Privacy and data management notice

• We collect and process personal data only in accordance with the applicable laws.
• The security of personal data is a priority for us. To this end, we have implemented appropriate administrative, technical and physical measures that serve to protect your personal data against loss, theft, unauthorised use and modification, or disclosure of your data.
• We disclose personal data to third parties only with consent.
• We send Direct Marketing (advertising) messages only with separate consent, but we may send system messages necessary for the proper use of the website even without such consent.
• We provide anyone with information about the data stored about them, and you may at any time request the modification or deletion of your data through our contact details.

Taking into account the above fundamental provisions, MOMENT-CONSULTING K2 Kft., acting in its capacity as data controller, aims to provide users ("Users") with information regarding the collection of personal data on the https://naturah.hu website (hereinafter: Website) and the data management methods used to handle the data on the Website, in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (hereinafter: GDPR), Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information, and other applicable national legislation and regulations.

This privacy and data management notice is available at the following address: http://naturah.hu/adatvedelmi-tajekoztato. Amendments to the notice take effect upon publication at the above website address.

Moment Consulting K2 Korlátolt Felelősségű Társaság (Registered office: 2164 Váchartyán, Fő út 133.), NAIH-127506/2017. (newsletter), data management registration numbers: NAIH-127505/2017. (direct marketing), NAIH-127507. (periodic promotion), NAIH-127509/2017. (marketing) (hereinafter: Service Provider, data controller) submits itself to the provisions of this notice and undertakes to comply with the following requirements set out in the applicable legislation.

Section 20(1) of Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information states that the data subject (in this case the website user, hereinafter: user) must be informed, before the data processing begins, whether the data processing is based on consent or is mandatory.

Before the data processing begins, the data subject must be clearly and comprehensively informed of all facts relating to the processing of their data, in particular the purpose and legal basis of the data processing, the person entitled to carry out the data processing and data handling, and the duration of the data processing.

Pursuant to Section 6(1) of the Info Act, the data subject must also be informed that personal data may be processed even where obtaining the data subject's consent is impossible or would entail disproportionate cost, and the processing of the personal data is necessary for the purpose of fulfilling a legal obligation applicable to the data controller, or is necessary for the purpose of enforcing a legitimate interest of the data controller or a third party, and the enforcement of this interest is proportionate to the restriction of the right to the protection of personal data.

The information must also cover the data subject's rights and remedies in connection with the data processing.

If the personal notification of the data subjects is impossible or would entail disproportionate cost (such as on a website), the information may also be provided by disclosing the following information publicly:

• the fact of the data collection,
• the scope of the data subjects,
• the purpose of the data collection,
• the duration of the data processing,
• the identity of the possible data controllers entitled to access the data,
• a description of the data subjects' rights and remedies in connection with the data processing, and
• where the data processing is subject to registration in the data protection register, the registration number of the data processing.

1. data subject/User: any specified natural person identified or — directly or indirectly — identifiable on the basis of personal data;
2. personal data: data that can be associated with the data subject — in particular the data subject's name, identification mark, and information characteristic of one or more of their physical, physiological, mental, economic, cultural or social identity —, as well as any conclusion regarding the data subject that can be drawn from the data;
3. data controller: the natural or legal person, or organisation without legal personality, who or which, alone or jointly with others, determines the purpose of the data processing, makes and implements the decisions concerning the data processing, or has them implemented by the data processor engaged;
4. data processing: regardless of the procedure applied, any operation or set of operations performed on the data, in particular its collection, recording, registration, organisation, storage, alteration, use, retrieval, transmission, disclosure, alignment or combination, blocking, deletion and destruction, as well as preventing the further use of the data, taking photographs, audio or video recordings, and recording physical characteristics suitable for identifying a person (e.g. fingerprint or palm print, DNA sample, iris image);
5. data handling: the performance of technical tasks related to the data processing operations, regardless of the method and tools applied to carry out the operations and the place of application, provided that the technical task is performed on the data;
6. data processor: the natural or legal person, or organisation without legal personality, who or which processes data on the basis of a contract concluded with the data controller;
7. data protection incident: the unlawful processing or handling of personal data, in particular unauthorised access, alteration, transmission, disclosure, deletion or destruction, as well as accidental destruction and damage.

