Data management information

DATA MANAGEMENT NOTICE for the https://test-runner.com website operated by Péter Bogár EV

Company name: Bogár Péter Individual Entrepreneur

Location: 1223 Budapest, Dallam u. 6

VAT number: 62630991-2-43

EV number: ev084306

E-mail: hello@test-runner.com

Dated: 2023.02.13

1. Introduction

Bogár Péter EV (hereinafter referred to as the operator) undertakes to ensure that all the contents of this policy are in accordance with the requirements of the applicable legislation and meet the requirements of the applicable legislation. The processing of data necessary for the performance of the Operator’s activities is based on the voluntary consent of the data subject.

https://test-runner.com

This privacy notice complies with the applicable legislation on data protection, in particular:

• Act CXII of 2005 on the Right to Informational Self-Determination and Freedom of Information (Infotv.);
• Act XLVIII of 2006 on the basic conditions and certain restrictions of economic advertising (Act XLVIII of 2006 on the basic conditions and certain restrictions of economic advertising (Act XLVIII of 2006 on the basic conditions and certain restrictions of economic advertising);
• Act C of 2007 on electronic communications (Eht.)

2. Interpretative provisions

For the purposes of this Code:

• Related: any specified natural person who is identified or identifiable, directly or indirectly, on the basis of personal data;
• personal data: data that can be associated with a data subject, in particular the name, the identification mark and one or more physical, physiological, mental, economic, cultural or social identities of the data subject, and the inference that can be drawn from the data concerning the data subject;
• consent: a voluntary and explicit indication of the data subject’s wishes, based on appropriate information, by which he or she signifies his or her unambiguous consent to the processing of personal data relating to him or her, either in full or in relation to specific operations;

• objection: a statement by the data subject objecting to the processing of his or her personal data and requesting the cessation of the processing or the erasure of the data processed;
• controller: a natural or legal person or unincorporated body which, alone or jointly with others, determines the purposes for which the data are processed, takes and implements decisions regarding the processing (including the means used) or has the processing carried out with a processor;
• processing: any operation or set of operations which is performed upon the data, regardless of the procedure used, such as collection, recording, recording, organisation, storage, alteration, use, retrieval, disclosure, transmission, alignment or combination, blocking, erasure or destruction, prevention of further use, taking of photographs, audio or video recordings, and physical features which can be used to identify the data subject (e.g. fingerprints, palm prints, DNA samples, iris scans);
• transmission: making data available to a specified third party;
• disclosure: making the data available to anyone;
• deletion: making the data unrecognizable in such a way that it is no longer possible to retrieve it;
• data marking: marking data with an identification mark to distinguish it;
• data blocking: the marking of data with an identifier in order to limit their further processing permanently or for a limited period of time;
• data destruction: the complete physical destruction of a storage medium containing data;
• data processing: the performance of technical tasks related to data processing operations, irrespective of the method and means used to perform the operations and the place of application, provided that the technical task is performed on the data;
• processor: a natural or legal person or unincorporated body which carries out processing of data on the basis of a contract, including a contract concluded pursuant to a legal provision;
• data controller: the public sector body which produced the data of public interest which must be made public by electronic means or in the course of whose activities the data were generated;
• data communicator: the public sector body which, if the data controller does not publish the data himself, publishes on a website the data communicated to it by the data controller;
• data file: the set of data managed in a register;
• third party: a natural or legal person or an unincorporated body other than the data subject, the controller or the processor
.

.

3.

Personal data may only be processed for specified purposes, for the exercise of rights and the performance of obligations. At all stages of processing, the purpose of the processing must be fulfilled and the collection and processing of data must be fair and lawful.

Only personal data that is necessary for the purpose of the processing and is adequate for the purpose of the processing may be processed. Personal data may only be processed to the extent and for the duration necessary to achieve the purpose. Personal data may be processed if:

• with the consent of the data subject, or
• it is required by law or, on the basis of a statutory authorisation and within the scope specified therein, by a decree of a local authority for a purpose in the public interest (hereinafter referred to as “mandatory processing”)

Personal data may also be processed where obtaining the consent of the data subject would be impossible or would involve disproportionate costs and the processing of personal data

• is necessary for compliance with a legal obligation to which the controller is subject, or
• is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, and the pursuit of those interests is proportionate to the restriction of the right to the protection of personal data.

