Privacy Policy

1. Introduction

Program PR Consulting Korlátolt Felelősségű Társaság (hereinafter Program PR Consulting Korlátolt Felelősségű Társaság, service provider, data controller, "Company"), as data controller, acknowledges the content of this legal notice as binding upon itself.
The Company undertakes that all data processing related to its activities complies with the requirements set out in this policy and in the applicable legislation.
Program PR Consulting Korlátolt Felelősségű Társaság is the operator of the website evermed.hu.

Program PR Consulting Korlátolt Felelősségű Társaság reserves the right to change this notice at any time. Naturally, it will inform its audience of any changes in good time.

Program PR Consulting Korlátolt Felelősségű Társaság is committed to protecting the personal data of its customers and partners, and considers respect for its customers' right to informational self-determination to be of paramount importance. The Data Controller handles personal data confidentially and takes all security, technical and organizational measures that guarantee the security of the data.

Program PR Consulting Korlátolt Felelősségű Társaság sets out below its data processing principles, presenting the expectations it has formulated for itself as a data controller and which it observes. Its data processing principles are in line with the applicable data protection legislation, in particular the following:

Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information;
Act V of 2013 on the Civil Code;
Act XLVIII of 2008 on the Basic Conditions and Certain Restrictions of Commercial Advertising Activity.
Act CVIII of 2001 (E-Commerce Act) on certain aspects of electronic commerce services and information society services;
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: "GDPR")

2. Definitions

data subject: any specific natural person identified or identifiable – directly or indirectly – on the basis of personal data;
personal data: data that can be linked to the data subject – in particular the data subject's name, identification number, and one or more items of information characteristic of their physical, physiological, mental, economic, cultural or social identity – as well as any conclusion that can be drawn therefrom regarding the data subject;
consent: a voluntary and definite indication of the data subject's wishes, based on appropriate information, by which they give their unambiguous consent to the processing of their personal data – whether in full or in relation to certain operations;
data controller: the natural or legal person, or organization without legal personality, who or which, alone or jointly with others, determines the purpose of processing the data, makes and implements decisions regarding data processing (including the means used), or has such decisions implemented by the data processor;
data processing: any operation or set of operations performed on data, regardless of the procedure applied, in particular its collection, recording, organization, storage, alteration, use, retrieval, transmission, disclosure, coordination or combination, blocking, deletion and destruction, as well as preventing further use of the data, taking photographs, sound or video recordings, and recording physical characteristics suitable for identifying a person (e.g. fingerprint or palm print, DNA sample, iris image);
data transfer: making data accessible to a specified third party;
disclosure: making data accessible to anyone;
data erasure: rendering data unrecognizable in such a way that it can no longer be restored;
data processing (technical operation): performing technical tasks connected with data processing operations, regardless of the method and means used to carry out the operations and the place of application, provided that the technical task is performed on the data;
processor: the natural or legal person, or organization without legal personality, who or which processes data under a contract – including a contract concluded pursuant to a legal provision.

3. Company data

Our company's details and contacts are as follows:

Name: Program PR Consulting Korlátolt Felelősségű Társaság
Mailing address: 8000 Székesfehérvár, Kriványi utca 1, 2
Company registration number: 07 09 034164
Tax number: 32135981-1-07
Phone number: +36 70 302 92 23
E-mail: hello@evermed.hu
Representative of the Data Controller: Tamás Molnár, Managing Director

4. Scope of personal data, purpose, legal basis and duration of data processing

We draw the attention of those providing data to Program PR Consulting Korlátolt Felelősségű Társaság to the fact that if they provide personal data that is not their own, it is the data provider's responsibility to obtain the data subject's consent. The data controller is not obliged to verify that such consent exists. The data controller draws the partner's attention to the fact that if they fail to meet this obligation, and as a result the data subject asserts a claim against the data controller, the data controller may pass on the asserted claim, and the amount of related damages, to the partner.

We provide the following information regarding our individual data processing activities.

4.1. Requesting a quote, inquiries via direct contact

Interested parties have the opportunity to contact our Company directly by e-mail sent to the Company's address, or by telephone.

Purpose of processing: to maintain contact and to promote and support the closest and most efficient possible cooperation between the data subject and our Company.
Legal basis of processing: legitimate interest – GDPR Article 6(1)(f)
Scope of personal data processed: name of the party requesting the quote/contact person; e-mail address, phone number, and any other information provided by the data subject,
Duration of processing: 3 years following the expiry of the validity of the offer, or until the data subject objects
Recipients of personal data: The data controller does not transfer the data obtained to any third party, except for the processor(s) named in point 7. The recorded data may only be accessed by the Data Controller's employees and the designated colleagues of the processor(s).
Description of the legitimate interest: our Company's legitimate interest in processing the data subject's data is direct marketing
Scope of data subjects affected: partners and data subjects who directly inquire (e.g. by e-mail or phone) about the Company's services.

