Data Processing Policy of Business Publishing Services Kft.
Business Publishing Services Kft. (address: 1075 Budapest, Madách Imre út 13-14, (Madách Trade Center), building “A”, 8th floor, company reg. no.: 01-09-732231 further referred to as: BPS or the Data Processor)
will process your personal data as follows during the publication of
a) HelloBaby! Magazine, Vital Magazine, Hotelier Magazine, and the Budapest Business Journal, Fine Restaurants (further referred to as the Magazines) and the operation of
b) hellobaby.hu, vitalmagazin.hu, www.hotelierinternational.com, bbj.hu, and www.businesspublishing.hu, (further referred to as the Websites)
according to current policy (“Policy”).
BPS is committed to the protection of your personal data and your right to IT self-determination will be given the highest priority and respect. BPS will treat personal data confidentially and will take all necessary measures in terms of security, technology and organization to guarantee data safety.
2. General remarks
2.1 Data of Data Processor
Name of Data Processor: Business Publishing Services Kft.
HQ: 1075 Budapest, Madách Imre út 13-14, (Madách Trade Center), building “A”, 8th floor,
Company reg. no.: 01-09-732231
BPS currently does not employ a data protection officer.
2.2 The policy’s personal and objective effect
The policy’s effect will be valid for readers and subscribers of the Websites and Magazines as well as users of connected services (e.g. newsletters, services in connection with registration and purchase) (further referred to as You or the data subject).
2.3 Concepts, basic principles, related regulations
“data processing”: any operation or the total of operations carried out with personal data or data files in an automated or non-automated way, i.e. collection, registration, grouping, articulation, storage, restructuring or changing, query, insight, use, publication, forwarding, spreading or giving access in any other way, coordination or connection, limitation, cancellation or erasure;
“data processor”: the natural or legal person, public power, agency, or any other power that processes personal data on behalf of the data processor;
“data protection incident”: the violation of safety that results in an accidental or illegal cancellation, loss, change, unlawful publication or illegal access of forwarded, stored or processed personal data;
“third party”: the natural or legal person, public power, agency, or any other power that is not identical with the Data Processor, the Data Processor or the persons who were authorized to process personal data under the close direction of the Data Processor;
“personal data”: any information that refers to an identified or identifiable natural person (“the affected person”); a natural person is identifiable, if he/she is identifiable directly or indirectly especially based on an identifier, e.g. name, number, local definition, online identifier, or a natural person’s body, physiological, genetic, spiritual, economic, cultural or social identity characters by one or several factors.
2.3.2 Basic principles
BPS as Data Processor will be liable for obeying the following:
It will process personal data lawfully, fairly and transparently for affected parties (“lawfulness, fairness and transparency”);
It will collect personal data for a specific and legitimate purpose only and data must not be processed in a manner that is incompatible with the purpose (“purpose limitation”);
The processed personal data must be adequate and relevant for data processing purposes and must be limited to what is necessary (“data minimization”);
It will make sure that personal data is accurate and updated, if necessary and every reasonable step must be taken to ensure that personal data that is inaccurate with regard to the purposes for which it is processed, is erased or rectified without delay. (“accuracy”);
It will store personal data in a form that permits the identification of data subjects for no longer that it is necessary for the purposes for which the personal data is processed. (“storage limitation”);
It will process personal data in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures (“integrity and confidentiality”).
2.3.3 Related regulations
Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
Hungarian law on accounting 2000/100
3. Data processed by BPS and the purpose of data processing
BPS will process personal data for the following purposes:
3.1.1 Subscription and transportation of magazines and publications
Data processing purpose: Subscription and transportation of magazines
Legal basis of data processing: Your consent
Processed personal data: Data that you have provided for the subscription and transportation
Period of data processing: 5 years after the termination of the subscription contract
Data forwarding: Your data may be forwarded to Magyar Posta Zrt. and/or GLS General Logistics Systems Hungary Csomag-Logisztikai Kft. for the transportation of magazines.
