PRIVACY AND SECURITY POLICY

​

These Regulations contain the internal rules of the data management activities of www.pszichoteam.hu (hereinafter: the Data Controller) in accordance with the provisions of the applicable data protection laws and regulations, in particular Act CXII of 2011 on the right to information self-determination and freedom of information. and Regulation (EU) 2016/679 of the European Parliament and of the Council.

These Regulations shall be interpreted in accordance with the provisions of the other regulations of the Data Controller. In the event of a conflict between the provisions of these Regulations and any other instructions or previously adopted regulations regarding the protection of personal data, the provisions of these Regulations shall prevail.

Budapest, December 29, 2021

​

Purpose and scope of the Regulations

By creating and making available these Regulations, the Data Controller intends to ensure the exercise of the right to information of natural persons involved in data management activities, and defines the principles and procedures that it follows in the course of its data management activities. The purpose of these Regulations is to provide the data subjects with adequate information on the data processing activities performed at the Data Controller, the data processed by the data controller and all relevant circumstances of the data processing and processing, the legal basis and recipient of the data transfer.

With these Regulations, the Data Controller intends to ensure the order of keeping the registers required by law, determines the applicable data security level and the procedure for its enforcement.

These Regulations cover all the processes carried out during the operation of the Data Controller, during which the processing of personal data of natural persons takes place, provided that the Data Controller has adopted a separate regulation on the processing of personal data of employees working with the Data Controller.

Temporal validity of these Regulations 29.12.2021. from the date of revocation.

Definitions

According to these Regulations, the Data Controller is: Emese EVE Queen Queen EV

Tax number: 56437696-1-33 Contact: molnarmese@gmail.com

The processing of data by employees in an employment relationship with the Data Controller in connection with their employment can be attributed to the Data Controller, it is classified as data processing by the Data Controller.

The use of terms in these Regulations complies with the provisions set out in Regulation (EU) 2016/679 of the European Parliament and of the Council, of which the following should be highlighted:

1. personal data: any information relating to an identified or identifiable natural person ("data subject"); identify a natural person who, directly or indirectly, in particular by reference to one or more factors such as name, number, location, online identifier or physical, physiological, genetic, mental, economic, cultural or social identity of the natural person identifiable;

2. special data: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as genetic and biometric data for the unique identification of natural persons, health data and personal data concerning the sexual life or sexual orientation of natural persons

3. data management: any set of operations or operations on personal data or files, whether automated or non-automated, such as collecting, recording, organizing, segmenting, storing, transforming or altering, retrieving, viewing, using, communicating, transmitting or otherwise by making available, harmonizing or linking, restricting, deleting or destroying;

4. the data subject's consent: a voluntary, specific and well-informed and unambiguous declaration of the data subject's consent to the processing of personal data concerning him or her, by means of a statement or an unequivocal statement;

5. data protection incident: a breach of security resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, personal data transmitted, stored or otherwise handled;

6. data processor: any natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller;

7.   profiling: any form of automated processing of personal data which involves the evaluation of certain personal characteristics of a natural person, in particular those relating to his performance, economic situation, state of health, personal preferences, interests, reliability, behavior, location or movement used to analyze or predict;

8.   third party: a natural or legal person, public authority, agency or any other body other than the data subject, the controller, the processor or persons who have been authorized to process personal data under the direct control of the controller or processor

9. employee: natural persons who have an employment relationship with the Data Controller as an employer

Abbreviations used in these Regulations:

1. Infotv. - Act CXII of 2011 on the right to information self-determination and freedom of information. law

2. GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council

3. Ptk. - Act V of 2013 on the Civil Code

4. Mt. - Act I of 2012 on the Labor Code

5. Fgytv. - 1997 CLV. law

ENSURING THE LAWFULNESS OF DATA PROCESSING

Data Protection Organization of the Data Controller

The Data Controller's management of data protection, data management, data security and information security is managed by the current Managing Director, who manages the entire Data Controller's organization in terms of data protection and data management with the instructions given to the employees under his direct control and the regulations issued by him.

The Data Controller shall make these Regulations available to all its employees and shall oblige them to comply with these Regulations. The data controller ensures that its employees are aware of and comply with legal and regulatory obligations regarding data management, classifies compliance with data protection regulations as an essential job duty, and may only access personal data on the basis of specific rights, purposes and in a way that does so.

