This is an English translation provided for information. In case of any discrepancy, the Hungarian version prevails.
UOIEA Zrt. (hereinafter: Organisation), in the course of its operation and the operation of hajtetovalas.com (hereinafter: Website), processes the data of natural persons who provide their personal data to the Organisation, visitors to the Website, those who register on the Website, or who provide their personal data in any other way (hereinafter collectively: Data Subject). In connection with the processing of the data, the Organisation hereby informs Data Subjects about the personal data it processes in the above context, the principles and practice it follows in processing personal data, and the ways and possibilities of exercising data subjects’ rights. By giving consent, the Data Subject accepts the contents of this Privacy Policy and consents to the data processing set out below.
1. The Organisation as controller
- Company name
- UOIEA Zrt.
- Registered office, postal address
- 1135 Budapest, Szegedi út 56. D2. I. ház, földszint 2., Hungary
- uoieazrt@gmail.com
- Tax number
- 27449116-2-41
- Company registration number
- 01-10-141567
2. Data protection legislation
In its data processing practice, the Organisation takes into account the relevant legislation in force at any given time. The data processing principles published in this policy are in line with the following legislation:
- Act LXVI of 1992 on the registration of citizens’ personal data and addresses;
- Act CXIX of 1995 on the processing of name and address data for research and direct marketing purposes (DM Act);
- Act CVIII of 2001 on certain issues of electronic commerce services and information society services;
- Act XLVIII of 2008 on the basic conditions and certain restrictions of commercial advertising (Grt.);
- Act CXII of 2011 on the right to informational self-determination and on freedom of information (Infotv.);
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR).
3. Definitions
- 3.1 Personal data
- Any data that can be linked to a natural person (hereinafter: data subject) who is identified or – directly or indirectly – identifiable on the basis of a specific item of personal data – in particular the data subject’s name, identification mark and one or more pieces of knowledge characteristic of their physical, physiological, mental, economic, cultural or social identity – as well as any conclusion drawn from the data concerning the data subject.
- 3.2 Consent
- A voluntary and explicit declaration of the data subject’s will, based on appropriate information, by which they give unambiguous consent to the processing of personal data concerning them – in full or covering certain operations.
- 3.3 Objection
- A declaration of the data subject by which they object to the processing of their personal data and request the termination of the processing or the erasure of the processed data.
- 3.4 Controller
- The natural or legal person or Organisation without legal personality which, alone or jointly with others, determines the purpose of the processing of data, makes and implements decisions regarding the processing (including the means used), or has them implemented by a processor it engages.
- 3.5 Data processing
- Any operation or set of operations performed on data, regardless of the procedure used, in particular collection, recording, organisation, storage, alteration, use, retrieval, transfer, disclosure, alignment or combination, blocking, erasure and destruction, as well as preventing further use of the data, taking photographs, sound or image recordings, and recording physical characteristics suitable for identifying a person (e.g. finger or palm prints, DNA samples, iris images).
- 3.6 Data transfer
- Making data available to a specific third party.
- 3.7 Disclosure
- Making data available to anyone.
- 3.8 Erasure
- Making data unrecognisable in such a way that it can no longer be restored.
- 3.9 Blocking
- Marking data with an identifier in order to restrict its further processing permanently or for a specific period.
- 3.10 Destruction of data
- The complete physical destruction of the data carrier containing the data.
- 3.11 Technical data processing
- Performing technical tasks related to data processing operations, regardless of the method and means used to carry out the operations and the place of application, provided that the technical task is performed on the data.
- 3.12 Processor
- The natural or legal person or Organisation without legal personality which processes data on the basis of its contract with the controller – including contracts concluded under legal provisions.
- 3.13 Third party
- A natural or legal person or Organisation without legal personality that is not the same as the data subject, the controller or the processor.
- 3.14 Third country
- Any state that is not a member of the European Economic Area.
- 3.15 Cookie
- A text file stored on our computer by the website visited, via the internet browser. Its function is to make browsing more convenient and personalised, as it allows various personal data and passwords to be stored. Cookies can also be used to run targeted/personalised advertising campaigns.
4. Principles followed in data processing
Personal data may be processed if
- the data subject has given consent to the processing of their personal data for one or more specific purposes;
- processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract;
- processing is necessary for compliance with a legal obligation to which the controller is subject;
- processing is necessary in order to protect the vital interests of the data subject or of another natural person;
- processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
- processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Personal data may only be processed for a specific purpose, in order to exercise a right and fulfil an obligation. At every stage of processing, the processing must correspond to its purpose, and the collection and processing of the data must be fair and lawful.
Only personal data that is essential for achieving the purpose of the processing and suitable for achieving that purpose may be processed. Personal data may only be processed to the extent and for the duration necessary to achieve the purpose.
During processing, the accuracy, completeness and – where necessary in view of the purpose of the processing – up-to-dateness of the data must be ensured, as well as that the data subject can only be identified for the time necessary for the purpose of the processing. The data subject is responsible for the data provided, its correctness, completeness and authenticity. The Organisation is not liable for damage resulting from incorrectly provided data, even if it could have recognised that the data was incorrect. If the person providing the data acts on behalf of another person, the person providing the data is responsible for having a data protection consent declaration from the data subject on terms identical to those of this Privacy Policy, and the burden of proving this also lies with them.
