Privacy Statement
ONE LOFT HUNGARY Limited Liability Company (registered office: 8435 Gic, Petőfi utca 7.; company registration number: 19-09-525247; tax number: 25782402-2-19; e-mail address: info@derbyhungary.hu; telephone number: +36 20 482 1333; hereinafter referred to as: "Data controller”) personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter referred to as “GDPR”), Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (hereinafter referred to as “infotv.”), and in accordance with the provisions of other applicable Hungarian laws.
The purpose of this data management notice is to provide detailed information about the data processing carried out on the derbyhungary.hu website, pigeon races, and related auction and brokerage services.
1. Data controller's data
1.1. Name: ONE LOFT HUNGARY Ltd.
1.2. Registered office: 8435 Gic, Petőfi Street 7.
1.3. Company registration number: 19-09-525247
1.4. Tax number: 25782402-2-19
1.5. Email address: info@derbyhungary.hu
1.6. Telephone number: +36 20 482 1333
1.7. Website: https://derbyhungary.hu/
1.8. The Data Controller is not obliged to appoint a data protection officer pursuant to Article 37 of the GDPR.
1.9. Hosting provider details:
1.9.1. Name: DotRoll Ltd.
1.9.2. Registered office: 1148 Budapest, Fogarasi út 3–5.
1.9.3. Telephone number: +36 1 432 3232
1.9.4. Email address: support@dotroll.com
1.9.5. Website: https://dotroll.com/hu/
1.10. Contact for data protection matters: info@derbyhungary.hu You may request information by e-mail or by post to the registered office of the Data Controller. The Data Controller will send its response within 1 month at the latest.
2. The Data Controller follows the following principles in particular when processing personal data:
2.1. processes personal data lawfully and fairly, and in a manner that is transparent to Users;
2.2. collects personal data only for specified, explicit and legitimate purposes;
2.3. only processes personal data necessary to achieve the purpose of data processing;
2.4. takes all reasonable measures to ensure that the data processed is accurate and up-to-date;
2.5. store personal data only for the necessary period;
2.6. ensures the security of personal data through appropriate technical and organizational measures;
2.7. processes the personal data of Users based on the prior informed and voluntary consent of the Users, or on the applicable legal grounds – in particular, the performance of a contract, the fulfillment of a legal obligation or legitimate interest.
3. Scope of Users
3.1. For the purposes of this data protection notice, "User" means any natural person who visits the derbyhungary.hu website, contacts the Data Controller, registers on the website, enters a pigeon race, uses the auction platform, bids, purchases, or otherwise uses the Data Controller's services.
3.2. The circle of Users includes in particular the following persons:
3.2.1. breeders entering pigeon races;
3.2.2. persons registering on the website;
3.2.3. buyers bidding on or purchasing the winning pigeons;
3.2.4. website visitors;
3.2.5. the persons initiating the contact.
4. Scope of personal data processed
4.1. Data processed during registration and entry
4.1.1. The Data Controller may in particular process the following data:
4.1.1.1. name;
4.1.1.2. address or registered office;
4.1.1.3. email address;
4.1.1.4. telephone number;
4.1.1.5. billing information;
4.1.1.6. breeder identifiers;
4.1.1.7. data of the pigeons named.
4.1.2. In addition to the above, the Data Controller may process:
4.1.2.1. identification data related to the user account;
4.1.2.2. auction and bidding data;
4.1.2.3. transaction and payment data, as well as the content of communication between the User and the Data Controller;
4.1.2.4. technical data related to the use of the website (e.g. IP address, log files).
4.2. The User voluntarily provides personal data to the Data Controller, for example by submitting a registration form, entering an entry, contacting us or using the auction platform. The User is responsible for ensuring that the data provided is true, accurate and up-to-date.
4.3. If the User provides the data of another person, the Data Controller assumes that the User is authorized to provide the data.
5. Details of data processing
5.1. Personal data is always processed for specific purposes in accordance with the provisions of the GDPR.
5.2. Registration and entry
5.2.1. The purpose of data processing is to create a user account and entry, administer participation in the competition, and manage and invoice the entry fee.
