Privacy notice · PSM Reporting

Unofficial AI-generated English translation. This version was automatically translated using artificial intelligence and may contain errors. The Hungarian-language Privacy Notice is the authoritative version and prevails in the event of any discrepancy. View the Hungarian version.

1. Details of the Data Controller

Name of the Data Controller: Gergonomic Non-profit Kft.
Registered office: 7629 Pécs, Hársfa út 84, Hungary
Postal address / complaints handling: 7629 Pécs, Hársfa út 84, Hungary
Email address: info@krazarium.com
Telephone number: +36/20/557-1788
Website: https://krazarium.com

The Data Controller processes the data of website visitors, customers and interested parties in the course of operating the website, handling online requests for quotations, data entry, data recording, data structuring, data migration, complaints handling and marketing activities.

2. Hosting provider

Name of the hosting provider: Hetzner Online GmbH
Registered office: Industriestr. 25, 91710 Gunzenhausen, Germany
Email address: info@hetzner.com
Website: www.hetzner.com

Description of data processing carried out in connection with operation of the website

This document contains all relevant data processing information concerning the operation of the online store under Regulation (EU) 2016/679 of the European Union (hereinafter: the Regulation or GDPR) and Act CXII of 2011 (hereinafter: the Privacy Act).

Principal legislation governing data processing

When processing personal data, the Data Controller has particular regard to the following legislation:

Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR);
AI Act – Regulation (EU) 2024/1689;
ePrivacy – Directive 2002/58/EC, implemented in Hungary by Act C of 2003 on Electronic Communications;
Act CXII of 2011 (Privacy Act);
Act C of 2000 on Accounting;
Act CXXVII of 2007 on Value Added Tax;
Act CLV of 1997 on Consumer Protection;
Decree 19/2014 (IV. 29.) of the Minister for National Economy;
applicable Hungarian and EU rules on electronic commerce services and electronic communications.

Principles of data processing

The Data Controller processes personal data lawfully, fairly and transparently in relation to the data subject. The Data Controller processes personal data only for specified, explicit and legitimate purposes and processes only the amount of data that is necessary and proportionate for achieving the relevant purpose.

The Data Controller strives to ensure that the data it processes are accurate and up to date, that personal data are retained only for as long as necessary, and that their security is ensured through appropriate technical and organisational measures.

Information on the use of cookies

The Data Controller uses so-called cookies when the website is visited. A cookie is a package of information consisting of letters and numbers that our website sends to your browser in order to save certain settings, make our website easier to use and help us collect certain relevant statistical information about our visitors.

Some cookies contain no personal information and cannot identify an individual user. Others contain an individual identifier—a secret, randomly generated sequence of numbers—stored by your device, which also makes it possible to identify you.

The operating period of each cookie is stated in the relevant cookie description.

Legal background and legal basis for cookies:

We distinguish three basic types of cookie: strictly necessary cookies, which ensure the proper functioning of the Website; statistical cookies; and marketing cookies.

The legal basis for processing is your consent under Article 6(1)(a) of the Regulation for statistical and marketing cookies, and the legitimate interest in ensuring the operation of the Website under Article 6(1)(f) of the Regulation for strictly necessary cookies.

Cookies are recorded in a separate cookie register, clearly identifying third-party cookies and their providers.

Main characteristics of cookies used by the website:

Strictly necessary cookies:

If you do not accept the use of these cookies, certain functions may not be available to you.

Session cookie: These cookies store the visitor's location, browser language and payment currency. They last until the browser is closed or for a maximum of 2 hours.

Age-restricted content cookie: These cookies record that age-restricted content has been approved and that the data subject is over 18 years of age. They last until the browser is closed.

Recommended products cookie: This records the list of products to be recommended when the “recommend to a friend” function is used. It lasts for 60 days.

Mobile version and design cookie: This detects the device used by the visitor and switches to full view on mobile. It lasts for 365 days.

Cookie acceptance cookie: This records acceptance, in the warning window displayed on arrival, of the statement concerning the storage of cookies. It lasts for 365 days.

Logout #2 cookie: Under option #2, the system logs the visitor out after 90 days. It lasts for 90 days.

Backend identifier cookie: This identifies the backend server serving the website. It lasts until the browser is closed.

Third-party cookies: Certain website functions rely on external services that may place their own cookies on the user's device.

The Data Controller uses third-party services to provide certain website functions. These providers may place their own cookies on the user's device.

Such providers may include in particular:

Google LLC (statistical and advertising services);
Meta Platforms Ireland Ltd. (marketing and remarketing services);
OpenAI LLC or another artificial intelligence service provider.

The relevant providers may collect data through their own cookies, which are governed by their own privacy policies.

The purposes of such cookies include in particular:

– collecting statistical data about use of the website;

– supporting marketing and advertising activities;

– displaying personalised content and offers.

Third-party cookies may process the following data:

– IP address;

– browser type;

– pages visited;

– user interactions.

These cookies are used only with the user's prior consent.

The Data Controller does not have full control over the operation of these cookies.

The user may enable, disable or delete cookies at any time through their browser settings.

For third-party cookies, the Data Controller works with the operating parameters specified by the providers, but strives to limit their duration in accordance with the principles of the GDPR.