Personal data may only be processed with consent based on appropriate prior information, unless its processing is required by law or by the legitimate interest of the parties.
The Organisation does not disclose the personal data it processes, does not transfer it to third parties other than the subcontractors mentioned, and the subcontractors are in no way entitled to retain the transferred personal data or transfer it to further third parties.
The controller may transfer personal data to a controller or processor carrying out data processing in a third country if the data subject has expressly consented to it. Data transfers to a state belonging to the European Economic Area must be treated as if they took place within the territory of Hungary.
Before processing begins, the data subject must be informed whether the processing is based on consent or is mandatory. Before processing begins, the data subject must be clearly and thoroughly informed of all facts relating to the processing of their data, in particular the purpose and legal basis of the processing, the persons entitled to process the data, the duration of the processing, and who may have access to the data.
The information must also cover the data subject’s rights and remedies in relation to the processing.
The Organisation ensures the security of the data and takes all technical measures and establishes the procedural rules necessary to implement the data protection provisions, in accordance with the legislation detailed in point 2.
5. Legal basis and purpose of processing
Data is processed with the voluntary consent of the data subjects. Giving consent includes accepting what is described in the privacy policy.
5.1 Data of website visitors
- Purpose of processing
- Ensuring and monitoring the operation of the website, preventing security incidents and evaluating them afterwards.
- Legal basis of processing
- Section 13/A(3) of Act CVIII of 2001 on certain issues of information society services.
- Scope of data processed
- The date and exact time of the visit, the address of the web page visited, the address of the page visited before it, the visitor’s IP address, and data characterising the browser and operating system used.
- Deadline for erasure
- 2 years from the visit.
5.2 Data collection on the website by external Organisations
External Organisations do not collect or process personal data on behalf of the Organisation. The web analytics Organisation, Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043), is only entitled to process data stripped of information referring to individuals on behalf of the Organisation. You can read the data processing guidelines applied at http://www.google.com/intl/hu/privacy/.
5.3 Personal data requested
- Purpose of processing
- Job advertisement for filling a position
- Legal basis of processing
- Voluntary consent of the data subject and legitimate interest – GDPR Article 6(1)(a) and (f)
- Scope and type of data processed
- Data in CVs (name, address, contact details, qualifications, career data, other data provided by the data subject)
- Duration of processing
- Until the position is filled, until erasure on request, or with consent for 6 months
- Possible consequences of not providing the data
- The data subject cannot apply for the advertised job offers.
- Purpose of processing
- Processing of personal data related to business activities
- Legal basis of processing
- Due to a legal obligation – GDPR Article 6(1)(f)
- Scope and type of data processed
- Data of company contact persons (name, address, contact details)
- Duration of processing
- Until erasure on request
- Purpose of processing
- Performing examinations, treatments and operations
- Legal basis of processing
- Due to a legal obligation – GDPR Article 6(1)(c); legitimate interest – GDPR Article 6(1)(f); voluntary consent of the data subject – GDPR Article 6(1)(a); Act CLIV of 1997 on Health, Section 136; Act XLVII of 1997 on the processing and protection of health and related personal data
- Scope and type of data processed
- Personal data of patients (name, address, phone number, email address, outpatient record data; in the case of surgery: anaesthesia record, nursing record, data of preliminary examinations, blood count, imaging examinations, Oncotype DX)
- Duration of processing
- 15 years
- Data subject’s consent requested
- Yes
- Possible consequences of not providing the data
- The data subject cannot use the service.
- Purpose of processing
- Making and maintaining contact
- Legal basis of processing
- Voluntary consent of the data subject – GDPR Article 6(1)(a)
- Scope and type of data processed
- Contact form on the website: name, email address, phone, the message, and any other personal data provided by the data subject
- Duration of processing
- 2 years from the provision of the data, or until erasure on request
- Purpose of processing
- For examinations and operations
- Legal basis of processing
- Due to a legal obligation – GDPR Article 6(1)(c) and legitimate interest – GDPR Article 6(1)(f); Act CLIV of 1997 on Health, Section 136; Act XLVII of 1997 on the processing and protection of health and related personal data
- Scope and type of data processed
- Data of relatives (name, address, contact details)
- Duration of processing
- 15 years
6. Use of cookies on the Organisation’s website
What is a cookie?
Cookies are small text files in which websites store information about visits for a specific period and purpose. On repeat visits, the website can recognise the text file and thus identify the previous visitor.
The primary function of cookies is to make browsing more convenient and personalised, as they allow various personal data and settings to be stored. Cookies can also be used to run well-targeted, personalised advertising campaigns.
Our Organisation currently does not use its own cookies on its website.
(1) Google Analytics
Our website uses the Google Analytics web analytics service of Google Inc. (address: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; hereinafter Google). Google Analytics uses its own cookies – also text files stored on the user’s computer – to analyse how users use the website. The information contained in the cookie describing the use of this website is usually sent to one of Google’s servers in the United States and stored there.
