Privacy policy and data management 

I.

The FELFÖLDI Sweets Manufacturing Limited Liability Company (represented by managing director Roland Felföldi, VAT number: 13723574-2-09) 4030, Diószegi road Eastern Industrial Site 6 based company (hereafter as Data Manager and Service Provider) sets out the expectations below that have been formulated and complied with referring to itself as Data Manager; makes a commitment that all data management and transmission of data relating to its activities meet the expectations of present regulation and existing legislation on data protection.  

This privacy policy can be modified at any time by Data Manager in accordance with the law. Users accept modification-after having entered into force-by using web services. The prevailing version of the privacy policy is available at www.felfoldi.hu/privacypolicy

Felföldi Sweets Manufacturing Ltd. asks its visitors (Users) to read this privacy policy before using the website. By using the website Users accept conditions included in present privacy policy.

User may ask Data Manager to change or delete his stored data any time. Data Manager does not take the responsibility of reliability of user’s personal data given. It is only the user who is responsible for them.

Service Provider is determined concerning protecting personal data highlights the importance of respecting the right to informational self-determination. Personal data is kept confidential and Data Manager shall take all safety, technical and organizational measures to guarantee the security of data.

Data Manager takes care of maintaining requirements for data security on the basis of Act CXII 2011. To fulfil this, necessary technical measurements have been taken against unauthorized access, alteration, disclosure, deletion or destruction, accidental destruction or damage. Regarding this the Data Manager declares that any employee who has access to personal data is required to preserve data confidentiality.

Data management principles are in line with current legislation on data protection, in particular the following:

Act EU 2016/679 The General Data Protection Regulation (GDPR)
Act CXII. 2011 on the right of informational self-determination and freedom of information
Act C. 2000 on accounting;
Act CVIII. 2001 on certain aspects of electronic commerce services and information society services;
Act C. 2003 on electronic communications;
Act XC. 2005 on freedom of electronic information;
Act XLVII. 2008 on banning unfair commercial practises against consumers;
Act XLVIII. 2008 on certain fundamental conditions and limitations of business advertising;
Act XC. 2005on freedom of electronic information;
Act C. 2003 on electronic communications;
16/2011. c. EASA / IAB recommendation for a review of best practices in online behavioural advertising

On the basis of 3. § of Act CXII. 2011 on the right of informational self-determination and freedom of information, the concepts used in this regulation are the following:

a) person involved: any determined person identified directly or indirectly or can be identified based on any specified personal data;
b) personal data: data associated with the person involved – especially name, identification number, and one or more pieces of specific knowledge to his physical, physiological, mental, economic, cultural or social identity- and from which conclusions may be excluded concerning him;
c) consent: the determined and voluntary expression of wish concerning the person involved, which is based on appropriate information and with which he gives his unambiguous consent to manage fully or up to a certain extent his personal data;
d) objection: statement by the person involved, with which he has the chance to criticize the management of his personal data, and calls for the elimination of data management and deletion of treated data;
e) Data Manager: any natural or legal person, or organization without legal personality, who or which alone or jointly with others sets the aim of data management, determines and implements the decisions on data management (including used instruments) make a contracted data processing executor done this implementation;
f) data management: any operation or set of operations performed on data regardless of the method used, in particular, collecting, recording, organizing, storing, altering, using, polling, transmitting, disclosing, coordinating, combining, blocking, deleting or destructing, as well as preventing data from further use, photographing, sound or video recordings and recording physical characteristics suitable for identification (such as fingerprints and palm prints, DNA samples and iris images.);
g) transmitting data: making data accessible to specified third party;
h) disclosure: making data available to anyone;
i) deletion of data: making data unrecognizable in such a way that the restoration is no longer possible;
j) data designation: adding identification mark to data in order to make it distinguishable from others;
k) data blocking: adding identification mark to data in order to limit further treatment in a final or definite period of time;
l) data destruction: full physical destruction of storage media containing data;
m) data processing: performing technical tasks related to data processing, regardless of the methods or means as well as application used, provided that technical tasks are performed on data;
n) data processor: any natural or legal person or organization without legal personality who or which have a contract with the data manager - including contract on the basis of the provisions of law as well - is processing the data;
o) third party: any natural or legal person or organization without legal personality who or which is different from the person involved, the data manager or the data processor;
p) third country: every country which is not an EEA member state;