Cookies related to operation of an AI-based chatbot

The website may use an artificial intelligence-based chatbot to support customer communications, automatically generating responses on the basis of user input. Without the cookies required for the chatbot to operate, the service may be unavailable or available only to a limited extent.

The following types of cookies may be used in connection with operation of the chatbot:

a session cookie to maintain the conversation;
a functional cookie to store conversation data temporarily;
a statistical cookie to improve the service, where used.

The purposes of these cookies include in particular:

enabling communication between the user and the chatbot;
maintaining continuity of conversations;
technically ensuring operation of the service;
improving the user experience.

Categories of data processed

Data processed by third-party providers and the AI chatbot include in particular:

IP address;
browser and device data;
actions performed on the website;
data entered during a chatbot conversation;
technical identifiers, such as a cookie ID.

Legal basis for processing

for necessary cookies: Article 6(1)(f) GDPR – legitimate interest;
for statistical and marketing cookies: Article 6(1)(a) GDPR – consent.

Transfers to third countries

Third-party providers—in particular Google, Meta and OpenAI—may transfer data to countries outside the European Economic Area, such as the United States of America.

The transfer takes place subject to appropriate safeguards, such as standard contractual clauses.

Statistical cookies:

Referrer cookies: These record the external website from which the visitor arrived. They last until the browser is closed.

Last viewed product cookie: This records the products most recently viewed by the visitor. It lasts for 60 days.

Last viewed category cookie: This records the category most recently viewed. It lasts for 60 days.

Cart cookie: This records the products placed in the shopping cart. It lasts for 365 days.

Smart offer cookie: This records the conditions for displaying smart offers, for example whether the visitor has previously visited the website or has an order. It lasts for 30 days.

Other cookies: A detailed list of the cookies on the website can be found in the Cookie Register.

Further information on deleting cookies is available at the following links:

Internet Explorer: http://windows.microsoft.com/en-us/internet-explorer/delete-manage-cookies#ie=ie-11

Firefox: https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer

Mozilla: https://support.mozilla.org/hu/kb/weboldalak-altal-elhelyezett-sutik-torlese-szamito

Safari: https://support.apple.com/guide/safari/manage-cookies-and-website-data-sfri11471/mac

Chrome: https://support.google.com/chrome/answer/95647

Edge: https://support.microsoft.com/hu-hu/help/4027947/microsoft-edge-delete-cookies

Google Consent Mode v2

The Data Controller has integrated Google Consent Mode v2 into its website and manages consent and rejection under the new version through its cookie panel. Under Google Consent Mode v2, in addition to the two previous flags (analytics_storage and ad_storage), Google uses two additional flags for storing and reading statistical and advertising cookies:

ad_user_data: Whether any user data may be sent to Google for advertising purposes.

ad_personalization: Whether user data may be used for personalised advertising purposes, such as remarketing.

These two controls determine whether the storage and reading of statistical and advertising cookies are permitted.

Data processed for entering into and performing a contract

Several processing operations may take place for the purpose of entering into and performing a contract. Please note that data processing in connection with complaints handling and warranty administration takes place only if you exercise one of the rights referred to.

If you do not make a purchase through the website and only visit it, the provisions on processing for marketing purposes may apply to you if you give us consent for marketing purposes.

Processing carried out for entering into and performing a contract is described in further detail below:

6. Contact, requests for quotations, handling enquiries and processing orders

The data subject may contact the Data Controller through the form available on the website, by email, by telephone or through another electronic channel, may request a quotation, or may ask a question about products or services.

Prior contact may be mandatory; if it is omitted, not every service can be ordered from the website.

Data processed

The data you provide when making contact: name, email address, addresses, telephone number, company name, tax number and company registration number. Where necessary, a bank account number is also processed. The Data Controller processes the characteristics of the service purchased or intended to be purchased and the time of purchase.

6.1. Purpose of processing

enabling contact;
receiving and processing requests for quotations;
responding to enquiries;
assessing the customer's needs;
preparing for the subsequent conclusion of a contract;
documenting customer communications.

6.2. Categories of data processed

In the course of processing, the Data Controller may process in particular the following data:

name;
email address;
telephone number;
company name;
billing or contact address;
the content of the request for quotation, message or enquiry;
business or other parameters necessary to prepare the quotation;
the content of attached documents, images and files;
the time of contact;
technical metadata and log data.

6.3. Legal basis for processing

the data subject's freely given consent [Article 6(1)(a) GDPR]; or
taking steps at the request of the data subject prior to entering into a contract [Article 6(1)(b) GDPR].

6.4. Duration of processing

Where no order or legal dispute results from the contact or request for quotation, the Data Controller retains the data provided for up to 5 years, in line with the enforceability of civil-law claims and the need to trace discussions.
Where the contact results in a contract, order, complaint or other legal relationship, the retention periods specified in the relevant separate section apply to the data.

6.5. Information on the use of AI when handling contacts and processing orders

Requests for quotations and enquiries received by email may be processed, organised, prepared and answered in whole or in part by an automated system, in particular through the use of artificial intelligence (AI). Detailed rules on the use of AI are set out in the section of this notice entitled “Use of artificial intelligence (ChatGPT)”.

Registration on the website

By storing the data provided during registration, the Data Controller can provide a more convenient service. Registration is a condition of entering into the contract.

