roba-group.com

The details of the Data Controller’s data protection officer/person responsible for data protection are as follows: Name: Balázs Rózsavölgyi

Email address: info@roba-group.com

  1. Processing of Personal Data Provided via the Contact Form
    1. Purposes of Data Processing
Purpose of this processing:To respond to the question submitted by the data subject.
  1. Categories of Data Subjects and Personal Data Processed
The categories of natural persons affected by this processing:Persons submitting questions through the website’s contact form.
In the course of this processing, the Data Controller processes the following personal data:Name, email address, telephone number, and any personal data that the data subject may provide in the message.
  1. Legal Basis for Processing

The legal basis for this processing:		Consent – Article 6(1)(a) of the GDPR – the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
Legislation governing the processing and, in the case of processing based on legitimate interests pursuant to Article 6(1)(f) of the GDPR, the legitimate interest forming the basis of the processing:
Not applicable.
Where special categories of personal data are processed, the relevant special category of personal data:
No special-category data are processed.
Additional condition(s) for processing special-category data pursuant to Article 9(2) of the GDPR:
Not applicable.
  1. Duration of Data Storage

For this processing, the retention period or the criteria used to determine it:		Six months following the response, unless a contract is concluded or the enforcement of a legal claim becomes necessary. In those cases, the data will be retained for five years from submission, taking into account the civil-law limitation period.
  1. Other Conditions
Possible consequences of failing to provide the data:The submitted question cannot be answered.

Other conditions pursuant to Article 13(2)(e) of the GDPR:		The provision of data is based on consent, and the data subject may withdraw that consent.
Where Article 6(1)(b) or (c) of the GDPR is relied upon, is the provision of data based on a statutory or contractual obligation, or is it a prerequisite for entering into a contract?
Not applicable.
  1. Recipients of Personal Data Transfers


Processors used in the course of this processing:		Rackhost Zrt. (tax number: 14571332-2-42). The purpose of the processing is to ensure the technical operation of the website, provide hosting and domain services, operate and maintain the system, correct errors, create backups, and provide technical customer support.
Joint processing is carried out with the following organisations in the course of this processing:
Not applicable.
In connection with this processing:Not applicable.
Regular transfers may be made to the following recipients:
Is any transfer made outside the EEA? If yes, how are the additional conditions under Chapter V of the GDPR met?
Not applicable.
  1. Automated Decision-Making, Including Profiling

The Data Controller does not carry out automated decision-making and/or profiling in relation to this processing.

  1. Operation of an Embedded Facebook Account
    1. Purposes of Data Processing

Purpose of this processing:		To ensure an online presence. The website uses the Facebook Pixel to support remarketing campaigns.
  1. Categories of Data Subjects and Personal Data Processed
The categories of natural persons affected by this processing:Facebook users who view the website.
In the course of this processing, the Data Controller processes the following personal data:IP address, browser and device information, cookies, and online identifiers.
  1. Legal Basis for Processing

The legal basis for this processing:		Consent – Article 6(1)(a) of the GDPR – the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
Legislation governing the processing and, in the case of processing based on legitimate interests pursuant to Article 6(1)(f) of the GDPR, the legitimate interest forming the basis of the processing:
Not applicable.
Where special categories of personal data are processed, the relevant special category of personal data:
No special-category data are processed.
Additional condition(s) for processing special-category data pursuant to Article 9(2) of the GDPR:
Not applicable.
  1. Duration of Data Storage
For this processing, the retention period or the criteria used to determine it:
Until the cookies expire.
  1. Other Conditions
Possible consequences of failing to provide the data:The submitted question cannot be answered.

Other conditions pursuant to Article 13(2)(e) of the GDPR:		The provision of data is based on consent, and the data subject may withdraw that consent.
Where Article 6(1)(b) or (c) of the GDPR is relied upon, is the provision of data based on a statutory or contractual obligation, or is it a prerequisite for entering into a contract?
Not applicable.


Note:		The loading of embedded Facebook content may be made conditional on cookie consent. It may be restricted through the visitor’s browser and Facebook account settings and controlled as described in Facebook’s privacy policy.
  1. Recipients of Personal Data Transfers


Processors used in the course of this processing:		Rackhost Zrt. (tax number: 14571332-2-42). The purpose of the processing is to ensure the technical operation of the website, provide hosting and domain services, operate and maintain the system, correct errors, create backups, and provide technical customer support.





