Data Protection and Data Management Information
From February 1st, 2020, for an indefinite period 

1. Basic principles, definitions
For questions regarding the operation of the r-filter.hu website, the provision of the services offered on it, and the handling of personal data arising in the course of the activities of AIR-FILTER Kft., before the start of data processing, the present „Data Protection and Data Processing Information” document (hereinafter: Information) provides information on the facts regarding data processing, in particular on the purpose of data processing, the legal basis for data processing, the duration of data processing. This Information covers the rights and remedies of data subjects regarding data processing, as well as the procedure to be followed in the event of a possible data protection incident. 

2) The time validity of the Information is indicated by the date shown on the cover page. The Data Controller reserves the right to modify the Information at any time and to publish a new Information on its website. With the entry into force of the new Information, its previous validity will expire simultaneously. 

3) Terms and definitions: Data subject: any identified or identifiable natural person who is the subject of personal data (Customers, registered users, newsletter subscribers, those who post reviews, i.e. anyone whose personal data we process based on a legal mandate from their consent or the performance of a contract concluded with them). Personal data: data that can be used to personally identify a data subject – in particular the data subject’s name, identification number, and any knowledge of one or more physical, physiological, mental, economic, cultural or social characteristics – as well as the conclusions that can be drawn from that data regarding the data subject (Our website only requests and stores (processes) data necessary for contact and the possible completion of a purchase and delivery. We do not request or process any health-related or other sensitive data.)
 Special data:
a) personal data regarding racial origin, belonging to a nation, political opinion or party affiliation, religious or other world view convictions, membership in interest representation organizations, sexual life,
b) personal data regarding health status and pathological addiction, as well as criminal personal data. (Special data is not requested or processed by the Data Controller. Any special data disclosed or made known to the Data Controller in any way shall be immediately deleted from the system by the Data Controller.) Data Controller: who, independently or together with others, determines the purpose of data processing, makes and implements decisions regarding data processing (including the means used), or implements them with the data processor. Data controller under this Notice: AIR-FILTER Personal data will be known to the Managing Director, who has access rights related to the relevant data management purpose, as well as the Company Manager; the Financial Manager; the Back Office Manager; the Sales Representative; the Logistics Manager; and the persons or organizations performing data processing activities under data processing contracts for the Company, within the scope and to the extent necessary for the performance of their duties. Data processing: regardless of the method used, any operation or set of operations performed on the data, including in particular collection, recording, storage, organization, preservation, modification, use, retrieval, transmission, disclosure, coordination or linking, blocking, deletion and destruction, as well as preventing further use of the data, the taking of photographs, audio or video recordings, and the recording of physical characteristics that could identify the person (e.g., fingerprints or palm prints, DNA samples, iris images); (With respect to our Website, we can only talk about the collection, storage, and transmission of personal data to Partners involved in the processing of purchases. Upon the request of the Data Subject, we will delete or modify the processed data in part or in full in accordance with the request.) Data Processing: performing technical tasks related to data management operations, regardless of the method and means used to carry out the operations, and the location of the application, provided that the technical task is performed by the Data Controller; (Here we are typically talking about a Partner that works with the Data Controller in order for the Data Controller to • comply with its legal obligation (e.g. accounting law), • deliver the purchased product via the registered Partner. • operate its website) Data Protection Officer: The person appointed by the Data Controller who, on behalf of the Data Controller, may take action in relation to personal data processing, or who is responsible for the data processing. Data Controller Data Protection Officer: Data Processor: a natural or legal person or entity that, under a contract, performs data processing – including a contract concluded under the provisions of law – such as the unauthorized access, modification, transmission, disclosure, deletion, or destruction of personal data. Data Processors under this Notice: Data Protection Incident: unlawful processing or processing of personal data, including in particular unauthorized access, modification, transmission, disclosure, deletion, or destruction, as well as accidental destruction or damage. Information Act: the Act CXII of 2011 on the Right of Self-Determination in Information and the Freedom of Information. FGG: The Act CLV of 1997 on Consumer Protection. GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC contains the main provisions regarding data processing. 