Data processed

In the course of processing, the Data Controller processes

your name,

home address,

telephone number,

email address,

the characteristics of the service purchased,

and the time of purchase, as well as,

for the purpose of creating and maintaining the user account, facilitating subsequent logins, and making user settings and previously recorded data available:

name;

email address;

password or authentication data associated with the password;

telephone number;

address;

previous data.

Duration of processing

For as long as the registration remains active or until the data subject requests deletion.

Legal basis for processing

Your freely given consent, which you provide to the Data Controller by registering [processing under Article 6(1)(a) of the Regulation].

Order processing

Processing activities are necessary when orders are processed for the purpose of performing the contract.

Data processed

The Data Controller processes your name, home address, telephone number, email address, the characteristics of the service purchased, the order number and the time of purchase. It also processes company data, in particular data suitable for identification—company name, tax number and company registration number—as data relating to the service ordered.

If you have purchased a service on the website, processing and the provision of data are essential for performing the contract.

We process the data for 5 years, corresponding to the civil-law limitation period.

Legal basis for processing

Performance of a contract [processing under Article 6(1)(b) of the Regulation].

Issuing invoices

Processing takes place for the purpose of issuing an invoice in accordance with the law and meeting the obligation to retain accounting documents. Under Section 169(1)–(2) of the Accounting Act, companies must retain accounting documents that directly or indirectly support their bookkeeping records.

Data processed

Name, addresses, email address and telephone number.

Comments and requests relating to the order.

Data relating to the service ordered.

Duration of processing

Under Section 169(2) of the Accounting Act, issued invoices must be retained for 8 years from the date of issue.

Legal basis for processing

Under Section 159(1) of Act CXXVII of 2007 on Value Added Tax, issuing an invoice is mandatory, and under Section 169(2) of Act C of 2000 on Accounting the invoice must be retained for 8 years [processing under Article 6(1)(c) of the Regulation].

Artificial intelligence service provider:

Name: OpenAI, L.L.C.

Registered office: 3180 18th St, San Francisco, CA 94110, USA

Website: https://openai.com

The processor provides an artificial intelligence-based service that assists in processing and responding to customer enquiries.

Handling consumer complaints

Processing takes place for the purpose of handling consumer complaints. If you make a complaint to us, the processing and provision of data are essential.

Data processed

The customer's name, telephone number and email address, and the content of the complaint.

Duration of processing

Consumer complaints are retained for 3 years under the Consumer Protection Act.

Legal basis for processing

Whether you make a complaint to us is your voluntary decision. However, if you do so, we are required to retain the complaint for 3 years under Section 17/A(7) of Act CLV of 1997 on Consumer Protection [processing under Article 6(1)(c) of the Regulation].

Purpose of processing:

receiving complaints;
investigating them;
responding to them;
maintaining records in accordance with consumer protection legislation.

Data processed in connection with demonstrating consent

During registration, ordering and newsletter subscription, the IT system stores technical data relating to consent so that consent can be demonstrated later.

Data processed

The time of consent and the data subject's IP address.

Duration of processing

Consent must be capable of being demonstrated later because of statutory requirements; the data are therefore stored until expiry of the limitation period following termination of the processing.

Legal basis for processing

This obligation is imposed by Article 7(1) of the Regulation [processing under Article 6(1)(c) of the Regulation].

Processing for marketing purposes

Processing relating to sending newsletters. Processing takes place for the purpose of sending newsletters.

Data processed

Name, address, email address and telephone number.

Duration of processing

Until the data subject withdraws consent.

Legal basis for processing

Your freely given consent, which you provide to the Data Controller when subscribing to the newsletter [processing under Article 6(1)(a) of the Regulation].

Processing relating to sending and displaying personalised advertisements

Processing takes place for the purpose of sending advertising content that corresponds to the data subject's interests.

Data processed

Name, address, email address and telephone number.

Duration of processing

Until consent is withdrawn.

Legal basis for processing

Your freely given, separate consent, which you provide to the Data Controller when the data are collected [processing under Article 6(1)(a) of the Regulation].

Remarketing

Processing as a remarketing activity is carried out with the help of cookies.

Data processed

The data processed by the cookies specified in the cookie notice.

Duration of processing

The storage period of the relevant cookie. Further information is available here:

Google's general cookie information:

https://www.google.com/policies/technologies/types/

Google Analytics information:

https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage?hl=hu

Facebook information:

https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen

Artificial intelligence service provider:

OpenAI, L.L.C.

Information: https://openai.com

Legal basis for processing

Your freely given consent, which you provide to the Data Controller by using the website [processing under Article 6(1)(a) of the Regulation].

Further processing activities

Use of artificial intelligence (AI, ChatGPT, OPEN AI)

For the purpose of developing its services, processing requests for quotations more quickly, serving customers more efficiently and supporting communications, the Data Controller may also use artificial intelligence-based solutions, in particular a service based on ChatGPT.

Certain services and functions of the website may use systems based on artificial intelligence (AI), including generative artificial intelligence solutions such as ChatGPT (hereinafter: “AI system”).

The operation of these AI systems may affect, in particular but without limitation, communications and solutions supporting data and information processing and data migration. When such functions are used, a clearly visible indication, such as “AI” or “MI”, will state when you are interacting with an AI system.

