Privacy Notice

I. Name of Data Controller

II. Legislation on Which the Processing is Based

Data processing is subject to the following legislation:

• Regulation (EC) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Regulation (EC) No 95/46/EC, in its current version: https://eur-lex.europa.eu/legal-content/HU/TXT/PDF/?uri=CELEX:32016R0679&from=HU
• Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (hereinafter: Info tv.), in its current text: https://net.jogtar.hu/jogszabaly?docid=A1100112.TV
• Act XLVIII of 2008 on the Basic Conditions and Certain Restrictions on Economic Advertising Activities, in its current text: https://net.jogtar.hu/jogszabaly?docid=A0800048.TV
• Act CLV of 1997 on consumer protection, in force: https://net.jogtar.hu/jogszabaly?docid=99700155.TV

III. Information on the Data Processed

Data processed by the controller: the online identifier of the data subject.

Legal basis for processing: the consent of the data subject, save for the strictly necessary storage described in point V.1, which records the user's own decision and is placed without consent under Article 5(3) of Directive 2002/58/EC

Duration of processing: until consent is withdrawn, and in any event no longer than the periods stated in point V

IV. About Cookies in General

(1) Cookies are short data files placed on the user's computer by the website visited. The purpose of the cookie is to make the given infocommunication, internet service easier and more convenient. There are several types, but they generally fall into two broad categories. One is the temporary cookie, which is placed on the user's device by the website only during a particular session (e.g. during the security identification of an online banking transaction), and the other is the persistent cookie (e.g. a website's language setting), which remains on the computer until the user deletes it. According to the European Commission's guidelines, cookies [unless strictly necessary for the use of the service] can only be placed on the user's device with the user's permission.

(2) In the case of cookies that do not require the user's consent, information shall be provided during the first visit to the website. It is not necessary for the full text of the cookie notice to appear on the website, but it is sufficient for website operators to provide a brief summary of the substance of the notice and a link to the full notice.

(3) In the case of cookies requiring consent, the information may also be linked to the first visit to the website if the processing of data associated with the use of cookies starts as soon as the page is visited. Where the use of the cookie is linked to the use of a function explicitly requested by the user, the information may also be provided in relation to the use of that function. In this case, it is not necessary for the full text of the cookie notice to appear on the website, but a brief summary of the substance of the notice and a link to the full notice.

(4) Visitors to the website must be informed about the use of cookies. By means of this information, the Data Controller ensures that the visitor can find out at any time before and during the use of the information society services of the website which types of data are processed by the Data Controller for which purposes, including the processing of data that cannot be directly linked to the user.

V. Cookies Used

The Data Controller informs its users that the Website uses cookies and comparable technologies, such as the local storage of the browser, for two purposes only: to operate the Website and to measure its traffic. The Data Controller does not use cookies for advertising, for remarketing, for building advertising audiences or for profiling, and it does not sell or share the data collected through them with any third party for such purposes.

Two categories are used. The first is strictly necessary storage, which the Website needs in order to function and in order to honour the decision the user has made; under Article 5(3) of Directive 2002/58/EC this category does not require consent. The second is statistical measurement, which is placed only after the user has given consent, and which the user may refuse or withdraw at any time without any consequence for the use of the Website.

The technologies actually in use are listed individually below. No other cookie is placed by the Website.

V.1. Record of the User's Own Decision

Name: ib_cookie_consent. Technology: the local storage of the browser, which is not a cookie in the narrow sense and is therefore never transmitted to any server. Purpose: to record whether the user has accepted or refused statistical measurement, so that the user is not asked again on every page. Legal basis: this entry is strictly necessary, because without it the Data Controller could not honour a refusal, and it is therefore placed without consent. Data processed: the value "accepted" or "declined". Duration: it remains in the browser until the user deletes the browsing data of that browser. The entry contains no identifier and no personal data.

V.2. Google Analytics 4

The Data Controller uses Google Analytics 4 in order to produce statistics on the use of the Website, principally the number of visitors, the pages they open and the time they spend. The service is loaded through Google Tag Manager, which does not itself place any cookie. Cookies placed: _ga, which distinguishes one browser from another, and _ga_LWY6GP5WDV, which maintains the state of a single visit. Data processed: the online identifier of the data subject, the truncated IP address, and technical data on the browser and on the pages opened. Legal basis: the consent of the data subject. Duration: the cookies expire no later than 13 months after they are first placed, and that period is not extended by any further visit, so that consent is sought again once it has elapsed. The browser may apply a shorter limit of its own, in which case the shorter period applies. The statistical records are retained for 14 months. Processor: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to the United States on the basis of the EU-US Data Privacy Framework, under which Google LLC is certified.