2. Data processing related to the viewing of the website
2.1 Viewing the content published on the website, which is accessible to everyone, is possible without providing personal data. The website automatically records the following data about visitors: the visitor’s IP address, the date and time of the visit, the sub-pages and content viewed on the website. These data are used by the data controller solely for analysis related to the website, to verify the secure operation of the website. Personal data processing does not take place.
2.2 On the website, as on the vast majority of other websites available, so-called „cookies” (cookies) operate; they store information related to the use of the website. These allow the use of Google Analytics and the Google Search Console services. The purpose of managing the data stored in cookies is to improve the user experience and to develop the online services of the website. The website only uses cookies that do not store information that is personally identifiable, i.e., it does not involve data processing.
3) During a visit to the website, the user can remove the cookies placed on their computer at any time or disable the use of cookies in their browser. Further information regarding this can be found on the website, which is also available in https://www.google.com/intl/hu/policies/pri-vacy/partners/ Hungarian.
4) The data controller processes the personal data obtained in connection with communications initiated by calling the telephone numbers provided on the website via the „Contact” page, or by sending messages to the email addresses recorded there. In addition, purchases made through the online store available on the website also involve personal data processing, regardless of whether they are made as a registered user or as an unregistered buyer. These and the r-filter@r-filter.hu questions, ideas, suggestions, and comments submitted to the email address are used and stored for the purpose of developing processes, products, and services; as well as for fulfilling purchases made through the online store. Providing data for this purpose is voluntary; the consent to the data processing for the above purposes is deemed given by sending the email or by completing the fields filled in during the purchase. Emails containing ideas, opinions, and comments are kept by the data controller for a maximum of 1 year; for unregistered buyers, the data provided in connection with the purchase (name, email address, phone number, billing address) is kept until the purchase or delivery is completed. If the purpose of the data processing no longer applies, it will be deleted after that. (Therefore, the data of registered users is kept until the registration period ends, the data of newsletter subscribers is kept until they unsubscribe from the newsletter, and the data of unregistered buyers is kept until the delivery of the product.) 

3. Details of data processing for individual activities
3.1 Requesting information: Pursuant to Article 65(3)(a) of the Infotv., NAIH – as the Authority – does not maintain a data protection register regarding this data processing.
a) Legal basis for data processing: Requesting the information is voluntary
b) The purpose of data processing: Providing appropriate information and maintaining contact with the data subject.
The scope and purpose of the processed data:
Data
Goal
Your name
identification
Your email
contacting, clarifying needs, providing information
Phone number
contacting, clarifying needs, providing information
Content of the question/request
Response to input data of the data subject: All natural persons who contact the Data Controller and request information from the Data Controller by providing their personal data.
c) Duration of data processing: Until the goal is achieved.
d) The process of data management:
da) the person concerned, in the manner chosen by him/her (in person, by telephone, by e-mail, or in another form), approaches the Data Controller for information purposes.
db) The Data Controller will, if necessary, clarify the request or demand with the affected person.
dc) The Data Controller provides the requested information in the manner in which it was received or as agreed upon with the data subject.
3.2 Subscription to the mailing list
a) Legal basis for data processing: Subscription is based on voluntary consent
b) The purpose of data processing: Providing information about the actions, events, prize draws and other relevant information for the Customers, targeted marketing activity towards the subscribers.
The scope and purpose of the processed data:
Data
Goal
Your name
identification
Your email
contacting
Phone number
contacting
Specified field of interest
offering, contact
The range of designated products
offering, contact
c) The scope of the data subjects: Any natural person who subscribes to the Data Controller’s mailing list by clicking on the “Subscribe” button
d) Duration of data processing: Until the consent is withdrawn or the subscription is cancelled.
e) The data management process:
ea) The person concerned subscribes to the Data Controller’s mailing list by providing their requested personal data through the „Subscribe” option located on the website’s interface.
eb) Alternatively, you may request, by other means, e.g. by letter sent to the r-filter@r-filter.hue-mail address or by contacting the telephone number indicated on the website, to have your previous subscription, as well as your personal data processed in connection with it, deleted.
ec) The Data Controller will, as necessary, clarify the request or requirement with the affected person.
The person wishing to unsubscribe must be aware that immediate cancellation can only be made by unsubscribing in accordance with sub-clause ea) of this paragraph; the cancellation under sub-clause eb) may have a processing time of a few days, for which reason it is not unlawful if during this period the system still sends the newsletter to the person concerned. The Data Controller also draws attention to the fact that a newsletter sent at the same or almost the same time as the current sub-clause ea) and an immediate cancellation request can technically avoid each other; therefore, the newsletter received after the cancellation does not constitute a failure to take the cancellation request into account. 