II. DATA MANAGEMENT PRINCIPLES OF PROVIDER:

The person concerned must be notified prior to the commencement of data management that it is mandatory or based on consent. The person involved must be informed clearly, understandably and in  detail about all the facts concerning data management, in particular, the purpose of data processing and legal basis of data management, the authorized persons of data management and processing, the duration of treatment, the fact that personal information is managed by Data Manager with  the consent of the person involved in order to fulfil a legal obligation concerning Data Manager or pursuing legitimate interest of a third party, or about those who are entitled to get to know the data. The information should include the rights and remedies in relation to data management concerning the person involved.

WHAT Personal Data Do We Collect and WHEN?

We ask you for certain personal data to provide you with the products or services you request. For example, when you make purchases, contact our consumer services, request to receive communications, create an account, participate in our events or contests, or use our Sites or Apps.

This personal data includes your:

• contact details including name, email, telephone number and shipping, billing address;
• login and account information, including screen name, password and unique user ID;
• personal details including gender, hometown, date of birth and purchase history, payment or credit card information;
• images, photos and videos;
• personal preferences including your wish list as well as marketing and cookie preferences.

When interacting with our Sites and Apps, certain data is automatically collected from your device or web browser. More information about these practices is included in the “Cookies and Pixel Tags” section of this privacy policy below.  This data includes:

• Device IDs, call state, network access; and
• Cookies, IP addresses, referrer headers, data identifying your web browser and version, and web beacons and tags.

2.1. The legal basis of data management:

Data Manager is entitled to getting to know personal data according to the legislation in force.

1. Personal data can be managed if:
- The person involved gives his consent, or
- it is decreed by local government for public interest purposes on the basis of law or the scope defined in an act. (Compulsory data management)

2. Personal data can also be managed if it is impossible to get the consent of the person involved or it is associated with disproportionate costs and managing data

a) is necessary to fulfil legal obligation concerning Data Manager,
b) is necessary to pursue legitimate interest concerning Data Manager or a third party, and enforcement of these interests is in accordance with limiting the right to protect personal data.

3. Concerning incompetent or people under 16 with diminished capacity the consent of their legal representative is needed in order to make a statement, except for parts of services where declaration concerns data management in everyday situations and therefore no special consideration is required.

If the person involved cannot gives his consent because of his disability or due to other unavoidable reasons, then personal data in question can be managed to a specified extent during the existence of barriers of giving consent concerning the following situations: protecting their own or other people’s vital interests, preventing or resolving immediate danger on people’s lives, physical integrity or assets.  

4. Valid consent or subsequent approval of the legal representative is not required to the validity of disclaimer involving the consent of the person involved if he is under the age of 16.

5.  If the inclusion of personal data in question took place with the consent of the person involved, unless otherwise specified in the Act, Data manager is entitled to manage data
- to fulfil legal obligation concerning Data Manager, or
- to pursue legitimate interest concerning Data Manager or a third party without further specific consent or even after the withdrawal of the consent if the enforcement of these interests is in accordance with limiting the right to protect personal data.

Personal data can be managed only for specified purposes, legal practice or fulfilment of obligations. Data management must meet this objective at any stage, furthermore, recording and managing data must be fair.

Only that kind of data can be managed which is essential and suitable for achieving the objective of data management, only to the extent and duration necessary to achieve that purpose.

Personal data may be managed with consent which is based on appropriate information.

During data management the data accuracy, completeness and being up to date must be ensured. It is also crucial to grant that the person involved can be identified only during the time needed for data management.

Users can only give their personal data on the website. If not own data is given it is the user who is obliged to obtain consent from the person involved.

Personal data can be transferred or handed over to Data Manager who carries on its activities concerning data management or data processing in a third country if the person involved has given his explicit consent, or the conditions specified above for data management have been fulfilled, and an adequate level of protection of personal data is provided concerning the management of data transmitted and processed. Data transfer to the EEA States shall be deemed as data transfer would take place within the territory of Hungary.

