Privacy Policy – Suppliers

Company Kifli.hu Shop Kft, 1106 Budapest Jászberényi út 45, Cégjegyzékszám: 01-09-339560 (also referred to as “we/our”), as a data controller, informs you,  as our contractual partner or potential contractual partner about the processing of personal data and privacy protection described below.
In the following text you will namely find out:

1. Which of your personal data will be processed;
2. For what purpose and by what means we will process your personal data;
3. To whom your personal data may be transferred;
4. For how long we will process your personal data;
5. What your rights are in relation to the protection of your personal data.

Please feel free to contact us at our e-mail address info@kifli.hu at any time if you need any explanation or advice regarding any part of the text or if you want to discuss further processing of your data.

1. Scope of personal data processing

1.1. If you are our business partner (private individual), we process your personal data that we need for the proper performance of our contractual obligations and to comply with our legal obligations in connection with the performance of the contract (tax and accounting obligations as per Sections 78 (3) and 202 of the Act no. CL of 2017 on Taxation and Section 169 (2) of the Act no. C of 2000 on Accounting). These data may include in particular:

1. name and surname;
2. contact address;
3. business name;
4. registered office address;
5. identification number and tax identification number;
6. telephone number; or
7. e-mail address.

Personal data under clauses a)-g) above are processed based on Article 6 (1) b) of the GDPR (performance of a contract), and the personal data under clauses a), c)-e) are processed based on Article 6 (1) c) of the GDPR (complying with legal obligations). If you do not provide us with the above data, no contract can be concluded.

 

1.2. If you are our business partner (legal entity), we process personal data of your contact persons that you voluntarily provide to us that we need for the proper performance of our contractual obligations. These data include:

1. name and surname;
2. telephone number;
3. e-mail address.

Personal data are processed based on Article 6 (1) f) of the GDPR (our and our contractual partner's legitimate interest). Our legitimate interest lies in our being able to perform the contract (via keeping contact with the contact person). The respective balancing test has been prepared.

1.3. If you wish to become our business partner and you provide us with your data for this purpose, for example via an electronic form located on the website, we process all your data that you voluntarily provide us with in this manner based on your request for the purpose of concluding a contract in the future. Typically, this will include data to the extent of:

1. (contact person’s) name and surname;
2. address;
3. business name;
4. registered office;
5. identification number and tax identification number;
6. telephone number;
7. e-mail address;
8. comments and messages, if any.

Personal data are processed based on Article 6 (1) b) of the GDPR (to take steps at the request of the data subject prior to entering into a contract).

 

2. Who has access to your personal data

We, as the data controller, will process your personal data. We will only disclose your personal data to authorised employees and cooperating persons or individual data processors contracted by us or to other data controllers, but only to the extent necessary to fulfil the individual purposes and on the corresponding legal ground for the processing of personal data. These include, for example:

 

• external accounting firms;
• external law firms;
• processors who provide us with server, web, cloud, marketing or IT services.

 

3. Period of personal data processing

We will process your personal data for the period of time determined by the purpose of the processing.

3.1. If the contract is concluded with a private individual, we process the data for the term of the contract. Following this, we store exclusively those data and exclusively for the time period that is justified by the purpose of satisfying our legal obligation. Under the tax legislation, the tax law limitation period is 5 years, according to the act on accounting, it is 8 years, and the general civil law limitation period is 5 years. If there is a legal dispute between the parties, processing will take place until the final completion of the case.

3.2 If the contract is concluded with a legal entity, we process the relevant contact details of the contact person for a period of 12 months after termination of the contract or 12 months following the date that he/she ceased to be a contact person.

If there is a dispute between the parties, the relevant data can be processed until its final resolution.

3.3. For the purpose of negotiating a contract (1.3 above), if, as a result of the negotiations, a contract is concluded, we will process the data for a period as indicated in Section 3.1 above. If, as a result of the negotiations, no contract is concluded, then we will process the data for a period of 6 months from the end of the negotiations (the respective balancing test has been prepared). If there is a legal dispute, processing will take place until the final completion of the case.

