Data protection, data transfer and data management information

12. Remarketing
Remarketing allows the Server to display advertisements to people who have previously visited its website or provided their email address.
Personal data processed: e-mail address, purchase data.
The purpose of the processing: to show ads to previous users on Facebook and Google.
Legal basis for processing: the legitimate interest of the Service Provider (direct marketing). The user's e-mail address is transferred to the Service Provider when subscribing to the newsletter, based on the subscriber's consent. This means that the Data Controller also processes the e-mail address provided for purposes other than the purpose of data collection (sending the newsletter) (remarketing).
Duration of processing: the data subject has the right to object at any time to the processing of personal data concerning him or her for remarketing purposes. If the user withdraws his/her consent to receive the newsletter (which he/she is entitled to do at any time), the processing of his/her data for remarketing purposes will also cease. In order to ensure that the storage of personal data is limited to the necessary period, the controller will delete personal data without the need to object or withdraw consent after 1 year from the date of the last newsletter.
Recipients: the relevant employees of the Service Provider, as data processors:

• Facebook Ireland Ltd. (Address: 4 Grand Canal square, Grand Canal Harbour, D2 Dublin, Ireland; Facebook Ads),
• Google Inc. (Address: 1600 Amphitheatre Pkwy, Mountain View, California 94043, USA) (Google AdWords),

who, as data processors, display the advertisement to their registered users who have opted in to receive personalised ads on Facebook or Google. The European Union has a compliance decision with the US.

13. Direct marketing

13. Newsletter subscription
Personal data processed: name, email address.
The purpose of the data processing: to provide the subscriber with information about products and promotions on the www.gallmet.hu website.
Legal basis for processing: the data subject's voluntary consent.
Duration of processing: until consent is withdrawn.
Recipients: the relevant employees of the Service Provider, as well as data processors:
The Rocket Science Group, LLC (675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308 USA), Privacy Policy: https://mailchimp.com/legal/privacy/
MailerLite Limited (Ground Floor, 71 Lower Baggot Street, Dublin 2, D02 P593, Ireland), Privacy Policy: https://www.mailerlite.com/legal/privacy-policy

13.2. Telemarketing subscription
The personal data processed: name, telephone number.
The purpose of the data processing: to provide the subscriber with information about products and promotions on the www.gallmet.hu website.
Legal basis for processing: the data subject's voluntary consent.
Duration of processing: until consent is withdrawn.
Recipients: the relevant employees of the Service Provider, as well as data processors:
MailerLite Limited (Ground Floor, 71 Lower Baggot Street, Dublin 2, D02 P593, Ireland), Privacy Policy: https://www.mailerlite.com/legal/privacy-policy

14. Other
We inform the visitors of the Website that the court, the prosecutor's office, the investigating authority, the administrative authority, the National Authority for Data Protection and Freedom of Information, or other bodies may request the Data Controller to provide information, to disclose or transfer data, or to provide documents.
The Data Controller shall disclose to public authorities, where the public authority has indicated the precise purpose and scope of the data, only such personal data as are strictly necessary for the purpose of the request and to the extent strictly necessary for the purpose of the request.

15. Rights of visitors and users of the Website in relation to data management
You may request free of charge information on the details of the processing of your personal data, as well as request the rectification, erasure, restriction of processing and object to the processing of such personal data. The Data Controller shall inform any recipient (data processor) to whom or with whom the personal data have been disclosed of the rectification, erasure or restriction of processing, unless this proves impossible or involves a disproportionate effort. We will inform you of these recipients upon request.
The Data Controller shall inform you of the action taken on the request under points (a) to (f) below without undue delay and in any event within one month of receipt of the request. If necessary, taking into account the complexity of the request and the number of requests, this time limit may be extended by a further two months. The Data Controller shall inform you of the extension, stating the reasons for the delay, within one month of receipt of the request.
If you have submitted the request electronically, the Controller will provide the information electronically, unless you request otherwise.
If the Data Controller does not take action on your request, it will inform you without delay and at the latest within one month of receipt of the request of the reasons for the failure to act and of your right to lodge a complaint with a supervisory authority and to seek judicial remedy.

