Data Processing Policy
WABERER’S INTERNATIONAL Nyrt. (the ‘Data Controller’), as the operator of the website accessible under the domain name www.waberers.com (the ‘Website’), hereby publishes its policy on data processing performed as part of sending out investment newsletters associated with the Website (the ‘Newsletter’).
By subscribing to the Newsletter, the users visiting the Website (the ‘User’) accept all terms of this Data Processing Policy (the ‘Policy’). Therefore, please read this Policy carefully before using the Website.
1. Data Controller’s details
The Data Controller is WABERER'S INTERNATIONAL Nyrt.
Registered office: 1239 Budapest, Nagykőrösi út 351., Hungary
Represented by: Tamás Fejes
Phone: +36 (1) 421-6300 (central number)
Data processing registration No: NAIH-142906/2018.
2. Scope of the data processed
Subscription to the Newsletter:
On the Website, the User may subscribe only to the Newsletter of the Data Controller on a dedicated interface. For subscription to the Newsletter, the following personal data need to be provided (it is mandatory to provide the data marked with an asterisk):
- full name*,
- company name,
- email address*,
- Waberer’s contact.
Only persons over 18 years of age are entitled to provide data on the Website.
3. Purpose and duration of data processing
The Data Controller may use the data for the following purposes in the event of subscription to the Newsletter:
In case of subscription: Sending offers, news related with the Data processor and communications via electronic newsletter at the specified e-mail address given by the subscriber.
The Data Controller processes the personal data when the purpose of data processing exists and until the User withdraws his or her consent to receiving Newsletters. The personal data will be deleted without delay at the same time as the cessation of the purpose of data processing upon the expiry of the deadline specified in this section or at the request of the User.
4. Legal basis for the processing of personal data
When subscribing to the Newsletter, Users consent to the processing of their personal data by the Data Controller as set out in this Policy. The processing of personal data is based on the User’s voluntary consent granted in the knowledge of the information provided in this Policy.
Users may only enter their own personal data in the Website. If they do not provide their own personal data, the data provider is obliged to obtain the consent of the person concerned.
5. Scope of those entitled to become familiar with personal data and data processing
The Data Controller and the Data Processors used by it are entitled to become familiar with personal data in accordance with the legislation in force.
Processing of data is performed by the following data processor acting on behalf of the Data Controller:
- SalesAutopilot Kft.
Registered office: 1024 Budapest, Margit körút 31-33. félemelet 4-5.
The Data Controller reserves the right to involve a Data Processor in data processing in the future, about which it will inform the Users by amending this Policy.
Unless expressly otherwise provided by law, the Data Controller will disclose data suitable for personal identification to third parties only with the express consent of the given User.
6. User’s rights
Access to personal data
At the request of the User, the Data Controller provides information on whether the Data Controller processes his or her personal data and, if so, he or she grants it access to the personal data and provides it the following information:
- purpose(s) of data processing;
- types of personal data affected by data processing;
- if the User’s personal data are transmitted, the legal basis for and recipient(s) of data transmission;
- planned duration of data processing;
- the User’s rights relating to the rectification, erasure and restriction of processing of personal data as well as objection to the processing of personal data;
- possibility of turning to the authority;
- source of the data;
- material information relating to profiling;
- name and address of the Data Processors and their activities relating to data processing.
The Data Controller makes available a copy of the personal data constituting the subject-matter of data processing to the User free of charge. The Data Controller may charge a reasonable fee based on its administrative costs for additional copies requested by the User. If the User submitted a request electronically, the information has to be made available in a widely used electronic format unless otherwise requested in the Data Subject.
The Data Controller is obliged to provide the information in a non-technical form at the request of the User without undue delay, but not later than within 25 days from the date of the request. The User may submit his or her request for access to the contact points specified in Section 1.
Rectification of processed data
The User may request (at the contact points specified in Section 1) that the Data Controller rectify his or her inaccurate personal data or supplement incomplete data, subject to the purpose of data processing. The Data Controller carries out the rectification without undue delay.
