Privacy Policy

Introduction:

RS Webdesign (registered office: D-85521 Ottobrunn, Röntgenstrasse 24), tax number: 146/226/72031 – EU tax number: DE462040364, hereinafter referred to as the „Service Provider” or „Data Controller”) is subject to the following policy: on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016, we provide the following information.

This privacy policy governs the processing of personal data on the following pages:

RS Webdesign’s website

The privacy policy is available on the following page: https://rswebdesign.eu/adatkezelesi-nyilatkozat/

Amendments to the regulations shall come into force upon their publication at the above address.

Details of the service provider as the data controller:

Names of the service provider’s websites: RS Web Design

Name of the service provider: RS Web Design

The service provider’s registered office: D-85521 Ottobrunn, Röntgenstrasse 24

Tax number: 146/226/72031

EU tax number: DE462040364

The service provider’s contact details, specifically the email address regularly used to communicate with customers: rswebdesign@rswebdesign.eu

The service provider’s postal address: D-85521 Ottobrunn, Röntgenstrasse 24

Telephone number: +49 1726528051

Name of the registering authority: Munich Tax Office

Definitions

„personal data”: any information relating to an identified or identifiable natural person („data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

„data processing”: any operation or set of operations which is carried out on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, classification, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

„data controller” means the natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by Union or Member State law, Union or Member State law may also determine the controller or specific criteria for the designation of the controller;

„data processor”: a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the data controller;

„recipient”: a natural or legal person, public authority, agency or any other body to whom or to which personal data are disclosed, whether or not that body is a third party. Public authorities which, in the context of an individual investigation, have access to personal data in accordance with Union or Member State law shall not be regarded as recipients; the processing of such data by those public authorities must comply with the applicable data protection rules in accordance with the purposes of the processing;

„consent of the data subject”: a voluntary, specific and informed, and unambiguous indication of the data subject’s wishes, by which the data subject, by a statement or a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

„data breach”: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to, personal data that is transmitted, stored or otherwise processed.

Principles governing the processing of personal data

Personal data:

(a) the processing must be carried out lawfully, fairly and in a manner that is transparent to the data subject („lawfulness, fairness and transparency”);
(b) they are collected only for specified, explicit and legitimate purposes, and are not processed in a manner incompatible with those purposes; in accordance with paragraph 1 of this Article, further processing for archiving in the public interest, for scientific or historical research purposes or for statistical purposes shall not be regarded as incompatible with the original purpose („purpose limitation”);
(c) they must be appropriate and relevant to the purposes of the data processing and must be limited to what is necessary („data minimisation”);
(d) they must be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data which are inaccurate, having regard to the purposes of the processing, are erased or rectified without delay („accuracy”);
(e) personal data must be stored in a form which permits identification of data subjects only for as long as is necessary to fulfil the purposes for which the personal data are processed; personal data may be stored for a longer period only if the processing of personal data is carried out in accordance with paragraph 1 of this Article for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes, subject to the implementation of appropriate technical and organisational measures as provided for in this Regulation to safeguard the rights and freedoms of data subjects („limited storage”);
(f) processing must be carried out in such a way that, by applying appropriate technical or organisational measures, the security of personal data is ensured, including protection against unauthorised or unlawful processing, accidental loss, destruction or damage („integrity and confidentiality”).

The data controller is responsible for ensuring compliance with the above and must be able to demonstrate such compliance („accountability”). The data controller declares that its data processing is carried out in accordance with the principles set out in this section.

Data Processing Registration

The fact that data is collected, the scope of the data processed and the purposes of data processing:

The purpose of data processing:

This is required for making contact, making a purchase and issuing a valid invoice.
Communication, sending confirmations
Communication; more efficient coordination of issues relating to invoicing or delivery.
The issuing of a valid invoice, as well as the drafting of the contract, the determination of its content, its amendment, the monitoring of its performance, the invoicing of the fees arising therefrom, and the enforcement of the related claims.
Managing information relating to orders and deliveries

Personal Data

Surname and first name
Email address
Telephone number
Billing name and address
Note regarding the order
Date of purchase/registration
IP address at the time of purchase/registration

An email address does not need to contain any personal data.

Data subjects: All persons registered on the website and all customers are data subjects.

