Prize for the June 2025 "Shop and Travel Prize Draw":

✅ In the month of June, we are giving away a 3 day, 2 night stay for 2 people with breakfast at the Forestlux guesthouse in the jewel of the Danube bend, Zebegény. The guest house is located in the heart of the forest, in a premium quality location, one hour from the capital. Unique relaxation in a luxury apartment with wellness facilities, 2,000 square meters of private forest area, private creek bank, in the immediate vicinity of a national park.

✅ Add your favourite GALLMET capsules to your shopping cart, reach the 20.000 HUF basket value (total value of the products) and you will automatically be entered into the monthly draw!

Buy and travel prize draw regulations

1. The name of the competition

"Shop and Travel Sweepstakes", hereinafter referred to as the Game.

2. The game organiser

2.1. The organizer of the game is GALLMED Kft. (registered office: 6500 Baja, Dózsa György út 25-27., Hungary, company registration number: 03-09-121132, tax number: 22999489-2-03), hereinafter referred to as Organizer.

3. Who can participate in the game

3.1 Only a natural person (hereinafter referred to as the "Entrant") who, during the period of the competition, has purchased at least 20.000. Ft. in total value, excluding shipping costs. The value of the purchase will include the coupon code or other discount applied by the Contestant, i.e. the total amount so reduced must reach 20.000. HUF 20,000. This automatically registers a valid application to participate in the game (hereinafter referred to as "Application"; section 4.4.). Participation in the prize draw is only valid if the Entrant does not exercise his/her right of withdrawal without giving reasons after the purchase.

3.2 If the Entrant is incapacitated, he/she is entitled to participate in the game, to administer the prize, to receive the prize and to make statements in connection with the game only with his/her legal representative or guardian. In the case of an incapacitated Candidate, only the Candidate's legal representative or guardian is entitled to take part in the prize administration, to receive the prize and to make any statements in relation to the prize.

4. Participation in the game, application

4.1 Only those Applicants who comply with the requirements set out in Chapter 3 and meet the conditions set out in section 3.1 may participate in the competition. Each purchase made in this way constitutes one valid entry, with multiple such purchases giving the same person multiple chances to participate in the game, equal to the number of purchases.

4.2 A valid entry in the game is conditional on the Entrant providing their true details and contact information at the time of purchase.

4.3 The Entrant will be registered in the prize draw for each valid entry during the duration of the competition.

4.4. The Application

Shopping: the Entrant has entered a prize draw on https://shop.gallmet.hu/ 20.000. Ft in total, as described in point 3.1.
The purchase, as part of the competition, may be validly made by the Entrant during the advertised period of the competition.
All valid entries will be entered into the prize draw.
The same applicant may submit more than one valid application; each valid application submitted as described in point 3.1. and, if successful, entitlement to receive the prize. entails the receipt of the Prize.

5. Duration of the game

5.1 The game will be open from 00:00 on 1 May 2025 until withdrawal. One winner will be drawn from the valid entries received during the relevant month in each calendar month during the duration of the competition. The Promoter reserves the right to close the competition at any time without giving any reason and with prior notice, which will be published on https://gallmet.hu/.

5.2 The deadline for receipt of applications is from 00:00 on the 1st day of the month to 23:59 minutes and 59 seconds on the last day of the month.

5.3. The time of receipt of a valid application is the time of the entry of the order in the Organiser's database according to the internal clock of the server. The internal clock of the server is valid for the duration of the game and follows the current Hungarian time zone.

6. The winning application, the draw, the prize and its receipt

6.1. During the duration of the Game, the User may use the website https://shop.gallmet.hu/ operated by the Promoter to 3.1, the competition will be automatically registered and all Entrants will be eligible to win, subject to the conditions set out above. as set out above.6.2.

6.2. The prize draw will take place on the first working day after the 15th day of each month at 10:00 a.m.

6.3 The prize draw will be conducted using a random numbering software at the Promoter's headquarters.

One winner will be drawn from the applicants in the draw. If you do not respond within 7 days of being notified that you have won, a new draw will be held and another winner will be drawn.

Lottery place: 6500 Baja, Dózsa György út 25-27.

