Privacy Policy
1. GENERAL INFORMATION
Raepop ("Raepop") offers its customers a "virtual packaging and digital gift delivery" service.
Raepop processes information that constitutes "personal data" within the meaning of Article 4(1) of the EU General Data Protection Regulation 2016/679 ("GDPR") in relation to the users of its services, its contractors' contacts and other persons (collectively, "data subject(s)"). In relation to Raepop's services, Anna Deli acts personally, either as data controller or data processor, for data protection purposes - in this regard, see section 4.
This privacy notice ("Notice") provides information on the processing of these personal data and on the rights and remedies of data subjects in relation to data processing.
Contact details of Raepop:
Representative: Anna Deli
Registered seat: 1190 Vienna, Hardtgasse 13/12, Austria
Telephone number: +43 670 6014519
Email address: anna.deli@raepop.com
Website: https://raepop.com
2. UPDATE AND AVAILABILITY OF THE PROSPECTUS
Raepop reserves the right to amend this Notice unilaterally, with effect from the date of the amendment, subject to the restrictions set out in the applicable legislation and, if necessary, with due notice to the data subjects. In particular, this Notice may be amended if necessary due to changes in legislation, the practices of data protection authorities, business or employee needs, new activities involving the processing of personal data, newly identified security risks, feedback from Raepop's customers or data subjects using Raepop's services. Raepop may use the contact information available to the data subject at Raepop for contact and communication purposes in connection with this Notice or data protection issues, or otherwise in connection with contacting the data subject. For example, Raepop will send the data subject a copy of the current version of the Notice upon request. Raepop reserves the right to amend this Policy unilaterally, with effect from the date of the amendment, subject to the restrictions provided for by applicable law and, if necessary, with prior and adequate notice to the data subject.
3. SPECIFIC DATA PROTECTION CONDITIONS
In certain specific cases, specific data protection conditions may also apply, which will be notified separately to the data subjects. This includes, for example, the information on cookies used by Raepop on its website and the information on cookies used when using Raepop services.
In any case, data subjects or other persons/organisations are obliged to provide Raepop with the relevant personal data in accordance with the applicable laws. Thus, in particular, they must have appropriate and informed consent or other legal basis for the transfer of personal data (for example: in the case of contacts, relatives, gift recipients). If Raepop becomes aware that a data subject's data has been disclosed without his or her consent or other appropriate legal basis, Raepop may delete the data without undue delay and the data subject is entitled to exercise the rights and remedies under this Notice. Raepop is not liable for any damage, loss or injury that may arise from the breach of the above undertaking and representations by data subjects.
4. SCOPE OF DATA PROCESSED AND PURPOSES OF DATA PROCESSING
The scope of the data processed, the purposes of the processing, the legal basis for the processing, the duration of the processing and the parties entitled to access the data are set out in the table below. Where a processing purpose is necessary to pursue a legitimate interest of Raepop or a third party, the interest balancing test used to establish the legitimate interest will be made available by Raepop upon request to one of the contact details above.
Raepop expressly draws the attention of data subjects to the fact that they have the right to object at any time, on grounds relating to their particular situation, to the processing of their personal data based on legitimate interest. In this case, Raepop will no longer process the personal data, unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
If the limitation period for the assertion of a claim is specified in this Notice as the period of processing, the act interrupting the limitation period shall extend the period of processing until the new date on which the limitation period starts to run (in accordance with Act V of 2013 on the Civil Code ("Civil Code Act 2013")). In the event of the expiry of the limitation period, the claim may be asserted within a period of one year from the date of the cessation of the obstacle - three months if the limitation period is one year or less - even if the limitation period has already expired or is less than the above period (Civil Code, Civil Code, Art. 6:24. § (2)).
The 8-year data retention period set out in Act C of 2000 on Accounting (the "Accounting Act") is calculated from the date on which an accounting entry relating to the data occurred in the year or the reporting/bookkeeping relied in any way on the data. In practice: if the data is included in a contract under which several deliverables are performed (for example, several services are provided under one contract), the 8 years should be calculated separately for each deliverable, because each deliverable is invoiced separately and used to account for the transaction.
Processing of data when using Raepop's services
Raepop as data processor
When using Raepop's services, the purposes for which users' personal data are processed are generally determined by Raepop's principal (the organisation whose services the user uses). In this case, the principal acts as a so-called "data controller" for data protection purposes and Raepop provides its services solely on the instructions of the principal. Raepop will provide the service/product selected and purchased by the user from the services/products marketed by the principal with a so-called digital packaging. In practice, this means that Raepop sends the purchased service/product to the user in an email containing a unique link. Through the link, the user - or the person to whom the user forwards the email ("gifted") - can access the service/product after watching an animation.
In this case, Raepop's principal determines, among other things, the following:
• the purpose for which Raepop's service is used and the data processed during its use (e.g. for which service/product Raepop offers the unboxing, whether Raepop wishes to send the user a confirmation email of the unboxing, etc.),
• what data is requested to use the service,
• the channel by which Raepop notifies the user of the service, and
• on which devices and platforms Raepop makes its service available.
