I. Data Controller

Name: Smart Supply Hub Korlátolt Felelősségű Társaság 

Registered seat: 2310 Szigetszentmiklós, Kántor utca 5.

Taxnumber: 23804568-2-13

Company registration number: 13-09-153831

Representative: Gecse Valéria ügyvezető (vezető tisztségviselő)

Mailing address, complaint management: 2310, Szigetszentmiklós Kántor utca 5.

E-mail: contact@dviced.com

Phone number: +36 24 526 888

Website: http://dviced.com

II. Description of the data processing activities carried out in the course of the operation of the webshop

II.1. Issuing the invoice

Content and purpose of data processing

Az adatkezelési folyamat a jogszabályoknak megfelelő számla kiállítása és a számviteli bizonylat-megőrzési kötelezettség teljesítése érdekében történik. A számvitelről szóló 2000. évi C. törvény (továbbiakban: Sztv.) 169. § (1)-(2) bekezdése alapján a gazdasági társaságoknak a könyvviteli elszámolást közvetlenül és közvetetten alátámasztó számviteli bizonylatot meg kell őrizniük

 

Data processed
Név, cím.

 

Period of the data processing
A kiállított számlákat az Sztv. 169. § (2) bekezdése alapján a számla kiállításától számított 8 évig meg kell őrizni.

 

Legal basis for the data processing

Jogi kötelezettség teljesítése. Az általános forgalmi adóról szóló 2007. évi CXXVII. 159. § (1) bekezdése alapján a számla kibocsátása kötelező és az Sztv. 169. § (2) bekezdése alapján 8 évig kell megőrizni [Rendelet 6. cikk (1) bekezdés c) pont szerinti adatkezelés].

III. Information on the use of cookies

This website does not use cookies.

IV. Recipients of personal data

IV.1. Categories of data processors engaged by the Data Controller

Data Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller.

IV.1.1. The Data Processor

Name of the data processor: Shopify International Limited

Contact details of the data processor:

Phone number of the data processor:

E-mail of the data processor: support@shopify.com

Registered seat of the data processor: 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin, D04 XN32, Ireland

Website of the data processor: https://www.shopify.com

Data Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller.

IV.1.2. Data processing related to accounting

Name of the data processor: Kecskés Istvánné EV

Registered seat of the data processor: 1143, Budapest Stefánia út 29.

Phone number of the data processor:  06-1-220-8519

E-mail of the data processor:

Website of the data processor:

The Data Processor participates in accounting under a contract concluded in writing with the Data Controller.

IV.1.3. Activities of data processors related to invoicing

Name of the data processor: Számlázz.hu

Registered seat of the data processor: KBOSS.hu Kft., 1031 Budapest, Záhony utca 7/D.

Phone number of the data processor: 

E-mail of the data processor: info@szamlazz.hu

Website of the data processor: https://www.szamlazz.hu

The Data Processor, under a contract concluded with the Data Controller, assists in the issuance and record-keeping of accounting documents.

IV.1.4. Activities of data processors related to the operation of CRM system

Name of the data processor: Shopify International Limited

Registered seat of the data processor: 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin, D04 XN32, Ireland

Phone number of the data processor: 

Email of the data processor: support@shopify.com

Website of the data processor: https://www.shopify.com

The Data Processor participates in recording orders under a contract concluded with the Data Controller.

IV.1.5. Data processing by a processor in connection with the use of the withdrawal functionality

Name of the data processor: Shopify International Limited

Registered seat of the data processor: 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin, D04 XN32, Ireland

Phone number of the data processor: 

Email of the data processor: support@shopify.com

Website of the data processor: https://www.shopify.com

The Data Processor participates in the technical provision and operation of the online withdrawal functionality under a contract concluded with the Data Controller.

IV.1.6. Data Processing in a Third Country: The Rocket Science Group LLC.

Description and safeguards of data processing outside the EU

Name of recipient: The Rocket Science Group LLC.
Registered seat of recipient: 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308 USA
E-mail address of recipient: privacy@mailchimp.com
Website of recipient: mailchimp.com

Mailchimp processes personal data outside the territory of the European Union. The Data Processor, on the basis of its contract with the Data Controller, assists in sending newsletters.

Mailchimp participates in the EU–U.S. Data Privacy Framework, which provides appropriate safeguards regarding the legal compliance of processing carried out in a third country.