Erasure (right to be forgotten) and blocking of processed data
The User may request that the Data Controller erase the personal data relating to him or her without undue delay, and the Data Controller is obliged to erase the personal data relating to the Data Subject without undue delay if one of the following reasons exists:
- the personal data are no longer needed for the purpose for which they have been collected or otherwise processed;
- the User withdraws his or her consent and there is no other legal basis for data processing;
- the User objects to the processing of his or her personal data;
- the personal data have been processed unlawfully;
- the personal data have to be erased for the fulfilment of a legal obligation prescribed in EU or national law applicable to the Data Controller;
- the personal data have been collected on the basis of consent in connection with offering information society-related services to children.
If the Data Controller has published personal data (made them available to a third party) and is obliged to delete them pursuant to the above, it has to take reasonable steps and measures, subject to the available technology and the costs of implementation, in order to inform the Data Controllers processing relevant personal data that the User has requested that they erase the links to the personal data in question or a copy or duplicate of such personal data.
Personal data need not be erased if data processing is required for:
- the freedom of expression and the exercise of the right to be informed;
- fulfilling an obligation under EU or national law prescribing the processing of personal data and applicable to the Data Controller or for performing tasks carried out in the public
- interest or in the exercise of public powers vested in the Data Controller;
- on the basis of public interest in the field of public health care;
- for the purposes of public archiving, scientific and historical research or statistics if the right to erasure is likely to make it impossible or seriously jeopardise such data processing; or
- for submitting, enforcing or protecting legal claims.
Restriction of processed data
The User is entitled to request that the Data Controller restrict the processing of data instead of rectifying or erasing the personal data if one of the following conditions is fulfilled:
- the User disputes the accuracy of the personal data; in this case, the restriction applies to the period that allows the Data Controller to check the accuracy of the personal data;
- data processing is unlawful, the User opposes the deletion of data, and instead he or she requests that their use be restricted;
- the Data Controller no longer needs the personal data for data processing, but the User requests them for submitting, enforcing or protecting legal claims; or
- the User has objected to data processing; in this case, the restriction applies as long as it is established whether the legitimate reasons of the Data Controller take precedence over to the Data Subject’s legitimate reasons.
If data processing is subject to restriction, such personal data may only be processed, except for their storage, with the User’s consent or for submitting, enforcing or protecting legal claims or for protecting the rights of other natural persons or legal entities or in an important public interest of the EU or a Member State.
The Data Controller informs the User at the request of whom data processing has been restricted, in advance, about lifting the restriction of data processing.
Obligation to notify of the rectification or erasure of personal data or the restriction of data processing
The Data Controller notifies every recipient to whom or which personal data have been disclosed of the rectification or erasure of personal data or the restriction of data processing unless this proves impossible or involves a disproportionate effort. At his or her request, the Data Controller informs the User about such recipients.
Right to object
The User may object to the processing of his or her personal data if the data processing:
- is necessary for performing a task carried out in the public interest or in the exercise of public powers vested in the Data Controller;
- is necessary for enforcing the legitimate interests of the Data Controller or a third party;
- is based on profiling.
If the User objects, the Data Controller may not continue to process the personal data unless it proves that data processing is warranted by compelling legitimate grounds, which take precedence over the User’s interests, rights and freedoms or which are related to the submission, enforcement or protection of legal claims.
If personal data are processed for direct marketing purposes and related profiling, the User is entitled at any time to object to the processing of his or her personal data for this purpose. If the User objects to the processing of personal data for direct marketing purposes, the personal data may no longer be processed for such purposes.
The Data Controller informs the User about the measures taken after his or her request for access, rectification, erasure, restriction, objection and data portability without undue delay, but not later than within 25 days of receipt of the request. If necessary, taking into account the complexity of the request and the number of requests, this deadline may be extended by an additional 2 months. The Data Controller informs the User about the extension of the deadline with an indication of the reasons for the delay within 1 month of receipt of the request. If the User submitted the request electronically, the information has to be given as far as possible electronically unless the Data Subject requests otherwise.
If the Data Controller does not take action after receiving the User’s request, it will inform the User without delay, but not later than 25 days of receipt of the request about the reasons for not taking action and the fact that the User may lodge a complaint with a supervisory authority and may exercise the right of judicial remedy before the court.
Upon request by the User, the information and the action taken on the basis of his or her request has to be provided free of charge. If the User’s request is clearly unfounded or is excessive, in particular, because of its recurring nature, the Data Controller may, subject to the administrative costs incurred in providing the requested information or taking the requested action, charge a fee of a reasonable amount or may deny taking action on the basis of the request. The Data Controller is bound to prove the clearly unfounded or excessive nature of the request.
