Privacy notice

PRIVACY NOTICE

1. Controller

Name: DIGITAL Számítástechnikai Kereskedelmi és Szolgáltató Kft. (short name: DIGITAL Kft.)

Address: 6723 Szeged, Csongrádi sugárút 83.

Controller's data protection officer: Váli Gábor

Controller's contact for data protection matters: dpo[at]digital.co.hu

This notice constitutes a unilateral undertaking by the controller in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (27 April 2016) and the relevant Member State legislation.

2. Purpose of processing

2.1 Provision of service(s) to natural persons, and in this context:

• Identifying the User and distinguishing them from other customers, users and enquirers
• Maintaining contact, measuring customer satisfaction
• Sending system message(s) relating to the service
• Participation in events and related ancillary services

Legal basis for processing: Contract

Providing the data is a precondition for concluding the contract. If the data are not provided, the Controller cannot perform the service ordered.

Categories of data processed:

• Name
• [Permanent] home address
• Delivery address
• E-mail address
• Telephone number
• Unique identifier

2.2 Provision of service(s) to legal persons, and in this context:

• Identifying the User and distinguishing them from other customers, users and enquirers
• Maintaining contact, measuring customer satisfaction
• Sending system message(s) relating to the service
• Participation in events and related ancillary services

Legal basis for processing: Legitimate interest – the controller's legitimate interest in keeping a record of the contact person's data for the performance of the contract.

Categories of data processed:

• Name
• E-mail address
• Telephone number
• Unique identifier

2.3 Issuing invoices and issuing the mandatory documentation related to the performance of the service.

Legal basis for processing: Compliance with a legal obligation (compliance with the financial accounting legislation)

Providing the data is a precondition for concluding the contract. If the data are not provided, the Controller cannot perform the service ordered.

Categories of data processed:

• Name
• [Permanent] home address
• E-mail address (where remote printing of invoices or e-invoicing is enabled)
• Unique identifier

2.4 Advertising of service(s) and provision of information to registered users

• Direct marketing and marketing communications with promotional content about new or renewed services
• Customer satisfaction measurement
• Invitations to marketing events

Legal basis for processing: Consent of the Data Subject

On the basis of this notice, the data subject consents to the processing of their personal data in writing, by e-mail, by accepting a web-based mailing list URL or by ticking the checkbox on the Controller's registration web page.

Categories of data processed:

• Name
• [Correspondence address]
• E-mail address
• Telephone number
• Additional information provided by the User

2.5 Advertising of service(s) and provision of information to Users

• Direct marketing and marketing communications with promotional content about new or renewed services
• Customer satisfaction measurement
• Invitations to marketing events

Legal basis for processing: Legitimate interest – the Controller's legitimate interest in direct marketing

By using a service, the data subject provided the controller with the data listed below. In this notice, the Controller informs the data subject that, relying on legitimate interest, it reclassifies the purpose of processing of the data processed in connection with the activities set out in points 2.1 and 2.2 and uses them for direct marketing purposes.

Source of the data: The Controller lawfully processed the Data Subjects' data for another purpose of processing.

Categories of data processed:

• Name
• Billing address
• Delivery address
• E-mail address
• Telephone number
• Unique identifier

2.6 Delivery of orders

• Delivery by courier service
• Delivery to a courier service point or pick-up point

Legal basis for processing: Legitimate interest – the controller's legitimate interest in keeping a record of the contact persons' and the recipient's data for the performance of the contract

Source of the data: As communicated by the legal person placing the order

Categories of data processed:

• Name
• Telephone number
• Unique identifier

2.7 Operation of an electronic surveillance system for the protection of the following:

• Security of the Controller's premises
• Protection of the Controller's assets
• Protection of the physical safety and property of the Controller's employees and visitors
• Investigation of the circumstances of any accidents or criminal offences that may occur

Legal basis for processing: consent of the Data Subject, which in this case is expressed by conduct, i.e. the Data Subject enters the Controller's premises despite the notice of camera surveillance.

