Privacy Policy

PRIVACY POLICY

ZEBRA PEN (UK) Limited Magyarországi Fióktelepe (Hungarian Branch Office)

 

 

TABLE OF CONTENTS

 

1.      Introduction

2.      Data controlling

2.1.   Direct enquiries

2.2.   Newsletter

2.3.   Contact form

2.4.   Sweepstakes

2.5.   Cookies

2.6.   Controlling the contact details of contractual partners

2.7.   Recruitment

2.8.   Controlling of employee data

3.      Data Processors

4.      Data security measures

5.      Rights of data subjects

5.1.   Right to access

5.2.   Right to rectification

5.3.   Right to erasure (the right to be forgotten)

5.4.   Right to restriction

5.5.   Right to data portability

5.6.   Right of objection

5.7.   Right of revocation

5.8.   Procedural provisions

6.      Alternatives to exercising rights

6.1.   The right to lodge a complaint with the supervisory authority

6.2.   The right to judicial remedy

7.      Data protection incidents and their circumstances, effects and the measurements taken to prevent them

 

1.           INTRODUCTION

 

1.1.       A ZEBRA PEN (UK) Limited Hungarian Branch Office (hereinafter: ZEBRA PEN) notifies You of the most important information related to the controlling of Personal Data of data subjects by issuing this privacy policy (hereinafter: Policy), in particular, of the purpose, legal basis of data controlling, storage period and scope of controlled data, further, the rights and remedies the data subjects are entitled to regarding the data controlling.

 

1.2.       This Policy applies to the online appearance of ZEBRA PEN under the domain name https://zebrapeneu.com/,to the website of ZEBRA PEN (hereinafter: Website), ZEBRA PEN’s marketing activities at events and ZEBRA PEN’s data controlling activities in the course of recruitment.

 

1.3.       ZEBRA PEN as the data controller, ensures that the Policy is available to the data subjects when their Personal Data are collected and that its content is disclosed to them. ZEBRA PEN reserves the right to unilaterally amend the Policy. ZEBRA PEN ensures that the relevant privacy policy in force is continuously available and viewable on the homepage of the Website.

 

1.4.       ZEBRA PEN shall control the Personal Data provided by the data subjects to ZEBRA PEN as confidential and shall take all security, technical and organizational measures reasonably expectable from it to ensure the security of the data.

 

By Personal Data we mean information, on the basis of which a natural person can undoubtedly be identified. The most important Personal Data are the so-called identification data, e.g., name, address, telephone number, e-mail address, online ID, however, also the image and the video footage are considered Personal Data (hereinafter: Personal Data).

 

1.5.       Employment Personal Data  means employment-related Personal Data relating to employment or any legal relationship for the performance of work, their establishment or termination, and Personal Data controlled in connection with, during or in relation to employment or any other legal relationship for the performance of work (hereinafter: Employment Personal Data).

 

1.6.       We kindly inform You that the Policy has been prepared in compliance with the following legislation, in particular:

 

–         REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter: GDPR);

–         Act No. CXII of 2011 on information self-determination and freedom of information (hereinafter: Data Protection Act);

–         Act No. V of 2013 on the Hungarian Civil Code (hereinafter: Civil Code); and

–         Act No. I of 2012 on the Hungarian Labour Code (hereinafter: Labour Code).

 

1.7.       The scope of the Policy does not extend to the services and data controlling of websites, service providers to which a link on the Website leads (e.g., Facebook, Youtube, LinkedIn, Profession.hu). These services are governed by the provisions of the privacy policy of the third party operating the service while ZEBRA PEN shall not be liable for such data controlling.

 

1.8.       The Policy does not apply to data controlling carried out after the conclusion of the individual contracts with contractual partners. While performing the contract, the provisions concerning each data controlling are regulated by the data controlling annex of the relevant contract.

 

1.9.       Data of ZEBRA PEN as controller:

 

Company name: A ZEBRA PEN (UK) Limited Hungarian Branch Office
Company’s abbreviated name: ZEBRA PEN
Registered office: H-1039 Budapest, Pünkösdfürdő utca 52.
Postal address: H-1039 Budapest, Pünkösdfürdő utca 52.
Company registration number: 01-17-001339
Registration authority: Metropolitan Court of Registration
Tax number: 28753773-2-41
Name of representative: Lázár Szilvia, branch director
E-mail: marketing@zebrapen-eu.hu
Phone: +36 1 630 9173
Website: https://zebrapeneu.com

 

2.           DATA CONTROLLING

 

2.1.       Direct enquiries

 

On the basis of the explicit voluntary consent of the interested data subject, ZEBRA PEN contacts these data subjects with advertising materials and promotional offers. The retail partners selling ZEBRA PEN products are listed on the Website’s store locator platform (hereinafter: Store Locator) upon explicit request. The data subject may give his/her (preliminary) consent through the following channels:

 

–        by filling and submitting the contact form placed on the Website;

–        by giving written consent to a ZEBRA PEN employee during events (e.g. exhibitions, conferences).

