Privacy Policy

This privacy policy sets out the data protection principles of BlackBelt Technology Zrt. Hereinafter, BlackBelt Technology Zrt. is referred to as the “Data Controller”.

The Data Controller is committed to fully respecting the rights of the website’s visitors (hereinafter: “Data Subjects”) relating to the processing of their data. Accordingly, we process the Data Subjects’ personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation (hereinafter: “GDPR”).

Details and contact information of the Data Controller

• BlackBelt Technology Zrt.

Representative of the Data Controller: Róbert Sövegjártó

Registered office: Ganz utca 16., 1027 Budapest

Office: Ganz utca 16., 1027 Budapest

Telephone: +36 1 611 0462

E-mail address and website: info@BlackBelt.hu, www.BlackBelt.hu

Use of cookies

Cookies are small data files that the visited website places on the user’s computer. The purpose of cookies is to make the use of a given infocommunication or online service simpler and more convenient by enabling the website to recognise the visitor’s browser on the next visit. Cookies can store user settings (for example, the selected language) and other information.

Among other things, cookies collect information about the visitor and their device, remember the visitor’s personal settings and can be used, for example, to operate online shopping carts. In general, they make the website easier to use, provide a better user experience and an efficient source of information, and enable operators to monitor the operation of the website, prevent abuse and provide a smooth, high-quality service.

Our website records and processes the following data about visitors and the device used to view the website:

• the IP address used by the visitor;
• the type of browser;
• the settings of the operating system of the device used for browsing (selected language);
• the date and time of the visit;
• the subpage, function or service visited.

Accepting or allowing cookies is not mandatory. Browser settings can be changed to reject all cookies or to display a warning when the system sends a cookie. Although most browsers accept cookies automatically by default, these settings can usually be changed so that the browser rejects automatic acceptance and offers a choice each time.

Information on the cookie settings of the most popular browsers is available at the following links:

• Google Chrome | https://support.google.com/accounts/answer/61416?hl=en
• Firefox | https://support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox
• Microsoft Internet Explorer 11 | https://support.microsoft.com/en-us/help/17442/windows-internet-explorer-delete-manage-cookies
• Microsoft Edge | https://support.microsoft.com/en-us/help/4468242/microsoft-edge-browsing-data-and-privacy
• Safari | https://support.apple.com/en-us/HT201265

Please note that certain website functions or services may not work properly without cookies.

Cookies used on the Data Controller’s website

Technical cookies (session cookies)

These cookies are necessary for visitors to browse the website without restriction and to use its functions and services smoothly; in particular, for the website to remember the visitor’s activities during the visit. The duration of the data processing related to such cookies is limited to the visitor’s given visit. This type of cookie is automatically deleted from the computer when the session or the browser is closed.

Legal basis of data processing: the Service Provider’s legitimate interest in the proper operation of the website.

Purpose of data processing: ensuring the proper operation of the website.

Session cookies used:

Opt-out option: https://tools.google.com/dlpage/gaoptout?hl=en

Cookies requiring consent

These allow the Data Controller to remember the user’s settings relating to the website. The visitor may refuse this data processing at any time before or during the use of the service. These data are not linked to the identification data of the user of the service and are not made available to third parties without the consent of the data subject.

The purpose of the data collection is to prepare analyses and statistics on how users use the website (for example, which source they came from, which web pages they visited, how much time they spent on the site, and which device and browser they used), and to understand the purposes of the website’s visitors. The legal basis of the data processing is the voluntary consent of the Data Subject.

Cookies used:

Opt-out option: https://tools.google.com/dlpage/gaoptout?hl=en

Contact

The Data Subject may send a message to BlackBelt at the e-mail address info@BlackBelt.hu.

Sending an e-mail requires a name and an e-mail address. We process these data for the purpose of contact and – if the Data Subject expressly consents to it – for the purpose of subscribing to the newsletter.

BlackBelt processes the contact data until the purpose of the data processing is fulfilled, that is, until the subject of the message (the sender’s question requiring a reply) can be considered closed, but for no longer than one year from sending the message.

In the case of a newsletter subscription, the Data Controller processes the data until unsubscription.

Data security

The Data Controller takes the necessary technical and organisational measures and establishes appropriate procedural rules in order to ensure the security of personal data throughout their processing.

The Data Controller selects and operates the IT tools used for data processing in such a way that

• the data are accessible only to authorised persons (availability);
• the authenticity and authentication of the processed data are ensured (authenticity of data processing);
• the integrity of the processed data can be verified (data integrity);
• the processed data are protected against unauthorised access (data confidentiality).

The Data Controller

• protects the data with appropriate measures against accidental or unlawful destruction, loss, alteration, damage, unauthorised disclosure and access;
• restricts access to personal data by defining authorisation levels;
• protects its IT systems with a firewall and ensures virus protection;
• ensures that, during electronic data processing, the data are accessible only for specified purposes, under controlled conditions and only to those who need them to perform their tasks;
• in order to protect the data sets processed in electronic records, applies appropriate technical solutions to ensure that the stored data cannot be directly linked to the Data Subject, unless permitted by law.