3.1.2 Website operation
Data processing purpose: The Data Processor may record visitor data for the performance of the service, the control of its operation or to prevent misuse, when you visit the website.
Legal basis of data processing: Your consent
Processed personal data: date, time, IP address, data in connection with user’s operation system and browser.
Period of data processing: 30 days from website visit.
Data forwarding: Webkontakt Kft. 1162 Budapest, Bekecs u. 27, Lion&Lion Consulting Kft., 1039 Budapest, Boglár utca 1. IX. em. 53.
3.1.3 Newsletter subscription
BPS will send direct marketing messages in newsletters to people who have given their explicit consent to this.
You can give your statement of consent to BPS in several ways, e.g. website subscription, registration processes or personal registration.
Data processing purpose: sending e-mail newsletters including business ads to people who are interested, providing information on recent news and offers.
Legal basis of data processing: Your consent
Processed personal data: data provided by data subject, date and time of subscription, IP address, data of user interactions (e.g. e-mail opened).
Period of data processing: Until consent is withdrawn
Data forwarding: To send e-mail newsletters the MailChimp service operated by The Rocket Science Group, LLC (address: 675 Ponce de Leon Ave NE Suite 5000 Atlanta, GA 30308 USA).
Your data may thus be forwarded to The Rocket Science Group, which is based in the United States of America, outside the European Economic Area. In order to provide the guarantees that are suitable for safeguarding your personal data, our Data Processor is a member of the Privacy Shield program. For further information, please consult the following link:
3.1.4 Data processing in connection with purchase
Data processing purpose: Purchase on BPS websites preparing invoices, payment of orders, registration of purchase and payment, potential repurchase processing, performing accounting duties, contact keeping with clients.
Legal basis of data processing: data processing is necessary to perform contracts, where a party is a data subject.
Type of processed personal data: data provided by data subject, order identification number
Period of data processing: Data is erased within five years from order performance.
Data forwarding: In case of bank card payment, the buyer’s bank card data will be forwarded directly to the following payment service providers: K&H Bank Zrt.
Your personal data may be forwarded for product transportation, delivery and to perform contracts to Magyar Posta Zrt. and/or GLS General Logistics Systems Hungary Csomag-Logisztikai Kft.
3.1.5 Data processing in connection with promotional contests
Data processing purpose: Execution of a promotional contest according to the promotional contest regulation, notifying the winner and transportation of prizes
Legal basis of data processing: Consent of data subject
Type of processed personal data: Data provided by data subject, identification number
Period of data processing: Data will be erased within five years from the end of promotional contest.
Winner’s data may be forwarded to the company that has offered the prize and/or to a courier service company in order to transport the prize according to promotional contest regulation.
3.1.6 Preservation of invoices and related registration
Data processing purpose: To perform BPS’ legal liability of preserving accounting invoices that can directly or indirectly prove accounting
Legal basis of data processing: Data processing is necessary for BPS to perform its legal liabilities.
Type of processed personal data: Invoice copy
Period of data processing: Eight years based on 169. § (2) of the Accounting Law.
Data forwarding: No pieces of data are forwarded.
4. The existence of automated decision-making, including profiling
BPS will not carry out any automated decision-making, including profiling, with your data.
5. Data protection rights and legal remedy options
5.1 Your rights
According to GDPR’s paragraphs 15-20 you are entitled in terms of your personal data processed by BPS
a) to get access to your personal data
b) to request the rectification of your personal data
c) to request the erasure of your personal data
d) to request the limitation of your personal data’s processing
e) to protest against the processing of your personal data
f) to receive your personal data and forward it to another data processor, if the legal preconditions of this are valid for you (right to data portability, see below point 5.1.6);
g) if the data processing of your personal data is based on your consent, you are entitled to withdraw your consent any time.
