Privacy Policy
INTRODUCTION
Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the Regulation) provides that the Controller shall take appropriate measures to provide any information relating to the processing of personal data to the data subject in a concise, transparent, intelligible, and easily accessible form, using clear and plain language, and that the Controller shall facilitate the exercise of data subject rights.
The obligation to provide preliminary information to data subjects is also mandated by Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information.
Through the notice set out below, we comply with this statutory obligation.
This notice must be published on the company's website or sent to the data subject upon request.
CHAPTER I – IDENTITY OF THE CONTROLLER
The publisher of this notice, and the Controller, is:
- Company name: Packers Energo Light Kft.
(hereinafter: Company)
CHAPTER II – DESIGNATION OF DATA PROCESSORS
Data processor: a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller; (Article 4(8) of the Regulation)
Engaging a data processor does not require the prior consent of the data subject, but the data subject must be informed. Accordingly, we provide the following information:
1. Our Company's IT Service Provider
Our Company uses a data processor for the maintenance and management of its website. This provider delivers IT services (web hosting) and, in this context—for the duration of our contract with them—processes personal data provided on the website. The operation performed by the provider consists of storing personal data on the server.
The details of this data processor are as follows:
- Company name: Pegaton Studio Kft
- Registered office: 2700 Cegléd, Lajos u. 9.
- Company registration number: 13-09-131495
- Tax number: 14904206-1-13
- Representative: Erzsébet Barsi
2. Our Company's Accounting Service Provider
To fulfill its tax and accounting obligations, our Company engages an external service provider under an accounting services contract. This provider processes the personal data of natural persons who have a contractual or payment relationship with our Company, strictly for the purpose of fulfilling our Company's statutory tax and accounting obligations.
The details of this data processor are as follows:
- Company name:
- Registered office:
3. Postal Services, Delivery, and Courier Services
These data processors receive the personal data required to deliver ordered products from our Company (data subject's name, address, telephone number) and use this data to deliver the products.
These providers:
– Magyar Posta – Courier Service
- Company name:
- Registered office:
4. Property Security Service Provider
This data processor operates workplace video surveillance, access control, and associated data processing on behalf of our Company for the duration of our contract with them.
Name of the service provider:
- Company name:
- Registered office:
CHAPTER III – DATA PROCESSING RELATED TO EMPLOYMENT
1. Labor and Personnel Records
(1) Only data and occupational medical fitness examinations strictly necessary for establishing, maintaining, and terminating an employment relationship, or for providing social and welfare benefits, may be requested from and recorded for employees, provided they do not infringe upon the employee's personal rights.
(2) On the legal basis of pursuing the employer's legitimate interests (Article 6(1)(f) of the Regulation), the Company processes the following employee data for the purposes of establishing, performing, or terminating employment:
1. name 2. birth name, 3. date of birth, 4. mother's name,
(3) Data concerning illness and trade union membership may only be processed by the employer to exercise a right or fulfill an obligation specified in the Labor Code.
(4) Recipients of personal data: company management, persons exercising employer authority, employees of the Company performing human resources duties, and data processors.
(5) Only the personal data of employees in executive positions may be disclosed to the owners of the Company.
(6) Retention period for personal data: 3 years following the termination of employment.
(7) Prior to commencing data processing, the data subject must be informed that the processing is based on the Labor Code and the pursuit of the employer's legitimate interests.
2. Data Processing Related to Aptitude Tests
(1) Employees may only be subjected to aptitude tests that are prescribed by employment regulations or are necessary for exercising a right or fulfilling an obligation specified in employment regulations. Prior to the test, employees must be provided with detailed information regarding, among other things, the skills or abilities being assessed and the tools and methods used. If an examination is mandated by law, employees must also be informed of the title and exact provision of the legislation.
(2) Questionnaires assessing occupational fitness and preparedness may be administered to employees by the employer both prior to establishing employment and during the course of employment.
(3) Questionnaires designed to evaluate psychological or personality traits may only be administered to larger groups of employees for clear work-related purposes and to enhance workflow efficiency and organization if the data revealed during analysis cannot be linked to individual employees—meaning the data is processed anonymously.
(4) Scope of processed personal data: the outcome of occupational fitness assessments and the conditions required for the role.
(5) Legal basis for data processing: the legitimate interests of the employer.
(6) Purpose of personal data processing: establishing and maintaining employment, filling job positions.
(7) Recipients or categories of recipients of personal data: The test results may be accessed by the evaluated employee and the specialist conducting the evaluation. The employer may only receive information stating whether the evaluated individual is fit for the job and what conditions must be provided. The employer shall not have access to the test details or full documentation.
(8) Retention period for personal data: 3 years following the termination of employment.
3. Processing data of job applicants, applications, and CVs
(1) Scope of manageable personal data: name of natural person, date and place of birth, mother's name, residential address, qualification details, photograph, telephone number, email address, employer's notes prepared on the applicant (if any).
(2) Purpose of personal data processing: evaluation of applications and candidacies, concluding an employment contract with the selected candidate. The data subject must be informed if the employer has not selected them for the specific position.
