Privacy Policy

PRIVACY POLICY

This privacy policy governs the processing of personal data carried out by HeyDONE Korlátolt Felelősségű Társaság as Data Controller.

The protection of your data is important to us! We respect the protection of the personal data and privacy of visitors to our website and of persons interested in our services; therefore, we collect and process only such information as is indispensable for the purposes set out in this policy.

The use of our website and of our services is entirely voluntary; accordingly, the processing of any personal data that may be required for this purpose is also voluntary, and such data are provided to us on the basis of consent. Where necessary, we will only thereafter also process them on the legal bases of the performance of a contract or compliance with a legal obligation.

This privacy policy governs the data processing of the following websites:

heydone.app

This privacy policy is available at the following page:

heydone.app/adatkezelesi-tajekoztato

Amendments to this policy shall enter into force upon their publication at the above address.

We reserve the right to amend this Policy at any time by unilateral decision. Accordingly, as Data Controllers, in the event of an amendment to this policy we are entitled (but not obliged) to inform data subjects of the amendment by means of a system message. Following any amendment, we will publish this policy on our websites in a publicly visible place. We recommend that you re-read this privacy policy from time to time in order to learn how we protect your personal data. If you are a data subject, you are entitled to exercise your rights relating to data processing in the manner set out in this policy and in the legislation in force from time to time.

The Data Controller and its contact details

heyDONE (1032 Budapest, Bécsi út 174. B. ép., Company registration number: 01-09-449774, Tax number: 29216589-2-41), as Data Controller, may be contacted in connection with the data protection rights referred to below at the following contact details:

Address: 1032 Budapest, Bécsi út 174. B. ép.

E-mail: [email protected]

Our data protection officer may be contacted at [email protected].

We will respond to your request without undue delay, and in any event within 1 month of receipt of the request, unless the legal conditions permit an extension of 2 months for the response. The Data Controller will inform you of any such extension, together with the reasons for the delay, within 1 month of receipt of the request.

If the Data Controller does not take action on your request, it will inform you without delay, and at the latest within one month of receipt of the request, of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

Our company's scope of activities

heyDONE is engaged, among other things, in information technology services and computer programming.

As Data Controller, we comply with the statutory requirements, process personal data exclusively on a legal basis laid down by law, and observe the principles relating to the processing of personal data. We have compiled these legal bases and principles, together with the definitions of certain terms, in our privacy policy so that you may also find information about them here.

Applicable legislation

In drafting the provisions of this privacy policy, we have taken into account the provisions of the following legislation:

Regulation (EU) 2016/679 of the European Parliament and of the Council ("General Data Protection Regulation" or "GDPR")

Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information ("Infotv.")

Act V of 2013 on the Civil Code ("Ptk.")

Act XLVIII of 2008 on the Basic Conditions and Certain Limitations of Commercial Advertising Activities ("Grtv.")

Act CVIII on Certain Issues of Electronic Commerce Services and Information Society Services

Act LXIII on the Protection of Personal Data and the Disclosure of Information of Public Interest

In compiling this policy, we have furthermore had regard to the recommendation of the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) on the data protection requirements of prior information.

Definitions

"personal data": any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

"processing": any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

"controller": the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

"processor": a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

"recipient": a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;

"third party": a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;

"consent of the data subject": any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

"personal data breach": a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

Principles relating to the processing of personal data

Personal data shall be

processed lawfully, fairly and in a transparent manner in relation to the data subject ("lawfulness, fairness and transparency");

collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes ("purpose limitation");

adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ("data minimisation");

accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay ("accuracy");

kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject ("storage limitation");

processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures ("integrity and confidentiality").

The Data Controller shall be responsible for, and be able to demonstrate compliance with, the above ("accountability").

Legal basis for processing

Processing of personal data shall be lawful only if and to the extent that at least one of the following applies:

the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

processing is necessary for compliance with a legal obligation to which the Data Controller is subject;

processing is necessary in order to protect the vital interests of the data subject or of another natural person;

processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller;

processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Processing activities

Customer relations and other processing

Should any question or problem arise in the course of using our services, you may contact us through the means indicated on the website (e-mail).

We erase incoming e-mails and messages and the data provided, including name and e-mail address and any other personal data provided voluntarily, no later than 2 years from the date on which the data were provided.

In the course of providing our service, processing activities not listed in this policy may occur. In such cases, at the time the data are collected we will provide information in writing – in exceptional cases orally – on how, for what purpose and on what basis we will process your data in the course of the given data collection, how long we will retain them and what rights you have in relation to the processing.

In the event of an exceptional request from an authority, or of a request from other bodies authorised by law, we are obliged to provide information, to disclose or transfer data, or to make documents available. In such cases, provided that the requesting party has specified the exact purpose and the scope of the data, we disclose personal data to the requesting party only to the extent and in the amount strictly necessary to achieve the purpose of the request.