The User may use AI systems only for their intended purpose and in accordance with applicable legislation and ethical guidelines, and may not use an AI system for any unlawful, harmful or abusive activity. In particular, the following are prohibited:

a) using AI systems in a manner that results in a breach of law or infringes the rights of third parties;

b) automatically or programmatically extracting data or output from any AI system;

c) interfering with any AI system, including circumventing any restriction or defeating any protective measure or security risk mitigation.

Use of automated security systems

When operating the website, the Data Controller may use an automatically operating protection system to safeguard system security and the integrity of the service.

The following data processing and security principles govern operation of the system security tool:

Data processing principles

processing is purpose-limited and minimised;
only data necessary for the security purpose are processed;
the system does not process complete payloads containing sensitive or confidential data;
unnecessary or disproportionate processing is excluded.

Operating principles

operation of the system is approval-centred;
the applicable rules and protocols may be changed only with explicit human approval;
human control is ensured even in the case of automated decisions.

Logging and incident management

During the incident management process, the system logs:

the occurrence of the security event;
its type;
its risk level;
the response steps taken.

Characteristics of logging:

purpose-limited;
masked, meaning restricted from a data protection perspective;
provided with unique identifiers;
does not contain data that would itself create a new data protection risk.

The Data Controller ensures that:

logging does not create a new processing risk;
logged data are accessible only to authorised persons;
logs are used solely for security and audit purposes.

A characteristic of AI-system technology is that it operates probabilistically rather than deterministically, has a limited ability to interpret linguistic context and cannot take individual circumstances fully into account. Accordingly, suggestions and other outputs produced by AI systems without human intervention are for information purposes only. Their accuracy, completeness, impartiality and currency are not guaranteed, and they may contain factual inaccuracies, sometimes referred to as “hallucinations”.

Outputs also do not constitute a binding statement, promise, offer, advice or completed professional product. Such outputs are used solely at the User's own risk and do not replace due care, decision-making based on critical thinking, or professional information or assistance from the Service Provider's staff. If the User uses a service or function supported by an AI system, personal data shared during its use are processed in accordance with the privacy notice applicable to that service or function.

An artificial intelligence (AI) Acceptable Use Policy is a fundamental document governing the safe and ethical use of AI tools, such as ChatGPT and Copilot, in the workplace or in education. Its purpose is to protect intellectual property and minimise legal risks. [1, 2]

Policies governing the use of AI rest on four pillars:

Data protection and confidentiality: Uploading trade secrets, customer data or sensitive information to AI systems is strictly prohibited.
Human review: Content generated by AI, including text, code and images, must be checked and approved by a human professional before use or publication.
Transparency: If AI played a significant role in creating content, this must be disclosed to users, customers or partners.
List of authorised tools: Only AI platforms approved by the AI provider or institution and reviewed for security may be used.

The rules set out in the EU AI Act apply within the risk management framework.

Purposes for which AI is used

The purposes for which AI is used include in particular:

automatic or partly automated processing of data;
preparing data and creating drafts of data structures;
organising and summarising enquiries received by email;
preparing draft responses based on the customer's needs;
accelerating customer communications;
supporting internal administrative and support workflows.

Categories of data processed by AI

The AI system may process data that are necessary for use of the service and provided by the data subject, including in particular:

name;
email address;
telephone number;
company name;
contact, billing and shipping data, where provided by the data subject;
the content of an email, message, attachment or enquiry;
technical, commercial, logistical, quantitative or other requirements communicated by the customer;
written responses and drafts created during communications;
technical and log data.

Purpose and nature of processing

AI systems are used primarily for support, preparatory and communication-assistance purposes. AI-generated content may include a preliminary quotation, draft, suggestion or information. AI is not used to make a decision concerning the data subject that produces legal effects and is based solely on automated processing entirely without human intervention.

Legal basis for processing

The legal basis for AI-assisted quotation management and customer communications is:

taking steps at the request of the data subject prior to entering into a contract [Article 6(1)(b) GDPR];
the data subject's consent [Article 6(1)(a) GDPR], where consent is the applicable basis for the relevant process; and
the Data Controller's legitimate interest [Article 6(1)(f) GDPR] in providing faster and more efficient customer service, administration and communications.

15.5. Automated processing and profiling

On the basis of data provided by the data subject, the AI system may identify patterns and relevant information and use them to prepare draft quotations, responses and data structures. Certain elements of this operation may constitute automated processing.

The Data Controller nevertheless states that:

quotations, responses, data structures or suggestions generated by AI are informative and preparatory in nature;
responses provided by AI may contain inaccuracies, omissions or ambiguous wording;
AI output does not in itself constitute a binding commitment, advice, automatic conclusion of a contract or contractual performance;
the data subject is entitled to human involvement and human review.

Automated decision-making and profiling (Article 22 GDPR)

The Data Controller informs data subjects that, when processing personal data, it does not carry out processing that makes a decision concerning the data subject solely by automated means and without human intervention where that decision produces legal effects or similarly significantly affects the data subject within the meaning of Article 22 GDPR.

The artificial intelligence (AI) systems used by the Data Controller:

perform support, preparatory and administrative functions only;
assist with processing user enquiries and preparing responses;
do not constitute autonomous decision-making systems;
do not make independent, binding decisions in the course of their operation.

Content generated by AI is informative or advisory in nature, its accuracy is not guaranteed, and it may always be subject to human review and will be subject to mandatory review where necessary.

