Privacy Notice

I. Introduction

Synergic Korlátolt Felelősségű Társaság (registered office: 6000 Kecskemét, Csillag u. 1-3., company registration number: 03-09-110501; tax number: 13013428-2-03; represented by: Horváth Tamás, Managing Director) (hereinafter: the Service Provider, the Controller) submits to the following notice.

Before processing begins, the data subject must be clearly and comprehensively informed of all facts relating to the processing of their data, in particular the purpose and legal basis of processing, the identity of those authorised to control and process the data, and the duration of processing.

The information must also cover the data subject's rights and remedies in relation to processing.

This privacy notice sets out the provisions governing the processing of personal data in connection with the operation of the online shop on the website (www.synergic.hu). The notice is available on our website at the following link: https://synergic.hu/adatvedelem

The purpose of the online shop is to supply products to the Service Provider's end-user customers (natural or legal persons and other organisations). Accordingly, in connection with its operation, the Service Provider primarily records data necessary for the performance of contracts. For customers who are not natural persons, it is also unavoidable that the Service Provider processes certain data of employees, authorised representatives or agents of its business partners; this Notice also applies to such processing. This Notice must be applied in conjunction with, and in accordance with, the Controller's General Terms and Conditions.

By using the website and by registering with the online shop, the User accepts the contents of this privacy notice.

The Controller may unilaterally amend this Notice at any time, subject to applicable legal requirements. Amendments to the Notice take effect upon publication at the above address.

II. Definitions

1. Data Subject: any identified natural person, or a natural person identifiable directly or indirectly on the basis of personal data, including natural persons designated as users by Users who are not natural persons (persons authorised to place orders and receive products, and commercial and goods handling contacts);
2. User: a Data Subject using the website (www.synergic.hu) and/or the online shop, including sole traders and sole proprietorships, or any other user who is not a natural person;
3. Personal data: any information relating to an identified or directly or indirectly identifiable natural person (the “Data Subject”);
4. Special categories of personal data: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic and biometric data used to uniquely identify natural persons, health data, and personal data concerning a natural person's sex life or sexual orientation;
5. Consent: a freely given, specific, informed and unambiguous indication of the Data Subject's wishes by which the Data Subject, by a statement or a clear affirmative action, signifies agreement to the processing of personal data relating to them;
6. Controller: Synergic Korlátolt Felelősségű Társaság (registered office: 6000 Kecskemét, Füst Milán utca 1/D., company registration number: 03-09-110501; tax number: 13013428-2-03; represented by: Horváth Tamás, Managing Director);
7. Processing: any operation or set of operations performed on personal data or sets of data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
8. Restriction of processing: the marking of stored personal data with the aim of limiting their processing in the future;
9. Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller.
10. Third party: a natural or legal person, public authority, agency or other body other than the Data Subject, the Controller, the Processor and persons authorised to process personal data under the direct authority of the Controller or Processor;

The other terms used in this Notice correspond to those defined by applicable legislation, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Regulation 95/46/EC (General Data Protection Regulation, hereinafter: GDPR), and Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (hereinafter: Infotv.). The Controller conducts its processing activities in full compliance with the legal requirements in force at all times.

III. Principles

1. When processing the Data Subject's data, the Controller observes the following principles in full:

1. data must be processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);
2. data must be collected for specified, explicit and legitimate purposes and not processed in a manner incompatible with those purposes (“purpose limitation”);
3. data must be adequate, relevant and limited to what is necessary for the purposes of processing (“data minimisation”);
4. data must be accurate and, where necessary, kept up to date (“accuracy”);
5. data must be kept in a form permitting identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed (“storage limitation”);
6. data must be processed in a manner that ensures appropriate security of personal data, including protection against unauthorised or unlawful processing and accidental loss, destruction or damage, using appropriate technical or organisational measures (“integrity and confidentiality”).
7. the Controller is responsible for compliance with the above principles and must be able to demonstrate such compliance (“accountability”).

2. The Controller has established its procedures in accordance with the above, reviews them continuously and amends them as necessary. The Controller ensures data protection by design and by default in its processing activities.

