Privacy policy

1. Introduction

Singer-Komjáti Mária e.v. (hereinafter: Singer-Komjáti Mária e.v., the service provider, the data controller, the Company), as data controller, acknowledges the content of this legal notice as binding upon itself.
The Company undertakes to ensure that all data processing related to its activities complies with the requirements set out in this policy and in the applicable legislation.
Singer-Komjáti Mária e.v. is the operator of the skmcakes.hu website.

Singer-Komjáti Mária e.v. reserves the right to amend this notice at any time. Naturally, it will inform its audience of any changes in due time.

Singer-Komjáti Mária e.v. is committed to protecting the personal data of its clients and partners and attaches particular importance to respecting its clients' right to informational self-determination. The Data Controller treats personal data confidentially and takes all security, technical and organisational measures that guarantee the security of the data.

Singer-Komjáti Mária e.v. sets out below its data processing principles and presents the requirements it has established for itself as data controller and complies with. Its data processing principles are in line with the applicable data protection legislation, in particular the following:

  • Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (2011. évi CXII. törvény);
  • Act V of 2013 on the Civil Code (2013. évi V. törvény – Ptk.);
  • Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities (2008. évi XLVIII. törvény – Grt.).
  • Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services (2001. évi CVIII. törvény – Ekertv.);
  • Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: “GDPR”)

2. Definitions

  • data subject: any natural person who is identified, or who can be identified, directly or indirectly, on the basis of specific personal data;
  • personal data: data that can be associated with the data subject – in particular the data subject's name, identification number, and one or more pieces of information characteristic of his or her physical, physiological, mental, economic, cultural or social identity – as well as any inference drawn from such data concerning the data subject;
  • consent: a voluntary and explicit expression of the data subject's wishes, based on adequate information, by which he or she gives unambiguous agreement to the processing of personal data relating to him or her, either in full or for specific operations;
  • data controller: the natural or legal person, or organisation without legal personality, which, alone or jointly with others, determines the purposes of the processing of data, makes and implements decisions concerning the processing (including the means used), or has them implemented by a data processor;
  • data processing: any operation or set of operations performed on data, irrespective of the procedure applied, in particular collection, recording, registration, organisation, storage, alteration, use, retrieval, transfer, disclosure, alignment or combination, blocking, erasure and destruction, as well as preventing the further use of the data, taking photographs, sound or video recordings, and recording physical characteristics suitable for identifying a person (e.g. fingerprints or palm prints, DNA samples, iris images);
  • data transfer: making data accessible to a specific third party;
  • disclosure: making data accessible to anyone;
  • erasure of data: rendering data unrecognisable in such a way that its restoration is no longer possible;
  • technical data processing: the performance of technical tasks related to data processing operations, irrespective of the method and means used to carry out the operations and of the place of application, provided that the technical task is performed on the data;
  • data processor: the natural or legal person, or organisation without legal personality, which processes data on the basis of a contract – including a contract concluded pursuant to a provision of law.

3. Company details

Our company details and contact information are as follows:

  • Name: Singer-Komjáti Mária e.v.
  • Postal address: 1213 Budapest, Csalitos út 65.
  • Registration number: 60266828
  • Tax number: 90913705-1-43
  • Phone: +36705026643
  • E-mail: hello@skmcakes.hu
  • Representative of the data controller: Singer-Komjáti Mária e.v.

4. Scope of personal data, purpose, legal basis and duration of data processing

We draw the attention of those providing data to Singer-Komjáti Mária EV to the fact that, if they provide personal data other than their own, it is the obligation of the data provider to obtain the consent of the data subject. The data controller is not obliged to verify the existence of such consent. The data controller draws the partner's attention to the fact that if the partner fails to comply with this obligation and the data subject consequently enforces a claim against the data controller, the data controller may pass on the enforced claim and the amount of any related damage to the partner.

We provide the following information in connection with our individual data processing activities.

4.1. Requests for quotation and enquiries by direct contact

Interested parties may contact our Company directly by e-mail sent to the Company's address or by telephone.

  • Purpose of the data processing: maintaining contact, facilitating communication between the data subject and our Company, and ensuring the closest and most effective cooperation possible.
  • Legal basis of the data processing: legitimate interest – Article 6(1)(f) GDPR
  • Scope of personal data processed: name of the person requesting the quotation/contact person; e-mail address, telephone number and any other information provided by the data subject,
  • Duration of the data processing: for 3 years following the expiry of the validity period of the quotation, or until the data subject objects
  • Recipients of the personal data: The data controller does not transfer the data obtained to third parties, with the exception of the data processor(s) specified in Section 7. The recorded data may be accessed only by the employees of the Data Controller and the designated staff of the data processor(s).
  • Description of the legitimate interest: our Company's legitimate interest is the processing of the data subject's data for the purpose of direct marketing
  • Data subjects concerned: partners and data subjects who enquire directly (e.g. by e-mail or telephone) about the Company's services.

