Terms and Conditions

These General Terms and Conditions (the “GTC”) apply to all deliveries of goods and services by ALPAKA Kft. (the “Supplier”), in particular those offered through the Facebook page “A fűszeres Alpaka”, the Instagram page “szeretem_a_fuszereket”, the LinkedIn page “Alpaka Kft.” and the TikTok page “szeretem_a_fuszereket”, as well as through www.fuszerkereskedelem.hu, www.alpaka.hu and www.webshop.fuszerkereskedelem.hu (collectively, the “Website”).

Effective date of these GTC: 15 October 2026.

This document can be downloaded and printed by clicking the small printer icon in the upper-right corner.

Any person or entity entering into a goods-delivery or service relationship with the Supplier in any form or through any communication channel, or using the Website (collectively, the “Customer” ), acknowledges and accepts these GTC and the Privacy Notice by using the Website. Technical information required to use the Website that is not included in these GTC is provided in the notices available on the Website.

Name: Alpaka Kft.

Registered office: Textilgyari ut 4., Szeged, HUNGARY, 6724, Hungary

Postal address: Textilgyari ut 4., Szeged, HUNGARY, 6724, Hungary

Business premises address: Textilgyari ut 4., Szeged, HUNGARY, 6724, Hungary

Representative: Orsolya Vas - Manager

Company registration number: 06-09-015657

Registering court: Szegedi Törvényszék Cégbírósága

Tax number: 22744564-2-06

EU VAT number: HU22744564

FELIR food-chain identification number: AA0183822

Bank: MBH Bank

Bank account number: 10102842-58388500-01000008

IBAN: HU64-10102842-58388500-01000008

E-mail: rendeles@alpaka.hu

Telephone: +36-30/653-8274

The Supplier supplies products exclusively on a wholesale basis to businesses and entrepreneurs holding a tax number, including food-business operators, plants, producers, sole traders and operators in the hospitality sector, who contact the Supplier in writing or register using their business details and accept these GTC and the Privacy Notice.

The Supplier is unable to supply products to private individuals or consumers without a tax number, as its purpose is to support and supply food-business operators and resellers. Registration using business details and approval of that registration are therefore conditions of purchase.

The Supplier offers spices, spice blends, teas, other food-industry ingredients and related accessories (the “Products”) in pre-packed sizes, in bulk, in custom sizes or as custom blends for business customers.

The minimum order quantity is one packaging unit. There is no minimum order value.

Spices and teas are agricultural products whose characteristics, particularly colour, size, structure and active constituents, depend significantly on environmental factors in the growing area and weather conditions. Characteristics shown in photographs may differ slightly from those of the current year’s harvest and from batch to batch. Such differences do not constitute a quality defect provided that the Product complies with applicable legal requirements.

Prices are generally displayed as net prices, as is customary in trade. The detailed page for each Product on the Website displays both gross and net prices and the VAT amount. Prices do not include delivery charges. Prices displayed on the Website are valid while stocks last or until withdrawn.

If, despite exercising the care reasonably expected of it, the Supplier displays an incorrect price, the Supplier is not obliged to supply the Product at that price, but must offer the Customer the option to purchase it at the correct price in the order confirmation. If the Customer does not wish to accept this option, the Customer may withdraw from the contract unilaterally.

The detailed delivery tariff forms part of these GTC and is also available on www.webshop.fuszerkereskedelem.hu under “PAYMENT” and “DELIVERY” in the footer menu.

The Website operated by the Supplier, including its graphic elements, text, posts, blog articles, technical solutions and service elements, is protected by copyright or other intellectual property rights. The Supplier is the copyright owner or authorised user of all content displayed on its social media pages, the Website and the services available through the Website, including all copyright works and other intellectual creations, such as graphics, photographs and other materials, the layout and editing of the Website interface, software and other solutions, ideas and implementations.

Saving, quoting or printing the content of the Website or any part thereof to a physical or other data medium is permitted only for private use or with the Supplier’s prior written consent.

Use of protected content without permission entitles the Supplier to claim a contractual penalty and/or compensation for non-pecuniary damage. The contractual penalty is HUF 1,000 per word per day and HUF 5,000 per image per day. Following notice from the Supplier, the unauthorised user must pay the amount within 8 days to the Supplier’s MBH Bank account, account number 10102842-58388500-01000008.

Except for the rights expressly specified in these GTC, neither use of the Website nor any provision of these GTC grants the Customer any right to use or exploit any trade name or trademark appearing on the Website.

The Supplier reserves all rights in every element of its services, particularly its domain name and related subdomains, all other domain names registered by the Supplier and their subpages, and its online advertising surfaces. Activities aimed at listing, organising, archiving or hacking the Supplier’s database, or reverse-engineering its source code, are prohibited unless the Supplier has given separate written permission.

Without a separate agreement or use of a service provided for this purpose, it is prohibited to modify or copy the Supplier’s database, add new data to it or overwrite existing data by bypassing the interface or search engine provided by the Supplier.

The Customer uses the Website at its own risk. Except for liability for damage caused intentionally, through gross negligence or by a criminal offence, and for contractual breaches causing death, personal injury or damage to health, the Supplier excludes liability for pecuniary and non-pecuniary damage arising during use of the Website.

The Supplier excludes liability for the conduct of Website users. The Customer is fully and exclusively responsible for its own conduct.

The Customer must ensure that use of the Website does not directly or indirectly infringe third-party rights or violate applicable law.

The Customer consents to the storage of the data and information it provides and to their use for statistical analysis and other business purposes that do not infringe personal-data protection, in any form and using any current or future means, including content, audio and video content sent by the Customer, including through third parties.

The Supplier is entitled, but not obliged, to review content made available by the Customer (for example, comments) and to search published content for indications of unlawful activity. The Supplier accepts no liability in this regard.

The Website enables Customers to view Products and place orders online. Products can be browsed using the menus and are organised into categories. Customers can browse by Product type, such as basic spices, peppers, onions, herbs and teas, and select different packaging units on each Product page.

