Adatkezelési tájékoztató

Privacy Policy

For visitors of the website operated by INHEAT Ltd. at the web address https://inheat.hu

Contents, Acknowledgment, and Acceptance of the Privacy Policy

This privacy policy has been prepared https://inheat.hu for visitors of the website operated by INHEAT Ltd. at https://inheat.hu, for the purpose of providing information about the circumstances of personal data processing carried out in connection with the website, as well as about the rights to which the data subjects are entitled in this regard.

When sending a message via the Contact page, the user of the website explicitly declares, by ticking the provided checkbox, that they have read the contents of this privacy policy (effective at the time of use), accept what is contained therein, and consent to the processing of their personal data voluntarily, without external influence or coercion.

By the implied conduct of sending a message and/or email, the website user gives their consent for the operator of the website to process the personal data contained in the message and/or email sent to the operator, in accordance with the provisions of this privacy policy.

Furthermore, the data controller draws the website user’s attention to only forward the personal data of a third party if there is a clear and verifiable authorization from the data subject to do so, since the data controller has no legal basis to process third-party data in this manner. Without a legal basis, the data controller will not process data, and therefore will delete without delay and permanently any personal data sent to it without proper authorization. (Unnecessary parts must be deleted.)

Name, Identification Details, and Contact Information of the Data Controller

Name: INHEAT Kft.

Headquarters: 1112 Budapest, Budaörsi út 153.

E-mail cím: inheat@inheat.hu

Tax number: 32019351-2-41

Web hosting service provider: AB PLUSZ Bt. / 2049 Diósd, IV. Béla király street 48.

Basic Terms Used in this Policy

Data subject: any natural person identified or identifiable by reference to any information

Identifiable natural person: a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

Personal data: : any information relating to the data subject

Special category data: any data belonging to the special categories of personal data, i.e. personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, as well as genetic data, biometric data for the purpose of uniquely identifying a natural person, health data, and personal data concerning a natural person’s sex life or sexual orientation.

Health data: personal data relating to the physical or mental health of a natural person, including any data that reveals information about the state of health of the natural person and that is collected in the course of the provision of health services to the natural person

Criminal personal data:personal data created in connection with a criminal offense or criminal proceedings during or prior to the criminal proceedings at bodies authorized to conduct criminal proceedings or to investigate criminal offenses, as well as at organizations of penal institutions, which can be associated with the data subject, including personal data relating to criminal history.

Consent:any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.

Data controller: the natural or legal person, or an organization without legal personality, which, alone or jointly with others, determines the purposes of the processing of personal data, and makes and implements decisions regarding data processing (including the means used) or has them implemented by the data processor, within the scope of authority granted by law or by a binding act of the European Union.

Joint controllera data controller that, alone or together with one or more other controllers, jointly determines the purposes and means of data processing (within the framework defined by law or a binding act of the European Union), and makes and executes decisions regarding data processing (including the means used) together with one or more other controllers, or has them executed by the data processor.

Data processing: any operation or set of operations performed on data, regardless of the procedure applied. This includes, in particular: collection, acquisition, recording, organization, storage, alteration, use, retrieval, transmission, disclosure, alignment or combination, blocking, erasure, and destruction of data, as well as preventing further use of the data; the taking of photographs, sound or image recordings; and the recording of physical characteristics suitable for identifying a person (e.g., fingerprint or palm print, DNA sample, iris image).

Data transfermaking data accessible to a specific third party.

Indirect data transferthe transfer of personal data to a data controller or data processor operating data processing in a third country or within an international organization, for the purpose of further transfer to another data controller or data processor operating data processing in another third country or within an international organization.

Disclosure:making data accessible to anyone.

Data deletionrendering data unrecognizable in such a way that it can no longer be restored.

Restriction of data processing::marking stored data with the aim of limiting its future processing (locking the data).

Data destruction: az adatot tartalmazó adathordozó teljes fizikai megsemmisítése.

Data processing (as an activity):the totality of data processing operations carried out by a data processor on behalf of or under the instructions of the data controller.

Data processora natural or legal person, or an organization without legal personality, which, within the framework and under the conditions defined by law or a binding act of the European Union, processes personal data on behalf of or under the instructions of the data controller.

Data setall data processed in a single filing system.

Third party:a natural or legal person, or an organization without legal personality, that is not the same as the data subject, the data controller, the data processor, or those persons who, under the direct authority of the data controller or data processor, are authorized to process personal data.