6.4 The Promoter will notify the winner of the draw by email within 3 working days of the draw. In the notification, the winner will be informed of the details of the prize collection and will be asked to take a photograph of themselves and the prize.

6.5 The prize will be awarded in the form of a voucher, which will be sent to the winner electronically (by e-mail) and by post, on paper. The Organiser will publish a photograph of the winner and the prize, including the initials of the winner's surname and first name, with the winner's consent, on the Facebook and Instagram online social networking sites and on https://gallmet.hu/ website.

6.6. Prize draw

Prize: one accommodation for 2 people for 3 days 2 nights per month, breakfast included, to be won by one winner in the draw. The prize will be awarded in the form of a voucher, which will be sent to the winner electronically (by e-mail) and by post on paper. The exact location of the current monthly prize can be found at https://gallmet.hu/, accommodation may vary from month to month. The voucher is normally redeemable from Sunday to Thursday, subject to availability of the accommodation. If the winner wishes to claim it on a Friday or Saturday, this is subject to prior agreement with the accommodation provider and possible surcharge. The voucher is valid for 6 months from the date of the draw.

The voucher is not personal and is transferable to another person, but not redeemable for money.

The Promoter reserves the right to make changes to the prize. The Organiser is not liable for the costs of travel the trip for reasons of force majeure or due to the fault of the winner.6.7.

6.7. Delivery and receipt of the prize.

The voucher will be sent to the winner electronically (by e-mail) and by post on paper within 14 days of the draw if the contact is successful. The Entrant agrees to provide proof of eligibility if they win and to cooperate with the Promoter to ensure that the prize is delivered in the manner and time specified by the Promoter.

6.8 If the eligible Winner fails to respond to the e-mail sent by the Promoter informing him/her of the winning prize, or fails to respond within the time limit specified, or if the prize is not delivered for reasons beyond the control of the Promoter (incorrect or false e-mail address, personal data, unsuccessful contact, etc.), the prize will not be awarded to the winner after the time limit has expired.

6.9 The Organiser shall not be liable for any consequences resulting from the incorrect information provided by the Applicant.

6.10. If a person is drawn who is subsequently found not to have complied with the terms and conditions of these Rules, or who is unable to be awarded the prize for the reasons set out above, a new draw will be made.

7. Clause on the right to invalidation

7.1 The Organiser reserves the right to declare invalid any Tender which does not comply with the the personal and/or formal requirements set out in these Rules of the Organiser, i.e:

a disqualified Candidate as defined in point 8 participates in the game,
the Applicant's application does not comply with point 4.

7.2 The Promoter reserves the right, in the event of unfair play or abuse of the game, to unfair or abusive play, it may suspend or cancel the game or exclude the Entrant who has committed such abuse from the from the game.

8. Who is excluded from the game

8.1. 8:1 § (1)1 of the Civil Code).

8.2 Other direct contributors to the running of the game and their close relatives are also not allowed to participate.

9. Exclusion of liability

9.1 The Promoter shall not be liable for any direct or indirect damages resulting from participation in the game or from the loss of internet service outside its control. The Promoter shall not be held liable for any other technical failures beyond its control.

9.2 The Promoter shall not be held liable for the consequences of any conduct or breach of the rules described in Clause 10, in particular for any events related to the provision of false information by the Entrants, the conduct of the Entrants, or the breach of the rules of the Competition by the Entrant.

10. Exclusion from the game

10.1 In the event of a breach of the rules, the Promoter reserves the right to disqualify the offending Entrant from the game without prior notice. Any person who uses unauthorised tools (e.g. hacking software, viruses, Trojan horses, etc.) or other manipulation to gain an unauthorised advantage or in any way interfere with the operation of the IT system operated by the Promoter will be disqualified. Any person placing an order on behalf of a third party (with or without the knowledge of that third party) may also be excluded from the game.

10.2 In particular, the Promoter may disqualify any Entrant who misleads other Entrants in any way by providing false information in relation to the Competition.

10.3 The use of sweepstakes associations, automated service providers and especially professional sweepstakes services is prohibited. Any breach of this rule may also result in the disqualification of the Entrant.