The Raepop's principal may also collect personal data about the user on its own - in doing so, it will act in accordance with the conditions set out in its own privacy policy and may use the personal data for the purposes of the processing set out therein.
Raepop's data processing activities are as follows:
Raepop as data controller
In some cases, when using Raepop's services, both the Principal and Raepop separately determine their own data processing purposes and the way in which the data is processed. In this case, the Principal and Raepop act as separate data controllers. In this case, Raepop will process the following personal data for the following purposes:
Data processing in relation to Raepop's clients and other activities of Raepop
For data protection purposes, Raepop acts as a so-called "data controller" in the following processing activities - it determines the purposes and means of the processing of data.
5. ORGANISATIONS ENTITLED TO PROCESS DATA
ORGANISATIONS ENTITLED TO PROCESS DATA Raepop uses the following contractual partners to carry out tasks related to data processing operations. The contracted partner acts as a so-called "data processor": it processes the personal data specified in this Notice on behalf of Raepop. If Raepop itself acts as a data processor, its data processor is called a "sub-processor".
Raepop may only use data processors or sub-processors that offer adequate guarantees, in particular in terms of expertise, reliability and resources, to implement technical and organisational measures to ensure compliance with the requirements of the GDPR, including the security of processing. The specific tasks and responsibilities of the processor/sub-processor are governed by the contract between Raepop and the processor/sub-processor. Once the processing has been completed, the processor/sub-processor shall, at Raepop's (or the controller's) option, return or delete the personal data, unless EU or Member State law applicable to the processor/sub-processor requires their retention.
6. DATA SECURITY (TECHNICAL AND ORGANISATIONAL) MEASURES
Raepop protects its systems storing personal data with authentication and uses a number of security settings provided by the hosting provider. The SQL (Structured Query Language) database is protected by a firewall and can only be accessed from a specific IP address. API interfaces can only be accessed from a specific IP address at points where SSL protection is required. Certain calls can only be used with the specified token. Hosting platform admin interfaces can only be accessed by authentication.
7. DATA SUBJECTS' DATA PROTECTION RIGHTS AND REMEDIES
Except as otherwise provided in this section, this section applies to data processing where Raepop acts as data controller. Where Raepop acts as a data processor, it shall cooperate with the controller in dealing with requests for data protection from data subjects.
7.1. Data protection rights and remedies
The data subjects' data protection rights and remedies are set out in detail in the relevant provisions of the GDPR (in particular Articles 15, 16, 17, 18, 19, 20, 21, 22, 77, 78, 79, 80 and 82 of the GDPR). The following summary sets out the most important provisions and Raepop provides information to data subjects on their rights and remedies in relation to data processing accordingly.
Information must be provided in writing or by other means, including, where appropriate, by electronic means. At the request of the data subject, oral information may be provided, provided that the identity of the data subject has been verified by other means.
Raepop shall inform the data subject of the measures taken in response to his or her request without undue delay and in any event within one month of receipt of the data subject's request to exercise his or her rights (see Articles 15-22 GDPR). If necessary, and taking into account the complexity of the request and the number of requests, this period may be extended by a further two months. Raepop shall inform the data subject of the extension, stating the reasons for the delay, within one month of receipt of the request. If the data subject has submitted the request by electronic means, the information shall be provided by electronic means where possible, unless the data subject requests otherwise.
If Raepop does not act on the data subject's request, it shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for the non-action and of the possibility to lodge a complaint with a supervisory authority and to exercise his or her right of judicial remedy.
7.2. Right of access of the data subject
(1) The data subject has the right to receive feedback from Raepop on whether his or her personal data are being processed. If such processing is ongoing, the data subject shall have the right to obtain access to the personal data and the following information:
a) the purposes of the processing;
b) the categories of personal data concerned;
c) the recipients or categories of recipients to whom the personal data have been or will be disclosed by Raepop, including in particular recipients in third countries or international organisations;
d) where applicable, the envisaged duration of the storage of the personal data or, if this is not possible, the criteria for determining this duration;
e) the data subject's right to obtain from Raepop the rectification, erasure or restriction of the processing of personal data concerning him or her and to object to the processing of such personal data;
f) the right to lodge a complaint with a supervisory authority; and
g) where the data have not been collected from the data subject, any available information about their source.
(2) Where personal data are transferred to a third country, the data subject shall have the right to be informed of the appropriate safeguards regarding the transfer.
(3) Raepop shall provide the data subject with a copy of the personal data which are the subject of the processing. For additional copies requested by the data subject, Raepop may charge a reasonable fee based on administrative costs. If the data subject has made the request by electronic means, the information shall be provided in a commonly used electronic format, unless the data subject requests otherwise.
7.3. Right to rectification
The data subject shall have the right to obtain from Raepop, at the data subject's request and without undue delay, the rectification of inaccurate personal data relating to him or her. The data subject also has the right to request the completion of incomplete personal data, including by means of a supplementary declaration.
