DATA PROCESSING AND PRIVACY NOTICE

1. INTRODUCTION

The Hungarian Tourist Agency, as data controller (1027 Budapest, Kacsa u. 15-23.), is operating a Campaign (hereinafter referred to as the “Campaign”) entitled “Where’s Kajla?” Certain tasks related to the implementation of the Campaign are performed by DEDU Kft. (registered office: 1096 Budapest, Thaly Kálmán utca 39, hereinafter referred to as the “Company”), a developer commissioned by the Hungarian Tourist Agency Zrt. and Mediator Group Kft., as data processor.

This Data Management and Privacy Policy provides information on the processing of personal data, as well as the rights and legal remedies of the data subjects in relation to data processing, in relation to the https://hungary.kajla.hu website (hereinafter referred as the Website) and to the Where’s Kajla mobile app (hereinafter referred as the Mobile app). The detailed conditions for the use of the Website and Mobile app are contained in the General Participation Rules (hereinafter referred to as the “General Participation Rules”).

The Company is committed to protecting the personal data of Campaign participants and considers it particularly important to respect their right to informational self-determination.

By accepting this Data Management and Privacy Policy, its scope also extends to children under the age of 16 and their legal representatives.

The Company treats personal data confidentially and takes all security, technical and organizational measures to guarantee the security of the data, and is committed to protecting your personal data.

Expected duration of the campaign: from 01.04.2025 for an indefinite period.

 

This information sheet records the following:

  • What personal data do we collect and process about you during participation in the Campaign and registration;
  • Where do we get this data from;
  • What do we do with this data;
  • How we store data;
  • To whom do we transfer/disclose this data;
  • How we take your data protection rights into account;
  • And how we comply with data protection regulations.

The principles of data management are in accordance with the applicable data protection legislation, in particular the following:

  • Act CXII of 2011 - on the right to informational self-determination and freedom of information
  • ( Info TV);
  • Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 – on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR);
  • Act V of 2013 – on the Civil Code (Civil Code);
  • Act XLVIII of 2008 - on the basic conditions and certain limitations of economic advertising activities ( Grt .);
  • Act XLVII of 2008 - on the prohibition of unfair commercial practices towards consumers ( Fttv ) (with particular regard to its annex - "blacklist", point 28).

2. COMPANY

Name: DEDU Digital Education Information Technology, Communication and Service Provider Limited Liability Company (DEDU Ltd.)

Headquarters: 1096 Budapest, Thaly Kálmán Street 39.

Company registration number: 01 09 329601

Name of the registering court: Commercial Court of the Metropolitan Court

Tax number: 26513344243

Email: info@dedu.hu

3. WHAT PERSONAL DATA DO WE COLLECT?

The Company's data processing activities are based on voluntary consent, the Company's legitimate interests or legal authorization. In the case of data processing based on voluntary consent, you may withdraw your consent at any stage of data processing or exercise your rights related to data processing in terms of access, correction, restriction and deletion.

In certain cases, the processing, storage and transmission of a range of the data provided is mandatory by law, of which we will notify you separately.

Personal data means any information about you that can be used to identify you, such as your name, contact details, etc., and information about your use of our Website and Mobile app that can directly or indirectly identify you.

We may collect personal data about you when you use our Website and Mobile app, subscribe to our newsletter, or contact us, etc.

In particular, we may collect the following types of data:

  • Email address;
  • Information about your use of our Website and Mobile app;
  • All communications exchanged with us or addressed to us, by letter or email;
  • Location, the geographical location of your computer or device, determined using its real-time IP address, if you use and enable location-based services on your device or computer.
  • Data that can be collected regarding the Kajla passport:
    • name;
    • email address;
    • photo – what you share to generate the profile picture;
    • country;
    • Location, the geographical location of your computer or device, determined using its real-time IP address, if you use and enable location-based services on your device;
  • Data that can be collected regarding the Kajla passport:
    • name;
    • country;
    • accommodation in Hungary;
    • parents' names and phone numbers;
    • Kajla's passport number;

4. WHAT, WHY AND FOR HOW LONG DO WE USE YOUR PERSONAL DATA?

We collect your personal data primarily for the purpose of participating in the Campaign, sending notifications, contacting you, sending newsletters, and organizing a prize draw on the basis of voluntary consent, legitimate interest, or legal authorization, about which we will not send any further notice beyond what is stated in this notice. You may object at any time to the processing of your personal data for the purpose of general business and consumer relations. In this case, your personal data will no longer be processed for this purpose.

