Full name: BIOrganik Online Élelmiszerkereskedelmi és Forgalmazó Kereskedelmi és Szolgáltató Kft.
Controller’s representative: Zsolt Szikora Managing Director
Seat: 1097 Budapest, Gubacsi út 47.
Company registration number: 01-09-920488
Tax number: 14801055-2-43
E-mail address: info@biorganik.hu
Telephone: +3612109114
Website: www.himalayakristalyso.hu
(hereinafter as: “Controller”)

Throughout the handling of your personal data, the Controller and its partners shall act pursuant to the following legislation:

• Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter as: “GDPR”);
• Act V of 2013 on the Civil Code;
• Act XLVIII of 2008 on Essential Conditions of and Certain Limitations to Business Advertising Activity;
• Act CVIII of 2001 on Electronic Commerce and on Information Society Services;

3.1) Data subjects and the personal data being processed

a) Data subjects: Natural persons visiting the Controller’s website at www.himalayakristalyso.hu (hereinafter as: “Website”), who establish contact with the Controller through the website’s Contact menu.

The scope of processed data, the purpose of the data processing and the safety of the processing

b) Data subjects: natural persons who visit the Controller’s website and who establish contact with the Controller via the e-mail address or phone number provided on the website or via post.

The scope of processed data, the purpose and legal basis of the data processing and the safety of the processing

You have the option of contacting us via e-mail, phone or post as well as through our social media pages. In the case of more complex issues or in relation to ongoing administration, we recommend contacting us through our office in order to provide you with answers to the best of our knowledge.
When contacting us, you voluntarily provide your personal data, which we will not use for any other purpose beyond establishing contact. We hereby inform you that you may revoke your previous consent at any time and request the deletion of your personal data processed on said legal basis. Should your query be related to any existing agreement concluded between us, your data shall be processed pursuant to our general privacy policy.
If you are under 16 years of age, you require the consent or subsequent approval of your legal representative to issue a query. The validity of the legal statement of the data subject’s consent for persons over 16 years of age does not require the consent or subsequent approval of their legal representative.

3.2) The safety of the data processing
The data provided by you is stored in electronic and hard copy format. Electronic data is stored in observance of suitable data security measures on our central server. The telephone calls you place to contact us are not recorded. The personal data stored on the Controller’s server may be accessed by the managing director as well as the representative responsible for answering queries.

3.3) The duration of the data processing
The personal data you provided shall be stored from the time of the query until the resolution of the purpose of the query. Insofar as the query should lead to us concluding an agreement with you, your personal data shall be processed pursuant to said agreement, in accordance with the general privacy policy.
In lack of any further communication from you within [7] days of the dispatch of our response, we shall delete all messages in relation to the subject and erase all your personal data from our electronic records and destroy any hardcover documents in relation to the subject. Insofar as legitimate interests call for the further storage of documents created through the query (e.g. for quality assurance purposes), we shall take measures to erase all of your personal data from said documents (data anonymization).

3.4) Processor
We shall employ the following Processor to perform the technical measures related to the data handling:

For the full list of the Processors we employ, please forward requests through our contact information listed under item no. 1 above.

It’s important for us to provide our clients with the widest range of information about us and our products as well as their availability, therefore we maintain Facebook, Instagram and Pinterest accounts and our website is directly linked to our https://veganfoodmarket.hu/webáruházunk website.
We hereby inform you that throughout the usage of said social media websites, we are also predominantly considered as users. Should you wish to visit our social media pages with your registered user account, the means of this is regulated by the privacy policies of the websites in question. Beyond the contents of the present item, additional information on your personal data processed through the social media website is available through the Controller of the websites in question.

4.1) Webshop usage
We wish to provide the opportunity for purchasing the products displayed on our website through the webshop maintained at the https://veganfoodmarket.hu/webáruházunk address. For the sake of your convenience, clicking on the Purchase button found on the sub-pages of the various products will automatically redirect you to our webshop. Our general privacy policy is available on the https://veganfoodmarket.hu/ website.

4.2) Facebook page
It’s important for us to provide our clients with the widest range of information about us and our products as well as their availability, therefore we maintain Facebook, Instagram and Pinterest accounts.
In regards to our Facebook page, we are considered the joint Controller with the operator of Facebook. Facebook is operated by Facebook Inc. (1601 S. California Ave, Palo Alto, CA 94304, USA) for which Facebook Ireland Limited (4 Grand Canal Square, Dublin, Ireland) is liable in Europe. We have concluded a joint data processing agreement with Facebook, which is available through the following link: https://www.facebook.com/legal/controller_addendum. This agreement governs our join data processing in line with the responsibilities pursuant to GDPR.
For more information on the data protection realized through Facebook, please refer to Facebook’s privacy policy at the following link: https://hu-hu.facebook.com/privacy/explanation.
You also have the opportunity of contacting us through our Facebook page, comment on our posts and provide us feedback on our Facebook page. The provisions for queries listed under item 3.1 b) shall prevail in that Facebook Ireland Limited shall be designated as Processor.

4.3) Instagram page

The data processing taking place on our Instagram page shall be governed by the provisions for our Facebook page, as Instagram is a Facebook product. For more information on Instagram’s data protection regulations, please refer to the following link: https://help.instagram.com/519522125107875?helpref=page_content

4.5) Pinterest page
On the Pinterest website we are not engaged in the processing of your data. For more information on Pinterest’s Privacy Policy, please refer to the following link: https://policy.pinterest.com/hu/privacy-policy

5.1) Data forwarding performed in relation to the legal obligations of the Controller
For the sake of fulfilling our legal obligations, we may forward the data subject’s personal data to recipients designated by legislation. The legal basis of the data forwarding: fulfillment of the legal obligations of the Controller [item c) paragraph (1) section 6 of the GDPR].