7.4. Right to erasure ("right to be forgotten")
(1) The data subject shall have the right to obtain, upon his or her request, the erasure of personal data concerning him or her by Raepop without undue delay where one of the following grounds applies:
a) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed by Raepop;
b) the data subject withdraws the consent on the basis of which the processing was carried out and there is no other legal basis for the processing;
c) the data subject objects to the processing and, where applicable, there is no overriding legitimate ground for the processing;
d) the personal data have been unlawfully processed;
e) the personal data must be erased in order to comply with a legal obligation under Union or Member State law applicable to Raepop; or
f) the personal data have been collected in connection with the provision of information society services.
(2) If Raepop has disclosed the personal data and is required to delete it pursuant to the above, it shall take reasonable steps, including technical measures, taking into account the available technology and the cost of implementation, to inform the data controllers that have processed the data that the data subject has requested the deletion of the links to or copies or replicas of the personal data in question.
(3) Paragraphs 1 and 2 shall not apply where the processing is necessary, inter alia:
a) for the exercise of the right to freedom of expression and information;
b) for the purposes of complying with an obligation under Union or Member State law to which Raepop is subject which requires the processing of personal data;
c) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, where the right referred to in paragraph 1 would be likely to render such processing impossible or seriously jeopardise it; or
d) for the establishment, exercise or defence of legal claims.
7.5. Right to restriction of processing
(1) The data subject shall have the right to obtain at his or her request the restriction of processing by Raepop if one of the following conditions is met:
a) the data subject contests the accuracy of the personal data, in which case the restriction shall apply for a period of time which allows Raepop to verify the accuracy of the personal data;
b) the processing is unlawful and the data subject opposes the erasure of the data and requests instead the restriction of their use;
c) Raepop no longer needs the personal data for the purposes of processing, but the data subject requires them for the establishment, exercise or defence of legal claims; or
d) the data subject has objected to the processing; in this case, the restriction shall apply for a period of time until it is determined whether Raepop's legitimate grounds prevail over the data subject's legitimate grounds.
(2) Where processing is subject to a restriction pursuant to paragraph (1), such personal data may be processed, except for storage, only with the consent of the data subject or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for important public interests of the Union or of a Member State.
(3) Raepop shall inform in advance the data subject at whose request the processing has been restricted on the basis of the above about the lifting of the restriction of processing.
7.6. Obligation to notify the rectification or erasure of personal data or the restriction of processing
Raepop will inform all recipients of any rectification, erasure or restriction of processing to whom or with which it has communicated the personal data, unless this proves impossible or involves a disproportionate effort. Upon request, Raepop will inform the data subject of these recipients.
7.7. Right to data portability
(1) The data subject shall have the right to receive personal data concerning him or her which he or she has provided to Raepop in a structured, commonly used, machine-readable format and the right to transmit such data to another controller without Raepop being prevented from doing so, if:
a) the processing is based on consent or on a contract; and
b) the processing is carried out by automated means.
(2) In exercising the right to data portability under paragraph (1), the data subject shall have the right to request, where technically feasible, the direct transfer of personal data between controllers (such as Raepop and other controllers).
(3) The exercise of the right described above shall be without prejudice to the provisions on the right to erasure ("right to be forgotten") and shall not adversely affect the rights and freedoms of others.
7.8. Right to object
(1) The data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to the processing of his or her personal data on the basis of legitimate interest. In such a case, the personal data will no longer be processed by Raepop, unless he or she can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
(2) Where the processing of personal data is carried out for direct marketing purposes, the data subject shall have the right to object at any time to the processing of personal data concerning him or her for such purposes, including profiling, where it is related to direct marketing.
(3) Where the data subject objects to the processing of personal data for direct marketing purposes, the personal data shall no longer be processed for those purposes.
(4) In relation to the use of information society services and by way of derogation from Directive 2002/58/EC, the data subject may exercise the right to object by automated means based on technical specifications.
(5) Where personal data are processed for scientific or historical research purposes or for statistical purposes, the data subject shall have the right to object, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
7.9. Right to lodge a complaint with a supervisory authority
The data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement, if the data subject considers that the processing of personal data relating to him or her infringes the provisions of the GDPR. In Hungary, the competent supervisory authority is the National Authority for Data Protection and Freedom of Information (website: http://naih.hu/; address: 1055 Budapest, Falk Miksa utca 9-11.; postal address: 1363 Budapest, Pf.) This right applies to the data subject even if Raepop is the controller and even if Raepop is the processor.
7.10. Right to an effective judicial remedy against the supervisory authority
(1) The data subject shall have the right to an effective judicial remedy against a legally binding decision of the supervisory authority concerning the data subject.
(2) The data subject shall have the right to an effective judicial remedy if the competent supervisory authority does not deal with the complaint or does not inform the data subject within three months of the procedural developments concerning the complaint lodged or of the outcome of the complaint.
(3) Proceedings against a supervisory authority shall be brought before the courts of the Member State in which the supervisory authority is established.
7.11. Right to an effective judicial remedy against Raepop
Dieses Recht steht der betroffenen Person auch dann zu, wenn Raepop This right applies to the data subject even if Raepop is the controller and even if Raepop is the processor.
(1) Without prejudice to available administrative or non-judicial remedies, including the right to lodge a complaint with a supervisory authority, the data subject shall have the right to an effective judicial remedy if he or she considers that his or her rights under the GDPR have been infringed as a result of the processing of his or her personal data in a way that does not comply with the GDPR.