If we collect your personal data for purposes other than participation in a Campaign, sending notifications, or contacting you, we will inform you of the different legal basis or request your prior written consent in accordance with the applicable rules.

We may use your data for the following purposes for a maximum of 4 months after the campaign has ended, for statistical and complaint management purposes:

  • Registration and login, use of the Website
    The Website provides information to users about the Kajla Passport stamping locations and the list of partners offering discounts for using the Passport. The general contents of the Website are available without registration.
  • Registration and login, use of the Mobile app
    The use of the Mobile app requires registration. This is necessary to save your results during the games, earned points, and the for the gift redeem.
  • Sending a newsletter
    If the User gives his consent, he can be regularly informed about the latest news, discounts, campaigns and their current status in a newsletter. Newsletters - in case of consent - are only sent to registrants over the age of 18.
    Newsletter sending service provider only in case of Partner registration: MailChimp (The Rocket Science Group, LLC (675 Ponce de Leon, Ave NE Suite 5000, Atlanta, GA 30308 USA)
    Scope of data processed: company name, contact person's name, contact person's email address. Legal basis for data processing: voluntary consent.
    Duration of data processing: until the data subject unsubscribes from the newsletter list or gives confirmation by clicking on the link at the bottom of the newsletters.
  • Sending notifications;
    In order to maintain contact, the Company may send notifications and system messages. The scope of the data processed: name, email address.
    Legal basis for data processing: voluntary consent, legitimate interest (GDPR Article 6 (1) ( f)). Duration of data processing: until the goal is achieved, until the Campaign is closed, until the consent is withdrawn by the legal representative.
  • Personal data that can be collected at Kajla stamping points (by signing a voluntary consent statement)
    By signing a voluntary consent statement at the stamping points, photographs and video recordings of parents and children can be taken, which the operator of the stamping point can forward to the campaign organizer.
    The scope of the processed data: parent's name, mother's name, address, children's names. Legal basis for data processing: voluntary consent.
    Duration of data processing: until the goal is achieved, until the Campaign is closed, until the consent is withdrawn by the legal representative.
  • Sending a product requested online;
    For products requested to an address during promotions, the Company uses the address for the purpose of sending the package.
    The scope of the processed data: name, address given as the place of delivery, email address.
    Legal basis for data processing: voluntary consent, legitimate interest (GDPR Article 6 (1) ( f)). Duration of data processing: until the goal is achieved, until the Campaign is closed, until the consent is withdrawn by the legal representative.
  • Profiling
    Profiling : any form of automated processing of personal data, during which personal data is used to evaluate certain personal characteristics relating to a natural person. The Company may carry out such activities for statistical purposes. The scope of the processed data: download number, geographical distribution ( geolocation , IP address).
    Legal basis for data processing: voluntary consent, legitimate interest (GDPR Article 6 (1) (f)). Duration of data processing: until the purpose is achieved, until the Campaign is closed, until the consent is withdrawn by the legal representative.
  • Complaint handling
    Data processing in accordance with the procedure specified in Section 6 of the General Participation Rules. The scope of data processed: name, address, email address.
    Legal basis for data processing: voluntary consent, legitimate interest (GDPR Article 6 (1) ( f)). Duration of data processing: until the purpose is achieved, until the Campaign is closed, until the consent is withdrawn by the legal representative.
  • Administrative and legal purposes
    We use your data in the event of disputes or legal claims, official or court requests.
    The scope of the data processed: name, email address. Legal basis for data processing: statutory authorization.
    Duration of data processing: until the purpose is achieved, until the Campaign is closed, until the consent is withdrawn by the legal representative, but no longer than until the purpose specified in the law is achieved, for a period prescribed by the competent authority.
  • Security and administrative measures, prevention/detection of crimes
    In order to fulfill our legal obligation, we may transfer your data to government authorities or law enforcement agencies.
    Scope of data processed: name, email address. Legal basis for data processing: legal authorization.
    Duration of data processing: until the purpose is achieved, until the Campaign is closed, until the consent is withdrawn by the legal representative, but no longer than until the purpose specified in the law is achieved, for a period prescribed by the competent authority.