Duration of data processing, deadline for erasure of data: This continues until the data subject submits a request for erasure. The data controller shall inform the data subject electronically of the erasure of any personal data provided by the data subject, in accordance with Article 19 of the GDPR. If the data subject’s request for erasure also extends to the email address they have provided, the data controller shall also erase that email address following the notification. This does not apply to accounting documents, however, as these must be retained for 8 years in accordance with Section 169(2) of Act C of 2000 on Accounting.

Accounting documents directly and indirectly supporting the accounting entries (including general ledger accounts, analytical and detailed records) must be retained in a legible form for at least 8 years, in such a way that they can be retrieved by reference to the accounting records.

The identity of potential data controllers entitled to access the data, and the recipients of the personal data: Personal data may be processed by the data controller’s customer service staff, in accordance with the above principles.

Explanation of data subjects’ rights in relation to data processing:

The data subject may request from the data controller access to their personal data, the rectification or erasure of such data, or a restriction on its processing, and the data subject has the right to data portability, as well as to withdraw their consent at any time.

Data subjects may request access to their personal data, the erasure or rectification of such data, or the restriction of its processing, as well as data portability, in the following ways:

by post to D-85521 Ottobrunn, Röntgenstrasse 24,

by email to the rswebdesign@rswebdesign.eu at the following email address,

by telephone on +49 1726528051

The legal basis for data processing:

Article 6(1)(b) of the GDPR,
Section 13/A(3) of Act CVIII of 2001 on certain issues relating to electronic commerce services and information society services (hereinafter: the Electronic Commerce Act): A service provider may process personal data that is technically essential for the provision of the service for the purpose of providing that service. Where all other conditions are the same, the service provider must select and, in all cases, operate the means used in the provision of information society services in such a way that personal data are processed only if this is absolutely necessary for the provision of the service and for the fulfilment of the other purposes set out in this Act; however, even in such cases, only to the extent and for the duration necessary.
Article 6(1)(c) in the case of issuing an invoice in accordance with accounting legislation.
In the case of enforcing claims arising from a contract, the limitation period is five years, in accordance with Section 6:21 of Act V of 2013 on the Civil Code. Section 6:22 [Limitation period] (1) Unless otherwise provided for in this Act, claims shall become time-barred after five years. (2) The limitation period shall commence when the claim becomes due. (3) Any agreement to alter the limitation period must be in writing. (4) Any agreement excluding the limitation period shall be void.

Please note that:

Data processing is necessary for the performance of a contract and for providing a quotation.
You are required to provide your personal data so that we can provide our services.
Failure to provide the required information will mean that we are unable to provide you with our services.

The fact that data is collected, the scope of the data processed and the purpose of data processing:

The purpose of data processing:

Identification
Staying in touch, sending replies
Carrying out the technical procedure required to respond

Personal Data:

Name
Email address
Message content
Date of first contact
The IP address at the time of connection

An email address does not need to contain any personal data.

Data subjects: All data subjects who send a message via the contact form.

Duration of data processing, deadline for erasure of data: Until the data subject submits a request for erasure.

The identities of potential data controllers entitled to access the data, and the recipients of the personal data: Personal data may be processed by the data controller’s customer service staff.

Explanation of data subjects’ rights in relation to data processing:

The data subject may request from the data controller access to, rectification of, erasure of, or restriction of the processing of personal data relating to them, and

The data subject has the right to data portability and to withdraw their consent at any time.

Data subjects may request access to their personal data, the erasure or rectification of such data, or the restriction of its processing, as well as data portability, in the following ways:

by post to D-85521 Ottobrunn, Röntgenstrasse 24,

by email to the rswebdesign@rswebdesig.eu at the following email address,

by telephone on +49 1726528051

Legal basis for data processing: the data subject’s consent, Article 6(1)(a) and (b).

Please note that:

This data processing is based on your consent and is necessary for us to stay in touch with you.
You are required to provide your personal data so that you can contact us.
Failure to provide the required information will mean that you will be unable to contact the Service Provider.