11. Other conditions and expenses related to the prize

11.1 The prize is not redeemable for cash. The winning Winner shall not be liable to pay any taxes on the prize. The Organiser shall assess and pay the tax liabilities arising from the prize to the tax authorities.

11.2 Any additional costs and expenses incurred by the Winning Entrant in connection with the use of the Prize shall be borne by the Winning Entrant.

11.3 The Promoter accepts no responsibility or liability whatsoever for any misrepresentation/incompleteness of information in the course of the data reconciliation process for the receipt of the prize and shall not be obliged to enter into any correspondence in this regard.

11.4 The Promoter reserves the right to change or withdraw the game without notice in the event of force majeure (war, earthquake, disaster, strike, unexpected epidemic restrictions or similar unforeseen event).

11.5 The Promoter will not accept any complaints regarding the prize draw for a period of 60 days after the end of the prize draw.

11.6. For more information, please contact gallmet@gallmet.hu.

12. Data protection

See the privacy notice for the competition.

2 June 2025.
GALLMED Kft.

DATA MANAGEMENT INFORMATION for the buy and travel competition

1. Data Controller

GALLMED Industrial, Commercial and Service Limited Liability Company

Abbreviated name: GALLMED Kft.
Company registration number: 03-09-121132
Tax number: 22999489-2-03
(head office: 6500 Baja, Dózsa György út 25-27., Hungary)
Postal address: Hungary, 6500 Baja, Dózsa György út 25-27.
E-mail address: gallmed@gallmed.hu

(hereinafter referred to as the "Data Controller").

2. Legislation applicable to data processing, scope of the information notice

2.1 The Data Controller provides its services from Hungary. Accordingly, Hungarian and European law shall apply to the provision of the service and to the processing of personal data of the Data Subjects in the course of using the service. The following legislation shall apply to the activities of the Controller in relation to the processing of personal data:

- REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (The EU General Data Protection Regulation), (hereinafter referred to as GDPR),

- Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (hereinafter referred to as the "Infotv."),

- Act CVIII of 2001 on certain aspects of electronic commerce services and information society services (hereinafter referred to as the "Act on electronic commerce services") and

- Act V of 2013 on the Civil Code (hereinafter: Civil Code).

2.2. The scope of this notice is limited to https://gallmet.hu/ on the website (the "Website"), relates to the processing of data in the course of participation in a prize draw advertised on the Website (the "Website").

2.3. For the purposes of this Notice, the Data Subject is the natural person participating in the prize draw (hereinafter referred to as

2.4 The dates and times specified in the Prospectus are to be understood as working days in Hungary.

3. Data processing related to the prize draw

3.1. The data subjects concerned by the processing are the Data Subjects who are https://shop.gallmet.hu/en/ buy a product advertised on the website
by fulfilling the specific conditions set out in the rules of the competition within the period specified for the competition. The rules of the game are available on the website during the period for participation in the game.

3.2 Legal basis for processing: processing necessary for the provision of the service pursuant to Article 6(1)(b) of the GDPR.

For the purposes of the payment of the taxes and levies related to the prize by the Data Controller, the data referred to in the following point are processed by the Data Controller pursuant to Article 6(1)(c) of the GDPR in order to fulfil a legal obligation to which the Data Controller is subject.

The Data Subject is required to provide the necessary data in order to participate in the prize draw. Failure to do so will result in the Data Subject being ineligible to enter the prize draw and the winner not being able to collect their prize.

If the Data Subject gives his or her express consent, the photograph of himself or herself and of the prize will be published in accordance with Article 6(1)(a) of the GDPR and Article 2:48(1) of the Civil Code.

3.3. Scope of data processed:
- surname,
- first name,
- e-mail address,
- order ID.

In the case of the winning Data Subject, the following data of the Data Subject will also be processed:
- the object of the prize,
- with his or her specific consent, his or her likeness in a photograph of him or her and the conclusions that can be drawn from it.

The following data of the winning Data Subject will be published:
- is the first letter of his surname,
- first name,
- the object of the prize,
- a photograph taken of him or her with his or her express consent.