16. Right of access: you have the right to obtain feedback from the Data Controller on whether your personal data are being processed and, if such processing is ongoing, you have the right to access your personal data and the following information: the purposes of the processing, the categories of personal data concerned, the data processors, the duration of the processing, if the data have not been collected by the Data Controller from you, any available information on their source.

17. Right to rectification: you have the right to have inaccurate personal data relating to you corrected by the Data Controller without undue delay at your request. Taking into account the purpose of the processing, you have the right to request the completion of incomplete personal data.

18. Right to erasure: you have the right to obtain from the Data Controller the erasure of personal data concerning you without undue delay, and the Data Controller is obliged to erase personal data concerning you without undue delay when the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; withdraw your consent if there is no other legal basis for the processing; object to the processing if the personal data have been unlawfully processed; erase the personal data in order to comply with a legal obligation under Union or Member State law to which the Controller is subject.

19. Right to object: you have the right to object at any time to the processing of your personal data based on the legitimate interests of the Controller. In such a case, the Controller may no longer process the personal data unless you can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims. Where personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such purposes, including profiling, where it is related to direct marketing.

20. Right to restriction of processing: you have the right to have the Controller restrict processing at your request if:
- you contest the accuracy of the personal data
- the processing is unlawful
- the Controller no longer needs the personal data for the purposes of processing, but you require them for the establishment, exercise or defence of legal claims
- you have objected to the processing.
If the processing is restricted, such personal data, except for storage, may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for important public interests of the Union or of a Member State.

21. Method of storage of personal data, security of processing
The Data Controller's servers are operated and maintained by a contracted company in case of problems:

• Center Webhost Kft. (1173 Budapest, Borsó utca 12-32. C. lház. 1. floor 2.), data management information: https://cweb.hu/adatkezelesi-tajekoztato/
• QUIC Cloud Inc., 150 Allen Rd. Suite 204, Basking Ridge, NJ 07920, USA (hereinafter "QUIC Cloud"):
  QUIC Cloud provides an extensive worldwide Content Delivery Network (CDN) with DNS service. This technically involves the transmission of information (data) between your browser and our website via the QUIC Cloud network. This allows QUIC Cloud to transfer information between your browser and our website.
  to analyse traffic between our servers and potentially malicious traffic on the internet. In doing so, we may use cookies or other technological means to repeatedly recognise Internet users, but only for the purposes described here.
  The use of the QUIC Cloud service is based on the fault-free and secure availability of our website.
  For more information about security and privacy at QUIC Cloud, please click here: https://quic.cloud/privacy-policy/.

The Data Controller shall implement appropriate technical and organisational measures to ensure a level of data security appropriate to the level of risk, taking into account the state of the art and the cost of implementation, the nature, scope, context and purposes of the processing and the varying likelihood and severity of the risk to the rights and freedoms of natural persons.
The Data Controller shall take appropriate measures to protect the data against, in particular, unauthorised access, alteration, disclosure, disclosure, deletion or destruction, accidental destruction, damage or loss, and inaccessibility resulting from changes in the technology used.
The Data Controller's IT systems and network are protected against computer fraud, espionage, sabotage, vandalism, fire and flood, computer viruses, computer intrusions and attacks that could lead to denial of service. The Data Controller ensures security through server-level and application-level protection procedures.
Electronic messages transmitted over the Internet, regardless of the protocol (e-mail, web, ftp, etc.) are vulnerable to network threats that could lead to fraudulent activity, contract disputes or the disclosure or modification of information. The Data Controller will take all reasonable precautions to protect against such threats. It monitors systems in order to record and provide evidence of any security incidents. System monitoring also allows the effectiveness of the precautions taken to be checked.
The Data Controller shall keep a record of any data breaches, indicating the facts relating to the data breach, its effects and the measures taken to remedy it.

22. Complaints
If you believe that the processing of personal data concerning you infringes the legal provisions on data protection, you have the right to take the Controller to court and to lodge a complaint with the supervisory authority.
Supervisory authority: the National Authority for Data Protection and Freedom of Information
head office: 1125 Budapest, Szilágyi Erzsébet fasor 22/C.
postal address: 1530 Budapest, P.O. Box: 5.
phone: +36 1 391-1400
fax: +36 1 391-1410
E-mail address: ugyfelszolgalat@naih.hu
Website: https://naih.hu/about-the-authority