Privacy policy

On this page you’ll find information about what data the HDcopy.hu website collects in order to provide the best possible user experience, and about what data our company needs from you when you use our services, so that your order is made in perfect quality and as quickly as possible. HD Copy Kft. is committed to protecting your data, to storing only as little of your personal data as possible, and to handling it responsibly and never misusing it. By continuing to browse our website, or by using our services, you accept and acknowledge the following.

The HDcopy.hu website is operated by HD Copy Kft., registered office: Bihari utca 15/A, 6723 Szeged, Hungary (hereinafter: the service provider or the data controller).

The website does not allow you to create a personal account, and it does not provide any service that can be used through online software. The purpose of the website is to provide general information about the services offered by HD Copy Kft. and about the ordering process. All information published on the website is for reference only. Using our services requires personal contact with our sales staff by email, by phone or in person.

Data collected by the HDcopy.hu website

The HDcopy.hu website collects information about its visitors using external analytics software, Google Analytics. During your visit, HD Copy Kft. receives the following information about your browsing of the HDcopy.hu website: the location (city) and time your browsing started, your browser type, the type of device (e.g. PC or mobile phone), the pages you viewed and the time you spent on them. This information is displayed in aggregated form and cannot be used to identify individual visitors.

You can find more information about how Google Analytics works and how it protects data here.

The English version of the HDcopy.hu website has a quote request form. It forwards the following data, entered by the client and not verified by us, to the service provider’s sales staff by email, and also stores it on the website’s server: the name, company or band name, email address, phone number (optional), country of delivery and EU VAT number (optional) of the person requesting the quote, and the details of the requested service: the type of product, the quantity, the desired delivery date and the project details. The service provider uses this data to prepare its quote, which it sends by email. The service provider retains the data of quote requests. Clients can ask HD Copy Kft.’s customer service by email or phone to delete the data of their quote request, and the service provider will do so within 48 hours of receiving the request.

Other data generated during an order

We designed our website to give you the fullest possible help in using our services. The website itself does not replace personal communication with our staff, during which further data may be generated (e.g. emails, shipping information). Our company retains this data to the extent necessary and uses it to fulfill our services, in compliance with the relevant regulations of the European Union and Hungarian law. If you have any questions or comments about data processing, please contact us at [email protected].

Legal details

The following laws apply to data processing:

The Fundamental Law of Hungary, Article VI;
GDPR (General Data Protection Regulation – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016);
Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Info Act);
Act V of 2013 on the Civil Code;
Act C of 2000 on Accounting;
Act CLV of 1997 on Consumer Protection;
Act CLXV of 2013 on Complaints and Public Interest Disclosures;
Section 13/A of Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services;
Act XLVII of 2008 on the Prohibition of Unfair Commercial Practices against Consumers;
Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities (with particular regard to Section 6);
Act XC of 2005 on Electronic Freedom of Information;
Act C of 2003 on Electronic Communications (with particular regard to Section 155);
Opinion 16/2011 on the EASA/IAB Best Practice Recommendation on Online Behavioural Advertising.

The data controller’s data protection principles

The service provider, as data controller, has designed and operates its internal processes for handling the data of private individuals, by taking appropriate technical and organizational measures, so that they fully comply with the provisions of the GDPR and the Info Act.

The data controller pays particular attention to ensuring that, in the course of its business activities and daily practice, the provisions of data protection laws and of its internal data protection policy are implemented, while also complying with the other sector-specific laws that apply to it.

The data controller organizes and carries out its data protection activities so that they are lawful, fair, transparent and accurate, and so that it processes only the data most necessary for the purpose of processing, and only for as long as is actually justified. The data controller treats its data processing activities confidentially to the necessary and justified extent, and places great emphasis on informing data subjects about data processing, if possible before processing begins, or, if this is not possible, at the first opportunity after processing begins. The data controller also considers it important to be accountable at all times for the measures it takes in these processes.

The data controller takes all necessary and reasonable measures to permanently delete any personal data provided to it for which it has no legal basis for processing. The data controller also takes measures to ensure that such personal data is not transferred to unauthorized third parties.

Access to data and data security measures

Access to data and data transfer: Only the data controller, and those of its employees for whom it is essential for the performance of their duties, may access the data processed by the data controller.

The data controller transfers the personal data it processes only to those of its contractual partners who are obliged to process or handle the transferred data under a contract concluded with the data controller for this purpose. Before transferring personal data, the data controller has made sure that these contractual partners, and the data processing practices they carry out, comply with the relevant data protection laws and internal regulations. The circumstances of the data transfer, and of the processing carried out by the contractual partner, are set out in the contract concluded between the two parties. The fact and circumstances of these data transfers are recorded in the details of the individual data processing activities.

Beyond the above, the data controller transfers the personal data it processes only in exceptional cases, exclusively to authorities legally entitled to receive it, where required by law or where the authorities request it. The data controller keeps a separate record of such data transfers.