Pursuant to Section 20(1) of Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information, we set out below, within the scope of the data processing related to the operation and use of the Website, the following: the fact of the data collection, the scope of the data subjects, the purpose of the data collection, the duration of the data processing, the identity of the possible data controllers entitled to access the data, and a description of the data subjects' rights in connection with the data processing.

1.1. The fact of the data collection, the scope of the data processed and the purpose of the data processing

Neither the username nor the e-mail address is required to contain personal data.

1.2. The scope of the data subjects: All data subjects registered on the website.

1.3. The duration of the data processing, the deadline for deleting the data: Immediately upon deletion of the registration. Except for accounting documents, since, pursuant to Section 169(2) of Act C of 2000 on Accounting, this data must be retained for 8 years.

1.4. The identity of the possible data controllers entitled to access the data: The personal data may be handled by the sales consultants and marketing staff of the data controller, respecting the above principles.

1.5. Description of the data subjects' rights in connection with the data processing: The data subject can initiate the deletion or modification of their personal data in the following ways:

• on the website at http://naturah.hu/profil
• by post at 2164 Váchartyán, Fő u. 133.,
• by e-mail at info@naturah.hu,
• by phone at +36 (1) 250 3415.

1.6. The legal basis of the data processing: the User's consent, Section 5(1) of the Info Act, Article 6(1)(a) and (b) of the GDPR, and Section 13/A(3) of Act CVIII of 2001 on certain issues of electronic commerce services and information society services (hereinafter: Elker Act).

Within the scope of data processing, we engage only data processors who undertake to comply with the legal requirements regarding the protection of personal data.

1. Data processors in the scope of product delivery

Activity performed: Delivery of products, shipping

MPL Magyar Posta Logisztika Zrt. — 1138 Budapest, Dunavirág utca 2-6. | ugyfelszolgalat@posta.hu | Phone: (06-1) 333-7777

The fact of the data processing, the scope of the data processed: delivery name, delivery address, phone number. The purpose of the data processing: delivery of the ordered product. The duration of the data processing: lasts until the delivery to the place of performance is completed.

2. Data processors in the scope of hosting services

Activity performed: Hosting service

Y-collective Kft. — 7628 Pécs, Arany János u. 24. | +36 (30) 48 00 513 | mate@y-collective.hu

The fact of the data processing, the scope of the data processed: all personal data provided by the data subject. The purpose of the data processing: making the website available and operating it properly. The duration of the data processing: immediately upon deletion of the registration, or until the given data processing purpose is achieved.

Cookies typical of websites are the so-called "cookies used for a password-protected session" and "security cookies", the use of which does not require prior consent from the data subjects.

• Scope of data processed: Unique identification number, dates, times
• Scope of data subjects: All data subjects visiting the website.
• Purpose of the data processing: Identification of users, tracking of visitors.
• Duration of the data processing: For session cookies, until the end of the website visit, while for other cookies it lasts a maximum of 8 years.
• Deletion option: The data subject has the option to delete cookies in the Tools/Settings menu of browsers, usually under the settings of the Privacy menu item.

This website uses Google Analytics, a web analytics service provided by Google Inc. ("Google"). Google Analytics uses so-called "cookies", text files that are stored on your computer to help analyse the use of the web page visited by the User.

The information generated by the cookies about the website used by the User is generally transferred to and stored on one of Google's servers in the USA. By activating IP anonymisation on the website, Google will previously shorten the User's IP address within the member states of the European Union or in other states party to the Agreement on the European Economic Area.

The User can prevent the storage of cookies by setting their browser accordingly. The User can also prevent Google from collecting and processing the data generated by the cookies by downloading and installing the following browser plugin: https://tools.google.com/dlpage/gaoptout?hl=hu

Pursuant to Section 6 of Act XLVIII of 2008 on the basic conditions and certain limitations of business advertising activities, the User may consent in advance and explicitly to the Service Provider contacting them with advertising offers and other communications at the contact details provided at the time of registration.

The Service Provider does not send unsolicited advertising messages, and the User may unsubscribe from receiving offers at any time, without restriction or justification, free of charge. The User may unsubscribe from advertisements by clicking on the link in the message.

