This Privacy Policy presents the characteristics of the data processing carried out through the website eiffelbeauty.hu (hereinafter: the “Website”), operated by SZÉKELY AFRODITÉ E.V. (hereinafter: the “Data Controller”), including, in particular, the collection, storage and use of data.
This Privacy Policy shall be effective as of 30 April 2023. The Data Controller shall make the currently applicable version of the Privacy Policy available on its Website and at its registered office.
This Privacy Policy has been prepared on the basis of Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: “GDPR”), with due regard to the provisions of Act CXII of 2011 on Informational Self-Determination and Freedom of Information (hereinafter: “Info Act”). Its terminology corresponds to the definitions set out in Article 4 of the GDPR and, in certain respects, is supplemented by the interpretative provisions of Section 3 of the Info Act. Matters not defined in this Privacy Policy shall be governed by the GDPR and, where permitted by the GDPR, by the provisions of the Info Act on a supplementary basis.
The Data Controller is entitled to prepare an extract of the content of this Privacy Policy in connection with individual data processing activities and may also ensure that data subjects, in connection with prior information concerning the processing of personal data, declare by signing this document that they have read and acknowledged the contents of the extract. The Data Controller reserves the right to amend this Privacy Policy. If the amendment affects the use of personal data provided by the data subject, the Data Controller shall inform the data subject of the changes in an appropriate manner, for example by e-mail. If the details of data processing also change as a result of an amendment to this Privacy Policy, the Data Controller shall separately request the consent of the data subject.
- Information on the Data Controller
| Name of the Data Controller: | SZÉKELY AFRODITÉ E.V. |
| Registered office of the Data Controller: | 1078 Budapest, Marek József str. 37. |
| Representative of the Data Controller: | SZÉKELY AFRODITÉ |
| Contact details of the Data Controller: | eiffelbeauty.hu |
- Principles Relating to Data Processing
When providing its services, the Data Controller pays particular attention to the protection of personal data, compliance with mandatory legal provisions, and secure and fair data processing. As set out in Section 3 of this Privacy Policy, the Data Controller treats the personal data provided to it confidentially and, in its procedures, complies with the principles of lawfulness, fairness and transparency under the GDPR. It processes personal data for specified purposes, taking into account the principle of data minimisation, complies with the principle of storage limitation, protects the confidentiality and integrity of personal data, and takes into account the principle of accuracy under the GDPR.
- Method and Security of Data Processing
The Data Controller ensures the security of data and takes the technical and organisational measures and establishes the procedural rules necessary to enforce the data and confidentiality protection requirements prescribed by the GDPR, the Info Act and other applicable legislation. The Data Controller protects personal data against unauthorised access, alteration, transmission, disclosure, accidental deletion or destruction, damage, as well as loss of accessibility resulting from changes in the technology used. The Data Controller places particular emphasis on protecting electronically processed datasets in various registers in order to ensure that data stored in different registers cannot be directly linked or attributed to the data subject, except where permitted by law.
- Data Processing Carried Out When Using the Data Controller’s Website
- Contact
The Data Controller provides visitors to the Website and its clients with the opportunity to contact the Data Controller through the contact details published on the Website and by completing the contact form provided for this purpose.
| Purpose of data processing | Answering questions and, in connection therewith, establishing and maintaining contact. |
| Scope of processed data | Name of the data subject, e-mail address, telephone number in the case of a telephone enquiry, and the message containing the legal matter. |
| Categories of data subjects | Persons in contact with the Data Controller. |
| Legal basis for data processing | The consent of the data subject pursuant to Article 6(1)(a) of the GDPR. |
| Data retention period | Until the question has been successfully answered or the purpose has been fulfilled, but no later than until deletion is requested by the data subject. |
| Method of data processing | Electronically. |
| Source of data | Data provided by the data subject. |
| Automated decision-making and profiling | The Data Controller does not use automated decision-making and does not carry out profiling. |
| Possible consequences of failure to provide data | If the data subject does not provide the Data Controller with the data, the Data Controller will not be able to establish contact with the data subject. |
| Who may access the personal data? | Persons employed by the Data Controller and any data processors engaged by the Data Controller. |
| Transfer to a third country or international organisation | No transfer to a third country or international organisation takes place. |
- Data Processing in Connection with Questionnaires
In order to speed up and simplify the process of providing its services, the Data Controller allows persons who contact the Data Controller to complete questionnaires.