“Bulk Products” are Products supplied in sacks or boxes in bulk sizes; their webshop names do not include a size designation. Bulk Products are supplied only in quantities exceeding 5 kg. Smaller quantities can be ordered by adding Products in 1,000 g or 250 g packs, small bags or bottles to the basket. Products in packaging smaller than bulk packaging can only be viewed by interested parties whose registration has been approved and who have logged into their account.

A short description, price or unit price and other characteristics are shown next to each Product, without limitation. For more information, click the Product image or the eye-shaped “View” icon. The Product page provides more detailed information and an enquiry form below the photograph.

Clicking a category displays its Products. If the Products do not fit on one page, the page numbers above and below the list can be used to navigate. The detailed Product page is available by clicking the Product name and contains detailed characteristics and price information.

The Website allows Products to be searched by keyword. Matching results are displayed in a list similar to category results.

The selected Product can be added to the basket using the basket button. The quantity or weight can be set next to the button. The Customer can review the basket, change quantities or remove items. There is no minimum order value; however, the minimum quantity for Bulk Products is 5 kg. The basket can be emptied using “Empty basket”. The Customer proceeds by clicking “Order”, after which they may log in or register.

To register, the Customer must provide an e-mail address, name, tax number, telephone number, billing address and, if different, delivery address, as well as a password. The Supplier checks the data and approves or rejects the registration within 3 business days. Rejection is passive, without a separate step or notification. The Supplier reserves the right to reject a registration without giving reasons. If no result is received within 3 business days, the Customer should contact customer service if necessary, because UNAS, the webshop service provider (see the Privacy Notice), sends notifications only for approved registrations, not rejected ones.

For VAT-exempt intra-Community sales within the EU, the Supplier checks the Customer’s data. VAT-exempt purchases are possible only after approval by the Supplier’s managing director.

Successful registration is confirmed by e-mail and on the Website. The Customer may request deletion of their registration by e-mail; in that case, they must register again to make future purchases. The Customer is responsible for keeping login credentials confidential and for updating their details, and must notify the Supplier if they become aware that a third party has misused their data. A new password can be requested on the Website using the registered e-mail address. Previously registered Customers can continue the ordering process by entering their e-mail address and password.

The Customer must then select a payment and delivery method. A summary page allows the Customer to check all entered data and the Products and quantities ordered. Data-entry errors can be corrected using the pencil icon. If everything is correct, the Customer finalises the order by clicking “Submit order”. Confirmation is provided on the Website and by e-mail. Any incorrect data noticed after submission (for example, in the confirmation e-mail) must be reported to the Supplier without delay and no later than within 24 hours.

Customers can log in using the “Customer Login” window or “Login” menu, regardless of whether they intend to place an order. After login, “MY PROFILE” and “Edit details” allow the Customer to amend registration data and track submitted orders and their status.

After an order is placed, the system automatically confirms receipt and includes the data provided by the Customer. This automatic confirmation does not constitute the Supplier’s contractual acceptance or confirmation of the order.

If, for any reason, the Customer cannot submit an order online through the Website, orders may exceptionally be accepted by e-mail at rendeles@alpaka.hu. After receipt, the order details and further communication will be handled by e-mail or another communication channel.

Orders are processed on business days between 08:00 and 16:00. Orders may be placed outside these hours, but orders submitted after working hours are processed on the next business day. For accepted orders, the delivery time from confirmation is 3 business days for Products in stock. If a Product is out of stock, delivery takes 2–3 weeks depending on the source of supply. The parties will coordinate any partial delivery and the expected delivery date.

All deliveries are conditional upon the Supplier receiving out-of-stock Products from its own suppliers in full and on time. Unforeseen events and force majeure may extend delivery times; the Supplier is not liable for resulting obstacles or delays.

The Supplier is not liable for changes to information or descriptions of an ordered Product made without prior notice due to the supplier or other causes beyond the Supplier’s control.

Information on the Website and in any price list provided by the Supplier does not constitute an offer by the Supplier to enter into a contract. For orders subject to these GTC, the Customer is deemed to make the offer under applicable law, and the Supplier accepts or rejects that offer.

Placing an order on the Website or by e-mail constitutes a declaration of intent by conduct. The contract is therefore concluded electronically rather than in writing; the Supplier does not file or archive it, and it is not subsequently accessible.

Contracts may be concluded in Hungarian, English and German.

The Supplier issues a paper invoice and sends it electronically as a remote invoice in a format to be printed by the Customer.

For advance payments and bank transfers, the Supplier sends by e-mail a payment request or invoice issued by the invoicing software of Kulcs-Soft Zrt., containing the necessary details. The transfer must be initiated by the deadline stated on the document.

Advance payment is available to any registered Customer. Bank transfer with a payment deadline is permitted only at the Supplier’s discretion and after a separate written framework agreement has been concluded.

Bank details:

Domestic HUF transfers: MBH Bank, 10102842-583885-010000008

SWIFT code for advance payments from abroad: MKKBHUHB

For invoices issued in EUR, advance payments should be made to the EUR account: EUR IBAN HU10102842-58388500-01003300.

In the event of late payment, the Supplier may charge default interest under Section 6:48 of Act V of 2013 on the Civil Code and claim fixed recovery-cost compensation of EUR 40.

If the Customer fails to pay within 3 days after the payment deadline following performance, the Supplier may suspend fulfilment of the Customer’s further orders.

For domestic delivery, payment is made to GLS General Logistics Systems Hungary Csomag-Logisztikai Kft. in cash or by bank card, or by bank card at a parcel locker.

A handling fee of HUF 857 gross per invoice is charged for cash on delivery. This payment method is not available for deliveries abroad.

Barion is an electronic payment service that enables convenient and secure payment in the webshop by bank card or pre-loaded balance. Barion Payment Zrt. is supervised by the Hungarian National Bank; its authorisation number is H-EN-I-1064/2013. The Supplier does not access, store or misuse the Customer’s card details.

Card payment does not require registration. The Customer must provide the card number, expiry date, CVC code on the back of the card and a valid e-mail address. Accepted cards: Mastercard or Maestro; Visa or Visa Electron.

Payment without a bank card is possible using a pre-loaded Barion balance, which the Customer can top up by bank transfer or cash deposit. Barion does not charge the Customer an additional fee for card payments.

