Privacy Policy - Realic Books

THE PROTECTION OF NATURAL PERSONS RIGHTS WITH REGARD TO THE PROCESSING OF PERSONAL DATA

INTRODUCTION

Why is this privacy notice made?

During its operation, the Data Controller handles personal data for several purposes, while respecting the rights of the data subjects and fulfilling legal obligations. The Data Controller also considers it important to present to the data subject the handling and the most important characteristics of the personal data that came to the controller’s knowledge during the data processing activities.

What is the legal basis of processing the data subjects’ personal data?

Personal data is only processed for a specific purpose and on an appropriate legal basis. These purposes and legal bases are presented individually, in relation to specific data processing.

What external assistance is used to process your personal data?

Personal data is mostly processed by the Data Controller at own premises. However, there are operations for which a data processor’s external help is necessary. The data processor may change according to the characteristics of each data processing.

Who is processing your personal data?

The data subject may receive information about the data processors employed by the Data Controller and their contact details in section II of this privacy notice.

SECTION I.

NAME OF THE DATA CONTROLLER

The issuer of this privacy notice and the Data Controller:

COMPANY NAME: REALIC INC. MAGYARORSZÁG LTD.

REGISTERED SEAT: 23 Bécsi körút, 6722 Szeged

COMPANY REGISTRATION NUMBER: 06-09-027171

TAX NUMBER: 27402845-2-06

REPRESENTS: Richárd dönczi executive manager

CONTACT: https://realicbooks.com/ under „contact”

(hereinafter: Company)

SECTION II

NAME OF THE DATA PROCESSORS

Data Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller; (Regulation 2016/679 Article 4 8.)

To use a data processor, prior consent from the data subject is not required, but he or she must be notified. Accordingly, the following information is provided:

IT Services:

Company name: Google LLC

Registered seat: Mountain View, California, USA

(it adheres to EU-U.S. PRIVACY SHIELD FRAMEWORK)

Contact: https://mail.google.com/

Company Name: Facebook, Inc.

Registered seat: Menlo Park, California, USA

(it adheres to EU-U.S. PRIVACY SHIELD FRAMEWORK)

Contact: https://www.facebook.com/

Hosting Provider:

COMPANY NAME: EVOLUTIONET KFT.

REGISTERED SEAT: 7342 Mágocs, Széchenyi utca 75.

CONTACT: http://domain-tarhely.net

Online payment service provider:

COMPANY NAME: PayPal (Europe) S.a.r.l.et Cie, S.C.A. and its subsidiaries and affiliated undertakings

CONTACT: https://www.paypal.com/

Data Processor performing accounting and payroll tasks:

company name:

registered seat:

COMPANY REGISTRATION NUMBER:

TAX NUMBER:

Data processor performing invoicing:

COMPANY NAME: KBOSS.HU KERESKEDELMI ÉS SZOLGÁLTATÓ ltd.

REGISTERED SEAT: 7. ZÁHONY STREET, 1031 BUDAPEST

COMPANY REGISTRATION NUMBER: 01-09-303201

TAX NUMBER: 13421739-2-41

CONTACT: https://www.szamlazz.hu/

Data processor performing postal, courier and logistic tasks:

COMPANY NAME: WEBSHIPPY MAGYARORSZÁG LOGISZTIKAI ÉS SZÁLLÍTMÁNYOZÁSI (HUNGARY LOGISTIC AND SHIPPING) ltd.

REGISTERED SEAT: 2151 Fót, 0221/12.

COMPANY REGISTRATION NUMBER: 13-09-213880

TAX NUMBER: 25569421-2-13

CONTACT: https://webshippy.com/

SECTION III.

LAWFULNESS OF PROCESSING

Data processing based on the data subject’s consent

It is considered a statement of consent, if the individual signifies agreement to the processing of personal data relating to him or her, by ticking a box (check-box) on the Company’s website or on any document provided to him or her, also making any technical adjustments related to information society services. This also applies to, any other statement or action, which signifies clearly, the consent of the data subject to the purposed processing of his or her personal data.