4.2. Requesting a quote, inquiries via the website (evermed.hu)

Our company provides the opportunity for data subjects to request a quote electronically.

Purpose of processing: to maintain contact and to promote and support the closest and most efficient possible cooperation between the data subject and our Company.
Legal basis of processing: the data subject's voluntary consent – GDPR Article 6(1)(a).
Scope of personal data processed: name of the person inquiring (first name, last name); e-mail address, phone number, company name, and any other information provided by the data subject.
Duration of processing: 3 years following the expiry of the validity of the offer, or until the consent is withdrawn.
Recipients of personal data: The data controller does not transfer the data obtained to any third party, except for the processor(s) named in point 7. The recorded data may only be accessed by the Data Controller's employees and the designated colleagues of the processor(s).
Scope of data subjects affected: partners and data subjects who inquire about the Company's services and products through the website.

4.3. Data processing related to quote follow-up

Purpose of processing: the data controller's legitimate interest in keeping records of the data subject's data beyond the validity period of the offer, for direct marketing purposes
Legal basis of processing: the data controller's legitimate interest, GDPR Article 6(1)(f),
Scope of personal data processed: contact person's last name and first name; phone number; e-mail address
Recipients of personal data: The data controller does not transfer the data obtained to any third party, except for the processor(s) named in point 7. The recorded data may only be accessed by the Data Controller's employees and the designated colleagues of the processor(s).
Duration of processing: until the data subject objects
Description of the legitimate interest: establishing business relationships with partners and those requesting quotes, providing accurate information to data subjects. Our Company's legitimate interest in processing the data subject's data is direct marketing
Scope of data subjects affected: recipients of quotes previously issued by the Company, and/or the contact person(s) named therein.

4.4. Newsletter registration

Purpose of processing: sending e-mail newsletters, which may also contain commercial advertising, to interested parties, and informing them of current information
Legal basis of processing: the data subject's prior, voluntary consent, GDPR Article 6(1)(a),
Scope of personal data processed: name, e-mail address
Duration of processing: until the voluntary consent is withdrawn, or until unsubscribing from the newsletter. Our Company processes the data provided by the data subject until the consent is withdrawn. Based on the withdrawal of consent, the processed data will be deleted from our newsletter database within 7 days at the latest, after which we will no longer send you a newsletter.
Recipients of personal data: The data controller does not transfer the data obtained to any third party, except for the processor(s) named in point 7. The recorded data may only be accessed by the Data Controller's employees and the designated colleagues of the processor(s). You may unsubscribe from the newsletter at any time by sending a letter to our Company at hello@evermed.hu, or by clicking the unsubscribe icon in the newsletter.
Scope of data subjects affected: partners and data subjects who subscribe to the Company's electronic newsletter.

4.5. Newsletter data (for newsletter subscriptions registered before 25.05.2018)

Purpose of processing: sending e-mail newsletters, which may also contain commercial advertising, to interested parties, and informing them of current information
Legal basis of processing: the data controller's legitimate interest, GDPR Article 6(1)(f),
Scope of personal data processed: name, e-mail address
Duration of processing: until the data subject objects
Description of the legitimate interest: providing information containing commercial advertising and business offers to data subjects subscribed to the newsletter. Our Company's legitimate interest in processing the data subject's data is direct marketing.
Recipients of personal data: the data controller does not transfer the data obtained to any third party, except for the processor(s) named in point 7. The recorded data may only be accessed by the Data Controller's employees and the designated colleagues of the processor(s). You may unsubscribe from the newsletter at any time by sending a letter to our Company at hello@evermed.hu, or by clicking the unsubscribe icon in the newsletter.
Scope of data subjects affected: partners and data subjects who subscribed to the Company's electronic newsletter before 25.05.2018.

4.6. Camera system

Cameras operate on the premises operated by the data controller for the personal and property security of data subjects, and for other purposes. Notice boards inform data subjects of their operation. Activities related to the operation of the camera system affecting the data subject are set out in the premises' "Security Camera Data Processing Notice", available at the premises.