If the data subject is unable to give his or her consent because of incapacity or for other reasons beyond his or her control, the personal data of the data subject may be processed to the extent necessary to protect his or her vital interests or those of another person or to prevent or protect against an imminent danger to the life, limb or property of a person, while the impediment to consent persists.

The consent of the legal representative of a minor aged 16 or over is not required for the validity of the declaration of consent of the data subject.

If the personal data have been collected with the consent of the data subject, the controller shall, unless otherwise provided by law,

• for the purpose of complying with a legal obligation to which he is subject, or
• for the purposes of the legitimate interests pursued by the controller or by a third party, where such interests are proportionate to the restriction of the right to the protection of personal data, without further specific consent and even after the withdrawal of the data subject’s consent.

In case of doubt, the data subject shall be presumed not to have given his or her consent.

4. Processing relating to the controller’s main activity

Purpose of the processing:The processing of personal data is carried out when strictly necessary. The purpose of the processing is to send you price notifications or newsletters.

For the purpose of sending information or notifications, the purpose is to provide information or to send emails.

Legal basis for processing:voluntary consent of the data subject. Consent [Article 6(1)(a) GDPR]

Article 6(1)(a)(c) of the GDPR.

Compassion of data subjects: any natural person, including a natural person acting on behalf of a legal person – company, organisation, representative, who makes use of the notifications offered by the website to the Data Controller.

• Scope of data processed and purpose of use: For sending notifications and newsletters: name, e-mail address.
• Duration of processing: processing lasts until revocation, i.e. unsubscription.
• Persons entitled to access the data: all employees of the Data Controller may access the processed data in the course of the performance of the core business.

All employees of the company are entitled to access the data at any time.

All employees of the company are entitled to use the data controller’s services.

Data controller:

All employees of the controller may access the data.

Company name.

Location:1223 Budapest, Dallam u. 6

Adószám: 62630991-2-43

EV number: ev084306

E-mail: hello@test-runner.com

5. Complaints handling

If you have a complaint about our services, we encourage you to make your complaint by email.

• name;
• address or e-mail;
• the subject of the complaint and

Rights:

• Fulfillment of a legal obligation pursuant to Article 17/A of Act CLV of the year on Consumer Protection.

Duration of data processing:The Data Controller shall keep the data for the period specified in the relevant legislation (3 years).

for a period of time not exceeding the legal limitation period.

6.

The Data Controller shall ensure the security of the processing of personal data by the technical means at its disposal in the storage and retention of personal data in accordance with the applicable legal requirements, in such a way as to ensure the privacy of the data subjects.

The Data Controller shall take all measures to prevent unauthorised access to and unauthorised processing of personal data in any form.

In order to protect the electronically processed data files in the various registers, the Controller shall ensure, by appropriate technical means, that the data stored in the registers cannot be directly linked and attributed to the data subject, except where permitted by law.

7. How long will we keep your data?

Deletion rules vary depending on the purpose of the processing. Within our erasure policy, we have identified different types of data for which we have assigned erasure rules according to time periods.

We will also delete your personal data at your request if you notify us.

We will also continue to store your data where we are entitled to do so under Article 17(3) of the GDPR.

8.

We will never disclose your data to unauthorised third parties.

9. Data subjects’ rights and means of redress

.

During the period of data processing, the User has the right,

• to be informed, before and at any time during the use of the service provided on the basis of this Privacy Notice, of the types of data processed by the Service Provider for which purposes, including the processing of data that cannot be directly linked to the User,
• request the correction of his/her data,
• request the deletion or blocking
of your data, subject to legal exceptions

• object to the processing

The data subject may submit the request indicated above to the following contact details, and the Data Controller shall inform him/her in writing of the action taken to comply with the request no later than 25 days after the request is submitted.

• E-mail: hello@test-runner.com
• Address: 1223 Budapest, Dallam u. 6
.

Further rights of the User are detailed in Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information, §§ 14-19, 21-23.

In the event of a breach of the law or inappropriate handling of data, the User may bring proceedings against the Service Provider before the National Authority for Data Protection and Freedom of Information or may also bring proceedings before the court , which may be brought before the court of law of the place of residence or domicile. Before initiating proceedings, it is advisable to seek redress from the Data Controller.