We only process your personal data where we have a legal basis for doing so. The legal basis depends on the purpose for which we collected the data and the purpose for which we need to use it. We may also process your personal data for the following reasons:

  • You have given your consent to the use of your personal data (e.g. for marketing purposes);
    Only children aged 16 or over can give their own consent. For persons under 16, the consent of their parents or legal guardian is required.
  • To protect your or another person's vital interests.

We will retain your data until you withdraw your consent or until the statutory deadline expires.

We will not retain your data for longer than is necessary to fulfil the purposes for which we process it. To determine the appropriate retention period, we will take into account the amount, nature and sensitivity of the personal data, the purposes for which we process it, and whether we can achieve those purposes by other means.

5. SHARING YOUR PERSONAL DATA

We may share your personal data with other companies within the European Union that we have entrusted with the processing of data recorded on our Website, on our Mobile app and/or with the operation, maintenance or management of our Website and Mobile app, its services or content in accordance with this privacy statement in order to comply with the data protection purposes. The entrusted companies will use the personal data only within the framework of the mandate received and in accordance with the terms of this privacy statement.

We will not transfer your personal data to third countries or international organizations outside the European Union.

In addition, in accordance with the purpose of this Privacy Policy, we may share your personal data with the following third parties:

  • Our permanent partners:
    Hosting provider: Servergarden Kft. (1139 Budapest, Váci út 99-105. Balance Building. 3rd floor)
    Newsletter sending service: MailChimp : The Rocket Science Group, LLC (675 Ponce de Leon, Ave NE Suite 5000, Atlanta, GA 30308 USA)
    Google Inc. (1600 Amphitheatre Parkway , Mountain View , CA 94043, USA)
  • Mobile app: during the registration the profile picture will be generated with OpenAI – means, the picture you upload will be shared with OpenAI: OpenAI Ireland Limited, with its registered office at 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, is the controller and is responsible for the processing of your Personal Data as described above.
  • With government authorities, regulatory authorities; we will only share your data based on legal requirements, if this is necessary to prevent and detect fraud or other crimes, and/or to maintain network and data security;
  • With trusted service providers who help us run our business, such as companies that provide postal or courier services, newsletters, games, cloud-based services that help our marketing team;
  • With legal and other professional advisors, courts and law enforcement agencies.

6. METHOD OF STORAGE OF PERSONAL DATA, SECURITY OF DATA PROCESSING

The Company performs electronic data processing and registration using a computer program that meets the requirements of data security. The program ensures that data is accessed only for a specific purpose and under controlled circumstances by those persons who need it to perform their tasks. The Company protects its IT systems with a firewall and provides virus protection. The Company's IT systems and other data storage locations are located at its headquarters and at its data processors. The Company ensures that data is accessed only for a specific purpose and under controlled circumstances by those persons who need it to perform their tasks.

The Company selects and operates the IT tools used to process personal data during the provision of the service in such a way that the processed data:

  • accessible to those authorized to do so (availability);
  • its authenticity and authentication are ensured (authentication of data processing);
  • its immutability can be verified (data integrity);
  • be protected against unauthorized access (data confidentiality).