| Purpose of data processing | Preparation of the service provided by the Data Controller and establishing contact. |
| Scope of processed data | Identification data of persons contacting the Data Controller (name, e-mail address, telephone number), as well as basic data relating to the specific type of matter. |
| Categories of data subjects | Persons completing the Data Controller’s questionnaire. |
| Legal basis for data processing | The consent of the data subject pursuant to Article 6(1)(a) of the GDPR. |
| Data retention period | One year from the submission of the questionnaire. |
| Method of data processing | Electronically. |
| Source of data | Data provided by the data subject. |
| Automated decision-making and profiling | The Data Controller does not use automated decision-making and does not carry out profiling. |
| Possible consequences of failure to provide data | The provision of personal data and information relating to the specific type of matter is not mandatory; however, providing such data facilitates the preparation of the service provided by the Data Controller and the establishment of contact. |
| Who may access the personal data? | Persons employed by the Data Controller and any data processors engaged by the Data Controller. |
| Transfer to a third country or international organisation | No transfer to a third country or international organisation takes place. |
- Cookies
When operating the Website, the Data Controller uses so-called “cookies”. A cookie is a small data file (hereinafter: “cookie”) sent by the Data Controller to the browser of the data subject and stored on the data subject’s device. The Data Controller uses essential cookies, i.e. session cookies (temporary cookies), on its Website.
The cookies used on the Website are not, in themselves, suitable for identifying data subjects. They are necessary for providing the Website’s services, and their use is essential for navigation on the Website and for the operation of the Website’s functions. Most browsers accept cookies by default, but the data subject may choose a setting that rejects cookies or notifies the data subject when cookies are received. Without accepting cookies, the Website or certain parts of it may not be displayed or may be displayed incorrectly. Temporary cookies are stored only until the end of the data subject’s browsing session and are essential for the proper functioning of certain functions or applications related to the Website, as these cookies ensure the proper operation of the Website, facilitate its use, and collect information about its use without identifying the visitors of the Website.
| Purpose of data processing | Ensuring the operation of the Website. |
| Scope of processed data | The computer’s Internet Protocol address (IP address), domain name (URL), access data, client file request (file name and URL), HTTP response code, information about the website from which the request originated, amount of bytes transferred during the visit, time of the visit, and information about the pages viewed. |
| Categories of data subjects | Users visiting the Data Controller’s Website. |
| Legal basis for data processing | The consent of the data subject pursuant to Article 6(1)(a) of the GDPR, in accordance with Section 155(4) of Act C of 2003 on Electronic Communications. |
| Data retention period | Until the end of the relevant visitor session (duration of the session). |
| Method of data processing | Electronically. |
| Source of data | Data provided by the data subject. |
| Automated decision-making and profiling | The Data Controller does not use automated decision-making and does not carry out profiling. |
| Possible consequences of failure to provide data | The provision of personal data and information relating to the specific type of matter is not mandatory; however, providing such data facilitates the preparation of the service provided by the Data Controller and the establishment of contact. |
| Who may access the personal data? | Personal data relating to the use of the Website may only be accessed by employees of the Data Controller. |
| Data transfer | No transfer to a third country or international organisation takes place. |
| Who may access the personal data? | Personal data relating to the use of the Website may only be accessed by employees of the Data Controller. |
| Data transfer | No transfer to a third country or international organisation takes place. |
- Data Processors
Data Processors do not make independent decisions and are only entitled to act pursuant to the agreement concluded with the Data Controller and the instructions received. Data Processors record, manage and process the personal data transferred to them by the Data Controller and processed by them in accordance with the provisions prescribed by the GDPR. Data Processors carry out data processing operations involving the personal data provided by data subjects within the period of use specified in this Privacy Policy and corresponding to the individual purposes of data processing. The Data Controller uses the following data processors for the data processing activities described in this Privacy Policy:
| Category of Data Processor | Purpose of data processing | Data Processor | ||
| Name | Registered office | Tax number / Company registration number | ||
| Hosting provider | Hosting services | ErdSoft Hungary Kft. | Kígyó utca 4., 6720 Szeged, Hungary |
32725458-2-06 / 06-09-030198 |
- Exercise of Data Subjects’ Rights
As a data subject, you may request information about the processing of your personal data and may request the rectification of your personal data, restriction of processing, or erasure of your data at eiffelbeauty@eiffelbeauty.hu. You are also entitled to exercise your right to data portability and your right to an effective remedy, as well as your right to withdraw your consent. In the event of a complaint, you may contact the National Authority for Data Protection and Freedom of Information in Hungary or, at your discretion, a court. In judicial proceedings, the regional court has jurisdiction.