In consent-based data collecting, the Data Controller may process the collected data without any further consent of the data subject, and also after the withdrawal of consent, if the processing is necessary for the performance of legal obligations.

Data processing based on performing legal obligations

In the case of data processing based on performing legal obligations, the scope of the data that can be processed, the purpose of the data processing, the duration of data storage and the recipients are governed by the provisions of the underlying legislation.

The processing of personal data for compliance with a legal obligation is based on the regulation, regardless of the consent of the data subject.

In this case, prior to the processing of the data, the data subject shall be informed that the data processing is obligatory and shall be clearly and in detail informed of all facts concerning the processing, in particular the purpose and legal basis of the data processing, the person authorized to handle and process the data, the duration of the data processing, whether the personal data of the data subject are processed by the Data Controller on the basis of the legal obligation applicable to him or her, and who can get access to the data. The information shall include the rights and remedies available to the data subject. In the case of mandatory data processing, the information may also take place with the publication of a reference to the legislative provisions which contain the foregoing information.

Data processing based on legitimate interests

Processing shall be lawful if processing is necessary for the purposes of the legitimate interests pursued by the Company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

Processing personal data for direct marketing purpose and for communication with data subject is considered to be legitimate interest.

Legitimate interest tests have been performed related to data processing based on legitimate interests, which are part of the appendix of this privacy notice. These are available upon request by data subjects.

Data processing for the protection of the vital interests of the data subject or other natural person

The protection of the life or other vital interest of the data subject or the protection of the interest of another natural person may also constitute a legal basis for the processing of data. In the case of a natural person this data processing may happen in the event of taking a medical service or stopping the spreading of epidemics.

Data processing based on contractual interests

Data processing may also be based on a contractual interest if it is necessary for the performance of a contract in which the data subject is a party or if it is requested by the data subject in order to prepare the contract.

Data processing for other purposes

Where the controller intends to further process the personal data for a purpose other than that for which the personal data was collected, the controller shall provide the data subject prior to that further processing with information on that other purpose. If it is necessary, the Company requires the consent of the data subject regarding the new purpose.

Promoting the rights of the data subject

The Company is obliged to ensure the exercise of the rights of the data subject during all data processing.

SECTION IV.

INFORMATION ABOUT DATA PROCESSING BY THE COMPANY

Sending messages, registering on the Company’s website

Natural persons sending messages on the website can give their consent to the processing of their personal data by ticking the appropriate checkbox.

The scope of personal data manageable: the natural person’s name (surname, first name), address, telephone number, e-mail address, online identification, invoicing name, postal name and postal address.

The purpose of processing personal data:

product search, information request, or tender request

The legal basis for data processing is the consent of the data subject.

Duration of storage of personal data: 5 years or until the data subject’s consent is revoked (request for deletion).

Data processing in the Company’s web shop

The book distributed by the Service Provider and the related application is only recommended for persons over 18 years of age.

Minors are not allowed to purchase without the consent of their parents or legal representatives.

The purchase in the web shop operated by the Company qualifies as a contract, according to 13/A.§ of Act CVIII of 2001 on certain issues of electronic commerce services and information society services and to Government Decree 45/2014. (II.26.) on detailed rules governing contract concluded between consumers and businesses. In case of purchasing in the web shop, the legal basis of the data processing is the contract.

In accordance with (1) 13/A of Act CVIII of 2001, for the purposes of creating, defining the content of, amending, monitoring the performance of, invoicing the fees arising from, and enforcing claims related to the service contract concluded for services falling within the category of information society service, the Company may process the personal identification data of natural persons acting as a customer who registers in the web shop. For title of consent, the Company may also process the telephone number, e-mail address, bank account number, online identifier of the customer registering in the web shop.