The Controller carries out this activity in compliance with the provisions of Act CXXXIII of 2005 on the Rules of Personal and Property Protection and of Private Investigation Activities (Szvtv.).

Categories of data processed:

• Image and moving image recording of the natural person (hereinafter together: recording)

Data subjects

3. Categories of data subjects

Users registered on the www.digital.co.hu and helpdesk.digital.co.hu websites and the contact persons provided by them. (Data processing registration number of the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): NAIH-146650/2018

4. Children

Our products and services are not intended for persons under the age of 16. We ask that persons under the age of 16 do not provide Personal Data to the Controller. If we become aware that we have collected personal data from a person under the age of 16, we will take the steps necessary to erase the data as soon as possible.

5. Duration of processing

• In the case of compliance with a legal obligation: the retention period laid down in the Accounting Act (számviteli törvény)
• In the case of a contract: until the deadline set out in the contract or, at the latest, 8 years after the expiry of the contract
• In the case of consent: until the Data Subject withdraws consent
• In the case of legitimate interest: until the Data Subject objects
• The Controller stores the recordings held in the electronic surveillance system for the period laid down in the provisions of Act CXXXIII of 2005 on the Rules of Personal and Property Protection and of Private Investigation Activities (Szvtv.).

With regard to recordings made by the electronic surveillance system, the Controller applies the following retention periods:

• in general, 3 days
• in the event of damage, or suspected damage, to the controller's assets, where the recordings are used: for the shortest period necessary to achieve the purpose

After the retention period has expired, the recordings are destroyed.

6. Information on the use of processors

In the course of processing, the Controller may transfer the data to the Processor(s) contracted by it for the performance of the contract.

Categories of recipients: courier services, freight forwarding companies, manufacturers, wholesalers, IT operators, SaaS providers, web hosting providers, online payment service providers, event organisers, accounting and auditing service providers.

7. Persons entitled to access the data

The Controller does not disclose the data obtained to third parties, with the exception of the Processor(s) referred to in point 6. The recorded data may be accessed only by the Controller's employees and the designated employees of the Processor(s).

The Controller does not disclose the recordings generated by the electronic surveillance system (NAIH data processing registration number: NAIH-97082/2016.) to third parties. The recordings may be accessed only by the Controller's designated employees.

Recordings previously made by the electronic surveillance system may be accessed by the Data Protection Officer, the Chief Operating Officer and the employee operating the system. At their request, the Data Subject may access only the recordings made of their own person, in the presence of one of the persons mentioned above. Access must in all cases be requested in writing from the Data Protection Officer.

The Controller draws up a record of every instance of inspection, which the company keeps for 1 year.

7.1 Persons entitled to restrict the images of the electronic surveillance system

Restriction of the recordings made by the electronic surveillance system may be implemented only where the Controller has detected an event that is likely to jeopardise the purpose to be achieved by the electronic surveillance system.

At the Data Subject's request, only the processing of recordings made of their own person may be restricted. The Data Subject must request the blocking in writing from the Data Protection Officer, stating its precise purpose and expected duration.

The Controller draws up a record of every step of the blocking procedure, which it keeps for 1 year.

8. Rights of data subjects

Using the contact details given in point 1, the Data Subject may

• request the Controller to provide information on the processing of their personal data;
• request the rectification of their data;
• request information about the processing;
• request the erasure of their personal data and the restriction of processing.

The Data Subject may exercise the above rights at any time by submitting a request to one of the contact addresses given in point 1.

• request that their data be transmitted to another controller, where the processing is based on a contract or consent and the Organisation carries out the processing by automated means;
• withdraw the consent previously given to the processing;

The Controller shall deal with or reject (stating the reasons) the request no later than 1 month after its submission – in exceptional cases within a longer period permitted by law. The Controller informs the Data Subject of the outcome of the examination in writing.

8.1 Cost of providing information

The Controller takes the actions and provides the necessary information free of charge on the first occasion.

If the Data Subject requests the same data twice within one month and the data have not changed during that period, the Controller charges an administrative fee.