If you have not submitted your request concerning the processing of your personal data in accordance with the provisions of this Privacy Policy and the Data Controller has been unable to carry out the appropriate identification required for data security and/or confidentiality protection under this Privacy Policy (i.e. has been unable to identify you as the data subject), the Data Controller shall request you to provide the missing information. If you fail to comply with or fully satisfy this request, the Data Controller will be unable to respond to your request.
The period between the Data Controller’s request for the necessary personal data or completion of the missing action and the provision of the personal data shall not be included in the deadline for responding to the request.
The Data Controller shall inform every recipient to whom the personal data have been disclosed of any rectification, erasure or restriction of processing, unless this proves impossible or requires disproportionate effort. At the request of the data subject, the Data Controller shall inform the data subject about such recipients.
- Right to Information and Access
As a data subject, you have the right to obtain confirmation from the Data Controller as to whether your personal data are being processed and to obtain access to the following information:
- information as to whether your personal data are being processed;
- the purpose of the processing;
- the categories of personal data concerned;
- the recipients or categories of recipients to whom the personal data have been or will be disclosed;
- the envisaged period for which the personal data will be stored or, if this is not possible, the criteria used to determine that period;
- information about your rights and your right to an effective remedy.
The Data Controller shall inform you of the measures taken following your request without undue delay and, in any event, within one month of receipt of the request. Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months. The Data Controller shall inform the applicant of any such extension within one month of receipt of the request, together with the reasons for the delay.
Information shall generally be provided free of charge. The Data Controller may charge a fee only in the cases specified in Article 12(5) and Article 15(3) of the GDPR.
If the Data Controller takes no action on your request, it shall inform you, as the data subject, without undue delay and at the latest within one month of receipt of the request, of the reasons for not taking action and of your right to lodge a complaint with a supervisory authority and to seek judicial remedy.
- Right to Rectification
As a data subject, you have the right to request that the Data Controller rectify inaccurate personal data concerning you without undue delay. Taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data, including by means of providing a supplementary statement.
For the period during which the Data Controller verifies the accuracy of the personal data, the processing of the personal data in question may be restricted in accordance with this Privacy Policy.
- Right to Object
As a data subject, you may object to the processing of your personal data by submitting a statement to the Data Controller where the legal basis for the processing is:
- the performance of a task carried out in the public interest pursuant to Article 6(1)(e) of the GDPR; or
- the legitimate interests pursued by the Data Controller pursuant to Article 6(1)(f) of the GDPR.
Where the right to object is exercised, the Data Controller may no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or which are related to the establishment, exercise or defence of legal claims.
The head of the Data Controller shall decide whether the processing is justified by compelling legitimate grounds. The Data Controller shall inform you, as the data subject, of its position in this matter in writing.