Online payment is also available through Stripe, which supports Apple Pay, Google Pay, Visa, Mastercard, Maestro and American Express.

The Supplier does not access, store or misuse the Customer’s card details. Stripe’s terms and privacy information are available at https://stripe.com/en-hu/privacy.

For domestic deliveries, delivery is expected on the business day following dispatch. Gross shipment weight, including packaging, and gross delivery charge:

Under 4.99 kg — HUF 2,985

5–9.99 kg — HUF 4,320

10–29.99 kg — HUF 5,543

30–49.99 kg — HUF 8,504

50–74.99 kg — HUF 10,389

75–99.99 kg — HUF 12,302

100–149.99 kg — HUF 17,030

150–199.99 kg — HUF 20,525

200–299.99 kg — HUF 28,004

300–599.99 kg — HUF 34,994

Over 600 kg — free of charge.

For domestic orders exceeding 600 kg per shipment, the Supplier covers the delivery charge. Cash-on-delivery handling is HUF 675 net plus VAT per invoice.

For international delivery, the gross weight of each parcel, including packaging, may not exceed 25 kg. Charges below are net per parcel.

EU Zone 1 — transit time 1–2 business days: Austria, Bulgaria, Czechia, Croatia, Germany, Romania, Slovakia and Slovenia.

0–24.99 kg — HUF 10,300 or the equivalent in EUR

25–49.99 kg — HUF 20,610 or the equivalent in EUR

50–74.99 kg — HUF 30,910 or the equivalent in EUR

75–99.99 kg — HUF 41,215 or the equivalent in EUR

100–149.99 kg — HUF 61,825 or the equivalent in EUR

150–599.99 kg — HUF 84,525 or the equivalent in EUR

Over 600 kg — free delivery.

EU Zone 2 — transit time 3–5 business days: Belgium, Denmark, Estonia, Finland, France, Greece, Ireland, the Netherlands, Poland, Latvia, Liechtenstein, Lithuania, Luxembourg, Norway, Italy, Portugal, Spain, Switzerland and Sweden.

0–24.99 kg — HUF 14,260 or the equivalent in EUR

25–49.99 kg — HUF 28,520 or the equivalent in EUR

50–74.99 kg — HUF 42,780 or the equivalent in EUR

75–99.99 kg — HUF 57,040 or the equivalent in EUR

100–149.99 kg — HUF 85,560 or the equivalent in EUR

150–599.99 kg — HUF 120,750 or the equivalent in EUR

Over 600 kg — free delivery.

GLS handles parcel deliveries. For pallet deliveries, the Supplier uses another transport service to select the most suitable delivery method.

Parcel deliveries are made on business days, Monday to Friday, between 08:00 and 17:00, or at another time agreed with the courier. The Customer may provide a different delivery address if they are not present at the registered address on weekdays.

GLS sends SMS or e-mail notifications about the parcel’s current status. The Customer may use the contact details in the notification to contact the courier service and coordinate the delivery time.

GLS customer service for recipients:

business days, 07:00–20:00.

Telephone: +36 29 886 700.

Mobile: +36 20 890 0660.

E-mail: info@gls-hungary.com.

Website: https://gls-group.com/HU/hu/kontakt/elerhetoseg/

GLS delivers the parcel personally to the Customer, who signs to confirm receipt. A family member may also receive the parcel on the Customer’s behalf. If the Customer and no authorised recipient are present, GLS returns the parcel to the depot or centre and attempts delivery a second or third time on the following business day(s). If delivery cannot be made, the courier leaves a notice containing the GLS customer service telephone number.

Upon receipt, the Customer must inspect the Product for damage. If damage to the packaging or Product is visible, the Customer may ask the courier to draw up a damage report. Under these GTC, acceptance from the courier and signing the proof of delivery constitute quantitative and qualitative acceptance. The Supplier therefore states that it cannot accept subsequent quantitative or qualitative complaints after the courier has left.

The Customer is responsible for thoroughly inspecting the parcel. If the parcel is damaged, the Customer must immediately request a damage report and take photographs. The Customer should then open the parcel and, if the contents are also damaged, have the damage recorded in the report and take several photographs. The courier service will not accept complaints about parcels accepted without a report. If damage to the packaging or Product is visible on delivery and occurred before receipt, the Supplier will arrange return or replacement free of charge. The Supplier accepts no liability for damage discovered after acceptance.

Pre-ordered and prepared parcels may be collected in person from the Supplier’s premises at Textilgyári út 4, Szeged, by prior appointment and during goods-release hours.

Orders pick-up hours:

Monday to Thursday, 10:00–16:00;

Friday, 10:00–14:00.

Upon receipt, the Customer checks the quantity and quality of the Products and verifies that they correspond to the order and confirmation. Any quantity discrepancy must be recorded by the parties’ representatives on the delivery note.

The Customer must notify the Supplier of quality complaints without delay and no later than within 2 business days.

The parties shall cooperate to resolve disputes concerning complaints. If no agreement is reached, they shall appoint an expert mutually accepted by both parties.

Where a carrier is involved, if the Customer identifies a quantity or quality defect, the Customer must take the written steps necessary to assert a claim against the carrier during and after receipt and send a copy to the Supplier.

If the Customer previously failed to accept an ordered Product (except when exercising a right of withdrawal), or the Product was returned to the Supplier marked “not collected”, the Supplier may make fulfilment conditional on advance payment of the purchase price and delivery costs. The Supplier may withhold delivery until it has verified successful payment of the Product price and the total amount shown on the payment request or invoice. If the price has not been paid in full, the Supplier will request payment of the balance.

In such cases, no default penalty, cancellation penalty or damages may be claimed against the Supplier.

The Customer may not set off its own claims against the Supplier or exercise rights of retention without the Supplier’s written consent.

If the Supplier performs defectively, the Customer may assert warranty claims against the business in accordance with Act V of 2013 on the Civil Code.

As the Products are foodstuffs, warranty claims apply only while the packaging is unopened and provided that the storage instructions on the label or in the Product description have been followed.

The Customer may assert warranty claims for food Products within their best-before period for defects that existed when the Product was handed over. Warranty rights cannot be asserted after the best-before date has expired.

