Privacy Policy | Innostart

Data processing notice

1. Purpose of this data processing notice

Innostart Kft. (Innostart Kft., hereinafter: service provider, data controller), as data controller, acknowledges the content of this legal notice as binding upon itself. It undertakes that all data processing related to its activities complies with the requirements set out in this policy, in the applicable national legislation and in the legal acts of the European Union.

The data protection principles relating to data processing are continuously available at https://innostart.ch/adatkezelesi-tajekoztato/.

Innostart Kft. reserves the right to change this notice at any time. It will, of course, inform its audience of any changes in due time.

If you have any questions regarding this notice, please write to us so that we can answer your question.

Innostart Kft. is committed to protecting the personal data of its customers and partners and considers respect for its customers’ right to informational self-determination to be of paramount importance. It treats personal data confidentially and takes all security, technical and organisational measures that guarantee the security of the data.

Innostart Kft. describes its data processing practices below.

2. Details of the data controller

Name of the undertaking: Innostart Kft.

Registered office of the undertaking: 1115 Budapest, Thallóczy Lajos u. 27., Hungary

Contact address of the undertaking: 1115 Budapest, Thallóczy Lajos u. 27., Hungary

E-mail address of the undertaking: info@innostart.ch

Tax number: 14643918-2-43

Telephone number: +36 30 / 350 – 86 – 30

3. Scope of personal data processed

3.1. Personal data to be provided when commenting on the website

To comment on the innostart.ch website, the commenter must provide their name and e-mail address. Only the name provided will be displayed with the comment, visible to others. This data is stored until the commenter withdraws their consent.

3.2. Technical data

Innostart.hu selects and operates the IT tools used to process personal data in the course of providing the service in such a way that the processed data:

is accessible to those authorised to access it (availability);
its authenticity and authentication are ensured (authenticity of processing);
its integrity can be verified (data integrity);
is protected against unauthorised access (data confidentiality).

Innostart Kft. protects the data by appropriate measures against unauthorised access, alteration, transmission, disclosure, deletion or destruction, as well as against accidental destruction.

Innostart Kft. ensures the security of data processing by technical, organisational and structural measures that provide a level of protection appropriate to the risks associated with the data processing.

In the course of data processing, Innostart Kft. preserves

confidentiality: it protects the information so that only those who are authorised can access it;
integrity: it protects the accuracy and completeness of the information and the method of processing;
availability: it ensures that when the authorised user needs it, they can actually access the desired information and that the related tools are available.

3.3. Cookies

3.3.1. Function and management of cookies

they collect information about visitors and their devices;
they remember visitors’ individual settings, which may be used e.g. when carrying out online transactions, so they do not have to be re-entered;
they make the website easier to use;
they provide a quality user experience.

In order to provide a personalised service, a small data package, a so-called cookie, is placed on the user’s computer and read back during a later visit. If the browser returns a previously saved cookie, the service provider managing the cookie has the possibility to link the user’s current visit to previous ones, but only with regard to its own content.

Third-party cookies are also used on the website. Cookies can be deleted and blocked in browsers. Cookies can also be disabled. Information on these settings can be found on the official website of your browser.

The visitor/registered user/customer of the website has the option of setting their browser in several ways to manage cookies: accept all cookies, reject all cookies, or request notification of the use of each cookie. However, it is important to note that certain cookies are necessary for the website to function properly. If the visitor/registered user/customer of the website partially or completely disables their use, certain services may only be available in part or not at all.

3.3.2. Strictly necessary session cookies

The purpose of these cookies is to enable visitors to browse the innostart.ch website fully and smoothly, to use its functions and the services available there. The validity of this type of cookie lasts until the end of the session (browsing); when the browser is closed, this type of cookie is automatically deleted from the computer or other device used for browsing.

3.3.3. Social network cookies

Social network cookies allow the visitor of the site to easily access social media networks and to share their opinion and information about our products with others. They may be used by third-party functions such as Facebook, Twitter, Google+, Pinterest or YouTube. These cookies may contain personal data and are capable of identifying the visitor.

3.4. Data related to online administration (contact)

The owner of the innostart.ch site, Innostart Kft., can be contacted directly at the e-mail address info@innostart.ch.

4. Purpose, method and legal basis of data processing

4.1. General data processing principles

The data processing activities of Innostart Kft. are based on voluntary consent or statutory authorisation. In the case of data processing based on voluntary consent, data subjects may withdraw their consent at any stage of the processing.

In certain cases, the processing, storage and transfer of a certain range of the data provided is made mandatory by law, of which we inform our customers separately.

We draw the attention of those providing data to Innostart Kft. that if they do not provide their own personal data, it is the obligation of the person providing the data to obtain the consent of the data subject.

