A https://florimo.hu/en website (hereinafter referred to as “the Website”) owned and operated by the Matécsa Ltd. in collaboration with (Matécsa Ltd.., H-6237 Kecel, 124 Vasút Street. , Company registration number: 03 09 101561, Tax registration number: 11022224-2-03 (hereinafter referred to as “the Service Provider”).
The purpose of this Policy is to set out the data protection and data processing principles and policy applied by the Service Provider.
We hereby inform you that Section 20(1) of Act CXII of 2011 on the Right to Data Self-Determination and Freedom of Information (hereinafter: “Infotv.”) stipulates that the data subject (hereinafter: the user) must be informed, prior to the commencement of data processing, whether such processing is based on consent or is mandatory.
The data subject must be informed clearly and in detail, prior to the commencement of data processing, of all facts relating to the processing of their data, including, in particular, the purpose and legal basis of the data processing, the person authorised to carry out data processing, and the duration of the data processing.
Furthermore, in accordance with Section 6(1) of the Information Act, the data subject must also be informed that personal data may be processed even if obtaining the data subject’s consent is impossible or would entail disproportionate costs, and the processing of personal data
If, due to the person’s lack of legal capacity or for some other unavoidable reason, they are unable to give their consent, then to the extent necessary to protect their own or another person’s vital interests, and to avert or prevent an immediate danger threatening the life, physical integrity or property, their personal data may be processed for as long as the obstacles to consent remain in place.
The consent or subsequent approval of the legal representative is not required for the validity of a legal declaration containing the consent of a minor who has reached the age of 16.
Under the Information Act, the above information must also cover the data subject’s rights and remedies in relation to the data processing in question.
However, where it is impossible to inform the data subjects personally, or where doing so would entail disproportionate costs, the information may also be provided by publishing the following details:
In light of the information provided above, please read the following Policy carefully. We would also like to draw your attention to the fact that the Service Provider is entitled to amend its data processing principles unilaterally, subject to the relevant legislation.
The amended data protection principles shall come into force upon their publication on the website.
Please be advised that the Service Provider processes, stores and handles the data on the above website in compliance with the data protection legislation in force at any given time. The relevant rules are set out in this Privacy and Data Processing Policy, which, in addition to setting out data processing methods, also sets out measures relating to data protection and the secure handling of personal data.
The Service Provider is committed to protecting the privacy rights of visitors to the Website, which is of paramount importance to us. However, please bear in mind that the security of information transmitted over the internet cannot be fully guaranteed.
The statutory definitions and interpretations of the terms used in these Regulations are as set out in Section 3 of the Info Act
personal data: data that can be linked to the data subject – in particular the data subject’s name, identification number, and one or more factors specific to their physical, physiological, mental, economic, cultural or social identity – as well as any conclusions drawn from such data concerning the data subject;
data subject/user: any natural person who is identified, or can be identified – directly or indirectly – on the basis of any specific personal data;
consent: a voluntary and unequivocal expression of the data subject’s will, based on adequate information, by which they give their unambiguous consent to the processing of their personal data – whether in full or in relation to specific operations;
data controller: a natural or legal person, or an organisation without legal personality, which, either alone or jointly with others, determines the purposes of data processing, takes and implements decisions relating to data processing (including the means used), or has such decisions implemented by a data processor appointed by it;
data processing: any operation or set of operations carried out on data, irrespective of the procedure used, including, in particular, collection, recording, organisation, storage, alteration, use, retrieval, transmission, disclosure, alignment or combination, blocking, erasure and destruction, as well as the prevention of further use of the data, the taking of photographs, audio or video recordings, and the recording of physical characteristics suitable for identifying the individual (e.g. fingerprint or palm print, DNA sample, iris scan) recording;
data transfer: making the data available to a specific third party;
data erasure: rendering the data unrecognisable in such a way that it can no longer be recovered;
data processing: the performance of technical tasks relating to data processing operations, irrespective of the method or means used to carry out those operations or the location of the application, provided that the technical task is performed on the data;
data processor: a natural or legal person, or an organisation without legal personality, which processes data on the basis of a contract concluded with the data controller – including a contract concluded pursuant to a statutory provision;
third person: a natural or legal person, or an organisation without legal personality, who or which is not the data subject, the data controller or the data processor;
protest: a statement by the data subject objecting to the processing of their personal data and requesting that the processing be discontinued or that the data processed be erased;
publication: making the data available to anyone;
data set: the totality of data held in a single register;
Personal data may only be processed for a specific purpose, in order to exercise a right or to fulfil an obligation. At every stage of data processing, the processing must be in accordance with the purpose for which the data is processed, and the collection and processing of the data must be fair and lawful.