(3) Legal basis for data processing: consent of the data subject.
(4) Recipients of personal data and categories of recipients: the executive authorized to exercise employer rights at the Company, and employees performing human resources duties.
(5) Duration of personal data storage: Until the application or candidacy is evaluated. Personal data of unselected applicants must be deleted. Data of individuals who have withdrawn their application must also be deleted.
(6) The employer may only retain applications based on the express, unambiguous, and voluntary consent of the data subject, provided that retention is necessary to achieve a data processing purpose compliant with statutory regulations. Such consent must be requested from applicants following the conclusion of the recruitment process.
4. Data processing related to the monitoring of email account usage
(1) If the Company provides an email account to the employee, the employee may use this email address and account exclusively for work-related duties, to ensure that employees communicate with each other or correspond on behalf of the employer with clients, other individuals, and organizations.
(2) The employee must not use the email account for personal purposes and must not store personal emails in the account.
(3) The employer is entitled to inspect the full contents and usage of the email account regularly – every 3 months –, during which the legal basis for data processing is the legitimate interest of the employer. The purpose of the inspection is to verify compliance with the employer's instructions regarding the use of the email account, as well as to review employee obligations (Labor Code, Sections 8 and 52).
(4) The executive of the employer, or the person exercising employer rights, is authorized to carry out the inspection.
(5) Provided the circumstances of the inspection do not preclude it, it must be ensured that the employee can be present during the inspection.
(6) Prior to the inspection, the employee must be informed of the employer interest justifying the inspection, who may conduct the inspection on behalf of the employer, the applicable rules under which the inspection will occur (compliance with the principle of proportionality/graduality) and the procedural workflow, as well as their rights and remedies related to the data processing involved in monitoring the email account.
(7) During the inspection, the principle of proportionality/graduality must be applied; thus, it must primarily be determined from the email address and subject line whether it pertains to the employee's duties and is not of a personal nature. The employer may review the content of non-personal emails without restriction.
(8) If, contrary to the provisions of this policy, it is established that the employee used the email account for personal purposes, the employee must be requested to delete the personal data without delay. In the event of the employee's absence or lack of cooperation, personal data will be deleted by the employer during the inspection. Due to the use of the email account contrary to this policy, the employer may apply employment-law consequences against the employee.
(9) In connection with data processing associated with the monitoring of the email account, the employee may exercise the rights set forth in the chapter of this policy governing data subjects' rights.
5. Data processing related to the monitoring of computers, laptops, and tablets
(1) Computers, laptops, and tablets provided by the Company to the employee for work purposes may be used by the employee solely to perform job duties; private use is prohibited by the Company, and the employee may not manage or store any personal data or correspondence on these devices. The employer may inspect data stored on these devices. The provisions of point 1.4 above shall otherwise apply to inspections by the employer of these devices and the associated legal consequences.
6. Data processing related to the monitoring of workplace internet usage
(1) The employee may only visit websites related to their work duties; personal internet usage in the workplace is prohibited by the employer.
(2) The Company is the holder of internet registrations performed in the name of the Company as part of work duties; user IDs and passwords referencing the company must be used during registration. If providing personal data is also required for registration, the Company is obliged to initiate their deletion upon termination of the employment relationship.
(3) The employer may monitor the employee's workplace internet usage, to which, along with the legal consequences, the provisions of point 1.4 apply.
7. Data processing related to the monitoring of company mobile phone usage
(1) The employer does not permit the private use of company mobile phones; mobile phones may only be used for work-related purposes, and the employer may inspect the phone numbers and data of all outgoing calls, as well as data stored on the mobile phone.
(2) The employee is obliged to notify the employer if they have used the company mobile phone for private purposes. In this case, the inspection can be carried out by the employer requesting an itemized call record from the telephone service provider and calling upon the employee to render the dialed numbers illegible on the document in the case of private calls.
The employer may stipulate that the costs of private calls must be borne by the employee.
(3) In all other respects, the provisions of Section 1.4 shall apply to the inspection and its legal consequences.
8. Data processing related to workplace access control
(1) When operating an access control system (non-electronic), information regarding the identity of the data controller and the manner of data processing must be posted.
(2) Scope of manageable personal data: name of natural person, address, vehicle license plate number, entry and exit times.
(3) Legal basis for data processing: enforcement of the employer's legitimate interests.
(4) Purpose of personal data processing: asset protection, performance of contract, monitoring compliance with employee obligations.
(5) Recipients of personal data and categories of recipients: the executive authorized to exercise employer rights at the Company, and, as data processors, employees of the Company's property security contractor.
(6) Duration of personal data storage: 6 months
9. Data processing related to workplace camera surveillance
(1) Our Company operates an electronic surveillance system at its registered office, business premises, and customer service areas for the protection of human life, physical integrity, personal freedom, trade secrets, and property protection, allowing for video, audio, or audiovisual recording; accordingly, the conduct of the data subject recorded by the camera also qualifies as personal data.