4.2. Requests for quotation and enquiries via the website (skm-cakes.hu)

Our company enables data subjects to request quotations electronically.

  • Purpose of the data processing: maintaining contact, facilitating communication between the data subject and our Company, and ensuring the closest and most effective cooperation possible.
  • Legal basis of the data processing: the voluntary consent of the data subject – Article 6(1)(a) GDPR.
  • Scope of personal data processed: name of the enquirer (first name, surname); e-mail address, telephone number, company name and any other information provided by the data subject.
  • Duration of the data processing: for 3 years following the expiry of the validity period of the quotation, or until consent is withdrawn.
  • Recipients of the personal data: The data controller does not transfer the data obtained to third parties, with the exception of the data processor(s) specified in Section 7. The recorded data may be accessed only by the employees of the Data Controller and the designated staff of the data processor(s).
  • Data subjects concerned: partners and data subjects who enquire via the website about the Company's services and products.

4.3. Data processing related to the follow-up of requests for quotation

  • Purpose of the data processing: the legitimate interest of the data controller in keeping records of the data subject's data beyond the validity period of the quotation for the purpose of direct marketing
  • Legal basis of the data processing: legitimate interest of the data controller, Article 6(1)(f) GDPR,
  • Scope of personal data processed: contact person's surname and first name; telephone number; e-mail address
  • Recipients of the personal data: The data controller does not transfer the data obtained to third parties, with the exception of the data processor(s) specified in Section 7. The recorded data may be accessed only by the employees of the Data Controller and the designated staff of the data processor(s).
  • Duration of the data processing: until the data subject objects
  • Description of the legitimate interest: establishing business relationships with partners and persons requesting quotations, and providing accurate information to data subjects. Our Company's legitimate interest is the processing of the data subject's data for the purpose of direct marketing
  • Data subjects concerned: the addressees of quotations previously issued by the Company and the contact person(s) named therein.

4.4. Newsletter subscription

  • Purpose of the data processing: sending e-mail newsletters, which may also contain commercial advertising, to interested parties, and providing information on current news
  • Legal basis of the data processing: the prior, voluntary consent of the data subject, Article 6(1)(a) GDPR,
  • Scope of personal data processed: name, e-mail address
  • Duration of the data processing: until the voluntary consent is withdrawn or until unsubscribing from the newsletter. Our Company processes the data provided by the data subject until consent is withdrawn. Upon withdrawal of consent, the processed data will be deleted from our newsletter database within 7 days at the latest, and we will not send you any further newsletters.
  • Recipients of the personal data: The data controller does not transfer the data obtained to third parties, with the exception of the data processor(s) specified in Section 7. The recorded data may be accessed only by the employees of the Data Controller and the designated staff of the data processor(s). You may unsubscribe from the newsletter at any time by sending a message to our Company at hello@skmcakes.hu, or by clicking the unsubscribe icon in the newsletter.
  • Data subjects concerned: partners and data subjects who subscribe to the Company's electronic newsletter.

4.5. Newsletter data (for newsletter subscriptions registered before 25 May 2018)

  • Purpose of the data processing: sending e-mail newsletters, which may also contain commercial advertising, to interested parties, and providing information on current news
  • Legal basis of the data processing: legitimate interest of the data controller, Article 6(1)(f) GDPR,
  • Scope of personal data processed: name, e-mail address
  • Duration of the data processing: until the data subject objects
  • Description of the legitimate interest: providing data subjects who have subscribed to the newsletter with information that may also contain commercial advertising and business offers. Our Company's legitimate interest is the processing of the data subject's data for the purpose of direct marketing.
  • Recipients of the personal data: the data controller does not transfer the data obtained to third parties, with the exception of the data processor(s) specified in Section 7. The recorded data may be accessed only by the employees of the Data Controller and the designated staff of the data processor(s). You may unsubscribe from the newsletter at any time by sending a message to our Company at hello@skmcakes.hu, or by clicking the unsubscribe icon in the newsletter.
  • Data subjects concerned: partners and data subjects who subscribed to the Company's electronic newsletter before 25 May 2018.

