Privacy Policy
PRIVACY POLICY
Heitz Élfurnér Művek Kft.
Heitz Élfurnér Művek Kft. (hereinafter referred to as: "Company") hereby informs visitors to the website at www.heitz.hu, job seekers, relatives of employees, and prospective business partners of the processing of personal data concerning them by the Company, and the rights of data subjects related to processing.
Processing by the Company shall be governed by the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (hereinafter referred to as: "GDPR"), and Act No. CXII of 2011, the Info Act, as well as other sectoral legislation.
1. Terms
Personal data: any information relating to an identified or identifiable natural person ("data subject") An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
Processing: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
Data subject: any natural person directly or indirectly identifiable by reference to specific personal data;
Controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the data controller or the specific criteria for its nomination may be provided for by Union or Member State law;
Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
Recipient: a natural or legal person, public authority, agency or another body, to which the personal data are disclosed;
Consent of the data subject: any freely given, specific, informed and unambiguous indication of the wishes of the data subject by which he/she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
2. Details of the controller:
| Name of the controller: | Heitz Élfurnér Művek Gyártó és Kereskedelmi Korlátolt Felelősségű Társaság |
| Company reg. No. of the controller: | Cg.07-09-011006 |
| Registered office of the controller: | 2490 Pusztaszabolcs, Iskola u. 1. |
| Electronic contact details of the controller: | moster_at_heitz.hu |
| Representative of the controller: | Manfred Oster, managing director |
| Name and contact details of the person responsible for data protection at the controller: | Manfred Oster, Heitz Élfurnér Művek Kft. H-2490 Pusztaszabolcs Iskola u. 1. Tel.exch.: 06-25/517-770, 517-771 |
3. Information on the processing of your personal data
3.1 Data of visitors to our website
Our Company does not collect data about visitors to our website, so e.g. our website does not use cookies, we do not record IP addresses, browser type, the URL of retrieved websites, or any other data.
3.2 Data of job applicants
| Information on processing |
| The scope of processed data | name, place and date of birth; mother's name; address; qualification data; photo; other data provided by the applicant |
| The purpose of processing | filling vacancies |
| The persons having access to the data | managing director, production assistant, staffing manager |
| The legal ground for processing |
- consent given by the applicant (par. a) of subsection (1) of Section 6 of the GDPR) - consent given by the applicant (par. a) of subsection (1) of Section 6 of the GDPR) |
| The duration of processing |
- in the case of applications for vacant positions and recruitment, or in the case of unsolicited applicants invited to an interview: 3 months from the filling of the position, or until a request for erasure is made by the applicant; - unsolicited applications: the application shall be permanently erased within 7 days from receipt, or the applicant shall be invited to an interview - in the case of employees with whom the Company concludes an employment contract on the basis of an application for a job advertisement in any way, CVs shall be erased within 8 days after the termination of employment |
| The means of data storage | paper-based and electronic |
| The rights of the applicant | right to information on processing, to rectification, to erasure, to object to processing, to data portability, to withdraw consent, and to lodge a complaint with the National Authority for Data Protection and Freedom of Information (NAIH) |
| The obligation to provide data | the provision of data is not mandatory, however, without them we cannot assess the application of the applicant, and the provision of data is essential for the conclusion of an employment contract, without the provision of data it is impossible to hold an interview and to conclude an employment contract |
3.3 Data of third parties associated with employees
| Information on processing |
| The scope of processed data | data required by law for receiving entitlements and benefits; contact details of a third party designated by the employee |
| The purpose of processing | receiving certain entitlements and benefits related to the employment, in the event of a work accident, notification of the person designated in advance by the employee involved in the accident |
| The persons having access to the data | managing director, production assistant |
| The legal ground for processing |
- consent given by the third-party data subject (par. a) of subsection (1) of Section 6 of the GDPR), or in the absence thereof - a legitimate interest pursued by the employee (par. f) of subsection (1) of Section 6 of the GDPR). - legitimate interest: receiving certain entitlements and benefits related to the employment, in the event of a work accident, notification of the person designated in advance by the employee involved in the accident |
| The duration of processing |
- for contact details until the 7th day following the termination of employment -for data related to taxation or social security 8 years (the limitation period for tax assessment) |
| The means of data storage | electronic and paper-based |
| The rights of the data subject |
right to information on processing, to rectification, to erasure, to object to processing, to data portability, to withdraw consent, and to lodge a complaint with the National Authority for Data Protection and Freedom of Information (NAIH) |
| The obligation to provide data | the provision of data is not mandatory for third parties. If the data are not provided, the employee will not be able to exercise the rights requiring the provision of data, e.g. there will be no person to be notified in case of an emergency, he/she will not be able to receive the given social security benefit, etc. |
3.4 Data of business partners
In the bidding phase
| Information on processing |
| The scope of processed data |