5.2.2. Affected Users: natural person nominators, breeders, or contact persons.
5.2.3. Scope of processed data: surname, first name, e-mail address, telephone number, billing address – including in particular the country, postal code, city and address –, entry parameters, entry fee summary, optional “early payment” statement, mandatory acceptance statement – including in particular the acceptance of the GTC and the data processing information – and data relating to the entered pigeons.
5.2.4. The legal basis for data processing is Article 6(1)(b) of the GDPR, i.e. performance of a contract.
5.2.5. The legal basis for processing of billing data is Article 6(1)(c) of the GDPR, i.e. compliance with a legal obligation, in particular compliance with accounting and tax legislation.
5.2.6. The legal basis for data processing in the area of system security logs and prevention of abuse is Article 6(1)(f) of the GDPR, i.e. the legitimate interest of the Data Controller.
5.2.7. Source of data: directly from the User, via the form, registration interface or other contact channel.
5.2.8. Storage period: the Data Controller will process the account and customer data related to the entry for a maximum of 5 years after the end of the competition, i.e. until the end of the general civil law limitation period or until the account is deleted, if there is no legal claim or retention obligation.
5.2.9. The Data Controller retains the data included in the accounting documents for 8 years in accordance with the Accounting Act.
5.2.10. Recipients / data processors: DotRoll Kft. as a hosting service provider, and if necessary, accounting or tax service providers, as well as IT operators. In the event of the use of a specific external service provider, the Data Controller will update this information accordingly.
5.3. Ensuring participation in pigeon competitions
5.3.1. The purpose of data management is to organize and conduct pigeon competitions, manage entries, provide competition administration, and ensure contact related to competitions.
5.3.2. The legal basis for data processing is Article 6(1)(b) of the GDPR, i.e. performance of a contract.
5.4. Operation of the auction system and provision of bidding
5.4.1. The purpose of data management is to mediate the sale of winning pigeons, operate the auction system, ensure bidding, and facilitate contact between breeders and buyers.
5.4.2. The legal basis for data processing is Article 6(1)(b) of the GDPR, i.e. performance of a contract.
5.4.3. The scope of the processed data includes in particular: the identification and contact data of the buyer and the breeder, data related to bidding, transaction and payment data, and delivery and contact data necessary for the transaction.
5.4.4. In the event of the sale of winning pigeons, personal data necessary for the transaction – in particular contact and delivery data – may be transmitted to the breeder and the buyer.
5.5. Contact
5.5.1. The purpose of data management is to maintain contact with Users, provide information, administer and ensure communication related to services.
5.5.2. Processed data: identification and contact information provided by the User, as well as the content of the message.
5.5.3. Legal basis for data processing: Article 6(1)(b) of the GDPR – performance of a contract; and Article 6(1)(f) of the GDPR – legitimate interest of the Data Controller.
5.5.4. In the case of legitimate interest, the Data Controller's legitimate interest is to ensure effective customer communication, handling of inquiries and administration related to services.
5.5.5. Retention period: the Data Controller processes the data provided during contact for a maximum of 1 year after the closure of the case, unless longer retention is necessary due to a legal dispute or the enforcement of a legal claim.
5.6. Fulfillment of invoicing and accounting obligations
5.6.1. The purpose of data processing is to issue invoices, record financial transactions, and fulfill accounting and tax obligations.
5.6.2. The legal basis for data processing is Article 6(1)(c) of the GDPR, i.e. compliance with a legal obligation.
5.7. Ensuring the operation and security of the website
5.7.1. The purpose of data management is to ensure the proper functioning of the website, maintain the security of IT systems, prevent unauthorized access, and detect possible abuse and fraud.
5.7.2. The legal basis for data processing is Article 6(1)(f) of the GDPR, i.e. the legitimate interest of the Data Controller.
5.8. Submission and enforcement of legal claims
5.8.1. The purpose of data management is to protect the rights of the Data Controller, to submit and enforce legal claims, and to handle any legal disputes.
5.8.2. The legal basis for data processing is Article 6(1)(f) of the GDPR, i.e. the legitimate interest of the Data Controller.
5.9. The Data Controller is entitled to process technical log data in order to ensure the security of the website and IT systems, including in particular the IP address, the time of access, and the logging of individual system events.
5.10. Marketing communication, newsletter
5.10.1. Currently, the registration form does not include a separate newsletter subscription. If the Data Controller launches a newsletter in the future, it will only be based on a separate, clear consent (opt-in).
