12.1. Data subjects are entitled to ask or inquire in a written form, via registered mail or with receipt required sent to the Controllers’ address or to the e-mail address of the Data processor appointed in the concerning information chart about the following
- to withdraw their consent to the processing of their Personal data;
- to ask information about the management of their Personal data;
- to ask correction of their data in case of a change in their Personal data or in case of the data are registered wrong;
- to ask for cancellation or lockup of their Personal data;
- to ask for a restraint of the management of their Personal data;
- to object to the processing of their Personal data; or
- to ask for the sending of their Personal data in a proportioned, widely used, machine-readable format, furthermore to forward these data by the Controller – without interference – to another Controller (right to portability of data).
The Data subject shall have the right to withdraw consent at any time, in which case the data provided shall be deleted from the systems of the Controller concerned, subject to the exceptions mentioned below and those listed in the data deletion. The use of the webshop may result in the impossibility to deliver the ordered Product to the Customer in the case of an unfulfilled order, and in the case of completed purchases, the deletion of data related to invoicing is excluded by law on the basis of accounting regulations, and if the Data Subject has a debt, it is necessary to process his/her data even in the case of withdrawal of consent on the basis of a legitimate interest in the recovery of the debt.
A request for information sent in e-mail can be considered as official only if – provided it is available for the Controllers – it was sent from the registered e-mail address of the Data subject. The request for information may cover the Data subject’s data managed by the Controllers, its source, the purpose of data management, its legal basis, the period of it, the names and addresses of the possible Data processors, the activities related to the data management, furthremore in case of the transmission of Personal data who and for what purpose received or will receive the data of the Data subject.
After the fulfilment of a request concerning to the cancellation or amendment of a Personal data the former (cancelled) data can not be restored anymore.
12.2. Regarding a query on data management the Controllers shall give the information in a written form upon the request of the Data subject, in a plain form, within the shortest period of time counted from the receipt but latest within 25 days. In case of an e-mail the first working day following the sending shall be considered as the date of receipt.
12.3. About the correction, lockup and cancellation of the Personal data the Data subject furthermore all those persons shall be notified to whom the data has been previously forwarded for the purpose of data management. The notification may be ignored if it does not violate the lawful rights of the Data subject considering the purpose of data management.
12.4. The Data subject is entitled to the cancellation of its Personal data by the Contollers without unjustified delay based upon the Data subjects request, and the Controllers are obligated to cancel the Personal data concerning to the Data subject without unjustified delay – except for the alternate regulation of the law -, in case of any of the following reasons emerge:
a) the Personal data are not needed anymore for the purpose they were collected or managed any other way, or the deadline for Personal data storage determined by the law has been expired;
b) the Personal data is incomplete or wrong and this status can not be corrected in a lawful way, provided that the cancellation is not excluded by the law;
c) the Data subject revokes its permissioin as the basis of data management, and the data management has not other legal basis;
d) the Data subject objects against the data processing and there is no lawful reason having priority for the data processing;
e) the Personal data has been processed illegally;
f) the Personal data shall be cancelled to fulfill the regulations of the law (the cancellation of the Personal data has been ordered by the court or authority).
Provided the Controllers have disclosed the Personal data to public and the Controllers shall cancel such data as written above, then the Controllers shall make the reasonably requestable steps considering the costs of the available technology and implementation – including also the technical measures – to inform the controllers who manage the data that the Data subject has requested the cancellation of the links referring to the Personal data in question or the copies or duplicates of such Personal data.
The terms and conditions determined in the present article are not applicable provided the data management is necessary:
a) to exercise the right to freedom of opinion and expression, and the right to information;
b)for the purpose of fulfilling the obligation of Personal data processing ordered by the law as the obligation of the Controllers, or to execute a task which shall be done arising from public interest;
c) for the purpose of making public interest archives, for scientific or historical research or statistical purposes provided the cancellation of the data would probably make impossible or would seriously jeopardize such data management; or
d) to file legal claims, to enforce or protect such claims.