Contact details of the NAIH:

Postal address: 1530 Budapest, PO Box 5.

+36 (1) 391-1400 Fax: +36 (1) 391-1410

E-mail: ugyfelszolgalat@naih.hu

URL: http://www.naih.hu

10. Handling and reporting of data breaches

A data protection incident is any event that results in the unlawful handling or processing of personal data, in particular unauthorised or accidental access, alteration, disclosure, deletion, loss or destruction, accidental destruction or accidental damage, of personal data processed, transmitted, stored or handled by the controller.

We are required to notify the National Authority for Data Protection and Freedom of Information (NAIH) of a data breach no later than 72 hours after we become aware of the data breach, unless we can demonstrate that the data breach is unlikely to pose a risk to the rights and freedoms of natural persons. If the notification cannot be made within 72 hours, it must state the reason for the delay and may provide the required information in detail without further undue delay.

We will inform data subjects of the data breach via our website within 72 hours of becoming aware of the data breach.

We keep records of data breaches for the purposes of monitoring the measures taken in relation to the data breach and informing data subjects. The register contains the following information:

• the scope of the personal data concerned;
• the scope and number of data subjects;
• the date of the personal data breach;
• circumstances and effects of the personal data breach;
• the measures taken to remedy the personal data breach.

The data contained in the register will be kept for 3 years from the date of detection of the personal data breach.

11. Data Protection Principles

The following principles apply to the processing of data by the Data Controller:

The principles set out in the GDPR are considered by our company as minimum requirements for data processing.

The principles set out in the GDPR are:

Principles of fairness, due process and transparency

The processing of personal data is carried out lawfully and fairly and in a transparent manner for the data subject. We ensure that natural persons are treated fairly in the processing of personal data relating to them.

We are transparent with natural persons about how we collect, use, access or otherwise process their personal data. The information and communication relating to the processing of personal data is easily accessible and understandable, and that it is presented in clear and plain language.

Principle of purpose limitation

Your personal data will be processed only for specific purposes, for the exercise of rights and the performance of obligations. At all stages of processing, the purpose of the processing is fulfilled and the collection and processing of data is fair and lawful.

Principle of data economy

The processing must be necessary and relevant.

The processing of personal data is only permitted if the processing cannot be carried out in any other way within reasonable limits. The personal data must be adequate and relevant for the purposes for which they are processed and the scope of the data must be limited to the minimum necessary for that purpose. Our Company complies with this requirement.

Principle of Accuracy

Personal data must be accurate and up-to-date, i.e. we will take all measures to ensure that personal data that are inaccurate for the purposes for which they are processed are promptly deleted or rectified.

Limited Retention Policy

Data will be stored only for the shortest possible period of time. In determining this period, we will take into account the context in which the data are processed and the legal obligation to keep the data for a specified period.

Integrity and confidentiality

Personal data must be processed in such a way as to ensure, through appropriate technical or organisational measures, the adequate

security, including protection against unauthorized or unlawful processing, accidental loss, destruction or damage to the data.

Principle of accountability

A fundamental principle that our Company respects. Our Company, as a controller, is responsible for compliance with the foregoing processing principles and is able to demonstrate compliance from the design of the processing until the end of the processing.

12.

Our data management principles comply with applicable national and European Union laws and regulations on data management and data protection, including but not limited to the following:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Regulation (EC) No 95/46/EC (General Data Protection Regulation, GDPR);
• Act CXII of 2006 on the right to informational self-determination and freedom of information (Infotv.)
• Act CVIII of 2007 – on certain aspects of electronic commerce services and information society services (Act on electronic commerce) (Eker. tv.)
• Act V of 2007 on the Civil Code (Civil Code)
• Act CLV of 2007 – on Consumer Protection (Consumer Protection Act)
• Act XLVIII of 2007 – on certain restrictions on commercial advertising activities (Act XLVIII of 2007)
• Act XIX of 2007 – on Criminal Procedure (Be.)
• Act C of 2007 – on Accounting (Accounting Act)
• Act C of 2002 – on Electronic Communications (Eht.)