2.2. The scope of personal data, the purpose, claim and time period of data management

The data management concerning the activities of the service provider is based on voluntary consents. However, in certain cases the management, storage and transmission of specified data is made compulsory by law. In this case User will be noticed.

Informants must be aware of the fact if they do not provide their own personal data, they are obliged to get permission the person involved.


2.2.1. User information related to the use of felfoldi.hu Website

The aim of data management: when visiting the website personal data is recorded by Service Provider in order to prevent abuse and to provide personalized service.
The Claim of data management: the consent of the person involved and 13/A. § (3) paragraph on Electronic Commerce.
Scope of managed data: full name, e-mail address, address, age, Facebook User’s name, date, time, visited webpage, IP address of User’s computer, and data related to User’s operational system and browser.
Period of time related to data management: one year after visiting the website or one year after the last the services provided.

When analyzing log files, and other data come up, Provider will not connect them to other information, and will not seek to identify user’s personality.

If the user does not explicitly specify data and information relating to himself, then the Provider does not collect or manage any personal data by which a user's personally would be identifiable.

An IP address is a series of numbers, which is suitable for identifying users' computers when going online. With the help of IP addresses visitors using a given computer can be localized either geographically. The pages visited and the date, time data are not suitable for identifying the person involved on their own, but in combination with other (e.g. Specified during registration) data they are good to withdraw conclusions concerning the user.

By visiting the website all users accept the use of cookies concerning the website by freelance Service Providers who record data and information which is involved in Privacy Policy and Data Management.  

Such data is generated when User logs in and goes online, and the cookies of the website record them as a result of the technical processes during the use of the Website. The automatically recorded data- without the user's specific statement or act – is logged when you visit the website or exit.

Due to basic settings a significant number of internet search engines accept cookies. At the same time it is possible for the Users to disable or reject them. Hereby we call your attention to the fact that disabling cookies by Users does not affect surfing or visiting our website, however it can occur that you will not able to visit some of the parts of the website or receive customized information.

Cookies are small programs or short text files, which are sent by a website to the hard drive of the User’s computer. Cookies contain information relating the User.  

The Internet search engine used by User automatically transmits certain further information towards the website, e.g. IP address of the User’s computer.

Data collected this way cannot be used for identification without giving further identification data. Data Manager will not connect further identification data with data collected by the application of these tracing techniques.

Data obtained this way by Data Manager will exclusively be used for making the services of the website easier to use, the assessment of the number of visitors and designing the webpage in accordance with the Users’ demands.

Application of cookies can be disabled and stored search history can be deleted at any time, which activities will not affect the right for applying the services on the website.

By using the website, you definitely approve of placing cookies on your computer in an automated way as it is defined in this present point. You also approve of cookies to be used in a strictly anonymous way according to and for the purposes of this present point.

These data will not be connected with other personal data of Users. Users will not be identified based on these data. Data of this kind are only available for outside Service Providers and Data Manager that handle the cookies.

Data Manager solely use cookies managed by outside Service Providers (e.g. Google) on the website. Cookies are small programs or short text files, which are sent by a website to the hard drive of the User’s computer. Cookies contain information relating the User.  

The independent auditing and assessment of the number of visitors and other web analytical data of the website www.felfoldi.hu. are helped by Google Analytics Server as an outside Service provider. Data Management can give detailed information about handling assessment data via www.google.com/analytics.

Service provider informs Users that outside Service providers place and re-read small data packages, so-called cookies on the Users’ computers in order to receive customized services. If the search engine sends back a previously saved cookie, the Service provider that handles the cookies has the opportunity to connect the user’s factual visit with the former ones, but exclusively as regards the provider’s own content.

Service provider informs Users that data of service clients will be stored at the rackforest.hu Storage Provider’s web hosting (1116 Budapest, Sáfrány utca 6. Tax number: 14671858-2-43).  
Service provider declares that managing Users’ data in www.rackforest.hu system is exclusively done by the Service Provider, and also declares that the previously defined regulations fixed in this present point regarding Users’ data is valid and applicable, also if cloud based data management is concerned. Service Provider takes responsibility for complying provisions fixed in this present data management regulation, in the frame of cloud based management.

