Version: 1.0
Date: 23.09.2021
Privacy Notice
The purpose of this Privacy Notice is to provide you with accurate and comprehensive information regarding the use of your Personal data with respect to the Platform (as defined below).
This Privacy Notice was prepared to take into account the relevant laws and regulations, most notably:
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, “GDPR”);
- The Hungarian Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information;
- The Hungarian Act C of 2003 on Electronic Communications, and
- The Hungarian Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities.
1. Basic concepts
This list of basic concepts is aimed at helping you to better understand this Notice.
Notice: this Privacy Notice.
Personal data: any information relating to an identified or identifiable natural person such as a name, or contact data, based on which the given natural person can be directly or indirectly (that is, combined with other information) identified.
Data subject: you, as a natural person with respect to whom the Data Controller processes Personal data.
Data Controller or “we”: the entity determining the purposes and means of the Data processing. The controller of your Personal data is KÖR Innovatív Zrt. (company registry number: 13-10-042118, registered seat: H-2600 Vác, Gödöllői út 6. B. ép.; Hungary).
Data processing: any action performed on Personal data, such as collection, structuring, storage, transmission or erasure.
Data Processor: An entity that processes Personal data on our behalf, as per our instructions.
Recipient: an entity to which we transfer Personal data.
Platform: the online platform made available by us to you as a private entrepreneur or to the company or other organisation that employs you, which platform enables service providers (including us) to sell, distribute, advertise, promote the sale of, or otherwise make available their laboratory and engineering services, subject to our Terms and Conditions, to us or to our customers who wish to make use of such services.
Cookie: cookies are small text files that are placed on your device (e.g. a computer) used when visiting the Platform. Each cookie is stored on your device for a specific period of time, allowing the Platform to “remember” certain data and settings. Cookies do not pose any security risk to your device and do not cause any malfunctions.
IP address: short for Internet Protocol address, an IP address is a unique set of numbers associated with each device connected to the internet. Devices use these addresses to communicate with one another. It also identifies the device you use when visiting the Platform.
Third country: all countries outside the European Economic Area. (In addition to the Member States of the European Union, the countries of the European Economic Area are Norway, Iceland and Liechtenstein.)
2. Why and when do we process your Personal data?
The Data Controller is the owner and operator of the Platform. The purpose of the Platform is to create an online marketplace that links business organizations in need of laboratory and engineering expert services with organizations and individual entrepreneurs who offer such capabilities. In accordance with our Terms and Conditions, the company or other organisation that employs you or you as an individual entrepreneur can register to the Platform and use it to sell, distribute, advertise, promote the sale of, or otherwise make available, search for, access to, use or otherwise purchase laboratory and engineering services.
In order to allow for the registration and subsequent use of the Platform, it is necessary to process certain Personal data of the natural persons acting as the representatives or contact persons of the organizations or the Personal data of individual entrepreneurs using the Platform. Therefore, to the extent such Personal data is processed, the use of the Platform and certain related processes entail the processing of Personal data.
You can find a detailed summary of the categories of Personal data processed, the purposes of the Data processing, the legal grounds of the processing as well as the applicable data retention periods in Section 4.
3. What are the principles of our Data processing?
When processing your Personal data, we adhere to the following principles:
- We process your Personal data lawfully, fairly and in a transparent manner. This means that you will always be provided with all the relevant information that relates to how and why your Personal data is processed and what privacy-related rights you may exercise during the course of the Data processing. It also means that the Data processing will always have a valid, real and lawful purpose. We will never process your Personal data for non-disclosed or not sufficiently specific purposes.
- We do not collect or store any data that is not necessary for the purposes described in Section 4. Apart from the data specified there, we do not collect or use any Personal data, nor do we collect Personal data that we plan to use only in the future for a purpose yet to be determined.
- We process your data only for as long as necessary given the underlying purpose. We do not store your data indefinitely, the applicable retention periods are communicated to you in a transparent manner and once the given period is over, your data will be erased without the possibility to restore them.