Spices and teas are agricultural products whose characteristics, particularly colour, size, structure and active constituents, depend significantly on growing-area conditions and weather. Slight differences may occur between Website photographs or samples and the current year’s harvest or stock, including differences between batches and growing locations. Such differences do not constitute quality defects if the Product complies with applicable legal requirements.

At the Customer’s choice, the Customer may request repair or replacement, unless the chosen remedy is impossible or would impose disproportionate additional costs on the business compared with another remedy. If repair or replacement has not been requested or is not available, the Customer may claim a proportionate price reduction, repair the defect at the business’s expense, have it repaired by another party at the business’s expense or, as a last resort, withdraw from the contract.

The Customer may change from the chosen warranty remedy to another, but bears the cost of doing so unless the change was justified or caused by the business.

The Customer must notify the Supplier of a defect without delay after discovering it and no later than 8 business days after discovery. The Customer may assert warranty claims directly against the business.

A product-liability warranty applies only to defects in movable property (Products). A Customer qualifying as a consumer may, at their choice, exercise the rights described in Section 7.1 or make a product-liability warranty claim.

As the Products are foodstuffs, warranty claims apply only while the packaging is unopened and provided that the storage instructions on the label or in the Product description have been followed.

Spices and teas are agricultural products whose characteristics, particularly colour, size, structure and active constituents, depend significantly on growing-area conditions and weather. Slight differences may occur between Website photographs or samples and the current year’s harvest or stock, including differences between batches and growing locations. Such differences do not constitute quality defects if the Product complies with applicable legal requirements.

A Product is defective if it does not meet the quality requirements laid down in the legislation in force when it was placed on the market. Under a product-liability warranty claim, the Customer may request only repair or replacement of the defective Product.

The Customer may assert a product-liability warranty claim within the Product’s best-before period. This right is lost after that period expires. The claim may be asserted only against the manufacturer or distributor of the movable item, and the Customer must prove the defect.

The manufacturer or distributor is released from its product-liability warranty obligation only if it proves that the Product was not manufactured or placed on the market in the course of its business; or that, according to the state of scientific and technical knowledge at the time the Product was placed on the market, the defect was not detectable; or that the defect resulted from the application of legislation or a mandatory official requirement. Proof of one ground is sufficient.

A warranty claim for defective performance and a product-liability warranty claim may not be pursued simultaneously for the same defect. If a product-liability warranty claim is successful, the Customer may assert a warranty claim against the manufacturer in respect of the replaced Product or repaired part.

Warranty claims may be submitted using the following contact details:

Name: Alpaka Kft.

Postal address: Textilgyari ut 4., Szeged, HUNGARY, 6724, Hungary

Telephone: +36-30/653-8274

E-mail: rendeles@alpaka.hu

The Customer may submit consumer complaints concerning a Product or the Supplier’s activities using the following contact details:

Name: Alpaka Kft.

Postal address: Textilgyari ut 4., Szeged, HUNGARY, 6724, Hungary

Telephone: +36-30/653-8274

E-mail: rendeles@alpaka.hu

The Supplier shall remedy an oral complaint immediately where possible. If immediate remedy is not possible because of the nature of the complaint or because the Customer disagrees with its handling, the Supplier shall draw up a record of the complaint and retain it for five years together with its substantive response.

For an oral complaint made in person at the business premises, the Supplier shall hand a copy of the record to the Customer immediately. If this is not possible, the Supplier shall proceed under the rules applicable to written complaints.

For an oral complaint made by telephone or another electronic communications service, the Supplier shall send a copy of the record to the Customer no later than together with its substantive response. In all other cases, the rules applicable to written complaints shall apply.

The Supplier shall assign a unique identifier to complaints recorded by telephone or another communications device to facilitate retrieval.

The Supplier shall provide a substantive response to written complaints within 30 days. For the purposes of these terms, taking action means posting the response.

If a complaint is rejected, the Supplier shall inform the Customer of the reasons.

The Alpaka Kft. webshop provides purchasing opportunities for registered businesses and other business partners.

The Customer may submit comments or complaints concerning Products, order fulfilment, delivery, invoicing or the Supplier’s services using the following details:

E-mail: rendeles@alpaka.hu

Telephone: +36 30 520 9293

Postal address: 6724 Szeged, Textilgyári út 4.

The Supplier will investigate complaints and seek to resolve them as soon as possible in a manner acceptable to both parties. The parties shall first attempt to resolve disputes amicably through direct consultation.

If a dispute cannot be resolved through negotiations, the following options are stated in these GTC. For consumer complaints or comments concerning the edibility or quality of food, the consumer may contact:

Csongrád-Csanád County Government Office, Department of Food Chain Safety and Animal Health

6724 Szeged, Vasas Szent Péter u. 9.

Telephone: +36 62 680 800

Csongrád-Csanád County Conciliation Board

6721 Szeged, Párizsi krt. 8–12.

Telephone: +36 62 549 392

E-mail: bekelteto.testulet@cskik.hu

Website: https://www.bekeltetes-csongrad.hu/

The Supplier reserves the right to delete the Customer’s user account in the webshop if the Customer has not logged into their account for at least two (2) years. The period of inactivity is calculated from the date of the last successful login.

The Supplier may decide at its own discretion whether to delete inactive accounts and is not obliged to delete all accounts meeting the above criteria. The Supplier may terminate the affected account without prior individual notice.

After deletion, the Customer will no longer be able to log in using the previous login credentials. If the Customer wishes to use the webshop again, they may submit a new registration, subject to the registration and approval rules in these GTC.

Deletion of a user account does not affect the Supplier’s obligation to retain data and documents for the period prescribed by applicable law.

Matters not regulated or not sufficiently regulated by these GTC are governed by the Civil Code and legislation applicable to contracts between businesses. The Supplier may amend these GTC, the prices of Products sold on the Website and other displayed prices at any time, without retroactive effect. Amendments take effect upon publication on the Website or following other written notification by the Supplier.

These GTC, notices available on the Website and other information constitute the entire agreement between the Supplier and the Customer. In individual cases, the Supplier may make delivery conditional on the conclusion of an additional written framework agreement.