IV.2. Transfer of data to third parties

The Data Controller transfers data to third parties (recipients) as set out below. These recipients do not process the data on the instructions of the Data Controller, but process them as independent controllers, on the basis of their own data processing policies.

IV.2.1. Recipients of data processing activities related to the delivery of goods

Name of recipient: Magyar Posta Zártkörűen Működő Részvénytársaság

Registered seat of recipient: 1138 Budapest, Dunavirág utca 2-6.

Phone number of recipient: +36-1/767-8200

E-mail address of recipient: ugyfelszolgalat@posta.hu

Website of recipient: posta.hu

 

The courier service, on the basis of its contract with the Data Controller, assists in the delivery of the ordered Goods. The courier service processes the personal data received in accordance with the Privacy Notice available on its website.

Purpose of the data transfer: to provide the courier service with the data relating to the purchase in order to carry out the delivery.

Legal basis of the data transfer: the performance of the contract concluded between you and the Data Controller pursuant to Article 6(1)(b) of the Regulation, which also includes the delivery of the product, where you selected a delivery method during the order process

IV.2.2. Recipients of data processing activities related to the delivery of goods

Name of recipient: GLS General Logistics Systems Hungary Csomag-Logisztikai Kft.

Registered seat of recipient: 2351 Alsónémedi, GLS Európa u. 2.

Phone number of recipient: 06-29-88-67-00

E-mail address of recipient: info@gls-hungary.com

Website of recipient: https://gls-group.eu/HU/hu/home

 

The courier service, on the basis of its contract with the Data Controller, assists in the delivery of the ordered Goods. The courier service processes the personal data received in accordance with the Privacy Notice available on its website.

Purpose of the data transfer: to provide the courier service with the data relating to the purchase in order to carry out the delivery.

Legal basis of the data transfer: the performance of the contract concluded between you and the Data Controller pursuant to Article 6(1)(b) of the Regulation, which also includes the delivery of the product, where you selected a delivery method during the order process

IV.2.3. Recipients of data processing activities related to the delivery of goods

Name of recipient: DPD Hungary Kft.

Registered seat of recipient: 1134 Budapest Váci út 33., A épület II. emelet

Phone number of recipient: +36-1/501-6200

E-mail address of recipient: dpd@dpd.hu

Website of recipient: https://www.dpd.com/hu/

 

The courier service, on the basis of its contract with the Data Controller, assists in the delivery of the ordered Goods. The courier service processes the personal data received in accordance with the Privacy Notice available on its website.

Purpose of the data transfer: to provide the courier service with the data relating to the purchase in order to carry out the delivery.

Legal basis of the data transfer: the performance of the contract concluded between you and the Data Controller pursuant to Article 6(1)(b) of the Regulation, which also includes the delivery of the product, where you selected a delivery method during the order process

IV.2.4. Data processing related to online payment

Name of the data controller: Shopify International Limited

Registered seat of the data controller: 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin, D04 XN32, Ireland

Phone number of the data controller: 

E-mail of the data controller: support@shopify.com

Website of the data controller: https://www.shopify.com

The purpose of data transfer: The payment service provider assists in the execution of online payments on the basis of its contract with the Data Data Controller. For this purpose, during the purchase process, data are transferred to the online payment service provider in order to complete the payment transaction.

Scope of data transfer: The purpose of data transfer: to provide the online payment service provider with the transaction data necessary for the payment operation initiated at the online payment service provider and related to the purchase.

Legal basis: Legal basis: performance of the contract concluded between you and the Data Data Controller pursuant to Article 6(1)(b) of the Regulation, which includes payment on the buyer’s part, and for which, in the case of online payment, data transfer under this section is required.

V. Your rights in the course of the data processing

During the period of data processing, you are entitled to exercise the rights set out in this Notice in accordance with the provisions of the Regulation.

If you wish to exercise your rights, this will involve your identification, and the Data Controller will necessarily have to communicate with you. Therefore, for the purpose of identification, you will be required to provide personal data; however, identification may only be based on data that the Data Controller otherwise already processes about you. In addition, your complaints relating to data processing will be available in the Data Controller’s email account for the period specified in this Notice in relation to complaints.

The Data Controller will respond to complaints relating to data processing within 30 days at the latest.

V.1. Right to withdraw consent

You have the right to withdraw your consent to data processing at any time. In such case, your personal data processed on the basis of consent will be deleted from our systems.

