Terms and conditions

Effective from 1 January 2024

Please read this document carefully before making a purchase on https://tickless.com/en/ (hereinafter the “Online Store”). By completing a purchase or placing an order, you accept the provisions of these General Terms and Conditions (hereinafter the “Terms and Conditions”).

Legal notice – Operator details

Name: ProtectOne Korlátolt Felelősségű Társaság

Registered office: H-1021 Budapest, Völgy u. 5/A.

Postal address: H-1021 Budapest, Völgy u. 5/A.

Registration authority: Company Registry Court of the Budapest-Capital Regional Court

Company registration number: 01-09-944010

Tax number: 22797933-2-41

Email: info@protectone.com

Website: https://tickless.com/

Hosting provider details:

Name: Websupport Magyarország Kft.

Registered office: 1119 Budapest, Fehérvári út 97-99.

Company registration number: Cg. 01-09-381419

Tax number: 125138205-2-43

Email: info@tarhelypark.hu

Website: https://tarhelypark.hu/

Introductory provisions

These Terms and Conditions set out the general terms governing the use of the Online Store operated by ProtectOne Korlátolt Felelősségű Társaság (registered office: H-1021 Budapest, Völgy u. 5/A.; company registration number: 01-09-944010, maintained by the Company Registry Court of the Budapest-Capital Regional Court; tax number: 22797933-2-41; email: info@protectone.com), as service provider (hereinafter the “Service Provider”).
A Customer may place an order in the Online Store operated by the Service Provider only after reading these Terms and Conditions and accepting their provisions as binding. By visiting the Online Store, the Customer accepts the provisions of these Terms and Conditions made available by the Service Provider and acknowledges that they are binding. Customer means a consumer.
The Service Provider sells its products through the Online Store in accordance with these Terms and Conditions. By visiting the Online Store and submitting a valid order, the Customer accepts these Terms and Conditions as binding.
These Terms and Conditions apply to every contract concluded between the Service Provider and the Customer through the Online Store. Unless otherwise provided, they also apply to all offers, deliveries and services of the Service Provider.
By submitting an order through the Online Store, the Customer expressly consents to the Service Provider using the email address provided during registration for the purpose of concluding the contract. The Customer’s order takes effect only if the Service Provider confirms it at the email address provided.
By reading and accepting these Terms and Conditions, the Customer acknowledges that different offers and promotions cannot be combined.
Please note in particular that the product keeps parasites away with 94% effectiveness. Accordingly, the Service Provider excludes liability if the product’s user (a dog or cat) contracts any disease as a result of a tick or flea bite; the resulting veterinary expenses cannot be charged to the Service Provider.

Subject of the contract and purchasing process

The subject of a contract concluded in the Online Store is the products offered there by the Service Provider. On making their first purchase, the Customer must provide the information required for the purchase: their full name (surname and given name), email address, shipping and billing addresses, and telephone number. Creating a registered user account is not required to make a purchase.
The Customer is responsible for entering accurate information, as the ordered product will be invoiced and delivered on the basis of the information provided. By placing an order, the Customer acknowledges that the Service Provider excludes liability for performance based on inaccurate information entered by the Customer.
The prices shown in the Online Store are gross prices and include the applicable VAT. The final purchase price of a product includes VAT, calculated at the rate prescribed by the laws in force on the date the invoice is issued. The displayed prices do not include shipping costs. The invoice for the purchase is sent electronically to the contact address provided by the Customer. The Service Provider reserves the right to change the price of products available for order in the Online Store; a change takes effect when it appears on the website. A change will not adversely affect the purchase price of a product already ordered and confirmed by the Service Provider.
The Service Provider retains title to the product until the purchase price has been paid. The product remains the property of the Service Provider until payment of the purchase price. Under the government decree on the detailed rules for contracts between consumers and businesses, a contract concluded through the Online Store qualifies as a distance contract.
Products in the Online Store are arranged in categories. By clicking on a product category, the Customer can select the desired product range and then individual products within it. Clicking on a product displays its photograph, item number, description and price.
After selecting a product, the Customer may click the “Add to Cart” button to place any number of products in the cart. This creates no obligation to purchase or pay, as placing a product in the cart does not constitute an offer.
While using the Online Store, the Customer can check the contents of the cart at any time by clicking the “View Cart” icon at the top of the website. Products can be removed from the cart and their quantities changed there.
If the Customer does not wish to select and add further products, they can continue the purchase by clicking the “Cart” button. The cart contents and the total price payable for the selected products will then appear. The Customer must then enter the required details, including the delivery method, payment method and contact information.
Once the Customer has checked that the cart contains the products they intend to order and that all information is correct, clicking the “Submit Order” button constitutes an express acknowledgement that they have made an offer and that, if the Service Provider confirms it in accordance with these Terms and Conditions, their declaration entails an obligation to pay.
The Customer may place an order at any time. The Service Provider will confirm the order by email no later than 3 working days after its submission.
The purchase price of ordered products may be paid online. Cash on delivery is also available exclusively for orders placed and delivered within Hungary. The surcharge for cash on delivery is HUF 490.
For online payment, the Customer may choose between Stripe and PayPal. During payment, the Customer is redirected to the payment page of the financial service provider. Payment therefore takes place directly on a page operated by that provider, in accordance with the rules and security requirements of international financial service providers and card companies, rather than on the Online Store’s website. The Service Provider has no access to, and cannot view, the details of the Customer’s PayPal virtual account, bank card or associated bank account, including account or card numbers and expiry dates.
The Customer acknowledges that the following personal data stored by the Service Provider in its customer database is transferred to the financial service provider acting as a data processor: email address, billing name, billing address and total order value. The nature and purpose of the processing performed by the data processor are described in the Stripe and PayPal privacy notices available at the following links: https://stripe.com/en-hu/privacy; https://www.paypal.com/myaccount/privacy/privacyhub.
To pay by bank card, the Customer needs the following information:
1. Card number (the number embossed or printed on the front of the card)
2. Expiry date (the date embossed or printed on the front of the card in MM/YY format)
3. Security code (the last three digits of the number on the signature panel on the back of the card)
The Customer may pay in the Online Store with the following card types:
1. VISA
2. MasterCard
3. Discover
4. JCB
5. American Express