The identity of the potential data controllers entitled to access the data, the recipients of the personal data:  

​

Personal data may be processed by the data controller's staff and by therapists, psychologists and counselors who necessarily cooperate with the data controller in order to provide the service, in compliance with the rules for employees set out in these regulations.

​

All employees are required to

• to organize and continue its work in such a way that the data protection and data protection regulations of the Data Controller are met; in this context, he / she is obliged to protect the data recorded by him / her in connection with the performance of his / her tasks, recorded on paper, from unauthorized access, loss, physical damage

• keep your individual access data and passwords; you may not disclose or publish it

• leave the IT systems after use, block access to electronic devices in case of departure or interruption of the session, lock and keep the data carriers in case of paper-based data management, leave them unattended

• to prevent the loss of electronically stored data to be backed up or performed at regular intervals by another employee holding a suitable job

• to participate in data protection trainings organized by the Data Controller

• in case of detection of a data protection incident, act in accordance with the Data Controller's regulations on the handling of data protection incidents

Employees and data processors performing data processing are obliged to maintain confidentiality in connection with data processing, are responsible for the observance of the operation in accordance with the regulations, for the integrity, integrity, availability, data protection incidents and violations arising from their intentional or negligent conduct.

To prevent unauthorized access, the Data Controller protects its IT systems with a firewall and virus protection, and selects the programs it uses to meet current information security requirements. It sets different levels of authorization for your IT systems and restricts access to the information with password protection, as well as measures to ensure that data files can be restored, in particular regular backups and the separate, secure storage of copies.

Electronic data management is performed only on computers owned or exclusively used by the Data Controller, on which activity logging is provided. The data stored on the network server machine (server) can only be accessed by duly authorized persons.

The up-to-dateness of the data controller's IT systems is ensured by continuous maintenance, who has access to the electronically stored data. Ensuring this access is an essential condition for the operation of the Data Controller, and is also necessary in order for the Data Controller's electronic devices and IT systems to comply with legal requirements. Some of the data stored in the IT systems are also accessed by the contractual partners of the Data Controller, who perform the development of the webshop operated by the Data Controller and search engine optimization. are entitled to know in connection with the performance of

Basic rules for data management

The data controller processes personal data only for the purpose of exercising rights and fulfilling obligations, and processes personal data to the extent and for the duration necessary, in compliance with the purpose limitation principle. Accordingly, at all stages of the data processing for a pre-determined purpose, if the purpose of the data processing has ceased or the processing of the data is otherwise unlawful, the data will be deleted.

Only personal data that is essential for the purpose of data processing and suitable for that purpose may be processed. The purpose of data processing shall be communicated to the data subject by the Data Controller prior to the collection of the data by means of publicly available information, regulations or individual communication.

The processing shall ensure the accuracy, completeness and, where necessary for the purposes of the processing, the accuracy of the data and that the data subject can only be identified for the time necessary for the processing.

Where the Data Controller uses data processors for data processing, it shall select for this purpose only persons who provide adequate guarantees for the implementation of appropriate technical and organizational measures to ensure compliance with the legal provisions on data processing and the protection of the rights of data subjects.

The data controller does not process personal data for direct business purposes.

The data controller shall process the data in one of the following cases:

• the processing is necessary to protect the vital interests of the data subject or of another natural person

• the processing is necessary for the performance of a contract in which the data subject is required by one of the parties or to take steps at the request of the data subject prior to the conclusion of the contract;

• the processing is necessary to fulfill a legal obligation on the controller

• the data subject has consented to the processing of his or her personal data for one or more specific purposes

• necessary for the performance of a task in the public interest or in the exercise of a public authority conferred on the controller

• the processing is necessary for the protection of the legitimate interests of the controller or of a third party, unless the interests or fundamental rights and freedoms of the data subject which require the protection of personal data take precedence over those interests;

The consent of the data subject only complies with the legal requirements if it is given voluntarily, in the possession of clear and appropriate information, ie information on data processing. The Data Controller states that in the event of a request for a quote on its website or the provision of personal data on the website, as well as requests for contact details on its website, the data subject consents to the processing of the personal data provided by him / her in a certain scope. Withdrawal of consent does not affect the lawfulness of consent-based data processing prior to withdrawal, so the withdrawal is only for the future. The related data processing takes place only in connection with the services provided by the Data Controller, they will not be communicated to third parties. The Data Controller will only process the personal data provided for as long as it provides a service to the data subject or this is necessary due to the legal relationship between the parties, after which they will be deleted.