EEA State:a Member State of the European Union and any other state that is party to the Agreement on the European Economic Area, as well as any state whose citizens enjoy the same legal status as a citizen of a state party to the Agreement on the European Economic Area, under an international treaty concluded between a state not party to that agreement and the European Union and its Member States.

Third countryany state that is not an EEA State.

Data protection incident:a breach of data security that results in the accidental or unlawful destruction, loss, alteration, unauthorized transfer or disclosure of, or unauthorized access to, personal data transmitted, stored, or otherwise processed.

Profiling:any form of automated processing of personal data consisting of the use of personal data to evaluate, analyze, or predict aspects relating to a natural person’s personal preferences, interests, reliability, behavior, location, or movements (including aspects of work performance, economic situation, health, etc.).

Recipient: a natural or legal person, or an organization without legal personality, to whom or which personal data is made accessible by the data controller or the data processor.

Pseudonymization:the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information stored separately, provided that technical and organizational measures are taken to ensure that the personal data is not attributed to an identified or identifiable natural person.

Laws Underpinning the Data Processing
The Fundamental Law of Hungary, Article VI;
GDPR (General Data Protection Regulation – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016);
Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Info Act);
Act V of 2013 on the Civil Code;
Act C of 2000 on Accounting;
Act CLV of 1997 on Consumer Protection;
Act CLXV of 2013 on Complaints and Public Interest Disclosures;
Section 13/A of Act CVIII of 2001 on Electronic Commerce and on Information Society Services;
Act XLVII of 2008 on the Prohibition of Unfair Commercial Practices against Consumers;
Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities (especially Section 6);
Act XC of 2005 on the Freedom of Electronic Information;
Act C of 2003 on Electronic Communications (especially Section 155);
NAIH Opinion No. 16/2011 on the EASA/IAB Best Practice Recommendation on Online Behavioural Advertising.
The Data Controller’s Data Protection Principles

INHEAT Ltd., as data controller, has designed and conducts its internal processes involving the handling of individuals’ data by implementing appropriate technical and organizational measures in such a way that these processes fully comply for GDPR and the Info Act dispose

The data controller pays special attention to ensuring that in the course of its economic activity and daily practice, compliance with other relevant sectoral laws is accompanied by the implementation of data protection laws and the provisions of its internal data protection policy.

The data controller organizes and conducts its data protection activities in a way that is lawful, fair, transparent, and accurate, and ensures that it processes only the data that are absolutely necessary for the purpose of data processing, and only for the period that is genuinely justified. The data controller treats its data processing operations as confidential to the necessary and justified extent, and places great emphasis on ensuring that data subjects are informed about the data processing preferably before it begins, or if that is not possible, at the first available opportunity after the data processing commences. The data controller also considers it important to be accountable at all times for the measures it takes during these processes.

The data controller takes all necessary and reasonable measures to permanently delete any personal data provided to it for which it does not have a legal basis for processing. The data controller also ensures that such personal data are not transferred to any unauthorized third party.

Access to Data and Security Measures

Access to data and data transfer: Only the data controller and those employees of the data controller for whom it is absolutely necessary for the performance of their duties have access to the data processed by the data controller.

The data controller only transfers the personal data it processes to those contractual partners who are obligated to process or handle the transferred data under a contract concluded with the data controller for this purpose. Before transferring personal data, the data controller has ensured that these contractual partners and their data processing practices comply with the relevant data protection laws and internal regulations. The circumstances of such data transfers or the data processing carried out by the contractual partner are recorded in the contract concluded between the two parties. The fact and circumstances of these data transfers are documented as part of the detailed description of each data processing activity. (See Section 9 of this Policy.)

Beyond the above, the data controller will only transfer the personal data it processes in extraordinary cases and solely to authorities legally authorized to receive such data, if required by law or if requested by the authorities. The data controller maintains a separate record of these data transfers.

Security measuresThe data controller treats the electronic data it records as confidential and stores them at its headquarters (1027 Budapest, Kacsa utca 15–23. Building 1, Ground Floor). For data storage and management, the data controller uses the hosting services of AB PLUSZ Bt. (2049 Diósd, IV. Béla király utca 48.). The data controller routes its email traffic through Google LLC (headquarters: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). The method of data storage complies with the relevant data protection laws. The data are protected with appropriate security measures.