In relation to the payment of taxes and contributions in connection with the prize, the winner is the Affected Person:
- name,
- mother's name,
- your nationality,
- place and date of birth,
- Social security number,
- tax identification number,
- postacíme.

3.4.Purpose of data management: database management related to the sweepstakes for the purpose of running the game, as well as the online publication of the winner for the purpose of promoting the Data Controller and increasing its visibility. The purpose of the processing of the personal data and contact details of the Data Subject who voluntarily provides them is to enable the Data Subject concerned to participate in the prize draw advertised on the website, in accordance with the rules of the game, to draw the prize in accordance with the rules of the game, to coordinate the delivery of the prize in the event of a win and to deliver the prize.

The publication is made on the website operated by the Data Controller https://www.facebook.com/gallmet/ and the https://www.instagram.com/gallmet/ on social networking sites, and https://gallmet.hu/ will take place on the website.

The purpose of processing the data processed for the payment of taxes and contributions related to the prize is to comply with the provisions of Art. 50, paragraphs (1) and (2) (tax and contribution returns) and Article 169, paragraph (2) (retention of supporting documents) of the Act on Accounting.

3.5 Duration of data processing: lasts for 60 days from the end of the monthly prize draw in question, with the publication of the winner's data lasting up to one year from the date of publication. After that, the data will be deleted.

In order to comply with the legal obligation (to keep the supporting documents) set out in Section 169 (2) of the Act on Accounting, the Data Controller shall keep the data processed for the payment of taxes and contributions related to the prize for 8 years from the date of their creation.

3.6.Method of storage of data: electronically, in a separate file for each purpose in the Data Controller's IT system, and in the electronic storage of the published photograph, the winner's first name and surname on the Facebook and Instagram social networking sites and on the https://gallmet.hu/ website.

4. Processing of data related to the receipt and response to a message

4.1.Data subjects concerned by the processing: data subjects sending messages to the Data Controller by e-mail using the e-mail address gallmet@gallmet.hu.

4.2 Legal basis for processing: the data subject's consent pursuant to Article 6(1)(a) of the GDPR. The data subject gives his/her consent by sending the e-mail.

You have the right to withdraw your consent at any time. Withdrawal of consent shall not affect the lawfulness of the processing carried out prior to the withdrawal. If the Data Subject withdraws his or her consent before responding to the message, the Data Controller will not continue the exchange of messages, will not respond to the questions previously asked, as it will have to delete the data processed on the basis of the consent.

4.3. Scope of data processed:

The Affected Party sending the message:
- name,
- your e-mail address,
- subject of the e-mail,
- the content of the message.

4.4. Purpose of processing: to enable the exchange of messages with the Data Controller.

4.5 Duration of processing: until the message is answered or the Data Subject's request is fulfilled. The Data Controller shall delete the data processed for this purpose after the reply to the message/fulfilment of the request. If the exchange of information takes place through several messages on related subjects, the Data Controller will delete the data once the exchange of information has been completed or the request has been fulfilled.

Messages with relevant content related to the sweepstakes and sent by a Data Subject who is a participant in the sweepstakes will be deleted by the Data Controller after 60 days following the end of the monthly sweepstakes.

Where the content of the messages may form the basis of a civil law claim, for example on the subject of entitlement to a prize, the Data Controller will store such messages until the expiry of the general limitation period in civil law, i.e. 5 years after the conclusion of the transaction.

4.6.Method of storage of data: electronically, in a separate file in the Data Controller's IT system.

5. Other data processing on the website

For details of other data processing on the website, please see the Cookie Notice on the website.

6. Recipients (data processors)

The Data Controller uses the following entities as data processors.

6.1. The website hosting provider and website developer used to host the game

6.1.1. Data subjects concerned by the processing: natural persons participating in the game.

6.1.2. The Data Controller uses as data processors the following

Unas Online Limited Liability Company
Abbreviated name: Unas Online Kft.
Company registration number: 08-09-015594
Tax number: 14114113-2-08
Head office: 9400 Sopron, Kőszegi út 14.
Postal address: 9400 Sopron, Kőszegi út 14.
Telephone: +36 99 200 200
E-mail: unas@unas.hu
Website: https://unas.hu/

as the web hosting provider and the website developer (hereinafter referred to as the "Data Processor").