Information on cookies:
By using different applications web pages visited by ’Users’ during surfing the Internet try to obtain as many and as detailed information as possible about visitors, their habits and interests.  Among the previously mentioned ways – regarding their frequency – the so called cookies and web beacons occupy prominent places.  Using cookies raises ethical and legal questions, since they are regarded as personal data, as they enable a more punctual identification of Users than the widely known IP addresses of computers.

Cookies
A cookie is a small text file that is placed on a computer or other device and is used to identify the user or device and to collect information. Cookies are typically assigned to one of four categories, depending on their function and intended purpose: strictly necessary cookies, performance cookies, functional cookies, and cookies for targeting and advertising purposes.

Cookie settings

Users can disable or permit the installation of cookies on their own computers, but it is important to know that disabling all cookies can help protect our personal data; it can also restrict the usability of certain websites. Using and permitting cookies is not necessary for simple surfing. Users can delete the cookies from their own computers, or they can disable the application of cookies. User can delete or disable cookies from own computer or disable cookies in own search engines. Users can handle cookies in search engines, in Tools/Settings menu point, under the menu point Setting data protection, under the heading ‘Cookies’.

Before the completion of the validity period visitors can delete the previously installed cookies from their computer. Mostly under the Tools/Settings; Search history; Delete menu point of the search engine it is possible to delete cookies.
Note that cancelling all the cookies on the computer’s hard disk may cause improper operation of certain websites.

2.2.2. Management of  www.felfoldi.hu Webpage cookie

We use only a performance cookies serviced by Google to perform analytics functions however social media cookies can be used by social media service providers like Facebook, Twitter or other social media networks, see Social media and Advertising cookies below.

Performance cookies: These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular, see how visitors move around the site, and whether they clicked on a link. This lets us know where we are doing well, and where we can improve, as well as making sure the pages load quickly and display properly. Information collected includes, for example, the Internet browsers and operating systems used, the domain name of the website previously visited, the number of visits, average duration of visit, and pages viewed. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our website, and will not be able to monitor its performance and enhance your experience.

Social media and Advertising: Social media cookies offer the possibility to connect you to your social networks and share content from our Sites through social media.  Advertising cookies (of third parties) collect information to help better tailor advertising to your interests, both within and beyond our Sites. In some cases, these cookies involve the processing of your personal data. Refusing these cookies may result in seeing advertising that is not as relevant to you or you not being able to link effectively with Facebook, Twitter, or other social networks and/or not allowing you to share content on social media.

2.2.3. NEWSLETTER, DM activity

Pursuant to 2008 XLVIII. Act 6 § on basic conditions and certain restrictions of Commercial Advertising Activities On definite and preliminary approval of the User, Service Provider sends promotion offers and other mails to any of the contacts given by the User at registration. Keeping the provisions of regulations in mind User may give an approval to the Service provider to handle User’s necessary personal details with the purpose of sending promotion offers.
Service provider will not send unasked promotion messages and User can unsubscribe from sending offers without restrictions, or reasoning and for free.  In this case Service provider will delete personal data – necessary for sending promotion messages – from registers and will not send more promotion offers to User any longer. By clicking the link in messages User unsubscribe from promotions.

Purpose of data management: sending newsletters also including commercial advertisements for  inquirers, giving actual information, games, discounts, direct marketing messages, preparation of customized offers, keeping contact, but exclusively on approval of User by ticking the appropriate field in relation or by subscribing for newsletters.  
Legal basis of data management: voluntary approval of the person involved, E-commerce Law 13 / A. § and Commercial Advertising Activities. § 6 (5) paragraph.
Scope of data managed: identity number, date and time of subscription, full name, email address, age, address, approval to direct marketing messages.
Period of data management:
until withdrawal of User’s approval, but maximum
24 months from last data update of User
Any requirements regarding cancellation or modification of approvals to direct marketing messages, personal details are possible at the following contact addresses:
via email  privacy@felfoldi.hu
Via post 4030 Debrecen, Diószegi út, Keleti Ipartelep 6.
Data management registration number:
NAIH: 90723/2015 és 90722/2015

