Information on data processing
INTRODUCTION
The present information sheet serves the purpose of providing adequate information to the data subjects by the Company on the relevant circumstances of data processing and on the rights of the data subjects, while complying with the obligations arising from Articles 13 and 14 of the Regulation[1] regarding the provision of information.
The present information sheet is available continuously on the website of the Company (www.pallasathenekiado.hu) and will be sent directly to the data subjects by the Company at request in such regard.
CHAPTER I
DATA OF THE CONTROLLER
Issuer of the present information sheet and Controller:
Company name: Pallas Athéné Könyvkiadó Kft.
Registered seat: H-1014 Budapest, Úri utca 21.
Company registration number: 01-09-303681
Tax number: 26133454-2-41
Representative regarding processing activities: Dr. Cseh, Katinka CEO
Email: info@pallasathenekiado.hu
Web: www.pallasathenekiado.hu
(Hereinafter: Company)
CHAPTER II
DATA OF THE PROCESSORS
As regards the present information, ?processor? means a legal person which processes personal data on behalf of the Company as controller.
For the involvement of a processor by the Company, no prior consent of the data subject shall be required, but the data subject shall be informed of such fact. Accordingly, we hereby provide the following information on the processors involved in the processing activities concerning the personal data processed by the Company:
The accounting service provider of the company
For the purpose of complying with the obligations of the Company as regards taxation and accounting (being also the purpose of the concerned processing activity), an external accounting service provider and a payroll company acting as a subcontractor thereof are involved by the Company, which service providers carry out activities as data processors regarding the personal data of the natural persons being in employment or other contractual relationship (typically by means of agency contract) with the Company.
The data of such processor are indicated below:
Accounting service provider
Company name: OPTIMA Befektetési Zrt.
Registered seat: H-1013 Budapest, Döbrentei utca 2.
Company registration number: 01-10-048464
Tax number: 25294848-2-41
Representative: dr. Fekete, Zoltán CEO
Email: info@optimabudapest.hu
Payroll company:
Company name: RUHAN Számviteli és Munkaügyi Kft.
Registered seat: H-2092 Budakeszi, Knáb János utca 38.
Company registration number: 13-09-134511
Tax number: 11735036-2-13
Representative Varga, Anikó managing director
Email: anikoridacs@t-online.hu
CHAPTER III
PROCESSING BASED ON CONSENT
The consent of the data subject may be the legal basis of processing exclusively where nor the performance of a contract, neither compliance with a legal obligation, neither the pursuance of a legitimate interest serves as the legal basis of the processing of personal data in compliance with purpose limitation.
Where processing based on consent is carried out, the consent of the data subject regarding the processing of his or her personal data (surname, first name, email address) is requested on the Company?s website.
Active approval given to the present information on data processing, available on the said link, by the data subject is a prerequisite to downloading.
The purpose of processing is to provide subsequent advantages to the user in relation to the Company?s activities (e.g. gifts, priority at registration to events).
Period of processing: the data provided by the user shall be erased in case the period of two passive years elapses. The data of the data subject shall be no longer processed and shall be erased if requested so by the data subject or if the data subject withdraws his or her consent.
The consent shall cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them.
Regarding the processing activities of the Company, consent may not be given by a written statement covering also different matters.
The data subject may withdraw his or her consent by any statement sent to the Company via email, or by oral communication to an employee of the Company acting in the scope of activities thereof. Where the consent is withdrawn by oral communication, the concerned employee shall inform the respective managing director of the Company in writing, providing all relevant information, particularly the data subject?s name and email address, and the date of the withdrawal.
If the personal data were collected on the basis of the data subject?s consent, unless otherwise provided by law, the controller shall be entitled process such data for the purpose of compliance with a legal obligation also without a separate consent.
CHAPTER IV
Community directives / Data processing on the Company?s Facebook Page
General rules
The Company has a Facebook and an Instagram Page for the purpose of promoting its publishing activities, as well as promoting and providing information on its events and book launches. The personal data disclosed by the visitors on the Facebook and Instagram Page of the Company are not processed by the Company, the terms of service and privacy policy of Facebook and Instagram shall be applicable respectively to such data. The Company shall not be liable for any data or comments disclosed with the breach of law by visitors.
CHAPTER V
SUMMARY INFORMATION ON THE RIGHTS OF THE DATA SUBJECTS
The data subject?s right to proper information
The Company?s general information on data processing is made continuously available by the Company on its website (www.pallasathenekiado.hu), and will be sent individually to data subjects at such request. The purpose of the said information sheet is to provide, in a public and available manner, clear and detailed information to the data subjects prior to and during the processing regarding all facts in relation thereto, particularly on the purpose and legal basis of the processing, the data of the controller and the processor, the period of processing, the legal basis on which the Company processes their personal data and the persons entitled to access the data. The information shall cover the data subject?s rights regarding the processing and the available remedies.