The Data Controller does not assume liability for the contents and data and information protection practice of external websites that can be accessed from the Website through links. If the Data Controller becomes aware that a page linked by it or the link itself infringes third party rights or violates the legislation in force, it will immediately remove the link from the Website.
8. Data security
The Data Controller undertakes to ensure the security of data and takes the technical and organisational measures and devise the rules of procedure that ensure that the recorded, stored and processed data are protected, and prevents their destruction, unauthorised use and unauthorised alteration. It also undertakes to call upon any third party to whom or which it transmits or discloses data on the basis of the consent of the Users to meet the data security requirements.
The Data Controller ensures that no unauthorised person has access to, is able to disclose, transmits, modifies or erases the data processed. Only the Data Controller, its employees and the Data Processor engaged by it may become familiar with the processed data. The Data Controller may not disclose them to third parties that are not authorised to become familiar with the data.
The Data Controller will use its best efforts to ensure that the data are not accidentally damaged or destroyed. The Data Controller prescribes the above commitment to its employees participating in its data processing activity.
The User acknowledges and accepts that if his or her personal data are entered in the Website, notwithstanding that the Data Controller has advanced security tools to prevent unauthorised access to or interception of the data, the protection of the data cannot be fully guaranteed on the internet. Should unauthorised access or data disclosure occur despite our efforts, the Data Controller is not responsible for such disclosure or unauthorised access or for any damage incurred by the User for this reason. In addition, the User may also provide his or her personal data to third parties who may use it for unlawful purposes or in an unlawful manner.
Under no circumstances may the Data Controller collect special data, i.e. data that relate to race, national or ethnic minority status, political opinion or party affiliation, religious or other beliefs, membership in advocacy organisations, health status, addictions, sexual life or criminal record.
9. Handling and reporting of personal data breach
Personal data breach means any event that results in the unlawful management or processing of personal data in respect of personal data managed, transmitted, stored or processed by the Data Controller, in particular, unauthorised or accidental access to, or the alteration, disclosure, erasure, loss or destruction of data, as well as the accidental destruction of and damage to data.
The Data Controller is obliged, without undue delay, but not later than 72 hours after it became aware of a personal data breach, to report the personal data breach to the National Authority for Data Protection and Freedom of Information unless the Data Controller can prove that the personal data breach is not likely to involve a risk to the rights and freedoms of natural persons. If the report cannot be filed within 72 hours, it has to include the reason for the delay and the required information may also be stated in parts, without further undue delay. The report filed with the National Authority for Data Protection and Freedom of Information should include at least the following information:
- nature of the personal data breach, number and category of Data Subjects and personal data;
- name and contact details of the Data Controller;
- probable consequences of the personal data breach;
- measures taken or planned to deal with, eliminate and remedy the personal data breach.
The Data Controller informs the Data Subjects about the personal data breach via the Website of the Data Controller within 72 hours following the personal data breach. The information has to contain at least the details specified in this section.
The Data Controller keeps a record of personal data breaches in order to check the measures relating to the personal data breaches and to provide information to the Data Subjects. The record contains the following details:
- scope of the personal data concerned;
- scope and number of the Data Subjects;
- date of the personal data breach;
- circumstances and effects of the personal data breach;
- measures taken to eliminate the personal data breach.
The Data Controller keeps the data contained in the record for 5 years of detecting the personal data breach.
10. Right enforcement options
The Data Controller uses its best efforts to ensure that personal data are processed in accordance with the legislation. If, however, the User feels that it did not meet this requirement, he or she may write to the firstname.lastname@example.org email address or to the 1239 Budapest, Nagykőrösi út 351., Hungary postal address.
If the User feels that his or her right to the protection of personal data has been violated, he or she may seek legal remedy with the competent bodies in accordance with the governing legislation:
- National Authority for Data Protection and Freedom of Information (address: 1125 Budapest, Szilágyi Erzsébet fasor 22/C, Hungary; email@example.com; www.naih.hu)
- the court.
11. Other provisions
This Policy is governed by the laws of Hungary, in particular, Act CXII of 2011 on the right to informational self-determination and freedom of information and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
Budapest, May 2018
WABERER’S INTERNATIONAL Nyrt.