4.6. Camera surveillance system

Cameras are operated on the premises operated by the data controller for the protection of the personal safety and property of data subjects and for other purposes. Data subjects are informed of their operation by notice signs. The activities related to the operation of the camera system are set out in the premises' “Information Notice on Data Processing by Security Cameras”, which is available on the premises.

4.7. Data processing related to ensuring the operation of information technology services

  • Purpose of the data processing: Singer-Komjáti Mária EV may use so-called "cookies" (temporary markers) on its websites, which enable faster access to them. "Cookies" means an item of information that is active only during an individual client session and that is placed on the Client's computer by the website for the purpose of faster identification. The Client may at any time request that cookies be disabled by changing the browser settings; however, disabling them may slow down or prevent access to certain parts of the site and the use of certain functions.
    The session cookies used avoid the need to resort to other IT tools that are potentially harmful to the confidentiality of clients' navigation, and they do not allow the acquisition of identifying personal data.
    The user can delete cookies from his or her own computer or disable the use of cookies in the browser. Cookies can generally be managed in the Tools/Settings menu of browsers, under the Privacy settings, under the name cookie.
  • Legal basis of the data processing: the voluntary consent of the data subject (User), Article 6(1)(a) GDPR.
    The User gives voluntary consent to the data processing by accepting the notice and declaration that pops up when starting to browse the website, or by continuing to browse.
    Scope of personal data processed: information technology data processing covers the data necessary for the operation of the “cookies” used to operate the website and for the use of the log files applied by the web hosting provider.
  • Duration of the data processing: until the end of the session
  • Recipients of the personal data: The data controller does not transfer the data obtained to third parties, with the exception of the data processor(s) specified in Section 7. The recorded data may be accessed only by the employees of the Data Controller and the designated staff of the data processor(s).
  • Data subjects concerned: every User visiting the website, irrespective of whether they use the services available on the website.

5. Other data processing

Information on data processing not listed in this notice will be provided at the time the data is collected. We inform our clients that certain authorities, bodies performing public tasks and courts may contact our company for the purpose of obtaining personal data. Our company will disclose personal data to such bodies – provided that the body concerned has specified the exact purpose and scope of the data – only to the extent strictly necessary to achieve the purpose of the request, and only where compliance with the request is required by law.

6. Transfer of personal data to third countries or international organisations

Our Company does not transfer your above personal data to any third country or international organisation.

7. Information on the use of data processors

In the course of data processing, the data controller transfers the data to the data processor(s) contracted by it for the performance of the contract.
Categories of recipients: system administration service provider, accounting and payroll service provider, server hosting, web hosting provider

8. Children

Our services are not intended for persons under the age of 16, and we ask that persons under 16 do not provide Personal Data to the Data Controller.
If we become aware that we have collected personal data from a child under the age of 16 – with the exception of the processing of data required by law – we will take the necessary steps to delete the data as soon as possible.

9. Automated decision-making

Our Company does not use automated decision-making in its data processing procedures or data collection.

10. Method of storing personal data and security of data processing

Our company's IT systems and other data storage locations are located at the registered office and on servers provided by the data processor. Our company selects and operates the IT tools used for processing personal data in the course of providing the service in such a way that the processed data:

  1. is accessible to those authorised to access it (availability);
  2. its authenticity and authentication are ensured (authenticity of data processing);
  3. its integrity can be verified (data integrity);
  4. is protected against unauthorised access (data confidentiality).

We pay particular attention to data security, and we take the technical and organisational measures and establish the procedural rules necessary to give effect to the safeguards required by the GDPR. We protect the data by appropriate measures, in particular against unauthorised access, alteration, transfer, disclosure, erasure or destruction, as well as against accidental destruction, damage, and inaccessibility resulting from changes in the technology used.

The IT systems and networks of our company and our partners are protected against computer-assisted fraud, computer viruses, computer intrusions and denial-of-service attacks. The operator ensures security through both server-level and application-level protection procedures. Daily backup of the data is ensured. Our company takes all possible measures to prevent personal data breaches; should such a breach occur, we will act without delay – in accordance with our incident management policy – to minimise the risks and remedy the damage.

11. Rights of data subjects and legal remedies

The data subject may request information on the processing of his or her personal data, and may request the rectification or – with the exception of mandatory data processing – the erasure or withdrawal of his or her personal data, and may exercise the right to data portability and the right to object in the manner indicated at the time of data collection or via the contact details of the data controller given above.

The rights of the data subject and the available legal remedies are set out below, and data subjects are informed thereof, on the basis of Act CXII of 2011 and Regulation (EU) 2016/679.