4.7. Data processing related to ensuring the operation of information technology services

Purpose of processing: Program PR Consulting Korlátolt Felelősségű Társaság may use so-called "cookies" (temporary markers) on its websites, which enable faster access to them. By "cookies" we mean information data that is only active during a given customer session and that is transferred from the website to the Customer's computer for faster identification purposes. The Customer may always request that cookies be disabled by changing their browser settings; however, this may slow down or prevent access to certain parts of the site, or the use of certain functions.
The session cookies used avoid the need to resort to other IT tools which could potentially harm the confidentiality of customers' navigation and which would allow the acquisition of identifying personal data.
The user is able to delete the cookie from their own computer, and may disable the use of cookies in their browser. Cookies can generally be managed under Tools/Settings menu, under Privacy settings, under the name cookie or süti.
Legal basis of processing: The voluntary consent of the data subject (User), GDPR Article 6(1)(a).
The User gives their voluntary consent to the data processing by accepting the pop-up notice and declaration that appears when they begin browsing the website, or by continuing to browse.
Scope of personal data processed: the information technology data processing concerns the scope of data necessary for the operation of the "cookies" used to operate the website and for the use of the log files applied by the web hosting provider.
Duration of processing: until the end of the session
Recipients of personal data: The data controller does not transfer the data obtained to any third party, except for the processor(s) named in point 7. The recorded data may only be accessed by the Data Controller's employees and the designated colleagues of the processor(s).
Scope of data subjects affected: Every User visiting the website, regardless of whether they use the services available on the website.

5. Other data processing

We will provide information on any data processing not listed in this notice at the time the data is collected. We inform our customers that certain authorities, bodies performing public duties, and courts may contact our company for the purpose of disclosing personal data. Our company only discloses personal data to these bodies – provided that the requesting body has specified the exact purpose and scope of the data – to the extent and in the measure absolutely necessary to achieve the purpose of the request, and provided that fulfilling the request is prescribed by law.

6. Transfer of personal data to a third country or international organization

Our Company does not transfer your above personal data to any third country or international organization.

7. Information on the use of a data processor

In the course of data processing, for the performance of the contract, the data controller transfers the data to the data processor(s) it has contracted with.
Categories of recipients: system administration service provider, accounting and payroll service provider, server hosting, web hosting service provider

8. Children

Our services are not intended for persons under the age of 16, and we ask that persons under the age of 16 do not provide Personal Data to the Data Controller.
If we become aware that we have collected personal data from a child under the age of 16 – with the exception of data processed in accordance with legal requirements – we will take the necessary steps to delete the data as soon as possible.

9. Automated decision-making

Our Company does not apply automated decision-making in its data processing procedures or data collection.

10. Method of storing personal data, security of processing

Our company's IT systems and other data storage locations are located at its registered seat and on servers provided by the data processor. Our company selects and operates the IT tools used for processing personal data in the course of providing its services in such a way that the processed data:

is accessible to those authorized to access it (availability);
its authenticity and authentication are ensured (authenticity of processing);
its unchanged state can be verified (data integrity);
is protected against unauthorized access (confidentiality of data).

We pay particular attention to data security, and we take the technical and organizational measures and establish the procedural rules that are necessary to give effect to the guarantees required under the GDPR. We protect the data with appropriate measures in particular against unauthorized access, alteration, transmission, disclosure, deletion or destruction, as well as against accidental destruction and damage, and against becoming inaccessible as a result of changes in the technology applied.

Both our company's and our partners' IT systems and networks are protected against computer-assisted fraud, computer viruses, computer break-ins and denial-of-service attacks. The operator also ensures security through server-level and application-level protection procedures. Daily security backups of the data are performed. In order to avoid data breaches, our company takes every possible measure, and in the event of such an incident – in accordance with our incident management policy – we act immediately to minimize risks and remedy damage.

11. Rights of data subjects, remedies

The data subject may request information about the processing of their personal data, and may request the rectification of their personal data, or – except in the case of mandatory data processing – its erasure or the withdrawal of consent, and may exercise their right to data portability and to object, in the manner indicated at the time the data was collected, or through the data controller's contact details above.

The rights of the data subject and their remedies are set out and communicated to data subjects below, based on Act CXII of 2011 and EU Regulation 2016/679.