Only personal data that is essential to the fulfilment of the purpose of data processing and is suitable for achieving that purpose may be processed. Personal data may only be processed to the extent and for the duration necessary to fulfil that purpose.
Legal basis: Data processing is carried out on the basis of a voluntary declaration by users of the online content on the Website, made after they have been duly informed; this declaration includes the users’ express consent to the use of their personal data provided whilst using the site.
The legal basis for data processing, in accordance with Section 5(1)(a) of the Information Act, is the data subject’s voluntary consent. Please note that the user gives their consent in respect of each instance of data processing by using the Website, by registering, or by voluntarily providing the requested data to the Service Provider, and in doing so, the user also accepts the data processing principles applied by the Service Provider.
Purpose: We hereby inform you that the data you have provided will be processed by the Service Provider (hereinafter: “Data Controller”) in accordance with the Information Act, solely for the purposes of identifying the user during registration on the Website and/or when purchasing tickets, to enable the user to access the services available via the Website, and to ensure the proper fulfilment of the product order, to conclude contracts with users and ensure any associated delivery, to provide subsequent evidence of the terms and conditions of the order, to document the adequacy of performance, as well as for invoicing, and for the purpose of sending newsletters and ensuring the provision of other services available on the Website.
Please note that, for the purposes set out above, data processing shall be carried out exclusively in the manner prescribed by law, to the extent and for the duration necessary to fulfil the purpose, and shall involve only such personal data as is strictly necessary for the fulfilment of the above purposes and suitable for achieving them.
During registration, the following details are primarily recorded:
Data recorded automatically during the operation of the system: data from the user’s computer used to log in, which is generated whilst using the service and which is recorded by the data controller’s system as an automatic result of technical processes. The system automatically logs the data recorded in this way upon login and logout, without any specific declaration or action on the part of the user. This data cannot be linked to other personal user data – except in cases required by law. Only the data controller has access to the data.
The purpose of the data that is automatically recorded is to compile statistics, to improve the IT system technically, and to protect users’ rights.
Please be advised that the data controller shall not use, nor may it use, the personal data provided for any purposes other than those set out in these points. Personal data may only be disclosed to third parties or public authorities with the user’s prior, express consent, unless otherwise provided for by law.
Please note that the data controller does not verify the personal data provided to it. The person providing the data is solely responsible for its accuracy.
Please note that by providing their email address, all users accept responsibility for ensuring that they are the only person using the service via the email address provided. In view of this undertaking, all liability relating to any logins made using a given email address rests solely with the user who registered that email address.
Please note that an IP address is a sequence of numbers that identifies your computer when connecting to an internet service provider, a local area network (LAN) or a wide area network (WAN). Web servers automatically identify your computer by its IP address whilst you are online. The Service Provider may collect IP addresses for the purposes of system administration and monitoring website usage. However, users are not primarily linked to their IP addresses, meaning that users remain anonymous.
Nevertheless, should the Service Provider consider it necessary to ensure compliance with the Website’s terms of use, or to protect the services or our other users, it may use IP addresses to identify users.
Duration of data processing, amendment and erasure of data
The processing of personal data provided on a mandatory basis during registration begins upon registration and continues until such data is deleted, the purpose is fulfilled, or until any other date specified by law. In the case of non-mandatory data, data processing continues from the time the data is provided until such time as the data in question is deleted, the purpose is fulfilled, or any other time specified by law.
Please note that you may request information about your data held by the Service Provider at any time. You may request, free of charge and at any time, without having to provide a reason or face any restrictions, that your data be amended or deleted from the Service Provider’s database by contacting us via the following contact details:
Please note that the Website operated by the Service Provider uses so-called “cookies” to collect profile and status data, and to identify registered users of the Website,
“to keep a record of the ”shopping basket” and to track visitors. Cookies are pieces of data that are temporarily stored on your computer’s hard drive by your browser when you visit the Website, and which are necessary for you to use the Website. However, they cannot, on their own, be used to identify a visitor personally. Cookies provide additional functionality for the Website and enable us to measure its usage more accurately.
Under the Info Act, cookies may be used subject to your prior consent. You therefore have the option to accept or reject cookies. By changing your browser settings, you can reject cookies or, if you wish, receive a warning before cookies are stored. Please refer to your web browser’s instructions or help section if you would like to find out more about these features and adjust your cookie settings. Please note that if you decide to reject cookies, you may not be able to make full use of the interactive features of our website or other websites.
We hereby inform you that, in accordance with Section 6 of Act XLVIII of 2008 on the fundamental conditions and certain restrictions of commercial advertising, the user may give their prior and express consent to the Service Provider to contact them via the contact details provided during registration (e.g. email address or telephone number) with the Service Provider’s advertisements for the purpose of providing information on current promotions, news and the provision of new services, and to process the personal data and to process the personal data necessary for sending such advertising materials and newsletters. The user is entitled to decide on this matter at the time of registration or when amending their registered details.