Customer relations

The fact that data is collected, the scope of the data processed and the purpose of data processing:

The purpose of data processing:

Keeping in touch
Identification
Performance of contracts
Business objective

Personal Data:

Name
Email address
Telephone number

Stakeholders: All data subjects who are in contact with the data controller by telephone, email or in person, or who are in a contractual relationship with the data controller.

Duration of data processing; deadline for erasure of data: Data processing shall continue until the legal relationship between the data controller and the data subject ceases, or, in the event of claims, for a period of 5 years following the termination of the contract.

The identities of potential data controllers entitled to access the data, and the recipients of the personal data: Personal data may be processed by the data controller’s customer service staff, in accordance with the above principles.

Explanation of data subjects’ rights in relation to data processing:

The data subject may request from the data controller access to, rectification of, erasure of, or restriction of the processing of personal data relating to them, and

The data subject has the right to data portability and to withdraw their consent at any time.

Data subjects may request access to their personal data, the erasure or rectification of such data, or the restriction of its processing, as well as data portability, in the following ways:

by post to D-85521 Ottobrunn, Röntgenstrasse 24,

by email to the rswebdesign@rswebdesign.eu at the following email address,

by telephone on +49 1726528051

The legal basis for data processing:

Article 6(1)(b) and (c) of the GDPR.
In the case of enforcing claims arising from a contract, the limitation period is five years, in accordance with Section 6:21 of Act V of 2013 on the Civil Code. Section 6:22 [Limitation period] (1) Unless otherwise provided for in this Act, claims shall become time-barred after five years. (2) The limitation period shall commence when the claim becomes due. (3) Any agreement to alter the limitation period must be in writing. (4) Any agreement excluding the limitation period shall be void.

Please note that

Data processing is necessary for the performance of a contract and for maintaining contact.
You are required to provide your personal data so that we can fulfil your order or other request.
Failure to provide the required information will mean that we are unable to process your order/request.

Data processors used: Hosting provider

Activity carried out by the data processor: Hosting service

Name and contact details of the data processor:

Name: Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus

Contact details: gdpr@hostinger.com.

The fact that data is processed, and the scope of the data processed: All personal data provided by the data subject.

Stakeholders: All data subjects using the website.

The purpose of data processing: Making the website available and ensuring it operates properly.

Duration of data processing; deadline for erasure of data: Data processing shall continue until the agreement between the data controller and the hosting provider is terminated, or until the data subject submits a request for erasure to the hosting provider.

The legal basis for data processing: the GDPR, Article 6(1)(f) and Section 13/A(3) of Act CVIII of 2001 on certain aspects of electronic commerce services and information society services.

The rights of the data subject:

You can find out about the circumstances of data processing,
You are entitled to receive confirmation from the data controller as to whether your personal data is being processed, and to access all information relating to the processing of your personal data.
You have the right to receive your personal data in a structured, commonly used and machine-readable format.
You have the right to have the data controller rectify any inaccurate personal data concerning you without undue delay upon your request.
You have the right to object to the processing of your personal data.

Website management

Activities carried out by the data processor: website operation (monitoring, technical updates, security system development, other developments, maintenance tasks)

Name and contact details of the data processor:

Name: Rita Szilagyi

Address: D-85521 Ottobrunn, Röntgenstrasse 24

Email: rswebdesign@rswebdesign.eu

The fact that data is processed, and the scope of the data processed: All personal data provided by the data subject.

Stakeholders: All data subjects who use the website’s services or who are registered on the website or have placed an order.

The purpose of data processing: Website operation (development, monitoring, bug fixes)

Duration of data processing; deadline for erasure of data: It shall remain in force until the termination of the agreement between the Service Provider and the website operator, or until the data subject submits a request for erasure to the website operator.

The legal basis for data processing: Article 6(1)(f) of the GDPR and Section 13/A(3) of Act CVIII of 2001 on certain aspects of electronic commerce services and information society services.

The rights of the data subject:

You can find out about the circumstances of data processing,
You are entitled to receive confirmation from the data controller as to whether your personal data is being processed, and to access all information relating to the processing of your personal data.
You have the right to receive your personal data in a structured, commonly used and machine-readable format.
You have the right to have the data controller rectify any inaccurate personal data concerning you without undue delay upon your request.
You have the right to object to the processing of your personal data.