- We shall do our best to ensure that your Personal data is kept accurate and up to date. For this purpose, we kindly ask you to inform us of any change in your Personal data that we process.
- We always take appropriate steps to ensure the safety of your Personal data and minimize the risk of unauthorized access, disclosure or any other event or data breach that could compromise the confidentiality, integrity or availability of your data.
- We know that first and foremost, you are the one who has the right to decide what happens to your Personal data. We examine and address any queries, requests or complaints you have in relation to the processing of your Personal data and respond to those within the statutory deadline. The same is true when you wish to exercise your rights detailed in Section 8.
4. How do we process your Personal data?
In this Section we describe all possible cases when we process your Personal data. This helps you see what Personal data we process, why, on what grounds and for how long.
4.1. Business contact details for the purposes of communication
What Personal data do we process?
Your contact data are used when your organization registers on the Platform and gives us your business contact details. We will need your business email address, for the purposes of communicating with your organization.
If your name, job title and business phone number are provided as well, we will use those to facilitate contact with the organization.
Why do we process your Personal data?
We process your Personal data for the following purposes:
- registering the organization, thereby allowing access to the Platform,
- providing support in the context of using the Platform;
- communicating with your organization regarding the use of the Platform and in relation to our contractual arrangements with your organization,
- preparation, execution, and fulfilling of contractual arrangements with your organization in accordance with our Terms and Conditions.
On what legal grounds do we process your Personal data?
We process your Personal data on the grounds of our legitimate interest related to operating the Platform, providing services to our registrants in line with our Terms and Conditions and performing our contractual obligations arising from any specific contractual arrangements concluded with the organisation appointed you as a contact person.
How long do we store your Personal data?
We process your Personal data:
- until your organisation informs us that another contact person has taken your place, but in no case after the expiry of the civil law statutory limitation period (5 years), which starts when the contractual arrangement is terminated between your organisation and us for any reason; or
- until you, as Data subject object to the Data processing, and our assessment finds no compelling cause that overrides your objection.
4.2. Registration on the Platform as individual entrepreneur
What Personal data do we process?
If you register on the Platform as an individual entrepreneur, we will process your name, job title, business email address, business telephone number, registration no., VAT no. or other tax identification no., URL of your website as an individual entrepreneur (if any), your registered address and address(es) of your other business premises, your mailing address, your billing name and address, the amount of fee agreed under any contractual arrangement concluded by using the Platform and any other business information of you as an individual entrepreneur shared with us or became known to us in connection with the use of the Platform.
You can also disclose to us your Personal data pertaining to your professional qualifications, expertise, licenses or other information that has relevance for us to achieve the purposes of the Platform specified in our Terms and Conditions (the Personal data that we collect will, under no circumstances, extend beyond your professional domain).
Why do we process your Personal data?
We process your Personal Data in order to:
- register you as an individual entrepreneur, thereby allowing access to the Platform;
- provide support in the context of using the Platform;
- communicate with you regarding the use of the Platform and in relation to our contractual arrangements;
- prepare, execute and fulfill contractual arrangements with you in accordance with our Terms and Conditions;
- meet our mandatory accounting and tax payment obligations.
On what legal grounds do we process your Personal data?
If you register as an individual entrepreneur, we process your Personal data as it is necessary for the performance of the contractual arrangement concluded by and between you and us.
Your billing and other data used for invoicing will be processed in order to ensure our compliance with legal obligations to which we are subject under the statutory provisions of accounting and tax law.
How long do we store your Personal data?
We process your Personal data until the expiry of the civil law statutory limitation period (5 years), which starts when the contractual arrangement is terminated between you and us for any reason.
Regarding accounting and taxation, we will retain your Personal data as required to do so by the mandatory provisions of law (i.e. documents related to financial settlement shall be retained for eight years).
4.3. Information on expertise, qualifications and licenses of professionals
What Personal data do we process?