5.2) Miscellaneous data forwarding:
In the case of legal disputes related to the data processing outlined in the present privacy, we shall forward the documents related to the dispute to our acting legal representative (law firm), furthermore in the case of legal or administrative proceedings, we shall forward said documents to the court or authority with competence and jurisdiction.

We shall take all necessary measures to ensure the validation of the rights of data subjects related to the handling of their personal data, as detailed below.
We shall provide the data subject with the possibility of forwarding requests to practice their rights through the contacts detailed in item no. 1 above:
- in person,
- via post,
- via e-mail,
- by telephone.
Data subjects’ requests of this nature shall be fulfilled without undue delay, yet in all cases within 30 days of their receipt, while providing the data subject with information on this in a concise, easily understandable and accessible form. We shall also decide on the possible refusal of the request within the same deadline and inform the data subject of said refusal, its reasons as well as their options for judicial remedy.
In principle, the data subject’s request shall be fulfilled via e-mail, yet if the data subject explicitly requests doing so via post or telephone, it shall be fulfilled via post or telephone. At the data subject’s request, we can only provide information via telephone by appropriately verifying the data subject’s identity.
We shall issue a copy of the data subject’s personal data upon their initial request free of charge. For further data issuing requests with identical data content and personal data, we shall charge a reasonable surcharge based on the related administrative costs.

6.1) Right of access by the data subject:
The data subject shall have the right to obtain information from the Controller through the contact information listed under item no. 1 on the following:
a) whether or not personal data concerning the data subject are being processed by us;
b) the data processing, as well as the names and contact information of the Processors listed under item 3.4 above and the type of personal data that has been forwarded to said parties;
c) the purposes of the processing of the data subject’s personal data and the legal basis of said processing;
d) the duration of the data processing;
e) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;
f) who, when and based on what legislation is provided with access to their personal data and the categories of said personal data;
g) whether we employ automated decision-making, and if so, details on its logic and profiling;
h) the circumstances and impact of any possible data protection breaches and the measures taken to alleviate its effects.
Even in lack of the data subject’s request, we will provide – via e-mail – information to the data subject of any substantial changes to the data processing outlined in the present policy, the circumstances of any possible data protection incident, its impact and the measures taken to alleviate its effects.

6.2) Right to rectification
At the data subject’s request we shall have rectify their inaccurate personal data.
We shall inform all recipients of said rectification to whom said personal data has been provided, unless this proves impossible or involves a disproportionate effort. At the data subject’s request, we shall provide them with a list of said recipients.

6.3) Right to erasure:
At the data subject’s request, we shall erase their personal data where one of the following grounds applies:
a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed and there is no other legal ground for their processing;
b) the personal data have been unlawfully processed;
c) the personal data have to be erased for compliance with a legal obligation in EU or Hungarian law.
We shall inform all recipients of said erasure to whom said personal data has been provided, unless this proves impossible or involves a disproportionate effort. At the data subject’s request, we shall provide them with a list of said recipients.

6.4) Right to restriction (blocking) of processing:
At the data subject’s request we shall restrict the processing where one of the following applies:
a) the accuracy of the personal data is contested by the data subject – in this case, the restriction is for a period enabling the Controller to verify the accuracy of the personal data;
b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
c) we no longer require the personal data for the purposes of the data processing, but they are required by the data subject for the establishment, exercise or defense of legal claims.
We shall inform all recipients of said restriction to whom said personal data has been provided, unless this proves impossible or involves a disproportionate effort. At the data subject’s request, we shall provide them with a list of said recipients.

6.5) Right to data portability:
At the data subject’s request, we shall provide them with the personal data concerning the data subject. We hereby acknowledge that the data subject shall have the right to have the personal data transmitted to another Controller without restriction.

6.6) Right to object:
In relation to the data subject’s personal data pursuant to [item a) paragraph (1) section 6 of the GDPR], the data subject is not entitled to the right to object.

Insofar as the data subject deems that we infringed on their rights to the protection of their personal data, pursuant to the relevant legislation, they may seek judicial remedy and lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (address: 1055 Budapest, Falk Miksa utca 9-11., mail address: 1363 Budapest, Pf.9.; telephone: +3613911400; fax: +3613911410; e-mail: ugyfelszolgalat@naih.hu; website: www.naih.hu; hereinafter as: “NAIH”), or the competent tribunal. We undertake to fully cooperate with the tribunals in question or the NAIH in all matters and issue the data on the data processing to the NAIH or the tribunal in question.
Furthermore we undertake to reimburse all damages caused by the unlawful processing of the data subject’s personal data or by violating data security requirements. In the case of the infringement on the data subject’s privacy rights, the data subject may request compensation. We shall be exempt from said liability insofar as the damages were incurred due to unpreventable causes beyond the data processing or if the damage and the infringement of the privacy rights was caused by the intentional or grossly negligent behavior of the data subject.

We undertake to ensure that all data processing related to our activities remains in accordance with the present policy and our data protection regulation of identical requirements as well as the demands of the prevailing legislation.
We reserve the right to amend the present privacy policy at any time, verifiably informing all data subjects subsequent to the implementation of said amendments.

Finalized: 15 February 2021