Profiling

If the AI system prepares a customised quotation or draft response on the basis of data and preferences provided by the data subject, such operation may in certain cases include elements of profiling. The sole purpose of such profiling is to support more relevant customer service, faster quotations and more effective communications, not to assess or exclude the data subject automatically.

In certain cases, particularly in support of customer communications, data organisation, creation of data structures, preparation of quotations, marketing and CRM processes, the Data Controller may carry out limited processing based on profiling for support purposes.

This may include, in particular, interpreting user enquiries, customising offers and optimising communications.

Such processing does not lead to automated decision-making and does not significantly affect the data subject without human intervention.

Rights of data subjects (Article 22 GDPR safeguards)

The data subject is entitled to request human involvement and human review, to express their point of view, to contest an automatically produced response, quotation or suggestion, and to have their case examined individually by a member of the Data Controller's staff.

The Data Controller strives to ensure that the interests, rights and freedoms of the data subject are not adversely affected when AI systems are used and that the use of AI does not result in a solely automated decision concerning the data subject that produces legal effects or similarly significantly affects them.

Nature of content produced by AI

Responses, quotations, summaries, data structures, suggestions and other textual outputs generated by the AI system may be the results of a system operating on a probabilistic basis. Their accuracy, completeness, currency and freedom from error therefore cannot be guaranteed in every case.

Content prepared by AI:

may be informative, preparatory or administrative in nature;
may contain inaccuracies, omissions or ambiguous wording;
does not in itself constitute a binding legal statement, legal advice, an automatic offer to enter into a contract or automatic contractual performance;
may be subject to human checking, clarification or confirmation where necessary.

The Data Controller reserves the right to modify, clarify, supplement or review responses, quotations or suggestions prepared by AI with human involvement.

AI service provider acting as processor

The Data Controller may use an external provider to provide AI-based functions.

Name of the AI service provider:

Name: OpenAI, L.L.C.

Registered office: 3180 18th St, San Francisco, CA 94110, USA

Website: https://openai.com

In the European Union and EEA: OpenAI Ireland Ltd.
Role: processor / service provider assisting in the provision of the service. Under the applicable business terms, the contracting party for customers in the European Union is generally OpenAI Ireland Ltd., and OpenAI may act as processor when processing customer data for the purpose of providing the services.

Acting on the Data Controller's instructions, the AI service provider may process data transmitted by the Data Controller to the extent necessary to provide the service.

The purpose of processing is to process requests for quotations, produce draft responses, support communications, prepare data structures, migrate data and increase administrative efficiency.

For business use, the Data Controller intends to use only AI services that are subject to appropriate contractual and data protection safeguards.

International data transfers

When the AI service is used, personal data may be transferred outside the European Union and the European Economic Area (EEA), in particular to a third country, or may become accessible there.

The OpenAI Data Processing Addendum provides for the application of processor terms to processing connected with business services, which the Data Controller acknowledges.

International data transfers may be made subject to appropriate safeguards. As a safeguard for transfers to a third country, the standard contractual clauses (SCCs) adopted by the European Commission must be taken into account.

When using the AI service provider, the Data Controller strives to ensure that data are transferred only to an appropriate extent and where suitable safeguards are in place, and that the rights of data subjects and an appropriate level of protection for personal data are ensured.

Data retention and data minimisation when using AI

The Data Controller also applies the principle of data minimisation when using AI systems. It therefore intends to transmit or have processed only data necessary to fulfil the relevant request for quotation, customer enquiry or communication purpose.

As a general rule, data processed in AI-assisted processes are retained for the same period as applies to the relevant underlying process, including in particular:

for contact and requests for quotations, the period specified in the relevant section of this notice;
for an order, the retention period applicable to order management;
for a complaint or legal dispute, the period specified in the relevant separate section.

The Data Controller strives to ensure that the personal data supplied to the AI system are limited, purpose-specific and necessary.

Informing the data subject about the use of AI

The Data Controller ensures that the data subject receives clear and intelligible information if artificial intelligence is involved in communications with them, preparation of quotations or processing of enquiries.

For this purpose, the Data Controller may provide information in particular in the following ways:

in this section of the privacy notice;
in clearly visible information displayed on the website;
in checkbox text associated with the quotation request form;
in an appropriate attention notice used in email communications.

Rights of data subjects in AI-assisted processing

Data subjects also have the rights provided by the GDPR in relation to AI-assisted processing, including in particular:

the right to information and access;
the right to rectification;
the right to erasure;
the right to restriction of processing;
the right to object;
the right to data portability, where its conditions are met;
rights related to automated decision-making, including the right to request human intervention.

In relation to AI-assisted processing of quotations or responses, the data subject may also request that their question, request for quotation or case be examined individually by a member of the Data Controller's staff.

Related accountability and compliance principles

The Data Controller strives to ensure that its use of AI:

is transparent to data subjects;
is not misleading;
does not lead to unjustified or disproportionate processing;
takes place subject to appropriate technical and organisational measures;
operates under human control to support the service and not as an independent decision-maker.

The Data Controller reserves the right to change the manner and extent of its use of AI, the related technical solutions and the range of providers in the future.

In such a case, it will update this privacy notice accordingly and inform data subjects about the substance of the change.

If the Data Controller intends to carry out further processing, it will provide prior information about the material circumstances of the processing: its legal background and legal basis, its purpose, the categories of data processed and its duration.