- for a corporate contracting partner: name, corporate e-mail address, corporate phone number of the contact person - for a natural person contracting partner: name, e-mail address, phone number, place and date of birth, mother's name, address - for marketing purposes: name, e-mail address, phone number |
| The purpose of processing |
- conclusion of a contract on the basis of the bid - enforcement of a claim in connection with the bid or defence in the event of a legal dispute - marketing for the purpose of concluding a future contract |
| The persons having access to the data | managing director, customer account managers |
| The legal ground for processing |
- for the data of the contact person of a corporate contracting partner: authorization by legislation on the basis of a legitimate interest pursued by the contracting partner (par. f) of subsection (1) of Section 6 of the GDPR) - legitimate interest: the conclusion of a contract - authorization by legislation in order to take steps at the request of the data subject prior to entering into a contract (par. b) of subsection (1) of Section 6 of the GDPR) - for marketing purposes and for the purpose of concluding future contracts consent given by the customer (par. a) of subsection (1) of Section 6 of the GDPR) |
| The duration of processing |
- 5 years from the end of the bidding procedure (the limitation period for civil law claims) - for processing for marketing purposes until the withdrawal of consent |
| The means of data storage | paper-based and electronic |
| The rights of the data subject | right to information on processing, to rectification, to erasure, to object to processing, to data portability, to withdraw consent, and to lodge a complaint with the National Authority for Data Protection and Freedom of Information (NAIH) |
| The obligation to provide data |
- the provision of data is not mandatory, however, without them we cannot assess the received bid, or we ourselves cannot make a bid, and the provision of data is essential for the conclusion of a contract - the provision of data for marketing purposes is not mandatory. If data are not provided, we will not be able to contact our partner with our offers |
In the contracting phase
| Information on processing |
| The scope of processed data |
- for a corporate contracting partner: name, corporate e-mail address, corporate phone number of the designated contact person, - for a natural person contracting partner: name, place and date of birth, mother's name, address - for marketing purposes: name, e-mail address, phone number |
| The purpose of processing |
- conclusion and performance of a contract - proof for any warranty claims - if transferred to the parent company of the parent company of the Company, as processor, maintaining contact for organizing production and delivery; - after the performance of the contract marketing purposes |
| The persons having access to the data |
- managing director, customer account managers - employees involved in the performance of the contract - managing director, customer account manager of the parent company of the parent company of the Company, H.Heitz Furnierkantenwerk Gmbh & Co. KG. (company reg. No.: HRA 5948, registered office: DE-49324 Melle, Maschweg 27.), as processor |
| The legal ground for processing |
- for the data of the contact person of a corporate contracting partner: authorization by legislation on the basis of a legitimate interest pursued by the contracting partner (par. f) of subsection (1) of Section 6 of the GDPR) legitimate interest: designation of a contact person for the performance of a contract - for a natural person contracting partner: authorization by legislation for the performance of a contract (par. b) of subsection (1) of Section 6 of the GDPR) - authorization by legislation on the basis of a legitimate interest pursued by the Company (par. f) of subsection (1) of Section 6 of the GDPR) legitimate interest: proof for any warranty claims consent of the data subjects to the processing of the data of corporate contact persons and natural person contracting partners for marketing purposes (par. f) of subsection (1) of Section 6 of the GDPR) |
| The duration of processing |
- 5 years from the termination of the contract (the limitation period for civil law claims) - the parent company of the parent company shall erase the data within 14 days from the performance of the given contract. - for processing for marketing purposes until the withdrawal of consent |
| The means of data storage | paper-based and electronic |
| The rights of the data subject | right to information on processing, to rectification, to erasure, to object to processing, to data portability, to withdraw consent, and to lodge a complaint with the National Authority for Data Protection and Freedom of Information (NAIH) |
| The obligation to provide data |
the provision of data is essential for the conclusion and performance of a contract, without them it is impossible to conclude a contract, or any concluded contract shall terminate the provision of data for marketing purposes is not mandatory. If data are not provided, we will not be able to contact our partner with our offers |
4. The rights of data subjects
The data subject shall send his/her requests related to the enforcement of his/her rights against the Company, concerning processing by the Company, to the managing director of the Company, or to the person responsible for data protection at the Company by e-mail or in any other way.
The rights of the data subject:
Right to information
At the request of the data subject, the Company shall be obliged to provide information to the data subject on whether or not personal data concerning him/her are being processed, and, where that is the case, the following information as well:
a) the purpose of the processing;
b) the categories of personal data concerned;
c) the recipients or categories of recipient to whom the personal data have been or will be disclosed;
d) the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
f) the right to lodge a complaint with NAIH;
g) where the personal data are not collected from the data subject, any available information as to their source;
h) whether data are transferred to a third country or to an international organization.