The right to information, also known as the data subject's “right of access”: Pursuant to Act CXII of 2011 and Article 15 of Regulation (EU) 2016/679, at the request of the data subject the Data Controller shall provide information on

  • the data processed by it and the categories of personal data,
  • the purpose of the data processing,
  • the legal basis of the data processing,
  • the duration of the data processing,
  • where applicable, the period for which the data will be stored or, if that is not possible, the criteria used to determine that period,
  • where applicable, if the data were not collected from the data subject, any available information as to their source,
  • where applicable, the existence of automated decision-making, including profiling, as well as meaningful information about the logic involved and the significance of such processing, and
  • the envisaged consequences of such processing for the data subject,
  • the details of the data processor, if a data processor has been used, i. the circumstances and effects of any personal data breach and the measures taken to remedy it, and
  • in the event of the transfer of the data subject's personal data, the legal basis, purpose and recipient of the data transfer.

The information is provided free of charge if the person requesting it has not yet submitted a request for information to the Data Controller concerning the same set of data in the current year. In other cases, reimbursement of costs may be charged. Any reimbursement already paid must be refunded if the data were processed unlawfully or if the request for information led to rectification.

The Data Controller draws the attention of data subjects to the fact that, under Act CXII of 2011, the provision of information must be refused

  1. if, pursuant to a law, an international treaty or a binding legal act of the European Union, the Data Controller receives personal data in such a way that the transferring data controller indicates, at the time of the transfer, a restriction of the rights of the data subject under the said Act or any other restriction on the processing of the personal data.
  2. in the interest of the external and internal security of the State, such as national defence, national security, the prevention or prosecution of criminal offences, the security of the penal system, as well as in the economic or financial interest of the State or local government, a significant economic or financial interest of the European Union, and for the prevention and detection of disciplinary and ethical offences related to the practice of professions and breaches of labour law and occupational safety obligations – including in all cases monitoring and supervision – as well as for the protection of the rights of the data subject or of others.

The Data Controller is obliged to notify the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) of rejected requests for information annually, by 31 January of the year following the year concerned.

The right to rectification: The data subject is entitled to have the Data Controller rectify, at his or her request and without undue delay, inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject is entitled to request that incomplete personal data be completed, including by means of a supplementary statement. At the same time, if the personal data does not correspond to reality and the personal data corresponding to reality is available to the Data Controller, the Data Controller shall rectify the personal data as a matter of obligation, even without a request from the data subject.

The right to erasure, also known as the “right to be forgotten”: The data subject is entitled to have the Data Controller erase, at his or her request and without undue delay, personal data concerning him or her, and the Data Controller is obliged to erase personal data concerning the data subject without undue delay, unless this is precluded by mandatory data processing.

In addition to the above case, the Data Controller is obliged to erase the data pursuant to Act CXII of 2011 and Regulation (EU) 2016/679 of the European Parliament and of the Council if

  • the processing of the data is unlawful;
  • the data is incomplete or incorrect – and this cannot be lawfully remedied – provided that erasure is not precluded by law;
  • the purpose of the data processing has ceased, or the statutory time limit for storing the data has expired;
  • it has been ordered by a court or by the Authority.
  • the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  • the data subject objects to the processing and there are no overriding legitimate grounds for the processing;
  • the personal data have to be erased for compliance with a legal obligation under the law applicable to the Data Controller;
  • the personal data have been collected in relation to the offer of information society services directly to children, as referred to in Article 8(1) of Regulation (EU) 2016/679.

Where the Data Controller has for any reason made the personal data public and is obliged to erase it pursuant to the above, the Data Controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform other controllers which are processing the data that the data subject has requested the erasure by them of any links to, or copy or replication of, those personal data.

The Data Controller draws the attention of data subjects to the limitations on the right to erasure or the “right to be forgotten” arising from the EU Regulation, which are as follows:

  1. exercising the right of freedom of expression and information;
  2. compliance with a legal obligation which requires processing of personal data under Union or Member State law to which the controller is subject, or the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
  3. reasons of public interest in the area of public health;
  4. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) of Regulation (EU) 2016/679, in so far as the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
  5. the establishment, exercise or defence of legal claims.

The right to restriction of processing, also known as the right to blocking: The data subject is entitled to have the Data Controller restrict processing at his or her request.
If, on the basis of the information available, it can be assumed that erasure would harm the legitimate interests of the data subject, the data must be blocked. Personal data blocked in this way may be processed only for as long as the purpose of the processing that precluded the erasure of the personal data persists.

If the data subject contests the accuracy or correctness of the personal data, but the incorrectness or inaccuracy of the contested personal data cannot be clearly established, the data shall be blocked. In this case, the restriction applies for a period enabling the Data Controller to verify the accuracy of the personal data.

