Data protection

Please read this Notice carefully in order to understand how we process your personal data and to know your rights regarding data processing.

It is of paramount importance for our Company to respect the privacy of all persons to whom personal data is disclosed, and therefore in its data management activities we comply with the applicable legislation, in particular Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information(Information law), and Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), in accordance with the provisions of this Privacy Notice. The purpose of this Privacy Notice is to ensure that all natural persons whose personal data we process are adequately informed about our data management practices and their rights in relation to those practices.

1. THE DATA CONTROLLER'S DATA

Company name:          Coffee Cosmetics Limited Liability Company

Seat:      4271 Mikepércs, Bocskai utca 3/A

Staying in touch:in writing, by phone or e-mail

Website: www.beauteducafe.hu      ..................................................

Telephone:        +36 70 384 8961

E-mail:            support@beauteducafe.hu

2. DEFINITIONS OF TERMS

For the purposes of this Notice, the definitions of terms are those set out in Article 4 of the GDPR and Article 3 of the Information Law. Key terms for the purposes of this Notice:

"data protection": the set of principles, rules, procedures, instruments and methods of processing which ensure the lawful processing of personal data and the protection of the individuals concerned.

"concerned":any natural person who is identified or otherwise identifiable, directly or indirectly, on the basis of specified personal data. In particular, a person may be considered identifiable if he or she can be identified, directly or indirectly, by name, an identifier or one or more factors specific to his or her physical, physiological, mental, economic, cultural or social identity.

"personal data": any information relating to an identified or identifiable natural person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the natural person.

"data management": any operation or set of operations which is performed upon personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

 "data controller": the natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

 "data processor": a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller.

3. WHAT PERSONAL DATA DO WE PROCESS?

Our Company processes the following personal data in accordance with applicable law:

• the name, e-mail address, telephone number and billing address of the customer in the case of orders from the webshop

• the names and e-mail addresses of the contact persons who have submitted questions on the Company's website under Contact;

• in the case of other private contracting partners of the Company, the following data: name of the contracting partner, name at birth, mother's name, place and date of birth, address, registered office, tax identification number, tax number, entrepreneur's or self-employed farmer's ID number, telephone number, e-mail address, bank account number;

• the image of persons in the recordings made by cameras operated by the Company;

• employees' personal data in accordance with the Company's Privacy Policy;

• the applications and CVs of candidates applying for a job advertised by the Company.

Our company does not process any personal data on the social networking sites.

4. FOR WHAT PURPOSES AND ON WHAT LEGAL BASIS DO WE PROCESS THE ABOVE PERSONAL DATA?

Our Company processes the personal data under point 3 for the following purposes and on the following legal bases:

1. In the case of an order via the webshop, we process the data of the customer or the applicant for the purposes of concluding a contract, fulfilling the order or contract, maintaining contact and fulfilling the legal obligations of the Company under tax and accounting law. Legal basis: for the conclusion and performance of the contract and for the fulfilment of the legal obligations applicable to the Company /Article 6(1)(b) and (c) GDPR/;

1. We process the data of those who ask questions on the Company's website for the purpose of answering questions and maintaining contact. The legal basis is the voluntary consent of the data subject or the taking of steps at the request of the data subject prior to the conclusion of the contract /Article 6(1)(a) and (b) GDPR/;

1. In the case of contracts with other private contracting partners, the Company processes the personal data of natural persons contracted with it as customers or suppliers for the purposes of concluding the contract, maintaining contact, performance or termination of the contract, granting contractual benefits, fulfilling the Company's legal obligations under tax and accounting law and enforcing the Company's claims arising from the contract. The legal basis for the processing is the conclusion and performance of the contract, the fulfilment of the legal obligations applicable to the Company and the enforcement of the legitimate interests of the Company /Article 6(1)(b)(c) and (f) GDPR/;

1. Our Company processes the personal data of its employees for the purposes of entering into and performing contracts and fulfilling the Company's tax, accounting and payer obligations. Its legal basis is the conclusion and performance of contracts and the fulfilment of legal obligations to which the Company is subject/GDPR Article 6(1)(b) and (c).

The processing of data related to the fitness for work of employees is justified by the fulfilment of legal obligations under Decree 33/1998 (VI.24.) NM. Legal basis: Article 6(1)(f) and (c) of the GDPR.

1. Our Company processes the data of applicants for the advertised job for the purposes of filling the advertised position, evaluating the applications and concluding a contract with the successful applicant. The legal basis is the voluntary consent of the data subject /Article 6(1)(a) GDPR/.