Taking into account the state of the art, the Data Controller applies appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

The Data Controller documents all personal data breaches, including the facts relating to them, their effects and the measures taken.

In the event of a personal data breach, the Data Controller notifies the Hungarian National Authority for Data Protection and Freedom of Information (hereinafter: the Authority) without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.

Rights of the Data Subject and their enforcement

The Data Subject may request information on the processing of their personal data and may request their rectification or erasure – except where the data processing is required by law – in accordance with the procedure described at the time of data collection or through customer service.

Right to information

Upon request, the Data Controller informs the Data Subject of the data processed by it or by a Data Processor acting on its behalf, their source, the purpose, legal basis and duration of the data processing, the name, address and activities of the Data Processor involved in the data processing and, in the case of data transfer, its legal basis and recipients.

The Data Controller provides the information in writing, in an easily understandable form, as soon as possible but no later than 25 days after the submission of the request. The information is free of charge, unless the requester has already submitted a request concerning the same data to the Data Controller in the same calendar year. In other cases, reimbursement of costs may be charged.

The Data Controller may refuse to provide information to the Data Subject only in cases specified by law. It informs the Data Subject of the refusal in writing, indicating the provision of the Act on Freedom of Information on which the refusal is based. In the notice of refusal, it also informs the Data Subject of the available legal remedies and the possibility of turning to the Authority.

Right to rectification

If the personal data are inaccurate and the correct data are available to the Data Controller, the Data Controller rectifies them.

Right to erasure

Personal data must be erased if their processing is unlawful; if the Data Subject requests it (except in cases of mandatory data processing); if the data are incomplete or inaccurate and this cannot be lawfully remedied, provided that erasure is not excluded by law; if the purpose of the processing has ceased or the statutory retention period has expired; or if ordered by a court or the Authority.

Right to restriction of processing

Instead of erasure, the Data Controller may restrict the processing of personal data if the Data Subject requests it, or if, based on the available information, erasure would harm the Data Subject’s legitimate interests. Restricted personal data may be processed only as long as the purpose for which erasure was not carried out continues to exist.

The Data Controller marks the personal data if the Data Subject disputes their correctness or accuracy, but their incorrectness or inaccuracy cannot be established beyond doubt.

Obligation to notify of rectification, erasure or restriction of processing

The Data Controller notifies the Data Subject of the rectification, restriction or erasure of the data. Notification may be omitted if, in view of the purpose of the processing, it does not harm the legitimate interests of the Data Subject.

If the Data Controller does not fulfil the Data Subject’s request for rectification, restriction or erasure, it informs the Data Subject of the factual and legal reasons for the refusal within 30 days of receiving the request. If the request is refused, the Data Controller informs the Data Subject of the available legal remedies and the possibility of turning to the Authority.

Right to object

The Data Subject has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them that is carried out in the public interest or in the exercise of official authority vested in the Data Controller, or that is based on the legitimate interests of the Data Controller or a third party, including profiling based on those provisions.

In the event of an objection, the Data Controller may no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject, or which relate to the establishment, exercise or defence of legal claims.

The Data Controller examines the request as soon as possible, but no later than 15 days after its submission, decides whether it is justified, and notifies the Data Subject of its decision.

If the objection is justified, the Data Controller terminates the data processing, including further data collection and data transfer, and blocks the data. It also notifies all those to whom it previously transferred the personal data concerned by the objection of the objection and of the measures taken on the basis of it; these recipients are obliged to take the measures necessary to enforce the right to object.

If the Data Subject does not agree with the Data Controller’s decision, or if the Data Controller fails to meet the statutory deadline, the Data Subject may turn to the court within 30 days of the communication of the decision or of the last day of the deadline. The Data Controller may also notify the Data Subject of the joinder of a third party to the proceedings. The Data Controller does not erase the Data Subject’s data if the data processing is required by law.

However, the data may not be transferred to the recipient if the Data Controller agrees with the objection or if the court has established that it is justified.

Right to data portability

The Data Subject has the right to receive the personal data they have provided to the Data Controller in a structured, commonly used and machine-readable format, and to transmit those data to another controller.

Legal remedy

In the event of an infringement of their rights, the Data Subject may initiate court proceedings against the Data Controller in the cases specified by law. The court handles the case as a matter of priority.

If the Data Subject has suffered material or non-material damage as a result of an infringement of the GDPR, they are entitled to receive compensation from the Data Controller or the Data Processor. The Data Controller or the Data Processor is exempt from liability if it proves that the damage was caused by an unavoidable cause outside the scope of data processing.

No compensation is due for the part of the damage resulting from the intentional or grossly negligent conduct of the injured party.

Filing an objection or a complaint does not affect the Data Subject’s other rights under data protection legislation.

Complaints are handled with the involvement of the Data Protection Representative (hereinafter: “DPR”). The Data Subject may file a complaint with:

• BlackBelt Technology Zrt.
• the Authority (1024 Budapest, Szilágyi Erzsébet fasor 22/C); or
• turn to the court.