The Company protects the data with appropriate measures, in particular against unauthorized access, alteration, transmission, disclosure, deletion or destruction, as well as accidental destruction, damage, and inaccessibility resulting from changes in the technology used.

In order to protect the data files managed electronically in its various registers, the Company ensures with appropriate technical solutions that the stored data cannot be directly linked and assigned to the data subject, unless permitted by law.

In view of the current state of technology, the Company ensures the protection of the security of data processing with technical, organizational and organisational measures that provide a level of protection appropriate to the risks associated with data processing.

The Company retains the following during data processing:

  • confidentiality: protects information so that only those who are authorized to access it can access it;
  • integrity: protects the accuracy and completeness of the information and the processing method;
  • Availability: ensures that when the authorized user needs it, they can actually access the desired information and that the related tools are available.

Informing the data subject about the data protection incident

If the data breach is likely to result in a high risk to the rights and freedoms of natural persons, according to the Company's classification, we will inform you of the data breach without undue delay and provide you with the information referred to in points (b), (c) and (d) of Article 33(3) of the GDPR.

7. CONTACT US

If you contact us, you can contact the Company using the contact details provided in this information or on the website.

The Company deletes all e-mails received, including the sender's name, e-mail address, date, time and other personal data provided in the message, no later than 5 years after the data was disclosed.

8. OTHER DATA PROCESSING

We will provide information about data processing not listed in this information when the data is collected.

We inform you that the court, the prosecutor, the investigating authority, the misdemeanor authority, the administrative authority, the National Data Protection and Freedom of Information Authority, the Hungarian National Bank, or other bodies authorized by law may contact the Company to provide information, communicate or transfer data, or make documents available.

The Company will only provide personal data to the authorities – if the authority has specified the exact purpose and scope of the data – to the extent and insofar as this is absolutely necessary to achieve the purpose of the request.

9. COOKIES, TRACKING, WEB ANALYTICS, SOCIAL MEDIA INTEGRATION

In order to provide a personalized service, the service provider places a small data package, called a cookie , on the user's computer and reads it back during the subsequent visit. If the browser sends back a previously saved cookie, the service provider managing the cookie has the opportunity to connect the user's current visit with previous ones, but only with regard to its own content.

The purpose of data processing is: to identify and distinguish users from each other, to identify the current session of users, to store the data provided during it, to prevent data loss, to identify and track users, and to perform web analytics measurements.

The legal basis for data processing is: data processing for statistical purposes and ensuring the appropriate user experience and proper functioning of the Website and Mobile app (legitimate interest of the data subjects), and/or the consent of the data subject.

The scope of personal data processed: IP address.

The source code of the Website and Mobile app operated by the Company may contain links to and from independent external servers for web analytics measurements. The measurement also includes tracking conversions. The web analytics service provider does not process personal data, only browsing-related data that is not suitable for identifying individuals. Currently, web analytics services are provided by Google Inc. (1600 Amphitheatre Parkway , Mountain View , CA 94043), within the framework of the Google Analytics service.

Cookies from their own computer or prohibit their use in their browser. These options depend on the browser, but are typically available in the Tools/Settings/Privacy/History/Preferences menu item .

Possible consequences of failure to provide data: incomplete availability of the website's services, inaccuracy of analytical measurements.

Google Analytics

The Website may use Google Analytics , a service provided by Google Inc. (1600 Amphitheatre Parkway , Mountain View , CA 94043, USA) (“Google”). Google Analytics uses cookies .

Your IP address is recorded as part of the use of cookies by Google Analytics . However, the IP address of website visitors is shortened before storage or analysis, thereby anonymizing it , if technically possible. After anonymization , personal data no longer has the character of personal data. Anonymization takes place within the European Union or the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the United States for shortening. Google Analytics We use the data recorded by cookies to analyze the user behavior of visitors to the Website.

