1. PREAMBLE, OBJECTIVE OF THE RULES

1.1. ORIANA International Tanácsadó, Fejlesztő és Szolgáltató Zrt. (Seat: 1037 Budapest, Montevideo utca ; Registration number: 01-10-140105; VAT number: 26597694-2-41; hereinafter: „Controller 1”), Oriana World Zártkörűen Működő Részvénytársaság (Seat 1037 Budapest, Montevideo utca 9.; Registration number: 01-10-140922; VAT number 26597694-2-41; hereinafter: „Controller 2”) and ORIANA Tanácsadó, Fejlesztő és Szolgáltató Korlátolt Felelősségű Társaság (Seat: 1037 Budapest, Montevideo utca 9.; Registration number: 01-09-702979; VAT number: 12778090-2-41; hereinafter: „Controller 3”) (hereinafter separately: “Company”; jointly: “Joint Controllers” or “Companies”) during their activity processes personal data defined in Article 4, point (1) of regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC („GDPR”) originated from the Companies clients, recipients of its marketing messages and visitors to its facilities, as well as other affected persons. These rules and information on data protection (hereinafter: „Rules”) include the conditions of data processing of the Companies of these personal data.

1.2. Companies entered into a Joint Controller Agreement on March 28 2023, according to which, the Companies, as data controllers, subject themselves to the contents of these Rules, furthermore undertake liability to that all the data management connected to their activities shall be compliant to the requirements specified in these Rules and the valid Hungarian and EU legal regulations.

1.3. The objective of these Rules is that the processing of personal and incidental sensitive data

a. necessary for using the services of the Companies,

b. necessary for the popularization of the services of the Companies, and

c. necessary for the activity of the Companies

should take place pursuant to the provisions of the prevailing Hungarian and EU legal regulations on data protection. The objective of these Rules furthermore is that the Companies previous to the processing of personal data to provide clear and detailed information on all facts relating to the processing of personal data, especially the purpose and legal basis of the data processing, the persons authorized to process and manage the data, the duration of the data processing, and to determine who can access the data and which rights and remedies are available for the affected person.

1.4. Furthermore, the objective of these Rules is that in the whole scope of services provided by the Companies, the affected person can be assured of that – regardless of the affected person’s sex, nationality or home address – the affected person’s rights and basic rights of freedom, such as especially their right to private life will be respected while their personal data is processed electronically (data protection). The Companies shall process the recorded personal data in confidence, by complying with the legal regulations and international recommendations on data protection and these Rules on data protection.

2. INTERPRETATION OF THE RULES, DEFINITIONS 

 2.1. These Rules shall be interpreted based on the principles of English language in consideration of the general legal principles of the Hungarian civil law. When interpreting these Rules, the words and phrases written in capital letters shall have the meaning conferred to them on their first place of appearance in the Rules – independently of their tense, mode and case, or whether they are singular or plural.

2.2. In harmony with the regulation of GDPR where it cannot be interpreted otherwise based on the context, the terms used in low-case letters in these Rules shall mean the following:

affected person/user means the natural person whose personal data the Company processes specifically but not exclusively  

a. the person who establish business relationship with the Company;

 b. the employees of the Company;

 c. persons applying for a job offered by the Company.

business advertisement information, statement, method of appearance, aimed at promoting the sales or other usage of marketable movables that can be possessed – including money, securities and financial assets and natural resources that can be utilised as things – (hereinafter jointly: the product), services, real estates, rights constituting asset value (hereinafter all of these jointly: goods) or, in connection with this objective, aimed at popularising the name, trademark, activities of the corporation or goods or brands;

consent/ approval of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

contract means contracts concluded between the affected person and the Company in connection with the activities of the Company;

data processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

data management fulfilling technical tasks connected to data processing operations independently of the method and tools used for their realisation and the place of usage, provided that the technical tasks are realised with data;

destruction the complete physical destruction of data carrier containing the data;

data transfer making the data available to a specified third party;

data erasure making data unrecognizable in a way that their restoring is not possible any longer;

data blocking providing data with identification marking in order to limit its further management definitely or for a specified period; instead of erasure, the Company blocks the data where the definite erasure of the data would breach the lawful interests of the affected person; blocked data shall be treated exclusively as long as the objective of data management exists, which excluded the erasure of the personal or sensitive data;