Delivery methods

The delivery method available for both domestic and international orders is courier service. Detailed information on delivery charges is available at https://tickless.com/en/shipping-information/.
Shipments are delivered by GLS courier service or by post (MPL).
Delivery time is 5 working days from confirmation of the order for products in stock and 10 working days if a product is not in stock. The Customer must therefore provide an address where they can receive the product at the agreed time. The Service Provider’s customer service team will inform the Customer by email of the expected delivery time in every case.
If the delivery deadline cannot be met for any reason, the Service Provider will inform the Customer by email. The Customer may not make any claim for damages against the Service Provider arising from a delivery delay.
If the carrier cannot deliver the product for any reason—for example, because the address provided is incorrect or inaccurate, the Customer or recipient is absent at delivery, or the delivery charge is unpaid—or if the Customer does not or cannot accept the product, including where they cite even a minor defect, the carrier may return it to the Service Provider after leaving a notice. The Service Provider and the Customer will then agree on a new delivery date by email. The Customer will in every case bear the cost of redelivery where the first delivery failed for a reason attributable to the Customer or arising within the Customer’s sphere of responsibility.
On delivery, the Customer must inspect the package and its contents. If the Customer notices damage to the product, they must notify the carrier and have the carrier draw up a report recording the damage. If the Customer fails to do so, the Service Provider will not accept a subsequent complaint concerning damage to the product.

Special provisions applicable to consumers

Consumer’s right of withdrawal

The consumer has the right to withdraw from the purchase without conditions or giving reasons within 14 calendar days of receiving the ordered product. The consumer may notify the Service Provider of their intention to withdraw by email no later than the final day of that period.
The Service Provider will promptly acknowledge receipt of the consumer’s withdrawal notice by email.
The consumer may exercise the right of withdrawal:
1. in the case of a contract for the sale of a product,
2. in respect of the product, or
3. where several products are sold and delivered at different times, in respect of the last product delivered,

within the period calculated from the day on which the consumer, or a third party designated by the consumer other than the carrier, receives the product.

The above does not affect the consumer’s right to withdraw between the date the contract is concluded and the date the product is received. If the consumer made the offer to conclude the contract, the consumer has the right to withdraw that offer before the contract is concluded, thereby ending their obligation to remain bound by it.
In the event of withdrawal, the Service Provider must refund the purchase price paid for the product, including delivery and packaging costs, no later than 14 calendar days after the withdrawal and the return of the product. The Service Provider will make the refund using the same payment method the consumer used. With the consumer’s express consent, the Service Provider may use another payment method, provided the consumer incurs no additional charge as a result. The Service Provider is not liable for delays caused by an incorrect or inaccurate bank account number or postal address provided by the consumer. If the right of withdrawal is exercised, the consumer must arrange and pay for the return of the product. The Service Provider does not undertake to bear return shipping costs.
The consumer is responsible for any reduction in the product’s value resulting from use beyond what is necessary to establish its nature, characteristics and functioning, from damage, or from use contrary to its intended purpose. The Service Provider may deduct the reduction in value from the price to be refunded to the consumer and may set off an amount proportionate to that reduction against the refund for the product subject to withdrawal. The Service Provider will have the returned product inspected to assess its general condition, with particular attention to how long it has been used. The reduction in value will be determined on the basis of the nature and purchase price of the product and the extent of wear resulting from the use described above.
The Service Provider expressly draws the consumer’s attention to the fact that the right of withdrawal cannot be exercised in the cases specified in Section 29(1) of Government Decree 45/2014 (II.26.).

Consumer rights concerning statutory liability for defects and warranties:

Statutory liability for defects (kellékszavatosság):

If the Service Provider performs defectively, the consumer may assert a claim against the Service Provider under the rules of the Hungarian Civil Code governing statutory liability for defects.
At the consumer’s choice, they may request repair or replacement, unless the remedy chosen is impossible or would involve disproportionate additional costs for the business compared with another remedy. If the consumer has not requested, or could not request, repair or replacement, they may request a proportionate reduction in the price or, as a last resort, withdraw from the contract. The consumer may switch from one chosen remedy to another but must bear the cost of doing so unless the switch was justified or the Service Provider gave cause for it.
The consumer must notify the Service Provider of a defect without delay after discovering it. A defect reported within two months of discovery is deemed to have been reported without delay.
The consumer may assert statutory claims for defects that already existed when the product was delivered within a limitation period of 2 years from receipt. After the two-year limitation period, the consumer can no longer assert these rights.
Any part of the repair period during which the consumer cannot use the product as intended does not count towards the limitation period.
The limitation period for a statutory claim concerning a part of the product affected by replacement or repair starts again. This rule also applies if a new defect arises as a consequence of the repair.
The consumer may assert a statutory claim for defects against the Service Provider.

Product liability for defects (termékszavatosság):

If a product is defective, the Customer may choose to assert either a statutory claim against the seller for defects or a product liability claim.
Under a product liability claim, the consumer may request only the repair of the defective product or, if repair is not possible within a reasonable time without prejudice to the consumer’s interests, its replacement.
A product is defective if it does not meet the quality requirements in force when it was placed on the market or does not have the characteristics stated in the manufacturer’s description.
The consumer may assert a product liability claim within two years of the product being placed on the market by the manufacturer. Once that period has elapsed, the consumer loses this right. The consumer must notify the manufacturer of the defect without delay after discovering it. A defect reported within two months of discovery is deemed to have been reported without delay. The consumer is liable for damage resulting from a delay in notification. The consumer may assert a product liability claim against the product’s manufacturer or distributor.
The manufacturer (distributor) is exempt from its product liability obligations only if it can prove at least one of the following:
1. it did not manufacture or place the product on the market in the course of its business activities; or
2. the defect could not have been identified at the time the product was placed on the market according to the state of scientific and technical knowledge; or
3. the defect resulted from compliance with legislation or a mandatory official requirement.
The consumer may assert a statutory claim against the business and a product liability claim against the manufacturer for the same defect at the same time. If a product liability claim is successfully enforced, the consumer may subsequently assert a statutory claim relating to the replacement product or the repaired part of the product only against the manufacturer.
The Service Provider draws attention to the fact that product liability claims follow the rules set out in the Hungarian Civil Code. Accordingly, if the Consumer purchased the product from a reseller or distributor, the Consumer may withdraw from the contract and seek a refund of the purchase price from that reseller or distributor under a statutory claim for defects. In that case—that is, where the Consumer purchased the product from a reseller—the Consumer may contact the Service Provider only to assert a product liability claim, which does not entitle the Consumer to reclaim the purchase price from the Service Provider. The Consumer acknowledges understanding this information, which is fully consistent with the provisions of the Hungarian Civil Code.