Data security measures: The data controller treats the electronic data it records confidentially and stores it at its registered office. The data controller handles its email traffic through Google LLC (registered office: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). The way the data is stored complies with the relevant data protection laws. The data is protected by appropriate security measures.

The data controller stores personal data kept in paper-based databases at its registered office. Databases not currently in use are locked away. The storage location is protected by appropriate security measures, equipment and devices.

The data controller, and the data processor(s) listed in this policy, are committed to protecting the security of the data they process. Therefore, in the course of their data processing activities, in line with the current state of the art and with professional data protection recommendations and practice – taking into account the nature and circumstances of the processing, the costs of implementation and the risk factors involved – they take all possible technical and organizational measures to guarantee an appropriate level of data security.

Your rights as a data subject

Right to information: The data subject has the right to concise, transparent and intelligible information about the processing of their personal data. This information must be easily accessible, clear and plainly worded, in language the data subject fully understands, and must include all essential circumstances of the processing.

If the data controller obtains personal data from the data subject, it provides the data subject with the appropriate information before obtaining the data.

If the data controller has not obtained the personal data from the data subject, it provides the data subject with the appropriate information within a reasonable period after obtaining the data, but no later than within one month.

If the personal data is used to communicate with the data subject, the appropriate information must be provided no later than at the first communication with the data subject, and if the personal data is expected to be disclosed to another recipient, no later than when the personal data is first disclosed.

If the data subject asks the data controller for information about the exercise of their rights regarding the processing of their data, or about the circumstances of the processing, the data controller provides the appropriate information without undue delay, and no later than within one month of receiving the request. If the request is complex, this deadline may be extended by a further two months. The data subject must be informed of any such extension.

If the data controller does not take action on the request, it informs the requester of this, stating the reasons and the data subject’s right to lodge a complaint.

The data controller must provide the information and related measures free of charge. However, if the data subject’s request is clearly unfounded or excessive, in particular because of its repetitive nature, the data controller may, taking into account the administrative costs of providing the information or taking the action requested, charge a reasonable fee or refuse to act on the request.

Right of access: The data subject has the right to obtain confirmation from the data controller as to whether their personal data is being processed, and, if so, to access the personal data and the following information: the purpose of the processing, the categories of personal data concerned, the recipients or categories of recipients, the planned period of storage, the data subject’s rights regarding processing listed below in this section, and the right to lodge a complaint. Furthermore, if the data was not collected from the data subject, information about its source, whether automated decision-making or profiling took place during the processing, and whether the personal data was transferred to a third country.

The data controller makes the data being processed available to the data subject. For any further copies requested by the data subject, the data controller may charge a reasonable fee based on administrative costs.

Right to rectification: The data subject has the right to have the data controller rectify or complete inaccurate personal data concerning them without undue delay.

Right to erasure (“right to be forgotten”): The data subject has the right to have the data controller erase personal data concerning them without undue delay, and the data controller is obliged to erase such personal data without undue delay, where one of the following grounds applies:

The personal data is no longer necessary for the purpose for which it was collected or otherwise processed;

The data subject withdraws the consent on which the processing is based, and there is no other legal ground for the processing;

The data subject objects to the processing, and there are no overriding legitimate grounds for the processing;

The personal data has been processed unlawfully;

The personal data must be erased to comply with a legal obligation under EU or member state law that applies to the data controller;

The personal data was collected in relation to the offer of information society services to children under the age of 16.

If the data controller has to erase personal data that it previously made public, it must take all reasonable steps to ensure that every other data controller that obtained the data from it after publication also erases it.

The data controller cannot erase the data, even at the data subject’s request, if further processing is necessary for one of the following reasons: exercising the right of freedom of expression and information, complying with a legal obligation that applies to the data controller, reasons of public interest in the area of public health, archiving purposes in the public interest, scientific or historical research or statistical purposes, or the establishment, exercise or defense of legal claims.

Right to restriction of processing: The data subject has the right to have the data controller restrict processing where one of the following applies: the data subject contests the accuracy of the personal data; the processing is unlawful; the data controller no longer needs the personal data for the purposes of processing, but the data subject requires it to enforce a legal claim; or the data subject has objected to the processing.

Where processing has been restricted, the personal data may, with the exception of storage, only be processed with the data subject’s consent, for the enforcement of legal claims, or for reasons of important public interest.

Right to data portability: The data subject has the right to receive the personal data they provided to a data controller in a structured, commonly used and machine-readable format. They also have the right to transmit this data to another data controller without hindrance from the data controller to which the personal data was provided, where the processing is based on the data subject’s voluntary consent or on a contract concluded by the data subject, and the processing is carried out by automated means. Where technically feasible, the data subject may ask for the data to be transmitted directly from one data controller to another.

