Data Processing Appendix

The rules of this Appendix apply to the data processing carried out on the Data Controller's website.

The Data Controller ensures that data processing on the website also technically complies with these rules.

The names of the websites concerned are listed in Part I of the Privacy Policy (hereinafter: the website).

4.1. Visitors to the website must be informed about the use of cookies on the website, and their consent must be requested for this purpose.

4.2. Depending on the type of cookie, the categories of data affected by cookies during a visit may include, among others, the IP address used by the visitor, the type of browser, the characteristics of the operating system of the device used for browsing (e.g. the language set), the time of the visit, the (sub)page, function or service visited, and the actions taken or clicks made.

4.3. The purpose of the data processing is to ensure the functional operation and use of the website, to ensure access to the website's services, to increase the efficiency of the service, to enhance the user experience, to make the use of the website more convenient, to analyse the website, and to place and display advertisements.

4.4. The legal basis for the data processing is the voluntary consent of the data subject – the visitor – which may be given or refused by ticking the checkbox placed in the cookie banner on the website. The choice is made by ticking the checkbox and saving the selection. By saving the choice, it is stored, and the use of the website is provided to the user accordingly. It should be taken into account that if the use of cookies is refused, certain functions of the website may not necessarily work correctly. Pursuant to Section 13/A(3) of Act CVIII of 2001 on Certain Aspects of Electronic Commerce Services and Information Society Services (the "E-Commerce Act"), the provider of a website may process personal data that are technically indispensable for the provision of the service, for the purpose of providing that service.

4.5. Recipients: the employees of the Data Controller, the data-processor employees of the IT service provider, and, in the case of third-party cookies, the third party as well. In the case of cookies enabling the display of advertisements, data may be transferred to a third country.

4.6. Duration of data storage: in accordance with the browser's cookie settings.

5.1. These rules apply if the website has a Contact, Customer Service, or equivalent function.

5.2. Data subjects concerned: a visitor to the website who sends a message or e-mail using the Contact menu item or forms, etc.

5.3. Categories of data processed: name, e-mail address, telephone number, company name, tax number, as well as any other, unrequested data provided by the user in the message.

5.4. Purpose of the data processing: to enable the visitor to contact the Data Controller, to provide customer service, to enable the possibility of requesting a quote, registration, booking, complaint handling, information about the operation of the website, analysis of the website, and the placement, display and sending of advertising offers.

5.5. Legal basis for the data processing: the consent of the data subject, given by reviewing the data processing notice, voluntarily providing their data, ticking the checkbox placed before the data processing declaration, and sending the message, or, in the case of e-mail, by sending the e-mail. Pre-ticking the checkbox is prohibited.

5.6. Recipients: the Data Controller's customer service employees, freight organisers, and the employees of the IT data processor.

5.7. Information on data processors: the Company's IT service provider (Privacy Policy, Part I).

5.8. Duration of data storage: the data provided are deleted upon request following the contact.

6.1. These rules apply if the website has a registration function, or an equivalent function.

6.2. Data subjects concerned: the user who registers for the services of the website and provides their personal data. It is the user's responsibility that only they use the service via the e-mail address provided and the data they have supplied. Persons who have not reached the age of 16 may only register on the website with the consent of the person exercising parental supervision.

6.3. Categories of data processed: name, e-mail address, telephone number, billing name and address, delivery name and address, online identifier, password.

6.5. Legal basis for the data processing: the consent of the data subject, given by reviewing the data processing notice, voluntarily providing their data, ticking the checkbox placed before the data processing declaration, and sending the message. Pre-ticking the checkbox is prohibited.

6.6. Recipients: the Data Controller's employees and the employees of the IT data processor.

6.7. Information on the use of data processors: the Data Controller's IT service provider (Privacy Policy, Part I).

6.8. Duration of data storage: until the registration/service is no longer active, or until the data subject withdraws their consent (requests deletion). The website must allow the registered person to delete their registered data.

7.1. These rules apply if the website has a newsletter subscription and sending function, or an equivalent function.

7.2. Data subjects concerned: the user who registers (subscribes) to the Data Controller's newsletter service. Persons who have not reached the age of 16 may not subscribe to the newsletter without the consent of the person exercising parental supervision.

7.3. Categories of data processed: name (surname, first name), e-mail address.

7.5. Legal basis for the data processing: the consent of the data subject. The data subject may unsubscribe from the newsletter at any time using the "Unsubscribe" function in the newsletter, or by a declaration made in writing or by e-mail. In such cases, all data of the person unsubscribing must be deleted without delay.

7.6. Recipients: the Company's employees performing tasks related to customer service and marketing activities, and, as data processor, the employees of the Company's IT service provider.

7.7. Information on the use of data processors: the Data Controller's IT service provider (Privacy Policy, Part I).

7.8. Duration of data storage: for as long as the newsletter service exists, for as long as the newsletter subscription exists, until unsubscription, or until the data subject withdraws their consent (requests deletion).

8.1. These rules apply if the website has a webshop, or an equivalent function.

8.2. Data subjects concerned: the user who purchases a product or service in the Data Controller's webshop.

8.3. Purpose of the data processing: to create the contract, to define and amend its content, to perform it, to monitor its performance, to invoice the fees arising from it, and to enforce claims related thereto.

8.3. Categories of data processed: the natural-person identification data necessary to identify the person registering or purchasing in the webshop, residential address, telephone number, e-mail address, bank account number, online identifier, tax number.

8.4. Legal basis for the data processing: in the case of a purchase made in the webshop, the legal basis for the data processing is the performance of the contract, having regard to Section 13/A of the E-Commerce Act and Government Decree 45/2014 (II. 26.). The legal basis for the processing of data provided for invoicing purposes is compliance with a legal obligation under the provisions of the VAT Act and the Accounting Act – in this respect, the duration of the data processing is 8 years.

8.7. Duration of data storage: until the end of the 5th year following the year of purchase; in respect of data recorded on accounting documents related to the purchase, 8 years. Data relating to a failed purchase must be deleted immediately.