Warranty (jótállás)

The warranty conditions prescribed by applicable law apply to products available in the Online Store. In the event of defective performance, the Service Provider is obliged to provide a warranty in accordance with Government Decree 151/2003 (IX.22.) on the mandatory warranty for certain durable consumer goods and the rules of the Hungarian Civil Code.
The warranty period is:

a) two years where the selling price is at least HUF 10,000 but does not exceed HUF 250,000;
b) three years where the selling price exceeds HUF 250,000.

For products with a value below HUF 10,000, the Service Provider provides a six-month warranty beginning on the day the product is handed over to the consumer.

The decree applies only to new products sold under consumer contracts concluded in Hungary.
The consumer may exercise warranty rights using the warranty certificate provided to them. An incorrectly issued warranty certificate, or failure to provide one, does not affect the validity of the warranty. If no warranty certificate has been provided, conclusion of the contract must be regarded as proven if the consumer presents proof of payment. Returning the opened packaging of the consumer product is not a condition for fulfilling a warranty claim. A defect is not covered by the warranty if its cause arose after the product was handed over to the consumer, including where the defect was caused by:
1. improper installation, unless the installation was performed by the Service Provider or its agent, or the improper installation resulted from an error in the user instructions;
2. damage to, or illegibility of, the serial number or unique identification labels;
3. use contrary to the product’s intended purpose or failure to follow the user instructions;
4. improper storage, improper handling or damage; or
5. elemental damage or a natural disaster.
In the event of a defect covered by the warranty, the consumer:
1. may, in the first instance, request repair or replacement at their choice, unless the chosen remedy is impossible or would impose disproportionate additional costs on the Service Provider compared with the other remedy, taking into account the product’s value in faultless condition, the seriousness of the breach of contract and the inconvenience caused to the consumer by fulfilling the warranty claim;
2. may request a proportionate reduction in the purchase price if the Service Provider has not undertaken repair or replacement, cannot fulfil that obligation within a reasonable time while safeguarding the consumer’s interests, or the consumer no longer has an interest in repair or replacement.
The consumer may assert a statutory claim for defects and a warranty claim, or a product liability claim and a warranty claim, simultaneously for the same defect. If the consumer has successfully enforced a claim arising from defective performance for a particular defect—for example, the business has replaced the product—they may not seek a further remedy for the same defect on another legal basis.

Complaint handling

The Service Provider aims to fulfil every order to an appropriate standard of quality and to the Customer’s complete satisfaction. If the consumer nevertheless has a complaint concerning the Service Provider’s performance, they may submit it by telephone using the number shown on the Service Provider’s website, by email or by post.
The Service Provider will examine a verbal complaint immediately and remedy it where necessary. If the consumer disagrees with how the complaint is handled, or the complaint cannot be examined immediately, the Service Provider must promptly draw up a record of the complaint and its position on it. Where a verbal complaint is made by telephone or another electronic communications service, a copy of the record must be sent to the consumer together with the substantive response no later than thirty days afterwards.
The Service Provider will give a substantive written response to a written complaint within 30 days in a verifiable manner and arrange for its delivery. If the Service Provider rejects the Consumer’s complaint, it must give reasons. The Service Provider will retain the complaint record and a copy of its response for 3 years and present them to supervisory authorities on request.
If a complaint is rejected, the consumer may initiate proceedings before an authority (the government office acts as the general consumer protection authority) or a conciliation board.

Contact details for the body acting as the general consumer protection authority are available at:

https://kormanyhivatalok.hu/elerhetosegek

Conciliation board contact details:

Baranya County Conciliation Board

Address: 7625 Pécs, Majorossy Imre u. 36.

Telephone: (72) 507-154; (20) 283-3422

Chair: Dr. Gőbölös Réka

Website: www.baranyabekeltetes.hu

Email: info@baranyabekeltetes.hu; kerelem@baranyabekeltetes.hu

Borsod-Abaúj-Zemplén County Conciliation Board

Address: 3525 Miskolc, Szentpáli u. 1.

Postal address: 3501 Miskolc, Pf. 376.

Telephone: (46) 501-090

Chair: Dr. Tulipán Péter

Website: www.bekeltetes.borsodmegye.hu

Email: bekeltetes@bokik.hu

Budapest Conciliation Board

Address: 1016 Budapest, Krisztina krt. 99.

Postal address: 1253 Budapest, Pf. 10.

Telephone: (1) 488-2131

Chair: Dr. Inzelt Éva Veronika

Website: www.bekeltet.bkik.hu

Email: bekelteto.testulet@bkik.hu

Csongrád-Csanád County Conciliation Board

Address: 6721 Szeged, Párizsi krt. 8-12.

Telephone: (62) 554-250, extension 118

Chair: Dr. Horváth Péter Károly

Website: www.bekeltetes-csongrad.hu

Email: bekelteto.testulet@csmkik.hu

Fejér County Conciliation Board

Address: 8000 Székesfehérvár, Hosszúséta tér 4-6.

Telephone: (22) 510-310

Chair: Dr. Csapó Csilla

Website: www.bekeltetesfejer.hu

Email: bekeltetes@fmkik.hu

Győr-Moson-Sopron County Conciliation Board

Address: 9021 Győr, Szent István út 10/A.

Telephone: (96) 520-217

Chair: Dr. Bagoly Beáta

Website: www.bekeltetesgyor.hu/hu; www.gymsmkik.hu/bekelteto

Email: bekeltetotestulet@gymskik.hu

7. Hajdú-Bihar County Conciliation Board

Address: 4025 Debrecen, Vörösmarty u. 13-15.

Telephone: (52) 500-710; (52) 500-745

Chair: Dr. Hajnal Zsolt

Website: www.hbmbekeltetes.hu

Email: bekelteto@hbkik.hu

Pest County Conciliation Board

Address: 1055 Budapest, Balassi Bálint utca 25., 4th floor, door 2.

Postal address: 1364 Budapest, Pf. 81.

