Privacy Policy
CONSOLE.DESIGN DATA MANAGEMENT INFORMATION
Niada Kft., as consoul.design is the owner of the website regarding the data management activities concerning the personal data of natural persons (data subjects) visiting the website, the European Council and the Parliament on the protection of natural persons with regard to the management of personal data and on the free flow of such data, and on the repeal of Directive 95/46/EC (EU) 2016/679, General Data Protection Regulation, hereinafter: GDPR), in order to inform the Data Subjects in advance and facilitate the exercise of their rights, this data management and data protection information is available to the data subjects.
1. The Data Controller
Company name: Niada Kft.
Headquarters: 8440 Herend, Hóvirág utca 2. A.
Company registration number: 19-09-522311
Tax number: HU27198449
Phone number: +36 30 739 9105
Email address: order@consoul.design
Website: consoul.design
(hereinafter: Data Controller)
2. The most important legislation on data management
Regulation (EU) 2016/679 of the European Parliament and of the Council (April 27, 2016) on the protection of natural persons with regard to the processing of personal data and on the free flow of such data, and on the repeal of Regulation 95/46/EC (general data protection regulation/GDPR);
on information self-determination and freedom of information CXII of 2011. TV. (Infotv.);
CVIII of 2001 on certain issues of electronic commercial services and services related to the information society. TV.
XLVIII of 2008 on the basic conditions and certain limitations of economic advertising activity. TV.
3. Categories of managed personal data, purpose, legal basis and duration of data management
3.1. Data management related to registration
Description of the data management process: on the Data Controller’s website, data subjects have the opportunity to register and thereby create a personal user account. The purpose of the personal user account is to make it easier for the concerned user to use certain functions of the website. (For example, after registration, the concerned user can use his registered data to shop in the webshop available on the website, he does not have to enter the necessary data separately during the purchase.).
After registration, to the e-mail address provided as part of the registration. the Data Controller sends a confirmation email. The registration becomes final after confirmation based on this.
| Categories of processed personal data | Purpose of data management | Legal basis for data management | Duration of data management |
| Name of the person concerned (surname, first name) | Identification of the data subject | Consent of the data subject (GDPR Article 6 (1) para. a) | Until the data subject’s consent is revoked |
| The e-mail address of the affected person | Maintaining contact with the data subject and forwarding messages to him | Consent of the data subject (GDPR Article 6 (1) para. a) | Until the data subject’s consent is revoked |
| The telephone number of the person concerned | Contact with the data subject | Consent of the data subject (GDPR Article 6 (1) para. a) | Until the data subject’s consent is revoked |
The source of processed personal data is the data subject. The password entered during registration is not stored by the Data Controller, only a so-called hash print, which is required for verification.
The provision of personal data depends on the voluntary decision of the person concerned, in case of failure to do so, the person concerned cannot use the options related to the registration, which ensure easier use of the functions available through the website. You have the right to withdraw your consent to data management at any time, which you can do by sending a statement of this content to info@consouldesign.com.
We would also like to inform you that the withdrawal of consent does not affect the legality of data processing based on consent, prior to the withdrawal.
3.2. Data management related to purchases in the webshop
Description of the data management process: in the webshop available on the website of the Data Controller, shopping is possible without registration, or for those concerned with registration. In accordance with Hungarian law, the Data Controller is obliged to issue an accounting document (invoice) for the purchases made. In the case of registered parties, the purchase process is simpler and faster, since in their case, after ordering the product, the billing data (name, address) is automatically retrieved from the user account data.