V.2. Access to personal data

You have the right to obtain confirmation from us as to whether or not we process your personal data. If we do process your personal data, you have the right to access such data and to receive information about the following:

• the purposes for which we process your personal data;
• the types/categories of personal data we process about you;
• the recipients or categories of recipients to whom the personal data have been or may be disclosed;
• the period for which the personal data will be stored, or, if this is not possible to determine in advance, the criteria used to determine the duration of the data processing;
• your rights to request the rectification or erasure of your personal data, or the restriction of processing, and, in the case of processing based on legitimate interest, your right to object;
• the possibility of lodging a complaint with the supervisory authority;
• where the data were not obtained from you, any available information as to their source;
• whether we apply automated decision-making, including profiling, and, if so, meaningful information about the essence and logic involved, as well as the expected consequences of such processing for you.

The purpose of exercising the right of access is primarily to verify the lawfulness of the data processing. If you request information with the same content unreasonably frequently, we are entitled to charge a reasonable fee.

V.3. Right to rectification

You have the right to request that the Data Controller rectify inaccurate personal data concerning you without undue delay.

V.4. Right to the restriction of data processing

You have the right to request that the Data Controller restrict the processing of your personal data where one of the following applies:

• you contest the accuracy of the personal data, in which case the restriction applies for the period enabling the Data Controller to verify the accuracy of the personal data; if the accurate data can be established immediately, restriction will not take place;
• the processing is unlawful, but you oppose the erasure of the data for any reason, for example because the data are important to you for the establishment of a legal claim, and therefore you request the restriction of their use instead of erasure;
• the Data Controller no longer needs the personal data for the purposes of the specified processing, but you require them for the establishment, exercise or defence of legal claims; or
• you have objected to the processing, but the Data Controller’s legitimate interest may also justify the processing, in which case the processing must be restricted until it is determined whether the Data Controller’s legitimate grounds override your legitimate grounds.

Where processing has been restricted, such personal data may, with the exception of storage, only be processed with the consent of the data subject, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.

V.5. Right to erasure - right to be forgotten

You have the right to request that the Data Controller erase personal data concerning you without undue delay where one of the following grounds applies:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed by the Data Controller;
• you withdraw your consent and there is no other legal basis for the processing;
• you object to processing based on legitimate interest and there are no overriding lawful grounds, i.e. legitimate interests, for the processing;
• the personal data have been unlawfully processed by the Data Controller and this has been established on the basis of the complaint;
• the personal data must be erased for compliance with a legal obligation under Union or Member State law to which the Data Controller is subject.

Erasure does not apply where the processing is necessary:

• for compliance with a legal obligation under Union or Member State law to which the Data Controller is subject and which requires the processing of personal data, such as data processing carried out in connection with invoicing, since the retention of invoices is required by law, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller;
• for the establishment, exercise or defence of legal claims, for example where the Data Controller has a claim against you which has not yet been fulfilled, or where the handling of a consumer or data protection complaint is in progress.

V.6. Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on legitimate interest. In such case, the Data Controller may no longer process the personal data unless the Data Controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or grounds which are related to the establishment, exercise or defence of legal claims.

V.7. Right to data portability

Where the processing is based on your voluntary consent or is carried out for the performance of a contractual obligation, you have the right to request that the Data Controller provide you with the data that you have provided to the Data Controller. The Data Controller will make such data available to you in XML, JSON or CSV format. Where technically feasible, you may request that the Data Controller transmit the data in such format to another controller.

V.8. Legal remedies

If you believe that the Data Controller has infringed any statutory provision relating to data processing, or has failed to comply with any of your requests, you may initiate proceedings before the Hungarian National Authority for Data Protection and Freedom of Information in order to terminate the presumed unlawful processing. The Authority’s registered office is: 1055 Budapest, Falk Miksa utca 9-11.; mailing address: 1363 Budapest, Pf. 9.; email: ugyfelszolgalat@naih.hu; telephone numbers: +36 (30) 683-5969, +36 (30) 549-6838, +36 (1) 391 1400.

We also inform you that, in the event of an infringement of statutory provisions relating to data processing, or if the Data Controller has failed to comply with any of your requests, you may bring proceedings before the regional court having jurisdiction according to your place of residence or habitual residence.

VI. Miscellaneous provisions

VI.1. Amendment of the Privacy Notice

The Data Controller reserves the right to amend this Privacy Notice in a manner that does not affect the purpose or legal basis of the data processing.

VI.2. Downloadable version

You can also download this Privacy Notice in PDF format here.