 

2.1.1.  Purpose of controlling

 

ZEBRA PEN controls Personal Data (name, contact details) of potential new customers and the contact persons of potential new contractual partners for the purpose of sending marketing enquiries (e.g. information and notification about personalized promotions, campaigns and sweepstakes).

 

Listing of retail stores on the Store Locator.

 

2.1.2.  Legal basis

 

Legal basis for data controlling is the preliminary consent of the recipient, granted by subscribing to the newsletter (Article 6 Section (1) Point a) of GDPR).

 

2.1.3.  Scope of data subjects

 

Persons duly completing and submitting the contact form or newsletter subscription form placed on the Website, as well as contact persons of retail stores listed on the Store Locator.

 

2.1.4.  Scope of controlled data

 

While sending direct enquiries, ZEBRA PEN controls the following Personal Data of the data subject:

–        full name

–        email address

–        telephone number.

 

2.1.5.  Storage period

 

The data subject may withdraw his/her consent granted for the data controlling for marketing purposes at any time by sending an email to marketing@zebrapen-eu.hu, in which case ZEBRA PEN shall delete the Personal Data of the data subject from its records.

 

2.2.       Newsletter

 

ZEBRA PEN sends newsletters to subscribers by using MailerLite’s newsletter sending interface operated by MailerLite Limited.

 

The data subject can give his/her (preliminary) consent through the following channels:

 

–        by filling in and submitting the newsletter subscription form placed on the Website;

–        by providing written consent to a ZEBRA PEN staff member during events (e.g. exhibitions, conferences).

 

2.2.1.  Purpose of controlling

 

ZEBRA PEN controls the Personal Data of the contact persons (name, contact details) of potential new contractual partners and potential new customers for the purpose of direct marketing activities (e.g. information about new product launches, events or price reductions of certain products).

 

2.2.2.  Legal basis

 

Legal basis for data controlling is the prior consent of the recipient, given by subscribing to the newsletter (Article 6 Section (1) Point a) of GDPR).

 

2.2.3.  Scope of data subjects

 

Persons subscribing voluntarily to the newsletter of ZEBRA PEN.

 

2.2.4.  Scope of controlled data

 

While sending the newsletter ZEBRA PEN controls the following Personal Data of the subscriber:

 

–       full name

–       email address

–       phone number

 

2.2.5.  Storage period

 

Should the recipient of the newsletter unsubscribe from the newsletter, ZEBRA PEN shall consider this to be a withdrawal of the recipient’s consent and shall not send further newsletters to the recipient and as from the unsubscription is detected, the recipient shall be deleted from the recipient list.

 

2.3.       Contact form

 

2.3.1.  Purpose of controlling

 

ZEBRA PEN controls the Personal Data (name, contact details) of the contact persons of potential new contractual partners for the purpose of direct marketing and stores them in its own CRM system for a specified period of time.

 

2.3.2.  Legal basis

 

Based on the expressed and voluntary consent of the concerned data subject, ZEBRA PEN contacts these data subjects with advertising materials and promotional offers (Article 6 Section (1) Point a) of GDPR).

 

2.3.3.  Scope of data subjects

 

The persons filling out and sending the contact form located on the Website and persons completing the consent form on paper at events.

 

2.3.4.  Scope of controlled data

 

During the completion of the contact form, ZEBRA PEN controls the following Personal Data of the persons filling out the contact form:

 

–       full name

–       email address

–       phone number

–       address

–       company name

 

2.3.5.  Storage period

 

The consent given during the submission of the contact form is sent by e-mail to the e-mail address order@zebrapen-eu.hu, to which the marketing staff member shall have access. If no agreement is reached between ZEBRA PEN and the company of the data subject on the basis of the requests, ZEBRA PEN shall store the data controlled in connection with the requests for 6 months, unless the data subject expressly requests further controlling of its data, after which ZEBRA PEN shall delete them immediately.

 

The data subject is entitled to withdraw its consent to data controlling for marketing purposes at any time by sending a statement to marketing@zebrapen-eu.hu, in which case ZEBRA PEN shall delete the data subject’s Personal Data from its records.