(2) Proceedings against Raepop shall be brought before the courts of the Member State where Raepop has its place of business. Such proceedings may also be brought before the courts of the Member State of habitual residence of the data subject. Such proceedings shall be subject to the jurisdiction of the courts of law in Hungary. The person concerned may, at his or her option, also bring the action before the competent court of the place of his or her domicile or residence. Information on the jurisdiction and contact details of the court (tribunal) can be found on the following website: www.birosag.hu.
Raepop ("Raepop") offers its customers a "virtual packaging and digital gift delivery" service.
Raepop processes information that constitutes "personal data" within the meaning of Article 4(1) of the EU General Data Protection Regulation 2016/679 ("GDPR") in relation to the users of its services, its contractors' contacts and other persons (collectively, "data subject(s)"). In relation to Raepop's services, Anna Deli acts personally, either as data controller or data processor, for data protection purposes - in this regard, see section 4.
This privacy notice ("Notice") provides information on the processing of these personal data and on the rights and remedies of data subjects in relation to data processing.
Contact details of Raepop:
Representative: Anna Deli
Registered seat: 1190 Vienna, Hardtgasse 13/12, Austria
Telephone number: +43 670 6014519
Email address: anna.deli@raepop.com
Website: https://raepop.com
2. UPDATE AND AVAILABILITY OF THE PROSPECTUS
Raepop reserves the right to amend this Notice unilaterally, with effect from the date of the amendment, subject to the restrictions set out in the applicable legislation and, if necessary, with due notice to the data subjects. In particular, this Notice may be amended if necessary due to changes in legislation, the practices of data protection authorities, business or employee needs, new activities involving the processing of personal data, newly identified security risks, feedback from Raepop's customers or data subjects using Raepop's services. Raepop may use the contact information available to the data subject at Raepop for contact and communication purposes in connection with this Notice or data protection issues, or otherwise in connection with contacting the data subject. For example, Raepop will send the data subject a copy of the current version of the Notice upon request. Raepop reserves the right to amend this Policy unilaterally, with effect from the date of the amendment, subject to the restrictions provided for by applicable law and, if necessary, with prior and adequate notice to the data subject.
3. SPECIFIC DATA PROTECTION CONDITIONS
In certain specific cases, specific data protection conditions may also apply, which will be notified separately to the data subjects. This includes, for example, the information on cookies used by Raepop on its website and the information on cookies used when using Raepop services.
In any case, data subjects or other persons/organisations are obliged to provide Raepop with the relevant personal data in accordance with the applicable laws. Thus, in particular, they must have appropriate and informed consent or other legal basis for the transfer of personal data (for example: in the case of contacts, relatives, gift recipients). If Raepop becomes aware that a data subject's data has been disclosed without his or her consent or other appropriate legal basis, Raepop may delete the data without undue delay and the data subject is entitled to exercise the rights and remedies under this Notice. Raepop is not liable for any damage, loss or injury that may arise from the breach of the above undertaking and representations by data subjects.
4. SCOPE OF DATA PROCESSED AND PURPOSES OF DATA PROCESSING
The scope of the data processed, the purposes of the processing, the legal basis for the processing, the duration of the processing and the parties entitled to access the data are set out in the table below. Where a processing purpose is necessary to pursue a legitimate interest of Raepop or a third party, the interest balancing test used to establish the legitimate interest will be made available by Raepop upon request to one of the contact details above.
Raepop expressly draws the attention of data subjects to the fact that they have the right to object at any time, on grounds relating to their particular situation, to the processing of their personal data based on legitimate interest. In this case, Raepop will no longer process the personal data, unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
If the limitation period for the assertion of a claim is specified in this Notice as the period of processing, the act interrupting the limitation period shall extend the period of processing until the new date on which the limitation period starts to run (in accordance with Act V of 2013 on the Civil Code ("Civil Code Act 2013")). In the event of the expiry of the limitation period, the claim may be asserted within a period of one year from the date of the cessation of the obstacle - three months if the limitation period is one year or less - even if the limitation period has already expired or is less than the above period (Civil Code, Civil Code, Art. 6:24. § (2)).
The 8-year data retention period set out in Act C of 2000 on Accounting (the "Accounting Act") is calculated from the date on which an accounting entry relating to the data occurred in the year or the reporting/bookkeeping relied in any way on the data. In practice: if the data is included in a contract under which several deliverables are performed (for example, several services are provided under one contract), the 8 years should be calculated separately for each deliverable, because each deliverable is invoiced separately and used to account for the transaction.
Processing of data when using Raepop's services
Raepop as data processor
When using Raepop's services, the purposes for which users' personal data are processed are generally determined by Raepop's principal (the organisation whose services the user uses). In this case, the principal acts as a so-called "data controller" for data protection purposes and Raepop provides its services solely on the instructions of the principal. Raepop will provide the service/product selected and purchased by the user from the services/products marketed by the principal with a so-called digital packaging. In practice, this means that Raepop sends the purchased service/product to the user in an email containing a unique link. Through the link, the user - or the person to whom the user forwards the email ("gifted") - can access the service/product after watching an animation.