Telephone: (1) 792-7881

Chair: Dr. Nadrai Géza

Website: www.panaszrendezes.hu; www.pestmegyeibekelteto.hu

Email: pmbekelteto@pmkik.hu

Miscellaneous provisions

A contract concluded through the Online Store does not qualify as a contract made in writing. The Service Provider does not file contracts; consequently, they cannot be accessed or viewed later. The Service Provider does not submit to the provisions of any code of conduct.
The https://tickless.com website and Online Store operated by the Service Provider function under Hungarian law. Accordingly, all transactions concluded in the Online Store are governed by the laws of Hungary in force at the relevant time.
Information provided on the website or in the Online Store’s price lists, descriptions, stock information, images, drawings and other documents concerning a product’s size, weight, price, colour and other characteristics is for information purposes only. The Service Provider reserves the right to make technical improvements to products or discontinue them.
Despite the greatest care, a technical error may result in incorrect information in a product description in the Online Store or in the display of an incorrect price, including one that differs significantly from the actual market price. The Service Provider accepts no liability for typographical errors or for any Customer claim for damages based on incorrect information or prices.
The Service Provider accepts no liability for errors made by the Customer when placing an order, for orders that cannot be fulfilled because of the quality or absence of internet service, or for orders that cannot be fulfilled because emails are lost for technical reasons at the email service provider. Neither party may be held liable for failure to fulfil contractual obligations where that failure results wholly or partly from force majeure.
The Service Provider may amend these Terms and Conditions unilaterally at any time by publishing the amendment on https://tickless.com/en/. Following their effective date, the amended provisions become effective in relation to the Customer upon the Customer’s first subsequent use of the website or Online Store and apply to orders placed after the amendment.
Technical information required to use the Online Store that is not included in these Terms and Conditions is provided in other information available at https://tickless.com/en/.
Content displayed on https://tickless.com/en/ and in the Online Store, including but not limited to products, descriptions, images and data, is protected by copyright.
The Online Store’s policy on the processing of personal data forms part of these Terms and Conditions and is available at https://tickless.com/en/data-protection/. The Online Store uses cookies; information about cookies is provided through the Online Store’s cookie management tool.
The invalidity of any provision of these Terms and Conditions does not affect the validity of the remaining provisions. The parties must replace an invalid provision with one that comes closest to fulfilling the purpose of the original provision.

What is the purpose of this Privacy Policy?

We have adopted this Privacy Notice to provide natural persons and representatives of legal entities who use our services (hereinafter: Users) with all material information in a concise, transparent, intelligible and easily accessible form, using clear and plain language, and to assist Users in exercising the rights described in Section 4. Our services are available at www.tickless.com.

Our obligation to provide information is based on Article 12 of Regulation (EU) 2016/679 of the European Parliament and of the Council, applicable from 25 May 2018 (hereinafter: the GDPR); Section 16 of Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (hereinafter: the Information Act); and Section 4 of Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services (the E-Commerce Act).

This Privacy Notice has been prepared with regard to the GDPR, the Information Act and other laws relevant to the individual processing activities. The laws are listed in Appendix 10.1, the main definitions are set out in Appendix 10.2, and the individual rights of data subjects are described in detail in Appendix 10.3.

In preparing and applying this Privacy Notice, we have taken account of the recommendation of the Hungarian National Authority for Data Protection and Freedom of Information on the data protection requirements for prior information, as well as Article 5 of the GDPR, particularly the principle of accountability in Article 5(2).

We also monitor European Union practice concerning the protection of personal data. Accordingly, we incorporate the content of the European Commission’s Article 29 Working Party Guidelines on Transparency into our data processing practices.

Details of the Data Controller

Name: ProtectOne Korlátolt Felelősségű Társaság

Registered office: 1021 Budapest, Völgy utca 5/a

Company registration number: 01-09-944010

Tax number: 22797933-2-41

Email address: info@tickless.com

Individual data processing activities

This section describes the material circumstances of each processing activity that the GDPR and other sector-specific laws require every data controller to disclose.

Data processing related to newsletters

Visitors to our Website may subscribe to our newsletter so that we can provide them with up-to-date information. The following information applies to this processing activity.

Personal data processed and purposes of processing

Personal data Purpose of processing Legal basis for processing

First name	Enables us to address the User personally in our newsletter	User’s consent (Article 6(1)(a) GDPR)
Email address	Provides the User’s electronic contact details to which we can send the newsletter	User’s consent (Article 6(1)(a) GDPR)

Legal basis for processing

The User’s consent (Article 6(1)(a) GDPR and Section 6(1) of Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities, hereinafter: the Advertising Act).

Duration of processing

We process the personal data provided until consent is withdrawn. The User may withdraw consent at any time by clicking the “Unsubscribe” button in a newsletter. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Method of processing

Electronically.

Contact and correspondence

Users may contact us through our Website for any purpose. We also process the personal data of our business partners’ contact persons in the course of our work. Details of the related processing are set out below.

Personal data processed and purposes of processing

Personal data Purpose of processing Legal basis for processing

Name	Identifying the User or our business partner’s contact person	User’s consent (Article 6(1)(a) GDPR); in the case of a business partner, legitimate interests (Article 6(1)(f) GDPR)
Email address	Contacting and corresponding with the User or our business partner’s contact person	User’s consent (Article 6(1)(a) GDPR); in the case of a business partner, legitimate interests (Article 6(1)(f) GDPR)
Telephone number	Contacting and corresponding with the User or our business partner’s contact person	User’s consent (Article 6(1)(a) GDPR); in the case of a business partner, legitimate interests (Article 6(1)(f) GDPR)

Legal basis for processing

The User’s consent to processing their personal data for the purposes set out in Section 3.2.1, given voluntarily through an affirmative action when making contact, such as calling us or sending an email (Article 6(1)(a) GDPR).

If we use a User’s data for a purpose other than that for which it was originally collected, we will inform the User and obtain their prior express consent, or give them an opportunity to prohibit that use (see Section 9.1).

We process the above personal data of our business partners’ contact persons on the basis of our and our business partners’ legitimate interests (Article 6(1)(f) GDPR). Both parties have a legitimate interest in effective business communication when using the Website and discussing partnership matters, and in being able to inform each other’s designated representative of any material circumstance affecting a contract between us. Processing does not infringe the contact person’s right to informational self-determination because facilitating communication between the parties and providing personal data for this purpose forms part of their employment or contractual duties. Our business partner’s contact person may object to this processing.

Duration of processing

We process personal data provided on the basis of consent until consent is withdrawn. The User may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

We process the personal data of our business partners’ contact persons for as long as necessary for communication and as permitted by the relevant laws: for five years from performance or termination of the contract under Act V of 2013, or for eight years from issuance of the invoice under Act C of 2000.