 

2.4.       Sweepstakes

 

ZEBRA PEN organizes sweepstakes as part of its marketing activities. ZEBRA PEN prepares the tailor-made  privacy policy (hereinafter: Sweepstakes Policy) on the participation and terms of each competition individually. Participants as defined in the Sweepstakes Policy may apply as described therein. Participants  provide Personal Data in connection with their entry and participation in the sweepstakes and, in the case of the winner, in connection with the receipt of the prizes. The controller of the Personal Data is ZEBRA PEN.

 

2.4.1.  Purpose of controlling

 

ZEBRA PEN controls the Personal Data of the participants in the sweepstakes for the purposes of participation in the sweepstakes, the drawing of the prizes, the coordination necessary for the receipt of the prizes in case of a win and to enable the delivery of the prizes.

 

2.4.2.  Legal basis

 

The legal basis for the controlling is the prior consent of the data subject (Article 1 Section (1) Point a) of the GDPR). Participants give their consent by registering (i.e. by implied conduct) as described in the Sweepstakes Policy.

 

2.4.3.  Scope of data subjects

 

Persons participating in the sweepstakes.

 

2.4.4.  Scope of controlled data

 

When sending the newsletter, ZEBRA PEN controls the following Personal Data of the subscriber:

–        full name

–        email address

–        address

–        phone number.

 

2.4.5.  Storage period

 

ZEBRA PEN controls the Personal Data of the data subject for the duration of the sweepstakes as set out in the Sweepstakes Policy.

 

The person participating in the sweepstakes may withdraw his/her consent to the controlling at any time by sending an email to marketing@zebrapen-eu.hu.

 

2.5.       Cookies

 

The Website uses cookies. The cookie is sent by the web server to the visitor’s browser and then is returned by the browser to the server.

 

Cookies are encrypted data sets, paths that are stored by the browser of the data subject visiting the Website and shall only be interpreted together with the given server. The user’s data itself is stored by the server, not by the cookie. The next time the data subject visits the Website, its browser will read the cookie and display the information or item on the Website that originally set the cookie. Cookies are usually stored by visiting or leaving the Website. Cookies cannot be used to identify the data subject and do not affect the performance of the data subject’s device.

 

For more information about cookie technology and how cookies work, visit e.g. www.allaboutcookies.org.

 

 

2.5.1.  Purpose of controlling

 

Cookies shall be used for the following purposes:

 

–       measurement of a website’s performance;

–       analysis of browsing.

 

2.5.2.  Legal basis

 

The data subject is entitled to determine the conditions for storing and accessing cookies by appropriately setting its internet browser. Most browsers generally accept cookies by default. However, the data subject may completely disable cookies or set its browser to send an alert when sending a cookie. In order to prevent the reception of cookies or to apply settings, the data subject shall change the browser settings. For information on disabling or enabling cookies the data subject shall visit its browser’s “Help” menu. For popular browsers, information on setting cookies can be found at the following links:

 

–       Internet Explorer: https://support.microsoft.com/hu-hu/help/17442/windows-internet-explorer-delete-manage-cookies;

–       Mozilla Firefox: https://support.mozilla.org/hu/questions/new/desktop/cookies;

–       Google Chrome: https://support.google.com/chrome/answer/95647?hl=hu;

–       Opera: http://help.opera.com/opera/Windows/2256/en/controlPages.html#manageCookies

–       Safari: https://support.apple.com/kb/PH5042

 

By clicking on the “Accept” button, the data subject gives its expressed consent to the storage of cookies on its device (Article 6 Section (1) Point a) of GDPR).

 

More information about the cookies used to visit the Website from a mobile device can be found on the following pages:

 

–       Android: https://developer.android.com/reference/android/webkit/CookieManager.html

–       Blackberry: https://docs.blackberry.com/en/smartphone_users/deliverables/3200 /Turn_off_cookies_in_the_browser_60_1072866_11.jsp

–       Opera: https://www.opera.com/help/tutorials/security/privacy/

–       SafariOS: https://support.apple.com/kb/PH5042

 

2.5.3.  Scope of data subjects

 

Persons visiting the Website only when giving their consent.

 

2.5.4.  Scope of controlled data

 

When using cookies, ZEBRA PEN controls the following Personal Data of the visitors:

 

–       IP address

–       location

–       time and date, duration and frequency of visiting https://zebrapeneu.com/ website

 

2.5.5.  Storage period

 

Depending on their type, these files shall be deleted at the end of the browsing session (temporary cookies) or after a longer period of time (permanent cookies).

 

2.6.   Controlling of the contact details of contractual partners

 

ZEBRA PEN maintains continuous contact with its customers throughout its activities. ZEBRA PEN uses external service providers (subcontractors and suppliers) to provide certain services in support of its activities (e.g. payroll, office rental, transport). It also controls data while dealing with these contractual partners.

