Privacy Policy
Introduction
I. It is very important to us to comply fully with the data protection rules in force at any given time and with the applicable statutory provisions. Below, we describe in detail the measures taken by www.ilockedyou.hu and B MISSION KFT (hereinafter collectively: “Service Provider”) to protect the data of data subjects, as well as the data processing operations carried out in the course of providing our services.
We treat personal data confidentially at all times and take all necessary security, technical and organizational measures to guarantee the security of personal data.
II. The purpose of this Privacy Policy is to set out the principles and rules governing the processing of personal and other data in the course of our activities, and to provide data subjects (applicants/visitors/players) with the necessary information.
The Service Provider does not carry out automated decision-making or profiling, and we do not transfer data to third countries. Only the Service Provider and its employees have access to the data.
The Service Provider reserves the right to amend this Privacy Policy, in which case it shall notify data subjects within the shortest possible time.
Key Definitions
“GDPR” – REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);
“personal data” – any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
“processing” – any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
“profiling” – any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements;
“pseudonymization” – the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person
“filing system” – any structured set of personal data which are accessible according to specific criteria, whether centralized, decentralized or dispersed on a functional or geographical basis;
“controller” – the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;
“processor” – a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller; “recipient” – a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities
shall be in compliance with the applicable data protection rules according to the purposes of the processing;
“consent of the data subject” – any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
“personal data breach” – a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed;
Data Processing in the Course of the Service Provider’s Activities
Types of personal data processed:
In the course of its activities, the Service Provider offers exciting, creative and entertaining escape room games through registration on the www.ilockedyou.hu website.
- Visitors can sign up for a game after registering on the website. When signing up, the Service Provider processes the players’ name, email address and phone number as personal data.
- We issue an invoice for payment of the service fee, for which it is essential to process the players’ name and address.
- In addition, so-called technical data are processed, which include data generated while using the website, such as IP address, login information, browser data, time spent on individual pages, page views and navigation paths, and the number and time of visits to the pages.
The legal basis for processing the data is the consent of the data subject.
Purpose of processing:
- The purpose of processing the data required for participation in the game is to register visitors and to provide the service.
- The purpose of processing the personal data required for invoicing is to enable the Service Provider to issue an invoice for payment of the fee in accordance with the accounting laws.
- We process these data in order to maintain the secure operation of our website.
Legal basis for processing:
- For the data required for participation in the game: the consent of the data subject.
- For the personal data required for invoicing: the provisions on the obligation to issue invoices of 2007. évi CXXVII. törvény (Act CXXVII of 2007 on Value Added Tax, “VAT Act”).
- The consent of the player.
Duration of processing:
- For no more than 3 working days after the service (game) has been provided, but in any case no more than 3 working days after the expiry of the validity period of the coupon granting access to the game.
For the period prescribed by 2007. évi CXXVII. törvény (Act CXXVII of 2007 on Value Added Tax, “VAT Act”), by 23/2014. (VI. 30.) NGM rendelet (Decree 23/2014 (VI. 30.) of the Minister for National Economy on the tax administration identification of invoices and receipts and on the tax authority audit of invoices retained in electronic form), and by 1/2018. (VI. 29.) ITM rendelet (Decree 1/2018 (VI. 29.) of the Minister for Innovation and Technology on the rules of digital archiving), but for no longer than 8 years. - For no more than 3 working days after the service (game) has been provided, but in any case no more than 3 working days after the expiry of the validity period of the coupon granting access to the game.
Data processors:
- Name of data processor: Mailchimp, The Rocket Science Group, LLC
Registered office of data processor: 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308 USA.
Purpose: Sending newsletters
- Name of data processor: booked4us
Registered office of data processor: (registered office: 2600 Vác, Zichy Hippolyt utca 12.)
Purpose: Processing the data required for booking time slots on the website
- Name of data processor: Németh Dániel Egyéni Vállalkozó (sole proprietor), hosting provider
Registered office of data processor: 2230, Gyömrő, Zrínyi utca 1.
Purpose: Hosting provider; stores personal data. It is not authorized to access the content of the personal data.