Personal data managed in paper-based records are stored by the data controller at its headquarters (1027 Budapest, Kacsa utca 15–23. Building 1, Ground Floor). Databases that are not in current use are kept locked away. The storage location is protected by appropriate security measures, equipment, and devices.

The data controller and the data processor(s) listed in this policy are committed to safeguarding the security of the data processed. Therefore, during their data processing and data handling activities, they take all possible technical and organizational measures to guarantee an appropriate level of data security — considering the nature and circumstances of data processing, the costs of implementation, as well as the relevant risk factors — in accordance with the current state of the art and relevant data protection professional recommendations and practices.

Rights of the Data Subject

Right to be informed: The data subject has the right to concise, transparent, and intelligible information regarding the processing of their personal data. This information must contain all the essential circumstances of the data processing, presented in an easily accessible form, clearly and plainly, and in language fully comprehensible to the data subject.

If the data controller collects personal data from the data subject, it provides the data subject with the appropriate information prior to obtaining the data.

If the personal data were not obtained from the data subject, the data controller will provide the data subject with the appropriate information within a reasonable period after obtaining the data, but no later than within one month.

If the personal data are used for the purpose of contacting the data subject, the information must be provided at the latest at the time of first contact with the data subject. If the personal data are expected to be disclosed to another recipient, the information must be provided to the data subject at the latest when the personal data are first disclosed.

If the data subject requests information from the data controller regarding the exercise of their rights related to the processing of their data or about the circumstances of the data processing, the data controller will provide the data subject with the appropriate information without undue delay, but no later than one month from the receipt of the request. This period may be extended by an additional two months depending on the complexity of the request. The data subject must be informed of any extension of the deadline.

If the data controller does not take action on the request, it will inform the requester of this — including the reasons for the inaction and the data subject’s possibility to lodge a complaint.

The data controller must provide the information and any actions related to it free of charge. However, if the data subject’s request is clearly unfounded or — especially due to its repetitive nature — excessive, the data controller may, taking into account the administrative costs of providing the information or action requested, either charge a reasonable fee or refuse to act on the request.

Right of access: the data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, and, if so, to access the personal data and receive the following information: the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipients; the envisaged period for which the data will be stored; the data subject’s rights related to data processing as listed below in this section; the data subject’s right to lodge a complaint; and, if the data were not collected from the data subject, any available information as to their source; as well as whether automated decision-making, including profiling, has taken place during the processing; and whether personal data has been transferred to a third country.

The data controller will provide the data subject with a copy of the personal data undergoing processing. For any additional copies requested by the data subject, the data controller may charge a reasonable fee based on administrative costs.

Right to rectification: The data subject has the right to obtain from the data controller the rectification or completion of inaccurate or incomplete personal data concerning them without undue delay upon request.

Right to erasure (“right to be forgotten”): The data subject has the right to have the data controller erase personal data concerning them without undue delay upon request, and the data controller is obligated to erase personal data concerning the data subject without undue delay if one of the following grounds applies:

The personal data are no longer necessary for the purpose for which they were collected or otherwise processed;
The data subject withdraws the consent on which the processing is based, and there is no other legal basis for the processing;
The data subject objects to the processing and there are no overriding legitimate grounds for the processing;
The personal data have been processed unlawfully;
The personal data must be erased to comply with a legal obligation under Union or Member State law to which the data controller is subject;
The personal data have been collected in relation to the offer of information society services directly to a child under the age of 16.

If the data controller has made the personal data public and is obliged to erase it, the controller, taking account of available technology and the cost of implementation, shall take all reasonable steps to inform other controllers which are processing the personal data that the data subject has requested the erasure of any links to, or copy or replication of, those personal data.

The data controller cannot erase the personal data despite the data subject’s request if further processing is necessary for one of the following reasons: for exercising the right of freedom of expression and information; for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject; for reasons of public interest in the area of public health; for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes; or for the establishment, exercise, or defense of legal claims.

Right to restriction of processing: The data subject has the right to have the data controller restrict processing at the data subject’s request if one of the following conditions applies: the data subject contests the accuracy of the personal data; the processing is unlawful; the data controller no longer needs the personal data for processing purposes, but the data subject requires them for the establishment, exercise, or defense of legal claims; the data subject has objected to the processing.

If processing has been restricted, such personal data—apart from storage—may only be processed with the data subject’s consent or for the establishment, exercise, or defense of legal claims, or for reasons of important public interest.