If the processing of personal data is required by law or is necessary for the fulfillment of the legal obligation of the Data Controller, the data processing is mandatory. In the case of mandatory data management, if the data subject fails to provide the data, the Data Controller is entitled or obliged to refuse to provide the service.

The duration of the data processing is indicated in the information on the given data processing. As a general rule, the Data Controller stipulates in these Regulations that the data processing takes place for as long as it is necessary to process the material data, taking into account the purpose of the data processing. In the case of data processed on the basis of consent, the data processing lasts until the consent is revoked, the decision of the court or authority to cancel it is enforced, or the rights and obligations arising from the legal relationship in connection with which the Data Controller handles personal data expire. The Civil Code. Under Section 6:22, the general limitation period is 5 years. Data processing on the basis of law lasts for the period or conditions specified by law.

RIGHTS OF ENTITLED PERSONS AND ENFORCEMENT OF THEIR RIGHTS

Rights of data subjects

Right to information and access to personal data

The data subject shall have the right to request information on the scope of the personal data processed and the circumstances of the data processing, in particular the purpose and legal basis of the data processing, the duration of the data processing and possible data protection incidents and remedies. The data subject also has the right to information if the Data Controller has obtained his or her personal data from another person, in which case the Data Controller shall also provide detailed information on from whom, when and how the data was collected.

The data subject has the right to receive feedback from the Data Controller as to whether the processing of his / her personal data is in progress, and if such data processing is in progress, the Data Controller shall grant him / her access to the personal data subject to the data processing. At the request of the data subject, he / she shall provide a copy of the processed data to the Data Controller.

Right to rectification

The data subjects have the right to request the correction and, if necessary and possible, the supplementation of their incorrectly recorded personal data, which the Data Controller is obliged to comply with without undue delay.

The right to cancel (the “right to forget”) and the right to protest

In the case of data processing based on the consent of the data subject, the data subjects have the right to request the deletion of the data, according to the legitimacy of which the data requested to be deleted must be deleted from all databases. If the data processing is based on the legitimate interest of the Data Controller, the data subject has the right to object to the data processing, in which case the personal data may only be further processed if the Data Controller's right over data processing takes precedence over the data subject's related to the submission, enforcement or defense of claims. Until a priority interest is established, access to material personal data shall be restricted by the Data Controller as set out below.

If the processing of certain personal data is no longer necessary for the purpose for which it was processed or the processing is unlawful, the data subject may also request the deletion.

Where personal data are processed for scientific and historical research or statistical purposes, the data subject shall have the right to object to the processing of personal data concerning him or her on grounds relating to his or her situation, unless such processing is necessary for the performance of a task carried out in the public interest. The Data Controller is obliged to provide data for statistical purposes pursuant to Sections 24 and 26 of the CLV Act 2016 on Official Statistics, in which case the transmitted data is not suitable for the identification of persons in contact with the Data Controller.

Right to restrict data processing

Data subjects have the right, at their request, to be restricted by the Data Controller in the following cases:

• if the accuracy of the personal data is disputed by the data subject

• the processing is unlawful and the data subject opposes the deletion of the data and instead requests a restriction on its use

• the data controller no longer needs the personal data for the purpose of data processing, but the data subject requests them in order to submit, enforce or protect legal claims

Personal data subject to a restriction may be processed, with the exception of storage, only with the consent of the data subject or for the purpose of bringing, enforcing or protecting legal claims or protecting the rights of another natural or legal person or in the important public interest of the European Union or a Member State.

If a personal data is corrected or deleted or the processing of data is to be restricted, the Data Controller shall inform all recipients to whom the personal data have been communicated of this fact, unless this proves impossible or requires a disproportionate effort. Upon request, the Data Controller shall inform the data subject about these recipients.

Informing the data subject about the data protection incident

If a data protection incident occurs at the Data Controller and it is likely to pose a high risk to the data subject's rights and freedoms, the Data Controller shall inform the data subject without undue delay of all relevant circumstances. The controller shall inform the data subject through publicly available information if any of the following conditions are met:

• The controller has implemented appropriate technical and organizational protection measures and these measures have been applied to the data affected by the data protection incident, in particular measures such as the use of encryption, which make the data incomprehensible to persons not authorized to access personal data.