The legal basis for the controlling is the legitimate interest of ZEBRA PEN as data controller [Article 6 Section (1) Point f) of the GDPR] for which ZEBRA PEN has carried out the balancing test, as set out below.

 

A.     Existence and lawfulness of legitimate interest

1.           Determination of legitimate interest

The purpose of the data controlling is to maintain contact with the contact persons (hereinafter: data subjects) indicated in the contract for the provision of services (including in particular sales) by ZEBRA PEN (hereinafter: contract) and thereby indirectly to perform the contract. It is in the legitimate interest of ZEBRA PEN to ensure unhindered contact with the contractual partner in order to effectively perform the tasks set out in the contract. In the contract, the parties undertake to send notifications relating to the contract to the contact persons indicated therein or, in some cases, to the person subsequently designated by the contractual partner. Such notification enables ZEBRA PEN to receive the customer’s request for a specific product or service and with the same notification ZEBRA PEN can involve the supplier in the project as well. It is in the legitimate and real interest of ZEBRA PEN to ensure that both ZEBRA PEN and the contractual partner can fulfil their contractual obligations. Considering the principle of contractual freedom established by Hungarian law and the generally accepted practice in the business world, the provision of contact details does not contradict any legal provisions and is considered lawful.

2.            Real, concrete and timely legitimate interest

ZEBRA PEN has an interest in maintaining contact with respect to the existing contracts and all future contracts (purchase orders), which is always timely in a manner required by the business course, and is therefore specific and limited in scope.   The existence of the legitimate interest can be established on the basis of points 1 and  2 above, and the question of necessity can therefore be examined.

B.     Necessity of data controlling

1.           The absolute necessity and adequacy of the data control to achieve the purpose

It is in the interest of ZEBRA PEN to carry out the professional tasks set out in the contract within an optimal timeframe and efficiently. The administrative tasks related to the performance of the contract (e.g. obtaining documents) can be carried out in the most efficient way possible by ZEBRA PEN directly contacting the responsible person employed by the customer, subcontractor or supplier and is competent to perform such tasks.

2.           Available alternatives

There are no available alternative solutions for ZEBRA PEN, other solutions not involving data controlling are not feasible as regards relationship management. The necessity of the legitimate interest can be established on the basis of points 1 and 2 above, and the question of proportionality can therefore be examined.

C.     Proportionality of data controlling

1.            Examining the nature of interests

The interest of the ZEBRA PEN is to maintain unhindered contact with the contractual partner in order to perform the contract. The data control affects the data subject’s right to informational self-determination, which may, however, be limited in accordance with the principles of necessity and proportionality.

2.            Type of data

Name, business telephone number and business e-mail address of the contact person (data subject). The Personal Data is provided by the contractual partner of ZEBRA PEN, who is also  a data controller itself. The data transferred do not contain any special data.

3.            The favourable/unfavourable effects of data controlling for data subjects The following rights of the data subject may be infringed, or the data controlling may have the following unfavourable effects on the data subject: the right to bear name; the identification of the natural person on the basis of other data.

·          The relationship between the data subject and ZEBRA PEN:

There is no legal relationship between the data subject and ZEBRA PEN, and there is a commercial contract (e.g. sales, agency, engagement, service) between the contractual partner and ZEBRA PEN.

·          The method of data controlling:

Data controlling takes place within the EEA Member States, on paper and electronically. The controlling is limited to the data strictly necessary for the purposes of the legitimate interest pursued, in accordance with the principles of data minimisation and purpose limitation. The data controlled is observed, recorded and stored solely for the purpose of ensuring the legitimate interest. In particular, the data controller does not compare the Personal Data of the data subject with other data, does not carry out profiling or disclose the data to the public. In this way, the effects of the controlling are as foreseeable and predictable as possible.

·          Reasonable expectations of the data subject

The data subject can reasonably expect, in the context of his/her job or duties, to provide his/her contact details in the course of the business relationship with the contractual partner (e.g. employment relationship, engagement), in particular under the contract concluded with ZEBRA PEN.

·          Informing the data subject about the data controlling

The contractual partner undertakes to inform the data subject controlling within the framework of the legal relationship between them of the controlling of the data subject’s data by ZEBRA PEN and of the possibility of such. ZEBRA PEN shall support the contracting partner in this provision of information by means of this Policy and by any other means necessary.

4.            Guarantees, safety measures

ZEBRA PEN incorporates the following safeguards and risk mitigation measures to its data controlling:

·          ZEBRA PEN limits the scope of the Personal Data controlled to the contact details necessary for day-to-day contact.

·          The Personal Data of the contact persons are stored in a printed form, as set out in the relevant contract, in key-locked offices and electronically in the Business Central system, and in Microsoft Office, accessible with a unique ID and password

·          Employees may only store the Personal Data of the contact persons in the office and on their company equipment and may only use it for relationship management purposes duringthe performance of their work duties.