| Categories of processed personal data | Purpose of data management | Legal basis for data management | Duration of data management |
| Name of the person concerned (surname, first name) The address of the person concerned | Identification of the data subject, preparation of the invoice related to the data subject’s purchase | Fulfilling the legal obligation of the data controller (GDPR Article 6 (1) para. c) CXXVII of 2007 Act (VAT Act) § 159 (1) para. , and § 169, as well as Act C. of 2000. (accounting tv.) based on § 169 | In relation to the given purchase, for 8 years after the invoice was issued |
| Number of the loyalty card of the person concerned (if you have one) | Identification of the person concerned, validation of the frequent customer discount due to him | Data management is necessary for the performance of a contract in which the data subject is a party (GDPR Article 6 (1) para. b) | In connection with the given purchase, for 5 years after the completion of the contract (statutory statute of limitations) |
| The e-mail address of the affected person | Maintaining contact with the data subject and forwarding messages to him | Fulfilling the legal obligation of the data controller (GDPR Article 6 (1) para. c) 45/2014. (II. 26.) Government Decree 6.-8. points | Up to 5 years after the completion of the contract related to the given purchase (statutory statute of limitations) |
| The telephone number of the person concerned | Contact with the data subject | In order to properly fulfill the contract, asserting the data controller’s legitimate interest related to effective communication (GDPR Article 6 (1) para. f) | Up to 5 years after the completion of the contract related to the given purchase (statutory statute of limitations) |
| Shipping address (if not the same as the billing address) | Delivery of the product purchased by the person concerned | Data management is necessary for the performance of a contract in which the data subject is a party (GDPR Article 6 (1) para. b) | In connection with the given purchase, for 5 years after the completion of the contract (statutory statute of limitations) |
The source of the processed personal data is the data subject, if the data subject has a registered user account, in which case the user account data provided by the data subject during registration. The data source is the internal register of the Data Controller regarding the right to be a regular customer.
The provision of invoicing-related data (name, address) is mandatory based on legal requirements, without which the Data Controller would not be able to use the Accounting TV. to fulfill its obligations under, and thus would not be able to sell the ordered goods to the person concerned.
The management of the e-mail address of the person concerned is necessary for the Data Controller to fulfill the information obligations required by law in connection with the conclusion of contracts between absentees. On the other hand, these data are necessary in order to fulfill the contract quickly and in accordance with the intention of the person concerned, and to ensure the possibility of effective communication necessary for this. If the data subject has registration, the system will transfer the phone number and e-mail data entered from his user account to the purchase data if he logs in as a registered user.
The data management of the delivery address – if it is different from the billing address – is necessary for the fulfillment of the relevant order (that is, the contract related to the delivery as a separate service). Providing the data depends on the data subject’s decision, otherwise the Data Controller will deliver (have it delivered) the purchased product to the billing address.
3. 3. Personal data management related to the right to cancel the purchase without giving a reason for online buyers
Description of the data management process: in the case of online purchases, the data subject, as a consumer, has the legal right to withdraw from the contract within a certain period of time from the conclusion of the contract or the receipt of the product without the obligation to provide reasons, that is, to decide that he does not wish to purchase the given product. The Data Controller manages the personal data of the person concerned as required by law in order to manage the amount. The data subject makes the data available to the Data Controller by filling in and sending the form template available on the Data Controller’s website.
| Categories of processed personal data | Purpose of data management | Legal basis for data management | Duration of data management |
| the name and address of the person concerned | administration related to the exercise of the data subject’s right of withdrawal without justification in connection with the contract between the data subject (as a consumer) and the Data Controller | Fulfilling the legal obligation of the data controller (GDPR Article 6 (1) para. c) 45/2014. (II. 26.) § 22 of the Government Decree and No. 2 based on its annex | 8 years after the exercise of the right of withdrawal (or exchange) (based on § 169 of the Accounting Act) |
| order ID related to the purchase of the person concerned (in case of cancellation) | administration related to the exercise of the data subject’s right of withdrawal without justification in connection with the contract between the data subject (as a consumer) and the Data Controller | Fulfilling the legal obligation of the data controller (GDPR Article 6 (1) para. c) 45/2014. (II. 26.) § 22 of the Government Decree and No. 2 based on its annex | |
| in case of cancellation, also the bank account number (current account number) of the person concerned | transfer of the amount due to the person concerned due to the cancellation | Fulfilling the legal obligation of the data controller (GDPR Article 6 (1) para. c) 45/2014. (II. 26.) Based on § 23 of Government Decree | |
| in case of exchange, the identifier of the exchange order | the identification of the affected person’s exchange transaction | Data management is necessary for the performance of a contract in which the data subject is a party (GDPR Article 6 (1) para. b) |
The data subject is the source of the processed data. Providing the data is necessary/obligatory in view of the legal regulations applicable to the Data Controller, otherwise the Data Controller would not be able to identify the data subject or the contract from which it wishes to withdraw, and the purchase price due to the data subject would not be able to be delivered to the data subject in the manner prescribed by law.