4. Personal data of third parties

Personal data of third parties, which means the personal data of employees and customers of our suppliers and other individuals involved in cooperation with us, or other data that we receive in connection with the conclusion or performance of a contract (such as e.g. the following data: name and surname, e-mail, telephone number), will be processed in accordance with applicable personal data protection legislation. We will use these personal data for the purpose of performing contracts based on our (and our contractual partner’s) legitimate interest (Article 6 (1) f) of the GDPR). Our legitimate interest lies in our being able to perform the contract (we will only process such personal data the processing of which is necessary for the performance of the contract). The respective balancing test has been prepared. We will process the personal data of third parties for as long as necessary based on the relevant contract, typically, for the duration of the contractual relationship and for the period of time stipulated by special legislation (for a period of eight years as per Article 169 (2) of the Accounting Act). They will then be retained for a longer period of time if there is a justified need to retain the data in connection with a specific case (e.g., if there is a legal dispute or authority procedure in place, then processing will take place until the final completion of the case).

5. Cookies

Cookies are small text files containing short data that can be stored on the user’s device when visiting a website. We use cookies on our website for the following purposes:

• remembering the logged-in user;
• convenient web features;
• anonymised evaluation of users’ movements on the website;
• obtaining voluntary feedback from users; and
• ads serving personalisation.

All personal data are processed in a lawful and transparent manner and only adequate, relevant and necessary data are requested in relation to the purposes of the processing.

You can reject cookies in the settings of your internet browser, or you can set the use of only some of them. You can find how to set cookies in the most frequently used browsers at the following links:

• Chrome
• Firefox
• Internet Explorer
• Opera
• Microsoft Edge

6. Your rights arising from the processing of personal data

As a data subject, you have certain rights in connection with the processing of personal data, which result from applicable laws and which you may exercise at any time. These rights include

1. 1. the right of access to personal data,
   2. the right to rectification of inaccurate personal data and to completion of incomplete personal data,
   3. the right to erasure of personal data if the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed, or if it is established that the personal data have been unlawfully processed,
   4. the right to restriction of processing,
   5. the right to data portability,
   6. the right to object to processing of personal data whereupon the processing will be discontinued, unless compelling legitimate grounds for the processing demonstrably exist which override the interests, rights and freedoms of the data subject, in particular where such grounds include the exercise of legal claims, and
   7. the right to turn to the data protection authority.

Right of access to personal data: If you wish to know whether we are processing your personal data, you have the right to obtain information as to whether or not your personal data are being processed and, where that is the case, you also have the right to obtain access to your personal data.

Right to rectification of inaccurate personal data and to completion of incomplete personal data: If you think that we are processing personal data about you which are inaccurate or incomplete, you have the right to request their rectification and/or completion. We will rectify or complete the data without undue delay, taking into account technological capacities.

Right to erasure: If you request erasure, we will erase your personal data if (i) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed, (ii) the personal data have been unlawfully processed, (iii) you object to the processing and there are no overriding legitimate grounds for the processing of your personal data, or (iv) the legal obligation in EU or national law to process personal data no longer applies.

Right to restriction of processing: You can request restriction of processing, where, for example

 you contest the accuracy of the personal data (in which case restriction lasts for a period enabling us to verify the accuracy of the personal data),

 we no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims or

you have objected to processing (in which case, restriction lasts until the verification whether our legitimate grounds override yours).

 

Right to data portability: If you wish us to transfer to a third party the personal data, we are processing about you electronically on the basis of a contract or your consent, you may exercise your right to data portability. In the event the exercise of this right adversely affects the rights and freedoms of others, we will not be able to act on your request.

Right to object: The right to object to the processing of personal data for the performance of a task carried out in the public interest for protection of legitimate interests. Unless we can demonstrate that compelling legitimate grounds for the processing exist which override the interests, rights and freedoms of the data subject, the processing will be discontinued without undue delay.

Where requests to exercise the above rights are repetitive or manifestly unfounded, we may either charge a reasonable fee for the exercise of the relevant right or refuse to act on the request. If this is the case, you will be informed accordingly.

You can exercise all your rights by contacting us at the e-mail address info@kifli.hu.

You can lodge a complaint with the supervisory authority, which is the National Authority for Data Protection and Freedom of Information, (website: https://naih.hu/ , postal address: 1363 Budapest, Pf.: 9., phone: +36 (1) 391 1400, e-mail: ugyfelszolgalat@naih.hu.

 

This Privacy Policy is in effect as of 25 May 2018 and is updated on a regular basis.