Method of processing

Electronically.

Data processing related to orders

Various products may be ordered through our Website. This section describes the related processing activities.

Personal data processed and purposes of processing

Personal data Purpose of processing Legal basis for processing

Name	Identifying the person ordering the product when fulfilling the order	Performance of a contract (Article 6(1)(b) GDPR); where the customer is a legal entity, legitimate interests (Article 6(1)(f) GDPR)
Residential address (postal code, city, street name and house number)	Sending the ordered product to the address provided	Performance of a contract (Article 6(1)(b) GDPR)
Telephone number	Contacting the customer and providing information about the order	Performance of a contract (Article 6(1)(b) GDPR); where the customer is a legal entity, legitimate interests (Article 6(1)(f) GDPR)
Email address	Contacting the customer and providing information about the order	Performance of a contract (Article 6(1)(b) GDPR); where the customer is a legal entity, legitimate interests (Article 6(1)(f) GDPR)

Legal basis for processing

Performance of a contract between the Data Controller and the User (Article 6(1)(b) GDPR).

Where the customer is a legal entity, the legal basis for processing the above personal data of its contact person is the legitimate interests of the Data Controller and the customer (Article 6(1)(f) GDPR). Both parties have a legitimate interest in effective business communication during the order process and in being able to inform each other’s designated representative of any material circumstance affecting their contract. Processing does not infringe the customer’s contact person’s right to informational self-determination because facilitating communication between the parties and providing personal data for that purpose forms part of their employment or contractual duties.

Duration of processing

For eight years after issuance of the accounting document relating to the contract (Section 169(1) of the Accounting Act, with regard to Section 166(6) of that Act).

Personal data that is not required to fulfil accounting obligations is retained for five years after fulfilment of the order for the purposes described above, with regard to Section 6:22(1) of Act V of 2013 on the Civil Code (the Civil Code).

Method of processing

Electronically.

Provision of personal data

Because we cannot fulfil orders without the personal data described in this section, providing it is a prerequisite for concluding a contract.

Data processing related to invoicing

After fulfilling an order, we issue an accounting document in accordance with Act C of 2000 on Accounting (hereinafter: the Accounting Act). Details of the related processing are set out below.

Personal data processed and purposes of processing

Personal data Purpose of processing Legal basis for processing

Name	Supporting the accounting record of fulfilment of the order as an economic transaction	Processing required by law: Article 6(1)(c) GDPR, Section 5(1)(b) of the Information Act and Section 166(1)–(3) of the Accounting Act
Residential address, or registered office in the case of a sole trader (postal code, city, street name and house number)	Supporting the accounting record of fulfilment of the order as an economic transaction	Processing required by law: Article 6(1)(c) GDPR, Section 5(1)(b) of the Information Act and Section 166(1)–(3) of the Accounting Act
Tax number of a sole trader	Supporting the accounting record of fulfilment of the order as an economic transaction	Processing required by law: Article 6(1)(c) GDPR, Section 5(1)(b) of the Information Act and Section 166(1)–(3) of the Accounting Act

Legal basis for processing

Processing required by law: Article 6(1)(c) GDPR, with regard to Section 5(1)(b) of the Information Act and Section 166(1)–(3) of the Accounting Act.

Duration of processing

For eight years after issuance of the accounting document (Section 169(1) of the Accounting Act, with regard to Section 166(6) of that Act).

Method of processing

Electronically.

We retain electronically issued documents in accordance with the rules on digital archiving, using a method that ensures all information in a document can be reproduced without delay, remains continuously readable and cannot subsequently be altered.

Provision of personal data

Because we cannot issue an accounting document without the personal data described in this section, its provision is required by law.

Data processing related to complaint handling

Users may contact us by email or telephone to ask questions or make complaints. Details of the related processing are set out below.

Personal data processed and purposes of processing

Personal data Purpose of processing Legal basis for processing

Name	Identifying the User	Processing required by law: Article 6(1)(c) and 6(2) GDPR, Section 5(1)(b) of the Information Act and Act CLV of 1997
Email address	Contacting and informing the User	Processing required by law: Article 6(1)(c) and 6(2) GDPR, Section 5(1)(b) of the Information Act and Act CLV of 1997
Telephone number	Contacting and informing the User	Processing required by law: Article 6(1)(c) and 6(2) GDPR, Section 5(1)(b) of the Information Act and Act CLV of 1997

Legal basis for processing

Processing required by law: Article 6(1)(c) and 6(2) GDPR, with regard to Section 5(1)(b) of the Information Act and Act CLV of 1997 on Consumer Protection (the Consumer Protection Act).

Duration of processing

For three years from receipt of the complaint, with regard to Section 17/A(7) of the Consumer Protection Act.

Method of processing

Electronically.

Data processing related to handling statutory defect and warranty claims

If a User asserts a statutory claim concerning defects in goods sold under the Civil Code, whether a claim against the seller or a product liability claim (hereinafter: a statutory defect claim), or a warranty claim to which they are entitled by law (hereinafter: a warranty claim), we are required to draw up a record under Decree 19/2014 (IV.29.) NGM on the procedural rules for handling statutory defect and warranty claims concerning goods sold under contracts between consumers and businesses (hereinafter: the “NGM Decree”). Details of the related processing are set out below.

Personal data processed and purposes of processing

Personal data Purpose of processing Legal basis for processing

Name	Identifying the User and drawing up a record	Processing required by law: Article 6(1)(c) and 6(2) GDPR, Section 5(1)(b) of the Information Act and Section 4(1) of the NGM Decree
Address	Identifying the User and drawing up a record	Processing required by law: Article 6(1)(c) and 6(2) GDPR, Section 5(1)(b) of the Information Act and Section 4(1) of the NGM Decree
Information concerning consent to data processing	Drawing up a record	Processing required by law: Article 6(1)(c) and 6(2) GDPR, Section 5(1)(b) of the Information Act and Section 4(1) of the NGM Decree

Legal basis for processing

Processing required by law: Article 6(1)(c) and 6(2) GDPR, with regard to Section 5(1)(b) of the Information Act and Section 4(1) of the NGM Decree.

Duration of processing

For three years from the date the record is drawn up, with regard to Section 4(1) and (6) of the NGM Decree.

Method of processing

Electronically.

What rights do Users have?