The right to information, or in other words the data subject's "right of access": Pursuant to Act CXII of 2011 and Article 15 of EU Regulation 2016/679, at the data subject's request, the Data Controller provides information

on the data it processes and the categories of personal data,
on the purpose of processing,
on the legal basis of processing,
on the duration of processing,
where applicable, on the duration of data storage, or, if this is not possible, on the criteria used to determine that duration,
where applicable, if the data was not collected from the data subject, all available information regarding its source,
where applicable, on automated decision-making, including profiling, as well as understandable information on the logic involved and the significance of such processing, and
the expected consequences for the data subject,
data on the processor, if a processor was used, i. on the circumstances and effects of the data breach and the measures taken to remedy it, as well as
in the event of transfer of the data subject's personal data, on the legal basis, purpose and recipient of the transfer.

The information is provided free of charge if the person requesting the information has not yet submitted a request for information to the Data Controller regarding the same set of data in the current year. In other cases, a cost reimbursement may be established. Any cost reimbursement already paid must be refunded if the data was processed unlawfully, or if the request for information led to a rectification.

The Data Controller draws the attention of data subjects to the fact that, under Act CXII of 2011, the provision of information must be refused,

if, pursuant to a law, an international treaty, or a binding legal act of the European Union, the Data Controller receives personal data in such a way that the transferring data controller indicates, simultaneously with the transfer, a restriction of the rights of the data subject provided for in the said law, or another restriction of processing.
in the interest of the external and internal security of the state, including national defense, national security, the prevention or prosecution of criminal offenses, and the security of the penal system, as well as for reasons of state or local government economic or financial interest, the significant economic or financial interest of the European Union, and for the purpose of preventing and detecting disciplinary and ethical offenses related to the practice of professions, and breaches of labor law and occupational safety obligations – including, in every case, control and supervision – as well as in the interest of protecting the rights of the data subject or others.

The Data Controller is obliged to notify the National Authority for Data Protection and Freedom of Information of rejected requests for information annually, by 31 January of the year following the year in question.

The right to rectification: The data subject has the right to request that the Data Controller rectify, without undue delay, inaccurate personal data concerning them. Taking into account the purpose of the processing, the data subject has the right to request that incomplete personal data be completed – including, among others, by means of a supplementary statement. At the same time, if the personal data does not correspond to reality, and personal data that does correspond to reality is available to the Data Controller, the Data Controller must rectify the personal data, even without a request from the data subject.

The right to erasure, or in other words the "right to be forgotten": The data subject has the right to request that the Data Controller erase, without undue delay, personal data concerning them, and the Data Controller is obliged to erase the personal data concerning the data subject without undue delay, if this is not precluded by mandatory data processing.

In addition to the above case, the Data Controller is obliged to erase the data pursuant to Act CXII of 2011 and Regulation (EU) 2016/679 of the European Parliament and of the Council, if

the processing of the data is unlawful;
the data is incomplete or incorrect – and this cannot be lawfully remedied – provided that erasure is not excluded by law;
the purpose of processing has ceased, or the statutory deadline for storing the data has expired;
it has been ordered by the court or the Authority.
the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
the data subject objects to the processing and there are no overriding legitimate grounds for the processing;
the personal data must be erased in order to comply with a legal obligation applicable to the Data Controller;
the personal data was collected in connection with the offer of information society services directly to children referred to in Article 8(1) of EU Regulation 2016/679.

In the event that the Data Controller has made the personal data public for any reason, and is obliged to erase it pursuant to the above, it shall take reasonable steps – including technical measures – taking into account available technology and the cost of implementation, to inform other data controllers processing the data that the data subject has requested the erasure of links to the personal data in question, or of copies or replications of such personal data.

The Data Controller draws the attention of data subjects to the limitations on the right to erasure or the "right to be forgotten" arising from the EU Regulation, which are as follows:

exercising the right to freedom of expression and information;
compliance with a legal obligation under Union or Member State law applicable to the data controller requiring processing of the personal data, or performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller;
public interest concerning public health;
archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) of EU Regulation 2016/679, insofar as the right to erasure is likely to render impossible or seriously impair the achievement of that processing; or
the establishment, exercise or defense of legal claims.

The right to restriction of processing, or in other words the right to blocking: The data subject has the right to request that the Data Controller restrict processing.
If, based on the available information, it is to be assumed that erasure would harm the legitimate interests of the data subject, the data must be blocked. Personal data blocked in this way may only be processed for as long as the purpose of processing that precluded the erasure of the personal data persists.

If the data subject disputes the accuracy or correctness of the personal data, but the inaccuracy or incorrectness of the disputed personal data cannot be clearly established, the data is blocked. In this case the restriction applies for the period that allows the Data Controller to verify the accuracy of the personal data.

Under the EU Regulation, data must be blocked if

the processing is unlawful, and the data subject opposes the erasure of the data and instead requests the restriction of their use;
the Data Controller no longer needs the personal data for the purposes of processing, but the data subject requires them for the establishment, exercise or defense of legal claims; or
the data subject has objected to processing; in this case the restriction applies for the period until it is established whether the Data Controller's legitimate grounds override those of the data subject.

Where processing is restricted (blocked), such personal data may, with the exception of storage, only be processed with the data subject's consent, or for the establishment, exercise or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.

The Data Controller hereby draws the particular attention of data subjects to the fact that the data subject's right to rectification, erasure or blocking may be restricted by law in the interest of the external and internal security of the state, including national defense, national security, the prevention or prosecution of criminal offenses, and the security of the penal system, as well as for reasons of state or local government economic or financial interest, the significant economic or financial interest of the European Union, and for the purpose of preventing and detecting disciplinary and ethical offenses related to the practice of professions, and breaches of labor law and occupational safety obligations – including, in every case, control and supervision – as well as in the interest of protecting the rights of the data subject or others.
The Data Controller informs the data subject, without undue delay and at the latest within 30 days of receipt of the request, of the matters set out in their request, and/or rectifies the data, and/or erases and/or restricts (blocks) the data, or takes other steps in accordance with the request, if there is no reason precluding this.

The Data Controller shall notify the data subject in writing of the rectification, erasure, or restriction of processing, as well as everyone to whom the data was previously transferred or disclosed for processing purposes. At the data subject's request, the Data Controller shall inform them of these recipients. Notification may be omitted if it does not harm the data subject's legitimate interest with regard to the purpose of processing, or if providing the information proves impossible or requires disproportionate effort. The Data Controller is also obliged to notify the data subject in writing if the data subject's exercise of their rights cannot be realized for any reason, and is obliged to precisely indicate the factual and legal reason, as well as the remedies available to the data subject: the possibility of turning to the court and to the National Authority for Data Protection and Freedom of Information.

The "right to data portability": The data subject has the right to

receive the personal data concerning them, which they provided to the Data Controller, in a structured, commonly used, machine-readable format, and shall also have the right to
transmit that data to another data controller without hindrance from the data controller to which the personal data was provided, where:
the processing is based on consent; and
the processing is carried out by automated means.

In exercising their right to data portability, the data subject has the right to request – where technically feasible – the direct transmission of the personal data between data controllers.
Given the nature of the data processing carried out by the Data Controller, the conditions for exercising the right to data portability are not met (there is no automated processing), and therefore the data subject cannot exercise this right.

The right to object: The data subject may object to the processing of their personal data – including profiling – if

the processing (transfer) of personal data is necessary solely for the enforcement of the Data Controller's or the recipient's rights or legitimate interests, except in the case of mandatory processing;
the use or transfer of the personal data is for the purpose of direct marketing, public opinion polling or scientific research;
the exercise of the right to object is otherwise permitted by law.

The data subject may also object, pursuant to Article 21(3) of EU Regulation 2016/679, to the processing of their personal data for direct marketing purposes, in which case the personal data may no longer be processed for that purpose.

If personal data is processed for scientific or historical research purposes or for statistical purposes, the data subject has the right to object to the processing of personal data concerning them for reasons relating to their particular situation, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
The Data Controller – while simultaneously suspending processing – shall examine the objection within the shortest possible time from the submission of the request, but no later than within 30 days, and shall inform the requester in writing of the outcome. If the requester's objection is well-founded, the Data Controller shall discontinue processing – including further data collection and transfer – and shall block the data, and shall notify everyone to whom the personal data affected by the objection was previously transferred of the objection and of the measures taken based on it, who are obliged to take action to enforce the right to object.

If the data subject disagrees with the Data Controller's decision, or if the Data Controller fails to meet the referenced deadline, the data subject is entitled – within 30 days of the decision being communicated – to turn to the court.
The data subject has the right to object in connection with automated decision-making.

Judicial enforcement: The data subject may turn to the court if their rights have been violated. The court shall deal with the matter as a priority. The Data Controller is obliged to prove that the data processing complies with the provisions of the law.

In the event of a violation of the right to informational self-determination, a report or complaint may be filed:

National Authority for Data Protection and Freedom of Information
Address: 1125 Budapest, Szilágyi Erzsébet fasor 22/c
Phone: +36 (1) 391-1400, Fax: +36 (1) 391-1410
www: http://www.naih.hu
e-mail: ugyfelszolgalat@naih.hu