(2) The legal basis for this data processing is the enforcement of the employer's legitimate interests and the consent of the data subject.
(3) Clear and legible notice and informative signage must be placed in a prominent location indicating the fact that the electronic surveillance system is being used in the given area, to assist third parties wishing to enter the premises. Information must be provided with respect to each individual camera. This information must include notice regarding the fact of surveillance conducted by the electronic asset protection system, the purpose of creating and storing video and audio recordings containing personal data recorded by the system, the legal basis of the processing, the storage location of the recordings, retention duration, the identity of the person operating (using) the system, the scope of persons authorized to access the data, and provisions regarding the rights of data subjects and procedures for enforcing them.
(4) Video and audio recordings of third parties entering the monitored area (clients, visitors, guests) may be created and processed with their consent. Consent may also be given by implied conduct. Implied conduct includes, in particular, when a natural person present enters the monitored area despite posted signage and notices regarding the operation of the electronic surveillance system.
(5) Recorded footage may be retained for a maximum of 3 (three) working days if not utilized. Utilization means that the recorded video, audio, or audiovisual footage and other personal data are intended to be used as evidence in judicial or other administrative proceedings.
(6) Any person whose right or legitimate interest is affected by the recording of video, audio, or audiovisual footage may, within three working days from the recording, request that the controller not destroy or delete the data, provided that proof of their right or legitimate interest is substantiated.
(7) An electronic surveillance system must not be operated in spaces where surveillance may violate human dignity, particularly in changing rooms, shower facilities, restrooms, or, for example, medical examination rooms and their waiting rooms, nor in areas designated for employee rest breaks.
(8) If no one is lawfully permitted to be present on the workplace premises – particularly outside working hours or on public holidays – the entire area of the workplace (such as changing rooms, restrooms, and areas designated for rest breaks) may be monitored.
(9) Beyond individuals authorized by law, operating personnel, the employer's executive and their deputy, and the workplace manager of the monitored area are authorized to view data recorded by the electronic surveillance system for the purposes of detecting infringements and checking system functionality.
CHAPTER IV – CONTRACT-RELATED DATA PROCESSING
1. Processing data of contracting partners – register of customers and suppliers
(1) On the legal ground of contract performance, the Company processes the following data of natural persons contracting with it as customers or suppliers for the purposes of conclusion, performance, and termination of contracts, as well as granting contractual discounts: name, birth name, date of birth, mother's name, address, tax identification number, VAT identification number, sole proprietorship or primary agricultural producer ID number, identity card number, residential address, registered office and site address, telephone number, email address, website address, bank account number, customer number (client ID, order number), online identifier (list of customers, suppliers, loyalty customer records). This data processing is deemed lawful even if the processing is necessary in order to take steps at the request of the data subject prior to entering into a contract. Recipients of personal data: employees of the Company performing customer service duties, employees performing accounting and taxation duties, and data processors. Duration of personal data processing: 5 years following the termination of the contract.
(2) Prior to commencing data processing, the data subject must be informed that the processing is based on the legal ground of contract performance; this notification may also be provided within the contract.
(3) The data subject must be informed of the transmission of their personal data to data processors.
2. Contact details of natural person representatives of legal entity clients, buyers, and suppliers
(1) Scope of personal data processed: name, address, telephone number, email address, and online identifier of the natural person.
(2) Purpose of the processing of personal data: performance of a contract concluded with the Company's legal entity partner, business contact maintenance; legal basis: consent of the data subject.
(3) Recipients of personal data, or categories of recipients: employees of the Company performing customer service-related tasks.
(4) Duration of personal data storage: for 5 years following the termination of the business relationship or the representative status of the data subject.
3. Visitor data processing on the Company's website
(1) Cookies are small data files placed on the user's computer by the visited website. The purpose of a cookie is to facilitate and enhance the usability of the given info-communication, internet service. There are numerous types, but they are generally classified into two main categories. One is the temporary (session) cookie, which the website places on the user's device only during a specific session (e.g., during the security identification of an online banking session); the other type is the permanent (persistent) cookie (e.g., website language preferences), which remains on the computer until deleted by the user. Pursuant to European Commission directives, cookies [unless strictly necessary for the use of the respective service] may only be placed on the user's device with the user's consent.
(2) In the case of cookies that do not require user consent, information must be provided during the initial visit to the website. It is not necessary for the full text of the cookie policy to be displayed on the website; it is sufficient for the website operators to briefly summarize the essence of the information and provide a link to the comprehensive policy.
(3) For cookies requiring consent, the provision of information may also be associated with the initial visit to the website if data processing related to the use of cookies begins immediately upon visiting the page. If the use of the cookie is tied to the use of a function explicitly requested by the user, the information may also be presented in connection with accessing that function. In this case as well, displaying the full text of the cookie policy on the website is not required; a brief summary of the essential information and a link referencing the comprehensive policy is sufficient.