6.1.3.Scope of data processing: the data processing concerns the data indicated in this notice.

6.1.4 The purpose of using a data processor: to ensure the operation of the website in the information technology sense, by providing the necessary electronic hosting and software.

6.1.5.Nature of processing: electronic processing, the processing of data only involves the provision of electronic storage space and software necessary for the IT operation of the website.

6.2. Processing of data related to prize draws

6.2.1. Data subjects concerned by the processing: the Data Subjects participating in the prize draw.

6.2.2.2 The Data Controller uses as a data processor the

Microsoft Ireland Operations Limited short name: Microsoft Ireland Ltd.
company registration number: 256796
Community tax number: IE8256796U
Location: 70 Sir Rogerson's Quay, Dublin 2, Ireland
postacím: One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland
Contact: https://www.microsoft.com/hu-HU/concern/privacy/
telephone: +1 800 710 200

as the developer of the software used for the lottery draw (hereinafter:
Data Processor).

6.2.3. Scope of the data processing: the processing of the name of the Data Subject participating in the sweepstakes

6.2.4. Purpose of using a data processor: to provide the software used to draw the winner.

6.2.5. Nature of data processing: electronic.

6.3. Processing of data related to the technical conditions of publication on an online community site

6.3.1. Data subjects concerned by the processing: the winner of the competition.

6.3.2. The Data Controller will use as a data processor:

Meta PlatformsIreland Ltd.(Facebook, Instagram)

Company registration number: 462932
Tax number: IE 9692928F
Location:Merrion Road, Dublin 4, D04 X2K5, Ireland
Postal address: Merrion Road, Dublin 4, D04 X2K5, Ireland
Telephone: +001 650 543 4800
Message:https://facebook.com/help/contact/540977946302970
Website:https://www.facebook.com/privacy/explanation

as the operator of the social networking sites Facebook and Instagram,

(hereinafter referred to as "Processor").

6.3.3.3.Scope of data processing: the data processing concerns the first initial of the winner's surname, first name, the designation of the prize of the Data Subject and the photograph of the Data Subject and the prize.

6.3.4 The purpose of the data processing: to ensure the operation of the Community site in the information technology sense and its publication by the Data Controller, including the provision of storage space necessary for the storage of the content of the Community site.

6.3.5.Nature of processing: processing is carried out electronically, and the processing of data consists solely of technical operations related to the operation and use of the Community Site, in particular the storage and retrieval of data and the operation of the Community Site.

6.4 The Data Controller does not use any other processor than the Data Processors indicated in the present Prospectus and does not transfer personal data to any other Recipients. If necessary in judicial or other official proceedings, the Data Controller shall provide the necessary personal data at the request of the competent authority.

7. Data protection, data security

7.1 The Data Controller shall ensure the security of the data in its data management activities, and shall ensure the enforcement of the law and other data protection and confidentiality rules by technical and organisational measures and internal rules of procedure. In particular, it shall take appropriate measures to protect the processed data against unauthorised access, alteration, disclosure, disclosure, deletion or destruction, accidental destruction or accidental damage and against inaccessibility resulting from changes in the technology used.

7.2 Data will be processed only for the legitimate purposes described in this notice and only to the extent necessary and proportionate for those purposes, in accordance with applicable laws and recommendations, and with appropriate security measures.

7.3 To this end, the Data Controller uses the http protocol "https" to access the website, which allows web communication to be encrypted and uniquely identified. In addition, as described above, the Data Controller stores the processed data in encrypted data files, which are stored in separate processing lists for each processing purpose, to which access is granted to specific employees of the Data Controller, who are responsible for the protection of the data and for their responsible processing in accordance with this Policy and the applicable laws.

7.4 The Data Controller shall enter into a binding data processing contract with the data processors it uses in order to comply with the applicable legislation and to guarantee an adequate level of data security.