If a service provider which employs you as an engineer or other expert shares information through the Platform with us about you, we will process your Personal data pertaining to your professional qualifications, expertise, licenses or other information that has relevance for us to achieve the purposes of the Platform specified in our Terms and Conditions (the Personal data that we collect will, under no circumstances, extend beyond your professional domain).
Why do we process your Personal data?
We process your Personal data in order to offer, promote and sale the laboratory or engineering services of your organisation to our clients.
On what legal grounds do we process your Personal data?
We process your Personal data on the grounds of our legitimate interest related to operating the Platform and offering your organisation’s laboratory and engineering services to our clients.
How long do we store your Personal data?
We will process your Personal data:
- until the expiry of the civil law statutory limitation period (5 years), which starts when the contractual arrangement is terminated between your organisation and us for any reason; or
- until you, as Data subject object to the Data processing, and our assessment finds no compelling cause that overrides your objection.
4.4. Inquiries, complaints and exercising Data subject rights
What Personal data do we process?
Your contact data (especially your name, email address, phone number, the name and other data of the organisation that employs you), further, any Personal data you disclose to us in the course of handling complaints or responding to queries related to the use of the Platform, the contractual relationship between us and you or the organisation employing you, or the exercising of Data subject rights (such as the detailed description of the complaint or query).
Please disclose Personal data in your request or complaint only to the extent absolutely necessary in order to fulfill your request or complaint. Please do not disclose any data that falls into the special categories of Personal data (such as data relating to ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health-related data, or data concerning a person’s sex life or sexual orientation). If you deem that it is absolutely necessary to disclose special data to us, please include your explicit consent in your query/complaint (or, in case the special data do not relate to you, the explicit consent of the Data subject it relates to), allowing us to process such data.
Why do we process your Personal data?
We process your Personal data for the purposes of handling complaints, answering queries related to the use of the Platform or exercising of the Data subject rights detailed in Section 8.
On what legal grounds do we process your Personal data?
We process your Personal Data on the grounds of our legitimate interest related to handling and responding to queries, complaints related to the Platform, the contractual relationship between us and you or the organisation employing you, further, our legitimate interest related to fulfilling our obligation to ensure you can exercise Data subject rights under the GDPR.
How long do we store your Personal data?
We process your Personal data:
- until the end of the civil law statutory limitation period (5 years), which starts from the conclusion of handling the complaint or responding to the query or Data subject request; or
- until you, as Data subject object to the Data processing, and our assessment finds no compelling cause that overrides your objection.
4.5. Disclosing reports and other deliverables to our customers
What Personal data do we process?
Your Personal data as an individual entrepreneur/employee or other expert hired by the service provider for preparing the report or other deliverable (typically your name and email address).
We will ensure that the reports and other deliverables provided by laboratory or engineering service providers to our customers in accordance with our Terms and Conditions do not contain Personal data relating to the individuals who contributed to the given deliverable.
This means in practice that we will remove any and all Personal data pertaining to you that is contained in the deliverable before we disclose it to our customers. We will, however, retain such information for our own records and for the purposes contained in Section4.8. The information will be available to us only and will be treated in a confidential manner.
We ask you not to include any Personal data in the user content (as defined in our Terms and Conditions) uploaded and posted through the Platform.
Why do we process your Personal data?
We remove your Personal data from the given deliverable so that the deliverable can be disclosed to the customer without unnecessarily containing Personal data.
Reports without any Personal data may be used by us in order to develop or improve the Platform and our services, this, however, does not constitute Data processing.
As for why we retain your Personal data for our own records, please see Section 4.8.
On what legal grounds do we process your Personal data?
We process your Personal data on the grounds of our legitimate interest related to operating the Platform, more specifically, on the grounds of our legitimate interest related to ensuring that only deliverables without your Personal data are disclosed to the customer, or used for developing the Platform and our services, thereby we adhere to the principle of data minimization and do not process unnecessary Personal data.