4. Presence and marketing on social media
a) The legal basis for data processing: The data processing related to the profile on the Data Controller’s social media pages is based on voluntary consent.
b) Purpose of data processing: Sharing of content on the Data Controller’s website on social media platforms, awareness-raising for this purpose, marketing. Scope and purpose of processed data:
Data
Goal
Your name
identification
used photo
identification
comment
opinion, expression of a comment
evaluation
opinion, expression of mood
Content of the question/request
response input data
c) The scope of the data subjects: Any natural person who visits the Data Controller’s social media pages, follows them, interacts with the content posted on them (like/dislike), and shares them with their own acquaintances, partially or completely.
d) Duration of data processing: Until the cancellation. (In this case, the Personal Data of the Data Subject are managed by the social network. If the Data Subject has accepted its privacy policy, they can then express their opinion in connection with the appearance of the Data Controller. However, these data processing activities are not managed by the Data Controller, but by the social network.) 

5. Data management related to banking data
a) Legal basis for data processing: Providing data related to bank transfers is necessary for the performance of the contract.
b) The purpose of the data processing: to facilitate the financial settlement from the part of the data subject. The scope and purpose of the processed data:
Data
Goal
name (of the account holder)
identification
e-mail address (postal address)
required for claiming the prize and sending the invoice
bank account number
identification
press release
identification
sum
required for the fulfillment
c) The scope of the parties involved: Any natural person who wishes to pay by bank transfer.
d) Duration of data processing: In accordance with the applicable accounting regulations.
e) The data management process:
ea) The Data Controller will send the fee request/invoice to the affected email (postal) address.
eb) the affected person transfers the appropriate amount to the Data Controller’s bank account.
ec) The Data Controller verifies the transfer.
ed) the data related to the transfer are entered into the Data Controller’s accounting system, to which only an accountant who is in a contractual relationship with the Data Controller may have access as a data processor in this regard. 

6. Complaint handling
a) The filing of the complaint is based on voluntary consent, but in the case of a filed complaint, the processed data is mandatory under the CLV of 1997 on the consumer end.
b) Complaint
ba) at the r-filter@r-filter.hue-mail address, preferably with the word „PANASZ” indicated in the "Subject" field of the email, or
bb) By postal mail, the Data Controller may have the information delivered to it at the address specified by the Company.
c) Scope of the affected parties: Any natural person who wishes to communicate their complaint in person or in writing regarding the ordered or used service/product and/or the Data Controller’s conduct, activity or negligence.
d) The purpose of data processing is to enable the submission of a complaint, to identify the person concerned and the complaint, and to record the mandatory data required by law, as well as to maintain contact.
e) Duration of data processing: the Data Controller shall keep the record of the complaint and a copy of the response for 5 years from the recording date, in accordance with the relevant and applicable provisions of § 7, item 17/A.
f) In accordance with the provisions of the Fgytv., the entrepreneur is required to respond in writing within thirty days of receiving the written complaint, or until its expiration if a shorter deadline is established by law. The entrepreneur is required to provide a written response and take action regarding the notification of the complaint within a reasonable period of time. The entrepreneur is required to provide a reason for their position rejecting the complaint.
g) The data processing process:
ga) the person concerned communicates their complaint to the Data Controller in the manner chosen by them.
In the case of verbal complaints, the Data Controller shall record the complaint in a record.
gc) The Data Controller will examine all the circumstances of the complaint and respond accordingly.
gd) The Data Controller strives to resolve the complaint in a reassuring manner for the complainant. 

7. Purchasing through the Webshop
a) Legal basis for data processing: The fulfillment of the sales contract is the legal basis for the processing of the requested data.
b) The purpose of data processing: concluding the contract, the contractual compliance by both parties, and the possible delivery arrangement.
The scope and purpose of the processed data:
Data
Goal
Your name
identification
e-mail address (postal address)
necessary for identification, sending of an invoice, and for delivery
Phone number
identification
billing address
identification
c) Scope of the data subjects: Any natural person who orders the product sold by the Data Controller through the online store.
d) Duration of data processing: In accordance with the applicable accounting rules and the purpose of the data processing.
e) The data management process:
ea) the person concerned orders the product via the website.
eb) The Data Controller processes the order
ec) After payment of the purchase price (see: 4. Data processing related to banking), the Data Controller will contact the Partner involved in the delivery and will then instruct the Partner to deliver the ordered product.
ed) If the „purchase with registration” option is selected by the Data Subject, we will continue to process their data in accordance with the data management of registered users.
ee) If a one-time, registration-free purchase was made, after the product is delivered, the buyer's personal data will be deleted. 