Recipients of personal data

Processing for the purpose of storing personal data

Processor: Hetzner Online GmbH

Contact details:
Registered office: Industriestr. 25, 91710 Gunzenhausen, Germany
Email address: info@hetzner.com
Telephone number: +49 (0)9831 505-0
Website: www.hetzner.com

Under its contract with the Data Controller, the Processor stores personal data. It is not entitled to access the personal data.

Processing activity connected with sending newsletters

Name of the company operating the newsletter system: Gergonomic Non-profit Kft.

Registered office of the company operating the newsletter system: 7629 Pécs, Hársfa út 84, Hungary

Telephone number of the company operating the newsletter system: +36/20/557-1788

Email address of the company operating the newsletter system: info@krazarium.com

Website of the company operating the newsletter system: https://krazarium.com

Under its contract with the Data Controller, the Processor assists in sending newsletters. In doing so, the Processor processes the data subject's name and email address to the extent necessary to send the newsletter.

Processing activity connected with sending newsletters

Name of the company operating the newsletter system: Gergonomic Non-profit Kft.

Registered office of the company operating the newsletter system: 7629 Pécs, Hársfa út 84, Hungary

Telephone number of the company operating the newsletter system: +36/20/557-1788

Email address of the company operating the newsletter system: info@krazarium.com

Website of the company operating the newsletter system: https://krazarium.com

The Data Controller reserves the right to use services based on artificial intelligence, such as OpenAI ChatGPT or similar systems, to support its newsletter and marketing communication processes.

The use of these services may affect in particular the following activities:

creating, editing and optimising newsletter text;
generating content suggestions;
preparing automated or semi-automated campaign management;
in certain cases, providing technical support for sending newsletters.

Categories of data processed

When using artificial intelligence systems, the Data Controller strives not to transmit personal data, or to transmit them only to the extent strictly necessary. If processing personal data is nevertheless necessary, it may concern in particular the following data:

name, for example for the purpose of addressing the recipient;
email address;
preferences, such as areas of interest and previous newsletter interactions.

Legal basis for processing

The legal basis for processing is:

the data subject's consent [Article 6(1)(a) GDPR]; and
the Data Controller's legitimate interest [Article 6(1)(f) GDPR] in making its marketing activities more effective.

Processors and data transfers

Providers of artificial intelligence services may act as processors of the Data Controller. Processing may take place in a country outside the European Economic Area. In such a case, the Data Controller ensures appropriate safeguards, such as contractual terms adopted by the EU.

Data security

The Data Controller uses appropriate technical and organisational measures to ensure that:

data are protected when AI systems are used;
unnecessary transfers of personal data are avoided;
data are accessible only to authorised persons.

Rights of data subjects

The data subject is entitled at any time to:

request information about AI-based processing;
request erasure or rectification of their data;
object to processing.

Processing related to accounting

Name of the processor: Gergonomic Non-profit Kft.

Registered office of the processor: 7629 Pécs, Hársfa út 84, Hungary

Telephone number of the processor: +36/20/557-1788

Email address of the processor: info@krazarium.com

Website of the processor: https://krazarium.com

Under a written contract with the Data Controller, the Processor assists in recording accounting documents. In doing so, the Processor processes the data subject's name and address to the extent necessary for the accounting records and for the period specified in Section 169(2) of the Accounting Act, after which it deletes them without delay.

Processing related to invoicing

Name of the processor: Gergonomic Non-profit Kft.

Registered office of the processor: 7629 Pécs, Hársfa út 84, Hungary

Telephone number of the processor: +36/20/557-1788

Email address of the processor: info@krazarium.com

Website of the processor: https://krazarium.com

Under its contract with the Data Controller, the Processor assists in maintaining records of accounting documents. In doing so, the Processor processes the data subject's name and address to the extent necessary for the accounting records and for the period specified in Section 169(2) of the Accounting Act, after which it deletes them.

Processing related to operation of the CRM system

Name of the processor: Gergonomic Non-profit Kft.

Registered office of the processor: 7629 Pécs, Hársfa út 84, Hungary

Telephone number of the processor: +36/20/557-1788

Email address of the processor: info@krazarium.com

Website of the processor: https://krazarium.com

Under its contract with the Data Controller, the Processor assists in maintaining records of orders.

In doing so, the Processor processes the data subject's name, address and telephone number, and the number and date of orders, within the civil-law limitation period.

Use of AI-based functions in the CRM

The Data Controller reserves the right to use artificial intelligence-based solutions, such as ChatGPT or other AI systems, to support certain functions of the CRM system.

The use of AI may concern in particular the following areas:

preparing and optimising customer communications, such as emails and responses;
preparing notes and summaries of customer interactions;
automated recommendations and content generation;
supporting sales and marketing processes;
analysing customer data, such as habits and preferences.

Categories of data processed

Data processed in the CRM system and by its associated AI functions include in particular:

name;
email address;
telephone number;
company name, where relevant;
contact details and the content of communications;
customer interactions and notes;
purchase or enquiry data;
preferences.

The Data Controller strives to process personal data only to the necessary and proportionate extent when using AI systems.

Legal basis for processing

performance of a contract [Article 6(1)(b) GDPR];
compliance with a legal obligation [Article 6(1)(c) GDPR];
legitimate interest in managing and developing customer relationships [Article 6(1)(f) GDPR];
for marketing, the data subject's consent [Article 6(1)(a) GDPR].

