Cookies are small data files that are sent from the website to the computer of the User during browsing and they are saved and stored by the browsers. As a default setting in the most common used browsers (Chrome, Firefox, etc.), downloading and using cookies are permitted, but You may change the browser settings to refuse and block cookies, as well as to delete the cookies that are stored on Your computer.

Analytics Cookie

The website is using the Google Analytics system of Google Inc. (hereinafter: ‘Google’) to analyse site traffic. This system stores cookies on Your information device to analyse our site traffic to help us improve the customer experience that our website provides. The data relevant to the website’s traffic (together with time and date of the visit and Your IP address) are transferred to the servers of Google USA and stored there. Google is using these data to evaluate and create reports on Your site visit habits, while simultaneously offer other services relevant to the usage of the website and the internet. If a User is opposed to Google Analytics creating reports on their site visits, a browser add-on may be installed that blocks Google Analytics. This add-on prevents the JavaScript scripts of Google Analytics (ga.js, analytics.js, and dc.js) from sending visitor information to Google. The Users who installed this add-on are exempt from participating in website content experiments as well.

If You wish to block the online activities of Google Analytics, look up the opt-out page of Google Analytics (http://tools.google.com/dlpage/gaoptout) and install the add-on in Your browser. For further information on the installation and uninstallation of the add-on, please, refer to the Help function of Your browser.

Targeted or advertising cookie

In order to ensure that our visitors receive marketing information that are most suited to their interests, we may use targeted or advertising cookies. This action shall require Your explicit consent that may be given by clicking on the appropriate button in the corresponding text box on the website. These cookies collect detailed information on Your browsing habits. If you have confirmed that you wish to continue receiving e-mails, marketing information and special offers from us, the cookies will work as follows:

• They collect information regarding which articles and / or services you searched for on our website. This way they create a database that enables us to identify You and Your settings, so that You will not be required to provide this information the next time You visit our website and helps us to identify You if You replied to an e-mail sent by us.

• They can restrict the number of times a given advertisement may be viewed and they are able to measure the efficiency of advertising campaigns.

​

Third-party cookies

We may visualize certain contents on our website by using external internet services. This may result in the storage of cookies that we have no supervision of and, thus, no control over the activities of these websites and domains that may collect data regarding Your use of such embedded contents.

Session cookies

Session cookies are indispensable for navigation on our website, for the operation of the essential functions of the website and for the access to protected content. These cookies store information of filled-out data sheets as well as occasionally Your preferred language, without collecting any information of You that may help us to identify You, being used for marketing purposes, or recording Your browsing history. These cookies shall be automatically erased when the website is closed and the session is finished.

Functional cookie

In order to enhance customer experience, functional cookies observe the device that You opened the website on, record Your previous customer decisions (for example: user name, password, preferred language, region, whether You had signed in during a previous session, any changes You made in the customizable elements of the website such as text size and font) to enable us to offer You tailor-made functions. These cookies do not record Your activities on other websites and we may not use them to send You ads when You are browsing different websites.

​

DATA PROCESSING PROVISIONS IN DETAIL

 

1. Data Subject submits their personal data voluntarily on our website during subscription to the newsletter, using the webshop service or complaint management, or communication with Service Provider. It is the responsibility of the Data Subject to ensure that the data provided are real, correct and precise.

2. If Data Subject submits the personal data of another person, Service Provider shall automatically assume that Data Subject possesses the necessary consent and authorisation to perform this action.

3. Data Subject may withdraw the consent for data processing free of charge at any time. Service Provider as Data Controller shall exercise the withdrawal of consent within 30 days. However, Service Provider as Data Controller shall reserve the right to process certain data to ensure the performance of its legal obligations or the realization of its lawful interests after the consent was withdrawn.

4. Service Provider shall store every e-mail address contacting zita@margallitiskincre.com for 90 days after the issue relevant to the e-mail is resolved, except if Data Subject explicitly requests otherwise. After 90 days, the e-mail addresses shall be erased, except if the lawful interest of Data Controller vindicates further data processing, until the lawful interest exists.

5. If the use of personal data is deemed illegal, if the Data Subject commits felony or if the information system is attacked, Service Provider as Data Controller shall be entitled to immediately erase the personal data of the Data Subject. However, if a felony or violation of the Civil Code is suspected, Service Provider as Data Controller shall be entitled to keep the personal data until the legal procedure ends.

6. If a legal court or any other authority orders the erasure of personal data in a legally binding way, Service Provider as Data Controller shall erase the personal data.

7. Legal courts, prosecutor’s offices or other authorities (Hungarian National Authority for Data Protection and Freedom of Information, law enforcement authorities, tax authority, for instance) may request Service Provider to hand over information or to make documents available. In such cases, Service Provider shall be obliged to perform its data reporting to the extent necessary for the purpose of the request.

8. Service Provider shall protect the personal data of the Data Subject with the adequate technical measures. Service Provider shall ensure the security and accessibility of the data and shall protect them from unauthorized access, alteration, damage, disclosure, and any other unauthorized use. The applied technical measures include the use of password protection and anti-virus softwares.

 

RIGHTS OF THE CUSTOMER

Your rights and available legal remedies:

You have the right to:

• receive informationregarding the processing of your personal data,

• receive accessto the stored personal data of yours,

• ask for rectificationif the data stored are incorrect, imprecise or incomplete,

• request the erasureof Your personal data if they are no longer needed or their processing is illegal,

• objectto the use of Your personal data for marketing purposes or other purposes deriving from their particular situation,

• request the restriction of the processing of their personal data in clearly specified cases,

• receive the personal data in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller (‘data portability’),

• not be subject to a decision concerning them and affecting them significantly that is based solely on automated data processing, but to be made by natural persons. User has the right to give their opinion and to appeal the decision (Chapter III of GDPR).