2.2.4. Game registration  

The purpose of managing data: conducting the prize game, drawing, notification of winners, delivery of prizes to the winners, promotion, fulfilment of accountancy obligations, and furthermore, sending email newsletters including economy commercials to the inquirers, providing actual information, discounts, direct marketing, preparation of customized offers, keeping contacts.
The legal basis of data management: the approval of the volunteer involved, E-commerce law 13 / A. § and Commercial Advertising Activities § 6 (5).
Scope of the managed data: date and time of registration, IP address of the computer, full name and address, email address, age, approval to direct marketing and data handling.
The deadline of the data management:
As regards the data of the winners’ name, address and prize on the basis of Accounting Act 169. § (2) paragraph ; 8 years
as regards all other data: the year 2020
Transferring data: date and time of sign up, IP address of the computer, full name, age, address and email address of the subscribers – on approval of the involved – is transferred to the database of Newsletter indicated here in the Data protection Regulations.

Disclosure: full name of the winners, name of settlements, their prize and the service enlisted will be disclosed on the website www.felfoldi.hu and on Facebook.

When handing over certain prizes – only on the on-site approval of the player – video and audio recording of the event can be made.

Any requirements regarding cancellation or modification of approvals to direct marketing messages, personal details are possible at the following contact addresses:
via email at privacy@felfoldi.hu
via post 4030 Debrecen, Diószegi út, Keleti Ipartelep 6.

Data management registration number:
NAIH 90723/2015 and 90722/2015

2.2.5. Handling of complaints

Purpose of data management: handling complaints in connection with services provided by Service provider.
Legal basis of date management: approval of the volunteer involved.
 Scope of data managed: line number, name and address of the client, description and recompense of the service, time of use of the service, time  and description of complaint, the demand the client wish to enforce, way of settling the complaint .
Time period of data management: 3 years


III. DATA PROTECTION

Data manager is obliged to take care about the safety of data, and furthermore, makes the technical and organizational arrangements, establishes the procedures regulations, which are intended to ensure the safety and protection of the recorded, stored and handled data and prevents their annihilation, unlawful usage or unlawful modification. Data manager is obliged to call each and every third party that, based on the approval of Users can be transferred or give away data to, to fulfil the requirements of data safety.

 Data manager ensures unavailability of data for unauthorized persons, non-disclosure of data, shall not be transferred, modified or deleted. The handled data are only available for Data manager and those involved employees of Data processors that act on behalf of the Controller. None of the data can be transferred or given away to unauthorized third parties by Data manager.

 Data manager does its best against intended or unintended damages or destruction of the data. The undertaking above is imposed to the employees of the Data manager involved in the activity of handling the data, and employees of Data processors acting on behalf of the Controller.  

User acknowledges and accepts that in case of entering personal data on the Website –despite the fact that Data manager has up-to-date safety devices for preventing any unlawful access or seeing into them – safety and protection cannot be guaranteed to a full extent on the Internet. Data manager does not take the responsibility for any damages, obtaining or acquiring data from the User or that are caused by unlawful access despite our efforts to prevent them.

Under no circumstances will Data manager collect special data that refer to race origins, belonging to national or ethnical groups, political views or party affiliation, religious or other ideology convictions, membership in representation of interests, health condition, pathological passions, sexual life, or criminal record.

Users’ rights of data handling:

• ask for a copy of your information
• ask for information to be corrected;
• ask for information to be erased or deleted; 
• ask for us to limit or restrict processing; 
• object to us processing your data, in particular where we use the data for direct marketing, including profiling for direct marketing purposes.  The right to object does not apply if we must process the data to meet a contractual or legal requirement;
• ask us to send you a copy in a structured digital format or ask for us to send it to another party.
• 
  Some rights, however, may be limited. We may be obliged by law or regulation to keep information.  We must respect other people’s privacy as well, which means we may need to redact or remove information where it includes personal data about someone else, even if it is connected to your data.  On occasion there may be a compelling legitimate interest to keep processing data.

Please see the details below:

By sending an email to the email address of Data manager mediamanager@felfoldi.hu, Users are free to ask information on the handling of their data, ask for correction, modification or deletion of their personal data, and may object to handling their data. On receiving applications Data manager is obliged to give the necessary information in intelligible written form at the earliest opportunity but in 30 days at the latest.  In so far as the person involved does not agree with the decision made by Data manager, they can appeal for legal remedies at the court or authorities within 30 days of the statement of the decision.