3.4. Data management related to the warranty/warranty replacement of the product purchased in the webshop, or the cancellation of the purchase (“warranty administration”)
Description of the data management process: in relation to the products purchased by the data subject in the webshop, there may be reasons and circumstances (e.g. a possible defect in the product) due to which the product-related so-called it becomes necessary to assert warranty or warranty rights. In relation to this kind of administration, the data subject can start the process via the Data Controller’s website, using the email or phone number found there. In some cases, the person concerned has the right/possibility to withdraw from the purchase, that is, to decide that he does not need the purchased product due to its defect or deficiency, and does not request another one instead.
| Categories of processed personal data | Purpose of data management | Legal basis for data management | Duration of data management |
| name, address and other details of the invoice (product, price, quantity) | administration related to the exercise of the warranty/warranty claim of the data subject in connection with the contract between the data subject (as a consumer) and the Data Controller | Fulfilling the legal obligation of the data controller (GDPR Article 6 (1) para. c) 19/2014. (IV. 29.) NGM Decree § 4 or Based on § 6 | |
| any additional personal data contained in the statement related to the change or cancellation of the person concerned, | |||
| order ID related to the purchase of the person concerned (in case of cancellation) | |||
| in the case of a refund, also the bank account number (current account number) of the person concerned |
The data subject is the source of the processed data. The provision of the data is necessary for the fulfillment of the legal obligation applicable to the Data Controller, in the event of failure to do so, the Data Controller would not be able to handle the claim related to the warranty and guarantee.
4. Getting to know the data within the organization of the Data Controller
Only those employees of the Data Controller who carry out tasks related to the implementation of the indicated data management goals can see the managed personal data:
– the chief executive officer of the Data Controller, or
– employees of the Data Controller performing customer service and customer service tasks based on their job title
– employees performing tasks related to the operation of the IT systems of the Data Controller.
5. Recipients, data processors
In order to ensure the operation of the Website and the high-quality service of orders via the Website, the Data Controller uses the cooperation of the following data processors. The data processors carry out their activities in accordance with the GDPR and the rules of the contract concluded with them, according to the instructions of the data controller.
5.1. Hosting service
Company name: XXX
Head office of Data Controller: XXX
Tax ID of Data Controller: XXX
Telephone contact of Data Controller: XXX
E-mail: XXX
Data management activities: receiving orders, requesting, collecting, storing and forwarding the data required to fulfill the order to the accounting and invoicing system. Sending confirmation emails.
6. Protection of processed personal data
When developing the technical and procedural rules for data management operations, the Data Controller places great emphasis on ensuring adequate physical, administrative and IT protection of the data it manages. The purpose of the measures used is primarily to avoid and prevent the possibility of unauthorized access to the managed data, the unauthorized change, transmission, disclosure, deletion or damage of the data. The Data Controller chooses the tools and measures used during data management accordingly. The Data Controller also ensures that only those authorized to access the processed data and that the authenticity and immutability of the processed data are ensured.
In order to prevent unauthorized access to personal data, changes and unauthorized disclosure or use of data, the data manager ensures the following in particular:
on the creation and application of incident management rules and procedures;
on the establishment and operation of the properly protected IT and technical environment;
on ensuring the knowledge of personal data management of employees participating in data management operations, confidentiality of employees, supervision of data management.
7. The data subject’s rights in relation to data management
In connection with the data management concerning his personal data, the data subject is entitled to:
for appropriate and transparent information, in the framework of this, to receive feedback from the Data Controller on whether your personal data is being processed;
to request the correction of inaccurate personal data;
to request the deletion of your processed personal data, if the data processing is based solely on your consent, or if the data are no longer needed for the purpose for which they were collected, or if the data processing is illegal;
exercise the right to the portability of your personal data, i.e. you are entitled to receive your personal data in a widely used, machine-readable form, to transmit it to another data controller, or to request this, provided that the data management is automated and based on a contract or consent, and that the exercise of the said right does not infringe the legitimate interests or freedom of others;
to request the restriction of the processing of your personal data (for example, if the accuracy of the processed data is disputed or the illegality of data processing has arisen until these circumstances are clarified);
to object to the processing of your personal data (for example, if the legal basis of the data processing is to assert the legitimate interests of the data controller or a third party), or to withdraw your previously given consent at any time,
in case of data processing deemed to be harmful, to contact a supervisory authority or a court.