3. The recipient of the service (User) must be able to prohibit processing both before and throughout their use of an information society service. The User may exercise this right as set out in Section IX.

IV. User responsibilities

1. If, during registration with or use of the online shop, the User provides the data of another natural person rather than their own, the User is solely responsible for ensuring that the data are provided with that person's consent and knowledge and after providing them with appropriate information. The Controller is not obliged to verify this. The Controller draws the User's attention to the fact that if the User fails to fulfil this obligation and the Data Subject consequently makes a claim against the Controller, the Controller may pass on the claim or the amount of the related damage to the User.

2. During processing, the accuracy and completeness of data and, where necessary for the purpose of processing, their currency must be ensured, as must the ability to identify the Data Subject only for as long as necessary for the purpose of processing. The User is responsible for ensuring that the data provided are accurate and kept up to date. The User must promptly record any changes to the data and amend them via the registration interface. The User may also request that the Controller amend the data using the Controller's contact details specified in Section IX.

3. The Controller does not process the data of minors. Nevertheless, the consent or subsequent approval of a legal representative is not required for the validity of a declaration of consent by a minor Data Subject who has reached the age of 16. Minors under 18 may not use the online shop and may not be registered with it. The User is responsible for ensuring compliance with this requirement.

V. Individual processing purposes and their conditions

The Controller processes personal data for the following purposes:

1. Conclusion and performance of a framework supply agreement for purchases through the online shop

The User registers with the online shop to conclude a framework supply agreement with the Controller. Under the framework supply agreement, the User is entitled to purchase through the online shop, i.e. to place individual orders which constitute individual agreements concluded under the framework agreement pursuant to the online shop's General Terms and Conditions.

To enable the parties to perform the framework agreement and individual contracts, the Controller must process certain contact details of the User or of Data Subjects acting on the User's behalf (e.g. executive officers, employees authorised to place orders, employees or agents authorised to receive ordered goods, and contacts responsible for invoicing and financial matters).

Personal data processed for a natural person:
Email address, password (stored in a non-reversible form), contact's surname, contact's first name, mobile phone number, display of gross prices, billing address: postcode, town, street and house number, delivery address: postcode, town, street and house number, newsletter subscription: yes/no, registration date and time, details of products stored on the favourites list and the date and time they were added

Personal data processed for a sole trader, sole proprietorship or business company:
Email address, password (stored in a non-reversible form), contact's surname, contact's first name, mobile phone number, display of gross prices, billing address: postcode, town, street and house number, delivery address: postcode, town, street and house number, newsletter subscription: yes/no, company name, tax number, registration date and time, details of products stored on the favourites list and the date and time they were added

Within the principal purpose of performing the contract, the Controller processes personal data for the following sub-purposes:

• conclusion, amendment and termination of the framework agreement and/or individual contract: certain basic details of a User who is a natural person (e.g. a sole trader or sole proprietorship) are necessary to establish, amend or terminate the legal relationship (see above for the data concerned). During registration, which results in the conclusion of the framework agreement, the User must provide certain personal data (the data listed above relating to a User who is a natural person, the executive officer of a User who is not a natural person, and contacts);
• determination and payment of consideration (purchase price and other costs), and invoicing: the Controller processes data of Users who are natural persons and Users' financial contacts for invoicing, payment of the purchase price and other costs, and resolution of certain payment-related matters;
• dispatch/delivery of ordered products: the Controller delivers ordered products to the address specified by the User, or they may be collected from the Controller's premises. To enable the products to be handed over, the Controller requests the recipient's name and identity card number, which it checks on site. Where the Controller arranges delivery, it may provide the details of the contact designated to receive the product (name, telephone number) to the carrier's representative (see below for the list of appointed carriers).

The legal basis for processing is the conclusion, performance and termination of the contract, the User's consent given upon registration, and Section 13/A(3) of Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services (hereinafter: Elker tv.):

“For the purpose of providing the service, the service provider may process personal data that are technically essential for the provision of the service. All other conditions being equal, the service provider must select and in all cases operate the tools used to provide an information society service in such a way that personal data are processed only if strictly necessary for the provision of the service and the fulfilment of the other purposes specified in this Act, and even then only to the necessary extent and for the necessary duration.”