Right to object: The data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of their personal data where it is necessary for the performance of a task in the public interest or for the purposes of legitimate interests, including profiling based on such processing. In this case, the data controller may no longer process the personal data, unless it demonstrates compelling legitimate grounds for the processing that override the interests, rights and freedoms of the data subject, or that relate to the establishment, exercise or defense of legal claims.

Where personal data is processed for direct marketing purposes (including profiling), the data subject has the right to object at any time to the processing of personal data concerning them for such purposes. If the data subject objects to such processing, the personal data may no longer be processed for this purpose.

Special provisions on processing the personal data of children

For processing of personal data in connection with the website, the voluntary consent of a data subject under the age of 16 is only considered lawful if, and to the extent that, it has been given or authorized by the person with parental responsibility over the child. A child who has reached the age of 16, however, may give voluntary consent to such processing of their personal data without separate parental permission.

Taking into account available technology, the data controller makes every reasonable effort to verify that, for users under the age of 16, consent to data processing has been given or authorized by the person with parental responsibility over the child.

Supervisory authority

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Registered office: Szilágyi Erzsébet fasor 22/c, 1125 Budapest, Hungary
Postal address: 1530 Budapest, Pf. 5, Hungary
Phone: +36 1 391 1400
Fax: +36 1 391 1410
Email: [email protected]
Website: https://naih.hu/

If you live in another EU member state, you can also lodge a complaint with the data protection authority of your country of residence. Legal remedy may be sought before the district court competent for the data controller’s registered office.

Definitions used in this policy

Data subject: any natural person identified or identifiable on the basis of any information.

Identifiable natural person: a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Personal data: any information relating to the data subject.

Special data: any data belonging to the special categories of personal data, i.e. personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, and data concerning a natural person’s sex life or sexual orientation.

Health data: personal data relating to the physical or mental health of a natural person, including data on health care services provided to the natural person, which reveals information about their state of health.

Criminal personal data: personal data relating to the data subject or to their criminal record, generated during or before criminal proceedings in connection with a crime or the criminal proceedings, at bodies authorized to conduct criminal proceedings or detect crimes, or at the penitentiary system.

Consent: any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.

Data controller: the natural or legal person, or organization without legal personality, which – within the framework set by law or by a binding legal act of the European Union – alone or jointly with others determines the purpose of data processing, makes and implements decisions on the processing (including the means used), or has them implemented by a data processor.

Joint controller: a data controller which – within the framework set by law or by a binding legal act of the European Union – jointly with one or more other data controllers determines the purposes and means of processing, and jointly with one or more other data controllers makes and implements decisions on the processing (including the means used), or has them implemented by a data processor.

Data processing: any operation or set of operations performed on data, regardless of the method used, in particular collection, recording, organization, storage, alteration, use, retrieval, transfer, disclosure, alignment or combination, blocking, erasure and destruction, as well as preventing further use of the data, taking photographs, sound or video recordings, and recording physical characteristics suitable for identifying a person (e.g. fingerprints or palm prints, DNA samples, iris images).

Data transfer: making data available to a specific third party.

Onward transfer: the transfer of personal data to a data controller or data processor operating in a third country or within an international organization, via a data controller or data processor operating in another third country or within an international organization.

Disclosure: making data available to anyone.

Data erasure: making data unrecognizable in such a way that it can no longer be restored.

Restriction of processing: marking stored data in order to limit its further processing.

Data destruction: complete physical destruction of the data carrier containing the data.

Data processing on behalf of the controller: the set of processing operations performed by a data processor acting on behalf of or under the instructions of the data controller.

Data processor: the natural or legal person, or organization without legal personality, which – within the framework and under the conditions set by law or by a binding legal act of the European Union – processes personal data on behalf of or under the instructions of the data controller.

Data set: all data processed in one record system.

Third party: a natural or legal person, or organization without legal personality, which is not the data subject, the data controller, the data processor, or a person who performs personal data processing operations under the direct authority of the data controller or data processor.

EEA state: a member state of the European Union, another state party to the Agreement on the European Economic Area, and any state whose nationals enjoy the same status as nationals of a state party to the EEA Agreement under an international treaty concluded between the European Union and its member states and a state not party to the EEA Agreement.

Third country: any state that is not an EEA state.

Personal data breach: a breach of data security leading to the accidental or unlawful destruction, loss, alteration, unauthorized transfer or disclosure of, or unauthorized access to, personal data transmitted, stored or otherwise processed.

Profiling: any form of automated processing of personal data intended to evaluate, analyze or predict personal characteristics of the data subject, in particular characteristics relating to their work performance, economic situation, health, personal preferences or interests, reliability, behavior, location or movements.

Recipient: a natural or legal person, or organization without legal personality, to which the data controller or data processor makes personal data available.

Pseudonymization: the processing of personal data in such a way that, without the use of additional information stored separately from the personal data, it can no longer be determined which data subject the personal data relates to, and technical and organizational measures ensure that it cannot be linked to an identified or identifiable natural person.