Privacy

This privacy notice (the “Notice”) is the privacy notice of the online shop operated by WK DOMA Real Estate. (1014 Budapest, Fortuna utca 5., hereinafter the “Company”) under the www.souvenirsbudapest.com domain, and applies to the personal data about you that the Company collects and processes in connection with your use of the website (the “Website”).

Registered address

1014 Budapest, Fortuna utca 5.

Tax number

25042854-2-41

Company registration number

01-09-888930

If you have any questions or comments about this Notice before using the www.souvenirsbudapest.com website, or before providing any data under this Notice, please contact our customer service through any of the following:

Phone

+36 30 530 5498

Email

info@domaboutiquerealty.com

The Company reserves the right to amend this Notice unilaterally, with effect from the time of the amendment. We therefore recommend that you visit www.domaboutiquerealty.com regularly to keep track of any changes. On request, we will send you a copy of the Notice currently in force.

By providing any personal data or information, you declare that you have read and expressly accept the version of this Notice in force at the time you provide that data or information.

Specific data protection terms may also apply to certain separate services; you will be informed of these before using the service in question.

We may ask for data about you on our website (www.souvenirsbudapest.com) or in connection with certain services, and you may also voluntarily provide us with, or make public (for example on social media), certain data while communicating with the website. Some of the information we collect qualifies as “personal data” under Regulation (EU) 2016/679, the EU General Data Protection Regulation (the “GDPR”), and under point 2 of section 3 of Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (the “Infotv.”).

The data controller: the data is controlled by the operator of the Website, WK DOMA Real Estate Kft. (1014 Budapest, Fortuna utca 5., tax number: 14101166-2-41, phone: +36 30 530 5498, email: info@domaboutiquerealty.com).

The Company essentially processes the following personal data:

• Running customer service for complaint handling – phone number, and records of email communication
• Information collected in connection with use of the Website
• Data processed through social media

Persons authorised to process data (editor, admin)

The Company does not engage data processors to carry out the technical tasks associated with its data processing operations.

The data processed, the purposes and duration of processing, and the persons entitled to access the data are set out below:

We use cookies in certain areas of the www.domaboutiquerealty.com website. Cookies are files that store information on your hard drive or in your web browser. They allow the website to recognise that you have visited it before. Cookies help us understand which parts of the website are most popular, because they show us which pages our visitors open and how long they spend there. Studying this lets us tailor the website better to your needs and offer you a richer experience. For example, cookies help us ensure that the information shown on your next visit meets your expectations.

When you visit one of our websites, technical information from which you cannot be identified may also be collected automatically — for example, the name of the website that referred you here, the location from which the website was accessed, and the searches carried out on the website. Collecting this information helps us recognise the search habits our users prefer without using personal data. This information is used internally only. Anonymous or general data from which you cannot be identified is not personal data and is therefore outside the scope of this Notice.

You can set your browser to accept all cookies, reject all cookies, or notify you when a cookie is sent to your device. Every browser is different, so please use your browser’s “Help” menu to change your cookie settings. In Microsoft Internet Explorer, for example, you can delete or disable cookies under “Tools/Internet Options” and change your security settings. The www.domaboutiquerealty.com website is designed to work with cookies, so disabling them may affect its usability and prevent you from enjoying all of its features.

Cookies used on our websites

• Analytics and tracking
• User identification session cookie

We do not exchange cookies with websites operated by third parties or with third parties.

Purpose of processing

Presenting the Company’s activities, products and company news on facebook.com and instagram.com.

Legal basis

Under section 5 of Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information, the voluntary consent of the data subject, given by registering on facebook.com and liking the page.

Duration of processing

Processing takes place on facebook.com. The duration and manner of processing, and the options for deleting and amending data, are governed by the policies of facebook.com and instagram.com (www.facebook.com/about/privacy; help.instagram.com/519522125107875).

The www.domaboutiquerealty.com website may contain links to other websites that we do not necessarily control, and other websites we do not control may link to www.domaboutiquerealty.com. Once you leave www.domaboutiquerealty.com, we cannot take responsibility for the security of any information you provide on other sites. We recommend acting with care and reading the privacy documents of the websites in question.