In this case, Raepop's principal determines, among other things, the following:
• the purpose for which Raepop's service is used and the data processed during its use (e.g. for which service/product Raepop offers the unboxing, whether Raepop wishes to send the user a confirmation email of the unboxing, etc.),
• what data is requested to use the service,
• the channel by which Raepop notifies the user of the service, and
• on which devices and platforms Raepop makes its service available.
The Raepop's principal may also collect personal data about the user on its own - in doing so, it will act in accordance with the conditions set out in its own privacy policy and may use the personal data for the purposes of the processing set out therein.
Raepop's data processing activities are as follows:
| Description of Raepop's tasks | Scope of personal data processed by Raepop as a data processor | Data retention period and additional data processors used by Raepop |
|---|---|---|
| Raepop - creates the digital packaging - sends the latest API development documentation to the client, and informs the client of any changes in a timely manner - generates a unique web page on its own server based on the data received from the client, which displays the packaging for the given waiting - sends an email to the user containing a unique link to the web page of the packaged service/product - notifies the user by email when the gift is unpacked (successful viewing of the animation) |
- the customer's email address - the subject of the email - mandatory or optional, this field is filled in by the customer, but Raepop receives it as data, because it will return the packaged service/product to him/her by email - the details of the purchased service/product (e.g. address of the performance, location) - the expiry date of the purchased service/product |
General data erasure: 1 year (12 months) Backups: 1 year (12 months) The list of additional data processors (sub-processors) used by Raepop is set out in Section 5 of this Notice. |
Raepop as data controller
In some cases, when using Raepop's services, both the Principal and Raepop separately determine their own data processing purposes and the way in which the data is processed. In this case, the Principal and Raepop act as separate data controllers. In this case, Raepop will process the following personal data for the following purposes:
| Purpose of the processing | Legal basis for processing | Scope of personal data processed by Raepop | Data retention period and additional data processors used by Raepop |
|---|---|---|---|
| The purpose of the processing is the direct provision of digital services related to the online sale of products to users (customers) through the system developed for this purpose by Raepop as the data controller. This includes, but is not limited to, sending services/products (e.g. tickets) to users. | Depending on whether Raepop provides the service to natural persons or other entities. In the case of natural persons, Article 6(1)(b) of the GDPR - the performance (execution) of a service contract directly with the data subject or the taking of steps at the request of the data subject prior to the conclusion of the service contract. For other organisations, Article 6(1)(f) GDPR - legitimate interests of Raepop and the organisation: to fulfil obligations in relation to Raepop's service, to exercise rights and to cooperate between the parties. Provision of personal data is a contractual requirement; without personal data Raepop cannot make an offer, request a quote or provide its service. |
- customer's email address - customer's IP address - subject of the email - mandatory or optional, this field is filled in by the customer, but we receive it as data, because Raepop sends the packaged service/product back to him/her by email with such an item - details of the purchased service/product (e.g. address of the performance, location) - expiry date of the purchased service/product |
5 years from the date of termination of the contractual relationship or (if different) from the date of the last contact (inactivity) with the
contact person (Civil Code. § 6:22 (1) - unless otherwise provided for in the Civil Code, claims shall expire within 5 years.) With regard to the fulfilment of tax obligations: the data retention period is 5 years from the last day of the calendar year in which the tax should have been declared, reported or notified, or in the absence of declaration, reporting or notification, the tax should have been paid (Act CL of 2017 on the Rules of Taxation - "Art." - §78 (3), §202 (1)). In the case of accounting documents: the data retention period is 8 years (§§ 168-169 of the Accounting Act). In practice, this is the case if the data are part of the documents supporting the accounting, for example, in documents related to the conclusion of a contract between the partnership and the partner (e.g. an order) or in the invoice issued. Backups: 1 year (12 months) The list of additional data processors (sub-processors) used by Raepop is set out in Section 5 of this Policy. |
| Send promotions, newsletters, satisfaction surveys to users by email. | Article 6(1)(a) of the GDPR - voluntary consent of the data subject, and Article 6(1) of Act XLVIII of 2008 on the Basic
Conditions and Certain Restrictions on Commercial Advertising Activities - prior, unambiguous and explicit consent of the data subject. The declaration of consent may be withdrawn at any time, without restriction and without giving reasons, free of charge. Withdrawal of consent shall not affect the lawfulness of processing based on consent prior to its withdrawal. Without consent, Raepop cannot send promotions, newsletters, satisfaction surveys. |
Name and e-mail address of the potential recipient. | If the data subject withdraws his or her consent, the personal data will be deleted. |
Data processing in relation to Raepop's clients and other activities of Raepop
For data protection purposes, Raepop acts as a so-called "data controller" in the following processing activities - it determines the purposes and means of the processing of data.