4. Information on the use of cookies
(1) In line with widespread internet practices, our Company also utilizes cookies on its website. A cookie is a small file containing a string of characters that is sent to the visitor's computer when visiting a website. When visiting the website again, the cookie enables the website to recognize the visitor's browser. Cookies may store user preferences (e.g., preferred language) and other information. Among other functions, they collect information about the visitor and their device, store individual settings, and may be used, for example, when utilizing online shopping carts. In general, cookies facilitate the use of the website, help provide a seamless web experience, serve as an efficient source of information, and enable the website operator to monitor site performance, prevent misuse, and ensure the continuous and proper quality of services provided on the website.
(2) During the use of the website, our Company records and processes the following data concerning the visitor and the device used for browsing:
• IP address used by the visitor, • browser type, • operating system characteristics of the device used for browsing (set language), • date and time of the visit, • visited (sub)page, function, or service.
(3) Acceptance and authorization of cookies is not mandatory. You can reset your browser settings to decline all cookies or to indicate when a cookie is being sent. Although most browsers automatically accept cookies by default, these settings can typically be modified to prevent automatic acceptance and to offer a choice each time.
You can find detailed information on the cookie settings of the most popular browsers at the following links:
- Google Chrome:
https://support.google.com/accounts/answer/61416?hl=en - Firefox:
https://support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop - Microsoft Internet Explorer 11:
http://windows.microsoft.com/en-us/internet-explorer/delete-manage-cookies#ie=ie-11 - Microsoft Internet Explorer 10:
http://windows.microsoft.com/en-us/internet-explorer/delete-manage-cookies#ie=ie-10-win-7 - Microsoft Internet Explorer 9:
http://windows.microsoft.com/en-us/internet-explorer/delete-manage-cookies#ie=ie-9 - Microsoft Internet Explorer 8:
http://windows.microsoft.com/en-us/internet-explorer/delete-manage-cookies#ie=ie-8 - Microsoft Edge:
http://windows.microsoft.com/en-us/windows-10/edge-privacy-faq - Safari:
https://support.apple.com/en-us/HT201265
Please note, however, that certain website features or services may not function properly without cookies.
(4) The cookies used on the website are not capable of identifying the user's personal identity on their own.
(5) Cookies used on the Company's website:
1. Technically essential session cookies
These cookies are necessary for visitors to browse the website and seamlessly and fully utilize its functions and the services available through the site, including, in particular, remembering actions taken by the visitor on specific pages during a session. The duration of data processing for these cookies applies solely to the visitor's current session; upon terminating the session or closing the browser, this type of cookie is automatically deleted from your computer.
Scope of processed data: AVChatUserId, JSESSIONID, portal_referer.
The legal basis for this data processing is Section 13/A (3) of Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services (E-Commerce Act).
Purpose of data processing: ensuring the proper operation of the website.
2. Cookies requiring consent:
These allow the Company to remember the user's choices regarding the website. The visitor may object to this data processing at any time, both prior to and during the use of the service. These data cannot be linked to the identifying data of the user and cannot be transferred to third parties without the user's consent.
2.1. Functional cookies:
The legal basis for data processing is the visitor's consent.
Purpose of data processing: increasing service efficiency, enhancing the user experience, and facilitating more convenient use of the website.
Duration of data processing: 6 months.
2.2. Performance cookies:
Google Analytics cookies – learn more here:
https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage
Google AdWords cookies – learn more here:
https://support.google.com/adwords/answer/2407785?hl=hu
5. Community Guidelines / Data Processing on the Company's Facebook Page
(1) The Company maintains a Facebook page to present and promote its products and services.
(2) Any question submitted on the Company's Facebook page does not constitute an officially filed complaint.
(3) The Company does not process personal data published by visitors on the Company's Facebook page.
(4) Visitors are governed by Facebook's Privacy Policy and Terms of Service.
(5) In the event of unlawful or offensive content being published, the Company reserves the right to exclude the individual concerned from membership or delete their comment without prior notice.
(6) The Company shall not be liable for any unlawful content or comments posted by Facebook users. The Company shall not be held liable for any operational errors, malfunctions, or issues arising from system modifications inherent to the operation of Facebook.
CHAPTER V – DATA PROCESSING BASED ON LEGAL OBLIGATION
1. Data processing for the fulfillment of tax and accounting obligations
(1) Under the legal basis of fulfilling a legal obligation, the Company processes statutory data of natural persons entering into a business relationship with it as customers or suppliers, for the purpose of meeting tax and accounting obligations prescribed by law (bookkeeping, taxation). The processed data include general
pursuant to Sections 169 and 202 of Act CXXVII of 2007 on Value Added Tax, specifically: tax number, name, address, tax status; pursuant to Section 167 of Act C of 2000 on Accounting: name, address, designation of the person or organization ordering the economic transaction, signature of the authorizer and the person verifying execution of the instruction, as well as, depending on the organization, the inspector's signature; on stock movement vouchers and cash handling vouchers, the signature of the recipient; on receipts, the signature of the payer; pursuant to Act CXVII of 1995 on Personal Income Tax: sole trader certificate number, primary agricultural producer certificate number, tax identification number.