Protecting your personal data is a priority for DOMA Boutique Realty and its partners. The collection and processing of personal, identifying data required while you use our website complies with the Hungarian data protection rules in force (Act CXII of 2011).

We treat your data confidentially and do not pass it on to third parties unless this is essential to performing a contract (e.g. postal or courier services). Our staff, partners and service providers are bound to us by confidentiality obligations.

The Controller undertakes to ensure the security of the data, to take the technical and organisational measures and to establish the procedural rules that keep the data collected, stored and processed protected, and to prevent its destruction, unauthorised use and unauthorised alteration. It also undertakes to call on every third party to whom it transfers or discloses data on the basis of the Users’ consent to meet the requirements of data security.

The Controller ensures that no unauthorised person can access, disclose, transmit, alter or delete the data processed. The data processed may be accessed only by the Controller and its employees, and the Controller does not disclose it to any third party not entitled to access it.

The Controller does everything in its power to ensure that the data is not damaged or destroyed, even accidentally. The Controller imposes this commitment on its employees involved in data processing.

The User acknowledges and accepts that when personal data is provided on the Website — even though the Website operator uses up-to-date security tools to prevent unauthorised access to the data or its interception — the protection of data on the Internet cannot be fully guaranteed. Should unauthorised access or disclosure occur despite our efforts, the Website operator is not liable for such data acquisition or unauthorised access, or for any damage suffered by the User as a result. In addition, the User may also give their personal data to third parties who may use it for unlawful purposes or in an unlawful manner.

The Company, as controller, under no circumstances collects special categories of data, that is, data relating to racial origin, membership of a national or ethnic minority, political opinions or party affiliation, religious or other philosophical beliefs, membership of an interest group, health, addictions, sexual life or criminal record.

Persons under the age of 16 may not provide personal data about themselves unless they have obtained their parents’ permission.

By providing personal data, you declare and warrant that you are acting in accordance with the above and that your legal capacity to provide the information is not restricted.

If you are not legally entitled to provide any personal data on your own, you must obtain the consent of the third parties concerned (e.g. an authorised family member, legal representative, guardian or other person — such as a consumer — on whose behalf you are acting) or provide another legal basis for providing the data. In this context, you must consider whether the consent of a third party is required for providing the personal data in question. We make every reasonable effort to delete all information provided to us without authorisation, and we ensure that such information is neither passed on to anyone else nor used by us (for advertising or any other purpose). Please tell us immediately if you find that a child has provided personal data about themselves, or a third party has provided personal data about you, without authorisation. You can reach us through the contact details given at the start of this Notice.

The Company, as operator of the website and as controller, does everything it can to ensure that personal data is processed lawfully. If you feel we have fallen short of this, please write to us at info@domaboutiquerealty.com.

In general, a data subject may request from the controller, above all: (a) information about the processing of their personal data, (b) the rectification of their personal data, and (c) the erasure or blocking of their personal data, except where processing is mandatory. The controller must provide the information in writing, in an intelligible form, at the data subject’s request, as soon as possible and at the latest within 25 days of the request. If the controller does not fulfil the data subject’s request for rectification, blocking or erasure, it will state the factual and legal reasons for rejecting it in writing — or, with the data subject’s consent, electronically — within 25 days of receiving the request.

The legal basis for processing is the Users’ voluntary consent, given by opening the website or by entering those parts of it that require registration.

11.1. Right to information

Users may request information about the processing of their personal data. On request, the controller will give the data subject detailed information about the data it processes, the purpose, legal basis and duration of processing, the name and address of the processor and its activities related to the processing, and who has received or is receiving the data and for what purpose. Information can be requested at the controller’s postal address (1014 Budapest, Fortuna utca 5.) or by email at info@domaboutiquerealty.com.

The User may also request the rectification and erasure of their personal data through the same channels.

A User who feels that the controller has infringed their right to the protection of personal data may bring a claim before a civil court or seek the assistance of the Hungarian National Authority for Data Protection and Freedom of Information (the “Authority”). Detailed provisions on this, and on the controller’s obligations, are set out in the Infotv.

