Data Controller:
Name: Éva Tamara Kiss, sole proprietor
Tax ID: 56929405-1-41
Registration number: 55637790
Headquarters: 1139 Budapest, 7/b Csongor Street.
E-mail: eva@evatamarakiss.hu
Data Processed and the Purpose of Data Processing: The Data Controller undertakes to ensure that all data processing related to its activities complies with the requirements set forth in this notice, applicable Hungarian laws, and European Union legislation. The Data Controller treats personal data as confidential and takes all necessary security, technical, and organizational measures to guarantee the security of the data.
Scope of data actually processed:
Client/Prospective Client Name, which serves to identify the data subject and to establish contact necessary for collaborative work, for the purposes of data processing described in the following section.
Client/Prospective client's electronic contact information (email or social media username), It serves to identify the data subject, establish contact, and maintain communication for the purposes of data processing described in the following section.
Client/Prospective Client's Phone Number, which serves to identify the data subject and to establish and maintain contact during our collaboration for the purposes of data processing described in the following section.
Client/Prospective Client's address, for billing purposes.
Purposes of data processing:
Establishing and maintaining contact by reaching out via email, phone, text message, and/or social media.
For the purpose of fulfilling a cooperation agreement, whether oral or written, regarding the use of a service.
To comply with legal obligations related to the provision of the service (bookkeeping, issuing invoices, fulfilling tax obligations).
Legal basis for data processing: In the case of special categories of data recorded and processed during the counseling process or supportive conversation, pursuant to Article 9(2)(a) of the GDPR, the data subject’s explicit consent is required for the processing of such personal data for the specific purpose of counseling; furthermore, pursuant to Section 4(1)(a) of Act XLVII of 1997 (Eüaktv.) for the purpose of promoting the preservation, improvement, and maintenance of health pursuant to Section 4(1)(a) of the Act, and for the purpose of monitoring the data subject’s state of health pursuant to Section 4(1)(c) of the Act. Contact with the data subject necessary to organize the counseling process/supportive conversation and to take steps at the data subject’s request prior to the conclusion of the contract, pursuant to Article 6(1)(b) of the GDPR.
Furthermore, the consultant/data controller has an overriding legitimate interest in responding to inquiries from interested parties, ensuring the high quality of its services and verifying compliance with applicable laws, as well as in asserting, enforcing, and protecting its legal claims, pursuant to Article 6(1)(f) of the GDPR.
Legal basis for issuing an invoice in accordance with accounting regulations: Article 6(1)(c) of the GDPR
Legal basis for communication: Article 6(1)(f) of the GDPR.
The data controller’s legitimate interest: ensuring continuity in the relationship with individuals who seek counseling or supportive conversations.
Legal basis for the performance of the contract: for the purpose of processing the data of contractual partners: Article 6(1)(b) of the GDPR
Legal basis for the data subject’s consent: for the purpose of electronic/online registration: Article 6(1)(a) of the GDPR
Duration of data processing: Invoices and the data used as the basis for issuing invoices (name, address) are retained for 8 years in accordance with Section 169(2) of Act C of 2000 on Accounting. Data provided for the purpose of maintaining contact is retained for 1 year following the termination of the relationship.
If the data are not required for accounting purposes, they may be processed following the termination of the legal relationship with the Client/Inquirer for a period not exceeding the statute of limitations under civil law. If personal data are processed until the expiration of the civil law statute of limitations (if the Data Controller asserts a legal claim against the Client/Inquirer, or if the Client/Inquirer asserts a legal claim against the Data Controller). Pursuant to Section 6:22 of Act V of 2013 on the Civil Code, such data may be deleted after 5 years.
The rights of the data subject and the options available for enforcing those rights: The Client/Prospective Client is entitled to the following rights (the conditions of which are defined by applicable laws):
Right of access granted by the client / interested party can request from the data controller:
The client / interested party has the right to receive feedback from the controller as to whether his / her personal data is being processed and, if such processing is in progress, the right to access the personal data and the following information: the purposes of the processing; the categories of his / her personal data; the recipients or categories of recipients to whom the personal data have been or will be disclosed; the planned duration of the storage of the personal data; the right to rectification, erasure or restriction of processing; right to lodge a complaint with a supervisory authority; information on data sources.
The data controller shall provide the information within a maximum of one month from the submission of the request. Upon request, the client/interested party shall provide a copy of the personal data of the data subject concerned with the data processing.
Right to rectification:
The client / interested party may request the correction of inaccurate personal data processed by the data controller and the completion of incomplete data.
Right to erasure (right to be forgotten):
The data subject shall have the right granted by the European legislator to obtain from the controller the erasure of personal data concerning him or her without undue delay:
personal data are no longer required for the purposes for which they were collected or otherwise processed;
the data subject withdraws the consent on which the processing is based and there is no other legal basis for the processing;
the data subject objects to the processing and there is no overriding legitimate reason for the processing;
personal data has been unlawfully processed;
the personal data must be erased for compliance with a legal obligation under union or member state law to which the controller is subject;
the personal data were collected in connection with the offer of information society services. The erasure of data may not be initiated if the processing is necessary: for the purpose of exercising the right to freedom of expression and information;
for the performance of a legal obligation requiring processing under union or member state law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
for archiving, scientific or historical research purposes or statistical purposes in the public interest, in the field of Public Health;
or to assert, exercise or defend legal claims.
Right to restriction of processing:
At the request of the client/interested party, the data controller restricts data management if one of the following conditions is met:
the client / interested party disputes the accuracy of the personal data, in which case the restriction applies for a period that allows the accuracy of the personal data to be verified;
the processing is unlawful and the client / interested party opposes the deletion of the data and instead requests the restriction of their use;
the data controller no longer needs the personal data for the purposes of data management, but the client/interested party requires them for the establishment, exercise or defence of legal claims;
the client / interested party has objected to the processing; in this case, the restriction applies for the period until it is determined whether the legitimate reasons of the data controller prevail over the legitimate reasons of the data subject.
Where processing is restricted, personal data, except for storage, may only be processed with the consent of the data subject or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a member state.
Right to data portability:
The client / interested party has the right to receive the personal data concerning him / her, which he / she has made available to the data controller, in a widely used electronic format and to transmit these data to another data controller.
Right to object:
The client / interested party has the right to object at any time, for reasons related to its own situation, to the processing of its personal data necessary to assert the legitimate interests of the data controller or a possible third party. The controller shall no longer process the personal data in the event of the objection, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
Right to complain:
The client / interested party may lodge a complaint before the National Authority for data protection and freedom of information.
Name: National Authority for Data Protection and freedom of information
Headquarters: 1125 Budapest, Erzsebet Szilagyi 22 / C.
Mailing address: 1530 Budapest, PO Box: 5.
Telephone: 1/3911 400
The client/interested party may exercise his / her rights by contacting the data controller directly via the indicated contact details.
If you have a request or question regarding data management, you can send your request electronically to the e-mail address indicated above. The client/interested person will receive information/reply within 30 days at the address indicated by the client.