Duration of processing:

• accepted registration: the Controller processes the data for the shortest possible time necessary to achieve the purpose, but no longer than until the framework agreement ends (registration is deleted), unless legislation requires the data to be retained for longer (in which case processing continues until the mandatory retention period expires), or the Controller has another appropriate legal basis for retaining the data (in which case processing continues until the purpose associated with that other legal basis is achieved, for example, for the enforcement of claims based on legitimate interest). The Data Subject is notified of any change in the legal basis and/or purpose.
• rejected registration: if registration is rejected, the Controller deletes the data at the same time as the rejection.

Data transfers: under certain contracts or obligations, personal data may be transferred to a third party, for example for delivery, as described above. The Controller also safeguards the data transferred through appropriate guarantees and other measures (see also Section VII).

For contract performance, the Controller generally uses a subcontractor who is the Processor. The Processor owns the online shop software and provides operational support to the Controller for performance of the contract for the sale of goods. In this relationship, the Processor also acts as the Controller's Processor, as the personal data provided by the User are transferred in full to the Processor for performance of the contract. In particular, the Processor performs all logistics tasks, including order preparation, packaging and handover to the carrier, and also performs other support tasks (such as server services, IT support and support for sending newsletters).

In connection with delivery, data may also be transferred to the following processors in addition to the Processor:
GLS General Logistics Systems Hungary Csomag-Logisztikai Kft.
Address: 2351 Alsónémedi, Európa u. 2.

2. Sending direct marketing messages and newsletters

Legal basis for processing: Users and Data Subjects may subscribe to newsletters and other direct marketing activities via the registration interface they manage. By subscribing, the User and Data Subject consent to the Controller using the data provided upon registration (primarily the email address) for direct marketing and sending newsletters. The User and/or Data Subject may withdraw this consent at any time via the registration interface or by making a request to the Controller (see also Section IX), and may similarly object to the processing of their data for these purposes.

Duration of processing: for the above purpose, the Controller processes the data until consent is withdrawn, but no longer than until registration ends or the Data Subject is removed from the registered persons.

Data transfers: when processing data for direct marketing and newsletters, the Controller does not transfer personal data to third parties other than the Processor.

Consequences of withholding consent: if the Data Subject does not consent to processing for the purposes set out above, they will not be directly informed of promotions announced by the Controller, new product launches, etc. Product discounts and information on new products can otherwise be found alongside individual products in the online shop, so the Data Subject does not lose access to discounts if they view the product directly in the online shop; they simply do not receive a summary.

Profiling and automated decision-making: no profiling or automated decision-making takes place in the operation of the online shop.

3. Enforcement of claims

If any claim arises against the User under the framework agreement and/or an individual contract, or the User wishes to make a claim against the Controller, the Controller may process the Data Subject's personal data for the purpose of enforcing that claim both during and after the termination of the framework agreement. By registering, the User expressly consents to this and ensures that the consent of the Data Subjects is also obtained.

Legal basis for processing: the legal basis for processing for this purpose is the User's consent as described above, intended to enable claims to be pursued lawfully, smoothly and in a time- and cost-effective manner.

Duration of processing: for the above purpose, the Controller processes the data for the shortest possible time necessary to achieve the purpose, but no longer than until the claims process is finally concluded or consent is withdrawn, unless legislation also requires the data to be retained thereafter, in which case the data are retained for the period specified by law.

Data transfers: the Controller may become entitled to transfer personal data to authorities and courts for the enforcement of claims. It may also become entitled to transfer certain personal data to obtain legal advice, refer a case to a debt collection agency, or for factoring or credit insurance. The Controller must limit data transfers to the minimum necessary. The Data Subject is informed of the transfer.

4. Use of the website

By using the website, visitors (registered and unregistered Users) accept the website usage policy available at www.synergic.hu and the provisions of this Privacy Notice.

The website may contain links to other websites. The Controller expressly states that it accepts no responsibility for the privacy and data processing procedures or policies of websites accessed by users through links to other websites. The Controller expressly draws users' attention to the fact that the provisions of this Privacy Policy do not extend to those websites.

For cookies used by the website, see Section IV.