Its data processing principles are in line with the applicable data protection legislation, in particular the following:

Act CXII of 2011 on the right to informational self-determination and freedom of information (Infotv.);
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR);
Act V of 2013 on the Civil Code (Ptk.);
Act C of 2000 on Accounting (Számv. tv.);
Act LIII of 2017 on the prevention and combating of money laundering and terrorist financing (Pmt.);
Act CCXXXVII of 2013 on credit institutions and financial enterprises (Hpt.).

5. Physical storage locations of the data

Your personal data (i.e. data that can be linked to you as a person) may come into our processing in the following ways: on the one hand, in connection with maintaining the internet connection, technical data relating to the computer, browser program, internet address and pages visited that you use are automatically generated in our computer system; on the other hand, you may also provide your name, contact details or other data if you wish to contact us personally while using the website.

Data technically recorded during the operation of the system: the data of the data subject’s computer used to log in, which are generated during voting and which the system of Innostart Kft. records as an automatic result of technical processes. The automatically recorded data is logged automatically by the system upon entry and exit, without any separate declaration or action by the data subject. This data cannot be linked to other personal user data, except in cases required by law. Only Innostart Kft. has access to this data.

6. Rights of the data subject and means of enforcement

The data subject may request information on the processing of their personal data, and may request the rectification of their personal data or – with the exception of mandatory data processing – its erasure or withdrawal, and may exercise their right to data portability and to object in the manner indicated at the time of data collection, or via the above contact details of the data controller.

6.1. Right to information

Innostart Kft. takes appropriate measures to provide data subjects with all information referred to in Articles 13 and 14 of the GDPR and each communication under Articles 15–22 and 34 relating to the processing of personal data in a concise, transparent, intelligible and easily accessible form, using clear and plain language.

6.2. Right of access of the data subject

The data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data and the following information:

the purposes of the processing;
the categories of personal data concerned;
the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
the envisaged period for which the personal data will be stored;
the right to rectification, erasure or restriction of processing and the right to object;
the right to lodge a complaint with a supervisory authority;
information on the sources of the data;
the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

The controller provides the information within a maximum of one month from the submission of the request.

6.3. Right to rectification

The data subject may request the rectification of inaccurate personal data concerning them processed by Innostart Kft. and the completion of incomplete data.

6.4. Right to erasure

The data subject has the right to obtain from Innostart Kft. the erasure of personal data concerning them without undue delay where one of the following grounds applies:

the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
the data subject withdraws the consent on which the processing is based, and there is no other legal ground for the processing;
the data subject objects to the processing and there are no overriding legitimate grounds for the processing;
the personal data have been unlawfully processed;
the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
the personal data have been collected in relation to the offer of information society services.

Erasure of the data cannot be initiated if the processing is necessary:

for exercising the right of freedom of expression and information;
for compliance with a legal obligation under Union or Member State law to which the controller is subject that requires the processing of personal data, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
for reasons of public interest in the area of public health, or for archiving, scientific or historical research or statistical purposes, on the basis of public interest; or for the establishment, exercise or defence of legal claims.

6.5. Right to restriction of processing

At the request of the data subject, Innostart Kft. restricts processing where one of the following applies:

the data subject contests the accuracy of the personal data, in which case the restriction applies for a period enabling the accuracy of the personal data to be verified;
the processing is unlawful and the data subject opposes the erasure of the data and requests the restriction of their use instead;
the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; or
the data subject has objected to processing; in this case the restriction applies for the period until it is established whether the legitimate grounds of the controller override those of the data subject.

Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

6.6. Right to data portability

The data subject has the right to receive the personal data concerning them, which they have provided to the controller, in a structured, commonly used and machine-readable format and to transmit those data to another controller.

6.7. Right to object

The data subject has the right to object, on grounds relating to their particular situation, at any time to the processing of personal data concerning them which is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or which is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, including profiling based on those provisions. In the event of an objection, the controller may no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or which relate to the establishment, exercise or defence of legal claims.

6.8. Automated individual decision-making, including profiling

The data subject has the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning them or similarly significantly affects them.

6.9. Right of withdrawal

The data subject has the right to withdraw their consent at any time.

6.10. Right to judicial remedy

In the event of a violation of their rights, the data subject may bring an action against the controller before a court. The court shall deal with the case as a matter of priority.

6.11. Data protection authority procedure

Complaints may be lodged with the Hungarian National Authority for Data Protection and Freedom of Information:

Name: Nemzeti Adatvédelmi és Információszabadság Hatóság (National Authority for Data Protection and Freedom of Information)

Registered office: 1125 Budapest, Szilágyi Erzsébet fasor 22/C., Hungary

Postal address: 1530 Budapest, Pf.: 5., Hungary

Telephone: +36 1 391 1400

Fax: +36 1 391 1410

E-mail: ugyfelszolgalat@naih.hu

Website: http://www.naih.hu

7. Other provisions

Information on data processing not listed in this notice is provided at the time of data collection.