8. Access to data
a) The Data Controller and the Data Processors described in point 1 may have access to the personal data provided by you in order to perform their duties.
b) The lawyer representing the Data Controller may also access your personal data if a court proceeding is initiated based on your complaint.
c) In exceptional cases, the Data Controller may disclose personal data to other state bodies. if
ca) the Data Controller, based on the legislation and its internal rules regarding document storage, transfers the case containing your personal data to the Archives,
cb) a judicial procedure is initiated in relation to you, and the court handling the case requires the submission of documents containing your personal data,
cc) The police contact the Authority and request the transfer of the documents containing your personal data for the investigation. 

9. Data security measures
a) The Data Controller stores the personal data provided by you primarily on a server equipped with the data processing standard security systems specified at the beginning of this Notice, partly on its own IT equipment, and in the case of paper data carriers, in a properly secured location at its headquarters. The Data Controller does not use any other collaborating service to store your personal data.
b) The Data Controller shall ensure, by means of reasonable measures and security software (firewall, virus scanner) and hardware appropriate to the age of the data, that your personal data is protected against, among other things, unauthorized access or unauthorized modification thereof. 

10. Rights related to data management
a) The right to request information You may request information from the Data Controller in writing via the contact details provided in point 1 of this document, to be informed of: – what personal data, – on what legal basis, – for what processing purpose, – from what source, – for how long it will process it, – to whom the Data Controller will provide access to the personal data or who the Data Controller has transferred the personal data to. The Data Controller will comply with your request within a maximum of 30 days, by sending a letter to the address provided by you.
b) The right to rectification You may request the Data Controller in writing through the contact details provided in point 1 of this document to modify your personal data (for example, you can change your email address or postal address at any time). The Data Controller will comply with your request within a maximum of 30 days and will notify you of this via a letter sent to the contact details provided by you.
c) Right to erasure You may request the Data Controller to delete your personal data via the contact details provided in point 1 of this document. The Data Controller may reject your request for erasure if the law or an internal policy requires the Data Controller to continue storing personal data. Such a case, for example, is when the deadline set in the internal policy regarding data storage has not expired. However, if there is no such obligation, the Data Controller will comply with your request within a maximum of 30 days and will notify you of this in a letter sent to the address you provided.
d) The right to block is yours. You may request the Data r-filter@r-filter.hu Controller to block your personal data via their email address in writing. The blocking will remain in effect until the reason you specified makes the storage of the data necessary. This could be the case, for example, if you believe that the Data Controller has handled your submission in an unlawful manner, but it is necessary for the purposes of an official or judicial procedure initiated by you for the purpose of blocking the submission from being deleted by the Data Controller. In this case, until the request is made by the authority or the court, the Data Controller will continue to store the personal data (for example, your submission), after which it will delete the data.
e) The right to object You may object to the processing of your data by contacting the Data Controller at the contact details provided in point 1 above, in writing, if the Data Controller intends to transmit or use your personal data for direct marketing, opinion polling or scientific research without your consent. You may also object to the processing of your data if you believe that the processing of your personal data is necessary solely for the purpose of fulfilling a legal obligation or exercising a legitimate interest of the Data Controller, except for data processing based on legal authorization. For example, you may not object to the transfer of your personal data to the Archive if we provide your submission containing personal data – together with the files of the case – to the Archive in accordance with our internal rules for data storage. 

11. Procedure in the event of the failure to exercise the rights related to data processing The Data Controller strives to ensure that you can exercise your data processing rights in accordance with the law and that every case ends satisfactorily for you. If you have not been able to resolve your objection, complaint, or requests regarding your personal data with our company in a satisfactory manner, or if you at any time consider that there has been a violation of your personal data or that a direct threat of such a violation exists, you are entitled to file a complaint with the National Data Protection and Information Freedom Authority. Contact information of the National Data Protection and Freedom of Information Authority Headquarters: 1125 Budapest, Szilágyi Erzsébet fasor 22/c. Mailing address: 1530 Budapest, Pf. 5 Telephone: +36 1 391 1400 Fax: +36 1 391 1410 E-mail: ugyfelszolgalat@naih.hu Web: naih.hu 12. Procedure in the event of a data protection incident endangering the security of the processed personal data Data Controller, as soon as it detects an intervention that may pose a potential threat to the security of the personal data it processes, shall immediately, but no later than 72 hours after the detection, report it through the data protection incident reporting online system established by the National Data Protection and Information Freedom Authority. In addition to reporting the incident, you must immediately take the necessary measures that are essential for the security of personal data. 13. Rights enforcement regarding data management In the event of unlawful data management by the Data Controller, you may initiate a civil lawsuit against the Data Controller. The trial is within the jurisdiction of the court of your residence. The trial may also be initiated before the court of your residence (the list and contact information of the courts can be viewed via the following link: http://birosag.hu/torvenyszekek.