• Scope of data processed: name, address, e-mail address, phone number (optional).
• Scope of data subjects: All subscribing Users who consent to receiving the newsletter.
• Purpose of the data processing: sending electronic messages containing advertisements to the data subject, providing information about current information, products, offers, promotions, new features, etc.
• Duration of the data processing: the data processing lasts until the consent statement is withdrawn, i.e. until unsubscription.
• Registration numbers of the data processing: NAIH-127506/2017. (newsletter), NAIH-127505/2017. (direct marketing), NAIH-127507. (periodic promotion), NAIH-127509/2017. (marketing)

The fact of the data collection, the scope of the data processed: the name registered on the Facebook/Google+/Twitter/Pinterest/Youtube/Instagram etc. social media sites, and the user's public profile picture.

Scope of data subjects: All data subjects who have registered on the social media sites and "liked" the website.

Purpose of the data collection: sharing, "liking" and promoting certain content elements, products, offers of the website, or the website itself, on the social media sites.

The data processing takes place on the social media sites, so the regulations of the given social media site apply to the duration and manner of the data processing, and to the options for deleting and modifying the data.

If a question arises during the use of the data controller's services, or the data subject has a problem, they may contact the data controller in the ways provided on the website (phone, e-mail, social media sites, etc.). We use your personal data for the period strictly necessary to achieve the intended purpose.

In the event of an exceptional official request, or on the basis of authorisation by law upon the request of other authorities, the Service Provider is obliged to provide information, disclose and hand over data, and make documents available.

The data controller plans and carries out the data processing operations in such a way as to ensure the protection of the data subjects' privacy. The data controller ensures the security of the data (password, authentication in a confirmation e-mail, SSL), takes the technical and organisational measures and establishes the procedural rules necessary to enforce the Info Act as well as other data and secrecy protection rules.

The data controller protects the data with appropriate measures, in particular against unauthorised access, alteration, transmission, disclosure, deletion or destruction, accidental destruction and damage, and inaccessibility resulting from changes in the technology applied.

The data subject may request the Service Provider to provide information about the processing of their personal data, may request the rectification of their personal data, and may request the deletion or blocking of their personal data — with the exception of mandatory data processing.

At the User's request, the Service Provider provides information about the data it processes, the source of the data, the purpose, legal basis and duration of the data processing, the name and address of any data processor, and its activities related to the data processing. The Service Provider provides the information in writing, in a comprehensible form, within the shortest possible time from the submission of the request, but no later than within 25 days. The information is free of charge.

The Service Provider deletes the personal data if its processing is unlawful, the User requests it, the data processed is incomplete or incorrect, the purpose of the data processing has ceased, or the deadline for storing the data specified by law has expired, or the court or the Hungarian National Authority for Data Protection and Freedom of Information has ordered it.

The User may object to the processing of their personal data if the processing or transmission of the personal data is necessary solely for the fulfilment of a legal obligation applicable to the Service Provider, or for the enforcement of a legitimate interest of the Service Provider, the data recipient or a third party, except where the data processing was ordered by law; if the use or transmission of the personal data is carried out for the purpose of direct marketing, opinion polling or scientific research; or in other cases specified by law.

The Service Provider examines the objection within the shortest time from the submission of the request, but no later than within 15 days, makes a decision on the question of its merits, and informs the applicant in writing of its decision.

A complaint against any potential infringement by the data controller may be lodged with the NAIH (Hungarian National Authority for Data Protection and Freedom of Information):

The data controller is obliged to prove that the data processing complies with the provisions of the law. The data recipient is obliged to prove the lawfulness of the data transmission.

The adjudication of the lawsuit falls within the competence of the regional court. The lawsuit may also — at the data subject's choice — be filed before the regional court of the data subject's place of residence or place of stay.

If the data controller violates the data subject's personality rights by unlawfully processing the data subject's data or by breaching the requirements of data security, the data subject may claim damages for grievance from the data controller.

The data controller is liable to the data subject for the damage caused by the data processor. The data controller is exempt from liability for the damage caused and from the obligation to pay damages for grievance if it proves that the damage or the violation of the data subject's personality rights was caused by an unavoidable cause outside the scope of the data processing.

In preparing this notice, we took into account the following legislation:

• Act CXII of 2011 – on the Right to Informational Self-Determination and Freedom of Information (Info Act)
• Act XLVIII of 2008 – on the basic conditions and certain limitations of business advertising activities (in particular its Section 6)
• Act XC of 2005 on electronic freedom of information
• Act C of 2003 on electronic communications (specifically its Section 155)
• Opinion 16/2011 on the EASA/IAB Best Practice Recommendation on Online Behavioural Advertising
• The recommendation of the Hungarian National Authority for Data Protection and Freedom of Information on the data protection requirements of prior information