Data serving technical purposes

Categories of data subjects: All data subjects using the website.

Categories of data processed: The dynamic IP address of the data subject's computer, depending on the settings of the customer's computer, the type of operating system and browser of the computer used by the data subject, and the data subject's activity in connection with the website.

Legal basis for data collection: voluntary consent. Reading the privacy policy before starting to use the website

Purpose of processing: The purpose of the data automatically recorded on the website (log files) is the compilation of statistics, the technical development of the IT system and the protection of users' rights.

We process the Data Subject's data exclusively by means of data processing performed with computer equipment.

The use of these data serves, on the one hand, technical purposes – e.g. the secure operation and subsequent audit of the servers – and, on the other hand, the Data Controller uses these data to compile site usage statistics and to analyse user needs in order to raise the standard of its services. The above data are not suitable for identifying data subjects, and the Data Controller does not link them with other personal data.

Categories of data processed: accuracy of the data provided

The Data Controller does not verify the personal data provided to it. The person providing the data is solely responsible for the accuracy of the data provided. By providing his or her e-mail address, each Data Subject also assumes responsibility for ensuring that only he or she uses the service from the e-mail address provided. In view of this assumption of responsibility, any and all liability in connection with logins made using a given e-mail address shall rest exclusively with the user who registered that e-mail address.

If, in order to use the service, the Data Subject has provided the data of a third party during registration, or has caused damage in any way during the use of the website, the Data Controller shall be entitled to claim damages from the Data Subject. In such a case, the Data Controller will provide all possible assistance to the competent authorities for the purpose of establishing the identity of the infringing person.

Data processors engaged by the Data Controller

Your personal data may be processed by our staff and by those data processors who have concluded a written data processing agreement with us as Data Controller. Your data may be processed by our staff, by our data processors and by their direct staff only to the extent necessary to achieve the purpose of the processing and for the period permitted by the legal basis.

Data processors do not take independent decisions; they are entitled to act solely in accordance with the contract concluded with us as Data Controller and the instructions received. As Data Controllers, we supervise the work of our data processors. Data processors are entitled to engage further data processors only with our consent.

Hosting and server provider

Activity performed by the data processor: Hosting services

Name and contact details of the data processor:

Name: RackForest Zrt.

Registered office: 1132 Budapest, Victor Hugo utca 11., Hungary – servers located in the EU (Hungary)

Website: https://rackforest.com

E-mail: [email protected]

Fact of processing and categories of data processed: All personal data provided by the data subject.

Categories of data subjects: All data subjects using the website.

Purpose of processing: Making the website available and ensuring its proper operation.

Duration of processing and deadline for erasure of the data: Processing lasts until the termination of the agreement between the Data Controller and the hosting provider, or until the data subject submits a request for erasure to the hosting provider.

Legal basis for data processing: the User's consent, Section 5(1) of the Infotv., Article 6(1)(a), and Section 13/A(3) of Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services.

Other data controllers

Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) – statistical services

Facebook Inc. (4 Grand Canal Square, Dublin Ireland) – statistical services

Use of cookies

We also use cookies to improve the quality of our services, to enhance the user experience and to display advertisements that are as relevant as possible and match your interests, by running behaviour-based marketing.

Categories of data processed: unique identification number, dates, times

Categories of data subjects: All data subjects visiting the website.

Purpose of processing: Identification of users and tracking of visitors.

Duration of processing: The period lasting until the end of the relevant visitor session.

Legal basis for processing: Section 5(1) of the Infotv., Article 6(1)(a), and Section 13/A(3) of Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services. The consent of the data subject is not required where the sole purpose of using the cookies is the transmission of a communication over an electronic communications network, or where the cookies are strictly necessary for the provider to provide an information society service explicitly requested by the subscriber or user.

Technical information on the use of cookies (what you can set and where, if you wish to disable their use):

The Data Controller's system automatically records the IP address of the user's computer, the start time of the visit and, in certain cases – depending on the computer's settings – the type of browser and operating system. The data thus recorded cannot be linked with other personal data. The data are processed solely for statistical purposes.

Cookies enable the website to recognise previous visitors. Cookies help optimise the website and tailor the website's services to users' habits. Cookies are furthermore suitable for

remembering settings, so that the user does not have to enter them again when moving to a new page,

remembering previously entered data, so that they do not have to be typed in again,

analysing the use of the website so that, as a result of improvements made using the information thus obtained, it operates as closely as possible to the user's expectations and the user can easily find the information sought, and

monitoring the effectiveness of our advertisements.