• The administrative fee is calculated on the basis of the hourly equivalent of the minimum wage in force at the time, as the hourly rate.
• The number of working hours spent on providing the information is charged at the above hourly rate.
• In addition, where the information is requested on paper, the cost of printing the reply at cost price and the postage costs.

8.2 Refusal to provide information

If the Data Subject's request is manifestly unfounded, if the Data Subject is not entitled to the information, or if the Controller can demonstrate that the Data Subject already has the information requested, the Controller rejects the request for information.

If the Data Subject's request is excessive, in particular because of its repetitive character, the Controller may refuse to act on the request.

8.3 Right to object

The Data Subject has the right to object at any time to the processing of their personal data based on legitimate interest or on the exercise of official authority.

In this case, the Controller may no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject, or which are related to the establishment, exercise or defence of legal claims.

If the Controller establishes that the objection is well-founded, it terminates the processing – including any further transfer and collection of data – as soon as possible, and notifies of the objection all those to whom it has previously transferred the Data Subject's data.

Dealing with the request is free of charge, except for unfounded or excessive requests, for which the Controller may charge a reasonable fee corresponding to its administrative costs. If the Data Subject does not agree with the Controller's decision, they may apply to a court.

9. Disclosure of data

The Controller does not make the recordings of the electronic surveillance system public.

10. Transfer of data to a third country or an international organisation

The Controller does not transfer the Data Subject's personal data or the recordings to a third country outside the states of the European Economic Area or to an international organisation.

11. Information on data security measures

The Controller processes the data in a closed system in accordance with the requirements of its Information Security Policy.

The Controller ensures data protection by default and by design. To this end, the Controller applies appropriate technical and organisational measures in order to:

• precisely regulate access to the data;
• grant access only to persons who need the data to perform their related tasks, and even then only to the minimum data necessary to perform the task;
• select the processors it engages with due care and ensure the security of the data by means of an appropriate data processing agreement;
• ensure the integrity (data integrity), authenticity and protection of the data processed.

The Controller applies reasonable physical, technical and organisational security measures to protect the Data Subjects' data, in particular against accidental, unauthorised or unlawful destruction, loss, alteration, disclosure, use, access or processing. In the event of known unauthorised access to or use of personal data that poses a high risk to the Data Subject, the Controller notifies the Data Subject without delay.

Where it is necessary to transfer Data Subjects' data, the Controller ensures appropriate protection of the transferred data, for example by encrypting them.

The Controller ensures by means of appropriate and regular backups that the Data Subjects' data are protected against destruction or loss.

12. Analytics services

The controller uses the Google Analytics service to track site statistics and users' demographic data, interests and behaviour on websites. The Controller also uses Google Search Console for search engine optimisation of the website and for measuring user satisfaction. Google allows the use of these analytics services to be restricted; to opt out of the use of your data by Google Analytics, please visit Google's page: https://tools.google.com/dlpage/gaoptout

13. Legal remedies

In the event of an alleged infringement relating to the processing of their personal data, any Data Subject may apply to the competent regional court (törvényszék) or initiate an investigation with the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság)

President: dr. Péterfalvi Attila,

Address: 1024 Budapest, Szilágyi Erzsébet fasor 22/C.,

Contact: ugyfelszolgalat[at]naih.hu, +36-1-3911400, www.naih.hu

The following supplementary privacy notice applies to the digital.co.hu/it-finanszirozas/hpe-greenlake page.

I. CONTROLLER, PROCESSOR

II. THE DATA PROCESSED, THE PURPOSE, LEGAL BASIS AND DURATION OF PROCESSING

III. DATA TRANSFERS

IV. YOUR RIGHTS (data subject rights)

V. LEGAL REMEDIES

VI. CONTACT

VII. FINAL PROVISIONS

Before providing detailed information on our processing, for the sake of clarity we state that the term "data subject" refers to you as a visitor to the website referred to above and as a natural person initiating contact (registering) on the website.