- Right to Restriction of Processing
Processing may be restricted where:
- you, as the data subject, contest the accuracy of the data, for the period enabling the Data Controller to verify the accuracy of the personal data;
- the processing is unlawful and you, as the data subject, oppose the erasure of the personal data and request the restriction of their use instead;
- the Data Controller no longer needs the personal data, but you, as the data subject, require them for the establishment, exercise or defence of legal claims;
- you, as the data subject, have objected to the processing of personal data pursuant to Article 21 of the GDPR, pending the verification of whether the legitimate grounds of the Data Controller override those of the data subject.
For the duration of the assessment of the data subject’s objection to the processing of personal data, the Data Controller shall suspend the processing, examine whether the objection is justified and make a decision, of which the applicant shall be informed.
If the objection is justified, the Data Controller shall restrict the data, meaning that only storage as a data processing activity may take place until:
- the data subject consents to the processing;
- the processing of personal data is necessary for the establishment, exercise or defence of legal claims;
- the processing of personal data becomes necessary for the protection of the rights of another natural or legal person; or
- processing is required by law for reasons of public interest.
If the data subject has requested restriction of processing, the head of the relevant organisational unit shall inform the data subject in advance of the lifting of the restriction.
- Right to Erasure (“Right to be Forgotten”)
As a data subject, you have the right to request that the Data Controller erase personal data concerning you without undue delay, and the Data Controller shall be obliged to erase personal data concerning the data subject without undue delay where one of the following grounds applies:
- the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- you, as the data subject, withdraw the consent on which the processing is based and there is no other legal ground for the processing;
- you, as the data subject, object to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR;
- the personal data have been unlawfully processed;
- the personal data must be erased in order to comply with a legal obligation under Union or Member State law applicable to the Data Controller; or
- the personal data have been collected in relation to the offer of information society services.
The data subject’s right to erasure may be restricted only where one of the exceptions specified in the GDPR applies.
- Right to Data Portability
As a data subject, you have the right to receive the personal data concerning you, which you have provided to the Data Controller, in a structured, commonly used and machine-readable format (.XML, .CSV), and you have the right to transmit those data to another data controller without hindrance from the data controller to which the personal data were provided, where:
- the legal basis for the processing is your consent or the processing is necessary for the performance of a contract to which you are a party as the data subject, or in order to take steps at your request prior to entering into a contract [Article 6(1)(a) or (b), or Article 9(2)(a) of the GDPR];
and
- the processing is carried out by automated means.
The Data Controller shall inform every recipient to whom the personal data have been disclosed of any rectification, erasure or restriction of processing, unless this proves impossible or requires disproportionate effort. At the request of the data subject, the Data Controller shall inform the data subject about such recipients.
- Right to Withdraw Consent
If the legal basis for the processing of your personal data by the Data Controller is your consent, you, as the data subject, may withdraw your consent to the processing at any time. In this regard, the Data Controller informs data subjects that, following the withdrawal of consent, the Data Controller may continue to process the data subject’s personal data for the purpose of fulfilling a legal obligation or enforcing its legitimate interests, provided that such enforcement is proportionate to the restriction of the right to the protection of personal data.
- Legal Remedies
If you, as the data subject, believe that the processing of your personal data violates the GDPR or the Info Act, or if you consider the manner in which the Data Controller processes your personal data to be detrimental to you, you may submit a complaint to the Data Controller at eiffelbeauty@eiffelbeauty.hu. You may also directly contact the supervisory authority regarding a complaint concerning the Data Controller’s data processing procedures and may submit a complaint to the National Authority for Data Protection and Freedom of Information (address: 1055 Budapest, Falk Miksa utca 9-11., postal address: 1363 Budapest, Pf. 9., telephone: +36 (1) 391-1400, e-mail: ugyfelszolgalat@naih.hu, website: naih.hu). The data subject may also apply to a court for the protection of their rights, and the court shall deal with the case as a matter of priority. In this case, the data subject may freely decide whether to submit the claim to the regional court having jurisdiction according to their place of residence (permanent address) or place of stay (temporary address) (birosag.hu/ugyfeleknek/torvenyszekek). The regional court having jurisdiction according to the data subject’s place of residence or place of stay can be found at birosag.hu/birosag-kereso.