VI. Data processing

The Controller uses the following cookies in operating the online shop:

1. Cookies commonly used by online shops

Cookies commonly used by online shops include “password-protected session cookies”, “shopping basket cookies” and “security cookies”, for which prior consent from data subjects is not required.

Purpose of processing: identifying users and tracking visitors.

Legal basis for processing: consent from the Data Subject/User is not required if the sole purpose of using cookies is to transmit a communication over an electronic communications network or if they are strictly necessary for the Controller to provide an information society service expressly requested by the Data Subject or User.

Data processed: unique identifier, IP address, activity dates and times.

Duration of processing:

1. session cookies last until the visit to the website ends,
2. the vsuser cookie lasts for 1 month after activity,
3. the VS_AUTH cookie lasts until 31 December 2028,
4. the browserDownloaderNewerAgain_cookie lasts for 1 year after activity.

Data subjects can delete cookies in their browser's Tools/Settings menu, generally under the Privacy settings.

2. Google Analytics

The Controller measures online shop traffic using Google Analytics. Data are transferred when the service is used. The transferred data cannot be used to identify the data subject. Further information on Google's privacy principles is available here: https://policies.google.com/privacy

3. Web logging

The Controller also uses web logging when the online shop is used. The purpose of processing is to enable the User's web activity to be traced for the performance of the contract (to demonstrate that fulfilment corresponds to the order).

The legal basis for processing is performance of the contract.

Data stored in connection with web logging: event times, User's name, Data Subject's name, source URL, IP address, web browser type, URLs viewed, and times of arrival at and departure from the website.

In addition, use of online shop functions and the parameters of those functions are logged.

Duration of processing for web logging: 60 days

Web log data are not transferred.

VII. Access to data, disclosure to third parties and data storage

1. General provisions

The Controller ensures data protection by default and by design. To this end, the Controller applies appropriate technical and organisational measures to:

• precisely regulate access to data;
• grant access only to persons who need the data to perform their duties, and even then only to the minimum data necessary for those duties;
• carefully select its appointed processors and ensure data security through appropriate data processing agreements;
• ensure that processed data remain unchanged (data integrity), authentic and protected.

2. Data transfers, processing and access

The Controller endeavours not to disclose Data Subject data to third parties. However, disclosure cannot be avoided in certain cases. The Controller primarily discloses data to third parties in the following cases:

• disclosure to authorities: the Controller may have reporting obligations arising from legislation in connection with the conclusion, performance and termination of contracts. Other disclosures may also take place in response to an official request or on the basis of suspected criminal activity.
• Processor's access rights: the Processor, as owner of the online shop software and the Controller's general subcontractor, has full access to data recorded in the online shop. The purpose of access is to perform the contract on the Controller's behalf. The Processor fulfils assignments referred to it by the Controller through a subcontractor under its agreement with the Processor.
• disclosure to processors: as part of the delivery service, the Controller may provide the Data Subject's data to the designated carrier/subcontractors as participants in fulfilment.

In addition to the cases set out above, the Controller may also disclose data to third parties in accordance with the legal requirements in force at the time.

Potential controllers authorised to access the data: personal data may be processed by the Controller's and Processor's staff in strict compliance with the principles set out in this Notice.

3. Physical storage of data

Data processing and backup take place in Hungary on servers owned by the Controller. The carriers' privacy policies apply to data processing carried out by carriers as part of the delivery service.

During data transfers, the Controller ensures the security of personal data through contractual safeguards meeting the standards required by applicable law. The Controller bears full responsibility for the lawfulness of data transfers and the security of the data.

4. Retention period

The Controller stores Data Subject data for the periods specified above for each processing purpose, after which the data are destroyed. The legal requirements in force at the time also apply to retention periods; if legislation requires data to be retained beyond the periods stated above, the Controller may store the data for the period specified by law.

VIII. Data protection measures taken by the Controller

The Controller applies reasonable physical, technical and organisational security measures to protect Data Subject data, particularly against accidental, unauthorised or unlawful destruction, loss, alteration, disclosure, use, access or processing. The Controller promptly notifies the Data Subject of known unauthorised access to or use of personal data that presents a high risk to the Data Subject.