Google does not combine the IP address transmitted by your browser with other data in connection with Google Analytics .

of Google Analytics cookies in the appropriate settings of your browser (for more information, see our cookie guide indicated in Section VI .). Please note that in this case you may not be able to use some of the functions of the Website.

You can also prevent Google Analytics from processing your data by downloading and installing the browser add-on available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en .

Google Remarketing

remarketing , Google's Remarketing service, on our website .

These service providers may collect or receive data from the Data Controller's website and other Internet locations using cookies , web beacons and similar technologies. They use this data to provide measurement services and target advertisements . Such targeted advertisements may appear on additional websites in Google's partner network. Remarketing lists do not contain the visitor's personal data and are not suitable for personal identification.

You can disable Google's use of cookies in Google's Advertising Settings. Network Advertising You can also disable cookies from third-party providers on the Initiative opt-out page.

For more information about Google's privacy policy, please visit: http://www.google.com/privacy.html

11. YOUR DATA PROTECTION RIGHTS AND LEGAL REMEDIES

You may request information about the processing of your personal data, as well as request the correction of your personal data, or - with the exception of mandatory data processing - its deletion or withdrawal, and you may exercise your right to data portability and objection in the manner indicated when collecting the data, or at the Company's contact details above.

Right to information:

The Company shall take appropriate measures to provide data subjects with all information referred to in Articles 13 and 14 of the GDPR regarding the processing of personal data and all information pursuant to Articles 15-22 and 34 in a concise, transparent, intelligible and easily accessible form, in clear and plain language.

The right to information can be exercised in writing through the contact details indicated in point II. Upon your request, information can also be provided orally – after verification of your identity.

Your right to access your data:

You have the right to receive feedback from the Company as to whether your personal data is being processed and, if such processing is taking place, you have the right to access the personal data and the following information: the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipients to whom the personal data have been or will be disclosed, including in particular recipients in third countries or international organisations; the planned storage period of the personal data; the right to rectification, erasure or restriction of processing and to object; the right to lodge a complaint with a supervisory authority; information on the sources of the data; the fact of automated decision-making, including profiling, as well as intelligible information on the logic involved and the significance and foreseeable consequences of such processing for the data subject. If personal data is transferred to a third country or international organization, you have the right to be informed about the appropriate safeguards for the transfer.

The Company will provide you with a copy of the personal data that is the subject of the data processing. For additional copies requested by you, the Company may charge a reasonable fee based on administrative costs. Upon request of the data subject, the Company will provide the information in electronic form.

The Company shall provide the information within a maximum of one month from the date of submission of the request.

Right to rectification:

You may request the correction of inaccurate personal data concerning you processed by the Company and the completion of incomplete data.

Right to erasure:

You have the right to request that the Company erase your personal data without undue delay if one of the following reasons applies:

  • personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
  • You withdraw your consent which is the basis for the data processing and there is no other legal basis for the data processing;
  • You object to the processing and there are no overriding legitimate grounds for the processing;
  • the personal data has been processed unlawfully;
  • the personal data must be erased to comply with a legal obligation under EU or Member State law applicable to the Company;
  • the personal data were collected in connection with the provision of information society services.

The deletion of data cannot be initiated if the data processing is necessary: for the purpose of exercising the right to freedom of expression and information; for the fulfillment of an obligation under EU or Member State law to which the Company is subject to the processing of personal data, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Company; for the purpose of public health, or for archiving, scientific and historical research purposes or statistical purposes, based on public interest; or for the establishment, exercise or defence of legal claims.

The right to restrict data processing:

At your request, the Company will restrict data processing if one of the following conditions is met:

  • You dispute the accuracy of the personal data, in which case the restriction applies for a period that allows you to verify the accuracy of the personal data;
  • the processing is unlawful and you oppose the erasure of the data and instead request the restriction of its use;
  • the Company no longer needs the personal data for the purposes of data processing, but the data subject requires them for the establishment, exercise or defense of legal claims; or
  • You have objected to the processing; in this case, the restriction applies for the period until it is determined whether the legitimate grounds of the Company override those of the data subject.
  • If processing is subject to restrictions, personal data may only be processed, with the exception of storage, with your consent, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for important public interest reasons of the Union or a Member State.
  • The Company will inform you in advance of the lifting of the restriction on data processing.