Google Analytics uses first party cookies, that is cookies set by this Website and not shared with other domains. The Data Controller has switched off the Google signals feature, with the result that the measurement is not combined with any advertising profile held by Google, and the Data Controller neither has access to nor makes use of any advertising function of the service.

V.3. Technologies That Are Not Used

So that the user is not left to assume otherwise, the Data Controller states expressly that the Website does not use Google Remarketing, Google Ads conversion tracking, the DoubleClick cookie, the Facebook or Meta pixel, the LinkedIn Insight Tag, or any comparable advertising or remarketing technology. Should any such technology be introduced in future, this Policy will be amended and consent will be sought before it is placed.

V.4. How Consent Is Obtained

Users in the European Economic Area, in the United Kingdom and in Switzerland are asked before anything is measured. When the Website is first opened, a notice is displayed which offers an equal and equally prominent choice between accepting and refusing statistical measurement. No measurement cookie is placed before the user has accepted. Nothing is pre-selected, closing or ignoring the notice is not treated as acceptance, and a refusal does not restrict the use of the Website in any way.

Users outside those territories, where the applicable law permits measurement without a prior request, are not interrupted by the notice. Statistical measurement begins when the page is opened, and the user may refuse at any time, with immediate effect, by the means described in V.5. The Data Controller also reads the Global Privacy Control signal sent by the browser and treats it as a refusal, so that a user whose browser sends that signal is never measured and is never asked.

The territory is determined inside the user's own browser, from its time zone and language settings alone. No IP address lookup is performed for this purpose, no location data is collected, and nothing about the user leaves the browser in order to make this decision. Where the territory cannot be determined, the user is treated as being in the European Economic Area and is asked first.

Where the user refuses, or has not yet answered, no cookie is placed. The measurement service may still receive an anonymous signal that a page was opened. That signal carries no identifier, places no cookie, and cannot be linked to the user or to any other visit.

V.5. Withdrawing Consent and Disabling Cookies

The user may change the decision at any time, with the same ease with which it was given. The simplest way is on this Website: the Cookie settings control in the footer of every page reopens the notice described in V.4. A refusal takes effect immediately, and the measurement cookies already placed are deleted at that moment.

Independently of the Website, the user may manage or delete cookies in the browser. The setting is normally found in the privacy section of the browser menu. The user may also install the browser add-on published by Google, which prevents Google Analytics from recording the visit on every website, not only on this one.

Withdrawing consent does not affect the lawfulness of the processing carried out before the withdrawal.

VI. Access to Data and Data Security Measures

VI.1. Access to and Transfer of Data

The personal data you have provided may be accessed by the Data Controller's employees in order to perform their tasks.

The Data Controller shall transfer the personal data processed to its subcontractors as set out in the Annex to this Policy.

The Data Controller will only exceptionally transfer your personal data to other Data Controllers, public bodies not listed in the Annex.

For example, if

• a judicial proceeding concerning you is pending and the court in the case requires the transfer of documents containing your personal data,
• the police contact the Data Controller and request the transfer of documents containing your personal data for the purposes of the investigation.

VI.2. Data Security Measures

The Data Controller stores the personal data you have provided on the Data Controller's servers or, where applicable, in paper files. The Controller does not use the services of any other company to store the personal data.

The controller shall take appropriate measures to protect personal data against, inter alia, unauthorised access or unauthorised alteration. For example, access to personal data stored on the server is logged by the Data Controller, which means that it is always possible to check who has accessed what personal data, when and to what extent.

VII. Rights of the Data Subject in Relation to Data Processing

1. Your Access Rights

You, as the right holder, have access to your personal data.

If you request feedback from the Data Controller on whether the Data Controller is processing your personal data, the Data Controller is obliged to provide you with information on:

• (a) what personal data,
• (b) on what legal basis,
• (c) for what purpose,
• (d) from what source,
• (e) how long it will treat.

Your right to receive feedback on whether (or not) your personal data is being processed by the Data Controller,

• (a) covers personal data relating to you;
• (b) does not cover anonymous data;
• (c) does not include personal data not relating to you; and
• (d) includes pseudonymised data that can be clearly linked to you.

The Data Controller will provide access to and a copy of your personal data upon your request. If you request an additional/repeat copy of your personal data, the Data Controller may charge a reasonable fee to cover the administrative costs incurred in connection with fulfilling the request, which will be borne by you.

2. Your Right to Rectification

You have the right to rectify your personal data.

This right:

• (a) does not cover anonymous data;
• (b) covers personal data relating to you;
• (c) does not include personal data not relating to you; and
• (d) includes pseudonymised data that can be clearly linked to you.