How long do we store your Personal data?
For the purpose described herein, we process your Personal data during its deletion from the report or other deliverable to be disclosed.
As for retaining it for our own records, please see Section 4.8.
4.6. Cookies and tracking codes
What Personal data do we process?
Personal data collected by Cookies and tracking codes active on the Platform, namely:
- the IP address and type of the device you use when visiting the Platform;
- the browser and operating system you use when visiting the Platform;
- certain parameters relating to your activity on the Platform, such as where you clicked, how long you stayed at a given site of the Platform and in which order you browsed the various sites of the Platform.
Why do we process your Personal data?
We use multiple Cookies and tracking codes on the Platform. Some are used only if you consent thereto.
The Cookie categories used are the following:
- Category 1: These Cookies are used in order to provide you with personalized content relating to our activities and services based on the analysis of your activity on the Platform. Some tracking codes also fall into this category.
- Category 2: These Cookies carry out statistical, aggregate analysis, which is important to us as this is how we learn certain preferences of our user. Based on this information we can improve the various functionalities of the Platform. Some tracking codes also fall into this category.
- Category 3: These Cookies are used for the purposes of load-balancing the Platform as a website, ensuring its security, remembering certain user settings, displaying content and optimizing its efficiency in various ways. Without these Cookies, certain functions of the Platform would not work properly or at all. These Cookies are automatically deployed to your computer when you visit the Platform and acknowledge the use of Cookies. Note that in this category, there are no tracking codes used.
On what legal grounds do we process your Personal data?
- Categories 1 and 2: on the basis of your voluntary, explicit and informed consent, which you can withdraw at any time (note that you can also manage your cookie settings in your browser);
- Category 3: on the basis of our legitimate interest related to ensuring the proper technical functionality of the Platform as a website.
4.7. Marketing
What Personal data do we process?
Your name and business email address provided when registering yourself as an individual entrepreneur or your organization on the Platform.
Why do we process your Personal data?
We process your Personal data for the purposes of sending newsletters and information on our services.
On what legal grounds do we process your Personal data?
We process your Personal data on the grounds of your explicit, informed and voluntary consent, which you can withdraw at any time.
Such withdrawal will not affect the lawfulness of our Data processing carried out before you withdrew your consent.
How long do we store your Personal data?
We process your Personal data:
- until the withdrawal of your consent; or
- if we erase your contact details for the reason specified in Section 4.1 of this Notice (i.e. because your objected to the use of your contact details).
4.8. Legal claims
What Personal data do we process?
Your Personal data disclosed to us through the Platform (including Personal data contained in a report or other deliverable).
Why do we process your Personal data?
We process your Personal data for the purposes of the establishment, exercise or defence of our legal claims in case of an authority, court or arbitration tribunal procedure.
On what legal grounds do we process your Personal data?
We process your Personal data on the grounds of the establishment, exercise or defence of our legal claims in case of an authority, court or arbitration tribunal procedure.
How long do we store your Personal data?
Until the end of the civil law statutory limitation period (5 years), which starts when the registered profile of the organization you represent, or your individual entrepreneur profile is deleted from the Platform.
5. How do we store your Personal data?
We store and process all your Personal data on properly protected servers. All servers we use are located in the territory of the European Union and the Personal data stored on the servers and is not accessible from Third countries.
6. To whom do we disclose your Personal data?
We treat your Personal data confidentially and do not disclose it to third parties except as listed here.
These exceptions are the following:
- in the case of exercising legal claims or defending against the legal claims of others, we might need to transfer your Personal data to our legal advisors, who will, at all times, be bound by confidentiality obligations as well as the professional secrecy rules applicable to attorneys at law;
- if a court procedure is initiated in relation to the contractual arrangements between you or your organisation and us, your Personal data might be disclosed to the court and other participants of such procedure;
- upon the request of authorities or courts, we are obliged to provide the information requested, which may contain your Personal data. We cannot be held responsible for such data transfers and their consequences. You will be notified if such a transfer takes place, to the extent permitted by the applicable laws.