Please be advised that the Service Provider processes the following data for the purposes of its direct marketing activities: name, email address, (telephone number). Any visitor to the Website may subscribe to the newsletter. The Service Provider will process the data provided by the user until they unsubscribe. Only the data controller’s staff are authorised to process users’ personal data.
The Service Provider does not send unsolicited advertising messages or newsletters to its visitors and users. Users are entitled to unsubscribe from these at any time, free of charge, without giving any reason and without any restrictions, as indicated in the newsletter and/or promotional offer. Please note that, upon unsubscribing, the Service Provider will delete from its records the user’s personal data required for sending newsletters and advertising, and will not contact the user with further promotional offers.
The Info. Act, and Act CVIII of 2001 on certain issues relating to electronic commerce services and information society services, the Service Provider may engage a data processor to process the personal data held. In the course of providing data processing services, the data processor is obliged to comply with this Privacy Policy, the relevant legislation in force, and the provisions of the contract governing its legal relationship with the Service Provider. By visiting the Website or using the Website’s services, the user consents to the transfer of their personal data to any data processors that the Service Provider may engage for the purposes of data processing. The identities of potential data controllers entitled to access the data are: the Matécsa Ltd..
Scope of data transferred: user’s name, telephone number, email address, home address/registered office, billing name and address, delivery address
Purpose of data transfer: to provide server services, including for the purpose of data storage
The personal data transmitted by the Service Provider shall be retained for the duration necessary for the user to make and settle payment for the service and for the delivery of the product, and, where applicable, until invoicing has been completed, as well as until the user unsubscribes from the newsletter or the newsletter service is discontinued, unless otherwise provided for by the relevant legislation.
Please be advised that you may request the deletion of your personal data from the above data processors or data controllers at any time.
The Info Act stipulates, as a data security requirement, that the data controller must plan and carry out data processing operations in such a way as to ensure the protection of data subjects’ privacy. The data controller, and the data processor within the scope of its activities, is obliged to ensure the security of the data; it is also obliged to take the technical and organisational measures and establish the procedural rules necessary to enforce the Info Act, and other data protection and confidentiality rules. Data must be protected by appropriate measures, in particular against unauthorised access, alteration, transmission, disclosure, erasure or destruction, as well as against accidental loss or damage, and against becoming inaccessible as a result of changes in the technology used.
In order to protect data files processed electronically in the various registers, appropriate technical measures must be put in place to ensure that the data stored in the registers – unless permitted by law – cannot be directly linked to or attributed to the data subject.
In the course of the automated processing of personal data, the data controller and the data processor shall take further measures to ensure that unauthorised data entry is prevented; to prevent the use of automated data processing systems by unauthorised persons via data transmission equipment; to ensure that it is possible to verify and establish to which bodies personal data have been or may be transmitted using data transmission equipment; the ability to verify and establish which personal data were entered into automated data processing systems, when and by whom; the ability to restore the installed systems in the event of a malfunction; and the preparation of reports on errors occurring during automated processing.
When determining and implementing measures to ensure data security, the data controller and the data processor must take into account the current state of the art. Where there are several possible data processing solutions, the one that ensures a higher level of protection for personal data must be chosen, unless this would entail a disproportionate burden on the data controller.
Under the provisions of the Info TV Act, the data subject may submit a request to the data controller
At the request of the data subject, the data controller shall provide information regarding the data concerning the data subject that it processes, or that are processed by a data processor commissioned by it or in accordance with its instructions, the source of such data, the purpose, legal basis and duration of the data processing, the name and address of the data processor and the activities carried out in connection with the data processing, and – where the data subject’s personal data have been transferred – the legal basis for the transfer and the recipient of the data.
The data controller maintains a record of data transfers for the purposes of verifying the lawfulness of such transfers and informing the data subject; this record includes the date of the transfer of the personal data processed by the data controller, the legal basis for the data transfer and the recipient, a description of the scope of the personal data transferred, and any other information specified in the legislation governing data processing.
The data controller is obliged to respond to a request for information in writing, in a form that is easy to understand, as soon as possible after the request is submitted, but within a maximum of 30 days. The information shall be provided free of charge if the person requesting the information has not previously submitted a request for information to the data controller in the current year concerning the same set of data. In other cases, a fee may be charged.
If the personal data does not correspond to the facts, and the data controller has access to personal data that does correspond to the facts, the data controller shall rectify the personal data.
Personal data must be erased if
Instead of erasure, the data controller shall block the personal data if the data subject so requests, or if, on the basis of the information available to the data controller, it can be assumed that erasure would prejudice the data subject’s legitimate interests. Personal data blocked in this way may be processed only for as long as the purpose of processing which precluded the erasure of the personal data remains valid.