Where we display various content on the website by means of external web services, this may result in the storage of certain cookies that are not controlled by the Data Controller, and the Data Controller therefore has no influence over what data these websites or external domains collect. Information on these cookies is provided by the policies applicable to the given service.

As Data Controller, we use cookies to display advertisements to Users via Google and Facebook. The processing takes place without human intervention.

The user may configure his or her web browser to accept all cookies, to reject all cookies, or to notify the user when a cookie is sent to his or her device. The settings options are usually found in the browser's "Options" or "Settings" menu. By disabling the use of cookies, the User acknowledges that the website will not function fully without cookies.

The detailed information available in English on the www.aboutcookies.org website also provides assistance with the settings in the various browsers.

Use of Google AdWords conversion tracking

As Data Controller, we use the online advertising programme called "Google AdWords" and, within its framework, we use Google's conversion tracking service. Google conversion tracking is an analytics service of Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google").

When the User reaches a website via a Google advertisement, a cookie required for conversion tracking is placed on his or her computer. These cookies have a limited validity, do not contain any personal data, and therefore the User cannot be identified by them.

When the User browses certain pages of the website and the cookie has not yet expired, both Google and the Data Controller can see that the User has clicked on the advertisement.

Each Google AdWords customer receives a different cookie, so they cannot be tracked across the websites of AdWords customers.

The information obtained by means of the conversion tracking cookies serves the purpose of compiling conversion statistics for AdWords customers who have opted for conversion tracking. Customers thereby learn the number of users who clicked on their advertisement and were forwarded to a page bearing a conversion tracking tag. However, they do not obtain any information by which any user could be identified.

If you do not wish to participate in conversion tracking, you may refuse it by disabling the installation of cookies in your browser. You will then not be included in the conversion tracking statistics.

Further information and Google's privacy statement are available at the following page: de/policies/privacy/

In order to obtain independent traffic and other web analytics data for the website, the Data Controller uses the Google Analytics software; accordingly, with respect to these data, the Privacy Policy of GoogleInc. is available at https://google.com/intl/h_All/policies/privacy . The User of the Website acknowledges that by using the website he or she consents to the processing of his or her data by Google Inc.

Use of Google Analytics

This website uses Google Analytics, a web analytics service of Google Inc. ("Google"). Google Analytics uses so-called "cookies", text files that are saved on your computer and thereby facilitate the analysis of the use of the website visited by the User.

The information generated by the cookies in connection with the website used by the User is usually transferred to and stored on a Google server in the USA. By activating IP anonymisation on the website, Google will first truncate the User's IP address within the Member States of the European Union or in other states party to the Agreement on the European Economic Area.

Only in exceptional cases will the full IP address be transferred to a Google server in the USA and truncated there. On behalf of the operator of our website, Google will use this information to evaluate how the User has used the website, to compile reports on website activity for the website operator, and to provide further services relating to website and internet use.

Within the framework of Google Analytics, the IP address transmitted by the User's browser is not merged with other Google data. The User may prevent the storage of cookies by configuring his or her browser accordingly; however, please note that in this case not all functions of our website may be fully usable. You may furthermore prevent Google from collecting and processing the data generated by the cookies and relating to the User's use of the website (including the IP address) by downloading and installing the browser plug-in available at the following link. https://tools.google.com/dlpage/gaoptout?hl=hu

Social media sites

Categories of data processed: the name registered on social media sites such as Facebook, YouTube, Instagram, etc., and the user's public profile picture

Categories of data subjects: Persons who have registered on social media sites such as Facebook, YouTube, Instagram, etc. and have "liked" the page.

Purpose of data collection: Maintaining contact on social media sites, and displaying, sharing and promoting certain content elements, services and offers of the website on social media sites.

Legal basis for data collection: voluntary consent to the processing of personal data on the given social media site

Duration of processing and deadline for erasure of the data: The processing takes place on the social media sites; accordingly, the duration and manner of processing and the possibilities for erasing and modifying the data are governed by the rules of the given social media site.

Security of processing

We protect your data, in particular against unauthorised access, alteration, transfer, disclosure, erasure or destruction, as well as against accidental destruction and damage.

As Data Controller, together with the operators of the server, we ensure the security of the data by means of technical and organisational measures that provide a level of protection appropriate to the risks associated with the processing, including, inter alia, as appropriate:

the pseudonymisation and encryption of personal data;

the ability to ensure the ongoing confidentiality, integrity, availability and resilience of the systems and services used for processing personal data;

the ability to restore the availability of and access to personal data in a timely manner in the event of a physical or technical incident;

a process for regularly testing, assessing and evaluating the effectiveness of the technical and organisational measures for ensuring the security of the processing.

Rights of data subjects in relation to processing

As a Data Subject, you may request information on the processing of your personal data, and may request the rectification of your personal data or – with the exception of processing required by law – their erasure, via the link in the footer of the newsletters or at any of our contact details.