7. What are your rights with respect to Data processing?
You, as a Data subject, have various rights with regards to the processing of your Personal data. These are set forth in the GDPR and you can exercise them at any time by contacting us.
Our contact details:
Data protection coordinator: Ms. Zsófia Szewczyk
email: dataprivacy@kor-group.com
postal address: 1134 Lehel street 11, Budapest HUNGARY
We consider your request on exercising your rights under GDPR authentic if we can clearly identify you based on your request. We will consider your request authentic only if it is made in writing or it is submitted via e-mail from your e-mail address known to us. Unless you voluntarily verify your identity in a different way, we cannot send information to any other email or postal address not previously known to us – in order to ensure the security of your Personal data.
We ask you to describe your request in a concise, clear manner in your own words and we will make sure to examine it and take the necessary steps. We will respond to each request submitted within 25 days of receiving the request. Exercising your rights is free of charge.
7.1. Right to access
Right to access means that you are entitled to request information about our processing of your Personal data. You can request us at any time to inform you whether we process your Personal data and if yes
- what data we process about you,
- what is the purpose of our Data processing,
- to which recipients we disclose your Personal data,
- how long does the retention period take (how long we keep your Personal data),
- what rights you have in relation to the Data processing, and
- whether we transfer your Personal data to any third countries or organisations and if we do, what additional guarantees we put in place to ensure the safety of your Personal data.
Additionally, you can request us to provide you with a copy of your Personal data processed by us. These copies will always be provided to you in the form of a pdf file, an email or in another form depending on the circumstances. We can only deny providing such a copy to you if it has a negative impact on the rights and freedoms of someone else or would violate the intellectual property or business secrets of someone else.
7.2. Right to rectification
If you have reason to believe that any of the Personal data we process about you is no longer correct (for example because your job title or email address changed) you can request us at any time to correct or update the data in question and we kindly ask you to do so, so that our records only contain your relevant and actual data. If feasible, we will also inform any Recipients of the change in your data so they can update their registries accordingly. We will provide you on request a list of Recipients to whom we communicated the change.
If you are registered as a contact person of an organization, we kindly ask you to let us know if you are no longer associated with the organization on behalf of which your contact data was registered on the Platform. If possible, please also provide us with the new contact data we can use.
7.3. Right to erasure (“right to be forgotten")
You have the right to be forgotten.
This means that we will, without undue delay erase any or all of your Personal data, if at least one of the following criteria is met:
- we no longer need the data for any of the purposes specified in Section 4 above;
- we were processing your data on the basis of your explicit consent (e.g. for marketing purposes or for certain Cookie types) and you withdraw such consent;
- we were processing your data based on our legitimate interest and you object to such processing, provided that based on our assessment, there are no legitimate grounds that override your objection;
- despite our best efforts, for some reason the data is has been processed unlawfully;
- we must erase the data in compliance with a mandatory provision in the laws either of the European Union or Hungary;
If feasible, we will also inform any Recipients of the erasure of your Personal data. We will provide you on request a list of Recipients to whom we communicated the fact of erasure.
Please note that we are not required to delete your data if the Data processing is necessary for the establishment, exercise or defence of our legal claims, or we are required by European Union of Hungarian law to store the data.
7.4. Right to restriction of Data processing
You can request the restriction of Data processing if at least one of the following criteria is met:
- you contest the accuracy of the data – in this case, the restriction extends to the period while we check the accuracy of the data;
- despite our best efforts the Data processing was unlawful, however, instead of erasing your data, you request that its processing be restricted;
- we no longer need your Personal data for any of the purposes specified above, but the data is needed for the establishment, exercise or defence of our legal claims;
- you objected to the processing – in this case, the restriction extends to the period until which we assess whether there are any legitimate grounds that override your objection.