Right to data portability:The data subject has the right to receive the personal data they have provided to the data controller in a structured, commonly used, machine-readable format. They also have the right to transmit those data to another data controller without hindrance from the controller to which the personal data were provided, if the processing is based on the data subject’s voluntary consent or a contract to which the data subject is a party, and the processing is carried out by automated means. Where technically feasible, the data subject can request to have the personal data transmitted directly from one controller to another.

Right to object: The data subject has the right, on grounds relating to their particular situation, to object at any time to the processing of their personal data which is based on a public interest or legitimate interest of the controller (including profiling based on those grounds). In such cases, the data controller may no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the data subject’s interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.

If personal data are processed for direct marketing purposes (including profiling for direct marketing), the data subject has the right to object at any time to processing of personal data concerning them for such marketing. If the data subject objects to processing for direct marketing purposes, personal data can no longer be processed for such purposes

Special Provisions for Processing Personal Data of Children

Regarding personal data processing carried out in connection with the website, the data subject’s voluntary consent — in the case of a child under the age of 16 — is considered lawful only if and to the extent that such consent is given or authorized by the person who holds parental responsibility over the child. However, a child who has reached the age of 16 may provide their voluntary consent to the processing of their personal data in this manner without separate parental permission.

Taking into account the available technology, the data controller makes every reasonable effort to verify that, in the case of users under 16, consent to data processing has been given or authorized by the holder of parental responsibility over the child.

Special Provisions for Processing Personal Data of Children

Personal Data Processing Activities Carried Out by the Website Operator

Personal Data Processing During Correspondence with Website Clients

Description of the data processing procedure and main circumstances: The website’s clients have the opportunity to send an email message to the data controller (operator) for information or administration purposes via the “contact form” on the website interface or through one of the listed email contacts. The data controller handles these emails in accordance with its internal data protection regulations outlined in this policy.

The data controller routes its email traffic through Google LLC (headquarters: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

Legal basis for processing: The data subject’s voluntary consent and/or the data controller’s legitimate interest.

Purpose of processing: To maintain contact with the website’s clients and to facilitate the handling of client-related matters.

Scope of processed data: The data subject’s name, address, email address, phone number, and the subject and content of the correspondence.

Method of data storage: In electronic and paper-based databases.

Data retention period: 1 year after the conclusion of the ongoing correspondence, or until client data is recorded, and until the data controller’s related legitimate interests are met or its obligations are fulfilled.

Is data transferred during the processing, and if so, to which recipient: no.

Does automated decision-making or profiling occur during the processing: no.

Personal Data Processing Related to Incoming Complaints

Description of the data processing procedure and main circumstances: Clients can submit complaints related to the website’s services via phone, email, mail, or in person to the website operator (data controller). During the handling of these complaints, the data controller may record and, if necessary, forward to its business partners those personal data of clients that are indispensable for conducting the complaint handling process. During the complaint handling, the data controller will only transfer personal data if the data subject has given prior consent or if the data controller has verified in advance that its business partner complies with the relevant data protection laws (detailed in Section 4) and has entered into a data processing or data controlling contract with the business partner.

Legal basis for processing: The data subject’s voluntary consent and/or the data controller’s legitimate interest.

Purpose of processing: To facilitate the handling of client complaints and to ensure communication with clients during this process.

Scope of processed data: Az érintett neve, lakcíme, tartózkodási helye, e-mail címe, telefonszáma, az igénybe vett szolgáltatás (vásárolt termék) megnevezése, a panaszra okot adó körülmények.

Method of data storage: In electronic and paper-based databases.

Data retention period: Data retention period: 1 year after the conclusion of the complaint handling process, or until the data controller’s related legitimate interests are met or its obligations are fulfilled.

Is data transferred during the processing, and if so, to which recipient:Is data transferred during the processing, and if so, to which recipient: Data may be transferred to the business partner involved in the warranty issue related to the complaint.

Does automated decision-making or profiling occur during the processing: no.

Data Processing in Case of Contact via Phone Number Provided on the Website

Description of the data processing procedure and main circumstances: The website operator (data controller) provides telephone contact information on the website through which interested parties can obtain further information or professional advice about its services. In principle, contacting via these phone numbers is anonymous and does not require the provision of personal data. However, if the data subject explicitly requests, or if it is necessary for the handling of the matter, the operator’s representative may record personal data provided by the data subject for the purposes of further administration. During phone conversations, personal data disclosed by clients to the data controller may be recorded by the data controller on paper and/or electronically in justified cases for the sake of procedural needs, and managed in its paper-based and electronic client records.