The Company shall provide the necessary information to the data subject free of charge within 30 days from the receipt of the request through the person responsible for data protection at the Company. The Company shall provide a copy of the personal data to the data subject upon request. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the above information shall be provided in an electronic form. If the Company fails to take action on the request of the data subject, the Company shall inform the data subject without delay and at the latest within 30 days of the receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with NAIH and seeking a judicial remedy.
The data subject may make his/her request in any form, or may authorize a representative to act on his/her behalf. For each request, the identity of the requester, and the identity and the right of representation, typically the authorization, of any representative shall be verified. The requested information shall be provided to the requester or his/her representative only if they have been successfully identified and the right of representation of the representative has been verified. No one may request the provision of information about another person without authorization. The provision of information shall be performed in such a way that data concerning another person or the business secrets of the Company shall not be disclosed. The provision of information shall be performed preferably in the form requested by the data subject, but for reasons of cost saving the electronic form shall be preferred, provided that it is accepted by the data subject. If the request is received electronically, the reply can be sent electronically without any further question. Original documents shall not be sent. The information shall be provided free of charge, however, where request are manifestly unfounded or excessive because of their repetitive character, a reasonable fee may be charged, provided that it is approved by the person responsible for data protection at the Company.
Right to rectification
At the request of the data subject, the Company shall be obliged to rectify without undue delay any inaccurate personal data concerning him/her, or, taking into account the purposes of processing, to complete any incomplete personal data on the basis of a supplementary statement provided by the data subject.
Right to erasure
In the cases specified in par. (1) of Article 17 of the GDPR, the data subject shall have the right to obtain from the Company the erasure of personal data concerning him/her without undue delay. Where the Company has transferred the personal data to a third party or made them public and is obliged to erase the personal data, the Company, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data. The Company may have a legal obligation to retain the data or a legitimate interest in it, therefore the approval of the person responsible for data protection shall be sought in all cases before erasing the data.
Right to restriction of processing
In the cases specified in par. (1) of Article 18 of the Regulation, the data subject shall have the right to obtain from the Company restriction of processing. A data subject who has obtained restriction of processing shall be informed by the Company before the restriction of processing is lifted.
The Company shall communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The Company shall inform the data subject about those recipients if the data subject requests it.
Right to data portability
In the cases specified in par. (1) of Article 20 of the Regulation, the data subject shall have the right to receive the personal data concerning him/her, which he/she has provided to the Company, in a structured, commonly used and machine-readable format, and shall have the right to transmit those data to another controller. At the request of the data subject, where technically feasible, the Company shall transmit the personal data directly to the controller designated by the data subject.
Right to object
The data subject shall have the right to object at any time to the processing of personal data concerning him/her which is based on point (e) or (f) of par. (1) of Article 6 of the Regulation. The Company shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
4. Complaint
The data subject may lodge a complaint about data processing by the Company with the following body:
name: National Authority for Data Protection and Freedom of Information
(Nemzeti Adatvédelmi és Információszabadság Hatóság)
registered office: 1024 Budapest, Szilágyi Erzsébet fasor 22/C.
website: www.naih.hu
5. Right to judicial remedy
According to Section 23 of the Info Act, the data subject may seek judicial remedy against the processing operations of the Company under the provisions of Section 23 of the Info Act, if in the view of the data subject the Company infringes, in the course of processing his/her personal data, the provisions laid down in laws or the binding legal act of the European Union on the processing of personal data.
6. Enforcement of rights related to personal data after the death of the data subject
Within five years of the death of the data subject, the rights to information (access), to rectification, to erasure, to restriction of processing, and to object, to which the data subject was entitled in his/her life, may be enforced by a person authorized to do so by the data subject in the form of an administrative disposal or a declaration made to the Company and incorporated in a public deed or a private deed of full probative value, taking into account the declaration of the later date if the data subject made more than one declaration to the Company.
If the data subject did not make a declaration complying with the above, his/her close relative as specified in the Civil Code may enforce, even in the absence of such a declaration, within five years of the death of the data subject, the rights to rectification or to object, to which the data subject was entitled in his/her life, and, if the processing had already been unlawful in the life of the data subject or the purpose of processing terminated upon the death of the data subject, the rights to erasure and to restriction of processing as well. The close relative who is the first to exercise the rights of the data subject shall be entitled to enforce his/her rights under this paragraph.
The person enforcing the rights of the data subject shall prove the fact and the date of the death of the data subject with an extract from the register of deaths or a court decision, his/her own identity, and in the above case his/her close relative status with a public deed.
Upon request, the Company shall inform the close relative of the data subject as specified in the Civil Code on the actions taken on the basis of the above, unless the data subject had prohibited it in his/her declaration specified above.