Pursuant to (2) 13/A of Act CVIII of 2001, for the purpose of invoicing and in relation with the use of information society services, the Company may process the personal identification data of natural persons, the address, delivery address, as well as the data with respect to the date, the duration and the location of the use of the service.

Recipients and categories of recipients of personal data: employees of the Company performing tasks related to customer service, payment, transportation, marketing activities; employees of the Company’s subcontractors performing tax related and accounting services for the purpose of fulfilling tax and accounting obligations, acting as data processors, employees of the Company’s IT service provider in order to provide hosting services; employees of the courier service with respect to delivery data (name, address, telephone number) the Company’s account Manager and the current photographer and video contract partners.

Duration of personal data processing: until the registration/service is maintained or until the withdrawal of the data subject’s consent (request for deletion), in case of purchase, until the end of a term of 8 years following the year of purchase.

When shopping in the web Shop, the Privacy Policy must be available via a link.

Data processing related to the Legend – Between Gods application

In the case of the purchase of the book distributed by the Company, the person over the age of 18 years becomes eligible to download the Legend – Between Gods application free of charge from the AppStore or Google Play.

The scope of personal data manageable: the natural person’s name (nickname), the image of his/her camera, thus the selfie (portrait) taken by him/her.

The purpose of processing personal data: to use the service

The legal basis for data processing: the consent of the data subject.

Duration of storage of personal data: duration of the active existence of the service

Data processing regarding the newsletter service

The natural person representing a legal entity who registers for the newsletter, by ticking the relevant checkbox, acknowledges that for the purposes of newsletter sending, requests for marketing purposes, sending information materials based on the Company’s legitimate and other business interest and based on the data subject’s consent, the Company processes the data subject’s data for the duration of the active existence of the service or until the data subject’s request for deletion (request for deletion sent by email) arrives.

It is forbidden to tick the checkbox in advance. The data subject may unsubscribe from the newsletter at any time by giving a written statement or a statement by email. In this case, all the data of the data subject must be deleted immediately.

The scope of personal data manageable: the natural person’s name (surname, first name) and e-mail address

The purpose of processing personal data:

Sending newsletter regarding the products and services of the Company
Sending commercial and information material
Request for marketing purposes

Legal basis of data processing: consent of the data subject, legitimate interest of the data controller. Based on the proportionality test, the Company’s interest for direct marketing purposes (Preamble 47, GDPR) – given that it is a business company – is greater than the risk posed by the processing of personal data related to the newsletter service. Legal consequence of not giving consent: no service provided.

Duration of storage of personal data: until the newsletter service is active or until the withdrawal of the data subject’s consent (request for deletion).

Data processing according to social media (Facebook, Instagram)

The Data Controller manages its own page on Facebook and on Instagram. The data subject could subscribe to the Facebook News Feed of the Company by clicking the “Like” button on the page and follow the Company’s page on Instagram by clicking the „Follow” button.

Purpose of personal data processing: information about the current news and information regarding the Data Controller

Legal basis of data processing: freely given consent of the data subject (Facebook’s/Insagram’s privacy policy)

Categories of processed personal data: name of the data subject

Period for which the personal data are stored: The data subject may unsubscribe from the Facebook News Feed of the Law Firm by clicking the “Dislike” button on the page or delete the unwanted content appearing on his or her News Feed in Settings. The data subject may click the „Unfollow” button to stop following the Company.

Data processing related to the organization of promotional draws

If the company organizes a promotional draw (Section 23 of Act XXXIV of 1991), based on the consent of the data subject natural person, the Company may process his/her name, address, telephone number, email address, online identification, and tax identification number. Participation in the game is voluntary. The consent for data processing is given by accepting these rules and participating in the game.

The purpose of the processing of personal data: to determine and notify the winner of the promotional draw, to send the prize, to make a request for marketing purposes, to send information materials. Legal basis for data processing: consent of the data subject.