Accounting tasks, invoicing

Activities carried out by the data processor: Accounting tasks and invoicing

Name and contact details of the data processor: (Accountant’s details)

Name: Seidler Büroservice

Address: D-99713 Ebeleben, Teichdamm 2

Email: info@bueroservice-seidler.de

The fact that data is processed, and the scope of the data processed: Name, billing name, billing address, email address, telephone number.

Stakeholders: All data subjects who place an order via the website.

The purpose of data processing: Carrying out accounting tasks.

Duration of data processing; deadline for erasure of data: Eight years, pursuant to Section 169(2) of Act C of 2000 on Accounting.

The legal basis for data processing: Article 6(1)(c) of the GDPR and Section 13/A(3) of Act CVIII of 2001 on certain aspects of electronic commerce services and information society services.

The rights of the data subject:

You can find out about the circumstances of data processing,
You are entitled to receive confirmation from the data controller as to whether your personal data is being processed, and to access all information relating to the processing of your personal data.
You have the right to receive your personal data in a structured, commonly used and machine-readable format.
You have the right to have the data controller rectify any inaccurate personal data concerning you without undue delay upon your request.

Email services

Activities carried out by the data processor: Order processing, order fulfilment, customer relations

Name and contact details of the data processor:

Name: Google LLC

Address: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Contact details: www.google.com/contact/

The fact that data is processed, and the scope of the data processed: Name, billing name, billing address, email address, telephone number, message content.

Stakeholders: All data subjects who contact the data controller by email.

The purpose of data processing: Communicating with customers via email.

The legal basis for data processing: Article 6(1)(c) and (f) of the GDPR.

The rights of the data subject:

You can find out about the circumstances of data processing,
You are entitled to receive confirmation from the data controller as to whether your personal data is being processed, and to access all information relating to the processing of your personal data.
You have the right to receive your personal data in a structured, commonly used and machine-readable format.
You have the right to have the data controller rectify any inaccurate personal data concerning you without undue delay upon your request.

Newsletter distribution, online marketing

Activities carried out by the data processor: sending newsletters, online marketing

Name and contact details of the data processor: (Details of the newsletter distribution system)

Name: Facebook Inc.

Registered office: 1 Hacker Way, Menlo Park, California, CA 94025, USA

Website: facebook.com

Customer Service: +1 (650) 543-480

The fact that data is processed, and the scope of the data processed: Name, email address, visitor data

Stakeholders: All data subjects who use the website or subscribe to the newsletter.

The purpose of data processing: To promote and advertise the products available on the website, and to increase traffic to the website.

Duration of data processing; deadline for erasure of data: It shall remain in force until the termination of the agreement between the Service Provider and the data processor specified in this clause, or until the data subject submits a request for erasure to this data processor.

The legal basis for data processing: the User’s consent, Section 5(1) of the Information Act, Article 6(1)(a), and Section 13/A(3) of Act CVIII of 2001 on certain issues relating to electronic commerce services and information society services.

The rights of the data subject:

You can find out about the circumstances of data processing,
You are entitled to receive confirmation from the data controller as to whether your personal data is being processed, and to access all information relating to the processing of your personal data.
You have the right to receive your personal data in a structured, commonly used and machine-readable format.
You have the right to have the data controller rectify any inaccurate personal data concerning you without undue delay upon your request.

Managing Cookies

Cookies typically used by online shops include so-called „password-protected session cookies”, „security cookies”, „essential cookies”, ”functional cookies” and „cookies used to manage website statistics”, for which it is not necessary to seek prior consent from data subjects.

The fact that data is processed, and the scope of the data processed: Unique identification number, dates, times

Stakeholders: All data subjects who visit the website.

The purpose of data processing: Identifying users, keeping track of the „shopping basket” and monitoring visitors.

Duration of data processing; deadline for erasure of data:

Session cookies

Section 13/A(3) of Act CVIII of 2001 on certain aspects of electronic commerce services and information society services (Elkertv.)
The period up to the closure of the relevant visitor session

Persistent or stored cookies

Section 13/A(3) of Act CVIII of 2001 on certain aspects of electronic commerce services and information society services (Elkertv.)
until the data subject is deleted

Cookies required for the site to function (instruShowed, frontend, frontend_cid)

Section 13/A(3) of Act CVIII of 2001 on certain aspects of electronic commerce services and information society services (Elkertv.)
until the data subject is deleted

Marketing cookies (popupData, om, om-success-cookie, om-success)

Section 13/A(3) of Act CVIII of 2001 on certain aspects of electronic commerce services and information society services (Elkertv.)
until the data subject is deleted

Cross-marketing cookies (PAP..)