8. Data subject's rights in relation to data processing

8.1. Right to information

8.1.1 The Data Subject may at any time obtain information about the processing by reading this Privacy Notice. At the Data Subject's request, oral information may also be provided, provided that the identity of the Data Subject has been verified by other means. The Data Subject may request information during and after the period of his or her involvement in the processing. The information shall also cover all relevant details of the processing and the way in which the Data Subject exercises his or her rights. Upon request, the Data Controller shall also inform the Data Subject of the measures taken on the basis of the Data Subject's requests, or the reasons for not taking such measures, indicating the forums available for lodging a complaint.

8.1.2 Provision of information is free of charge. If the Data Subject's request is manifestly unfounded or excessive, in particular because of its repetitive nature, the Data Controller shall, taking into account the administrative costs of providing the information or information requested or of taking the requested action:
a) charge a reasonable fee; or
(b) refuse to act on the request.

8.1.3 The Data Controller shall provide the information as soon as possible (without undue delay) after the request is made, but no later than one month.

8.2. Right of access

8.2.1 The Data Subject has the right to access the data processed about him/her. In the event of such a request, the Controller shall inform the Data Subject whether or not his or her personal data are being processed and of all relevant circumstances relating to the specific processing.

8.2.2 Under the right of access, the Data Subject may request a copy of his or her personal data processed by the Controller, which the Controller shall provide to him or her free of charge on the first occasion. For subsequent copies, the Controller may charge a reasonable fee based on administrative costs.

8.2.3 The Controller shall provide the copy in a commonly used electronic format, unless the Data Subject requests otherwise.

8.2.4. The Data Controller shall provide access as described above as soon as possible (without undue delay) after the request is made, but no later than one month.

8.3 Right to rectification

8.3.1 The Data Subject shall have the right to have inaccurate personal data concerning him or her corrected by the Data Controller without undue delay upon his or her request.

8.3.2.Taking into account the purpose of the processing, the Data Subject has the right to request the completion of incomplete personal data, including by means of a supplementary declaration.

8.3.3 At the request of the Data Subject, the Data Controller shall correct or, where justified, supplement inaccurate personal data concerning him or her without undue delay.

8.4. Right to erasure

8.4.1.The Data Subject shall have the right to obtain from the Data Controller the erasure of personal data relating to him or her without undue delay, and the Data Controller shall be obliged to erase personal data relating to the Data Subject without undue delay, if one of the following grounds applies:
(a) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
b) the Data Subject withdraws the consent on which the processing is based and there is no other legal basis for the processing;
c) the Data Subject objects to the processing and there are no overriding legitimate grounds for the processing;
d) the personal data have been unlawfully processed;
(e) the personal data are subject to a legal obligation under European Union or Member State law applicable to the controller
must be deleted in order to be fulfilled.

8.4.2 The Data Controller is not obliged to delete data necessary for the establishment, exercise or defence of legal claims, even if the Data Subject so requests, nor is the Data Controller obliged to delete data whose processing is necessary for the protection of the vital interests of the Data Subject or of another natural person or for compliance with an obligation under Union or Member State law applicable to the Data Controller. However, the Data Controller shall, in principle, delete the data without request after the retention period has expired.

8.5. Right to restriction of processing

8.5.1 At the request of the Data Subject, the Controller shall restrict the processing if one of the following conditions is met:

(a) the Data Subject contests the accuracy of the personal data, in which case the restriction applies for the period of time necessary to allow the Controller to verify the accuracy of the personal data;
(b) the processing is unlawful and the Data Subject opposes the erasure of the data and requests instead the restriction of their use;
(c) the Controller no longer needs the personal data for the purposes of processing, but the Data Subject requires them for the establishment, exercise or defence of legal claims;
(d) the Data Subject has objected to the processing; in this case, the restriction shall apply for the period until it is established whether the legitimate interests of the Controller prevail over the legitimate interests of the Data Subject;

8.5.2 If the processing is restricted, such personal data shall be processed by the Data Controller only with the consent of the Data Subject, except for storage, or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for important public interests of the European Union or of a Member State.

8.5.3 The Data Controller shall inform the Data Subject who has contested the accuracy of the personal data and on this basis the processing has been restricted, in advance of the lifting of the restriction of processing.