12.5. Instead of a cancellation the Controllers lock up the Personal data in case of the Data subject requires it, or if it is presumable based upon the available information that the cancellation would violate the lawful rights of the Data subject. The Personal data locked up this way may be processed merely until the purpose of data processing, which excluded the cancellation of the Personal data, exists.
12.6. The Data subject, and all those to whom the Personal data was transmitted previously for the purpose of Processing of data, shall be notified about the correction, lock-up, marking and cancellation. The notification can be skipped by the Controllers if it does not violate the lawful interest of the Data subject considering the purpose of Processing of data.
12.7. Provided the Controllers do not perform the Data subject’s request for correction, lock-up or cancellation so the Controllers shall inform the Data subject within 25 days counted from the receipt of request in a written form about the factual and legal justification why the application for correction, lock-up or cancellation has been rejected, furthermore notifies the Data subject that it may turn to the court or to the Hungarian National Authority for Data Protection and Freedom of Information over against the resolution of the Controllers.
12.8. The Data subject is entitled to a restricted processing of data implemented by the Controllers based upon the request of the Data Subject, provided any of the following conditions are fulfilled:
a) if the Data Subject contests the accuracy, correctness or completeness of the Personal Data processed by the Controller concerned or by a Data Processor acting on its behalf or at its instructions, and the accuracy, correctness or completeness of the processed Personal Data cannot be established beyond reasonable doubt, for the period necessary to resolve the doubt;
b) the procession of data is illegal, and the Data subject objects the cancellation of data, instead of it requests the restriction of their use;
c) the Controller concerned does not need the Personal data anymore for processing of data, but the Data subject claims to get them for the filind, enforcement of protection of a legal claim;
d) the Data subject objected against the processing of data; in this event the restriction concerns to the period of time until it is determined whether the lawful reasons of the Controllers have priority against the lawful reasons of the Data subject or not
e) if the data should be erased but there are reasonable grounds to consider, on the basis of a written declaration by the Data Subject or on the basis of information available to the Controllers, that the erasure of the data would harm the legitimate interests of the Data Subject, for the duration of the legitimate interest not to erase the data;
f) if the data should be erased but are necessary to preserve them as evidence in investigations or proceedings, in particular criminal proceedings, carried out by or with the participation of Controllers or other public authorities, as provided for by law, pending the final or conclusive outcome of such investigations or proceedings;
g) if the data should be erased but must be kept for the purpose of complying with a documentary obligation, for ten years after the erasure of the data processed.
Provided the processing of data is under restrictions, then such Personal data – except for the storage – can be processed only with the approval of the Data subject, or for the filing, enforcement or protection of legal claims, or for the protection of rights of other natural persons or legal entities, or arising from an important public interest of the European Union or any member state.
The Controllers preliminary inform the Data subject – who requested the restrictions of data processing – about the release of data processing restrictions.
12.9. The Data subject may object against the processing of its Personal data,
a) if the procession or transmission of Personal data is necessary only for the fulfilment of the legal obligation to which the Controller is subject or for the enforcement of the Contoller’s, the Personal data recipient’s or third person’s lawful interests, except for a mandatory data processing;
b) if the use or transmission of Personal data happens for the purpose of direct business acquisition, for a survey or for a scientific research; furthermore
c) törvényben meghatározott egyéb esetben. in additional cases determined by staturory law.
The Controllers examine the objection within the shortest period from its receipt but latest within 25 days, decide on its merits and inform the Data subject about their decision in a written form.
In case of the Controllers determine the well-foundedness of the Data subject’s objection, so the Controllers terminate the processing of data – including also the further data recording and transmission -, locks up the Personal data and informs about the objection and about the measures imposed based upon it to whom the Personal data affected by the objection previously has been transmitted, and who are obligated to take measures in favour of the enforcement of the objection right. If the Data subject does not agree with the decision of the Controllers or if the Controller sfail to keep the deadline referred in the present article, then it may to turn to the court within 30 days counted from the disclosure of the decision or from the last day of the deadline.