Under the EU Regulation, the data must be blocked if

  1. the processing is unlawful and the data subject opposes the erasure of the data and requests the restriction of their use instead;
  2. the Data Controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; or
  3. the data subject has objected to the processing; in this case, the restriction applies pending verification of whether the legitimate grounds of the Data Controller override those of the data subject.

Where processing has been restricted (blocked), such personal data shall, with the exception of storage, only be processed with the data subject's consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

The Data Controller hereby expressly draws the attention of data subjects to the fact that the data subject's right to rectification, erasure and blocking may be restricted by law in the interest of the external and internal security of the State, such as national defence, national security, the prevention or prosecution of criminal offences, the security of the penal system, as well as in the economic or financial interest of the State or local government, a significant economic or financial interest of the European Union, and for the prevention and detection of disciplinary and ethical offences related to the practice of professions and breaches of labour law and occupational safety obligations – including in all cases monitoring and supervision – as well as for the protection of the rights of the data subject or of others.
The Data Controller shall, without undue delay and at the latest within 30 days of receipt of the request, inform the data subject of the matters specified in the request, and/or rectify the data, and/or erase and/or restrict (block) the data, or take other steps in accordance with the request, unless there is a ground precluding this.

The Data Controller shall notify the data subject in writing of the rectification, erasure or restriction of processing, as well as all those to whom the data were previously transferred or disclosed for the purpose of data processing. At the request of the data subject, the Data Controller shall inform him or her about those recipients. Notification may be omitted if, having regard to the purpose of the processing, it does not harm the legitimate interests of the data subject, or if providing the information proves impossible or would involve a disproportionate effort. The Data Controller is also obliged to notify the data subject in writing if the exercise of the data subject's rights cannot be fulfilled for any reason, and must specify precisely the factual and legal reasons as well as the legal remedies available to the data subject: the possibility of applying to a court and to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).

The “right to data portability”: The data subject is entitled to

  1. receive the personal data concerning him or her, which he or she has provided to the Data Controller, in a structured, commonly used and machine-readable format, and is further entitled to
  2. transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:
  3. the processing is based on consent; and
  4. the processing is carried out by automated means.

In exercising the right to data portability, the data subject is entitled to request – where technically feasible – that the personal data be transmitted directly from one controller to another.
In view of the data processing carried out by the Data Controller, the conditions for exercising the right to data portability are not met (there is no automated data processing); therefore, the data subject cannot exercise this right.

The right to object: The data subject may object to the processing of his or her personal data – including profiling – if

  • the processing (transfer) of the personal data is necessary solely for the enforcement of a right or legitimate interest of the Data Controller or of the data recipient, except in the case of mandatory data processing;
  • the personal data are used or transferred for the purposes of direct marketing, public opinion polling or scientific research;
  • the exercise of the right to object is otherwise permitted by law.

The data subject may also object, pursuant to Article 21(3) of Regulation (EU) 2016/679, to the processing of personal data for direct marketing purposes, in which case the personal data may no longer be processed for such purposes.

Where personal data are processed for scientific or historical research purposes or for statistical purposes, the data subject is entitled, on grounds relating to his or her particular situation, to object to the processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
The Data Controller – while simultaneously suspending the processing – shall examine the objection within the shortest possible time from the submission of the request, but no later than within 30 days, and shall inform the applicant of the outcome in writing. If the applicant's objection is well-founded, the Data Controller shall terminate the processing – including any further data collection and data transfer – block the data, and notify of the objection and of the measures taken on the basis thereof all those to whom the personal data affected by the objection were previously transferred and who are obliged to take action to enforce the right to object.

If the data subject does not agree with the decision of the Data Controller, or if the Data Controller fails to meet the above deadline, the data subject is entitled to apply to a court within 30 days of the communication of the decision.
The data subject has the right to object in relation to automated decision-making.

Judicial enforcement: In the event of a violation of his or her rights, the data subject may apply to a court. The court shall handle the case as a matter of priority. The Data Controller bears the burden of proving that the data processing complies with the provisions of the law.

In the event of a violation of your right to informational self-determination, you may file a report or complaint with:

Hungarian National Authority for Data Protection and Freedom of Information (NAIH) (Nemzeti Adatvédelmi és Információszabadság Hatóság)
Address: 1125 Budapest, Szilágyi Erzsébet fasor 22/c
Phone: +36 (1) 391-1400, Fax: +36 (1) 391-1410
www: http://www.naih.hu
e-mail: ugyfelszolgalat@naih.hu