Recipients of personal data and categories of recipients: employees of the Company performing tasks in customer service and marketing activities, data processors of the Company as data processors, especially the IT service provider of the Company, employees performing accounting, employees of the courier service and the other data processors mentioned in the Privacy Notice. The Company may display the names of the winners on Facebook, Instagram with the explicit consent of the data subject, drawing the attention of the data subject to the fact that the news may be shared by others. On social media, implied behavior can be considered as giving consent.

Duration of storage of personal data: 5 years and in case of the personal data of the winner, for the purpose of keeping accounting documents, 8 years.

Data processing regarding personal data of customers, contract partners and their contacts

If the Company and its business partner make a contract, the parties shall name the contact person and his or her address in the contract.

Purpose of personal data processing: business partnership, fulfillment of the provisions of the contracts

Legal basis of data processing: the data processing is necessary to fulfill a contractual obligation

Categories of processed personal data: the data subjects’ name, address, phone number, job title, and e-mail address

Period for which the personal data are stored: 5 years from the termination of contract, and/or the statutory retention period

Cookie policy on the website of the Company

Cookies are text files with small pieces of data, that are stored in the user’s computer or phone (HDD, SSD) until their expiration date, and if a user returns to that site in the future, the web browser returns that data to the web server. Their purpose is to store data regarding visiting the website, and personal adjustments, but these are not personal data of the user. Cookies help to create a user friendly website and to improve the user’s experience. If the user does not agree to use cookies, the use of the website will be intermitted.

Purpose of personal data processing: improvement in user’s internet experience, storage of personal adjustments

Legal basis of data processing: the data subject’s freely given consent

Categories of processed personal data: the Data Controller stores every analytical information without name or any other personal data

Period for which the personal data are stored: The data subject can delete the cookies anytime on his or her computer or phone

Data processing of applicants’ personal data, accordingly their CV and application

The Law Firm processes the CVs sent to it and personal data given in it, based on the consent of the data subject (even by implicit conduct)

Categories of processed personal data: the natural person’s name, place and date of birth, mother’s name, address, educational attainment, photo, phone number, e-mail address, employers’ opinion (if it is available), CV, and personal data in these documents

Purpose of personal data processing: application, assessment of the application and to make an employment contract

Recipients of personal data, and categories of recipients: the employer at the Law Firm who exercises employer’s rights, and other employees dealing with labour related tasks

Period for which the personal data are stored: 5 years from the application and assessment of the application. The personal data of applicants not chosen to contract must be removed after 5 years, this also pertains to the personal data of an applicant who has withdrawn his or her application. Storing personal data after 5 years has to be consent-based.

If the applicant does not give his or her consent, he or she shall not be chosen to make an employer contract.

SECTION V.

INFORMATION ABOUT THE RIGHTS OF DATA SUBJECT

You can find further information about the rights of the data subject in General Data Protection Regulation (https://eur-lex.europa.eu/legal-content/HU/TXT/HTML/?uri=CELEX:32016R0679)

Information and access to personal data (Article 13 and 14)
Right of access by the data subject (Article 15)
Right to rectification (Article 16)
Right to erasure (‘right to be forgotten’ – Article 17)
Right to restriction of processing (Article 18)
Right to data portability (Article 20)
Right to object (Article 21)
Right to not be subject to automated individual decision-making, including profiling (Article 22),
Right for remedies (Article 77-82).
Right to lodge a complaint with a supervisory authority:

Every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes General Data Protection Regulation. You can find further information about remedies under Article 77.

Contact of the supervisory authority:

The National Authority for Data Protection and Freedom of Information

Registered seat: 9-11. Falk Miksa Street, Budapest, 1055 HUNGARY

Postal address: 1363 Budapest, Pf.: 9.

Phone number: +36 (1) 391-1400

E-mail address: ugyfelszolgalat@naih.hu

Place and date:

Szeged,

REALIC INC. MAGYARORSZÁG LTD.

2013