Method of Storing Personal Data and Security of Processing
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Service Provider implements appropriate technical and organizational measures to ensure a level of data security appropriate to the risk.
We select and operate the IT tools used for processing personal data in the course of providing the service in such a way that the processed data are accessible to authorized persons, that the processing is authentic, that data integrity is ensured, and that the data are protected against unauthorized access,
Furthermore, we protect the data with appropriate measures, in particular against unauthorized access, alteration, transmission, disclosure, erasure or destruction, as well as against accidental destruction, damage, and loss of accessibility resulting from changes in the technology used.
By means of appropriate technical solutions, we ensure that the stored data cannot be directly linked to other data sets processed electronically in different records or attributed to the data subject.
In addition, we ensure the security of processing through technical, organizational and structural measures that provide a level of protection appropriate to the risks associated with the processing.
In the course of processing, the Service Provider
- protects information so that only those authorized to do so can access it,
- protects the accuracy and completeness of the information and of the processing method, and
- ensures that, when an authorized user needs it, they can actually access the required information and that the related tools are available.
Our IT system and network are both protected against various cyberattacks. We ensure security through server-level and application-level protection procedures
The Service Provider, as controller, keeps a record of any personal data breaches, indicating the facts relating to the personal data breach, its effects and the remedial action taken.
The Service Provider shall notify any personal data breach to the Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian National Authority for Data Protection and Freedom of Information) without undue delay and, where feasible, no later than 72 hours after having become aware of it, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.
Controller details and contact information
www.ilockedyou.hu and B MISSION KFT
tax number: 32422698-2-41
registered office: 1133, Bp, Ipoly 26b
contact: info@ilockedyou.hu
Data Subject Rights and Legal Remedies
Data subjects may request information about the processing of their personal data, and may request the rectification of their personal data and – with the exception of mandatory processing – their erasure, withdraw their consent, request the restriction of processing, and exercise their right to data portability and their right to object in the manner indicated at the time the data were collected, via the controller’s contact details above or through its customer service.
Right to information:
At the request of the data subject, the Service Provider shall take appropriate measures to provide data subjects with all information referred to in Articles 13 and 14 of the GDPR and any communication under Articles 15–22 and 34 relating to the processing of personal data in a concise, transparent, intelligible and easily accessible form, using clear and plain language.
Right of access by the data subject:
The data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information: the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations; the envisaged period for which the personal data will be stored; the right to request rectification, erasure or restriction of processing and the right to object; the right to lodge a complaint with a supervisory authority; information on the source of the data; the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. Where personal data are transferred to a third country or to an international organization, the data subject has the right to be informed of the appropriate safeguards relating to the transfer.
The Service Provider shall provide the data subject with a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. At the request of the data subject, the Service Provider shall provide the information in electronic form.
The right to information may be exercised in writing via the contact details indicated.
At the data subject’s request – after credible proof and verification of their identity – information may also be provided orally.
Right to rectification:
The data subject may request the rectification of inaccurate personal data concerning him or her processed by the Service Provider and the completion of incomplete data. To have your personal data modified, please contact the Service Provider at its official email address, the info@ilockedyou.hu address.
Right to erasure:
The data subject has the right to obtain from the Service Provider, at his or her request, the erasure of personal data concerning him or her without undue delay where one of the following grounds applies:
- the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- the data subject withdraws the consent on which the processing is based, and there is no other legal ground for the processing;
- the data subject objects to the processing and there are no overriding legitimate grounds for the processing;
- the personal data have been unlawfully processed;
- the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
- the personal data have been collected in relation to the offer of information society services.
Erasure of data cannot be requested where processing is necessary: for exercising the right of freedom of expression and information; for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; for reasons of public interest in the area of public health, or for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes; or for the establishment, exercise or defense of legal claims.
To have your personal data erased, please contact the Service Provider at its official email address, the info@ilockedyou.hu address.
Right to restriction of processing:
At the request of the data subject, the Service Provider shall restrict processing where one of the following applies:
- the accuracy of the personal data is contested by the data subject, in which case the restriction applies for a period enabling the accuracy of the personal data to be verified;
- the processing is unlawful and the data subject opposes the erasure of the data and requests the restriction of their use instead;
- the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defense of legal claims; or
- the data subject has objected to processing; in this case, the restriction applies pending the verification of whether the legitimate grounds of the controller override those of the data subject.
Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
The Service Provider shall inform the data subject in advance before the restriction of processing is lifted.
To have the processing of your personal data restricted, please contact the Service Provider at its official email address, the info@ilockedyou.hu address.
Right to data portability:
The data subject has the right to receive the personal data concerning him or her, which he or she has provided to the controller, in a structured, commonly used and machine-readable format, and has the right to transmit those data to another controller.
Right to object:
The data subject has the right to object, on grounds relating to his or her particular situation, at any time to the processing of personal data concerning him or her which is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or which is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, including profiling based on those provisions.
In the event of an objection, the controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defense of legal claims.
Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.
Where the data subject objects to processing for direct marketing purposes, the Service Provider shall no longer process the personal data for such purposes.
Automated individual decision-making, including profiling
The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
The above right shall not apply if the decision
- is necessary for entering into, or performance of, a contract between the data subject and the controller;
- is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or
- is based on the data subject’s explicit consent.
Right to withdraw consent
The data subject has the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
Procedural rules
The controller shall provide information on action taken on a request under Articles 15–22 of the GDPR to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests.
The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.
If the controller does not take action on the request of the data subject, it shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
The Service Provider shall provide the requested information and communications free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either charge a reasonable fee, taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request.
The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out by it to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.
The controller shall provide the data subject with a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, the information shall be provided in a commonly used electronic form, unless otherwise requested by the data subject.
Compensation and restitution for non-pecuniary damage (sérelemdíj):
Any person who has suffered material or non-material damage as a result of an infringement of the General Data Protection Regulation shall have the right to receive compensation from the controller or processor for the damage suffered. A processor shall be liable for the damage caused by processing only where it has not complied with obligations under the law specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller.
Where more than one controller or processor, or both a controller and a processor, are involved in the same processing and are responsible for any damage caused by processing, each controller or processor shall be held liable for the entire damage jointly and severally.
A controller or processor shall be exempt from liability if it proves that it is not in any way responsible for the event giving rise to the damage.
Right to go to court:
In the event of an infringement of their rights, data subjects may bring proceedings against the controller before the court (having jurisdiction, at the data subject’s choice, based on the defendant’s registered office or the data subject’s place of residence). The court shall hear the case as a matter of priority. Proceedings relating to the protection of personal data are exempt from court fees.
Data protection authority proceedings:
Complaints may be lodged with the Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian National Authority for Data Protection and Freedom of Information):
Name: Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian National Authority for Data Protection and Freedom of Information)
Registered office: 1125 Budapest, Szilágyi Erzsébet fasor 22/C.
Mailing address: 1530 Budapest, Pf.: 5.
Marketing Communications
Marketing communication is essential to the business’s activities. The legal basis for the related processing is the interest shown in our services or the users’ explicit consent.
In accordance with the European Union Privacy and Electronic Communications Regulations (PECR), we send marketing messages to our users if they have made a purchase from us or have explicitly consented to receiving marketing messages.
We always make it clearly visible how to withdraw consent and unsubscribe from our messages. Every email contains an unsubscribe link at the bottom, or removal from our database can be requested at info@ilockedyou.hu.
Even if you unsubscribe from marketing communications, we may still send you messages, but only regarding the fulfillment of your orders.
Anonymized data and “COOKIES”
The www.ilockedyou.hu website, as well as our email messages and advertisements, use so-called “cookies” and similar technologies, such as tracking codes, remarketing tags and pixels, which are activated only after the user has given consent.
These technologies help us better understand users’ behavior and interests, thereby supporting a higher-quality and more efficient operation.
Our goal is to make using www.ilockedyou.hu as user-friendly and personalized as possible. If users wish to prevent these technologies from recording non-personal data, they can do so in the following ways:
- by blocking them from loading using the cookie notices displayed on the website
- by disabling “cookies” in the browser
- or by using this tool (http://www.youronlinechoices.eu/)
If you have any questions, please feel free to contact us at info@ilockedyou.hu.