Where Data Subject data must be transferred, the Controller ensures appropriate protection of the transferred data, for example by encrypting the data set. The Controller bears full responsibility for the processing of Data Subject data by third parties.

The Controller also protects the Data Subject's data against destruction or loss through appropriate, regular backups.

During automated processing of personal data, the Controller takes additional measures to ensure

1. prevention of unauthorised data entry;
2. prevention of the use of automated data processing systems by unauthorised persons using data transmission equipment;
3. that it is possible to verify and establish the bodies to which personal data have been or may be transmitted using data transmission equipment;
4. that it is possible to verify and establish which personal data were entered into automated data processing systems, when and by whom;
5. that installed systems can be restored in the event of a malfunction; and
6. that errors arising during automated processing are reported.

IX. Rights of the Data Subject

The Data Subject has the following rights in relation to processing:

1. Right to transparent information: before and during processing, the Data Subject has the right to receive information about the data processed and the processing itself; this Policy forms part of that information;
2. Right of access to stored data: the Data Subject may request information about data stored about them and aspects of processing (in particular the existence, purpose and legal basis of processing, categories of data processed, disclosures to third parties, retention period, methods of exercising rights, remedies, data source, profiling, automated decision-making, safeguards, etc.);
3. Right to rectification: the Data Subject may request correction of inaccurate data;
4. Right to erasure (right to be forgotten): the Data Subject may request erasure if:
   • the data are no longer needed for the original purpose for which they were collected
   • the Data Subject withdraws consent to processing
   • the Data Subject objects to processing and there is no other reason or legal basis for processing
   • the processing is unlawful
   • a legal obligation requires erasure
   • the data were collected in connection with the offering of an information society service;
5. Right to object: the Data Subject may object to processing based on public interest or legitimate interests; in that case, the Controller may continue processing only if there are compelling legitimate grounds that override the Data Subject's interests or relate to the enforcement of legal claims. Processing for direct marketing may be objected to at any time, and the data may no longer be processed for that purpose following an objection;
6. Right to restriction of processing: restriction may be requested where data have been processed unlawfully and in other cases permitted by law;
7. Right to data portability: where processing is automated and based on consent or a contract, the Data Subject may request the data they provided in a structured, commonly used, machine-readable format and may transmit the data as they choose;
8. Right to withdraw consent: the Data Subject may withdraw consent at any time.

The Data Subject may exercise the above rights at any time. A request may be submitted by email to [email protected], via the form under the GDPR menu in the online shop, or in writing to the Controller's postal address at 6000 Kecskemét, Füst Milán utca 1/D. The Controller informs Data Subjects that it is not required to appoint a data protection officer under applicable law, but an appointed person responsible for data protection is available to Data Subjects at the above contact details.

The Controller may verify the Data Subject's identity before responding, to check whether the request comes from the person entitled to make it. The Controller considers requests received from the Data Subject's email address held by the Controller or through the registered online interface to originate from the Data Subject. For requests received in other forms, the Controller may authenticate the Data Subject by other means (e.g. by enquiring verbally at the telephone number provided about the validity of a written request, requesting written confirmation of a verbal request, or initiating another appropriate identification method).

The Controller examines incoming requests and handles or rejects them with reasons without undue delay and no later than one month, or, in exceptional cases, within a longer period permitted by law. The Controller informs the Data Subject of the outcome in writing. Requests are handled free of charge, except for unfounded or excessive requests, for which the Controller may charge a reasonable fee reflecting its administrative costs.

The Controller deletes incoming correspondence, together with the sender's name and email address and any other voluntarily provided personal data, no later than five years after the matter is resolved.

The Data Subject may at any time raise observations or complaints about processing with the Controller using the contact details above (by email to [email protected], by completing the form under the GDPR menu in the online shop, or by post to 6000 Kecskemét, Füst Milán utca 1/D.). The Data Subject may also initiate court proceedings concerning the processing complained of before the court for the Controller's registered office or the Data Subject's place of residence; such proceedings are exempt from court fees and are dealt with as a priority. In addition, the Data Subject may lodge a complaint with the National Authority for Data Protection and Freedom of Information.

Issued: Kecskemét, 2020.06.17.