(2) The storage period for personal data is 8 years following the termination of the legal relationship serving as the legal basis.
(3) Recipients of personal data: employees and data processors of the Company performing taxation, accounting, payroll, and social security duties.
2. Data Processing as a Paying Agent
(1) Under the legal basis of fulfilling a legal obligation, the Company processes the personal data prescribed by tax laws of data subjects—employees, their family members, staff members, and recipients of other benefits—with whom it maintains a paying agent relationship (Section 7, Point 31 of Act CL of 2017 on the Rules of Taxation [Art.]) for the purpose of fulfilling statutory tax and contribution obligations (determining taxes, tax advances, and contributions; payroll processing; social security and pension administration). The scope of processed data is defined by Section 50 of the Art., specifically including: natural personal identification data of natural persons (including previous name and title), gender, citizenship, natural person's tax identification number, and social security identification number (TAJ number). Where tax laws attach legal consequences thereto, the Company may process employee health data (Section 40 of the Personal Income Tax Act) and trade union membership data (Section 47 (2) (b) of the Personal Income Tax Act) for the purpose of fulfilling tax and contribution obligations (payroll processing, social security administration).
(2) The storage period for personal data is 8 years following the termination of the legal relationship serving as the legal basis.
(3) Recipients of personal data: employees and data processors of the Company performing taxation, payroll, and social security (paying agent) tasks.
3. Data Processing Concerning Documents of Permanent Value Under the Archives Act
(1) Under the legal basis of fulfilling its legal obligation, the Company processes its documents qualifying as having permanent value pursuant to Act LXVI of 1995 on Public Records, Public Archives, and the Protection of Private Archival Material (Archives Act) to ensure that the portion of the Company's archival material possessing permanent value is preserved intact and in a usable state for future generations. Data retention period: until transfer to the public archive.
(2) The Archives Act governs the recipients of personal data and other data processing matters.
CHAPTER VI – SUMMARY INFORMATION ON DATA SUBJECT RIGHTS
In this chapter, for the sake of clarity and transparency, we briefly summarize the data subject rights, detailed information on the exercise of which is provided in the following chapter.
Right to Prior Information
The data subject has the right to be informed about the facts and details concerning data processing prior to the commencement of data processing.
(Articles 13–14 of the Regulation)
Detailed provisions are set forth in the following chapter.
Data Subject's Right of Access
The data subject has the right to obtain confirmation from the Controller as to whether or not personal data concerning them are being processed, and, where that is the case, access to the personal data and the related information specified in the Regulation.
(Article 15 of the Regulation).
Detailed provisions are set forth in the following chapter.
Right to Rectification
The data subject has the right to obtain from the Controller without undue delay the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.
(Article 16 of the Regulation).
Right to Erasure ('Right to Be Forgotten')
1. The data subject has the right to obtain from the Controller the erasure of personal data concerning them without undue delay, and the Controller has the obligation to erase personal data concerning the data subject without undue delay where one of the grounds specified in the Regulation applies.
(Article 17 of the Regulation)
Detailed provisions are set forth in the following chapter.
Right to Restriction of Processing
The data subject has the right to obtain from the Controller restriction of processing where the conditions specified in the Regulation are met.
(Article 18 of the Regulation)
Detailed provisions are set forth in the following chapter.
Notification Obligation Regarding Rectification or Erasure of Personal Data or Restriction of Processing
The Controller shall communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The Controller shall inform the data subject about those recipients upon request.
(Article 19 of the Regulation)
Right to Data Portability
Under the conditions set forth in the Regulation, the data subject has the right to receive the personal data concerning them, which they have provided to a Controller, in a structured, commonly used, and machine-readable format, and has the right to transmit those data to another Controller without hindrance from the Controller to which the personal data have been provided.
(Article 20 of the Regulation)
Detailed provisions are set forth in the following chapter.
Right to Object
The data subject has the right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them based on point (e) (processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller) or point (f) (processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party) of Article 6(1) of the Regulation.
(Article 21 of the Regulation)
Detailed provisions are set forth in the following chapter.
Automated Individual Decision-Making, Including Profiling
The data subject has the right not to be subject to a decision based solely on automated processing—including profiling—which produces legal effects concerning them or similarly significantly affects them.
(Article 22 of the Regulation)
Detailed provisions are set forth in the following chapter.
Restrictions
Union or Member State law to which the Controller or processor is subject may restrict by way of legislative measures the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, in accordance with the rights and obligations specified in Articles 12 to 22.
(Article 23 of the Regulation)
Detailed provisions are set forth in the following chapter.
Communication of a Personal Data Breach to the Data Subject
When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the Controller shall communicate the personal data breach to the data subject without undue delay.
(Article 34 of the Regulation)
Detailed provisions are set forth in the following chapter.
Right to Lodge a Complaint with a Supervisory Authority (Right to Administrative Redress)
The data subject has the right to lodge a complaint with a supervisory authority—in particular in the Member State of their habitual residence, place of work, or place of the alleged infringement—if the data subject considers that the processing of personal data relating to them infringes the Regulation.