| Purpose of the processing | Legal basis for processing | Scope of the data | Data retention period, access rights, recipients of data transfers |
|---|---|---|---|
| Processing of data of contractual partners, contacts, representatives, managers of Raepop's clients (e.g. cinemas, theatres),
third parties and/or persons involved in the performance of contracts / performance monitoring. Purpose of the processing: performance of the contract (day-to-day execution), and/or contact, information, communication. This includes, for example, the processing of postal addresses of the persons concerned, instructions to contact persons, or the sending of official notifications using contact details and information on the obligations to be fulfilled. |
Depending on whether the contract is concluded with the data subject (e.g. sole traders) or with another undertaking: a) Article 6(1)(b) GDPR - performance (enforcement) of the contract directly with the data subject b) Article 6(1)(f) GDPR - legitimate interest of Raepop and the undertaking contracting with it: to perform contractual obligations, to exercise rights and to ensure economic cooperation between the parties and effective communication between the parties. The transfer of personal data is a contractual requirement; without personal data, Raepop cannot conclude and perform the contract or provide the Raepop system; without contact data, the purpose of the processing of contact data cannot be achieved, it is strictly necessary for the maintenance of the relationship, the provision of information to data subjects and communication with data subjects. |
The names of the persons concerned, their contact details (e-mail, telephone number, mobile phone number) and any activity or
communication containing personal data in the course of communication with Raepop (for example, communication from the contact person or any natural
person acting on behalf of the partner). The personal data are provided to Raepop either by the contractual partner, by the data subjects themselves or by third parties involved in the case in question. |
Data retention time: 5 years from the termination of the contractual relationship (Ptk. 6:22 (1) - unless otherwise provided for in the Civil Code, claims expire within 5 years.) With regard to the fulfilment of tax obligations: the data retention period is 5 years from the last day of the calendar year in which the tax should have been declared, reported or notified, or in the absence of declaration, reporting or notification, the tax should have been paid (Act CL of 2017 on the Rules of Taxation - "Art." - §78 (3), §202 (1)). In the case of accounting documents: the data retention period is 8 years (§§ 168-169 of the Accounting Act). In practice, this is the case if the data are part of the documents supporting the accounting, for example, in the documents related to the conclusion of a contract between Raepop and the partner (e.g. an order) or in the invoice issued. |
| The processing of data of contractors' contacts, employees, representatives, managers, persons involved in the monitoring
of the performance of contracts and other third parties. Purpose of the processing: any other action relating to compliance issues or the enforcement of other rights in relation to contracts or non-contractual compliance issues. For example: seeking remedies necessary to ensure Raepop's rights. |
The legal basis for the processing in this case is Raepop's legitimate interest (Article 6(1)(f) GDPR). Legitimate interest: to process compliance issues related to the contract and to perform any other tasks related to the performance of the contract, including seeking remedies necessary to ensure contractual rights. Raepop also has a legitimate interest to use personal data of data subjects for the purposes of use in litigation, evidence, claims and enforcement in the event of any dispute. Raepop needs this data in order to initiate and prove any legal proceedings, without which the purpose of the processing cannot be achieved. | The data subject's natural person identification data - name, mother's name, date and place of birth, address - contact details
(e-mail, telephone number, mobile phone number) and any activity and communication relating to the contract that contains personal data (for example,
communication from the contact person or any natural person acting on behalf of the partner). The personal data are provided to Raepop either by the contractual partner, the persons concerned or third parties involved in the case in question. |
Data retention time: 5 years from the date of termination of the contractual relationship between Raepop and the contracted partner or from the date of the case in question (Civil Code. 6:22 (1) - unless otherwise provided for in the Civil Code, claims expire within 5 years.) |
| Processing in relation to the enforcement of the data protection rights of the data subjects (for details, see point 7) | Article 6(1)(c) GDPR (processing is necessary for compliance with a legal obligation to which Raepop is subject). The legal obligation is to enable the exercise of the data subject's rights under Articles 15-22 GDPR and to document other steps taken in relation to the request, and to cooperate with Raepop's principal in the management of the data subject's rights (where Raepop acts as a data processor). |
Personal data relating to data protection requests received by Raepop directly from the data subject or through Raepop's agent: the contact details of the natural persons/legal entities or, in the case of other entities, the contact persons (in particular: name, address, e-mail address, telephone number) who have contacted Raepop, the content of the request, the action taken in response to the request and the documents relating to the request. For example: if the data subject requests the deletion of all his/her data by e-mail under the GDPR and Raepop complies with this request, the e-mail requesting deletion will be kept regardless of this. | Data retention period: indefinite unless otherwise specified by the DPA. |
| Records of data protection incidents (including documentation of the steps taken to deal with incidents) | Article 6(1)(c) GDPR (processing is necessary for compliance with a legal obligation to which Raepop is subject). The legal obligation: pursuant to Article 33(5) GDPR, the controller shall keep a record of the data protection incident, indicating the facts relating to the data protection incident, its effects and the measures taken to remedy it. This record allows the DPA to verify compliance with the requirements of the GDPR. Where Raepop acts as a data processor, it shall notify the data controller of a personal data breach pursuant to Article 33(2) GDPR without undue delay after becoming aware of it. |
Personal data of the data subjects relating to the personal data breach. | Data retention period: indefinite unless otherwise specified by the DPA. |
5. ORGANISATIONS ENTITLED TO PROCESS DATA
ORGANISATIONS ENTITLED TO PROCESS DATA Raepop uses the following contractual partners to carry out tasks related to data processing operations. The contracted partner acts as a so-called "data processor": it processes the personal data specified in this Notice on behalf of Raepop. If Raepop itself acts as a data processor, its data processor is called a "sub-processor".