When Data processing is restricted, we are permitted to store Personal data, but we are not allowed to use it. Please note that the restriction of Data processing does not apply, if the Data processing is necessary for the establishment, exercise or defence of our legal claims or for the protection of the rights of another person.
If you registered on behalf of a business organization, please consider that your Personal data is always processed as part of a business organisation profile registered on the Platform. Therefore, if you request the restriction of the processing of your Personal data, this might result in our inability to maintain contact with the organization on behalf of which your data was provided and we might not be able to fulfil our contractual obligations to your organisation.
We explicitly exclude any and all liability for the event when communication with your business organization or performing our obligations becomes impossible because you requested the restriction of the processing of your Personal data.
7.5. Right to object
If the legal basis for the processing of your Personal data is our legitimate interest or that of a third party, you may object to the processing at any time. Upon objection, we will erase your Personal data, except if
- our Data processing is justified by legitimate and compelling causes that override your objection, or
- the Data processing is required for the establishment, enforcement or defence of our legal claims.
If you registered on behalf of a business organization, please consider that your Personal data is always processed as part of a business organisation profile registered on the Platform. Therefore, if you object to the processing of your Personal data, this might result in our inability to maintain contact with the organization on behalf of which your data was provided and we might not be able to fulfil our contractual obligations to your organisation.
We explicitly exclude any and all liability for the event when communication with your business organization or performing our obligations becomes impossible because you objected to the processing of your Personal data.
7.6. Right to data portability
You can request that we provide you with your Personal data specified in Sections 4.2, 4.6 (in the case of Cookie categories 1 and 2) and 4.7 in a commonly used, machine-readable format (e.g. a pdf file or email) or that your Personal data be transferred directly to another data controller of your choice.
You can exercise this right only if the legal basis for the Data processing is your explicit consent or the Data processing is necessary for the preparation or conclusion of a contract between you and us.
7.7. Profiling
Cookies and tracking codes belonging to category 1 described in Section 4.6 also carry out profiling.
The logic behind their functioning is the following;
Certain criteria of your activity (e.g. where you click on the Platform, how long you remain there) are logged by these Cookies and tracking codes;
- this allows us to draw certain conclusions about your preferences which we can later use to provide you with personalized content in the form of advertisements. This is what you’ve likely already experienced with webshops or online marketplaces where, based on your previous searches, certain goods are advertised to you on dynamic surfaces integrated into websites;
- note that we will use the results of this analysis to send you custom-tailored newsletters and other information directly, only if you also consented to receiving newsletters as per Section 4.7.
7.8. Right to lodge a complaint, right to an effective judicial remedy
We hope that you will never have reason to lodge any complaint against the processing of your Personal data by us.
Nevertheless, we inform you of your rights to effective legal remedy as follows.
If you believe that your Personal data is processed unlawfully, you may file a complaint with the competent data protection supervisory authority. In Hungary, this is the National Authority for Data Protection and Freedom of Information (in Hungarian: “Nemzeti Adatvédelmi és Információszabadság Hatóság”, “NAIH”).
Address: 1055 Budapest, Falk Miksa utca 9-11.
Postal address: 1374 Budapest, Pf.:603.
Telephone: +36-1-391-1400
Fax: +36-1-391-1410
If you live or work abroad (i.e. in a European Union Member State other than Hungary) you can also file a complaint with the competent authority of the country of your residence or workplace.
You may also bring proceedings before a court if
· you believe your Personal data is processed unlawfully (you can go directly to court, there is no need for a preceding procedure by NAIH);
· NAIH made a binding decision concerning you that you wish to contest;
· NAIH fails to address your complaint or does respond to it within three months of receiving it (in the latter two cases, the proceedings must be brought against NAIH).
You can bring the proceedings at the regional court competent based on your domicile or habitual place of residence (depending on your choice). More detailed information on Hungarian courts is available here:
https://birosag.hu/en