(Article 77 of the Regulation)
Detailed provisions are set forth in the following chapter.
Right to an Effective Judicial Remedy Against a Supervisory Authority
Every natural and legal person has the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them, or where the supervisory authority does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged.
(Article 78 of the Regulation)
Detailed provisions are set forth in the following chapter.
Right to an effective judicial remedy against a controller or processor
Without prejudice to any available administrative or non-judicial remedy, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.
(Article 79 of the Regulation)
Detailed provisions are set forth in the following chapter.
CHAPTER VII – DETAILED INFORMATION ON THE RIGHTS OF THE DATA SUBJECT
Right to Prior Information
The data subject shall have the right to receive information regarding the facts and information relating to processing prior to the commencement of data processing
A) Information to be provided where personal data are collected from the data subject
1. Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:
a) the identity and the contact details of the controller and, where applicable, of the controller's representative;
b) the contact details of the data protection officer, where applicable;
c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;
d) where the processing is based on point (f) of Article 6(1) of the Regulation (legitimate interests pursued), the legitimate interests pursued by the controller or by a third party;
e) the recipients or categories of recipients of the personal data, if any;
f) where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1) of the Regulation, reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.
2. In addition to the information referred to in point 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing:
a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
b) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability;
c) where the processing is based on point (a) of Article 6(1) (consent of the data subject) or point (a) of Article 9(2) (explicit consent of the data subject) of the Regulation, the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
d) the right to lodge a complaint with a supervisory authority;
e) whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data;
f) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the Regulation and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
3. Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2.
4. Points 1 to 3 shall not apply where and insofar as the data subject already has the information.
(Article 13 of the Regulation)
B) Information to be provided where personal data have not been obtained from the data subject
1. Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information:
a) the identity and the contact details of the controller and, where applicable, of the controller's representative;
b) the contact details of the data protection officer, where applicable;
c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;
d) the categories of personal data concerned;
e) the recipients or categories of recipients of the personal data, if any;
f) where applicable, that the controller intends to transfer personal data to a recipient in a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1) of the Regulation, reference to the appropriate or suitable safeguards and the means to obtain a copy of them or where they have been made available.
2. In addition to the information referred to in point 1, the controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject:
a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
b) where the processing is based on point (f) of Article 6(1) of the Regulation (legitimate interests), the legitimate interests pursued by the controller or by a third party;
c) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject and to object to processing as well as the right to data portability;
d) where the processing is based on point (a) of Article 6(1) (consent of the data subject) or point (a) of Article 9(2) (explicit consent of the data subject) of the Regulation, the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
e) the right to lodge a complaint with a supervisory authority;
f) from which source the personal data originate, and if applicable, whether it came from publicly accessible sources; and
g) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the Regulation and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
3. The controller shall provide the information referred to in points 1 and 2:
a) within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circumstances in which the personal data are processed;
b) if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject; or
c) if a disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed.
4. Where the controller intends to further process the personal data for a purpose other than that for which the personal data were obtained, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in point 2.
5. Points 1 to 5 shall not apply where and insofar as:
a) the data subject already has the information;
b) the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89(1) of the Regulation, or insofar as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available;
c) obtaining or disclosure is expressly laid down by Union or Member State law to which the controller is subject and which provides appropriate measures to protect the data subject's legitimate interests; or
d) where the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or Member State law, including a statutory obligation of secrecy.
(Article 14 of the Regulation)
Data Subject's Right of Access
1. The data subject shall have the right to obtain from the Controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:
a) the purposes of the processing;
(b) the categories of personal data concerned;
(c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, including, in particular, recipients in third countries or international organizations;
d) where applicable, the planned duration of the storage of personal data, or, if this is not possible, the criteria for determining that duration;
e) the data subject’s right to request that the Data Controller rectify, erase, or restrict the processing of personal data concerning him or her, and to object to the processing of such personal data;
(f) the right to file a complaint with a supervisory authority;
(g) if the data were not collected from the data subject, any available information regarding their source;
(h) the fact that automated decision-making, including profiling, as referred to in Article 22(1) and (4) of the Regulation is taking place, as well as, at least in those cases, the logic applied and comprehensible information regarding the significance of such data processing and the likely consequences for the data subject.
2. If personal data is transferred to a third country or to an international organization, the data subject has the right to be informed about the appropriate safeguards regarding the transfer in accordance with Article 46 of the Regulation.
3. The Data Controller shall provide the data subject with a copy of the personal data subject to processing. For any additional copies requested by the data subject, the Data Controller may charge a reasonable fee based on administrative costs. If the data subject submitted the request electronically, the information must be provided in a widely used electronic format, unless the data subject requests otherwise. The right to request a copy shall not adversely affect the rights and freedoms of others.