Raepop may only use data processors or sub-processors that offer adequate guarantees, in particular in terms of expertise, reliability and resources, to implement technical and organisational measures to ensure compliance with the requirements of the GDPR, including the security of processing. The specific tasks and responsibilities of the processor/sub-processor are governed by the contract between Raepop and the processor/sub-processor. Once the processing has been completed, the processor/sub-processor shall, at Raepop's (or the controller's) option, return or delete the personal data, unless EU or Member State law applicable to the processor/sub-processor requires their retention.
| The data processor | His work |
|---|---|
| Rackforest Kft. Victor Hugo u. 18-22, 1132 Budapest Telephone: +36 70 362 4785 Email: info@rackforest.com Steuernummer: 14671858-2-41 https://rackforest.com/ |
Rackforest Ltd. provides the web hosting service of Raepop. Raepop processes the personal data it processes as data controller and data processor using the webhosting service of Rackforest Ltd. |
6. DATA SECURITY (TECHNICAL AND ORGANISATIONAL) MEASURES
Raepop protects its systems storing personal data with authentication and uses a number of security settings provided by the hosting provider. The SQL (Structured Query Language) database is protected by a firewall and can only be accessed from a specific IP address. API interfaces can only be accessed from a specific IP address at points where SSL protection is required. Certain calls can only be used with the specified token. Hosting platform admin interfaces can only be accessed by authentication.
7. DATA SUBJECTS' DATA PROTECTION RIGHTS AND REMEDIES
Except as otherwise provided in this section, this section applies to data processing where Raepop acts as data controller. Where Raepop acts as a data processor, it shall cooperate with the controller in dealing with requests for data protection from data subjects.
7.1. Data protection rights and remedies
The data subjects' data protection rights and remedies are set out in detail in the relevant provisions of the GDPR (in particular Articles 15, 16, 17, 18, 19, 20, 21, 22, 77, 78, 79, 80 and 82 of the GDPR). The following summary sets out the most important provisions and Raepop provides information to data subjects on their rights and remedies in relation to data processing accordingly.
Information must be provided in writing or by other means, including, where appropriate, by electronic means. At the request of the data subject, oral information may be provided, provided that the identity of the data subject has been verified by other means.
Raepop shall inform the data subject of the measures taken in response to his or her request without undue delay and in any event within one month of receipt of the data subject's request to exercise his or her rights (see Articles 15-22 GDPR). If necessary, and taking into account the complexity of the request and the number of requests, this period may be extended by a further two months. Raepop shall inform the data subject of the extension, stating the reasons for the delay, within one month of receipt of the request. If the data subject has submitted the request by electronic means, the information shall be provided by electronic means where possible, unless the data subject requests otherwise.
If Raepop does not act on the data subject's request, it shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for the non-action and of the possibility to lodge a complaint with a supervisory authority and to exercise his or her right of judicial remedy.
7.2. Right of access of the data subject
(1) The data subject has the right to receive feedback from Raepop on whether his or her personal data are being processed. If such processing is ongoing, the data subject shall have the right to obtain access to the personal data and the following information:
a) the purposes of the processing;
b) the categories of personal data concerned;
c) the recipients or categories of recipients to whom the personal data have been or will be disclosed by Raepop, including in particular recipients in third countries or international organisations;
d) where applicable, the envisaged duration of the storage of the personal data or, if this is not possible, the criteria for determining this duration;
e) the data subject's right to obtain from Raepop the rectification, erasure or restriction of the processing of personal data concerning him or her and to object to the processing of such personal data;
f) the right to lodge a complaint with a supervisory authority; and
g) where the data have not been collected from the data subject, any available information about their source.
(2) Where personal data are transferred to a third country, the data subject shall have the right to be informed of the appropriate safeguards regarding the transfer.
(3) Raepop shall provide the data subject with a copy of the personal data which are the subject of the processing. For additional copies requested by the data subject, Raepop may charge a reasonable fee based on administrative costs. If the data subject has made the request by electronic means, the information shall be provided in a commonly used electronic format, unless the data subject requests otherwise.
7.3. Right to rectification
The data subject shall have the right to obtain from Raepop, at the data subject's request and without undue delay, the rectification of inaccurate personal data relating to him or her. The data subject also has the right to request the completion of incomplete personal data, including by means of a supplementary declaration.
7.4. Right to erasure ("right to be forgotten")
(1) The data subject shall have the right to obtain, upon his or her request, the erasure of personal data concerning him or her by Raepop without undue delay where one of the following grounds applies:
a) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed by Raepop;
b) the data subject withdraws the consent on the basis of which the processing was carried out and there is no other legal basis for the processing;
c) the data subject objects to the processing and, where applicable, there is no overriding legitimate ground for the processing;
d) the personal data have been unlawfully processed;
e) the personal data must be erased in order to comply with a legal obligation under Union or Member State law applicable to Raepop; or
f) the personal data have been collected in connection with the provision of information society services.