Processors and data transfers

The CRM system provider and partners providing integrated AI services may act as processors.

Processing may involve a transfer to a country outside the European Economic Area. In such a case, the Data Controller applies appropriate safeguards, such as standard contractual clauses.

Automated decision-making

The Data Controller uses the AI solutions applied in the CRM system as support tools. Without human review, AI does not make an automated decision concerning the data subject that produces legal effects or similarly significantly affects them.

Data security

The Data Controller uses appropriate technical and organisational measures to ensure:

the protection of data stored in the CRM system;
the secure use of AI systems;
protection against unauthorised access;
application of the principle of data minimisation.

Rights of data subjects

The data subject is entitled to:

request information about their data processed in the CRM system;
request rectification or erasure of their data;
object to processing;
request restriction;
exercise their right to data portability.

Processing related to online payment

Name of the data controller: SimplePay Zrt.

Registered office of the data controller: 1138 Budapest, Váci út 135–139, Building B, 5th floor, Hungary

Telephone number of the data controller: +36 1 3-666-611

Email address of the data controller: ugyfelszolgalat@simple.hu

Website of the data controller: https://simplepay.hu

Under its contract with the Data Controller, the payment service provider assists in carrying out online payments. For this purpose, data are transferred to the online payment service provider during the purchase process. The online payment service provider processes the data subject's billing name and address and the number and date of the order in accordance with its own privacy rules.

Purpose of the data transfer: to provide the online payment service provider with the transaction data required for the payment operation initiated with it in connection with the purchase.

Legal basis for the data transfer: performance of the contract between you and the Data Controller under Article 6(1)(b) of the Regulation. Payment by the purchaser forms part of that contract and, in the case of online payment, the transfer of data described in this section is necessary for the payment.

Processing related to the use of AI

AI service provider acting as processor

The Data Controller may use an external provider to provide AI-based functions.

AI service provider: Name: OpenAI, L.L.C. Registered office: 3180 18th St, San Francisco, CA 94110, USA Website: https://openai.com

Acting on the Data Controller's instructions, the AI service provider may process data transmitted by the Data Controller to the extent necessary to provide the service.

The purpose of processing is to process requests for quotations, produce draft responses, support communications and increase administrative efficiency.

For business use, the Data Controller intends to use only AI services that are subject to appropriate contractual and data protection safeguards.

Your rights in relation to processing

During the period of processing, you have the following rights under the Regulation:

the right to withdraw consent;
access to personal data and information concerning processing;
the right to rectification;
user rights relating to the use of AI;
restriction of processing;
the right to erasure;
the right to object;
the right to portability.

If you wish to exercise your rights, this will require your identification and the Data Controller will necessarily need to communicate with you. Personal data must therefore be provided for identification, although identification may be based only on data that the Data Controller otherwise processes about you. Your complaints concerning processing will be available in the Data Controller's email account for the period specified for complaints in this notice. If you were our customer and wish to identify yourself for complaints or warranty administration, please also provide your order identifier. This enables us to identify you as a customer. The Data Controller will respond to complaints concerning processing within 30 days at the latest.

Right to withdraw consent

You may withdraw your consent to processing at any time, in which case the data provided will be deleted from our systems. Please note, however, that where an order has not yet been fulfilled, withdrawal may mean that we are unable to deliver it to you.

In addition, where the purchase has already taken place, accounting rules prevent us from deleting billing data from our systems. If you owe us an outstanding amount, we may also continue to process your data after consent is withdrawn on the basis of our legitimate interest in recovering the debt.

Access to personal data

You are entitled to obtain confirmation from the Data Controller as to whether your personal data are being processed and, where they are, you are entitled to:

obtain access to the personal data being processed; and
receive the following information from the Data Controller:
the purposes of processing;
the categories of personal data processed about you;
information about the recipients or categories of recipient to whom the Data Controller has disclosed or will disclose the personal data;
the envisaged period for which the personal data will be stored or, if that is not possible, the criteria used to determine that period;
your right to request from the Data Controller rectification or erasure of personal data concerning you or restriction of their processing and, where processing is based on a legitimate interest, to object to the processing of such personal data;
the right to lodge a complaint with a supervisory authority;
where the data were not collected from you, any available information as to their source;
the existence of automated decision-making, including profiling, where such a procedure is used, and, at least in those cases, meaningful information about the logic involved and the significance and envisaged consequences of such processing for you.

Exercise of this right may be aimed at establishing and verifying the lawfulness of processing. If information is requested repeatedly, the Data Controller may therefore charge a reasonable fee for providing it.

The Data Controller provides access to personal data by sending the processed personal data and information to you by email after identifying you. If you are registered, access is provided by allowing you to view and check the personal data processed about you after logging into your user account.

Please state in your request whether you are requesting access to personal data or information about the processing.

Right to rectification

You have the right to have the Data Controller rectify inaccurate personal data concerning you without undue delay upon request.