(Article 15 of the Regulation)
Right to Erasure ('Right to Be Forgotten')
1. The data subject has the right to request that the Data Controller erase personal data concerning him or her without undue delay, and the Data Controller is obligated to erase personal data concerning the data subject without undue delay if any of the following grounds apply:
(a) the personal data are no longer necessary for the purpose for which they were collected or otherwise processed;
(b) the data subject withdraws the consent on which the processing is based pursuant to Article 6(1)(a) or Article 9(2)(a) of the Regulation, and there is no other legal basis for the processing;
(c) the data subject objects to the processing of his or her personal data pursuant to Article 21(1) of the Regulation, and there are no legitimate grounds for the processing that override the data subject’s interests, or the data subject objects to the processing pursuant to Article 21(2);
(d) the personal data were processed unlawfully;
(e) the personal data must be erased to comply with a legal obligation under Union or Member State law applicable to the Data Controller;
(f) The personal data were collected in connection with the provision of information society services referred to in Article 8(1) of the Regulation.
2. If the Data Controller has made the personal data public and is required to erase it pursuant to paragraph 1 above, it shall take all steps reasonably expected of it—including technical measures—taking into account available technology and the cost of implementation, in order to notify the data controllers that the data subject has requested the deletion of links to the personal data in question or of copies or duplicates of such personal data.
3. Paragraphs 1 and 2 do not apply if the data processing is necessary:
(a) for the purpose of exercising the freedom of expression and the right to information;
(b) to comply with a legal obligation under Union or Member State law to which the Data Controller is subject, or to perform a task carried out in the public interest or in the exercise of official authority vested in the Data Controller;
(c) in accordance with Article 9(2)(h) and (i) and Article 9(3) of the Regulation, on the basis of the public interest in the field of public health;
(d) in accordance with Article 89(1) of the Regulation, for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, insofar as the right referred to in paragraph 1 is likely to render such processing impossible or seriously impair it; or
e) to assert, enforce, or defend legal claims.
(Article 17 of the Regulation)
Right to Restriction of Processing
1. The data subject has the right to request that the Data Controller restrict data processing if any of the following conditions are met:
a) the data subject disputes the accuracy of the personal data; in this case, the restriction applies for a period that allows the Data Controller to verify the accuracy of the personal data;
(b) the processing is unlawful, and the data subject objects to the erasure of the data and requests, instead, that its use be restricted;
(c) the Data Controller no longer needs the personal data for the purposes of data processing, but the data subject requires it to assert, exercise, or defend legal claims; or
d) the data subject has objected to the processing of data pursuant to Article 21(1) of the Regulation; in this case, the restriction applies for as long as it has not been determined whether the Data Controller’s legitimate grounds take precedence over the data subject’s legitimate grounds.
2. If data processing is subject to restrictions under paragraph 1, such personal data may be processed, with the exception of storage, only with the data subject’s consent, or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of substantial public interest of the Union or of a Member State.
3. The Data Controller shall notify the data subject, whose data processing has been restricted pursuant to paragraph 1 at his or her request, in advance of the lifting of the restriction on data processing.
(Article 18 of the Regulation)
Right to Data Portability
1. The data subject has the right to receive the personal data concerning him or her, which he or she has provided to a Data Controller, in a structured, commonly used, and machine-readable format, and has the right to transmit that data to another Data Controller without hindrance from the Data Controller to whom the personal data was provided, if:
(a) the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) of the Regulation, or on a contract pursuant to Article 6(1)(b); and
(b) the data processing is carried out by automated means.
2. In exercising the right to data portability under paragraph 1, the data subject has the right—if technically feasible—to request the direct transfer of personal data between data controllers.
3. The exercise of this right shall not infringe upon Article 17 of the Regulation. This right does not apply where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller.
4. The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.
(Article 20 of the Regulation)
Right to Object
1. The data subject has the right to object at any time, on grounds relating to his or her particular situation, to the processing of his or her personal data based on Article 6(1)(e) of the Regulation (processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller) or (f) (processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party), including profiling based on those provisions. In such a case, the Data Controller may no longer process the personal data, unless the Data Controller demonstrates that the processing is justified by compelling legitimate grounds that override the interests, rights, and freedoms of the data subject, or that are related to the establishment, exercise, or defense of legal claims.
2. If personal data are processed for the purpose of direct marketing, the data subject has the right to object at any time to the processing of personal data concerning him or her for this purpose, including profiling, to the extent that it is related to direct marketing.
3. If the data subject objects to the processing of personal data for direct marketing purposes, the personal data may no longer be processed for that purpose.
4. The data subject must be expressly informed of the right referred to in paragraphs 1 and 2 no later than at the time of the first contact with the data subject, and the relevant information must be presented clearly and separately from all other information.
5. With regard to the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise the right to object using automated means based on technical specifications.
6. If personal data are processed for scientific or historical research purposes or for statistical purposes in accordance with Article 89(1) of the Regulation, the data subject has the right to object, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
(Article 21 of the Regulation)
Automated Individual Decision-Making, Including Profiling
1. The data subject has the right not to be subject to a decision based solely on automated processing—including profiling—that would produce legal effects concerning him or her or similarly significantly affect him or her.