The Company shall inform the person concerned without delay of the outcome of the evaluation of the applications. Personal data of unsuccessful applicants will be deleted by the Company immediately after the evaluation of the applications. The obligation of deletion shall also apply if the applicant changes his mind or withdraws his application during the application process.

1. In the case of images recorded by the cameras operated by the Company, the purpose of data processing is to protect human life, health and physical integrity, personal safety, the protection of property and trade secrets, and the detection, investigation, proof and prevention of related infringements. Legal basis for processing: the data subject's consent and the legitimate interest of the Company in the protection of its property and business secrets /Article 6(1)(a) and (f) GDPR/;

The Company shall inform the data subjects of the use of the camera surveillance system before they enter the field of vision of the cameras. By entering the area monitored by the camera, the data subject consents to the taking of the picture in addition to the information.

The Company maintains a Facebook page for marketing purposes, but no independent database or profile is created on it.

5. THE ENVISAGED DURATION OF THE PROCESSING

Retention period for data relating to the performance of contracts: 5 (five) years after the termination of the contract.

The storage period for invoices and the documents on which they are based is 9 (nine) years.

Retention period of the documents on which the employment relationship is based: 8(eight) years from the date of termination of the employment relationship.

Personal data of applicants will be deleted immediately after the application has been assessed, if the applicant is not accepted.

The recordings made by cameras operated by the Company will be deleted after 3 (three) working days at the latest.

6. WHO HAS ACCESS TO PERSONAL DATA

The personal data that we process is accessible to the management and employees of our Company in accordance with the provisions and principles of applicable law. To ensure the security of personal data, our employees are bound by confidentiality obligations.

In order to comply with its tax and accounting obligations under the law, our company employs an accountant to whom we disclose personal data necessary for the performance of his or her duties.

In the case of coffee orders, our Company uses a courier service for delivery, to which the name, telephone contact details and delivery address of the customer are forwarded for delivery.

7. YOU HAVE THE FOLLOWING RIGHTS IN RELATION TO THE PROCESSING OF YOUR PERSONAL DATA

A)      RIGHT TO INFORMATION AND RIGHT OF ACCESS

You have the right to receive feedback from our Company on whether your personal data are being processed and, if so, to receive information about the personal data concerned by the processing, the purposes of the processing, the recipients to whom your data are disclosed, the envisaged duration of the processing and your other rights in relation to the processing.

Upon your request, our Company will provide you with a copy of the personal data concerned by the processing. For additional copies, our Company will charge a copying fee of HUF 60 per page.

B)      RIGHT TO RECTIFICATION

If the information we hold about you is out of date or otherwise inaccurate, you can ask us to correct any inaccurate information. Taking into account the purpose of the processing, you have the right to request the completion of your inaccurate personal data.

C)      RIGHT TO ERASURE

Our Company will delete personal data relating to you if it is no longer necessary for the purposes for which it was processed; if the processing is unlawful; if you have withdrawn your consent to the processing and there is no other legal basis for the processing; if you object to the processing and there are no overriding legitimate grounds for the processing; and if required by a legal obligation to which our Company is subject.

D)      THE RIGHT TO RESTRICTION OF PROCESSING

You have the right to have your data processing restricted by our Company at your request if one of the following conditions is met:

H)      PROHIBIT THE USE OF YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES OR WITHDRAW YOUR CONSENT TO THE PROCESSING FOR MARKETING PURPOSES

You have the right to object to the use of your personal data for marketing purposes, and you may withdraw your consent to such processing at any time, without giving any reason, free of charge, in which case our Company will delete your personal data processed for this purpose from its records and will no longer send you newsletters and advertising.

I)        RIGHT TO DATA PORTABILITY

Where the processing is based on your consent or on a contract with you and the processing is automated, you have the right to receive the personal data you provide to us in a structured, commonly used, machine-readable format and the right to transfer this data to another controller.

J)       RIGHT TO PROTEST

You have the right to object to the processing of your personal data by our Company if the processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party or if the use or transfer of your personal data is for direct marketing, public opinion polling or scientific research purposes.

8. REMEDIES INFORMATION

If you have any questions or complaints about the processing of your personal data, please contact us at ............................Our Company will investigate your complaint and inform you of the results of its investigation and the action it has taken within thirty (30) days at the latest.

If you consider that the processing of your personal data infringes the applicable laws, you have the right to lodge a complaint with the data protection supervisory authority or to take legal action.

The data protection supervisory authority in Hungary is the National Authority for Data Protection and Freedom of Information (1125 Budapest, Szilágyi Erzsébet fasor 22/C) ugyfelszolgalat@naih.hu.

The Tribunal has jurisdiction to hear data protection cases. A lawsuit may also be brought before the court of the place of residence or domicile of the data subject, at the data subject's choice.