(2) If Raepop has disclosed the personal data and is required to delete it pursuant to the above, it shall take reasonable steps, including technical measures, taking into account the available technology and the cost of implementation, to inform the data controllers that have processed the data that the data subject has requested the deletion of the links to or copies or replicas of the personal data in question.
(3) Paragraphs 1 and 2 shall not apply where the processing is necessary, inter alia:
a) for the exercise of the right to freedom of expression and information;
b) for the purposes of complying with an obligation under Union or Member State law to which Raepop is subject which requires the processing of personal data;
c) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, where the right referred to in paragraph 1 would be likely to render such processing impossible or seriously jeopardise it; or
d) for the establishment, exercise or defence of legal claims.
7.5. Right to restriction of processing
(1) The data subject shall have the right to obtain at his or her request the restriction of processing by Raepop if one of the following conditions is met:
a) the data subject contests the accuracy of the personal data, in which case the restriction shall apply for a period of time which allows Raepop to verify the accuracy of the personal data;
b) the processing is unlawful and the data subject opposes the erasure of the data and requests instead the restriction of their use;
c) Raepop no longer needs the personal data for the purposes of processing, but the data subject requires them for the establishment, exercise or defence of legal claims; or
d) the data subject has objected to the processing; in this case, the restriction shall apply for a period of time until it is determined whether Raepop's legitimate grounds prevail over the data subject's legitimate grounds.
(2) Where processing is subject to a restriction pursuant to paragraph (1), such personal data may be processed, except for storage, only with the consent of the data subject or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for important public interests of the Union or of a Member State.
(3) Raepop shall inform in advance the data subject at whose request the processing has been restricted on the basis of the above about the lifting of the restriction of processing.
7.6. Obligation to notify the rectification or erasure of personal data or the restriction of processing
Raepop will inform all recipients of any rectification, erasure or restriction of processing to whom or with which it has communicated the personal data, unless this proves impossible or involves a disproportionate effort. Upon request, Raepop will inform the data subject of these recipients.
7.7. Right to data portability
(1) The data subject shall have the right to receive personal data concerning him or her which he or she has provided to Raepop in a structured, commonly used, machine-readable format and the right to transmit such data to another controller without Raepop being prevented from doing so, if:
a) the processing is based on consent or on a contract; and
b) the processing is carried out by automated means.
(2) In exercising the right to data portability under paragraph (1), the data subject shall have the right to request, where technically feasible, the direct transfer of personal data between controllers (such as Raepop and other controllers).
(3) The exercise of the right described above shall be without prejudice to the provisions on the right to erasure ("right to be forgotten") and shall not adversely affect the rights and freedoms of others.
7.8. Right to object
(1) The data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to the processing of his or her personal data on the basis of legitimate interest. In such a case, the personal data will no longer be processed by Raepop, unless he or she can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
(2) Where the processing of personal data is carried out for direct marketing purposes, the data subject shall have the right to object at any time to the processing of personal data concerning him or her for such purposes, including profiling, where it is related to direct marketing.
(3) Where the data subject objects to the processing of personal data for direct marketing purposes, the personal data shall no longer be processed for those purposes.
(4) In relation to the use of information society services and by way of derogation from Directive 2002/58/EC, the data subject may exercise the right to object by automated means based on technical specifications.
(5) Where personal data are processed for scientific or historical research purposes or for statistical purposes, the data subject shall have the right to object, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
7.9. Right to lodge a complaint with a supervisory authority
The data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement, if the data subject considers that the processing of personal data relating to him or her infringes the provisions of the GDPR. In Hungary, the competent supervisory authority is the National Authority for Data Protection and Freedom of Information (website: http://naih.hu/; address: 1055 Budapest, Falk Miksa utca 9-11.; postal address: 1363 Budapest, Pf.) This right applies to the data subject even if Raepop is the controller and even if Raepop is the processor.
7.10. Right to an effective judicial remedy against the supervisory authority
(1) The data subject shall have the right to an effective judicial remedy against a legally binding decision of the supervisory authority concerning the data subject.
(2) The data subject shall have the right to an effective judicial remedy if the competent supervisory authority does not deal with the complaint or does not inform the data subject within three months of the procedural developments concerning the complaint lodged or of the outcome of the complaint.
(3) Proceedings against a supervisory authority shall be brought before the courts of the Member State in which the supervisory authority is established.
7.11. Right to an effective judicial remedy against Raepop
Dieses Recht steht der betroffenen Person auch dann zu, wenn Raepop This right applies to the data subject even if Raepop is the controller and even if Raepop is the processor.
(1) Without prejudice to available administrative or non-judicial remedies, including the right to lodge a complaint with a supervisory authority, the data subject shall have the right to an effective judicial remedy if he or she considers that his or her rights under the GDPR have been infringed as a result of the processing of his or her personal data in a way that does not comply with the GDPR.
(2) Proceedings against Raepop shall be brought before the courts of the Member State where Raepop has its place of business. Such proceedings may also be brought before the courts of the Member State of habitual residence of the data subject. Such proceedings shall be subject to the jurisdiction of the courts of law in Hungary. The person concerned may, at his or her option, also bring the action before the competent court of the place of his or her domicile or residence. Information on the jurisdiction and contact details of the court (tribunal) can be found on the following website: www.birosag.hu.