Contracts concluded under these GTC do not incorporate customs or practices established in the parties’ previous business relationship. They also do not incorporate customs regularly applied by parties to similar contracts and widely known in the relevant business sector.

Purchasing through the Website presupposes that the Customer is aware of and accepts the possibilities and limitations of the Internet, particularly technical performance and potential errors. The Supplier is not liable for operational failures in the Internet network that prevent the Website from functioning or prevent a purchase.

The Supplier’s Privacy Policy is available at: https://webshop.fuszerkereskedelem.hu/shop_help.php?tab=privacy_policy

Effective date of these General Terms and Conditions: 15 October 2026.

DATA PROCESSING / HANDLING INFORMATION (PRIVACY POLICY) ON THE RIGHTS OF THE NATURAL PERSON / INDIVIDUAL COSTUMER REGARDING THE PROCESSING / HANDLING OF YOUR PERSONAL DATA

CONTENTS

INTRODUCTION

CHAPTER I - NAME OF THE DATA CONTROLLER

CHAPTER II – NAMES OF DATA PROCESSORS

1. IT services of our company
2. Postal services, delivery, package sending (parcel delivery)
3. Billing and newsletter systems, accounting activities

CHAPTER III - ENSURING THE LAWFULNESS OF DATA PROTECTION

1. Data processing based on the consent of the data subject
2. Data processing based on the fulfillment of legal obligations
3. Facilitating the exercise of data subject rights

CHAPTER IV - PROCESSING OF VISITORS’ DATA ON THE WEBSITE OF THE COMPANY - INFORMATION ON THE USE OF COOKIES

CHAPTER V - INFORMATION ON THE RIGHTS OF THE DATA SUBJECT

INTRODUCTION

REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: Regulation) specifies that the data controller shall take appropriate measures to ensure that the data subjects are provided each information regarding data processing in a concise, transparent, intelligible and easily accessible form, using clear and plain language, and that the Data Controller shall assist the data subjects in exercising their rights.

The obligation of providing prior information to the data subject is also required by Act CXII of 2011 on informational self-determination and the freedom of information.

By providing the below information, we shall fulfil such statutory obligations.

CHAPTER I

NAME OF THE DATA CONTROLLER

Information released and handled (data controlled) by:

Company name: Alpaka Kft.

Headquarters: 6724 Szeged, Textilgyari ut 4.

Company register (registry) number: 06-09-015657

Tax number: 22744564-2-06

Representative: dr. Vas Orsolya

Phone number: +36 62/ 469 740

Fax: +36 62/ 469 740

E-mail address: info@fuszerkereskedelem.hu

Website: www.fuszerkereskedelem.hu, www.dobozostea.hu

(in the following: Company)

CHAPTER II 

NAMES OF DATA PROCESSORS

Data processor: means a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller; (Article 4 (8) of the Regulation) The use of a data processor does not require the prior consent of the data subject, but requires his or her information. Accordingly, we provide the following information:

1. IT services of our company

Our company uses data processors to maintain and manage its website, which provides IT services (hosting services) and, within the framework of our contract with it, manages the personal data provided on the website, the operation is the storage of personal data on the serverThe names of these data processors are as follows:

Company name: Introweb Szolgaltato es Kereskedelmi Kft.

Headquarters: 6724 Szeged, Gelei Jozsef u. 5.

Company register (registry) number: 06-09-008564

Tax number: 13037176-2-06

Representative: Ordog Szilard

Phone number: +36 20 414 2574

E-mail address: porta@introweb.hu

Website: www.introweb.hu

Company name: Unas Online Kft.

Headquarters: 9400 Sopron, Major koz 2. I./15.

Company register (registry) number: 08-09-015594

Tax number: 14114113208

Representative: Koczan Tamas

E-mail address: unas@unas.hu

Website: www.unas.hu

 2. Postal services, delivery, package sending (parcel delivery)

The following providers:

Company name: Magyar Posta Zrt.

Headquarters: 1138 Budapest, Dunavirag utca 2-6.

Company register (registry) number: 01-10-042463

Tax number: 10901232-2-44

Phone number: +36 1 767 8200

E-mail address: ugyfelszolgalat@posta.hu

Website: www.posta.hu

Company name: GLS General Logistics Systems Hungary Csomag-Logisztikai Kft.

Headquarters: 2351 Alsonemedi GLS Europa u. 2.

Company register (registry) number: 13-09-111-755

Tax number: 12369410-2-44

Phone number: +36 1 802 0265*

Company name: DPD Hungaria Kft.

Headquarters: 1158 Budapest, Kesmark utca 14. B.ep.

Company register (registry) number: 01-09-888141

Tax number: 13034283-2-42

Representative: Czifrik Szabolcs

Phone number: +36 1 501 6200

Company name: Express One Hungary Kft.

Headquarters: 1239 Budapest, Europa utca 12.

Company register (registry) number: 01-09-980899

Tax number: 13947109-2-43

Phone number: +36 70 866 8733

E-mail address: adatvedelem@expressone.hu

 3. Billing and newsletter systems, accounting activities

The following providers:

Company name: Kulcs-Soft Szamitastechnika Nyrt.

Headquarters: 1022 Budapest, Torokvesz ut 30/A.

Company register (registry) number: 01-10-045531

Tax number: 13812203-2-41

Phone number: +36 1 336 5300

Company name: KBOSS.hu Kft. – Szamlazz.hu

Headquarters: 1031 Budapest, Zahony u. 7.

Company register (registry) number: 01-09-303201

Tax number: 13421739-2-41

Representative: Stygar-Joo Janos

E-mail address: info@szamlazz.hu

Company name: Bithuszarok Szamitastechnikai es Szolgaltato Bt. - Listamester.hu

Headquarters: 2051 Biatorbagy, Damjanich utca 8.

Company register (registry) number: 13-06-065996

Tax number: 21158218-2-13

Data protection officer: dr. Kasa-Richlach Monika

Officer’s Phone number: +36 20 222 9856

Company name: Del-Thermo Kft.

Headquarters: 6726 Szeged, Andras u. 5.

Company register (registry) number: 06-09-013097

Tax number: 14490758-2-06

Phone number: +36 62 471 896

CHAPTER III

ENSURING THE LAWFULNESS OF DATA PROTECTION

1. Data processing based on the consent of the data subject

• If the Company wishes to carry out data processing based on consent, then the consent of the data subject to the processing of his personal data must be requested in a data request form with the content and information specified in the privacy policy.

• It is also considered consent, if the data subject checks the appropriate box while viewing the website of the Company, performs relevant technical settings while using services related to the information society, or any other statement or action, which in the given context, clearly indicates the consent of the data subject to the processing of his personal data. Therefore, remaining silent, pre-checking of boxes, or not taking action shall not be considered consent.

• Such consent shall cover all data processing activities performed for the same purpose or purposes. If the data processing serves multiple purposes at the same time, then the consent shall cover all purposes of data processing.

• If the data subject's consent is given in the context of a written declaration which also concerns other matters - e.g. concluding sales or service contracts - the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration by the data subject which constitutes an infringement of the Regulation shall not be binding.

• The Company shall not stipulate the conclusion or performance of contracts with the provision of giving consent to the processing of personal data that are not necessary for performing the contract.

• The withdrawal of consent must be made possible in the same simple manner as the giving of consent.

• In case the personal data were collected under the consent of the data subject, the data controller - unless required otherwise by law - may process the collected data for the purpose of compliance with the applicable legal requirements without the need to obtain a separate consent, and even after the data subject has withdrawn its consent.

1. Data processing based on the fulfillment of legal obligations

• In case of data processing based on legal obligation, the provisions of the underlying provisions shall be applicable to the scope of data to be processed, the purpose of data processing, the duration of data storage, and the recipients.

• Data processing based on the performance of legal obligations shall be independent of the consent by the data subject, since such data processing is specified by legislation. In this case, prior to the start of the data processing, the data subject must be informed that such data processing is mandatory, and prior to the data processing he must be clearly and in detail informed about any facts related to the processing of his data, in particular about the purpose and legal basis of the data processing, the person entitled to data processing, the duration of the data processing, on the fact that the data controller processes his personal data based on the applicable legal obligation, and about who can have access to the data. The information should include the rights of the data subject and any legal remedies relating to data processing. In case of mandatory data processing, information may be provided by disclosing reference to the legal provision containing the above information.

1. Facilitating the exercise of data subject rights

In the course of all data processing, the Company shall facilitate the exercise of data subject rights.

CHAPTER IV

PROCESSING OF VISITORS’ DATA ON THE WEBSITE OF THE COMPANY - INFORMATION ON THE USE OF COOKIES

1.Visitors to the website must be informed on the use of cookies at the website, and the visitors’ consent shall be requested in respect of this - with the exception of technically essential session cookies.

2.General information on cookies

2.1. Cookies are small data files sent by the visited website to the visitor’s browser (in variable name-value format) to store it, and later to be uploaded by the same website. A cookie may be assigned validity - it can be valid until the browser is closed, or for an indefinite period. At a later stage, it will send these data to the browser server at each HTTP(S) request. In this way, it modifies the data stored on the user’s computer.

2.2. The essence of cookies is that due to the nature of web services it is necessary for it to mark a user (e.g. that it entered the site) and to handle it accordingly later. The danger lies in the fact that the user is not always aware of the presence of cookies, and they can be suitable for the website operator or other service providers whose contents are embedded in the site

(e.g. Facebook, Google Analytics) - creating a profile of the user, and in this case the contents of the cookie may be considered personal data.

2.3. Types of cookies:

2.3.1. Technically essential session cookies: cookies without which the site simply would not function as intended; they are necessary for identifying the user, for example, to manage login or what items were placed in the basket, etc. This is typically storing session IDs, since other data are stored on the server, which is safer. It has safety implications - if the session cookie’s value is not generated appropriately, then there is a risk of session hijacking attack, and therefore it is imperative that these values are generated correctly. In other terminologies all cookies that are erased when you exit the browser are called session cookies (a session is a browser use from entry until exit).

2.3.2. Cookies assisting the use: these are the cookies that remember the user’s choices, for example the form of the site the user wishes to see it. These types of cookies actually mean the setting data stored in the specific cookie.

2.3.3. Performance cookies: even though these cookies do not have much to do with “performance”, these are the cookies that collect information about the user’s behavior within the visited site, the time he spent there, and any clicks. Typically, these third-party applications (e.g. Google Analytics, AdWords, or Yandex.ru cookies). They are suitable for visitor profiling.

For more information on Google Analytics cookies please see:

https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage

For more information on Google AdWords cookies please see:

https://support.google.com/adwords/answer/2407785?hl=hu

2.4. Accepting the use of cookies is not mandatory. You may reset your browser settings to refuse all cookies or to indicate when the system is sending a cookie. Although most browsers automatically accept cookies as default, but they can usually be changed in order to prevent automatic acceptance, and offers a choice every time.

You can find information about the cookie settings of the most popular browsers at the links below:
• Google Chrome: https://support.google.com/accounts/answer/61416?hl=hu
• Firefox: https://support.mozilla.org/hu/kb/sutik-engedelyezese-es-tiltasa-amit-weboldak-haszn
• Microsoft Internet Explorer 11: http://windows.microsoft.com/hu-hu/internet-explorer/delete-manage-cookies#ie=ie-11
• Microsoft Internet Explorer 10: http://windows.microsoft.com/hu-hu/internet-explorer/delete-manage-cookies#ie=ie-10-win-7
• Microsoft Internet Explorer 9: http://windows.microsoft.com/hu-hu/internet-explorer/delete-manage-cookies#ie=ie-9
• Microsoft Internet Explorer 8: http://windows.microsoft.com/hu-hu/internet-explorer/delete-manage-cookies#ie=ie-8
• Microsoft Edge: http://windows.microsoft.com/hu-hu/windows-10/edge-privacy-faq
• Safari: https://support.apple.com/hu-hu/HT201265

However, we would like draw your attention to the fact that some website features or services may not function properly without the use of cookies.

1. Information about the cookies used on the Company's website and the data created during visiting the website

3.1. Scope of data processed during visiting the website: Our Company’s website may record and process the following data on the visitor, or the device the visitor used for browsing:

• IP address used by the visitor,

• browser type,
• characteristics of the operating system of the device used for browsing (the language set),
• date of the visit,
• the visited (sub)page, function or service.

• click

We retain these data for a period of up to 90 days, and use them primarily for inspecting security incidents.

3.2. Cookies used on the website

3.2.1. Technically essential session cookies

Purpose of data processing: ensuring the appropriate operation of the website. These cookies are necessary for the visitors to browse the website smoothly and make full use of its features as well as the services available through the website, such as - among others - in particular remembering the operations performed by the visitors on the specific pages, or identifying the signed-in user during a visit. These cookies only perform data processing during the actual visit of a visitor, and at the end of the session, or when the browser is closed, these type of cookies are automatically deleted from the visitor’s computer.

The legal basis of such data processing is Section 13/A(3) of Act CVIII of 2001 on certain issues of electronic commerce and information society services (Electronic Commerce Act), which stipulates that the service provider may – for the purpose of providing the service – process personal data indispensable for providing the service for technical reasons. Should other conditions be identical, the service provider shall select and operate the means applied in the course of providing information society service at all times, so that personal data be processed only if it is absolutely indispensable for providing the service or achieving other objectives stipulated in this Act, and only to the required extent and duration.

3.2.2. Cookies assisting use:

These cookies remember the user’s choices, for example the form of the site the user wishes to see it. These types of cookies actually mean the setting data stored in the specific cookie.

The legal basis of the data processing is the consent of the visitor.

The purpose of data processing: Increasing the efficiency of the service, enhancing user experience, making the use of the site more convenient.

These data are stored on the user's computer; the website has simply access to them to recognize its visitors.

3.2.3. Performance cookies:

These cookies collect information about the user’s behavior within the visited site, the time he spent there, and any clicks. Typically, these are third-party applications (e.g. Google Analytics, AdWords).

The basis of data processing: the consent of the data subject.

The purpose of data processing: analysis of the website, sending advertising offers.

CHAPTER V

INFORMATION ON THE RIGHTS OF THE DATA SUBJECT

1. Short summary of the rights of the data subject:

1. Transparent information and communication, as well as assisting the data subjects in exercising their rights
2. Right to receive prior information - if personal data are collected from the data subject
3. Informing the data subject, and information to be provided where personal data have not been obtained from the data subject
4. Right of access by the data subject
5. Right to rectification
6. Right to erasure (“right to be forgotten”)
7. Right to restriction of processing
8. Notification obligation regarding rectification or erasure of personal data or restriction of processing
9. Right to data portability
10. Right to object
11. Automated individual decision-making, including profiling
12. Restrictions
13. Communication of a personal data breach to the data subject
14. Right to lodge a complaint with a supervisory authority (right to supervisory judicial remedy)
15. Right to an effective judicial remedy against a supervisory authority
16. Right to an effective judicial remedy against a controller or processor

 1. Rights of the data subject in detail:

1.Transparent information and communication, as well as assisting the data subjects in exercising their rights

 1.1. The data controller shall provide all information regarding the processing of personal data in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information must be provided in writing or otherwise - including electronic means where appropriate. At the request of the data subject, verbal information may also be provided, in case the identity of the data subject is verified.

 1.2. The data controller shall facilitate for the data subjects to exercise their rights.

 1.3. The data controller shall, without undue delay, but in any event within one month following the receipt of the request, inform the data subject about the measures determined in respect of the request to exercise the rights of the data subject. This period may be extended

by two months under the conditions specified in the Regulation, which information must be provided to the data subject.

1.4. If the controller does not take action on the request of the data subject, the controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

1.5. The data controller provides the data and the information on the rights of the data subject free of charge, however, in cases provided for in the Regulation a fee may be charged.

The detailed rules can be found in Article 12 of the Regulation.

2. Right to receive prior information - if personal data are collected from the data subject

 2.1. The data subject is entitled to be informed about any facts and information related to the data processing, prior to the commencement of the data processing. In this context, the data subject must be informed about:

1. a) the identity and contact details of the data controller and his representative,
2. b) the contact details of the data protection officer (where applicable),
3. c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing,
4. d) the legitimate interests of the data controller or of a third party, where the processing is based on pursuing legitimate interests,
5. e) the recipients of personal data - to whom the personal data are disclosed -, or categories of recipients of the data, if any;
6. e) where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation.

 2.2. In order to ensure fair and transparent data processing, the data controller shall provide the data subject with the following information:

1. a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
2. b) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability;
3. c)where the processing is based on the consent of the data subject, the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
4. d) the right to lodge a complaint with a supervisory authority;
5. e) whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data;
6. f) the existence of automated decision-making, including profiling, and at least in those cases meaningful information about the logic involved, as well as clear

information on the significance and the envisaged consequences of such processing for the data subject.

 2.3. Where the data controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the data controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information.

The detailed rules for the right to prior information are set out in Article 13 of the Regulation.

3. Informing the data subject, and information to be provided where personal data have not been obtained from the data subject

 3.1. Where personal data have not been obtained from the data subject, the data controller must inform the data subject within one week after obtaining the personal data; where personal data are used for contacting the data subject, at the time of first contacting the data subject; if a disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed, the data subject must be informed about the facts and information described in the above Point 2, about the affected categories of personal data, from which source the personal data originate, and if applicable, whether it came from publicly accessible sources.

 3.2. Further rules shall be governed by the contents of the above Point 2 (Right to receive prior information).

The detailed rules for providing information are set out in Article 14 of the Regulation.

4. Right of access by the data subject

4.1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the information contained in the above Points 2-3. (Article 15 of the Regulation).

4.2. Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 of the Regulation relating to the transfer.

 4.3. The data controller shall provide the data subject with one copy of the processed personal data. The data subject may be charged a reasonable administration fee for any additional copies by the data controller.

The detailed rules of the right of access by the data subject can be found in Article 15 of the Regulation.

5. Right to rectification

5.1. The data subject shall be entitled to have the data controller rectify his or her incorrect personal data without delay.

5.2. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

These rules are set out in Article 16 of the Regulation.

6. Right to erasure (“right to be forgotten”)

6.1. The data subject shall have the right to obtain from the data controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay if

1. a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
2. b) the data subject has withdrawn his or her consent on which the data processing is based, and there is no other legal ground for the processing;
3. c) the data subject objects to the data processing, and there is no priority legitimate reason for the data processing,
4. d) the personal data have been unlawfully processed;
5. e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the data controller is subject;
6. f) the personal data have been collected in relation to the offer of information society services.

6.2. The right to erasure may not be exercised if the data processing is required

1. a) for exercising the right of freedom of expression and information;
2. b) for compliance with a legal obligation which requires processing by Union or Member State law or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller;
3. c) for reasons of public interest in the area of public health;
4. d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, in so far as the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
5. e) for the establishment, exercise or defense of legal claims.

The detailed rules of the right to erasure are set out in Article 17 of the Regulation.

7. Right to restriction of processing

7.1. Where data processing has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defense of your legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

7.2. The data subject shall have the right to obtain from the data controller restriction of data processing where one of the following applies:

1. a) accuracy of the personal data is contested by the data subject, for a period enabling the data controller to verify the accuracy of the personal data;
2. b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
3. c) the data controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defense of legal claims; or
4. d) the data subject has objected to data processing; in this case such restriction shall be valid for a period it is determined whether the legitimate grounds of the data controller override those of the data subject.

7.3. The data subject shall be informed before the restriction of processing is lifted.

These relevant rules are set out in Article 18 of the Regulation.

8. Notification obligation regarding rectification or erasure of personal data or restriction of processing

The data controller shall inform each recipient of any rectification, erasure or restriction, whom or which the personal data have been disclosed to, unless this proves impossible or involves a disproportionate effort. On request, the data controller shall inform the data subject of these recipients.

These rules can be found in Article 19 of the Regulation.

9. Right to data portability

 9.1. Under the conditions specified in the Regulation, the data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where

1. a) the processing is based on consent or on a contract; and
2. b) the processing is carried out by automated means.

 9.2. The data subject shall be entitled to request the direct transfer of the personal data between the data controllers.

9.3. Exercising the right to data transfer may not infringe Article 17 of the Regulation (Right to erasure (“right to be forgotten”). Right to data portability shall not be exercised if the data processing is required for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. This right shall not adversely affect the rights and freedoms of others.

The detailed rules can be found in Article 20 of the Regulation.

10. Right to object

10.1. The data subject has the right to object, on grounds relating to his or her particular situation, at any time to the processing of personal data concerning him or her for public interest or for exercising public authority (Section (1) e) of Article 6), or for the purposes of legitimate interests (Point f) of Article 6), including profiling. In this case the data controller may not continue to process the personal data, except where the data controller demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or are needed for the establishment, exercise or defense of legal claims.

10.2. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

10.3. At the latest at the time of the first communication with the data subject, the rights shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.

10.4. The data subject may exercise his or her right to protest via automated devices based on technical specifications as well.

10.5. Where personal data are processed for scientific or historical research purposes or statistical purposes, the data subject, on grounds relating to his or her particular situation, shall have the right to object to the processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

The relevant rules are set out in Article 21 of the Regulation.

11. Automated individual decision-making, including profiling

11.1. The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

11.2. This right may not be exercised, if the decision:

1. a) is necessary for entering into, or performance of, a contract between the data subject and a data controller;
2. b) is authorised by Union or Member State law to which the data controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or
3. c) is based on the data subject's explicit consent.

11.3. In the cases referred to in Points a) and c) above, the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests,

at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

Further rules are set out in Article 22 of the Regulation.

12. Restrictions

Union or Member State law to which the data controller or data processor is subject may restrict by way of a legislative measure the scope of the obligations and rights (Articles 12 to 22 and Article 34, as well as Article 5), when such a restriction respects the essence of the fundamental rights and freedoms.

The conditions of such restrictions are set out in Article 23 of the Regulation.

13. Communication of a personal data breach to the data subject

13.1. When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the data controller shall communicate the personal data breach to the data subject without undue delay. Such information shall describe in clear and plain language the nature of the personal data breach and contain at least the following:

1. a) the name and contact details of the data protection officer or other contact point where more information can be obtained;

1. b) description of the likely consequences of the personal data breach;
2. c) description of the measures taken or proposed to be taken by the data controller to            address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

13.2. Informing the data subject shall not be required if any of the following conditions are met:

1. a) the data controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption;
2. b) the data controller took subsequent measures following the personal data breach which ensure that the high risk to the rights and freedoms of the data subjects is no longer likely to materialise;
3. c) the information would involve disproportionate effort. In such cases, there shall instead be a public communication or similar measure whereby the data subjects are informed in an equally effective manner.

Further rules are set out in Article 34 of the Regulation.

14. Right to lodge a complaint with a supervisory authority (right to supervisory judicial remedy)

The data subject has the right to lodge a complaint to a supervisory authority - in particular in the European Member State of his or her habitual place of stay, place of work or the place of

the alleged infringement - in case the data subject believes that the processing of his or her personal data violates the Regulation. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy.

These rules are set out in Article 77 of the Regulation.

15. Right to an effective judicial remedy against a supervisory authority

15.1. Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning him or her.

15.2. Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to a an effective judicial remedy where the supervisory authority which is competent does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged.

15.3. Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established.

15.4. Where proceedings are brought against a decision of a supervisory authority which was preceded by an opinion or a decision of the Board in the consistency mechanism, the supervisory authority shall forward that opinion or decision to the court.

These rules are set out in Article 78 of the Regulation.

16. Right to an effective judicial remedy against a controller or processor

 16.1. Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.

 16.2. Proceedings against a data controller or a data processor shall be brought before the courts of the Member State where the data controller or data processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the data controller or data processor is a public authority of a Member State acting in the exercise of its public powers.

These rules are set out in Article 79 of the Regulation.

16/05/2018 Szeged

Orsolya Vas

Manager

Alpaka Kft.