Upon your request, we provide information on the data we process about you, the purpose, legal basis and duration of the processing, the name and address (registered office) of the data processor and its activities in connection with the processing, and on who receives or has received the data and for what purpose.

We are obliged to provide the information in writing, in an intelligible form and free of charge, within the shortest possible time from the submission of the request, but no later than within 1 month.

We are furthermore obliged to rectify personal data that do not correspond to reality.

We erase personal data if their processing is unlawful, if the data subject so requests, if the data are incomplete or inaccurate – and this cannot be lawfully remedied – provided that erasure is not precluded by law, if the purpose of the processing has ceased, if the statutory period for storing the data has expired, or if erasure has been ordered by a court or by the data protection supervisory authority.

We notify the data subject of the rectification and erasure, as well as all those to whom the data were previously transferred for the purpose of processing. Notification is omitted if, having regard to the purpose of the processing, this does not prejudice the legitimate interest of the data subject.

The data subject may object to the processing of his or her personal data if the processing (transfer) of the personal data is necessary solely for the enforcement of a right or legitimate interest of the Data Controller, except where the processing is required by law; if the personal data are used or transferred for the purposes of direct marketing, public opinion polling or scientific research; or if the exercise of the right to object is otherwise permitted by law.

As Data Controllers – while simultaneously suspending the processing – we are obliged to examine the objection within the shortest possible time from the submission of the request, but no later than within 15 days, and to inform the applicant in writing of the outcome. If the objection is justified, we terminate the processing – including any further collection and transfer of data – and block the data, and we notify all those to whom the personal data concerned by the objection were previously transferred, and who are obliged to take measures to give effect to the right to object, of the objection and of the measures taken on the basis thereof.

Rights of data subjects

Right of access: You have the right to obtain from the Data Controller confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and the information listed in the Regulation.

Right to rectification: You have the right to obtain from the Data Controller without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Right to erasure: You have the right to obtain from the Data Controller the erasure of personal data concerning you without undue delay, and the Data Controller has the obligation to erase personal data concerning you without undue delay where certain conditions apply.

Right to be forgotten: Where the Data Controller has made the personal data public and is obliged to erase them, the Data Controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the data that you have requested the erasure of any links to, or copies or replications of, those personal data.

Right to restriction of processing: You have the right to obtain from the Data Controller restriction of processing where one of the following applies:

you contest the accuracy of the personal data, in which case the restriction applies for a period enabling the Data Controller to verify the accuracy of the personal data;

the processing is unlawful and you oppose the erasure of the data and request the restriction of their use instead;

the Data Controller no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims;

you have objected to processing; in this case the restriction applies pending the verification whether the legitimate grounds of the Data Controller override your legitimate grounds

Right to data portability: You have the right to receive the personal data concerning you, which you have provided to a controller, in a structured, commonly used and machine-readable format, and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided (…)

Right to object: You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you based on (…), including profiling based on those provisions.

Objection in the case of direct marketing: Where personal data are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where you object to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

Automated individual decision-making, including profiling: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

The preceding paragraph shall not apply if the decision:

is necessary for entering into, or performance of, a contract between you and the Data Controller;

is authorised by Union or Member State law to which the Data Controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or

is based on your explicit consent

Communication of a personal data breach to the data subject

When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the Data Controller shall communicate the personal data breach to the data subject without undue delay.

The communication to the data subject shall describe in clear and plain language the nature of the personal data breach and shall communicate the name and contact details of the data protection officer or other contact point where more information can be obtained; describe the likely consequences of the personal data breach; and describe the measures taken or proposed to be taken by the Data Controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

The communication to the data subject shall not be required if any of the following conditions are met:

the Data Controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption;

the Data Controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects is no longer likely to materialise;

it would involve disproportionate effort. In such a case, there shall instead be a public communication or similar measure whereby the data subjects are informed in an equally effective manner.

If the Data Controller has not already communicated the personal data breach to the data subject, the supervisory authority, having considered the likelihood of the personal data breach resulting in a high risk, may require it to do so.

Notification of a personal data breach to the supervisory authority

In the case of a personal data breach, the Data Controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the competent supervisory authority, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification is not made within 72 hours, it shall be accompanied by reasons for the delay.

Right to lodge a complaint

If you find that any of your rights have been infringed, please contact us; we will do everything in our power to investigate the matter and to compensate you for any inconvenience.

You may exercise your right to lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):

Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian National Authority for Data Protection and Freedom of Information)

1125 Budapest, Szilágyi Erzsébet fasor 22/C.

Postal address: 1530 Budapest, Postafiók: 5.

Telephone: +36 -1-391-1400

Fax: +36-1-391-1410

E-mail: [email protected]