The data subject, as well as all those to whom the data has previously been disclosed for the purposes of data processing, must be notified of any rectification, blocking, marking or erasure. Notification may be omitted if this does not infringe the data subject’s legitimate interests in view of the purpose of the data processing.
If the data controller does not comply with the data subject’s request for rectification, blocking or erasure, it shall, within 30 days of receiving the request, provide in writing the factual and legal grounds for rejecting the request for rectification, blocking or erasure. In the event of a refusal to comply with a request for rectification, erasure or blocking, the data controller shall inform the data subject of the right to seek judicial redress and of the possibility of lodging a complaint with the Authority.
We would like to inform you that, as a user, you may object to the processing of your personal data under the Info. tv. if
The Service Provider shall examine the objection as soon as possible after the request is submitted, but within a maximum of 15 days, shall decide on the merits of the objection, and shall inform the applicant of its decision in writing. If the Service Provider finds the data subject’s objection to be well-founded, it shall cease data processing – including any further data collection and data transfer – and shall block the data; it shall also notify all those to whom the personal data concerned by the objection had previously been disclosed of the objection, as well as the measures taken on that basis, to all those to whom the personal data subject to the objection was previously transferred and who are obliged to take action to ensure the right to object is upheld. If the user disagrees with the decision taken by the Service Provider, or if the Service Provider fails to meet the above deadline, the user may bring the matter before a court within 30 days of being notified of the decision. Furthermore, the user may bring a claim before a court in the event of a breach of their rights. The court shall deal with the matter as a matter of priority.
The data controller is obliged to prove that the processing of data complies with the provisions of the law. The data recipient is obliged to prove the lawfulness of the data transfer.
The court has jurisdiction to hear the case. The case may also be brought before the court with jurisdiction over the place where the person concerned is domiciled or resident, at their discretion.
A party to the proceedings may also be a person who would otherwise lack legal capacity to be a party to the proceedings. The Authority may join the proceedings on behalf of the person concerned
may intervene to ensure the success of the case.
If the court grants the application, the data controller shall be required to provide information, to rectify, block or erase the data, to annul a decision made by means of automated data processing, to take account of the data subject’s right to object, and to disclose the data requested by the recipient.
If the court rejects the data recipient’s application, the data controller is obliged to erase the data subject’s personal data within 3 days of the judgement being notified. The data controller is also obliged to erase the data if the data recipient does not apply to the court within the specified time limit.
The court may order that its judgment be made public – including the publication of the data controller’s identifying details – if this is required in the interests of data protection and the protected rights of a large number of data subjects.
If the data controller causes damage to another person through the unlawful processing of the data subject’s data or by breaching data security requirements, the data controller is obliged to compensate for such damage.
If the data controller infringes the data subject’s right to privacy by processing their data unlawfully or by breaching data security requirements, the data subject may claim compensation from the data controller.
The data controller shall be liable to the data subject for any damage caused by the data processor, and the data controller shall also be obliged to pay the data subject the compensation for non-pecuniary damage due in the event of a breach of the data subject’s rights to privacy caused by the data processor. The data controller shall be exempt from liability for the damage caused and from the obligation to pay compensation if it proves that the damage or the infringement of the data subject’s right to privacy was caused by an unavoidable cause outside the scope of the data processing.
No compensation for damages is payable and no compensation for pain and suffering may be claimed to the extent that the damage or the infringement of a personal right resulted from the intentional or grossly negligent conduct of the person concerned.
Please note that the Service Provider holds the exclusive rights to the information displayed and contained on the Website (text, images, videos and other content). The content and design of the Website are protected by international and Hungarian law. Furthermore, it is prohibited to sell, publish, copy, alter in any form, republish or distribute any information or articles originating from the Service Provider or the Website. We reserve all further rights relating to the published material and shall enforce them, if necessary, through the courts or other legal means.
Please do not use the Website if you do not agree with the above.
Should you have any further questions regarding data protection or data processing,
Please contact our colleague using the contact details below:
As part of the service we provide to our users, the Service Provider offers various links to access other third-party websites. The privacy policy set out here does not apply to these sites. Please check the legal and privacy policies of any websites you wish to visit via our links.
Please note that the Service Provider reserves the right to unilaterally amend these Terms and Conditions, which shall come into effect upon their publication on the Website. We may also post a notice on our Website regarding any particularly important or significant changes.
In view of this, we recommend that you keep up to date with our Privacy Policy. Please note that by continuing to use our Website, you accept our Privacy Policy and any changes we may make to it.
The data controller’s data protection registration number:
In drawing up the Data Protection and Data Processing Policy, the following legislation was primarily taken into account and applied: