Effective as of 30 June 2026
Click here to download, print and view the Contract. (link)
ILCSI is committed to protecting and safeguarding your personal data, and issues this Notice to provide information on the processing of your personal data. This Privacy Notice provides a summary of what personal data are processed and used by Ilcsi Beautifying Herbs Organic Skin Care Ltd. (Ilcsi SZÉPÍTŐ FÜVEK Biokozmetikai KFT) and/or ILCSI E-Commerce Ltd. (ILCSI E-kereskedelmi Kft.) as individual controllers (each a Controller, jointly ‘ILCSI’ or ‘Controllers’), and how; and how the Controllers protect such data in relation to your browsing of the website, purchases in the webshop and/or in an Ilcsi Beauty Salon store and the use of other services provided to you.
Furthermore, this Privacy Notice shall also apply to data processing in connection with the official Ilcsi Facebook, Instagram, Youtube social media platforms (www.hu-hu.facebook.com/ilcsibeautifyingherbshungary, www.instagram.com/ilcsi_official/?hl=hu, https://www.youtube.com/user/IlcsiOrganicSkincare).
What are personal data? Personal data means any information or partial information relating to you as a natural person, on the basis of which you can be directly (e.g. based on your name) or indirectly (e.g. through a personal unique identifier) identified. Your personal data include details such as: your first name and surname, home address, email address or phone number.
This Privacy Notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR).
Click here to jump directly to the following topics:
CONTROLLERS’ NAME AND CONTACT DETAILS
DATA PROTECTION ADMINISTRATOR’S NAME AND CONTACT DETAILS
IF YOU ARE UNDER 18 YEARS OLD – INFORMATION FOR THOSE UNDER 18
THE CATEGORIES OF PERSONAL DATA PROCESSED, THE PURPOSE AND DURATION OF, AND THE LEGAL BASIS FOR PROCESSING:
REGISTRATION
PROVISION OF A USER ACCOUNT, LOGIN TO THE USER ACCOUNT
PURCHASING PRODUCTS IN THE WEBSHOP
PLACING ORDERS OR SUBMITTING APPLICATIONS ON THE PROFESSIONAL PLATFORM OF THE WEBSITE
PAYMENT AND INVOICING, ISSUE OF ACCOUNTING DOCUMENT
CUSTOMER SERVICE, QUESTIONS RELATING TO THE PRODUCTS
COMPLAINT HANDLING
NEWSLETTER
DATA PROCESSING IN CONNECTION WITH TRAININGS AND EVENTS
DATA PROCESSING IN CONNECTION WITH CONFERENCES AND EVENTS
REPORTING ON EVENTS
DISPLAY OF ‘ILCSI BEAUTY SALONS’ ON THE WEBSITE
CUSTOMER SATISFACTION SURVEYS
STOCK MONITORING SERVICE
DATA PROCESSING IN RELATION TO OUR SOCIAL MEDIA ACCOUNTS
ENQUIRIES RELATING TO OUR PROCESSING OPERATIONS
FULFILMENT OF THE OBLIGATIONS IN RELATION TO PERSONAL DATA BREACHES
ENFORCEMENT OF LEGAL CLAIMS
BROWSING, COOKIES
CONSULTATION, SERVICE DEVELOPMENT, QUALITY ASSURANCE
CONTRACTUAL CONTACT PERSONS
LINKS TO OTHER WEBSITES
ACCESS TO DATA, DATA SECURITY MEASURES
DATA TRANSFER TO A THIRD COUNTRY
PROFILING
COOKIE NOTICE
YOUR RIGHTS AND HOW TO ENFORCE THEM
19. BROWSING, COOKIES
The controller in respect of the data processing in relation to the information society services provided on the website (including the webshop on the website) is: Ilcsi Beautifying Herbs Organic Skin Care Ltd. and ILCSI E-Commerce Ltd.
When you visit the website (including the webshop on the website), the website places cookies – short data files, strings – on your computer. If you want to avoid the application of cookies on your computer or other device used for browsing (e.g. mobile phone, tablet etc.) you have the opportunity to disable the cookies for example through the relevant settings of your browser. You can find general information about cookies below, and detailed information (what cookies we use, who provides them, for what purposes we use cookies and for how long they are processed) on the cookie management page.
What are cookies?
When you visit the websites (including the webshop on the website) of the controller, the website places cookies – short data files, strings – on your computer. The anonymous user identifier (cookie) is a unique series of signs – suitable for identification and the storage of profile information – that service providers store on your device. It is important to know that such a series of signs is not suitable in itself for identifying you, it can only identify your computer. In the world of internet networks, personal information and customised service can only be rendered if service providers can individually identify their customers’ habits and needs. Service providers use anonymous identification to learn more about their customers’ information usage habits, and so they can further ameliorate the quality of their services, and be able to offer customisation opportunities to the clients. Cookies facilitate the use of websites, assist website visitors in being able to properly use the website during browsing.
1. Google traffic cookies – used by Google for monitoring Google traffic
The websites use the Google Analytics system by Google Ireland Limited (‘Google’) to analyse website traffic. The Google Analytics system stores ‘cookies’ i.e. small text files on your device and uses them for analysing traffic at our website. Users who do not want Google Analytics to prepare a report on their visits can install the Google Analytics Opt-out browser add-on. This browser add-on instructs the scripts of Google Analytics JavaScript (ga.js, analytics.js, and dc.js) not to transfer any traffic information to Google. Furthermore, users installing the Opt-out browser add-on do not participate in content experiments either. To opt-out from web activities of Analytics on our websites, install: tools.google.com/dlpage/gaoptout
2. Session cookies, deleted at the end of the session:
These cookies are essential for navigation on our websites, for the operation of key functions and the availability of protected contents. These cookies e.g. store the products selected by you in the webshop, and do not collect any information about you allowing your identification, which could be used for marketing purposes, or which would remember other websites visited by you. Upon closing the website, these cookies are automatically deleted and the session is closed.
3. Third party visitor behaviour cookie – Hotjar, Optimizely, Cookiebot
These cookies record how users use the website. The information recorded this way can be used to prepare statistics that can be used to further develop the website. For more information about the HotJar online behaviour analytics and feedback service, visit the provider’s website, and you can also opt out of the HotJar service here: https://www.hotjar.com/opt-out. For more information about the Optimizely online analytics service, visit the service provider’s website, and you can also opt out of the Optimizely service here: https://www.optimizely.com/about/. More information about Cookiebot is available here: https://www.cookiebot.com/. Facebook and Google also use third party cookies on our website, processing data for dynamic remarketing purposes.
4. Convenience cookies for statistical purposes
The cookies store the statistical data of your visits, so that we can improve our services.
For what purpose are your personal data processed?
To ensure the proper operation of the website, the proper display of contents, to properly design the user interface, to continuously develop the website to improve user experience, to identify you so that we can offer you content in the right language and to ensure data security. Furthermore, in order to identify the users’ browsing habits, as well as to prepare statistics relating to the website, and to collect anonymised personal data for statistical purposes.
The data subjects: include the visitors of the websites, social media sites of the Controllers.
| Which of your personal data do we process: | On what basis do we process these (legal bases): | For how long do we process these data: |
· the IP address, MAC address of your device · type of operating system and browser · data of error messages · website activity data
| Legitimate interest (Article 6(1)(f) of the GDPR) Regarding the cookies that are necessary for ensuring the proper operation and basic functions of the website for our users, e.g. navigation on the website, using the basket and ordering function in the webshop, the legitimate interest of the Controllers is to be able to operate their website and/or for the cookies to ensure the smooth operation of the webshop running on the website. Data processing also serves the purpose that we can ensure that the webshop running on the website can be visited and orders can be placed therein. Having weighed the affected data subjects’ interests, rights and freedoms to freely dispose of their personal data, we have found that processing the data is necessary for enforcing our interests and the interests of third parties, and it also serves the interests of the data subjects, given that using the website would be impossible without the application of these cookies. There is no other way to carry out these data processing operations and the proper operation of the whole website.
YOU HAVE THE RIGHT TO OBJECT TO OUR DATA PROCESSING OPERATIONS CARRIED OUT FOR A LEGITIMATE INTEREST
Safeguards: The cookies only process a minimum of personal data, and the cookies we use mostly process data in an anonymised way. The complete balancing test is available here.
Cookies processed based on legitimate interest (for detailed information see the cookie management interface): · user-input cookies · authentication cookies · user centric security cookies |
Information in the cookies is stored until the realisation of the purpose (expiry of their validity), in this regard, see the detailed information on the cookie management interface; or we process the data until you disable data processing. |
· the IP address, MAC address of your device For third party cookies (Google Analytics) and/or anonymously: · the number of website visitors · referral site · the website pages visited, clicks within the website
| Your consent. (Under Article 6(1)(a) of the GDPR)
For remarketing cookies, cookies displaying advertisements or monitoring user behaviour, displaying general offers, and for statistical cookies, processing is based on your consent. Your identification based on your IP address to navigate you to the language site.
You have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing performed before the withdrawal of such consent. | Information in the cookies is stored until the realisation of the purpose (expiry of their validity), in this regard, see the detailed information on the cookie management interface; or we process the data until you disable data processing. |
OBJECTION: You shall have the right to object at any time to processing based on our legitimate interests as above; you may do so via the contact information in the ‘Controllers’ name and contact details’ chapter or by notifying it to our data protection administrator.
What happens if you do not provide the data?
The data are not provided by you, instead we collect them about you, and the data are automatically logged by the system. Such information in itself is not suitable for personal identification, we do not merge these data with other personal data; we use the data for analysing trends, making statistics on the use of the site, administering the services, analysing and meeting users’ demands, all of which contribute to the development of the quality of our services and our website. The individual cookies are essential for the operation of the website.
The manner of erasing the data: Cookies are automatically deleted when their validity expires. If you wish to avoid that such identifiers be stored on your computer, you can select the relevant settings in your browser so that it does not permit the placement of unique identifiers or permits only certain of them – in such a case, however, you may not be able to access certain services or not in the form as if you had enabled the placement of identifiers. For the most popular browsers, you can disable the cookies here:
Google Chrome: https://support.google.com/chrome/answer/95647?co=GENIE.Platform%3DDesktop&hl=en-GB
Internet Explorer: https://support.microsoft.com/hu-hu/help/17442/windows-internet-explorer-delete-manage-cookies
Mozilla Firefox: https://support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox
Microsoft Edge: https://support.microsoft.com/hu-hu/help/4027947/windows-delete-cookies
To whom we may transmit your data: Your personal data may be accessed by dedicated employees within the Controllers' organisation. You can find the third party cookie providers on the cookie management interface. In addition, the following persons contribute to making it possible to use, browse and display our website:
| Name | Registered office | Purpose of data transmission or transfer |
| Google Cloud EMEA Limited | 70 Sir John Rogerson’s Quay, Dublin 2, Ireland | For the webshop and website, it provides us with hosting services. |
| BIG FISH Internet-technológiai Kft. | H-1066 Budapest, Nyugati tér 1-2, Hungary | Operates the webshop and website for us. |
| Google Ireland Limited | Gordon House, Barrow Street, Dublin 4, Írország. | Provides web analytics services in relation to the website. |
| Optimizely Inc. | 631 Howard Street, Suite 100 San Francisco, CA 94105, USA | Provides the cookie collecting visitors’ behaviours. |
Usercentrics A/S
| Havnegade 39 1058 Copenhagen, Denmark Phone: + 45 50 333 777 E-mail: mail@usercentrics.com
| Provides the cookie management interface for us. |
| ZeroTime Services Kft. | H-2013 Pomáz, Mikszáth Kálmán u. 36/4., Hungary | Provides hosting services for us for the archive data of the webshop and the website. |
| Color and Code Kft. | H-3300 Eger, Fazola utca 6., Hungary | Provides operational services for the archive data of the webshop and the website. |
| Microsoft Ireland Operations Limited | One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland | providing computer programs, mail system |
20. CONSULTATION, SERVICE DEVELOPMENT, QUALITY ASSURANCE
The controller in respect of the data relating to consultation is: Ilcsi Beautifying Herbs Organic Skin Care Ltd. and ILCSI E-Commerce Ltd.
Please note that the chat consultation is provided not by ILCSI, and ICSI is solely responsible for making available the chat platform. Consultation is provided by the beautician professional providing the answers, who qualifies as an individual controller. We recommend you seek information as to personal data processing by the beautician professional prior to using the service. The personal data collected in the context of the consultation will be processed independently by the Controllers for the following purposes:
For what purpose are your personal data processed?
Processing of data is carried out for the purposes of improving the products and services of the Controllers and quality assurance. In the course of the processing, the Controllers record and analyse the data provided in the context of the consultancy. The data of the conversation are stored and processed by the Controllers in such a way that they are not in themselves personally identifiable and are not linked to other personal data.
Data subjects: include the users initiating the consultation available on the website and/or participating in the same.
| Which of your personal data do we process: | On what basis do we process these (legal bases): | For how long do we process these data: |
· data provided by you in the framework of consultation · offline when sending a request for advice in addition to the above: name and email address · your IP address · if you want to continue the chat on Messenger, your Messenger contact details and username | Your consent. (Article 6(1)(a) of the GDPR) By checking the relevant checkbox, you expressly consent to the Controllers processing your personal data specified in this Section for the purposes of improving our products and services and for quality assurance. You have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing performed before the withdrawal of such consent.
Based on your explicit consent, (Article 9(2)(a) of the GDPR)
we process your data falling into special categories of personal data in case you provide such data and if such data are necessary for the consultation. Please note that we do not ask you to provide any special category of personal data.
By checking the relevant checkbox, you expressly consent to the Controllers processing your personal data specified in this Section for the purposes of improving our products and services and for quality assurance. You have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing performed before the withdrawal of such consent. |
We will process your personal data until the withdrawal of your consent – but for no longer than 1 year.
|
What happens if you do not provide the data?
Providing the above personal data shall be voluntary; if you do not provide such data to us, you will not be able to participate in the consultation service and we cannot analyse your data. Your name and email address will only be requested for contact purposes by the beautician professional providing the advice when there is no live chat on the website (chat indicates offline status). This way you can send your question to the beauty professional and he/she will answer it later by email. You only need to enter your Messenger details if you want to switch from the chat forum to Messenger and continue the conversation there.
Manner of erasing the data: We will erase your above personal data upon expiry of the above deadline.
To whom we may transmit your data: Within the organisation of the Controllers, your data may be accessed by the authorised dedicated employees; your personal data may be transferred to the following processors, other recipients for the purposes specified below:
| Name | Registered office | Purpose of data transmission or transfer |
| Google Cloud EMEA Limited | 70 Sir John Rogerson’s Quay, Dublin 2, Ireland | Provides web hosting services for us for the webshop and the website. |
| BIG FISH Internet-technológiai Kft. | H-1066 Budapest, Nyugati tér 1-2, Hungary | Operates the webshop and the website for us. |
| beautician professional providing the consultation |
| provides the consultation |
| Jivosite, Inc. | 1811 Silverside Road, Wilmington, Delaware, 19810 (képviselője: Security Trend Ltd, UK, email: info@security-trend.co.uk) | service provider of chat program |
| ZeroTime Services Kft. | H-2013 Pomáz, Mikszáth Kálmán u. 36/4., Hungary | Provides hosting services for us for the archive data of the webshop and the website. |
| Color and Code Kft. | H-3300 Eger, Fazola utca 6., Hungary | Provides operational services for the archive data of the webshop and the website. |
Aut O’Mattic Ltd.
| Business Centre, No.1 Lower Mayor Street, International Financial Services Centre, Dublin 1, Ireland | Provides us with webshop programming services for the archive data of the webshop and the website. |
Automattic Inc.
| 60 29th Street #343, San Francisco, CA 94110, USA | Provides us with webshop programming services for the archive data of the webshop and the website. |
21. CONTRACTUAL CONTACT PERSONS
The controller is the contracting company: Ilcsi Beautifying Herbs Organic Skin Care Ltd. or ILCSI E-Commerce Ltd.
For what purpose are your personal data processed?
Processing of data is carried out in connection with the conclusion of a contract with us. During processing, the data of the natural persons included in the contract will be processed with the objectives of concluding and performing the contract, administration relating to the performance of the contract and for communication purposes.
Data subjects: Natural persons included in the contract.
| Which of your personal data do we process: | On what basis do we process these (legal bases): | For how long do we process these data: |
For company/organization contact persons or contractual partners who are private individuals: · first name and surname of contractual partner · address of contractual partner · contact details of contractual partner (e.g. email, telephone) · in certain cases, signature of contractual partner · name of company contact person · contact details of company contact person (e.g. email, telephone) · position of company contact person
For company/organization representatives: Data included in public registers: · first name and surname · place of birth · home address · e-mail (company or as indicated in a public register) · mother’s name · tax identification number · manner of representation, effective date, duration and expiry of title Contact data: · (workplace) phone number, e-mail Other: · in certain cases, signature
For contractual partners who are sole traders: Data included in public registers: · name · registration number · tax number · statistical code · date of registration · registered office (establishment) · activities · status (e.g. suspension and the starting date thereof) · sole trader ID data Contact data: · (workplace) phone number, e-mail Other: · in certain cases, signature
Source of data: Where we obtained such data from a source other than you, then the source of the data is our contractual partner who is your employer or partner under other legal relationship. If you act (with right of sole or joint representation) on behalf of our contractual partner, or you are our contractual partner in your capacity as a sole trader, and the above data have been obtained by us from a source other than you or the contracting company, then the data are from a publicly available source, namely from the company or other public register. | For data processing related to the conclusion or performance of the contract:
Processing of the data of company/organization contact persons/representatives: Legitimate interest Under Article 6(1)(f) of the GDPR The processing is necessary based on the legitimate interest of our contractual partner (who is your employer or contracted partner, or the company/organization you represent) and on our legitimate interest for concluding, performing the contract and communicating in relation to the contract and for contacting each other fast and interactive.
Considering your interests, rights and freedoms to freely dispose of your personal data, we have found that the enforcement of the legitimate interest of our contractual partner and our legitimate interest regarding the conclusion and faultless performance of the contract as well as the relating contact and communication overrides your right to dispose of your personal data. We have also found that the restriction is necessary and proportionate to the fulfilment of your job as an employee or your contractual obligations as a contracted partner, as applicable. We have chosen the measure entailing the least possible restriction, also considering cost-effectiveness. There is no other way for us to carry out these data processing operations.
Safeguards: The Controllers will process your data confidentially; only dedicated persons within their organisation may access the data. Objection: You may object to data processing any time where such processing takes place on grounds of legitimate interests.
If the contracting party is a private individual or sole trader:
Performance of the contract (Under Article 6(1)(b) of the GDPR) Contract refers to a contract entered into by you with us for our services or by us for your services.
| Processing starts when the first personal data are supplied to us during the negotiations prior to contract conclusion with a view to the successful conduct of contract negotiations. We will retain the data for 5 years following the date of contract termination (the end of the statute of limitations period under civil law) with a view to contract performance; upon expiry of such deadline, we review our data processing and the data will be erased if there is no other valid legal basis for the processing (e.g. in the case of accounting or tax obligations, we retain the data together with the relevant documents for the period specified by law for the purpose of complying with these obligations, see. Chapter PAYMENT AND INVOICING, ISSUE OF ACCOUNTING DOCUMENT).
If you have objected to the processing of personal data processed based on legitimate interest, data are processed until the assessment of such objection, except if there is a valid legal basis for further data processing.
|
OBJECTION: You shall have the right to object at any time to processing based on our legitimate interests as above; you may do so via the contact information in the ‘Controllers’ name and contact details’ chapter or by notifying it to our data protection administrator.
What happens if you do not provide the data? Please note that if you are our contracted partner in your capacity as a natural person or sole trader, the conclusion of the contract is conditional upon you providing the personal data, in the case of a sole trader, the data are also included in a public database. If our contractual partner is a company or organization represented by you, it shall be mandatory for contracting parties to provide their data regarding representation, as it is not possible to conclude the relevant contract in lack of such data; however, these data are also available from public databases. Under the relevant contract the contracting parties are also required to provide their respective contact persons’ data in order to facilitate contractual performance, keeping contact, assigning the tasks related to the contract; in lack of such data, performance of the contract may even become impossible. Providing the above personal data is not required by law.
Manner of erasing the data: We will erase your above personal data upon expiry of the above deadline if there is no other valid legal basis for further data processing.
To whom we may transmit your data: Within the organisation of the Controllers your data may be accessed by the authorised dedicated employees; your personal data may be transferred to the following processors, other recipients for the purposes specified below:
| Name | Registered office | Purpose of data transmission or transfer |
| Microsoft Ireland Operations Limited | One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. | providing computer programs |
| IT system administrator | data security, computer system monitoring and error correction | |
| Google Cloud EMEA Limited | 70 Sir John Rogerson’s Quay, Dublin 2, Ireland | For the webshop and website, it provides us with hosting services. |
| BIG FISH Internet-technológiai Kft. | H-1066 Budapest, Nyugati tér 1-2, Hungary | Operates the webshop and website for us. |
| lawyer, law firm | reviewing and writing contracts and related materials | |
| ILCSI E-Commerce Ltd. or Ilcsi Beautifying Herbs Organic Skin Care Ltd. | H-1021 Budapest, Üdülő út 37, Hungary
| transfer of data for administrative purposes within the group of undertakings
|
Ilona Polyákné Gömöri sole trader
| H-2011 Budakalász, Nárcisz u. 7, Hungary | accounting services where necessary to fulfil accounting obligations |
| ZeroTime Services Kft. | H-2013 Pomáz, Mikszáth Kálmán u. 36/4., Hungary | Provides hosting services for us for the archive data of the webshop and the website. |
LINKS TO OTHER WEBSITES
Please note that for your convenience and to provide you more comprehensive information we may include links and/or menus to other websites. These websites and blogs operate independently of us, they have their own privacy policies for data processing, and we have no influence on these. You are recommended to also read the privacy notices of any such website you visit.
ACCESS TO DATA, DATA SECURITY MEASURES
The Controllers will do everything in their power to take care of the security of your personal data in compliance with Article 32 of the GDPR. In addition to that, the Controllers will take the technical and organisational measures and have in place the procedural rules as necessary to comply with the GDPR and other relevant data protection and confidentiality regulations.
The Controllers guarantee the appropriate level of data security in the following manner: your data are stored in a secure technical environment, they are accessible only by authorised persons (our staff members after appropriate identification), we use encryption for your electronically stored data, the natural persons with access to the personal data may process the personal data only in line with the Controllers’ instructions; we ensure that data integrity can be certified, we protect your data from unauthorised access and, with a view to that, we apply security measures, for data transfers we use encryption with an appropriate technical solution, and we test, evaluate and correct our security measures. Personal data breach: If a breach takes place concerning your data, after becoming aware thereof, we will do everything in our power to mitigate the risks. If such an event takes place concerning your data which, in spite of the protection measures taken by the Controllers (or their processor), is likely to result in a high risk to your rights and freedoms, we will notify you and the competent supervisory authority thereof without delay (including any steps you can take).
DATA TRANSFER TO A THIRD COUNTRY
Personal data may only be transferred to a third country if the third country in question ensures an adequate level of protection. Such a transfer shall not require any specific authorisation.
Currently, the data are transferred to the following controllers and processors to the following third countries outside the EU, for the following purposes:
| Processor’s name, registered office, country | Adequacy decision – under Article 45(1) of the GDPR | Purpose of data transmission, transfer and processing |
| The Rocket Science Group LLC (registered office: Georgia, 675 Ponce De Leon Ave NE, Suit 5000, Atlanta, Georgia 30308, USA), | Commission Implementing Decision (EU) 2016/1250 (USA - EU Privacy Shield List) | In connection with sending newsletters and direct marketing messages. |
Automattic Inc. 60 29th Street #343 San Francisco, CA 94110 USA | Commission Implementing Decision (EU) 2016/1250 (USA - EU Privacy Shield List) | Provides us with webshop programming services for the archive data of the webshop and the website. |
Optimizely Inc. 631 Howard Street, Suite 100 San Francisco, CA 94105 USA | Commission Implementing Decision (EU) 2016/1250 (USA - EU Privacy Shield List) | Provides the cookie collecting visitors’ behaviours. |
| Jivosite, Inc. 1811 Silverside Road, Wilmington, Delaware, 19810 (representative: Security Trend Ltd, United Kingdom and Wales, email info@security-trend.co.uk) | Commission Implementing Decision (EU) 2016/1250 (USA - EU Privacy Shield List) | service provider of chat program |
PROFILING
Please note that our data processing operations include profiling as defined in this section.
Google as an independent service provide may perform profiling as follows, which may also have an impact on our website, given that we use the Google Analytics service on the website.
Google’s notice on the service: “For example, when you visit a website that uses advertising services like AdSense, including analytics tools like Google Analytics, or embeds video content from YouTube, your web browser automatically sends certain information to Google. This includes the URL of the page you’re visiting and your IP address. We may also set cookies on your browser or read cookies that are already there. Apps that use Google advertising services also share information with Google, such as the name of the app and a unique identifier for advertising. Google uses the information shared by sites and apps to deliver our services, maintain and improve them, develop new services, measure the effectiveness of advertising, protect against fraud and abuse, and personalize content and ads you see on Google and on our partners’ sites and apps. (…) Sometimes, when processing information shared with us by sites and apps, those sites and apps will ask for your consent before allowing Google to process your information. For example, a banner may appear on a site asking for consent for Google to process the information that site collects. When that happens, we will respect the purposes described in the consent you give to the site or app, rather than the legal grounds described in the Google Privacy Policy. If you want to change or withdraw your consent, you should visit the site or app in question to do so. (…) How you can control the information collected by Google on these sites and apps: Here are some of the ways you can control the information that is shared by your device when you visit or interact with sites and apps that use Google services:
· Ad Settings helps you control ads you see on Google services (such as Google Search or YouTube), or on non-Google websites and apps that use Google ad services. You can also learn how ads are personalized, opt out of ad personalization, and block specific advertisers.
· If you are signed in to your Google Account, and depending on your Account settings, My Activity allows you to review and control data that’s created when you use Google services, including the information we collect from the sites and apps you have visited. You can browse by date and by topic and delete part or all of your activity.
· Many websites and apps use Google Analytics to understand how visitors engage with their sites or apps. If you don’t want Analytics to be used in your browser, you can install the Google Analytics browser add-on. Learn more about Google Analytics and privacy.
· Incognito mode in Chrome allows you to browse the web without recording webpages and files in your browser or Account history (unless you choose to sign in). Cookies are deleted after you've closed all of your incognito windows and tabs, and your bookmarks and settings are stored until you delete them. Learn more about cookies.
· Many browsers, including Chrome, allow you to block third-party cookies. You can also clear any existing cookies from within your browser. Learn more about managing cookies in Chrome.
For further information about Google’s privacy principles, click here: https://policies.google.com/privacy?hl=en. You can also unsubscribe from Google Analytics tracking in the future by downloading the Google Analytics Opt-out Browser Addon application and installing it to your current browser: tools.google.com/dlpage/gaoptout.
YOUR RIGHTS AND HOW TO ENFORCE THEM
You shall have the following rights in connection with your personal data processed by us:
1. Right of access
2. Right to rectification
3. Right to erasure
4. Right to restriction of processing
5. Right to data portability
6. Right to object
7. Right to withdraw consent
8. Exercise rights after death
1. RIGHT OF ACCESS |
You shall have the right to obtain confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, about the following: what personal data are processed (in what categories), for what purpose, for how long, and the recipients of such data. Furthermore, you can to request information as to what rights you have in connection with processing i.e. that you may request the erasure, restriction of processing of personal data, the rectification of data, and may object to processing. Furthermore, you shall have the right to file a complaint with the supervisory authority (Hungarian National Authority for Data Protection and Freedom of Information, Nemzeti Adatvédelmi és Információszabadság Hatóság, registered office: H-1055 Budapest, Falk Miksa utca 9-11., website: www.naih.hu, phone number: +36 (1) 391-1400, email: ugyfelszolgalat@naih.hu). Where the personal data have not been collected from you, you may request information as to their source.
2. RIGHT TO RECTIFICATION |
You may request that your personal data be rectified, corrected or made accurate, if they have changed or have been wrongly recorded. If your data have been recorded incompletely, you may also request their completion by means of a supplementary statement.
3. RIGHT TO ERASURE |
You shall have the right to obtain the erasure of personal data concerning you where one of the following grounds applies:
- the personal data are no longer necessary in relation to the purposes for which we have collected or processed them
- you withdraw consent on which the processing is based, and there is no other legal ground for the processing
- you object to the processing and there are no overriding legitimate grounds for the processing
- we have processed the personal data unlawfully
- the data have to be erased for compliance with a legal obligation
- in relation to services directly offered to children.
Where we have made the personal data public, we shall take reasonable steps to inform controllers which are processing the personal that you have requested the erasure by such controllers of any links to, or copy or replication of, those personal data. Please note that we will not be able to fulfil your erasure request if the data are necessary for the establishment, exercise or defence of legal claims; the erasure would restrict the exercising of the right of freedom of expression and information; or if a legal obligation applicable to us (or purposes in the public interest, scientific or historical research purposes or statistical purposes) requires us to act contrary to the request.
4. RIGHT TO RESTRICTION OF PROCESSING |
You shall have the right to obtain from us restriction of processing where one of the following applies:
- you do not think that the personal data are accurate; in such a case restriction applies to a period enabling us to verify the accuracy of the personal data
- the processing is unlawful but you oppose the erasure of the personal data and request the restriction of their use instead
- we no longer need the personal data, but they are required by you for the establishment, exercise or defence of legal claims
- you object to processing, in such a case restriction applies pending the verification whether our legitimate grounds override your legitimate grounds
Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with the data subject's consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. We shall communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. We shall inform you about those recipients if you request it.
5. RIGHT TO DATA PORTABILITY |
You shall have the right to receive the personal data we process concerning you, and have the right to transmit (or have us transmit upon your instruction) those data to another controller specified by you, if processing is based on your consent or the performance of a contract, and is carried out by automated means. Portability shall be without prejudice to the rights and freedoms of others, and to the right of erasure (right to be forgotten).
6. RIGHT TO OBJECT |
You shall have the right to separately object to processing of personal data concerning you which is based on the Controllers’ legitimate interest, public interest, or is carried out in the exercise of official authority, including profiling. Please note that we perform profiling according to “Profiling” section of this Privacy Notice. In such cases we shall no longer process your personal data unless processing is justified by compelling legitimate grounds which override your interests, rights and freedoms or are necessary for the establishment, exercise or defence of legal claims. Where personal data are processed for direct marketing purposes, you shall have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing. After such objection, we may no longer process the data.
7. RIGHT TO WITHDRAW CONSENT |
You shall have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
8. Enforcement of rights relating to personal data after the data subject’s death |
Pursuant to the Hungarian Privacy Act: Within five years of the death of the data subject, the following rights may be enforced in relation to the data of the deceased person by a person authorised to do so by the data subject in the form of an administrative disposal or a declaration made at the Controllers and incorporated in a public deed or a private deed of full probative value: right of access, rectification, erasure, restriction and objection. If the data subject has made more than one declaration, the declaration of the later date may be used to enforce the rights. If the data subject has not made an administrative disposal or a declaration at the Controllers, his or her close relative according to the Civil Code first contacting the Controllers may demand rectification or object to processing, and – if the processing had already been unlawful in the life of the data subject or if the purpose of processing terminated upon the death of the data subject – demand erasure or the restriction of processing of the deceased person’s data within five years of the death of the data subject. Upon request, the Controllers shall inform the data subject’s close relative on the measures taken, unless the data subject had prohibited it.
The person enforcing the data subject’s rights shall verify the fact and the date of the data subject’s death with a death certificate or with a court decision, as well as his own personal identification, together with his status as a close relative, with a public deed, in accordance with the law.
The following means of legal enforcement and remedies are available to you in connection with our processing of your personal data:
1. You may contact us
2. You may enforce your right to file a complaint
3. You may turn to court
4. You may demand compensation
1. you may contact us
If you have a complaint in relation to data processing or wish to exercise your rights, you can use our following contact information for that purpose:
Email: adatvedelem@ilcsi.com
Mailing address: H-1021 Budapest, Üdülő út 37., Hungary.
We shall inform you without undue delay and at the latest within one month of receipt of the request of any measures taken further to your request, or of the reasons for not taking action. That period may be extended by two further months if the request is complex or a high number of requests is received. We will provide the information by electronic means where possible. Information and any actions taken shall be provided free of charge, unless the requests are manifestly unfounded or excessive, in particular because of their repetitive character. In such cases we may charge a reasonable fee or refuse to act on the request. We may request the provision of information necessary to confirm your identity in connection with the request. A copy of your personal data processed by us may also be requested free of charge for the first time; for any further copies, we shall charge a fee corresponding to administrative costs.
2. RIGHT TO LODGE COMPLAINTS |
If you believe that our data processing does not comply with the law, you may lodge a complaint to the supervisory authority; you can also lodge a complaint to the supervisory authority if we fail to act upon your request without delay but within no more than a month of receipt of the request and/or we fail to notify you of the reason of the delay. The main supervisory authority of the Controllers’ headquarters in Hungary is the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság), with its registered office at: H-1055 Budapest, Falk Miksa utca 9-11., website: www.naih.hu, phone number: +36 (1) 391-1400, email: ugyfelszolgalat@naih.hu.
3. Right to turn to court |
You have the right to turn to court: (i) against the binding decision passed by the supervisory authority concerning you, (ii) if we fail to act upon your request without delay but within no more than a month of receipt of the request and/or we fail to notify you of the reason of the delay, (iii) if the supervisory authority neglects your complaint, has rejected your complaint although you think it was justified, or completely fails to notify you of the developments and results regarding your complaint within three (3) months, (iv) without prejudice to your right to complaint, you may turn to court if you believe that your rights under the GDPR have been violated as the processing of your data did not comply with the GDPR. Proceedings against a Controllers shall be brought before the courts of the Member State where the Controllers have an establishment (Hungary). Alternatively, such proceedings may be brought before the courts of the Member State where you have your habitual residence.
4. Right to compensation |
If you have suffered material or non-material damage (grievance award) as a result of violation of the GDPR, you are entitled to compensation from the Controllers or the processor for any damage suffered. We shall be exempt from liability if we prove that we are not in any way responsible for the event giving rise to the damage.
LEGAL BACKGROUND FOR PROCESSING
The Controllers process your personal data under the following laws:
1. REGULATION (EU) 2016/679 of the EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (‘GDPR’)
2. Hungarian law: Act CXII of 2011 on Informational Self-Determination and Freedom of Information (‘Privacy Act’)
3. Hungarian law: Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Business Advertising Activities (‘Business Advertising Act’)
4. Hungarian law: Act V of 2013 on the Civil Code of Hungary (‘Civil Code’)
GOVERNING LAW AND OTHER PROVISIONS
This Privacy Notice shall be governed by the laws of Hungary.
Should the laws in effect in your country impose rules on the parties which are more stringent than those in this Privacy Notice, you shall be obliged to comply with those more stringent rules. You, however, acknowledge and accept that the Controllers’ liability is based on the laws governing this Privacy Notice, and that, to the greatest extent permissible under the relevant laws and court decisions, it excludes its liability for not complying with the provisions applicable in the user’s country.
The headings herein are for convenience only; in themselves they are not sufficient to understand the details of processing. Should you have any questions not clearly answered in this Privacy Notice, please feel free to notify us thereof via the adatvedelem@ilcsi.com email address.
Ilcsi Beautifying Herbs Organic Skin Care Ltd. / ILCSI E-Commerce Ltd. / Jambrik Law Firm