• the controller has taken additional measures following the data protection incident to ensure that the high risk to the data subject's rights and freedoms is no longer likely to materialize;

• the information would require a disproportionate effort.

The data controller's procedure for data protection incidents is contained in detail in a separately published policy.

Method of enforcement

The Data Controller can make his / her requests and notifications related to the data processing at the contact details indicated above.

The controller shall examine all requests and notifications relating to the processing and shall take a decision within 30 days of receipt, which shall be communicated to the data subject in writing, including by e-mail. The data controller shall also indicate the remedies available in his written reply.

The data controller states that, depending on the content of the application or notification, it may be accepted if the applicant identifies himself / herself, precisely due to the data protection regulations. In the event of failure to provide the required identification, the Data Controller may request the applicant to rectify the deficiencies, which period shall not be included in the above deadline, if the identification is actually required. In order to fulfill its data protection legal obligation, the Data Controller shall keep a register containing the identification of the applicant, the date of the application and the application.

If the Data Controller concerned does not agree with the above decision, or the Data Controller fails to comply with the deadline without due justification or does not respond to the request, the data subject is entitled to apply to a court within 30 days. A data processing lawsuit may also be brought by the data subject before the court having jurisdiction over the place of residence or stay of his or her choice. The court is acting out of turn in the case. The Data Controller is obliged to prove that the data processing complies with the provisions of the law. In addition to compensation for damage caused by unlawful data processing, a claim for damages arising from the violation of personal rights, in particular the right to self-determination of data protection, may also be enforced in the lawsuit. If the Data Controller has used a data processor to perform certain data management operations, the Data Controller shall also be liable to the data subject for the damage caused by the data processor, in addition to the data processor, as the case may be. The data controller shall only be released from liability for the damage and injury caused if it proves that the damage or the violation of the data subject's personal rights was caused by an unavoidable cause outside the scope of data processing. There is no need to pay damages and no claim for damages to the extent that the damage was caused by the victim's intentional or grossly negligent misconduct, in particular in the case of false disclosure.

In case of violation of the right to information self-determination, the data subject is entitled to file a complaint with the National Data Protection and Freedom of Information Authority (address: 1125 Budapest, Szilágyi Erzsébet fasor 22 / c, website: http://www.naih.hu ).

The Data Controller states that the rights of the data subject may be restricted by law to a certain extent, taking into account the fundamental rights of the data subjects, in which case the Data Controller is obliged to comply with the mandatory legal requirements. In these cases, the data controller shall indicate the legal restriction in response to incoming requests and notifications from data subjects.

DATA PROCESSING BASED ON THE LEGAL INTEREST OF THE DATA CONTROLLER

Record requests for data management

It shall keep a register with the controller of the data subject's requests concerning data processing, indicating the date of the request, the content of the request, if possible, the identification of the data subject and the data processing measures taken. The purpose of keeping the register is to ensure the verifiability of compliance with legal and regulatory requirements for data management, to create transparency and the highest possible level of data protection security, which is an outstanding interest of the data controller and, indirectly, also of the data subjects. Only the administration of the Data Controller and a specially authorized employee have the right to access the register, in addition, it may be used during the official control for the purpose of data protection control, and the register shall be kept until the Data Controller terminates without a legal successor. Restrictions on access to the register and targeted data management ensure that the rights and freedoms of data subjects are not violated.

CONSENTED DATA MANAGEMENT

Use of the Data Controller's Website

A cookie is a small piece of data that can be created by a website display program on a visitor's computer, mobile phone or other device that provides Internet access to the website operated by the Data Controller, thus enabling the display of content tailored to the visitor's needs. The cookie is sent by the web server to the visitor's browser and then returned by the browser to the server. The cookie does not contain executable files, viruses or spyware, nor does it have access to the data stored on the visitor's computer. The Data Controller does not transfer the information and personal data resulting from the use of cookies to third parties, the data to be technically recorded may not be combined with other personal data, and the Data Controller will not make a decision based on them.

We also use Google Analytics as a third party cookie to improve our website and improve our user experience for our data management service.

You can delete the cookies used by the Data Controller from your device used for Internet browsing at any time using the affected browser. The process of deleting cookies is determined by the browser used by the person concerned, about which the browser's help menu provides detailed information.

FINAL PROVISIONS

The current management of the Data Controller is entitled to establish and amend these Regulations.

It publishes these Regulations on its website and at its registered office, as well as with its employees.

​