We inform our customers that the court, the public prosecutor, the investigating authority, the authority for minor offences, the administrative authority, the National Authority for Data Protection and Freedom of Information, the Hungarian National Bank, or other bodies authorised by law may contact the controller for the purpose of providing information, disclosing or transferring data, or making documents available.

Innostart Kft. discloses personal data to authorities – provided that the authority has specified the exact purpose and the scope of the data – only to the extent and in the amount strictly necessary to achieve the purpose of the request.

8. Copyright

All images, graphics, logos and text content on the website of Innostart Kft. are protected by copyright; copying, storing electronically or otherwise, reproducing, transferring, distributing, printing or publishing them in whole or in part without the express prior written permission of Innostart Kft. is prohibited. Unauthorised use is contrary to law and Innostart Kft. will initiate legal proceedings against it.

9. Other definitions

In the application of Act CXII of 2011 on the right to informational self-determination and freedom of information:

data subject: any specified natural person identified or – directly or indirectly – identifiable on the basis of personal data;
personal data: data that can be linked to the data subject – in particular the data subject’s name, identification mark, and one or more pieces of information characteristic of their physical, physiological, mental, economic, cultural or social identity – as well as any conclusion regarding the data subject that can be drawn from the data;
consent: the voluntary and explicit expression of the data subject’s will, based on appropriate information, by which they give their unambiguous agreement to the processing of personal data concerning them – in full or covering specific operations;
objection: the declaration of the data subject by which they object to the processing of their personal data and request the termination of the processing or the erasure of the processed data;
controller: the natural or legal person, or organisation without legal personality, which alone or jointly with others determines the purpose of the processing of data, makes and implements decisions concerning the processing (including the means used), or has them implemented by a processor commissioned by it;
processing: any operation or set of operations performed on data, regardless of the procedure applied, in particular collection, recording, registration, organisation, storage, alteration, use, retrieval, transmission, disclosure, alignment or combination, blocking, erasure and destruction, as well as prevention of further use of the data, taking photographs, audio or video recordings, and recording physical characteristics suitable for identifying a person (e.g. fingerprints or palm prints, DNA samples, iris images);
data transfer: making the data available to a specified third party;
disclosure: making the data available to anyone;
erasure: rendering the data unrecognisable in such a way that its restoration is no longer possible;
data marking: providing the data with an identification mark in order to distinguish it;
blocking: providing the data with an identification mark in order to restrict its further processing permanently or for a specified period;
destruction: the complete physical destruction of the data carrier containing the data;
data processing (technical): the performance of technical tasks related to data processing operations, regardless of the method and means used to carry out the operations and the place of application, provided that the technical task is performed on the data;
processor: the natural or legal person, or organisation without legal personality, which processes data on the basis of a contract concluded with the controller – including a contract concluded pursuant to a provision of law;
data owner: the body performing a public task which produced the data of public interest that must be published electronically, or in the course of whose operation this data was generated;
data publisher: the body performing a public task which – if the data owner does not publish the data itself – publishes on its website the data sent to it by the data owner;
data file: the totality of data processed in one register;
third party: a natural or legal person, or organisation without legal personality, who or which is not the same as the data subject, the controller or the processor;
EEA state: a Member State of the European Union and another state party to the Agreement on the European Economic Area, as well as a state whose nationals enjoy the same legal status as nationals of a state party to the Agreement on the European Economic Area on the basis of an international treaty concluded between the European Union and its Member States and a state not party to the Agreement on the European Economic Area;
third country: any state that is not an EEA state.

1. Pursuant to Section 20 (4) of Act CXII of 2011 on the right to informational self-determination and freedom of information, the following must be determined with regard to data processing related to the operation of the web shop:

the fact of data collection,
the scope of data subjects,
the purpose of data collection,
the duration of data processing,
the identity of the potential controllers entitled to access the data,
a description of the data subjects’ rights related to data processing.

2. The fact of data collection, the scope of data processed and the purpose of data processing:

Personal data	Purpose of processing
Surname and first name	Required for contact, for purchasing and for issuing a proper invoice.
E-mail address	Contact, information related to the order.
Telephone number	Contact, more efficient handling of questions related to invoicing or delivery.
Billing name and address	Issuing a proper invoice, as well as creating the contract, determining and amending its content, monitoring its performance, invoicing the fees arising from it, and enforcing the related claims.
Delivery name and address	Enabling home delivery.