8.6 Obligation to notify the rectification or erasure of personal data or the restriction of processing

The Data Controller shall notify the Data Subject and all recipients to whom the data were previously disclosed of the rectification, restriction or erasure. Notification may be omitted if it proves impossible or involves a disproportionate effort. Upon request, the Data Subject shall be informed by the Controller of those recipients.

8.7 Right to data portability

8.7.1 The Data Subject shall have the right to receive personal data concerning him or her which he or she has provided to the Controller in a structured, commonly used, machine-readable format, and the right to transmit such data to another controller without hindrance from the controller to which he or she has provided the personal data, if:
(a) the processing is based on the consent of the Data Subject or on a contract concluded with him or her; and
(b) the processing is carried out by automated means.

8.7.2 In exercising the right to data portability as set out above, the Data Subject has the right to request, where technically feasible, the direct transfer of personal data between data controllers.

8.8 Right to object

8.8.1 Data Subjects may object to the processing of their personal data based on legitimate interests at any time on grounds relating to their particular situation.

8.8.2. In this case, the Data Controller may continue to process the personal data only if it proves that the processing is justified by compelling legitimate grounds which override the interests, rights and freedoms of the Data Subject or are related to the establishment, exercise or defence of legal claims.

9. Complying with the data subject's requests

9.1 The Controller shall provide the information and take the measures referred to in point 8 free of charge. If the Data Subject's request is manifestly unfounded or excessive, in particular because of its repetitive nature, the Data Controller shall, taking into account the administrative costs of providing the requested information or information or of taking the requested action:
a) charge a reasonable fee; or
(b) refuse to act on the request.

9.2 The Data Controller shall inform the Data Subject of the measures taken in response to the request, including the provision of copies of the data, without undue delay and at the latest within one month of receipt of the request. If necessary, taking into account the complexity of the request and the number of requests, this time limit may be extended by a further two months. The Data Controller shall inform the Data Subject of the extension of the time limit within one month of receipt of the request, stating the reasons for the delay. If the Data Subject has made the request by electronic means, the information shall be provided by the Data Controller by electronic means, unless the Data Subject requests otherwise.

9.3 If the Data Controller does not take action on the Data Subject's request, the Data Controller shall inform the Data Subject without delay, but no later than one month from the date of receipt of the request, of the reasons for the failure to take action and of the possibility for the Data Subject to lodge a complaint with the supervisory authority indicated in point 10.2 and to exercise his/her right to judicial remedy as provided for in the same point.

9.4. The data subject may submit his/her requests to the Data Controller by any means that allows the identification of the data subject. The identification of the Data Subject submitting the request is necessary because the Data Controller can only execute requests to those entitled to do so. If the Data Controller has reasonable doubts about the identity of the natural person submitting the request, it may request additional information necessary to confirm the identity of the Data Subject.

9.5 If the Data Subject wishes to submit his or her request by post, he or she may send it to the address at 6500 Baja, Dózsa Gyögy út 25-27., or electronically by e-mail to the following e-mail address: gallmed@gallmed.hu
A request sent by e-mail shall be considered as authentic by the Data Controller only if it is sent from the e-mail address provided by the Data Subject to the Data Controller and registered with the Data Controller, but the use of a different e-mail address shall not constitute a valid request.
ignoring. In the case of e-mail, the date of receipt shall be deemed to be the first working day following the date of dispatch.

10. Enforcement

10.1 Any complaint by the data subject regarding the processing of his or her data may be addressed to the Data Controller, in particular by contacting:

GALLMED Kft.
E-mail address: gallmed@gallmed.hu
Postal address: Hungary, 6500 Baja, Dózsa György út 25-27.

10.2. You may exercise your rights before the courts and may also apply to the National Authority for Data Protection and Freedom of Information:

National Authority for Data Protection and Freedom of Information

Address: Hungary, 1055 Budapest, Falk Miksa utca 9-11.
Postal address: Hungary, 1363 Budapest, Pf. 9.
Telephone: +36 1 391 1400
Fax: +36 1 391 1410
E-mail: ugyfelszolgalat@naih.hu
Website:https://www.naih.hu/

In the event of a court proceeding, the lawsuit may also be brought in the court of the place of residence or domicile of the Data Subject, at the choice of the Data Subject.

02 June 2025.