disclosure making the data available to anyone;

objection the statement of the affected person by objecting the processing of its personal data and by which it requests the erasure of the processed data;

personal data means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed

personal identification data the first and last name, maiden name, of the affected person, its sex, place and date of birth, its mother’s birth first name and last name, permanent address, place of stay, social security identification mark jointly or any of them which is or may be suitable for identifying the affected person;

pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;

sensitive data personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation;

supervisory authority means the authority which is responsible for personal data and the freedom of information in Hungary, the Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian National Authority for Data Protection and Freedom of Information) (address: 1055 Budapest, Falk Miksa utca 9-11.; Mail address: 1363 Budapest Pf 9.)

third party means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data;

2.3. If it is not concluded differently from the text otherwise:

a. reference to any legal regulations in these Rules includes the incidental later modified, expanded, uniform structure of the legal regulation in question;

b. in these Rules the titles and paragraph numbers serve exclusively reference and they shall be considered only together with the interpretation of the text of these Rules;

c. all references to a person in these Rules mean reference to any person, company, association, government, state, state institution or authority;

d. any of the provisions of these Rules shall not be interpreted in a way that it would exclude the liability or legal remedy for fraudulent statements or procedures or statements or procedures made or initiated in bad faith.

3. NAMES AND CONTACT INFORMATIONS OF THE CONTROLLERS

3.1. ORIANA International Tanácsadó, Fejlesztő és Szolgáltató Zártkörűen Működő Részvénytársaság

Seat of the controller: 1037 Budapest, Montevideo utca 9. 

Mail (postal) address of the controller: 1037 Budapest, Montevideo utca 9. 

Registration number of the controller: 01-10-14010501 

VAT number of the controller: 26597694-2-41

E-mail address of the controller: richard.basa@orianasoftware.com

3.2. Oriana World Zártkörűen Műkörő Részvénytársaság

Seat of the controller:1037 Budapest, Montevideo utca 9. 

Mail (postal) address of the controller: 1037 Budapest, Montevideo utca 9. 

Registration number of the controller: 01-10-140922 

VAT number of the controller: 28729954-2-41 

E-mail address of the controller: richard.basa@orianasoftware.com

3.3. ORIANA Tanácsadó, Fejlesztő és Szolgáltató Korlátolt Felelősségű Társaság

Seat of the controller: 1037 Budapest, Montevideo utca 9. 

Mail (postal) address of the controller: 1037 Budapest, Montevideo utca 9. 

Registration number of the controller: 01-09-702979 

VAT number of the controller: 12778090-2-41 

E-mail address of the controller: erika.terdik@orianasoftware.com 

4. PRINCIPLES RELATING TO PROCESSING OF PERSONAL DATA

 4.1. The Company shall use and store the personal data provided by the affected person lawfully, fairly and in a transparent manner only for specified purposes determined in these Rules.

4.2. The personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.

4.3. The process of the personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

4.4. The processed personal data shall be accurate and, where necessary, kept up to date. Every reasonable step must be taken by the Company to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay.

4.5. The processed personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.

4.6. The personal data shell be processed by the Company in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures.

4.7. The Company shall process the personal data only for the realization of the purposes specified in these Rules.

4.8. Where the affected person is a child below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child. The Company shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology.

4.9. The Company shall be responsible for, and be able to demonstrate compliance with the provisions of this paragraph.

5. OBJECTIVE OF DATA PROCESSING, PURPOSES OF PROCESSED DATA, AND DURATION OF DATA PROCESSING

5.1. Data processing related to the Company’s business activities

purposes and objective of data processing 

The Company during its business activity may process personal data.  Personal data shall only be processed  by the Company for the purpose of (i) identifying the affected person, distinguishing them from other affected persons, and maintaining contact with the the affected person; (ii) performing any legal or contractual relationship; (iii) performing any contract; (iv) in the event of termination of the contract, enforcement of claims and enforcement of collateral; (v) sending notices or other communications related to the services provided by the Company; (vi) the fulfillment of data processing and data reporting required by legislation; (vii) settlement of accounts and proof of obligations and rights of the parties related to any contract; (viii) processing for statistical purposes, including data collection for market analysis purposes. During the business activity of the Company personal data shall be processed based on the voluntary approval of the affected person or on purpose for the performance of a contract to which the affected person is party or in order to take steps at the request of the affected person prior to entering into a contract determined by article 6 (1) (a) and (b) of the GDPR

Where the legal basis of the data processing is the performance or preparation of a contract, the contract shall contain all the information which the affected person shall know concerning the processing of personal data, in particular the definition of the data to be processed, the duration of data processing, the purpose of use of personal data, the fact of the transfer of personal data, the recipients and the use of data processors.

Where data processing is based on the consent of the affected person, the Company shall provide the affected person prior to granting consent with any information that the data subject must know about the processing of personal data, in particular the definition of the data to be processed, the duration of data processing, the purpose of use of personal data, the fact of the transfer of personal data, the recipients and the use of data processors.

duration of data processing

In the case of entering into a contract with its partners, the Company shall process the personal data for a period of five (5) years counted from the date of termination of the contractual relationship or the enforceability of the contract, and thereafter the Company shall be obliged to erase the personal data. In the case of data processing based on the consent of the affected person, the data processing shall continue until the consent is revoked or the affected person requests to delete the data, unless there is no other legal basis for data processing.

5.2. Data processing related to advertising activity

Pursuant to Section 6 paragraph (1) of Advertising Law, advertisement for the purpose of direct marketing by direct contact of a natural person as a recipient of advertising (such as electronic mail or other equivalent individual communication tool, with the exception of the postal item sent by the addressee) may be communicated only if the recipient has given prior, unambiguous, and express consent to it. In harmony with the applicable law and the consent of the affected persons, the Company shall be obliged to maintain a record of the personal data provided by the affected persons who has given his/her consent. Data recorded in this register – regarding the recipient of the advertisement – may only be processed in accordance with the consent statement, until it is revoked, and may be transferred to third parties only with the prior consent of the affected person or in case if it is permitted by law.

The affected person shall therefore authorize the Company and may agree that the Company shall inform the affected person about its services by direct mail or other tools of communication (telephone, e-mail, SMS, etc.) and shall agree that the Company process his/her personal data for such purpose. The affected person may, at any time, forbid – without limitation or justification – the Company to send him/her direct marketing promotional material, and may at any time and free of charge withdraw his/her consent to send such promotional letters and to process of his/her personal data on the purpose of marketing. The affected person may declare his/her claim in this manner to the Company through the contact details specified in these Rules and through any other contact details listed on the mailings of the Company. In this case, the client will no longer be contacted by the Company for advertising purposes.

5.3. Data processing related to the employees of the Company

objective of data processing, and processed data:

To comply with the registration and notification obligations according to the applicable labor law the Company shall process the following personal data of its employees based on the voluntary approval of the affected person or on the fulfillment on the Company’s obligations under the legislation stipulated in article 6 (1) (c) of the GDPR: 

a. surname and forename;

b. surname and forename at birth;

c. nationality;

d. date and time of birth;

e. mother’s maiden name;

f. address;

g. bank account number;

h. social security number;

i. type and number of identification document

The Company informs the affected person that the data processing described in this section is based on legal authorization.

duration of data processing

The duration of the data processing affecting the employees of the data controller is determined by the applicable legislation.

5.4. Data processing related to potential employees of the company

Legal basis of the data processing related to potential employees of the Company is based on the informed and unambiguous consent statement of the affected person stipulated in article 6 (1) (a) of the GDPR. The purpose of data processing is to recruit and select potential employees for the Company.

By sending his/her CV and other application documents to the Company, the potential employee approve that the Company shall  store, process and use the personal data provided during application in accordance with applicable laws and regulations, until the affected person withdraw his/her consent, or for a period of 1 year counted from the date of filling the relevant position.

5.5. Data management related to visitors to Company premises

The Company shall operate and install surveillance cameras for security purposes in its office, premises, and in other property owned and managed by the Company. Cameras can capture images that can be viewed and used by data controller for property protection purposes or for performing labor contracts. The legal basis of the data processing determined in this section is the necessary purposes of the legitimate interests pursued by the controller stipulated in article 6 (1) f) of the GDPR. The purpose of data processing is to protect the Company’s assets and to prevent attacks on its assets and to detect persons who have committed attacks on their assets. The recordings will be deleted by the Company if they are not used for any purpose described in this section within 3 days after the recordings were made.

5.6. Data processing on the Homepages of the Company

The system used by the Company will identify the computer of the homepage operated by the company (hereinafter referred to as: “Homepage”) user by so-called cookies. In order that all contents of the Homepage can be viewed, the user should approve the cookies. Therefore, when downloading certain parts of the Homepage, cookies will be placed on the user’s computer, which are necessary for the operation of each function of the Homepage. Cookies are small text files, which are saved by the computer and the browser and the user will not receive any information on that from the Company. Cookies are not suitable for identifying the person of the user and they live only during the session. The objective of the Company with placing the cookies is to send essential information to the visitors in a targeted way. The above information shall be used by the Company exclusively for the operation of the Homepage and statistical purposes.

The user shall acknowledge that by using the Homepage, the user approves expressly that the Homepage uses cookies for marketing (remarketing), by the aid of which the Company can send customised advertisements to the users via the Internet. The User can prohibit the usage of the above cookies on the advertisement setting page of Google.

While browsing the Homepage, technical information is recorded (e.g. in the form of log files, which include the user’s IP address, the date and time, the URL of the visited page). The system logs such information continuously, but it will not connect it to the information provided during usage. The users will not but only the Company will access to information collected in this way. The Company shall use the above information exclusively for the technical operation and for statistical purposes of the Homepage.

During the operation of the Homepage, automatically, technically recorded data may be stored in the system for a reasonable period from the time of their generation to ensure the operation of the system. The controller ensures that these automatically recorded data cannot be interconnected with other personal data, except in cases that are legally binding. If the user has terminated his or her consent to the management of his or her personal data or has been unsubscribed from the service, then his/her personal data will not be identifiable excluding for investigation authorities or for their experts.

By accepting the Rules, the affected person shall acknowledge that during the usage of the Homepage, he/she shall not share content or shall not send messages, which 

a. breaches other people’s honor, dignity;

b. impeaches other persons for their national, ethnic origin race, affiliation to a religious group or presumed debt;

c. impeaches any services, business companies, without grounds, in bad faith or with the aim of discrediting.

The Company will erasure such personal data immediately and call the affected person to fulfil the above requirements. Should the affected person behave in the same way, by breaching the above rules after the notice, the Company, without any further notice, reserves the right to itself to erasure the data of the affected person.

6. GENERAL REGULATIONS OF DATA PROCESSING

6.1. The Company informs the affected person that no process of sensitive data takes place.

6.2. It is the voluntary decision of the affected person whether or not to give the personal data included in paragraph 5 of the Rules to the Company but without the recording of personal data specified in above most of the services provided by the Company cannot be used by the affected person. In case the affected person gives the data of a third party while using the services of the Company or in case the affected person causes any harm, the Company shall be entitled to claim compensation for damages from the affected person. The Company will not verify the personal data given to the Company. Exclusively the person providing the data shall be liable for the authenticity, truth of the provided data. Any affected person, when providing its e-mail address shall undertake liability for that only this person that has provided the contact information will use the services from the e-mail address.

6.3. The Company may request the affected person to provide other personal data as well subject to the condition that the Company shall specify the purpose of data processing before requesting so. Recording personal data shall be voluntary in each case and if certain personal data is not provided this fact shall not influence the services provided by the company.

6.4. Should the Company process personal data of the affected person pursuant to any provisions of laws, then the Company shall inform the affected person on such data management operation, the purpose and duration of the operation before executing the – by also specifying the legal reference. Before requesting any personal data, the Company shall inform the affected person that the provision of the data in question is voluntary and based on the approval of the affected person or it is compulsory and is based on legal regulations.

6.5. The Company shall be entitled to use the personal data in a way that the data shall be deprived of its relationship to the affected person and for statistical purposes. The Company undertakes that it will be impossible to connect such data to any of the affected persons after their statistical processing.

6.6. The affected person shall acknowledge that the Company may process the provided personal data with the aim of safety data agreement, may request the copy of the affected person’s personal identity card with the aim of controlling the authenticity of personal data which the affected person can send to the Company either in a scanned form via e-mail or by regular mail but which shall be subject to special data processing approval. The Company shall store the personal data recorded during safety data control in its protected information system and only temporarily and after the completion of the safety data control the Company shall destroy the photocopy sent by the affected person. The Company shall inform the affected person on the purpose and further conditions of data processing realised via safety data control when requesting the information. The affected person shall acknowledge that courts, prosecutors, investigation authorities or authorities of minor infractions might contact the Company with the aim of requesting, transferring personal data or making documents available to them. The Company shall disclose to authorities personal data only in a quantity and to an extent, which is definitely necessary for achieving the purpose of the request upon the lawful requests from authorities – if the authority has specified the accurate purpose and the scope of information.

6.7. Where processing is based on consent affected person shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. The processing shall be continued if there is any other legal basis of data processing. 

7. ACCESS TO THE PROCESSED DATA, DATA MANAGEMENT AND DATA TRANSFER

7.1. Access to the processed data

Primarily the Company and the internal employees of the Company shall be entitled to know the personal data and they shall not publish or disclose the personal data to any third parties and they shall use the personal data for the purposes specified in the Rules. 

Within the scope of operation of its information system, the Company may use the services of a data processor person (e.g. system operator, system administrator. 

The Company shall be entitled to transfer the affected person’s personal data to its subcontractors. Before selecting its partners, the Company prepared such selections with utmost care. Such partners shall treat the confidential information acknowledged by them when fulfilling their liabilities and providing their services, subject to the provisions of legal regulations.

7.2. Data management

7.2.1. The controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of GDPR and ensure the protection of the rights of the data subject.

7.2.2. Processing by a processor shall be governed by a contract or other legal act, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller.

7.2.3. The processor shall not process personal data except on instructions from the controller, unless required to do so by Union or Member State law.

7.2.4. On behalf of the Company the above listed processors manage personal data and/or receive data transfer:

7.2.5. The Company reserves the right to use other processors for managing the personal data in the future. In this case the Company is obliged to inform the affected persons by sending them the modified Rules in which the new processors are listed.

8. DATA SECURITY

8.1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:

a. the pseudonymisation and encryption of personal data; 

b. the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; 

c. the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; 

d. a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.

8.2. The Company shall take all the measures necessary for ensuring the safety of personal data given by the users on during network communication, data storage and guarding. Access is strictly limited to personal data in order that illegal learning, illegal change and usage of personal data can be prevented. The information system and network of the Company is protected appropriately against fraud, spying, sabotage, vandalism, fire, flood, computer bugs, computer breaking that might take place during computer usage. At the same time in harmony with to the applicable legal limitations, the Company excludes its liability for data loss or damage caused by computer attacks that are beyond its control or by crimes committed by third parties.

8.3. When processing data, the Company shall preserve (1) secrecy: the Company protects personal data in a way that access to it can be possible to persons that are authorized to do so; (2) integrity: the Company protects the integrity and the accuracy of processing of personal data.

9. RIGHTS OF THE AFFECTED PERSONS

9.1. Right of information and access to personal data

The affected person shall have the right to obtain from the Company confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

a. the purposes of the processing; 

b. the categories of personal data concerned; 

c. the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations; 

d. where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; 

e. the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; 

f. the right to lodge a complaint with a supervisory authority; 

g. where the personal data are not collected from the affected person, any available information as to their source; 

h. the existence of automated decision-making, including profiling, referred and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the affected person.

Where personal data are transferred to a third country or to an international organization, the affected person shall have the right to be informed of the appropriate safeguards pursuant relating to the transfer.

The Company shall provide a copy of the personal data undergoing processing. For any further copies requested by the affected person, the controller may charge a reasonable fee based on administrative costs. Where the affected person makes the request by electronic means, and unless otherwise requested by the affected person, the information shall be provided in a commonly used electronic form.

9.2. Right of rectification of personal data

The affected person shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the affected person shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

9.3. Right of erasure of personal data („right to be forgotten”)

The affected person shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies

a. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

b. the affected person withdraws consent on which the processing is based according to point, and where there is no other legal ground for the processing;

c. the affected person objects to the processing pursuant;

d. the personal data have been unlawfully processed; 

e. the personal data have to be erased for compliance with a legal obligation in EU or Hungarian law to;

f. the personal data have been collected in relation to offer of information society services directly to a child.

Where the controller has made the personal data public and is obliged pursuant to the above mentioned to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

Erasure shall be refused (i) for exercising the right of freedom of expression and information; (ii) for compliance with a legal obligation which requires processing by law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (iii)  for reasons of public interest in the area of public health; (iv)  for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes likely to render impossible or seriously impair the achievement of the objectives of that processing; or (v) for the establishment, exercise or defence of legal claims.

9.4. Right to restriction of processing

The affected person shall have the right to obtain from the Company restriction of processing where one of the following applies:

a. the accuracy of the personal data is contested by the affected person, for a period enabling the Company to verify the accuracy of the personal data; 

b. the processing is unlawful and the affected person opposes the erasure of the personal data and requests the restriction of their use instead;

c. the Company no longer needs the personal data for the purposes of the processing, but they are required by the affected person for the establishment, exercise or defense of legal claims; 

d. the affected person has objected to processing pursuant pending the verification whether the legitimate grounds of the controller override those of the data subject.

Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with the affected persons consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the EU or of Hungary.

An affected person who has obtained restriction of processing shall be informed by the Company before the restriction of processing is lifted.

9.5. Right to data portability

The affected person shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:

a. the processing is based on consent or on a contract pursuant; and

b. the processing is carried out by automated means.

9.6. Right to object

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1) of GDPR, including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

At the latest at the time of the first communication with the data subject, the mentioned above shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.

The data subject may exercise his or her right to object by automated means using technical specifications.

Where personal data are processed for scientific or historical research purposes or statistical purposes, the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

9.7. Notification obligation regarding rectification or erasure of personal data or restriction of processing

The controller shall communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.

9.8. The affected person can exercise his/her above listed rights on one of the following contacts:

Name: ORIANA International Zrt.
Seat: 1037 Budapest, Montevideo utca 9.
E-mail: info@orianasoftware.com

10. OBLIGATIONS OF THE AFFECTED PERSON 

10.1. The affected person shall provide true, authentic personal data and – if any of the pieces of data is changed – shall correct the personal data or ask the Company to correct the information.

10.2. The Company, without any further notice, reserves the right to itself to erasure the data of an affected person that abuses the personal data of another person.

11. RECORDS OF PROCESSING ACTIVITIES

11.1. The Company shall be obliged, and the Company representative, shall maintain an electronic record of processing activities under its responsibility. That record shall contain all of the necessary information prescribed in GDPR and Info Law.

11.2. The Company and the Company representative shall make the record available to the supervisory authority on request

12. PERSONAL DATA BREACH

12.1. In the case of a personal data breach, the Company shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.

12.2. When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the Company shall communicate the personal data breach to the affected person without undue delay.

12.3. The communication to the affected person shall not be required if any of the following conditions are met:

a. the Company has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption; 

b. the Company has taken subsequent measures which ensure that the high risk to the rights and freedoms of affected person is no longer likely to materialise; 

c. it would involve disproportionate effort. In such a case, there shall instead be a public communication or similar measure whereby the affected persons are informed in an equally effective manner.

12.4. If the Company has not already communicated the personal data breach to the affected person, the supervisory authority, having considered the likelihood of the personal data breach resulting in a high risk, may require it to do so or may decide that any of the conditions referred to in clause 12.3. are met.

13. LEGAL REMEDY

13.1. If the affected person believes that the Company by the data processing realised by itself breached these Rules or the prevailing legal regulations, then, in order to stop the presumed unlawful data processing, the affected person shall contact Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian National Authority for Data Protection and Freedom of Information) (address: 1055 Budapest, Falk Miksa utca 9-11/. Mail address: 1363 Budapest Pf. 9.).

13.2. The affected person shall be entitled to initiate a legal procedure against the Company where it believes that the rights regulated the Rules are breached by the Company. The court shall act in urgency. The tribunal shall have jurisdiction in the litigation – according to the affected person’s decision – based on the home address of the affected person or the seat of the Company.

14. MODIFICATION, INTERPRETATION, EFFECTIVE DATE OF THE RULES

14.1. With sending electronic notice to the affected persons – the Company reserves the right to itself to modify these Rules unilaterally.

 14.2. The Company states that all the modifications of the Rules will be compliant to the provisions on data protection of the legal regulations in effect on the date of modification.

14.3. The Company states that the Rules must be interpreted in harmony with the legal regulations in effect on the date of interpretation of the Rules. Should there be discrepancies between the Rules and the legal regulations in effect, the provisions of the legal regulations in effect shall be ruling.

14.4. The effective date of these Rules is 28^th March 2023.