Section 13/A(3) of Act CVIII of 2001 on certain aspects of electronic commerce services and information society services (Elkertv.)
The period up to the closure of the relevant visitor session

Customer service cookies

Section 13/A(3) of Act CVIII of 2001 on certain aspects of electronic commerce services and information society services (Elkertv.)
The period up to the closure of the relevant visitor session

(Start of visit, end of visit, anonymised user ID, ID of chat conversation started)

The identities of potential data controllers entitled to access the data: The data controller does not process personal data through the use of cookies.

Explanation of data subjects’ rights in relation to data processing: Data subjects can delete cookies via the Tools/Settings menu in their browser, usually under the Privacy settings.

The legal basis for data processing: Consent from the data subject is not required where the sole purpose of using cookies is the transmission of communications via an electronic communications network, or where the service provider absolutely requires them and the service provider absolutely requires it to provide an information society service.

Using Google AdWords conversion tracking

The data controller uses an online advertising programme called „Google AdWords” and, as part of this, utilises Google’s conversion tracking service. Google Conversion Tracking is an analytics service provided by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; „Google“).

When a User accesses a website via a Google advert, a cookie required for conversion tracking is placed on their computer. These cookies have a limited validity period and do not contain any personal data, so the User cannot be identified through them.

When the User browses certain pages on the website and the cookie has not yet expired, both Google and the data controller can see that the User has clicked on the advert.

Each Google AdWords client is assigned a different cookie, so they cannot be tracked via the websites of AdWords clients.

The information – which is collected using conversion tracking cookies – is used to generate conversion statistics for clients who have opted for AdWords conversion tracking. This enables clients to see how many users clicked on their advert and were redirected to a page tagged with a conversion tracking tag. However, they do not have access to any information that could be used to identify individual users.

If you do not wish to take part in conversion tracking, you can opt out by disabling cookies in your browser. You will then not be included in the conversion tracking statistics.

Further information and Google’s privacy policy are available on the following page: www.google.de/policies/privacy/

The use of Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Inc. („Google”). Google Analytics uses so-called „cookies”, which are text files stored on your computer, to help analyse your use of the website you are visiting.

Information generated by cookies relating to the website used by the User is usually transmitted to and stored on one of Google’s servers in the USA. By activating IP anonymisation on the website, Google will first truncate the User’s IP address within the Member States of the European Union or in other states party to the Agreement on the European Economic Area.

The full IP address will only be transmitted to a Google server in the USA and shortened there in exceptional cases. On behalf of the operator of this website, Google will use this information to evaluate how the User has used the website, as well as to compile reports for the website operator on website activity and to provide further services relating to website and internet usage.

Within the framework of Google Analytics, the IP address transmitted by the User’s browser is not linked to any other data held by Google. The User may prevent the storage of cookies by adjusting the settings in their browser; however, please note that in this case, not all features of this website may be fully accessible. You can also prevent Google from collecting and processing data relating to your use of the website (including your IP address) via cookies by downloading and installing the browser plug-in available via the following link. https://tools.google.com/dlpage/gaoptout?hl=hu

Facebook Pixel

The Facebook pixel is a piece of code that enables the website to track conversions, create target audiences, and provide the site owner with detailed analytics on how visitors use the website. Using the Facebook remarketing pixel tracking code, you can display personalised offers and adverts to website visitors on Facebook. The Facebook remarketing list cannot be used to identify individuals. You can find further information about the Facebook Pixel here:https://www.facebook.com/business/help/651294705016616

Newsletter

Pursuant to Section 6 of Act XLVIII of 2008 on the fundamental conditions and certain restrictions on commercial advertising, the User may give their prior and express consent to the Service Provider contacting them with its advertising offers, other communications via the contact details provided at the time of registration.