Right to data portability:

You have the right to receive the personal data concerning you, which you have provided to the Company, in a structured, commonly used and machine-readable format and to transmit these data to another data controller.

Right to object:

You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Company, or processing necessary for the purposes of the legitimate interests pursued by the Company or by a third party, including profiling based on the aforementioned provisions. In the event of an objection, the Company shall no longer process the personal data unless there are compelling legitimate grounds for doing so which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

If the processing of personal data is carried out for the purpose of a direct general business-to-consumer relationship, you have the right to object at any time to the processing of personal data concerning you for this purpose, including profiling, insofar as it is related to the direct business-to-consumer relationship.

In the event of an objection to the processing of personal data for the purpose of general business and consumer relations, the data may not be processed for this purpose.

Automated decision-making in individual cases, including profiling:

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

The above right does not apply if the data processing

  • Necessary for the purpose of entering into or performing a contract between you and the Company;
  • is permitted by Union or Member State law applicable to the Company, which also lays down suitable measures to safeguard the rights and freedoms and legitimate interests of the data subject; or
  • based on your express consent.

Right of withdrawal:

You have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Rules of procedure:

The Company shall inform the data subject without undue delay, but in any case within one month of receipt of the request, of the measures taken in response to the request pursuant to Articles 15 to 22 of the GDPR. If necessary, taking into account the complexity of the request and the number of requests, this deadline may be extended by a further two months.

The Company will inform you of the extension of the deadline, indicating the reasons for the delay, within one month of receipt of the request. If you submitted the request electronically, the information will be provided electronically, unless you request otherwise.

If the Company does not take action on your request, it will inform you without delay, but no later than one month from the receipt of the request, of the reasons for the failure to take action and of the possibility of lodging a complaint with a supervisory authority and exercising your right to a judicial remedy.

The Company shall provide the requested information and communication free of charge. If your request is manifestly unfounded or excessive, in particular due to its repetitive nature, the Company may charge a reasonable fee, taking into account the administrative costs of providing the requested information or communication or taking the requested action, or may refuse to take action on your request.

The Company shall inform all recipients to whom the personal data have been disclosed of any rectification, erasure or restriction of processing made by it, unless this proves impossible or involves a disproportionate effort. Upon request, the Company shall inform the data subject of these recipients.

The Company shall provide the data subject with a copy of the personal data subject to data processing. For additional copies requested by the data subject, the Company may charge a reasonable fee based on administrative costs. If the data subject has submitted the request electronically, the information will be provided in electronic format, unless the data subject requests otherwise.

Right to go to court:

The data subject may take legal action against the Company in the event of a violation of his or her rights. The court shall proceed with the case promptly.

Data protection authority procedure:

You can file a complaint with the National Data Protection and Freedom of Information Authority:

Name: National Data Protection and Freedom of Information Authority

Headquarters: 1125 Budapest, Szilágyi Erzsébet fasor 22/C.

Mailing address: 1530 Budapest, P.O. Box: 5.

Phone: 06 1 391 1400

Fax: 06 1 391 1410

E-mail: ugyfelszolgalat@naih.hu

Website: http://www.naih.hu

12. CHANGES TO THE PRIVACY POLICY

Please note that we are entitled to unilaterally change the provisions of this Data Management and Privacy Policy within the framework of the applicable legislation. Amendments to the Data Management and Privacy Policy are effective from the time of their publication on the Website. The Company notifies Users of the amendment to the Data Management and Privacy Policy electronically by informing the User about the amendment in a pop-up window upon their first login following the amendment. The User accepts the amendment by checking the box before logging in. If the User does not agree with the amendment and does not actively accept it, he/she is no longer entitled to use the Website.