It is important to us that our processing meets the requirements of fairness, lawfulness and transparency. This section briefly introduces the rights of data subjects. They are explained in more detail in Appendix 3 to this Privacy Notice.

Users may request information about the processing of their personal data free of charge, access that data and receive a copy. In the cases specified by law, they may request rectification, erasure, blocking or restriction of processing, and may object to processing. Users may send information requests and the requests described in this section to the contact details in Section 2.

Right of access

A User may obtain confirmation from us as to whether we process their personal data. They may access that data and details of its processing and receive a copy of the personal data we process.

Right to rectification

At the User’s request, we will rectify inaccurate personal data concerning them without undue delay. The User may also request that incomplete personal data be completed, including by means of a supplementary statement.

Right to erasure

At the User’s request, we will erase personal data concerning them if we no longer need to process it, if they withdraw consent or object to processing, or if the processing is unlawful.

Right to be forgotten

At the User’s request, we will endeavour to notify every data controller who has obtained, or may have obtained, access to the User’s personal data made public of the User’s request for erasure.

Right to restriction of processing

At the User’s request, we will restrict processing if the accuracy of the personal data is contested, the processing is unlawful, the User objects to processing, or we no longer need the personal data provided.

Right to data portability

A User may receive the personal data concerning them that they have provided in a structured, commonly used and machine-readable format and may transmit that data to another data controller.

Right to object

A User may object at any time, on grounds relating to their particular situation, to processing of their personal data based on legitimate interests (see Sections 3.1, 3.2 and 3.3). In that case, we may no longer process the personal data unless we demonstrate compelling legitimate grounds that override the User’s interests, rights and freedoms, or grounds relating to the establishment, exercise or defence of legal claims. As a general rule, following an objection the personal data may no longer be processed for that purpose.

Responding to requests

We will examine a request as soon as possible after its submission, and no later than 30 days afterwards—or 15 days in the case of an objection—and decide whether it is justified. We will notify the applicant of our decision in writing. If we do not fulfil a User’s request, our decision will state the factual and legal reasons for its rejection.

Available remedies

The protection of personal data is important to us, and we respect Users’ right to informational self-determination. We therefore endeavour to respond properly and on time to every request. We ask Users to contact us with any complaint or question before pursuing a claim before an authority or court, so that we can resolve any concerns promptly.

If contacting us does not resolve the matter, the User may:

enforce their rights before a court under Act V of 2013 on the Civil Code. Proceedings may also be brought before the regional court with jurisdiction over the User’s place of residence or stay. A list of regional courts and their contact details is available at https://birosag.hu/torvenyszekek; and
lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information under the Information Act (address: 1055 Budapest, Falk Miksa utca 9-11.; postal address: 1363 Budapest, Pf. 9.; telephone: +36-1-391-1400; fax: +36-1-391-1410; email: ugyfelszolgalat@naih.hu; website: https://naih.hu/; hereinafter: NAIH).

Our procedure for requests to exercise rights

Notification of recipients

We notify every recipient to whom we have disclosed the User’s personal data of any rectification, erasure or restriction of processing, unless doing so proves impossible or involves disproportionate effort. At the User’s request, we will inform them of those recipients.

Form and timing of information

We provide information about measures taken in response to requests relating to Section 4 within one month of receiving the request, electronically unless the User requests otherwise. If necessary, this period may be extended by a further two months, taking into account the complexity and number of requests. We will notify the User of the extension and its reasons within one month of receiving the request.

Information may also be provided orally at the User’s request, provided they verify their identity by other means.

If we do not take action on a request, we will inform the User of the reasons within one month of receiving it and explain that they may lodge a complaint with NAIH and seek a judicial remedy (Section 4.9).

Verification

In exceptional cases, if we have reasonable doubts about the identity of the natural person making a request, we will ask for additional information needed to confirm their identity. This measure is necessary to support the confidentiality of processing under Article 5(1)(f) GDPR and to prevent unauthorised access to personal data.

Costs of information and measures

We provide information in response to requests relating to Section 4 and take the corresponding measures free of charge.

If a User’s request is manifestly unfounded or excessive, particularly because of its repetitive nature, we may charge a reasonable fee reflecting the administrative cost of providing the requested information or taking the requested action, or refuse to act on the request.

Possible recipients of personal data and data processors

In connection with operation of the Website

The hosting provider, acting as a data processor, may access personal data provided when the Website is used.

Name: Websupport Magyarország Kft.

Contact: info@tarhelypark.hu

In connection with newsletters

Newsletter software is used to send newsletters from the Website. Its operator acts as a data processor engaged by us. Its details are:

Name: The Rocket Science Group

Contact: https://mailchimp.com/

In connection with delivery of ordered products

We engage courier companies as data processors to deliver ordered products. Their details are:

6.3.1.

Name: GLS General Logistics Systems Hungary Csomag-Logisztikai Kft.

Contact: https://gls-group.com/HU/en/home/

6.3.2.

Name: Magyar Posta Zrt.

Contact: https://www.posta.hu/

In connection with payment for orders

The price of an order may be paid through a banking service provider’s interface. The data processors are:

Name: PayPal (Europe) S.à r.l. et Cie, S.C.A

Contact: www.paypal.com

Name: Stripe, Inc.

Contact: https://stripe.com/

In connection with invoicing

The data processor we engage for invoicing receives the personal data Users provide for that purpose. Its details are:

Name: KBOSS.hu Kft.

Contact: www.szamlazz.hu

Data security

Taking into account the state of the art and the cost of implementation; the nature, scope, context and purposes of processing; and the risks of varying likelihood and severity to the rights and freedoms of natural persons, we implement appropriate technical and organisational measures both when determining how data will be processed and during processing. These measures are intended to implement data protection principles effectively, such as data minimisation, and to integrate the safeguards needed to meet GDPR requirements and protect data subjects’ rights.

Organisational measures

We grant access to our IT systems through permissions assigned to identifiable individuals. Access is granted according to the principle of necessary and sufficient rights: each employee may use our IT systems and services only to the extent required for their duties, with the appropriate permissions and for the necessary period. Access to IT systems and services may be granted only to persons who are not subject to restrictions for security or other reasons, such as conflicts of interest, and who have the professional, business and information security knowledge needed to use them safely.

Technical measures

We make every effort to ensure that our IT equipment and software continue to meet technological standards generally accepted in the market.

In developing our systems, we provide for logging so that operations can be monitored and traced and incidents, such as unauthorised access, can be detected.