11.2. Right to rectification, erasure and blocking

If personal data is inaccurate and the accurate personal data is available to the controller, the controller will rectify it. Personal data must otherwise be erased if its processing is unlawful; if the data subject requests it as set out above; if it is incomplete or incorrect — and this cannot lawfully be remedied — provided that erasure is not precluded by law; if the purpose of processing has ceased or the statutory retention period has expired; or if a court or the Authority has ordered it.

Instead of erasing it, the controller will block personal data if the data subject so requests, or if the information available suggests that erasure would harm the data subject’s legitimate interests. Personal data blocked in this way may be processed only for as long as the purpose that precluded its erasure persists. The controller will flag personal data it processes if the data subject disputes its accuracy but its inaccuracy cannot be clearly established.

The data subject, and everyone to whom the data was previously transmitted for processing, must be notified of any rectification, blocking, flagging or erasure. Notification may be omitted if, given the purpose of processing, this does not harm the data subject’s legitimate interests.

Where the website’s services are used improperly, or at the User’s own request, the controller will erase the User’s data. Erasure takes place within 8 days of receiving the request. The controller reports rejected requests to the Authority annually, by 31 January of the following year. If a request for rectification, erasure or blocking is rejected, the controller will inform the data subject of the option of seeking judicial remedy or turning to the Authority.

11.3. Right to object

The data subject may object to the processing of their personal data if processing or transfer is necessary solely to fulfil a legal obligation of the controller or to pursue the legitimate interests of the controller, a recipient or a third party, except in the case of mandatory processing; if the personal data is used or transferred for direct marketing, opinion polling or scientific research; and in other cases specified by law.

In the cases set out in the GDPR and in section 21 of the Infotv., the data subject may object to the processing of their personal data. The controller will examine the objection as soon as possible, and within 25 days of the request at the latest, decide whether it is justified, and inform the applicant of its decision in writing.

If the controller finds the objection justified, it will stop processing — including any further collection and transfer of data — block the data, and notify everyone to whom the personal data concerned was previously transferred, and who must act to enforce the right to object, of the objection and the measures taken on the basis of it. If the data subject disagrees with the controller’s decision, or if the controller misses the deadline, the data subject may go to court within 30 days of the decision being communicated or of the last day of the deadline.

The data subject may go to court if their rights are infringed and in the cases set out in section 21 of the Infotv. At the data subject’s choice, proceedings may also be brought before the regional court for their place of residence or stay.

The court handles the case as a matter of priority. The controller must compensate any damage caused to others by unlawful processing of the data subject’s data or by breaching data security requirements. The controller is also liable to the data subject for damage caused by a processor. The controller is exempt from liability if it proves that the damage was caused by an unavoidable reason outside the scope of processing. No compensation is due to the extent that the damage resulted from the injured party’s intentional or grossly negligent conduct.

In addition, anyone may file a report with the Hungarian National Authority for Data Protection and Freedom of Information to initiate an investigation on the grounds that a violation of rights, or an imminent threat of one, has occurred in connection with the processing of personal data or with the exercise of the rights to access data of public interest or data public on grounds of public interest.

Website

naih.hu

Postal address

1530 Budapest, Pf.: 5., Hungary

Phone

+36-1-391-1400

Fax

+36-1-391-1410

Email

ugyfelszolgalat@naih.hu

Rights and remedies relating to data processing are set out in detail in subchapters 13–17 and 30 of the Infotv.

Before initiating any proceedings, it may be advisable to send your complaint to the controller first.

All Users use the public communication channels that form part of our services at their own risk. The moral rights in the copyright of individual comments belong to the User concerned; however, the User may not assert any property right or claim against the controller, and the Company, as controller, is entitled to quote from them without restriction, reproduce them and/or, where necessary, moderate and/or modify them.

Users may send their opinions and comments to the controller; however, the Company, as controller, will not publish — and will delete — any comment that breaches the law, infringes personality rights, or does not comply with the controller’s business policy and principles. Otherwise, third parties may print, download or distribute comments for personal use only, and may use them only with the controller’s written consent.

Please note that comments appearing on public communication channels are subject to the various laws governing public communication.

Using the Internet brings various threats to privacy. Please note that an opinion you post on the website is personal data from which your special data — even your origin or political views — may be inferred. This data becomes accessible to everyone. To protect your personal data, we recommend using PETs (privacy-enhancing technologies); many websites provide information about them.