In compliant with the provisions of Article 37 of GDPR, Service Provider as Data Controller shall not be obligated to designate a data protection officer, but Data Subjects are entitled to ask questions regarding the operation of our website or our data processing activities via our customer service.

Our customer service:

Our customer service can be reached via the contact details given in 'CORPORATE INFORMATION OF DATA CONTROLLER’.

Upon Your request, You may receive informationon the following areas:

• Your personal data,

• the source of data,

• purpose of data processing,

• legal basis for data processing,

• time period of data processing, together with the governing circumstances and regulations,

• name, contact details and activity relevant to data processing of the Data Processor(s),

• circumstances and impact of a possible personal data breach, as well as the measures done to prevent and resolve such a breach.

The communication shall be free of charge. The communication may only be denied by Service Provider if it contradicts the relevant regulations. In such cases, Service Provider shall name the relevant legal provision and inform the Data Subject about their opportunity to lodge a court appeal or to turn to an authority.

If the Data Subject believes that their personal data are incorrect, incomplete or imprecise, they may request Service Provider as Data Controller to rectify the data. We shall comply with such a request without undue delay within 15 calendar days (within 30 days at maximum). If the request can not be granted, the Data Subject shall receive a written statement setting out the reasons.

You have the right to objectthe processing of your personal data and you may request Service Provider as Data Controller to erase Your personal data.

Service Provider shall be obliged to inform You about your right to object upon the first communication.

If Service Provider processes Your personal data based on Your consent or a contract, you may receive Your personal data from Service Provider upon request. If it is technically feasible, You may also request your personal data to be sent to a different companythat You wish to use the services of.

You may use your right to restriction of data processingwhen it is not evident whether the erasure of the data is necessary and the timing of the erasure is not obvious either. You are entitled to request restriction of data processing when one of the following applies:

• You contest the accuracy of the personal data,

• You opposes the erasure of the personal data,

• the Data Controller no longer needs the personal data for the purposes of the processing, but they may not be erased due to legal reasons,

• the decision regarding the objection against processing filed by You is still pending.

Where processing has been restricted, such personal data shall only be processed with the Data Subject's consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. A Data Subject who has obtained restriction of processing shall be informed by the Data Controller before the restriction of processing is lifted.

You may file an appeal regarding data processing at the competent court, file a complaint at the supervisory authority, or engage in proceedings (https://naih.hu/panaszuegyintezes-rendje.html).

Supervisory Authority: Hungarian National Authority for Data Protection and Freedom of Information

Registered seat: H-1125 Budapest, Szilágyi Erzsébet fasor 22/c.

Mailing address: 1530 Budapest, Pf.: 5.

Telephone number: +36-1-391-1400

Fax number: +36-1-391-1410

E-mail address: ugyfelszolgalat@naih.hu

Website: https://naih.hu/

In order to accelerate the cooperation and the resolution of any possible problems with data processing, we kindly ask you to contact Service Provider before appealing to the supervisory authority or the competent court!

​

PERSONAL DATA BREACH

If any part of the personal data is disclosed to unauthorized people, Data Controller shall immediately notify the supervisory authority: the Hungarian National Authority for Data Protection and Freedom of Information. The Data Controller shall do the notification without undue delay and, where feasible, not later than 72 hours after having become aware of the breach. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.

The notification of the personal data breach shall at least:

1. describe the nature of the personal data breach including where possible, the categories and approximate number of Data Subjects concerned and the categories and approximate number of personal data records concerned;

2. communicate the name and contact details of the data protection officer or other contact point where more information can be obtained;

3. describe the likely consequences of the personal data breach;

4. describe the measures taken or proposed to be taken by the Data Controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

5. Communication of a personal data breach to the Data Subjects

6. When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the Data Controller shall communicate the personal data breach to the data subject without undue delay.

7. The notification shall be the responsibility of the data protection officer.

8. The communication to the Data Subjects shall not be required if any of the following conditions are met:

   1. the Data Controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption;

   2. the Data Controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of Data Subjects is no longer likely to materialise;

   3. the communication would involve disproportionate effort. In such a case, there shall instead be a public communication or similar measure whereby the Data Subjects are informed in an equally effective manner.

Service Provider shall keep a record of personal data breaches, irrespective of whether they are communicated.

Abbreviations of the legislations relevant to this Data Protection Policy and our corporate communication activities:

Constitution of Hungary (in force since 25 April 2011)

Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR)

Act CXII of 2011 on Informational Self-determination and Freedom of Information (‘Privacy Act’)

Act V of 2013 on the Civil Code

Act CVIII of 2001 on certain issues of electronic commerce activities and information society services (‘Act on E-Commerce’)

Act C of 2003. on Electronic Communications

Act CLV of 1997 on Consumer Protection

Act CLXV of 2013 on Complaints And Notification Of General Interest.

Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities (hereinafter: ‘Advertising Act’)

Data Controller shall monitor the possible changes in the European and national regulations on data processing and shall amend this Data Protection Policy if necessary in order to comply with the regulations on lawful data processing, while simultaneously informing the You about such changes via the website.

​