Our server is located on an isolated, dedicated server provided by our hosting provider and is protected and secured.

Taking account of the relevant NAIH recommendation, we use the HTTPS protocol on the Website, which provides a higher level of data security than the HTTP protocol.

Cookies

To ensure that our Website functions properly, we sometimes place small data files on the User’s device, as most modern websites do.

What is a cookie?

A cookie is a small text file that a website places on a User’s device, including a mobile phone. It allows the website to “remember” the User’s settings, such as language, font size and display preferences, so that they do not have to set them again each time they visit our Website.

The cookies used on the Website are listed below:

Cookie source Cookie name Cookie function Cookie expiry

WordPress	elementor	Used by the website’s WordPress theme. It allows the website owner to edit or publish content in real time.	Never
CookieYes	cookieyes-consent	Used by CookieYes to remember Users’ consent preferences on subsequent visits. It does not collect or store personal data about website visitors.	1 year
WooCommerce	woocommerce_items_in_cart	Records whether any items are in the WooCommerce cart.	Session
WooCommerce	woocommerce_cart_hash	Determines whether the contents or data of a cart have changed.	Session
WooCommerce	wp_woocommerce_session_	Creates a unique code for each customer so that WooCommerce can locate that customer’s cart data in the database.	2 days, 1 minute
Stripe	__stripe_mid	Used by Stripe to process payments.	1 year
Stripe	__stripe_sid	Used by Stripe to process payments.	1 hour
Mailchimp	mailchimp_landing_site	Records the first page visited by the User.	1 month
Polylang	pll_language	Remembers the User’s selected language on return visits and obtains language information if it is not otherwise available.	1 year
PixelYourSite	pys_session_limit	Set by the PixelYourSite plugin to manage analytics services.	1 hour
PixelYourSite	pys_start_session	Set by the PixelYourSite plugin to manage analytics services.	Session
	_ga	Used by Google Analytics to calculate visitor, session and campaign data and track website use for analytics reports. It stores information anonymously and assigns a randomly generated number to identify individual Users.	1 year, 1 month, 4 days
Google	_ga_	Set by Google Analytics to store and count page views.	1 year, 1 month, 4 days
Google	_gcl_au	Used by Google Tag Manager to assess the effectiveness of advertising on websites using its services.	3 months
Google	_gid	Used by Google Analytics to store information about how visitors use the website and produce an analytics report on website performance. The information collected may include the number of visitors, their sources and pages visited, in anonymised form.	1 day
Google	_gat_gtag_UA_*	Set by Google Analytics to store a unique User ID.	1 minute
Hotjar	_hjSessionUser_*	Assigns information from later visits to the same website to the same User ID, which is retained in a Hotjar User ID unique to that website.	1 year
Hotjar	_hjSession_	Assigns information from later visits to the same website to the same User ID, which is retained in a Hotjar User ID unique to that website.	1 hour
PixelYourSite	pys_first_visit	Set by the PixelYourSite plugin to manage analytics services.	7 days
PixelYourSite	pysTrafficSource	Set by the PixelYourSite plugin to manage analytics services.	7 days
PixelYourSite	pys_landing_page	Set by the PixelYourSite plugin to manage analytics services.	7 days
PixelYourSite	last_pysTrafficSource	Set by the PixelYourSite plugin to manage analytics services.	7 days
PixelYourSite	last_pys_landing_page	Set by the PixelYourSite plugin to manage analytics services.	7 days
Facebook	_fbp	Used by Facebook to display advertisements on Facebook or a digital platform carrying Facebook ads after a visit to the website.	7 days
doubleclick.net	test_cookie	Determines whether the User’s browser supports cookies.	15 minutes
YouTube	YSC	Tracks views of videos embedded from YouTube.	Session
YouTube	VISITOR_INFO1_LIVE	Measures bandwidth and determines whether the User receives the new or old player interface.	6 months
YouTube	VISITOR_PRIVACY_METADATA	Stores the User’s cookie consent status for the current domain.	6 months
YouTube	PREF	Stores User preferences, such as language, search-result format and other customisations for YouTube videos embedded on various websites.	8 months
Google	IDE	Stores information about how the User uses the website so that Google DoubleClick can display advertisements suited to the User’s profile.	1 year, 24 days
Not available	pbid	No description available.	6 months
Not available	cookies.js	No description available.	Session
Not available	m	No description available.	1 year, 1 month, 4 days, 1 minute

These cookies can be deleted or blocked, but the Website may then fail to function properly.

We do not use cookies to identify the User personally. They serve only the purposes described above.

How can cookies be managed?

Cookie files can be deleted (see www.AllAboutCookies.org) or blocked in most modern browsers. In that case, however, certain settings may need to be selected again whenever the Website is used, and some services may not function.

Detailed information on deleting and blocking cookies is available in English at www.AllAboutCookies.org and at the following browser-specific links:

Google Analytics

The Website uses Google Analytics, a web analytics service provided by Google Inc. (“Google”). Google Analytics uses “cookies”, which are text files saved on the User’s computer to help analyse how the User uses the Website.
Information generated by the cookies about the User’s use of the Website is generally transferred to and stored on a Google server in the United States. If IP anonymisation is activated on the Website, Google first truncates the User’s IP address within Member States of the European Union or other states that are party to the Agreement on the European Economic Area.
Only in exceptional cases is the full IP address transferred to a Google server in the United States and truncated there. Google uses this information on our behalf to evaluate the User’s use of the Website, prepare reports on Website activity for us and provide other services relating to Website and internet use.
Google does not combine the IP address transmitted by the User’s browser as part of Google Analytics with other Google data. The User may prevent cookies from being stored by changing the appropriate browser settings. Please note, however, that some Website functions may then be unavailable or limited. The User may also prevent Google from collecting and processing data generated by cookies concerning their use of the Website, including their IP address, by downloading and installing the browser plugin available at https://tools.google.com/dlpage/gaoptout?hl=en.

Facebook Pixel

Facebook Custom Audience is an internet analytics and advertising service provided by Facebook, Inc. (“Facebook”). It enables the Data Controller to obtain information about how visitors use the Website. Further information about Facebook Custom Audience and Facebook Pixel cookies is available at https://www.facebook.com/policies/cookies/.