Furthermore, subject to the provisions of this notice, the Customer may consent to the Service Provider processing their personal data necessary for the sending of promotional offers.

The Service Provider shall not send unsolicited advertising messages, and the User may unsubscribe from receiving such offers free of charge, without restriction and without having to provide a reason. In this case, the Service Provider will delete all personal data required for sending advertising messages from its records and will not contact the User with further advertising offers. The User may unsubscribe from advertising by clicking on the link in the message.

The fact that data is collected, the scope of the data processed and the purpose of data processing:

The purpose of data processing

Identification, enabling users to subscribe to the newsletter.
Carrying out a technical operation.

Personal Data

Name
Email address
Date of registration
IP address at the time of registration

Stakeholders: All data subjects who have subscribed to the newsletter.

The purpose of data processing: sending electronic messages containing advertising (e-mails, text messages, push notifications) to the data subject; providing information on current developments, products, promotions, new features, etc.

The duration of data processing; the deadline for erasure of data: Data processing will continue until the consent is withdrawn, i.e. until you unsubscribe.

Explanation of data subjects’ rights in relation to data processing:

The data subject may request from the data controller access to their personal data, the rectification or erasure of such data, or a restriction on its processing, as well as

You may object to the processing of your personal data, and you have the right to data portability and to withdraw your consent at any time.

Data subjects may exercise their rights to access, erasure, rectification or restriction of processing of their personal data, data portability, or to object to the processing in the following ways:

by post to D-85521 Ottobrunn, Röntgenstrasse 24,

by email to the rswebdesign@rswebdesign.eu at the following email address,

by telephone on +49 1726528051

The data subject may unsubscribe from the newsletter at any time, free of charge.

The legal basis for data processing: the data subject’s consent, Article 6(1)(a) and (f), and Section 6(5) of Act XLVIII of 2008 on the fundamental conditions and certain restrictions on commercial advertising activities: The advertiser, the advertising service provider and the publisher of the advertisement shall – within the scope specified in the declaration of consent – keep a record of the personal data of the persons who have provided a declaration of consent to them. The data recorded in this register – relating to the recipient of the advertisement – may only be processed in accordance with the terms of the declaration of consent until such consent is withdrawn, and may only be disclosed to third parties with the prior consent of the data subject.

Please note that

Data processing is based on your consent and the service provider’s legitimate interests.
You must provide your personal data if you wish to receive our newsletter.
Failure to provide this information means that we will be unable to send you our newsletter.

Complaints Handling

The fact that data is collected, the scope of the data processed and the purpose of data processing:

Personal data – Surname and first name

Purpose of data processing – Identification, maintaining contact.

Email address – Contact details.

Telephone number – Contact details.

Billing name and address – Identification; handling quality complaints, queries and issues relating to the products ordered.

Stakeholders: All customers who have made a purchase on the website and have raised a complaint regarding quality.

Duration of data processing; deadline for erasure of data: The minutes of the complaint lodged, transcript and the response thereto must be retained for 5 years in accordance with Section 17/A(7) of Act CLV of 1997 on consumer protection.

Explanation of data subjects’ rights in relation to data processing:

The data subject may request from the data controller access to, rectification of, erasure of, or restriction of the processing of personal data relating to them, and
The data subject has the right to data portability and to withdraw their consent at any time.

Data subjects may request access to their personal data, the erasure or rectification of such data, or the restriction of its processing, as well as data portability, in the following ways:

by post to D-85521 Ottobrunn, Röntgenstrasse 24,

by email to the rswebdesign@rswebdesign.eu at the following email address,

by telephone on +49 1726528051

The legal basis for data processing: the data subject’s consent, Article 6(1)(c) and Section 17/A(7) of Act CLV of 1997 on Consumer Protection.

Please note that

The provision of personal data is based on a legal obligation.
The processing of personal data is a prerequisite for the conclusion of the contract.
You are required to provide your personal data so that we can process your complaint.
Failure to provide the required information means that we will be unable to process the complaint you have submitted to us.

Social Media Pages

The fact that data is collected, and the scope of the data processed: The name used to register on social media sites such as Facebook, Google+, Twitter, Pinterest, YouTube, Instagram, etc., and the user’s public profile picture.