On the basis of our data processing mandate and on our behalf, Google uses the data it receives to analyse the use of the website and to compile reports on website activity, and within the framework of our mandate provides other internet services related to the website to the website operator. Google stores the IP addresses sent by the browser to the Google Analytics service separately from other data. You can prevent cookies from being stored by setting your browser appropriately; and with the browser extension available at http://tools.google.com/dlpage/gaoptout?hl=de you can prevent the data in the cookie describing your use of the website (including your IP address) from being sent to Google, and prevent such data from being processed by Google. You can find information about the general terms of use of Google Analytics at http://www.google.com/analytics/terms/hu.html, and about its privacy policy at http://www.google.com/intl/de/analytics/privacyoverview.html.
(2) Google AdWords
The website uses Google’s analytics service called Google AdWords, including its conversion tracking feature. Google AdWords places a conversion tracking cookie (also known as a click-through or conversion cookie) on the hard drive of the visitor’s computer when the user clicks on an ad served by Google. These cookies expire within 30 days and are not suitable for personal identification. When certain pages of our website are visited, Google and UOIEA Zrt. may track whether the visitor reached our website by clicking on an ad.
Google uses the data obtained through conversion cookies to compile statistical analyses for users of the AdWords conversion tracking feature. These statistics show how many people clicked on an ad served by Google in total, and how many opened our pages while a valid conversion cookie was on their computer. We do not receive data suitable for personally identifying our visitors. We cannot combine this data with our other data in a way that would allow conclusions about a particular user.
7. Persons with access to the data, data transfer, data processing
The data may primarily be accessed by the Organisation, by companies in a contractual relationship with the Organisation for processing the data (recorded in the third-party register and the data asset inventory), and by the Organisation’s internal staff; however, they do not disclose the data or transfer it to third parties. The Organisation may use a processor to achieve the specified purposes.
Beyond the above, personal data concerning the Data Subject may only be transferred in cases mandatorily specified by law or on the basis of the Data Subject’s consent.
8. Possibility of amending the privacy policy
The Organisation reserves the right to amend this privacy policy unilaterally, with prior notice to users. By using the service after the amendment takes effect, you accept the amended privacy policy.
9. Users’ rights regarding the processing of their personal data
The data subject may request information about the processing of their personal data and may request the rectification of their personal data or – except for statutory exceptions – its erasure. At the data subject’s request, the Organisation provides information about the data it processes, the purpose, legal basis and duration of the processing, the name and address (registered office) of the processor and its activities related to the processing, and who received or receives the data and for what purpose. The controller provides the information in writing, in an easily understandable form, as soon as possible after the request is submitted, but within 30 days at the latest. This information is free of charge. Requests for information must be sent by email to uoieazrt@gmail.com, and the data subject will receive a reply within 8 working days.
The data subject may object to the processing of their personal data in a declaration sent to the Organisation at the contact details given in point 14 if they dispute the lawfulness of the processing; in this case, the Organisation notifies the data subject of its decision in writing. If the data subject does not agree with the decision, they may turn to the court (regional court) to enforce their rights.
10. Means of enforcement
The data subject may object to the processing of their personal data
- if the processing or transfer of personal data is necessary solely for compliance with a legal obligation of the controller or for the enforcement of the legitimate interests of the controller, the recipient or a third party, except in the case of mandatory processing;
- if the personal data is used or transferred for direct marketing, public opinion polling or scientific research; and
- in other cases specified by law.
The controller examines the objection as soon as possible after the request is submitted, but within 15 days at the latest, decides whether it is well-founded, and informs the applicant of its decision in writing. If the Organisation establishes that the data subject’s objection is well-founded, it terminates the processing – including further data collection and transfer – blocks the data, and notifies the objection and the measures taken on its basis to all those to whom it previously transferred the personal data concerned by the objection and who are obliged to take measures to enforce the right to object.
If the data subject does not agree with the controller’s decision on the objection, or if the controller misses the 15-day deadline for conducting the examination, the data subject may turn to the court within 30 days of the communication of the decision or of the last day of the deadline.
11. Controller’s declaration
The controller considers the contents of this policy binding on itself and undertakes that its data processing in connection with its service meets the requirements set out in this policy.
12. Legal remedies
The data subject has the following rights and remedies in connection with data processing: the data subject may request information from the Organisation at its contact details (postal address: 1135 Budapest, Szegedi út 56. D2. I. ház, földszint 2., Hungary; email: uoieazrt@gmail.com) about the processing of personal data; in this case, the Organisation provides information about the data it processes, the purpose, legal basis and duration of the processing, and any data processing, or the legal basis and recipient of the data transfer (Infotv. Section 14).
The Organisation must provide the information in writing within 25 days at the latest, and may only refuse it on grounds specified by law.
The data subject may turn to the NAIH with legal remedy claims and complaints:
- Name
- Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian National Authority for Data Protection and Freedom of Information)
- Address
- 1125 Budapest, Szilágyi Erzsébet fasor 22/c, Hungary
- Phone
- +36 (1) 391-1400