The Data Controller will correct or complete your personal data accordingly upon your request. The Data Controller will inform the recipients of your personal data (if any) of the rectification of your personal data. However, the Data Controller will not inform the recipients of the rectification of personal data if it proves impossible or would involve a disproportionate effort to inform the recipients.

3. Right to Erasure

You have the right to have your personal data deleted under certain conditions.

The Controller shall delete your personal data without undue delay if:

• (a) the Controller processes those personal data, and
• (b) you request the erasure of your personal data, and
• (c) the personal data are not necessary for the purposes for which the Controller processes the personal data.

The Controller shall delete your personal data without undue delay if:

• (a) the Controller processes your personal data, and
• (b) you request the erasure of your personal data, and
• (c) you withdraw the consent on which the processing of your data is based, and
• (d) there is no other legal basis for the further processing of your data.

The Controller shall delete your personal data without undue delay if:

• (a) processing is necessary for the purposes of the legitimate interests pursued by the Controller or a third party, and
• (b) You object to the Controller processing your personal data, and
• (c) the legitimate ground for processing such personal data does not override your objection.

The Controller shall delete your personal data without undue delay if:

• (a) you request the erasure of your personal data, and
• (b) the processing of such data by the Controller is not unlawful; or
• (c) cancellation is mandatory under the applicable law, or
• (d) your data is collected in relation to information society services.

The Data Controller will inform the recipients of your personal data (if any) of the erasure of your personal data. However, the Data Controller will not inform the recipients of the erasure of personal data if it would be impossible or would require a disproportionate effort to inform the recipients.

4. Your Right to Restrict Processing

You may request the restriction of the processing of your personal data.

Your right to request restriction of the processing of your personal data:

• (a) does not cover anonymous data
• (b) covers personal data relating to you
• (c) does not include personal data that does not relate to you; and
• (d) includes pseudonymised data that can be clearly linked to you.

The Controller will restrict the processing of your personal data for the period during which it verifies the accuracy of such data if you request the restriction of the processing of your personal data and you contest the accuracy of such data.

The Data Controller will restrict the processing of your personal data if you request the restriction of the processing of data whose processing is unlawful and you object to the erasure of such data.

The Controller will restrict the processing of your personal data if:

• (a) you request the restriction of the processing of your personal data, and
• (b) the Controller no longer needs those data for the purposes of its processing, and
• (c) You are requesting your data in order to lodge, exercise or defend a legal claim.

The Controller will restrict the processing of your personal data if:

• (a) You object to the processing of your personal data that is necessary for the purposes of the legitimate interests of the Controller, and
• (b) You are waiting for confirmation that the Controller has a legitimate ground for processing your personal data which does not override your objection.

The Data Controller will inform the recipients of such personal data (if any) of the restriction of the processing of your personal data. However, the Data Controller will not inform the recipients of such restriction if it would be impossible or would require a disproportionate effort to inform the recipients.

If the Controller restricts the processing of your personal data, it may:

• (a) may store such personal data
• (b) may process such personal data with your consent
• (c) may process personal data for the establishment, exercise or defence of legal claims or the protection of the rights of individuals.

5. Your Right to Data Portability

You have the right to receive personal data concerning you that you have provided to a controller in a structured, commonly used, machine-readable format and the right to have those data transferred to another controller without hindrance (where technically possible) to the controller to whom you have provided the personal data, where the processing is based on consent or is necessary for the performance of a contract and the processing is automated.

Your right to data portability:

• (a) does not cover anonymous data
• (b) covers personal data about you
• (c) does not include personal data that does not relate to you
• (d) does not cover clearly pseudonymous data

6. Deadline for Processing Your Application as a Data Subject

The Data Controller shall respond to requests for the rights to which you are entitled under the above without undue delay and at the latest within one month.

7. Right to Lodge a Complaint

If you believe that your rights have been infringed, the Data Controller recommends that you seek a conciliation with the Data Controller by contacting the Data Controller directly. If such conciliation is not successful or if you do not wish to engage in such activities, you may take the matter to court or to the NAIH. In the event of legal proceedings, you may decide to bring such proceedings before the competent court in your place of residence or domicile.

The contact details of the NAIH are as follows: 1125 Budapest, Szilágyi Erzsébet fasor 22/C.; telephone: +36 1 391 1400; fax: +36 1 391 1410; e-mail: ugyfelszolgalat@naih.hu; website: www.naih.hu

8. Amendments to This Information Notice

The Data Controller reserves the right to amend this information at any time. The Data Controller will inform customers of such changes by letter or e-mail, as appropriate, and in any case in accordance with applicable law.