Stakeholders: All those concerned who have registered on social media sites such as Facebook, Google+, Twitter, Pinterest, YouTube, Instagram, etc., and have „liked” the website.

The purpose of data collection is: Sharing, „liking” or promoting certain content, products or special offers on the website, or the website itself, on social media platforms.

The duration of data processing, the deadline for erasure of data, the identities of any potential data controllers entitled to access the data, and a description of the data subjects’ rights in relation to data processing: Data subjects may find information on the source of the data, how it is processed, the method of transfer and the legal basis for such processing on the relevant social media site. Data processing takes place on social media platforms; therefore, the duration and method of data processing, as well as the options for deleting and amending data, are governed by the terms and conditions of the relevant social media platform.

The legal basis for data processing: the consent of the volunteer concerned to the processing of their personal data on social media platforms.

Customer relations and other data processing activities

Should the data subject have any questions whilst using our services, or should they encounter any problems, they may contact the data controller via the methods provided on the website (telephone, email, social media, etc.).

The Data Controller will process the data provided in emails, messages, telephone calls, Facebook, etc., together with the enquirer’s name and email address, as well as any other personal data provided voluntarily, no later than 5 years after the data was provided.

We will provide information on any data processing operations not listed in this notice at the time the data is collected.

In the event of an exceptional request from a public authority, or a request from other bodies authorised by law, the Service Provider is obliged to provide information, disclose or transfer data, and make documents available.

In such cases, the Service Provider shall disclose personal data to the requesting party – provided that the latter has specified the exact purpose and scope of the data – only to the extent that is strictly necessary to fulfil the purpose of the request.

The rights of data subjects

The right of access

You have the right to receive confirmation from the data controller as to whether your personal data is being processed, and, if such processing is taking place, you have the right to access your personal data and the information set out in the Regulation.

The right to a correction

You have the right to have inaccurate personal data concerning you rectified by the data controller without undue delay upon your request. Taking into account the purposes of the data processing, you have the right to request that incomplete personal data be completed, including, amongst other things, by means of a supplementary statement.

The right to erasure

You have the right to request that the data controller erases your personal data without undue delay, and the data controller is obliged to erase your personal data without undue delay under certain conditions.

The right to be forgotten

Where the data controller has made the personal data public and is obliged to erase it, it shall take all steps that can reasonably be expected, taking into account the available technology and the costs of implementation – including technical measures – to inform data controllers processing such data that you have requested the deletion of links to the personal data in question or of copies or duplicates of that personal data.

The right to restriction of processing

You have the right to request that the data controller restrict the processing of your data if any of the following conditions are met:
If you contest the accuracy of the personal data, the restriction shall apply for a period enabling the data controller to verify the accuracy of the personal data;
the processing is unlawful, and you object to the erasure of the data and instead request that its use be restricted;
the data controller no longer needs the personal data for the purposes of data processing, but you require it for the purpose of establishing, exercising or defending legal claims;
You have objected to the processing of your data; in this case, the restriction applies for as long as it has not been determined whether the data controller’s legitimate grounds take precedence over your legitimate grounds.

The right to data portability

You have the right to receive the personal data concerning you, which you have provided to a data controller, in a structured, commonly used and machine-readable format, and you are also entitled to transmit this data to another data controller without being prevented from doing so by the data controller to whom you have provided the personal data.

The right to protest

In the case of data processing based on legitimate interests or the exercise of official authority as legal grounds, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data, including profiling based on the aforementioned provisions.

Objection in the case of direct solicitation

Where personal data are processed for the purposes of direct marketing, you have the right to object at any time to the processing of your personal data for this purpose, including profiling, insofar as it is related to direct marketing. If you object to the processing of your personal data for the purposes of direct marketing, your personal data may no longer be processed for that purpose.

Automated decision-making in individual cases, including profiling

You have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you. The preceding paragraph shall not apply where the decision:
It is necessary for the conclusion or performance of a contract between you and the data controller;
the processing is permitted by Union or Member State law applicable to the data controller, which also lays down appropriate measures to safeguard your rights, freedoms and legitimate interests; or
It is based on your express consent.