Right to restriction of processing

You have the right to have the Data Controller restrict processing upon request where one of the following applies:

you contest the accuracy of the personal data, in which case restriction applies for the period enabling the Data Controller to verify their accuracy; if the accurate data can be established immediately, restriction will not take place;
the processing is unlawful but, for any reason, you oppose erasure of the data—for example because the data are important to you for asserting a legal claim—and request restriction of their use instead;
the Data Controller no longer needs the personal data for the stated purposes of processing, but you require them for the establishment, exercise or defence of legal claims; or
you have objected to processing, but the Data Controller's legitimate interest may also provide a basis for processing; pending verification of whether the Data Controller's legitimate grounds override your legitimate grounds, processing must be restricted.
Where processing has been restricted, such personal data may, with the exception of storage, be processed only with the data subject's consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State.

The Data Controller will inform you in advance that the restriction of processing is to be lifted, at least 3 working days before it is lifted.

Right to erasure — right to be forgotten

You have the right to have the Data Controller erase personal data concerning you without undue delay where one of the following grounds applies:

the personal data are no longer necessary for the purposes for which the Data Controller collected or otherwise processed them;
you withdraw consent and there is no other legal ground for the processing;
you object to processing based on a legitimate interest and there are no overriding legitimate grounds for the processing;
the Data Controller has unlawfully processed the personal data and this has been established on the basis of a complaint;
the personal data must be erased for compliance with a legal obligation under Union or Member State law applicable to the Data Controller.
Where the Data Controller has made the personal data processed about you public on any lawful ground and is obliged to erase them for one of the grounds above, it must, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform other controllers processing the data that you have requested erasure of any links to, copies of, or replications of those personal data.

Erasure does not apply where processing is necessary:

for exercising the right of freedom of expression and information;
for compliance with an obligation under Union or Member State law applicable to the Data Controller that requires the processing of personal data;

this includes processing carried out for invoicing, as retention of invoices is required by law; processing may also be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller;

for the establishment, exercise or defence of legal claims, for example where the Data Controller has an outstanding claim against you that has not yet been satisfied or where a consumer complaint
or data protection complaint is being handled.

Right to object

You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data based on a legitimate interest. In that case, the Data Controller may no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing that override your interests, rights and freedoms or that relate to the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, including profiling to the extent that it is related to direct marketing. If you object to processing for direct marketing purposes, the personal data may no longer be processed for those purposes.

Right to data portability

Where processing is carried out by automated means or is based on your freely given consent, you have the right to request that the Data Controller provide you with the data you supplied to it. The Data Controller will provide those data in XML, JSON or CSV format and, where technically feasible, you may request that it transmit the data in that format to another controller.

Automated decision-making

You have the right not to be subject to a decision based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you. In such cases, the Data Controller must implement suitable measures to safeguard the data subject's rights, freedoms and legitimate interests, including at least the right to obtain human intervention on the part of the Data Controller, to express their point of view and to contest the decision.

The above does not apply where the decision:

is necessary for entering into or performing a contract between you and the Data Controller;
is authorised by Union or Member State law applicable to the Data Controller that also lays down suitable measures to safeguard your rights, freedoms and legitimate interests;
or is based on your explicit consent.

Registration in the data protection register

Under the provisions of the Privacy Act, the Data Controller was required to register certain processing activities in the data protection register. This registration obligation ceased on 25 May 2018.

Data security measures

The Data Controller states that it has taken appropriate security measures to protect personal data against unauthorised access, alteration, transmission, disclosure, erasure or destruction, accidental loss and damage, and unavailability resulting from changes in the technology used.

Within the limits of its organisational and technical capabilities, the Data Controller makes every effort to ensure that its Processors also take appropriate data security measures when working with your personal data.

Remedies

If you believe that the Data Controller has infringed a statutory provision governing processing or has failed to comply with one of your requests, you may initiate an investigation by the Hungarian National Authority for Data Protection and Freedom of Information in order to remedy the alleged unlawful processing: NAIH (postal address: 1363 Budapest, Pf. 9, Hungary; email: ugyfelszolgalat@naih.hu; telephone: +36 (30) 683-5969, +36 (30) 549-6838, +36 (1) 391 1400). You are also informed that, if statutory provisions governing processing are infringed or the Data Controller fails to comply with one of your requests, you may bring civil proceedings against the Data Controller before a court.

Amendment of this Privacy Notice

The Data Controller reserves the right to amend this Privacy Notice in a manner that does not affect the purpose or legal basis of processing. By using the website after an amendment enters into effect, you accept the amended Privacy Notice.

If the Data Controller intends to carry out further processing of the collected data for a purpose other than that for which they were collected, it will inform you before that further processing about the purpose of processing and the following information:

the period for which the personal data will be stored or, if that is not possible, the criteria used to determine that period;
your right to request from the Data Controller access to and rectification or erasure of personal data concerning you, or restriction of their processing; where processing is based on a legitimate interest, your right to object to processing; and, where processing is based on consent or a contractual relationship, your right to request data portability;
where processing is based on consent, the fact that you may withdraw your consent at any time;
the right to lodge a complaint with a supervisory authority;
whether the provision of personal data is based on a statutory or contractual requirement or is a prerequisite for entering into a contract, whether you are obliged to provide the personal data, the possible consequences of failure to provide the data, and the existence of automated decision-making, including profiling, where such a procedure is used; and

at least in those cases, meaningful information about the logic involved and the significance and envisaged consequences of such processing for you.

Processing may begin only after this information has been provided. Where the legal basis for processing is consent, you must also consent to the processing in addition to receiving the information.