Legal basis for processing: The data subject’s voluntary consent and/or the data controller’s legitimate interest.

Purpose of processing: To provide clients with a convenient, quick, efficient way to handle matters remotely, and to ensure communication that may become necessary in connection with this service.

Scope of processed data: Scope of processed data: The data subject’s name, home address, current address, email address, phone number, and any other information provided by the data subject during the telephone contact.

Method of data storage: In electronic and paper-based databases.

Data retention period: Until December 31 of the year following the conclusion of the telephone transaction, or until the client data is recorded, or until the data controller’s related legitimate interests are met or its obligations are fulfilled.

Is data transferred during the processing, and if so, to which recipient: no.

Does automated decision-making or profiling occur during the processing: no.

Additional Data Processing Concerning the Website User for Which Separate Policy Has Been Prepared

The data controller provides detailed information regarding the cookies used on the website in the “Cookie Management Policy.”

Handling of Data Protection Incidents

The data controller will report a data protection incident to the supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the incident is unlikely to result in a risk to the rights and freedoms of natural persons.

The data controller keeps a record of data protection incidents in accordance with legal requirements, retaining the data in the record for 5 years. The record of data protection incidents includes: the scope and number of data subjects affected by the incident; the categories of personal data concerned; the date and time of the data protection incident; the circumstances and effects of the data protection incident; and the measures taken to remedy the data protection incident.

If a data protection incident is likely to result in a high risk to the rights and freedoms of natural persons, the data controller will inform the data subject of the incident without undue delay. The communication must describe in clear and plain language the nature and main facts of the data protection incident, as well as the measures taken by the data controller to address it.

The supervisory authority may also order the notification of data subjects if, in its assessment, the data protection incident is likely to result in a high risk.

The data controller is not required to inform the data subject of the data protection incident if any of the following conditions are met:

the data controller had implemented appropriate technical and organizational protection measures, and those measures were applied to the personal data affected by the incident (in particular those measures, such as encryption, that render the data unintelligible to any person who is not authorized to access it);
the data controller has taken subsequent measures following the incident to ensure that the high risk to the data subject’s rights and freedoms is no longer likely to materialize;
notifying the data subject would involve disproportionate effort. In such cases, a public communication or similar measure whereby the data subjects are informed in an equally effective manner must be made instead.
Remedies and Compensation

Legal Remedies:

If a data subject has a complaint regarding the processing of their personal data, it is advisable to first communicate it to the data controller in order to clarify the matter as soon as possible and to seek an amicable resolution.

In addition, every data subject has the right to lodge a complaint with a supervisory authority — in particular in the Member State of their habitual residence, place of work, or place of the alleged infringement — if they believe that the data controller’s processing of their personal data violates applicable data protection laws. Furthermore, every natural and legal person is entitled to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them. Moreover, every data subject is entitled to an effective judicial remedy if they believe that their rights under data protection laws have been infringed as a result of the processing of their personal data not complying with those laws.

Compensation:

Any person who has suffered material or non-material damage as a result of an infringement of data protection laws is entitled to receive compensation for the damage suffered from the data controller or the data processor. Every data controller involved in processing is liable for the damage caused by processing that infringes data protection laws. The data processor is liable for damage caused by processing only if it has not complied with the obligations of data protection law specifically directed at processors, or if it acted outside or contrary to the lawful instructions of the data controller. The data controller or data processor shall be exempt from liability if it proves that it is not in any way responsible for the event giving rise to the damage.

Supervisory Authority: National Authority for Data Protection and Freedom of Information (NAIH, Hungary)

Headquarters: 1125 Budapest, Szilágyi Erzsébet fasor 22/c.

Mailing address: 1530 Budapest, P.O. Box 5.

Phone: +36 (1) 391-1400

Fax: +36 (1) 391-1410

Email address::ugyfelszolgalat@naih.hu

Website:https://naih.hu/

Judicial remedy may be sought at the competent tribunal court according to the registered office of the data controller.

Budapest, 2024.08.01.

Privacy Policy

Privacy Policy

Közösségi oldalaink:

This is custom heading element