The protection of your personal data is of the utmost importance to us, and this Privacy Notice explains what personal data we process about you, for what purposes and on what legal basis. The Privacy Notice also sets out your rights.

1. Data of the Data Controller

Data Controller: Cropfood TÉSZ Zrt.
Registered office: 6625 Fábiánsebestyén, Arany János u. 20/3. Place of business: 2211 Vasad, István király u. 11. Company registration number: 32098981-2-06 Tax number: 143/179/21293 Company registration number: 32098981-2-06

2. General legislation on which the processing is based

  • Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR)
  • 2011. évi CXII. törvény az információs önrendelkezési jogról és az információszabadságról (Infotv.)
  • 2013. évi V. törvény a Polgári Törvénykönyvről (Ptk.)
  • 2007. évi CXXVII. törvény az általános forgalmi adóról (Áfatörvény)
  • 2000. évi C. törvény a számvitelről (Számviteli tv.)
  • 2001. évi CVIII. törvény az elektronikus kereskedelmi szolgáltatások, valamint az információs társadalommal összefüggő szolgáltatások egyes kérdéseiről (Eker tv.)
  • 1997. évi XLVII. törvény az egészségügyi és a hozzájuk kapcsolódó személyes adatok kezeléséről és védelméről (Eüaktv.)
  • Guideline on good pharmacovigilance practices (GVP) Module VI – Collection, management and submission of reports of suspected adverse reactions to medicinal products (Rev 2)

3. Concepts

Personal Data: any information relating to an identified or identifiable natural person (“Data Subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Such typical personal data include in particular: name, address, place and date of birth, mother’s name. Data processing: any operation or set of operations which is performed upon personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. Controller: the natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of the processing are determined by Union or Member State law, the Controller or the specific criteria for the designation of the Controller may also be determined by Union or Member State law. Processor: a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the Controller. Recipient: the natural or legal person, public authority, agency or any other body to whom or with which personal data are disclosed, whether or not a third party.

4. Principles

The Data Controller shall take into account the following principles in the processing of personal data, including:

  1. be carried out lawfully and fairly and in a transparent manner for the Data Subject (lawfulness, fairness and transparency)
  2. collected only for specified, explicit and legitimate purposes and not processed in a way incompatible with those purposes; further processing for archiving purposes in the public interest, scientific and historical research purposes or statistical purposes is not considered incompatible with the original purpose in accordance with Article 89(1) of the GDPR (purpose limitation)
  3. be adequate, relevant and limited to what is necessary for the purposes for which the data are processed (data minimisation)
  4. be accurate and, where necessary, kept up to date; all reasonable steps must be taken to ensure that personal data which are inaccurate for the purposes for which they are processed are erased or rectified without delay (accuracy)
  5. be kept in a form which permits identification of Data Subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be kept for longer periods only if the personal data will be processed for archiving purposes in the public interest, scientific and historical research purposes or statistical purposes in accordance with Article 89(1) of the GDPR, subject to the implementation of appropriate technical and organisational measures to safeguard the rights and freedoms of Data Subjects as provided for in this Regulation (limited storage)
  6. be processed in such a way as to ensure adequate security of personal data, including protection against unauthorised or unlawful processing, accidental loss, destruction or damage (integrity and confidentiality), by using appropriate technical or organisational measures
  7. the Data Controller is responsible for compliance with the above and must be able to demonstrate such compliance (accountability)

5. Data management activities

a) contacting us on the website (data provided on the Contact and Request a Quote pages)

Purpose of data processing Contacting, maintaining contact
Legal basis for processing Article 6(1)(b) GDPR: necessary for the performance of the contract or for taking steps at the request of the Data Subject prior to the conclusion of the contract
Categories of Affected Persons Interested
Scope of personal data Name, telephone number, email address, declaration of age 16
Data retention time Until the end of the 1st year after contact
Data transmission No transfer of data pursuant to Articles 44-49 of the GDPR
Addressees The Data Controller uses Data Processor(s):