·          Cosmo Consult Kft. as the data processor maintaining the Business Central software, together with ZEBRA PEN, applies appropriate data security measures (e.g. password protection, IT audits, testing, export-protection).

·          The Personal Data of the contact persons are used by ZEBRA PEN solely for the purpose of contacting them and thereby the performance of the contracts. The contact is made at a time and in a manner appropriate to the needs of the partner and the nature of the project, considering working time and therewith privacy as much as possible.

·          ZEBRA PEN controls the contact details during the existing legal relationship or, after the termination of the legal relationship, for the purpose of enforcing any legal claims (e.g. indemnity) until the statute of limitations (5 years). In case a payment is made on the basis of the contract, the documents relating thereto and containing the contact person’s Personal Data are considered accounting documents, which ZEBRA PEN shall keep for 8 years in accordance with the applicable accounting laws.

D.    Result

Based on the evaluation of the interests of ZEBRA PEN and the contact persons, while considering the above circumstances, ZEBRA PEN has concluded that the controlling of the Personal Data of the contact persons has a low impact on the privacy of the contact persons and that the safeguards listed above reduce the risk of Personal Data being collected and used in more extensive scope than necessary. ZEBRA PEN considers, on the basis of the above, that a legitimate interest can be established in relation to the contract with the contractual partner for the controlling of the data of the contact persons,  the interest of ZEBRA PEN prevails over the interests, fundamental rights and freedoms of the data subjects, and that the controlling is therefore allowed in order to ensure the legitimate interests of ZEBRA PEN.

 

2.7.   Recruitment

 

ZEBRA PEN collects Employment Personal Data from applicants as part of its recruitment activities.

 

2.7.1.  Purpose of controlling

 

ZEBRA PEN controls the Employment Personal Data for recruitment purposes, with the purpose of establishing an employment relationship with the applicants for the advertised job positions. In case of an unsuccessful recruitrement process, ZEBRA PEN shall control the applicant’s Employment Personal Data in each case solely with the applicant’s expressed consent for the purpose of filling in job positions advertised in the future.

 

2.7.2.  Legal basis

 

ZEBRA PEN carries out the data controlling for recruitment purposes after prior notification of the data subject, and upon the consent of the data subject granted directly to ZEBRA PEN through Profession.hu. The consent covers (i) the controlling of data relating to the concerned job advertisement and, as a separate option, (ii) in the event of an unsuccessful recruitment process, the storage and use of the Employment Personal Data and the resume for the purpose of filling job positions advertised in the future. (Article 6 Section (1) point a) of the GDPR).

 

2.7.3.  Scope of data subjects

 

The data controlling for recruitment purposes concerns the Personal Data of applicants for job positions advertised by ZEBRA PEN.

 

2.7.4.  Scope of controlled data

 

In the course of controlling data for recruitment purposes, ZEBRA PEN controls the following Employment Personal Data of the applicant and candidate:

–        full name

–        email address

–        phone number

–        permanent address

–        residential/temporary address

–        place and date of birth

–        signature

–        Personal Data provided in resume (previous jobs, education, hobbies, foreign languages spoken)

–        results of a competency test, if completed by the applicant

–        if successful in the recruitment procedure, also the Employment Personal Data (see in Employment Privacy Policy).

 

2.7.5.  Storage period

 

ZEBRA PEN will control the Employment Personal Data of the data subject in accordance with the above legal basis and for the recruitment purposes indicated above until the successful completion of the recruitment process, i.e. until the acceptance of the employment offer sent by ZEBRA PEN. If the recruitment process was not successful and ZEBRA PEN does not make an offer of employment to the applicant, ZEBRA PEN shall only continue to store the applicant’s Employment Personal Data on the basis of the applicant’s expressed consent and until the explicit withdrawal of the consent, however for a maximum period of 1 year.

 

2.8.   Controlling of employee data

 

In the course of its operations, ZEBRA PEN controls the Employment Personal Data of its employees for the purposes of the performance of employment contracts and on the basis of certain legitimate interests and, in certain cases, on the basis of the employee’s expressed consent.

Detailed information on the controlling of employees’ Employment Personal Data is provided in the Employment Privacy Policy, available to the employees electronically on ZEBRA PEN’s internal server at all times and made available to the employee (worker) upon the establishment of the employment relationship (other legal relationship for the performance of work).

 

3.           DATA PROCESSORS

 

A data processor is a natural or legal person who processes Personal Data on behalf of ZEBRA PEN as data controller.