Right to prior information
The data subject has the right to be provided with information on the facts and information related to the processing prior to the commencement of the processing.
Right to access
The data subject shall have the right to obtain from the Company confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the information related to the processing.
Right to rectification
The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Right to erasure (?right to be forgotten?)
The data subject shall have the right to obtain from the Company the erasure of personal data concerning him or her without undue delay if
- a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- b) the data subject withdraws consent on which the processing is based and there is no other legal ground for the processing;
- c) the data subject objects to the processing and there are no overriding legitimate grounds for the processing;
- d) the personal data have been unlawfully processed;
- e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the Company is subject;
- f) the personal data have been collected in relation to the offer of information society services.
Right to restriction of processing
The data subject shall have the right to obtain from the controller restriction of processing if
- a) the accuracy of the personal data is contested by the data subject, for a period enabling the Company to verify the accuracy of the personal data;
- b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
- c) the Company no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; or
- d) the data subject has objected to processing; in such case, the restriction shall apply to the period of the verification whether the legitimate grounds of the Company override those of the data subject.
The Company shall communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The Company shall inform the data subject about those recipients if the data subject requests it.
Right to object
The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or for the purposes of the legitimate interests pursued by the controller or by a third party. In such case, the Company shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
Where personal data are processed for scientific or historical research purposes or statistical purposes, the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
Restrictions
Union or Member State law to which the Company or the processor in contractual relationship therewith is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in the Regulation for the reason stipulated therein.
Notifying the data subject of any personal data breaches
Where the personal data breach is likely to result in a high risk to the rights and freedoms of the data subject, the Company shall communicate to the data subject a personal data breach without undue delay.
Such communication shall describe in clear and plain language the nature of the personal data breach, the likely consequences thereof and the measures taken or proposed to be taken by the Company to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
The said communication provided to the data subject may be dispensed with if:
- a) the Company has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption;
- b) the Company has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects is no longer likely to materialise;
- c) it would involve disproportionate effort ? in such a case, there shall instead be a public communication or similar measure whereby the data subjects are informed in an equally effective manner.
Right to lodge a complaint with a supervisory authority (right to administrative remedy)
Every data subject shall have the right to lodge a complaint with a supervisory authority, if the he or she considers that the processing of personal data relating to him or her infringes the Regulation.
Each data subject shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them, or where the supervisory authority does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged.
data of the supervisory authority:
Hungarian National Authority for Data Protection and Freedom of Information
Postal address: H-1530 Budapest, Pf.: 5.
Email: ugyfelszolgalat@naih.hu
Phone: +36 (1) 391-1400
Right to an effective judicial remedy against the controller or the processor
Each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights have been infringed as a result of the processing of his or her personal data in non-compliance with the Regulation.
Information to be provided where personal data are collected from the data subject
- Where personal data relating to a data subject are collected from the data subject, the Company shall, at the time when personal data are obtained, provide the data subject with all of the following information:
- a) the identity and the contact details of the controller and of the controller’s representative pursuant to CHAPTER I;
- b) in accordance with Paragraph (1) of Article 37 of the Regulation, no data protection officer was appointed at the Company;
- c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing, along with indicating the legitimate interest where the legal basis of the processing is such legitimate interest pursuant to the present information sheet;
- e) the recipients or categories of recipients of the personal data, if any;
- f) the fact that the controller does not intend to transfer personal data to a third country or international organisation;
- g) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
- h) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing, but the data subject has no right to data portability, since no automated processing is carried out by the Company;
- i) where the processing is based on the consent of the data subject, the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
- k) the right to lodge a complaint with a supervisory authority;
- l) the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data;
m) no automated processing is carried out by the Company;
- n) the Company does not intend to further process the personal data for a purpose other than that for which the personal data were collected;
CHAPTER VI.
SUBMISSION OF THE DATA SUBJECT?S REQUEST,
ACTIONS TAKEN BY THE CONTROLLER
Actions taken on the basis of the data subject?s request
The Company as data controller shall provide information on action taken on a request submitted by the data subject regarding exercising his or her rights without undue delay and in any event within 8 days of receipt of the request.
Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.
Where the Company has reasonable doubts concerning the identity of the natural person making the request, the controller may request the provision of additional information necessary to confirm the identity of the data subject.
Pallas Athéné Könyvkiadó Kft.
[1] REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data, on the free movement of such data, and repealing Directive 95/46/EC