2. Paragraph 1 does not apply if the decision:
(a) is necessary for the conclusion or performance of a contract between the data subject and the data controller;
(b) the processing is permitted by Union or Member State law applicable to the Data Controller, which also provides for appropriate measures to safeguard the data subject’s rights, freedoms, and legitimate interests; or
(c) is based on the data subject's explicit consent.
3. In the cases referred to in points (a) and (c) of paragraph 2, the Data Controller is required to take appropriate measures to protect the rights, freedoms, and legitimate interests of the data subject, including, at a minimum, the data subject’s right to request human intervention by the Data Controller, express their point of view, and lodge an objection to the decision.
4. The decisions referred to in paragraph 2 may not be based on special categories of personal data referred to in Article 9(1) of the Regulation, unless where Article 9(2)(a) or (g) applies and appropriate measures have been taken to protect the data subject’s rights, freedoms, and legitimate interests.
(Article 22 of the Regulation)
Restrictions
1. Union or Member State law to which the Data Controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34 of the Regulation, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:
a) national security;
b) defence;
c) public security;
d) the prevention, investigation, detection, or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;
e) other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary, and taxation matters, public health, and social security;
f) the protection of judicial independence and judicial proceedings;
g) the prevention, investigation, detection, and prosecution of breaches of ethics for regulated professions;
h) a monitoring, inspection, or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g);
i) the protection of the data subject or the rights and freedoms of others;
j) the enforcement of civil law claims.
2. In particular, any legislative measure referred to in paragraph 1 shall contain specific provisions at least as to:
a) the purposes of the processing or categories of processing,
b) the categories of personal data,
c) the scope of the restrictions introduced,
d) the safeguards to prevent abuse or unlawful access or transfer,
e) the specification of the Data Controller or categories of Data Controllers,
f) the storage periods and the applicable safeguards taking into account the nature, scope, and purposes of the processing or categories of processing,
g) the risks to the rights and freedoms of data subjects, and
h) the right of data subjects to be informed about the restriction, unless this may be prejudicial to the purpose of the restriction.
(Article 23 of the Regulation)
Communication of a Personal Data Breach to the Data Subject
1. When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the Data Controller shall communicate the personal data breach to the data subject without undue delay.
2. The communication to the data subject referred to in paragraph 1 shall describe in clear and plain language the nature of the personal data breach and contain at least the information and measures referred to in points (b), (c), and (d) of Article 33(3) of the Regulation.
3. The communication to the data subject referred to in paragraph 1 shall not be required if any of the following conditions are met:
a) the Data Controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption;
b) the Data Controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects referred to in paragraph 1 is no longer likely to materialise;
c) it would involve disproportionate effort. In such a case, there shall instead be a public communication or similar measure whereby the data subjects are informed in an equally effective manner.
4. If the Data Controller has not already communicated the personal data breach to the data subject, the supervisory authority, having considered the likelihood of the personal data breach resulting in a high risk, may require it to do so or may decide that any of the conditions referred to in paragraph 3 are met.
(Article 34 of the Regulation)
Right to lodge a complaint with a supervisory authority
1. Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or place of the alleged infringement if the data subject considers that the processing of personal data relating to them infringes this Regulation.
2. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Article 78 of the Regulation.
(Article 77 of the Regulation)
Right to an Effective Judicial Remedy Against a Supervisory Authority
1. Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.
2. Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to an effective judicial remedy where the supervisory authority competent pursuant to Articles 55 and 56 of the Regulation does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged pursuant to Article 77.
3. Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established.
4. Where proceedings are brought against a decision of a supervisory authority which was preceded by an opinion or a decision of the Board in the consistency mechanism, the supervisory authority shall forward that opinion or decision to the court.
(Article 78 of the Regulation)
Right to an effective judicial remedy against a controller or processor
1. Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77 of the Regulation, each data subject shall have the right to an effective judicial remedy where they consider that their rights under this Regulation have been infringed as a result of the processing of their personal data in non-compliance with this Regulation.
2. Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has their habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers.
(Article 79 of the Regulation)
CHAPTER VIII – SUBMISSION OF DATA SUBJECT REQUESTS, MEASURES TAKEN BY THE DATA CONTROLLER
1. The Data Controller shall provide information to the data subject on action taken on a request to exercise their rights without undue delay and in any event within one month of receipt of the request.
2. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The Data Controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay.
3. Where the data subject makes the request by electronic means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.
4. If the Data Controller does not take action on the request of the data subject, the Data Controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
5. The Data Controller shall provide information under Articles 13 and 14 of the Regulation and any communication and any actions taken regarding the rights of the data subject (Articles 15 to 22 and 34 of the Regulation) free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the Data Controller may, taking into account the administrative costs of providing the information or communication or taking the action requested:
refuse to act on the request.
The Data Controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.
6. Where the Data Controller has reasonable doubts concerning the identity of the natural person making the request, it may request the provision of additional information necessary to confirm the identity of the data subject.