Joint processing is carried out with the following organisations in the course of this processing:		Embedded Facebook content may be placed on the website, such as the display of a Facebook page, news feed, “Like” button, or share button. When Facebook embedded elements are displayed, Facebook (Meta Platforms Ireland Limited) may process personal data as a joint controller.
Meta Platforms Ireland LimitedRegistered office: 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, IrelandPrivacy policy: https://www.facebook.com/privacy/explanation
Regular transfers may be made to the following recipients in connection with this processing:
No data transfers take place.

Is any transfer made outside the EEA? If yes, how are the additional conditions under Chapter V of the GDPR met?		Meta Platforms Ireland Limited participates in the Data Privacy Framework, thereby meeting the requirements set out in Chapter V of the GDPR: https://www.facebook.com/privacy/policies/data_privacy_framework/
  1. Automated Decision-Making, Including Profiling

The Data Controller does not carry out automated decision-making and/or profiling in relation to this processing.

  1. Google Analytics
    1. Purposes of Data Processing
Purpose of this processing:The website uses Google Analytics to compile website traffic statistics.
  1. Categories of Data Subjects and Personal Data Processed
The categories of natural persons affected by this processing:Users who view the website.
In the course of this processing, the Data Controller processes the following personal data:IP address, browser and device information, cookies, and online identifiers.
  1. Legal Basis for Processing

The legal basis for this processing:		Consent – Article 6(1)(a) of the GDPR – the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
Legislation governing the processing and, in the case of processing based on legitimate interests pursuant to Article 6(1)(f) of the GDPR, the legitimate interest forming the basis of the processing:
Not applicable.
Where special categories of personal data are processed, the relevant special category of personal data:
No special-category data are processed.
Additional condition(s) for processing special-category data pursuant to Article 9(2) of the GDPR:
Not applicable.
  1. Duration of Data Storage
For this processing, the retention period or the criteria used to determine it:
Until the cookies expire.
  1. Other Conditions
Possible consequences of failing to provide the data:The submitted question cannot be answered.

Other conditions pursuant to Article 13(2)(e) of the GDPR:		The provision of data is based on consent, and the data subject may withdraw or refuse consent by deleting the cookies.
Where Article 6(1)(b) or (c) of the GDPR is relied upon, is the provision of data based on a statutory or contractual obligation, or is it a prerequisite for entering into a contract?
Not applicable.
  1. Recipients of Personal Data Transfers


Processors used in the course of this processing:		Rackhost Zrt. (tax number: 14571332-2-42). The purpose of the processing is to ensure the technical operation of the website, provide hosting and domain services, operate and maintain the system, correct errors, create backups, and provide technical customer support.



Joint processing is carried out with the following organisations in the course of this processing:		In relation to Google Analytics: Google LLC1600 Amphitheatre ParkwayMountain View, California 94043, USA
Google’s privacy policy: https://policies.google.com/privacy?hl=en
Regular transfers may be made to the following recipients in connection with this processing:
No data transfers take place.

Is any transfer made outside the EEA? If yes, how are the additional conditions under Chapter V of the GDPR met?		Google LLC participates in the Data Privacy Framework, thereby meeting the requirements set out in Chapter V of the GDPR: https://policies.google.com/privacy/frameworks?hl=en
  1. Automated Decision-Making, Including Profiling

The Data Controller does not carry out automated decision-making and/or profiling in relation to this processing.

  1. Rights of Data Subjects
    1. Right of Access

Pursuant to Article 15 of the GDPR, the data subject may request information and confirmation from the Data Controller concerning the conditions and circumstances of the processing of his or her personal data, in particular regarding:

  • the purpose and legal basis of the processing of the data subject’s personal data;
  • the categories of personal data concerned;
  • the recipients or categories of recipients of the personal data;
  • the intended period for which the data subject’s personal data will be stored, or the criteria used to determine that period;
  • the options available to the data subject for exercising his or her rights and obtaining legal remedies;
  • whether the Data Controller carries out automated decision-making or profiling using the personal data and, if so, the circumstances thereof.

When exercising the right of access, data subjects may request one electronic copy of the personal data processed about them from the Data Controller free of charge, pursuant to Article 15(4) of the GDPR.

  1. Right to Rectification

Pursuant to Article 16 of the GDPR, the data subject has the right to request that the Data Controller rectify inaccurate personal data concerning him or her without undue delay and to request the completion of incomplete personal data.

