Privacy and Data Management Notice

1. Purpose of the Policy

1.1 This Privacy and Data Management Notice (hereinafter referred to as "Notice") contains the most important data protection rules and principles concerning the records maintained by ViP Vita Portal Zrt. (hereinafter referred to as the "Service Provider"), with particular emphasis on the requirements related to data management, data processing, data transfer, data protection, and disclosure. The purpose of this Notice is to define the data protection and data management principles and rules applied by the Service Provider and the conditions and methods of data processing in accordance with the relevant Hungarian and EU legislation, in a manner that respects the interests of the data subjects.

1.2 The Service Provider operates the website airless-store.hu (hereinafter referred to as the "Website"), within which it manages the data of users (hereinafter referred to as "Users") of the Website.

1.3 This Notice has been developed in accordance with the provisions of Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (hereinafter referred to as "Info Act"), Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services (E-Commerce Act), Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities, and Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as "GDPR").

1.4 The Service Provider reserves the right to inform the User via email about modifications to the services provided or the general terms and conditions. The Service Provider will not use such information for advertising purposes.

2. Service Provider Information:

Company name: ViP Vita Portal Zrt.
Headquarters: 1095 Budapest, Soroksári út 44, 2nd floor
Company registration number: 03-10-141228
Tax number: 14685590-2-43
Representative's name, position, and contact: Zoltán Farkas, CEO, graco@vipvitaportal.hu

Server and website operator:
Company name: New Time Kft.
Headquarters: 6000 Kecskemét, Tavirózsa utca 13
Company registration number: 03-09114478
Tax number: 13919829-2-03

3. Data Management by the Service Provider

3.1 Registration

Customer registration required for product purchases.

Recorded data (in case of individuals):
- Date of birth
- Email
- Phone number
- Name
- Postal code
- City
- Address

Purpose of data management: identifying the customer on the website
Legal basis for data management: necessary for the performance of a contract
Duration of data management: can be terminated by the service provider and the user (data subject) through ordinary or extraordinary termination.
Data storage method: The Service Provider stores the User’s registered data on the server of New Time Kft.

3.2 Newsletter Subscription

Purpose of data management: providing information in the form of a newsletter
Scope of data managed: email address
Legal basis for data management: consent
Duration of data management: until the withdrawal of consent
Data storage method: The Service Provider stores the User’s registered data on its own server.

4. Data Management Related to Payment

User declaration:
“I acknowledge that ViP Vita Portal Zrt. (headquarters: 1095 Budapest, Soroksári út 44, 2nd floor) as the data controller will transfer my personal data stored in the user database of airless-store.hu to OTP Mobil Kft., as the data processor.
The scope of data transferred by the data controller includes the following:
- Transaction ID
- Bank account number
- Bank account holder
- Payment amount
- Payment date
- IP address
- Unique payment identifier
- Unique payer identifier

The nature and purpose of data processing by the data processor can be viewed in the SimplePay Privacy Policy at the following link: https://simplepay.hu/vasarlo-aff”

Contact information for OTP Mobil Kft., as the data processor:
OTP Mobil Szolgáltató Kft.
1138 Budapest, Váci út 135-139. Building B, 5th floor
Email: ugyfelszolgalat@simple.hu
Phone: (+36 1/20/30/70) 3 666 611

Scope of data management: data of Users placing a registration order on the Website or by other means (paper, email, phone, etc.)
Purpose of data management: to process and fulfill your order, and to provide you with the billing for the ordered service.

Refusal to provide data: providing the data is a prerequisite for entering into a contract regarding the order, and the data must be provided for the order to be processed. If you do not provide the data, we cannot process your order.

Method of data deletion: automatically after the specified period.

Legal basis for data management:
The data processing is necessary for the performance of the General Terms and Conditions/Orders regarding the use of the Website and the Services, or to take steps at your request prior to entering into the General Terms and Conditions/Order (General Data Protection Regulation Article 6 (1) b)).

Duration of data management:
5 years from the termination of the service.

5. Responsibility

The Service Provider does not verify the accuracy of the personal data registered by the User. The User is solely responsible for the accuracy of the registered data. The User is responsible for the accessibility and use of the data transmitted by the Service Provider to the registered email address.

6. Management of Registered Data

The data registered by the User may be accessed by the Service Provider and the person(s) performing data processing. The access rights to the data management process of the Service Provider are determined by the executive officer of the Service Provider. The access rights to the data processing process commissioned by the Service Provider are determined by the executive officer (managing director) of the appointed data processor. The Service Provider is entitled and obliged to forward data to third parties for purposes specified by law.

7. User Rights

7.1 The User is entitled to request information free of charge about their personal data being processed, the purpose of data management, its legal basis, duration, the name, address (headquarters), and activities related to data management and processing, as well as who and for what purpose may access the data, and the rights related to the data management and the legal remedies available. The User is entitled to request the correction, deletion, blocking, or restriction of processing of their data free of charge, and may object to the processing of their personal data in cases defined by law.

7.2 The Service Provider is obliged to examine the User's request as soon as possible, but no later than within 30 days of submission—within 15 days in the case of objection—and to make a decision regarding its validity, which shall be communicated to the applicant in writing. If the Service Provider does not fulfill the User's request, the decision shall state the factual and legal reasons for rejecting the request.

The User is entitled to assert their rights before a court under the Civil Code of 2013 and to submit a complaint to the National Authority for Data Protection and Freedom of Information (1125 Budapest, Szilágyi Erzsébet fasor 22/c.; [https://www.naih.hu/panaszuegyintezes-rendje.html](https://www.naih.hu/panaszuegyintezes-rendje.html)) as provided in the Info Act.

8. Additional Information

8.1 The Service Provider collects data about the activities of interested parties in a way that does not make the interested parties identifiable, and cannot be linked to the personal data provided by the User during registration or to data provided during the use of other websites or services.

8.2 The Service Provider is obliged to inform the User in advance and obtain their explicit consent if the Service Provider intends to use the User’s personal data for purposes other than those specified by the data processing purpose.

8.3 The Service Provider is obliged to ensure the security of data management and data processing, and to take all necessary technical measures to protect the recorded, stored, and processed data, and to prevent their unauthorized use, modification, or destruction.

8.4 The Service Provider maintains a record of its data management activities as required by law (record of data management activities).

8.5 A data breach is a security breach that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access to personal data that is processed. In the event of a data breach, the Service Provider is required to act in accordance with Articles 33 and 34 of the GDPR. The Service Provider keeps a record of data breaches, including the facts related to the data breach, its effects, and the measures taken to remedy it.

8.6 The Service Provider is entitled to unilaterally modify this Notice at any time. The Service Provider publishes the modification of the Notice on its website. The User is entitled to continue using the services of the website after accepting the modification of the Notice.

Effective: August 28, 2024.