Your request concerning the above mentioned rights can be sent to the contacts indicated above. BPS will inform you about the steps taken, based on your request, within 30 days of receiving the request, but without undue delay. If BPS does not take any steps, it will inform you about the reasons why no action is taken based on your request within 30 days of receiving the request, but without undue delay. If you don’t agree with BPS’ reply, there are legal remedy options from which you may choose. BPS will inform all addressees about rectifications, erasures or data processing limitations, with whom the personal data has been communicated, unless this proves to be impossible or requires a disproportionally great effort. BPS will inform you about the addressees upon request.
5.1.1 Right of access
You are entitled to receive feedback from BPS, whether the processing of your personal data is being proceeded and if such data processing is going on; you are entitled to get access to your personal rights, as well as getting information on the circumstances of the processing of your data. The requested information can cover the following, among others: purposes of data processing, categories of personal data, addressees or categories of addressees with whom BPS has communicated the personal data or will communicate it, the planned period of data storage and, if the data was not collected directly from you, all available information on the source of data.
You are entitled to request the rectification of your inaccurate personal data or ask for the extension of incomplete personal data and BPS must do this without undue delay.
5.1.3 Right to erasure (“Right to be forgotten”)
You are entitled to have your personal data erased by BPS upon your request without undue delay, where one of the following grounds applies:
a) the personal data is no longer necessary
b) the data subject withdraws the consent on which the processing is based and where there is no other legal ground for the processing
c) the data subject objects to the processing and there are no overriding legitimate grounds for the processing
d) the personal data have been unlawfully processed by BPS
e) when the personal data has to be erased for compliance with a legal obligation
BPS will not erase the data, if data processing is necessary for one of the following reasons: (i) for exercising the right of freedom of expression and information; (ii) for compliance with a legal obligation on personal rights; (iii) for the establishment, exercise or defense of legal claims.
5.1.4 The right of restriction to data processing
You have the right to make BPS restrict data processing on your request, where one of the following applies:
a) the accuracy of the personal data is contested by you, in which case the restriction is valid for a period enabling BPS to verify the accuracy of the personal data;
b) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead
c) BPS no longer needs the personal data for the purposes of processing, but it is required by you for the establishment, exercise or defense of legal claims; or
d) you have objected to processing, in which case the restriction refers to the period, until it is verified whether the legitimate grounds of the Data Processor override those of the data subject.
Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a member state. BPS will inform you before the restriction of processing is lifted.
5.1.5 Right to object
You will have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you that are based on BPS’ due interest. In this case BPS shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing that override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.
5.1.6 Right to data portability
You will have the right to receive the personal data concerning you, which you have provided to BPS, in a structured, commonly used and machine-readable format and have the right to transmit such data to another data processor without hindrance from BPS, to which the personal data has been provided, where:
a) the data processing is based on your consent or necessary to perform a contract, where you are one of the parties or it is necessary to take steps on your request prior to signing the contract and
b) the data processing is carried out by automated means, i.e. the processing of personal data takes place in an IT system and not on paper.
5.1.7 Legal remedy
Should you not agree with BPS’ reply or measurement taken, you can file your complaint to the National Data Protection and Freedom of Information Authority (1125 Budapest, Szilágyi Erzsébet fasor 22/c; phone: +36-1-391-1400; e-mail: email@example.com).
6. Data forwarding, data and contacts of data processors
Data processors used by BPS are listed under point no. 3, the point relevant for the given data processing purpose.
7. Potential changes of the information sheet
BPS may change this information sheet and its attachments. In this case BPS will make the updated version public. BPS will always provide proper information about real changes. Besides regarding the data processed during BPS activities other data protection regulations may also be valid apart from the data processing discussed in current information sheet. You can get more information about these on websites and at the contacts indicated above.
 The above two conditions must be performed together, i.e. you can only use your right to data portability, if you have given your consent to the processing of your data (i.e. consent is the legal basis of data processing) or data processing is based on a contract and it is carried out through IT systems without human intervention.