 

ZEBRA PEN engages the following data processors for data processing:

 

Name	Registered office and further contact details	Description of the activity carried out	Scope of controlled data
Marketing Astro Kft.	https://www.marketingastro.com/ registered office: 2161 Csomád, Kossuth Lajos út 79.company registration number: 13-09-210700 tax number: 25149205-2-13 E-mail: hello@marketingastro.com   Phone: +36 30 370 3411	The host of ZEBRA PEN own website and marketing service provider. The information You provide is stored on a server operated by the hosting provider. The data can only be accessed by our employees and the employees operating the server, however, they shall all be responsible for the secure controlling of the data. The purpose of data controlling is to ensure the operation of the Website. The Personal Data provided by the data subject will be processed until the end of the operation of the Website or in accordance with the contractual agreement between the Website’s operator and the hosting provider. If necessary, the data subject may also request the deletion of its data by contacting the hosting provider. The legal basis for data controlling is the consent of the data subject and data data controlling based on law. The data center is located in Csomád, at the registered office of Marketing Astro.	storage and backup of Website data (including contact form submissions), personal data controlled by ZEBRA PEN in the course of marketing activities
Google (Google Analytics)	https://www.google.com/about/datacenters/	ZEBRA PEN measures the traffic of the Website by using Google Analytics. Data is transmitted during the use of the service. The data transmitted are not suitable for identifying the data subject. For more information about Google’s privacy principles, go to https://www.google.com/policies/privacy/ads/ .	cookie data
MailerLite Limited	https://www.mailerlite.com   Dublin 2, D02 P593, 71 Lower Baggot Street Ground Floor, Ireland	The MailerLite Limited is the data processor engaged by ZEBRA PEN and ZEBRA PEN ensures the security of Personal Data and data controlling in accordance with the GDPR through the review of the data protection regulations of the MailerLite Limited.	data provided by the user, based on consent, for sending newsletters or for direct marketing
Dialogue Creatives Kft.	https://dialoguecreatives.com/   –       registered office: 1036 Budapest, Lajos utca 48-66. E. ép. –       company registration number: 01-09-909776 –       tax number: 14567339-2-41 –       E-mail: hello@dialoguecreatives.com	advertising agency	cookie data, data relating to sweepstakes and direct enquiries
Cosmo Consult Kft.	https://www.cosmoconsult.hu/ –       registered office: 1118 Budapest, Rétköz utca 5. –       company registration number: 01-09-300717 –       tax number: 25997053-2-43 –       e-mail: contact.hu@cosmoconsult.com –       phone: +36 1 899 9000	ZEBRA PEN uses Microsoft licenses provided by Cosmo Consult on a subscription basis. In addition, Cosmo Consult provides ZEBRA PEN with the Business Central enterprise management software and its maintenance.	All Personal Data controlled by ZEBRA PEN.
Profession.hu	–       registered office: 1123 Budapest, Nagyenyed utca 8-14. 4. em. –       company registration number: 01-09-199015 –       tax number: 25087879-2-44 –       e-mail: ugyfelszolgalat@profession.hu –       phone: +36 (1) 244-2070	ZEBRA PEN carries out its recruitment activities through Profession.hu. Profession.hu processes data on the basis of the consent of the applicant.	Personal Data controlled during the selection process, and, in case of successful selection process, all Employment Personal Data controlled by ZEBRA PEN.
Microsoft Corporation	–       registered office: Redmond, Washington 98052 USA –       company registration number: 600-413-485 –       tax number: –       e-mail: mail.support.microsoft.com –       phone: 866-425-4709	ZEBRA PEN uses Microsoft IT services. Data is stored in Microsoft’s system, therefore inevitably, Employment Personal Data is transferred to Microsoft. Microsoft ensures the security of Personal Data in its Privacy Statement, which is part of the Microsoft Service Agreement. ZEBRA PEN fully accepts Microsoft’s Privacy Policy, whereby Microsoft guarantees the security of the data transferred.	All Personal Data controlled by ZEBRA PEN is stored on Microsoft’s system.

 

4.           DATA SECURITY MEASURES

 

ZEBRA PEN takes appropriate data security measures to protect the Personal Data provided by data subjects. Within this scope, its IT systems, which also contain Personal Data stored in electronic form, are protected by a multi-level password.

 

ZEBRA PEN uses in particular the following technical and organizational measures to protect the Personal Data of the data subjects from unauthorized access, accidental loss, destruction or damage:

–        full access to the data is exclusively granted to the management, ZEBRA PEN employees have access only to the data necessary for the job position they hold (access restriction, folder system, password protection);

–        printed material is stored in a key-locked cabinet and/or office, and data recorded on electronic devices are -protected by a password necessary for the use of the equipment;

–        partners (e.g. administrators, enterprise management software and internal system operators) warrant the security of Personal Data and the lawfulness of data collection under the agreements concluded with external services providers. ZEBRA PEN has verified that the data processors provide adequate guarantees to comply with the requirements of the GDPR and to implement appropriate technical and organizational measures to ensure the protection of the rights of data subjects, while selecting them.