DEADLINE FOR ACTION

The data controller shall inform you of the measures taken in response to the above requests without undue delay, but in any event within 1 month of receiving the request. If necessary, this period may be extended by 2 months. The data controller shall inform you of any extension of the time limit, stating the reasons for the delay, within one month of receiving the request. If the data controller does not take any action in response to your request, it shall inform you without delay, but no later than one month from receipt of the request, of the reasons for failing to take action, and that you may lodge a complaint with a supervisory authority and seek judicial redress.

DATA PROTECTION

The data controller and the data processor shall, taking into account the state of the art and the cost of implementation, as well as the nature, scope, context and purposes of the data processing, and the risks of varying likelihood and severity to the rights and freedoms of natural persons, to ensure a level of data security appropriate to the risk, including, where applicable:

the pseudonymisation and encryption of personal data;
ensuring the ongoing confidentiality, integrity, availability and resilience of the systems and services used for the processing of personal data;
in the event of a physical or technical incident, the ability to restore access to personal data and ensure the availability of such data in a timely manner;
a procedure for the regular testing, assessment and evaluation of the effectiveness of the technical and organisational measures taken to ensure the security of data processing.

Informing the data subject about the data breach

Where a data breach is likely to result in a high risk to the rights and freedoms of natural persons, the data controller shall inform the data subject of the data breach without undue delay. The information provided to the data subject must describe the nature of the data breach in a clear and plain language, and must include the name and contact details of the data protection officer or any other contact person who can provide further information; it must describe the likely consequences of the data breach; the measures taken or planned by the data controller to address the data breach must be described, including, where appropriate, measures to mitigate any adverse consequences arising from the data breach. The data subject need not be informed if any of the following conditions are met:

the data controller has implemented appropriate technical and organisational security measures, and these measures were applied to the data affected by the data breach, in particular those measures – such as the use of encryption – which render the data unintelligible to any person not authorised to access the personal data;
following the data breach, the data controller has taken further measures to ensure that the high risk to the data subject’s rights and freedoms is unlikely to materialise in the future;
providing such information would require a disproportionate amount of effort.

In such cases, data subjects must be informed through publicly available information, or similar measures must be taken to ensure that data subjects are informed in an equally effective manner. If the data controller has not yet notified the data subject of the data breach, the supervisory authority may, after assessing whether the data breach is likely to result in a high risk, order that the data subject be notified.

REPORTING A DATA PROTECTION INCIDENT TO THE AUTHORITY

The data controller shall notify the competent supervisory authority of the data breach without undue delay and, where possible, no later than 72 hours after becoming aware of the data breach, to the competent supervisory authority in accordance with Article 55, unless the data breach is unlikely to pose a risk to the rights and freedoms of natural persons. If the notification is not made within 72 hours, the reasons for the delay must also be provided.

COMPLAINTS PROCEDURE

Complaints regarding any breach of the law by the data controller may be lodged with the National Authority for Data Protection and Freedom of Information: National Authority for Data Protection and Freedom of Information, 1125 Budapest, Szilágyi Erzsébet fasor 22/C. Postal address: 1530 Budapest, PO Box 5. Telephone: +36 -1-391-1400 Fax: +36-1-391-1410 E-mail: ugyfelszolgalat@naih.hu

EPILOGUE

In preparing this information leaflet, we have taken the following legislation into account:

– On the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (27 April 2016)

– Act CXII of 2011 – on the right to informational self-determination and freedom of information (hereinafter: the Information Act)

– Act CVIII of 2001 – on certain aspects of electronic commerce services and information society services (in particular Section 13/A)

– Act XLVII of 2008 – on the prohibition of unfair commercial practices towards consumers;

– Act XLVIII of 2008 – on the fundamental conditions and certain restrictions on commercial advertising (in particular Section 6)

– Act XC of 2005 on Freedom of Information in the Electronic Sector

– Act C of 2003 on Electronic Communications (specifically Section 155)

– Opinion No. 16/2011 on the EASA/IAB Recommendation on Best Practice for Behavioural Online Advertising

– The National Authority for Data Protection and Freedom of Information’s recommendation on data protection requirements for prior notification

– Regulation (EU) 2016/679 of the European Parliament and of the Council (27 April 2016) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

Last updated: 24 June 2026

Privacy Policy

RS Web Design

Consultation