To make our notice easier to understand, on the basis of Article 4 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) – hereinafter: GDPR – we inform you of the most important terms needed to understand this Privacy Notice:

– personal data: “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.” [GDPR Article 4(1)]

– processing: “any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.” [GDPR Article 4(2)]

– controller: “the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.” [GDPR Article 4(7)]

– processor: “a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller” [GDPR Article 4(8)]

– consent of the data subject: “any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear

affirmative action, signifies agreement to the processing of personal data relating to him or her” [GDPR Article 4(11)]

I. CONTROLLER, PROCESSOR

Controller:

Company name: DIGITAL Számitástechnikai Kereskedelmi- és Szolgáltató Kft.

Registered office: 6723 Szeged, Csongrádi sgt.83.

Company reg. no.: 06-09-000341

Tax number: 10406115-2-06

Represented by: Fenyvesi József Vilmos, Managing Director

Registered with the Court of Registration of the Szeged Regional Court (Szegedi Törvényszék Cégbírósága)

We inform you that, as Controller, we use the following processor:

Company name: Dentsu Hungary Kft.

Registered office: 1027 Budapest, Kacsa u. 15-23.

Company reg. no.: 01-09-168441

II. THE DATA PROCESSED, THE PURPOSE, LEGAL BASIS AND DURATION OF PROCESSING

DATA PROCESSED (data categories) PURPOSE OF PROCESSING LEGAL BASIS FOR PROCESSING DURATION OF PROCESSING

The registrant's name;

e-mail address;

telephone number; company name;

where they come from;

position Identification of the person registering for contact. Consent of the applicant under GDPR Article 6(1)(a) For 30 days from initial contact

The applicant's name,

e-mail address,

telephone number Maintaining contact with the registrant. Consent of the applicant under GDPR Article 6(1)(a) For 30 days from initial contact

III. DATA TRANSFERS

Apart from the data subject, the personal data we process may be accessed by the Processor(s) named in this notice.

We inform you that, in order to maintain contact, we use the services of The Rocket Science Group LLC [MailChimp] – hereinafter: MailChimp – in the course of which the personal data you provide are transferred to the MailChimp system.

In view of this, we ask you to read the MailChimp Privacy Notice carefully as well, and to take into account and comply with its provisions. Privacy Policy https://mailchimp.com/legal/privacy/

We inform you that we may disclose personal data to an authority or court, e.g. in legal proceedings, upon a request from a court or authority, or at the request of a law enforcement agency, or if

as controller we consider this necessary for the investigation or prevention of, or other action in connection with, an unlawful event or activity, or if this is otherwise required of the Controller by law.

IV. YOUR RIGHTS (data subject rights)

As a data subject, you may exercise your rights relating to the processing of your personal data processed under this Privacy Notice by sending a request to the controller by e-mail to dpo[at]digital.co.hu.

Under Articles 15-21 of the GDPR, the data subject has, in relation to the personal data processed about them by the controller, the right of access to the personal data processed about the data subject, i.e. the right to obtain confirmation from the controller as to whether or not their personal data are being processed. Where your personal data are being processed, you have the right to receive information about the processing concerning you, including the categories of personal data processed about you.

The data subject has the right to obtain from the controller, at their request and without undue delay, the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, you as data subject have the right to request that incomplete personal data be completed, including by means of a supplementary statement.

The Data Subject may withdraw their consent to the processing of their personal data at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

The Data Subject has the right to obtain from the controller, at their request and without undue delay, the erasure of personal data concerning them. In this case, the controller is obliged to erase the personal data concerning the data subject without undue delay, provided that the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed. Personal data concerning the data subject must also be erased if you as data subject object to the processing and there are no overriding legitimate grounds for the processing on the part of the controller or a third party. The Controller is also obliged to erase the personal data if the personal data have been unlawfully processed, or if the personal data have to be erased for compliance with a legal obligation under Union or Hungarian law to which the Controller is subject.