 

ZEBRA PEN protects the security of Personal Data controlled in relation to the operation of Website with technical, organizational and physical measures, including secure servers and firewalls.

 

5.           RIGHTS OF DATA SUBJECTS

 

Data subjects shall have the right to request from ZEBRA PEN access to and rectification or erasure of Personal Data concerning them or restriction of data controlling and to object to data controlling as well as the right to data portability.

 

ZEBRA PEN specifies below the content of certain rights to be exercised by data subjects in accordance with data controlling and certain characteristics of exercising these rights.

 

5.1.       Right to access

The data subjects shall have the right to obtain confirmation from ZEBRA PEN as data controller as to whether or not Personal Data concerning them are being controlled. In case their Personal Data are being controlled, the data subjects shall have the right to access the Personal Data and the following information:

 

–       the purposes of the data controlling;

–       the categories of Personal Data of the data subject;

–       the recipients or categories of recipients to whom the Personal Data have been or will be disclosed, in particular recipients in third countries or international organizations;

–       the envisaged period for which the Personal Data will be stored;

–       the rights of data subject in relation to data controlling (in particular the right to rectification, erasure or restriction of data controlling and to object);

–       the right to lodge a complaint with the supervisory authority;

–       any available information as to the source of data;

–       the existence of automated decision-making, including profiling and at least meaningful information about the logic involved, as well as the significance and the envisaged consequences of such data controlling for the data subjects.

 

ZEBRA PEN as data controller shall provide a copy of the Personal Data undergoing data controlling. For any further copies requested by the data subjects, ZEBRA PEN may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided by ZEBRA PEN in electronic form. The right to access shall be exercised by using the contact details provided in Section 5.8.

 

5.2.       Right to rectification

The data subjects shall have the right to request the rectification of inaccurate Personal Data concerning them and ZEBRA PEN shall comply with such request without undue delay. Taking into account the purposes of the data controlling, the data subjects shall have the right to have incomplete Personal Data completed, including by means of providing a supplementary statement.

 

5.3.       Right to erasure (right to be forgotten)

The data subjects shall have the right to have ZEBRA PEN erase Personal Data concerning them without undue delay. ZEBRA PEN shall erase the Personal Data of data subjects without undue delay, if:

 

(i)               the purposes or the legal basis of data controlling ceased to exist;

(ii)             the data subject objects to the data controlling and there are no overriding legitimate grounds for the data controlling;

(iii)           the Personal Data have been unlawfully controlled; or

(iv)            the Personal Data have to be erased for compliance with a legal obligation in European Union or Member State law to which ZEBRA PEN as data controller is subject.

 

ZEBRA PEN shall refuse to erase the Personal Data of data subjects, if the data controlling is necessary for compliance with a legal obligation which requires data controlling by European Union or Member State law to which ZEBRA PEN is subject or for the submission, assertion or defense of legal claims.

 

5.4.       Right to restriction

The data subjects shall have the right to obtain from ZEBRA PEN restriction of controlling their Personal Data, if:

 

(i)               the accuracy of the Personal Data is contested (in this case the restriction shall apply for a period enabling the controller to verify the accuracy of the Personal Data); or

(ii)             the data controlling of ZEBRA PEN is unlawful and the data subject opposes the erasure of the Personal Data and requests the restriction of their use instead; or

(iii)           ZEBRA PEN no longer needs the Personal Data for the purposes of the data controlling, but they are required by the data subject for the submission, assertion or defense of legal claims; or

(iv)            the data subject has objected to data controlling.

 

Should data controlling be restricted, such Personal Data shall, with the exception of storage, only be controlled with the data subject’s consent or for the submission, assertion or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State.

 

5.5.       Right to data portability

The data subjects shall have the right to receive the Personal Data concerning them, which they have provided to ZEBRA PEN, in a structured, commonly used and machine-readable format and to transmit such data to another controller if the data controlling is based on consent or a contract and the data controlling is carried out by automated means.

In exercising the right to data portability, the data subjects shall have the right to have the Personal Data transmitted directly from one controller to another, if technically feasible.

 

5.6.       Right of objection

The data subjects shall additionally have the right to object at any time to controlling of Personal Data concerning them for direct marketing purposes, which includes profiling. In such cases the Personal Data shall no longer be controlled for such purposes.