Useful links

National Authority for Data Protection and Freedom of Information

www.naih.hu

National Media and Infocommunications Authority

nmhh.hu

Legislation in force

www.magyarorszag.hu

This Notice is governed directly and bindingly by the GDPR, and by Hungarian law, in particular Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information.

The Company, as controller, reserves the right to amend this Notice unilaterally at any time, subject to prior notice to the User. To continue using the Website, the User must accept the amendment on the Website in the manner the Website provides. Amendments take effect for the User upon acceptance, or upon first use of the Website.

Where one is appointed by the company, the data protection officer is responsible for monitoring the processing of data and for informing and advising the staff, subcontractors and suppliers who process personal data of their related obligations. The data protection officer also cooperates with the data protection authority, acting as an intermediary between the authority and individuals.

At Vár-Archívum Kft., this role is performed by the Managing Director in office at the time.

Purpose of processing

• establishing and maintaining contractual relationships in connection with the Company’s commercial activities, and exercising the rights and performing the obligations arising from them;
• enforcing and protecting legitimate interests relating to the client;
• fulfilling legal obligations arising in connection with the contractual relationship.

Retention of data

• 12 months from the date on which the data subject gives their consent.
• for all personal data processed on the basis of consent that falls under sections 56–57 of Act LIII of 2017 on the Prevention and Combating of Money Laundering and Terrorist Financing, the processing period is 24 months after the contractual relationship ends.

Method of processing

• keeping paper-based or electronic records

As a condition of collecting data, before entering into a contractual relationship with the data subject, the Company must in every case inform them of

• the name and contact details of the Company or of its representative;
• the fact that the contractual relationship can be established only if they consent to the Company knowing and processing the personal data required for it;
• the exact purpose, legal basis and specific scope of processing;
• the recipients, or categories of recipients, of the personal data;
• the intended retention period of the personal data;
• the rights of the data subject;
• the option of lodging a complaint with the Authority or seeking judicial remedy.

The Company must provide this information using the forms in the annexes (consent declarations), by sending them to the data subject or making them available to them.

1. Lawfulness, fairness and transparency

   Personal data must be processed lawfully, fairly and in a manner that is transparent to the data subject. We must always process personal data in compliance with the applicable legislation, and act fairly while doing so — for example, we never disclose our contractual partners’ data in any way. Fair and transparent processing requires that we process data in a way that keeps it traceable.

2. Purpose limitation

   Personal data may be collected only for specified, explicit and legitimate purposes and may not be processed in a manner incompatible with those purposes. We may only ever collect data for a specified purpose — and not only must we be able to say what that purpose is, we cannot swap it for another as we please.

3. Data minimisation

   Personal data must be adequate, relevant and limited to what is necessary for the purposes of processing. We may only ever collect as much data as we strictly need.

4. Accuracy

   Personal data must be accurate and, where necessary, kept up to date, and every reasonable step must be taken to ensure that personal data that is inaccurate for the purposes of processing is erased or rectified without delay.

5. Storage limitation

   Personal data must be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes of processing. From time to time we must dispose of (destroy) data. When doing so, we make sure to dispose, with a written record, only of documents that were actually in our possession (recorded in our register), so that we do not retrospectively evidence unauthorised processing against ourselves. We also always take care that, to keep data traceable, we can answer a data subject who asks when and how we ended the processing of their data.

6. Integrity and confidentiality

   Personal data must be processed in a manner that ensures its appropriate security through appropriate technical or organisational measures, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.

The principles in summary

• we may process personal data only for a specified purpose, to exercise a right or fulfil an obligation;
• at every stage, our processing must serve its purpose, and we must act fairly and in accordance with the applicable laws when collecting and processing data;
• we may process only personal data that is essential and suitable for achieving the purpose of processing, and only to the extent and for as long as the purpose requires;
• during processing we must ensure that the data is accurate, complete and — where the purpose of processing requires it — up to date, and that the data subject can be identified only for as long as the purpose requires; once we can no longer assign a purpose to the data, we must stop processing without delay and destroy the data in a verifiable way.

A personal data breach occurs when data for which the company is responsible comes into the possession of unauthorised parties, whether inadvertently or unlawfully, or becomes temporarily unavailable or is altered.