Users may apply in written for the deletion of their personal data anytime at any of the Data manager’s contacts.
On application, Data manager will lock the personal data of User instead of deleting it, or will do the same if on the basis of available data it is presumable that deletion would harm the rightful interest of User involved. The data locked in this way remains handled by Data manager as long as the data handling aim persists which prevented the data from deletion.

Service provider will refund any damages caused by unlawful data handling, or breaking the rules of safety requirements. Data manager is not responsible for any damages that are caused by unavoidable reasons outside the scope of data management.
Data manager will not refund the damage resulting from intended or seriously careless behaviour of the harmed.

In case of legal injury User can apply for legal remedies or refer complaints at Data manager, in court or at the National Authority for Data Protection and Freedom of Information.

Contact details of Authorities of Legal remedies:

Debrecen Courthouse 4002 Debrecen, Széchenyi utca 9. (Judgement of the trial is within the competence of the courthouse. The trial – in accordance with the person involved – can be proceeded in the court of a courthouse at a place of residence or stay of the person involved.
National Authority for Data Protection and Freedom of Information
Seat: 1125 Budapest, Szilágyi Erzsébet fasor 22/C.
Postal address: 1530 Budapest, Pf.: 5.
Telephone: 003613911400
Fax: 0036613911410
E-mail: ugyfelszolgalat@naih.hu
 
Exclusively on definite consent of the User or on obligation by law or other legal regulations will Data manager discloses any personal data to a third party. In case it is necessary to disclose personal data to third parties, or authorities, Data manager will inform user by email promptly.
 
For further questions on managing personal data, information will be given at the following email address: privacy@felfoldi.hu
 
Felföldi Sweets Manufacturing Ltd. Service provider and Data manager will not use any personal data handled for the purpose of a third party, and will not misuse them in any other way.

Hereby we are informing Users that electronic messages via the Internet, independently from the protocol (email, web, ftp, etc.) are very vulnerable against network threatening that lead to unlawful activities, contract debates, modification or disclosure of information. Data manager will make maximum efforts to prevent threatening of these types. Data manager observes systems in order to record every safety difference and prove evidence in case of security events. Monitoring systems also enables checking the efficiency of applied precautionary measures.

IV. CONTACT DEATILS OF DATA MANAGEMENT:

4.1. Contact details of data management:
Name: Felföldi Sweets manufacturing Ltd.
Seat: 4030 Debrecen, Diószegi út, Keleti Ipartelep 6.
Trade register number: Cg.09-09-012550
Name of registering court: Debrecen Courthouse, as registry Court
Tax number: 13723574-2-09
Telephone: 003652437293
E-mail: privacy@felfoldi.hu
NAIH registration number: 90723/2015

4.2. Name and contact details of data processor:
Name: Felföldi Sweets Manufacturing Ltd.
Seat: 4030 Debrecen, Diószegi út, Keleti Ipartelep 6.
Trade register number: Cg.09-09-012550
Name of registering court: Debrecen Courthouse as Registry Court
Tax number: 13723574-2-09
Telephone: 003652437293
E-mail: privacy@felfoldi.hu
NAIH registration number: 90723/2015


V.) CHANGES TO OUR PRIVACY POLICY

Applicable law and our practices change over time. If we decide to update our privacy policy, we will post the changes on our Sites and Apps. If we materially change the way in which we process your personal data, we will provide you with prior notice, or where legally required, request your consent prior to implementing such changes. We strongly encourage you to read our privacy policy and keep yourself informed of our practices.  This privacy policy was last modified in May 2018.

VI.) OTHER REGULATIONS

The provisions of 2011 CXII Act, regarding Hungarian law, especially autonomy of information rights and information freedom are applicable on the present regulations of data protection.
Data manager reserves the right at all times to unilaterally modify the present Data protection regulations any time as is preliminary communicated to the involved.  

Debrecen, 25 May 2018  

Felföldi Sweets Manufacturing Ltd.
Data Manager