 

In case the data subject objects, ZEBRA PEN shall no longer control the Personal Data unless ZEBRA PEN demonstrates compelling legitimate basis for the data controlling which override the interests, rights and freedoms of the data subject or for the submission, assertion or defense of legal claims.

 

5.7.       Right of revocation

The data subjects shall have the right to revoke their consent at any time. The consent of the data subjects shall be deemed as the legal basis for the data controlling in case of the data controlling purposes set forth in Section 2 of this Policy. The legal basis for the data controlling shall not affect the lawfulness of data controlling based on consent before its revocation, thus the prior data controlling of ZEBRA PEN based on consent is not rendered unlawful by the fact that the data subjects subsequently revoke their consent.

 

5.8.       Procedural provisions

The data subjects can notify ZEBRA PEN of their request to exercise any of their rights related to data controlling by the following contact details:

 

–       personally, at the registered office of ZEBRA PEN: H-1039 Budapest, Pünkösdfürdő utca 52.

–       in writing by mail: H-1039 Budapest, Pünkösdfürdő utca 52.

–       electronically: order@zebrapen-eu.hu / marketing@zebrapen-eu.hu

 

ZEBRA PEN shall provide the data subject with information on the evaluation of the request and the measures taken without undue delay, but within 1 (one) month of receipt of the request, at the latest. In case the data subject submits a large number of requests, or his/her request is particularly complex, ZEBRA PEN may extend the 1 (one) month period by 2 (two) additional months but shall inform the data subject on the justification and reasons of such extension within 1 (one) month of receipt of the request. The data subject is notified by ZEBRA PEN on its decision in writing or by electronic means, where the request was submitted by electronic means.

 

In case ZEBRA PEN does not take measures on the request of the data subject, ZEBRA PEN shall inform the data subject without delay but within 1 (one) month of receipt of the request at the latest of the reasons for not taking measures and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

 

The above information and measure shall be provided by ZEBRA PEN free of charge.

 

Should requests from a data subject be manifestly unfounded or excessive, in particular because of their repetitive character, ZEBRA PEN as data controller may either, considering the administrative costs of providing the information or notification or taking the measure requested:

 

(i)               charge a reasonable fee; or

(ii)             refuse to act on the request.

 

ZEBRA PEN is obliged to demonstrate the manifestly unfounded or excessive character of the request.

 

The detailed provisions of the rights of data subjects related to data controlling are specified in Chapter III „Rights of data subject” of GDPR and in Sections 14-21 of Data Protection Act.

 

6.           ALTERNATIVES TO EXERCISING RIGHTS

 

Within the scope of alternatives to exercising rights, the data subjects may initiate two procedures, which are described by ZEBRA PEN below:

 

6.1.        Right to lodge a complaint with a supervisory authority

The data subjects shall have the right to lodge a complaint with National Authority for Data Protection and Freedom of Information (hereinafter: NAIH) as supervisory authority, if the data subjects consider that the controlling of Personal Data concerning them infringes the provisions of GDPR.

 

The contact details of NAIH:

 

Registered office: H-1125 Budapest, Szilágyi Erzsébet fasor 22/c.
Postal address: 1530 Budapest, Pf. 5
Phone: +36 1 391 1400
Official electronic mail address: ugyfelszolgalat@naih.hu
The website of NAIH: https://naih.hu

 

6.2.        Right to judicial remedy

The data subjects shall additionally have the right to judicial remedy (i) against a legally binding decision of the supervisory authority concerning them, (ii) if the supervisory authority does not handle a complaint or (iii) does not inform the data subjects within 3 (three) months on the progress or outcome of the complaint lodged. The data subjects may, at their own discretion, bring the proceedings before the competent regional court where the data subjects have their residential address or place of stay.

 

7.           DATA PROTECTION INCIDENTS AND THEIR CIRCUMSTANCES, EFFECTS AND THE MEASUREMENTS TAKEN TO PREVENT THEM

 

The Personal Data breach shall mean a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise controlled.

 

In case of a Personal Data breach, ZEBRA PEN shall, without undue delay, and where feasible, not later than 72 hours after having become aware of it, notify the competent supervisory authority on the Personal Data breach, unless the Personal Data breach is unlikely to result in a risk to the rights and freedoms of the data subjects. To ensure this, ZEBRA PEN shall take all necessary measures.

 

ZEBRA PEN shall notify the data subjects on the Personal Data breach without undue delay if it is likely to result in a high risk. In such case ZEBRA PEN shall, in the notification addressed to the data subjects, describe in clear and plain language the nature of the Personal Data breach, the likely consequences of the Personal Data breach and the measures taken or proposed to be taken to remedy the Personal Data breach, including, if applicable, measures to mitigate its possible adverse effects.

 

 

__ June 2024