The Facebook Pixel service requires cookies to be placed on Users’ devices. We use Facebook Pixel on the Website for both advertising and Website analytics. Facebook Pixels place cookies on devices used to browse the Website. Their purposes include creating appropriate advertising audiences, measuring conversions across devices, targeting and optimising advertisements for the appropriate audience, displaying personalised advertisements, and preparing reports and statistics about visits to the Website and application.

Users may manage Facebook’s related processing activities through their Facebook and Google accounts and may allow the collection of data through Facebook cookies on the Website. After logging into Facebook, Users may view these cookies in Facebook Ads Settings and set or change their cookie preferences there. On the Website, Users may give consent to cookies grouped by type.

Other provisions

Processing for a different purpose

If we intend to use data provided for a purpose other than the purpose for which it was originally collected, we will inform Users and obtain their prior express consent, or give them the opportunity to prohibit that use.

Record-keeping obligation

We maintain records of the processing activities for which we are responsible in accordance with Article 30 GDPR.

Personal data breaches

A personal data breach is a security breach leading to the accidental or unlawful destruction, loss or alteration of personal data processed, or to its unauthorised disclosure or access. In the event of a personal data breach, we must act in accordance with Articles 33 and 34 GDPR. We keep records of personal data breaches, including the relevant facts, their effects and the measures taken to remedy them.

Amendments

We may amend this Privacy Notice unilaterally at any time. If we amend it, we retain earlier versions and, where possible and appropriate, draw data subjects’ attention to the amended provisions.

Effective: September 2024

ProtectOne Kft.
Data Controller

Appendices

Appendix: Applicable laws

When preparing this Privacy Notice, the Data Controller took account of applicable laws and important international recommendations, particularly:

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR);
Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (Information Act);
Act V of 2013 on the Civil Code (Civil Code);
Act CXXX of 2016 on the Code of Civil Procedure;
Act C of 2000 on Accounting (Accounting Act);
Act CLV of 1997 on Consumer Protection (Consumer Protection Act);
Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services (E-Commerce Act).

Appendix: Terms relating to the processing of personal data

Data controller: the legal person that determines the purposes and means of processing personal data.
Processing: any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Data transfer: making data available to a specified third party.
Data erasure: making data unrecognisable in a manner that prevents their restoration.
Data marking: attaching an identifying mark to data in order to distinguish them.
Restriction of processing: marking stored personal data with the aim of limiting their processing in the future.
Data destruction: the complete physical destruction of a medium containing data.
Data processor: a legal person that processes personal data on behalf of a data controller.
Recipient: a natural or legal person, public authority, agency or other body to which personal data is disclosed, whether or not it is a third party.
Cookie: a small data packet (text file) sent by a web server and placed on a User’s computer for a specified time. Depending on its nature, the server may add to it during subsequent visits. If a browser sends back a previously stored cookie, the service provider handling that cookie may link the User’s current visit with earlier visits, but only in relation to the content of that cookie.
Data subject/User: an identified or identifiable natural person. An identifiable natural person is one who can be identified directly or indirectly, particularly by reference to an identifier such as a name, number, location data or online identifier, or to one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity.
Third party: a natural or legal person, public authority, agency or other body other than the data subject, data controller, data processor or persons authorised to process personal data under the direct authority of the controller or processor.
Consent of the data subject: any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they signify agreement to the processing of personal data concerning them, by a statement or clear affirmative action.
IP address: in networks using the TCP/IP protocol, servers have IP addresses, or identification numbers, enabling their identification on the network. Every computer connected to a network has an IP address through which it can be identified.
Personal data: any information relating to a data subject.
Objection: a statement by a data subject objecting to the processing of their personal data and requesting that processing cease or the processed data be erased.

Appendix: Data subjects’ rights

Access

A User may request access to their personal data processed by us through any of our contact channels. We will provide information about:

whether their personal data is being processed;
the purposes of processing;
the categories of personal data concerned;
the recipients or categories of recipients to whom the personal data has been or will be disclosed;
the planned period of storage;
their rights;
available remedies; and
the sources of the data.

The User may also request a copy of their personal data undergoing processing. In that case, we provide the personal data in a structured, commonly used and machine-readable format (PDF/XML), or as a printed paper copy. The copy is provided free of charge.

Rectification

A User may request, through our contact channels, that we rectify inaccurate personal data concerning them and complete incomplete data. If we do not have the information needed to correct or complete inaccurate information, we may ask the User to provide supplementary information and verify its accuracy. Until the data can be corrected or completed because the supplementary information is unavailable, we restrict processing of the personal data concerned and temporarily suspend operations on it other than storage.

Erasure

A User may request, through our contact channels, that we erase personal data concerning them if either of the following applies:

we no longer need the data; or
the User has concerns about the lawfulness of our processing of their data.

If, following a User’s request, we determine that we are obliged to erase personal data we process, we will cease processing it and destroy the personal data previously processed. An obligation to erase personal data may also arise following withdrawal of consent, exercise of the right to object or a legal obligation.

Restriction of processing

A User may request, through our contact channels, that we restrict processing of personal data concerning them if:

they have concerns about the lawfulness of processing and request restriction instead of erasure; or
we no longer need the data, but the User requires it for the establishment, exercise or defence of legal claims.

We automatically restrict processing if the User contests the accuracy of personal data or exercises the right to object. In that case, the restriction lasts for the period needed to verify the data’s accuracy or, following an objection, to determine whether the conditions for continuing processing are met.

While processing is restricted, the personal data concerned may be stored but otherwise processed only:

with the data subject’s consent;
for the establishment, exercise or defence of legal claims;
to protect the rights of another natural or legal person; or
for reasons of important public interest.

We will inform Users before lifting the restriction.

Data portability

A User may request, through our contact channels, that we provide the personal data concerning them that we process so they can use it further as they choose. They may also ask us to transmit it to another data controller they designate.

This right is limited to personal data the User provided to us that we process to perform their contract. Other data cannot be transferred under this right. We provide the personal data in a structured, commonly used and machine-readable format (PDF/XML), or as a printed paper copy.

Exercising this right does not automatically erase the personal data from our systems. The User may contact us again or continue communicating with us after the data has been transferred.

Objection

A User may object at any time, through our contact channels, to processing of their personal data for the purposes specified in Sections 3.1, 3.2 and 3.3 of this Privacy Notice. We will then assess whether processing is justified by compelling legitimate grounds that override the User’s interests, rights and freedoms, or grounds relating to the establishment, exercise or defence of legal claims. If such grounds exist, we will continue processing the personal data. Otherwise, we will cease processing it.