  • Hosting provider: Oros-Com Kft. (headquarters: 5900 Orosháza, Nagyatádi út 45)

The Data Controller uses its own system for electronic mail.
Source of data The source of personal data is the interested party (data provided on the Contact Us and Request a Quote pages)
How to provide data, consequences The data must be provided. If you do not provide the personal data, the Data Controller will not be able to contact you.

b) contact by email

Purpose of data processing To contact you by email
Legal basis for processing Article 6(1)(b) GDPR: necessary for the performance of the contract or for taking steps at the request of the data subject prior to the conclusion of the contract
Categories of Affected Persons Interested
Scope of personal data Name, phone number, email address
Data retention time Until the end of the 1st year after contact
Data transmission No transfer of data pursuant to Articles 44-49 of the GDPR
Addressees The Data Controller does not use Data Processor(s) The Data Controller uses its own system for electronic mail.
Source of data The source of personal data is the interested party
How to provide data, consequences The data must be provided. If you do not provide the personal data, the Data Controller will not be able to contact you by email.

The Website uses cookies. A cookie is a file that is placed on your computer when you visit a website. A cookie is a packet of information that the server sends to the browser, and then each time you request a cookie, the browser sends it back to the server with the data content specified by the server. The purpose of this is to save the web settings of the website you are visiting, so that when you visit the same website again from the same device, the site will remember the parameters you have set. The cookie has many functions. Cookies are most often used to personalise advertisements, services and analyse website traffic. Under current legislation, a cookie can only be stored on your device if it is absolutely necessary, i.e. essential for the functioning of the website, and is called a “necessary cookie”. For all other types of cookies, your consent is required. You can view and set the cookies currently used on the website in a pop-up window when you access the website. Modern browsers allow you to change your cookie settings. Some browsers automatically accept cookies by default, but you can change this setting to prevent automatic acceptance in the future. If you change this setting, the browser will offer you the option to set cookies each time you change it. Given that the purpose of cookies is to support and facilitate the usability and processes of the website, it cannot be guaranteed that you will be able to use all the functions of the website to their full extent if you disable cookies. The website may then function differently than intended in the browser. For more detailed information on cookie settings for the browsers below:

7. Social media

The Data Controller is available on the following social networking site(s). The operator of the social networking site is considered as a separate Data Controller and information on the processing of data is available at the following links:

Community page: Name of data controller: Contact details of the Privacy Notice:
Youtube Google LLC (Headquarters: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) https://policies.google.com/technologies/product-privacy?hl=hu

The Data Controller does not record or process personal data about the user of the given social networking site in its internal database and system.

8. Access to data

Personal data may be accessed by the competent staff of the Data Controller to the extent necessary for the performance of their tasks.

9. Data security measures

The Data Controller shall take appropriate IT, technical and personnel measures to protect the personal data it processes against, inter alia, unauthorised access or unauthorised alteration.

10. Data Subjects’ rights in relation to data processing and their content

Data Subjects’ rights in relation to data processing The content of the Data Subject’s right to data processing
Right to information /Articles 13-14 GDPR/ You have the right to be informed of the fact and purposes of the processing at the time of obtaining your personal data. The Controller will also provide you with such additional information as is necessary to ensure fair and transparent processing, taking into account the specific circumstances and context in which the personal data are processed. You shall also be informed of the fact of profiling and its consequences.
Right of access /Article 15 GDPR/ You have the right to request information as to whether your personal data is being processed and, if such processing is taking place, you have the right to be informed that the Data Controller:

  • what personal data
  • on what legal basis
  • for what processing purpose
  • how long it treats
  • to whom, when, under which law, to which personal data, to whom you have given access or to whom you have transferred your personal data
  • the source of your personal data (if not provided by you to the Data Controller)
  • whether it uses automated decision-making and its logic, including profiling.
Right to rectification /Article 16 GDPR/ You have the right to have inaccurate personal data concerning you corrected or incomplete personal data completed by the Data Controller at your request. You may therefore request that the Controller amend any of your personal data (for example, you may change your e-mail address or other contact details at any time).
Right to erasure (“right to be forgotten”) /Article 17 GDPR/ You have the right to have your personal data deleted by the Data Controller at your request if one of the following grounds applies:

  • your personal data are no longer necessary for the purposes for which they were collected or otherwise processed
  • you withdraw your consent on the basis of which the processing was based pursuant to Article 6(1)(a) or Article 9(2)(a) and there is no other legal basis for the processing
  • you object to processing on the basis of Article 21(1) and there are no overriding legitimate grounds for processing, or you object to processing on the basis of Article 21(2)
  • your personal data have been unlawfully processed
  • your personal data must be erased in order to comply with a legal obligation under Union or Member State law to which the Data Controller is subject
  • your personal data have been collected in connection with the provision of information society services referred to in Article 8(1).
Right to restriction /Article 18 GDPR/ You have the right to have the Controller restrict the processing of your personal data at your request if one of the following grounds applies:

  • You contest the accuracy of your personal data (in which case the limitation applies for the period of time that allows the Controller to verify the accuracy of the personal data)
  • the processing is unlawful and you oppose the erasure of the data and instead request the restriction of their use
  • the Controller no longer needs the personal data for the purposes of processing, but you require them for the establishment, exercise or defence of a legal claim you have objected to the processing in accordance with Article 21(1) (in which case the restriction applies for the period until it is determined whether the legitimate grounds of the Controller override your legitimate grounds).
Right to data portability /Article 20 GDPR/ You have the right to receive personal data concerning you which you have provided to a Data Controller in a structured, commonly used, machine-readable format and the right to transmit such data to another Data Controller without hindrance from the Data Controller to which you have provided the personal data, if:

  • the processing is based on consent within the meaning of Article 6(1)(a) or Article 9(2)(a), or on a contract within the meaning of Article 6(1)(b), and
  • the processing is carried out by automated means.

You have the right to request, where technically feasible, direct transfer of your personal data between Data Controllers.
Right to object /Article 21 GDPR/ You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Article 6(1)(e) or (f), including profiling based on those provisions. In such a case, the Controller may no longer process your personal data unless the Controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims. If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such purposes, including profiling, where it is related to direct marketing.
Right to withdraw consent /Article 7(3) GDPR/ You have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of the processing based on consent prior to its withdrawal. You must be informed of this before consent is given. The withdrawal of consent shall be made possible in the same simple manner as the granting of consent.

11. Data Subjects’ remedies in relation to data processing and their content

Legal remedies Content of the remedy
Right to complain to the Supervisory Authority /Article 77 GDPR/ If your right to the protection of your personal data is infringed, you may lodge a complaint with the following Authority:
National Authority for Data Protection and Freedom of Information
registered office: 1055 Budapest, Falk Miksa utca 9-11.
postal address: 1363 Budapest, Pf. 9.
telephone: +36 (1) 391-1400
email: ugyfelszolgalat@naih.hu
website: www.naih.hu
The right to an effective judicial remedy against the Controller or the Processor (initiation of court proceedings) /Article 79 GDPR/ You have the right to take legal action against the Controller or Processor if you consider that the processing of your personal data is unlawful. The court will decide the case out of turn. In such a case, you are free to decide whether to bring your action before the competent court in your place of residence or domicile. The courts can be contacted at: www.birosag.hu/torvenyszekek

12. Update of the Privacy Notice

The Data Controller reserves the right to unilaterally amend this Privacy Notice. In particular, this Privacy Notice may be amended if necessary due to changes in legislation, data protection authority practices, business needs or other circumstances. At the Data Subject’s request, the Controller shall send him a copy of the current version of the Privacy Notice in the form agreed with him.

Vasad, 7 February 2024.