The Data Subject has the right to obtain from the controller, at their request, restriction of processing where they contest the accuracy of the personal data, in which case the restriction applies for a period enabling the controller to verify the accuracy of the personal data. Processing must also be restricted where the processing is unlawful and you as data subject oppose the erasure of the data and request the restriction of their use instead, and also where the controller no longer needs the personal data for the purposes of the processing but the data subject requires them for the establishment, exercise or defence of legal claims. Processing must likewise be restricted if you as data subject have objected to the processing; in the latter case the restriction applies pending verification of whether the legitimate grounds of the controller override your legitimate grounds as data subject.

The Data Subject has the right to receive the personal data concerning them, which they have provided to the controller, in a structured, commonly used and machine-readable format.

The Data Subject has the right to object, on grounds relating to their particular situation, at any time to the processing of their personal data for the purposes of the legitimate interests pursued by a third party.

In the event of your unexpected death, the rights to which you were entitled during your lifetime may be exercised, within five years of your death, by the person you have authorised for that purpose by means of an administrative disposition (ügyintézési rendelkezés) or by a declaration made to the Controller in a public deed or in a private deed of full probative value.

If you do not make such a legal declaration during your lifetime, your close relative within the meaning of the Civil Code (Ptk.) is nevertheless entitled to exercise your right to rectification and your right to object to the processing and – if the processing was already unlawful during your lifetime or the purpose of the processing ceased upon your death – your close relative is entitled to exercise your right to erasure of the data or to restriction of processing within five years of your death. Your rights under this paragraph may be exercised by the close relative who is the first to exercise this entitlement. The person exercising the data subject's rights in place of the data subject after the data subject's death must prove the fact and date of the data subject's death by means of a death certificate or a court decision, and their own identity – and, in the case referred to in the previous paragraph, their status as a close relative – by means of a public deed.

V. LEGAL REMEDIES

You may exercise your rights relating to processing set out in point IV of this Privacy Notice by means of a written request sent to the controller by post to its registered office or electronically by e-mail to dpo[at]digital.co.hu.

If the controller fails to provide the information to the data subject in writing within 1 month of the submission of the written request for information, or if the erasure, restriction or rectification of personal data does not take place within 1 month, or if the Controller does not comply with the data subject's request for rectification, restriction or erasure and does not communicate the reasons for the refusal in writing within 1 month, you as data subject are entitled to seek a legal remedy.

Legal remedies and complaints may be pursued with the Hungarian National Authority for Data Protection and Freedom of Information (hereinafter: NAIH).

Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság)

Registered office: 1055 Budapest, Falk Miksa utca 9-11

Website: http://www.naih.hu,

E-mail address: ugyfelszolgalat@naih.hu

The data subject has the right to apply to a court against a decision of the NAIH concerning a complaint.

The data subject may also apply directly to a court against the controller if, in their opinion, the controller or a processor engaged by the controller or acting on its instructions infringes the requirements concerning the processing of personal data laid down by law or in a binding legal act of the European Union. At the data subject's choice, the case will be heard by the regional court (törvényszék) competent for the data subject's place of residence or place of stay.

In accordance with its obligations under Articles 32-34 of the GDPR, the Controller does everything in its power to ensure the security of the data subject's data, and also takes the necessary technical and organisational measures, establishes the procedural rules and adopts the measures necessary to give effect to the GDPR, Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.) and other data protection and confidentiality rules.

VI. CONTACT

If you have any questions regarding this Privacy Notice or our approach to data protection, or if you wish to exercise any of the rights set out in this Privacy Notice, you can contact us using the following details:

Address: 6723 Szeged, Csongrádi sgt.83.

VII. FINAL PROVISIONS

Please note that you, as the person who provided the personal data to us, are responsible for their accuracy. If you provide personal data that are not your own or provide incorrect data/personal data, you are obliged to indemnify the Controller in full in the event that a third party asserts a claim against the controller.

In matters not regulated in this notice, the processing is governed by the applicable legislation, in particular the provisions of the GDPR and the Infotv.

We inform you that the controller is entitled to amend this notice unilaterally. The amended provisions apply from their entry into force.

This Privacy Notice has been drawn up in Hungarian and English. In the event of any discrepancy between the Hungarian and the English versions, the Hungarian version shall prevail.

Szeged, 29 March 2021