7.1. Content of individual rights of the data subject
right of access to personal data: the data subject is entitled to receive feedback from the Data Controller as to whether his personal data is being processed, and if so, he is entitled to receive access to the following information:
categories of processed personal data,
the purpose of data management,
recipients to whom your personal data has been disclosed or will be disclosed,
the planned duration of data storage, or the criteria for determining the duration
the source of the data, if the data was not collected from the data subject,
on the right to apply (complain) to the supervisory authority,
if automated decision-making or profiling takes place during data management, then about the fact and logic of this, as well as the expected consequences for you;
you are entitled to receive a copy of your processed personal data.
right to rectification of personal data: the data subject has the right to request that the Data Controller correct inaccurate personal data concerning him or her without undue delay, and may request that incomplete personal data be supplemented, among other things, by means of a supplementary statement.
the right to delete personal data: the data subject has the right to have the Data Controller delete the personal data concerning him without undue delay upon request, and the Data Controller is obliged to delete the personal data concerning the data subject without undue delay if:
the personal data are no longer needed for the purpose for which they were collected or otherwise processed or;
the data subject withdraws his consent and there is no other legal basis for the data processing or;
the data subject objects to data processing and there is no overriding legal reason for data processing, or;
the personal data has been unlawfully processed or;
the personal data must be deleted in order to fulfill the legal obligation applicable to the Data Controller;
the collection of personal data took place in connection with the offering of services related to the information society (e.g. in the context of some online marketing, internet prize draw).
There may be important reasons and interests that may allow processing of the data subject’s data even if he/she has requested their deletion (this may be the case, for example, to exercise the right to freedom of expression and information, or if it is necessary to present, assert, or defend legal claims).
the right to restrict data processing: the data subject has the right to have the Data Controller restrict data processing at his request, if:
the data subject disputes the accuracy of the personal data (in this case, the restriction lasts until the Data Controller checks the accuracy of the personal data) or;
the data management is illegal and the data subject requests the restriction of their use instead of deleting the data, or;
the Data Controller no longer needs the personal data for the purpose of data management, but the data subject requires them to present, enforce or defend legal claims; obsession
the data subject objected to data processing (in this case, the restriction lasts until it is determined whether the legitimate reasons of the Data Controller take precedence over the legitimate reasons of the data subject);
During the restriction period – with the exception of cases related to the protection of the important public interest or the rights of individuals – no other data management operations can be performed with the data other than the storage of the given data
the right to data portability: the data subject has the right to receive the personal data concerning him/her provided to a data controller in a segmented, widely used, machine-readable format, and is also entitled to transmit this data to another data controller. This right belongs to the data subject if the data processing is based on his consent or a contract and is carried out in an automated manner. The exercise of the right must not adversely affect the rights and freedom of others.
the right to object: if the legal basis of the data processing is the legitimate interest that the Data Controller wishes to assert, the data subject is entitled to object to the processing of his personal data at any time for reasons related to his own situation. In such a case, the Data Controller may no longer process the personal data, unless the Data Controller proves that the data processing is justified by compelling legitimate reasons that take priority over the interests, rights and freedoms of the data subject, or that are necessary for the presentation, enforcement or defense of legal claims are connected. (With regard to this data management – taking into account its stated legal basis – the right to protest is not relevant.)
8. Remedial rights
If, according to your judgment, you have suffered a violation of your rights in connection with the processing of your personal data by Niada Kft., and you believe that we did not respond to your requests and comments in this regard, or did not respond in an appropriate time or manner, you have the right to file a complaint with the competent supervisory authority.
Details of the competent supervisory authority:
name: National Data Protection and Freedom of Information Authority (NAIH)
address: 1055 Budapest, Falk Miksa utca 9-11.
e-mail: ugyfelszolgalat@naih.hu
telephone: +36 1 391 1400
You also have the right to apply to the competent court of your place of residence or – depending on your choice – your place of residence, if, in your opinion, the Data Controller is handling your personal data in violation of the provisions of the law or the mandatory legal act of the European Union.
We recommend that if you plan to apply to the supervisory authority or court, you should first contact the Data Controller at the contact details indicated in point 1, as the necessary information regarding your questions and requests requiring remedial action is available at the Data Controller.
With any request, question, or comment related to the processing of personal data, the Data Subject may contact the staff of the Data Controller by e-mail sent to the e-mail address indicated in point 1 or the Data Controller at 2000 Szentendre, Rózsa u. 16. in a letter sent to his postal address.
Our company is committed to the implementation of the principles of legal, transparent and fair data management, therefore, in situations deemed to be harmful, we take extraordinary measures to clarify the questions that have arisen, and to remedy the established harm, and to inform you of the findings and the measures we have taken, and if you contact the Data Controller for information, we will inform you within a maximum of 1 month from the date of contacting us.