  1. Right to Erasure

Pursuant to Article 17 of the GDPR, the data subject has the right to request that the Data Controller erase his or her personal data where consent has been withdrawn, the data have been processed unlawfully, an obligation arising from Union or Member State law applies to the Data Controller, the purpose of the processing has ceased to exist, or, following the exercise of the right to object, there are no lawful grounds for continuing the processing. The data subject may also request erasure when objecting to processing carried out for direct marketing purposes.

The Data Controller will not comply with a request for erasure where legislation requires the personal data to be retained and the applicable statutory processing or retention period has not yet expired.

  1. Right to Restriction of Processing

Pursuant to Article 18 of the GDPR, the data subject has the right to request that the Data Controller restrict processing where one of the following applies:

  • the data subject contests the accuracy of the personal data;
  • the processing is unlawful, and the data subject opposes the erasure of the data and requests the restriction of their use instead;
  • the Data Controller no longer needs the personal data for the purposes of the processing, but the data subject requires them for the establishment, exercise, or defence of legal claims;
  • the data subject has objected to the processing.
  1. Right to Data Portability

Pursuant to Article 20 of the GDPR, the data subject may request that the Data Controller provide personal data concerning him or her, which are processed by automated means on the basis of the data subject’s consent [Article 6(1)(a) of the GDPR] or the performance of a contract [Article 6(1)(b) of the GDPR], in a structured, commonly used, and machine-readable format.

Where technically feasible, the Data Controller will, at the data subject’s request, transmit the personal data directly to another controller designated in the request.

The right to data portability under this section does not create an obligation for controllers to implement or maintain data-processing systems that are technically compatible with one another.

Where the exercise of the data subject’s right to data portability adversely affects the rights and freedoms of others, in particular their trade secrets or intellectual property, the Data Controller may refuse the request to the extent necessary.

The rules governing the right to data portability do not apply where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

  1. Automated Decision-Making and Profiling

Pursuant to Article 22(3) of the GDPR, where the relevant specific privacy notice states that automated decision-making, including profiling, is carried out in relation to the processing concerned, the data subject may request human intervention on the part of the Data Controller, express his or her point of view during the decision-making process, and contest the decision. The Data Controller currently does not carry out automated decision-making or profiling.

  1. Right to Object

Pursuant to Article 21 of the GDPR, the data subject may, on grounds relating to his or her particular situation, object at any time to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller [Article 6(1)(e) of the GDPR], as well as to processing based on the legitimate interests of the Data Controller [Article 6(1)(f) of the GDPR].

Where an objection is submitted, the personal data may continue to be processed only if compelling legitimate grounds for the processing override the interests, rights, and freedoms of the data subject, or if the processing is connected with the establishment, exercise, or defence of legal claims.

  1. Right to Legal Remedy
    1. Data Protection Officer

The data subject may contact the Data Controller’s data protection officer at any time or, where no data protection officer has been appointed, the contact person designated for data protection matters, using the contact details set out in the section entitled “THE DATA CONTROLLER AND ITS CONTACT DETAILS”, if the data subject has any questions or wishes to submit a complaint concerning the processing or protection of his or her personal data or the exercise of data-subject rights.

  1. Right to Lodge a Complaint with the Data Protection Supervisory Authority

Without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information if the data subject considers that the Data Controller or a processor engaged by it has, through an act or omission, infringed the law or created a risk of infringement.

Contact details of the Hungarian National Authority for Data Protection and Freedom of Information:

Registered office: 1055 Budapest, Falk Miksa utca 9-11. Postal address: 1363 Budapest, P.O. Box 9

Telephone: +36 1 391 1400, +36 30 683 5969, +36 30 549 6838

Email: ugyfelszolgalat@naih.hu Website: http://naih.hu/ Judicial Remedy

Right to an Effective Judicial Remedy against a Controller or Processor

Without prejudice to any available administrative or non-judicial remedies, including the right to lodge a complaint with the data protection supervisory authority, every data subject may bring proceedings before a court if he or she considers that the Data Controller or a processor engaged by it has infringed his or her rights relating to the processing of personal data.

The proceedings fall within the jurisdiction of the court competent according to the Data Controller’s registered office, namely the Budapest-Capital Regional Court. The data subject may choose to bring the proceedings before the court having jurisdiction at his or her place of residence or temporary residence.

A list of regional courts is available at: http://birosag.hu/torvenyszekek