5.10.2. Consent can be withdrawn at any time, free of charge, for example by unsubscribing. Unsubscribing will stop marketing communications; it will not affect data processing for contractual or statutory purposes, in particular invoicing.
5.11. Prize games
5.11.1. Occasional campaigns and prize games may be announced according to separate regulations. The Data Controller will always publish the regulations applicable to the given campaign or prize game in a clearly visible place on the website.
6. Duration of data management
6.1. The Data Controller processes personal data only for the purpose of data processing or for the retention period required by applicable law.
6.2. The retention period for each data processing is in particular as follows:
6.2.1. the data provided during registration will be processed by the Data Controller for the duration of the user account;
6.2.2. the Data Controller processes data related to participation in competitions, entries and use of the auction system until the contractual relationship exists and until the statute of limitations for civil law claims expires;
6.2.3. the Data Controller retains data related to invoicing and accounting for at least 8 years in accordance with accounting legislation;
6.2.4. the Data Controller processes the data provided during the contact process until the purpose of the contact is fulfilled or until any legal claims are settled;
6.2.5. the Data Controller processes technical data and log files related to the operation of the website for a maximum period of time for the security and operational purpose;
6.2.6. In the case of data processing based on consent, the Data Controller processes the data until the consent is withdrawn.
7. Data processors
7.1. The Data Controller is entitled to use data processors.
7.2. Data processors may in particular be involved in the following activities:
7.2.1. web hosting service;
7.2.2. IT operations;
7.2.3. invoicing and accounting;
7.2.4. email service;
7.2.5. payment services;
7.2.6. operation of the auction system.
7.3. Hosting provider: DotRoll Ltd. – web server operation and e-mail service.
7.4. System operation/WordPress plugins: registration forms and order/registration processes are implemented with WordPress plugins running on the website (e.g. form management plugins). External data transmission takes place only if necessary to fulfill the data processing purpose.
7.5. When a specific external service provider appears, the Data Controller will update this section.
7.6. Data processors may process personal data only on the instructions of the Data Controller.
7.7. If the scope of data processors changes, the Data Controller will incorporate the changes into this data processing information.
8. Data transfer
8.1. The Data Controller transfers personal data to third parties solely on the basis of legal obligation, performance of a contract or with the consent of the User.
8.2. In the event of the sale of winning pigeons, personal data necessary for the transaction – in particular contact and delivery data – may be transmitted to the breeder and the buyer.
8.3. Data transfer abroad is not typical. If the Data Controller uses a service provider outside the European Union or the European Economic Area in the future, data transfer will only take place with guarantees in accordance with the provisions of the GDPR.
8.4. In the event of an official request, the Data Controller will only provide personal data to the extent necessary.
9. Use of cookies
9.1. Cookies are small data files that are stored by the browser. The User can delete or disable them at any time in their browser; the “Help” menu of most browsers contains instructions.
9.2. The website provides brief information on the use of cookies upon first visit and – in the case of categories requiring consent – requests consent. Acceptance of cookies is not mandatory, however, some functions of the site may not be available without cookies necessary for operation.
9.3. The purpose of using cookies is in particular:
9.3.1. ensuring the proper functioning of the website;
9.3.2. user session management;
9.3.3. providing a login process;
9.3.4. statistical and analytical measurements;
9.3.5. detection of security incidents.
9.4. Categories of cookies on the website:
9.4.1. Necessary/functional cookies: maintaining the session, operating forms, security.
9.4.2. Functional cookies: remembering user settings.
9.4.3. Statistical/analytical cookies (if consented): anonymous analysis of visitor behavior (e.g. page views, clicks).
9.4.4. Marketing cookies (with consent): only if such a service is actually enabled on the website.
9.5. The use of cookies necessary for the operation of the website is essential for the proper functioning of the website. Cookies for analytical and marketing purposes are used only with the prior consent of the User.
9.6. A specific list of cookies is available in the cookie notice and on the cookie consent interface; these include the name, service provider, purpose and expiration data. Functional cookies are essential for the website to function.
9.7. The User has the right to manage or delete cookies in the browser settings.
10. Rights of Users
10.1. The User is entitled to:
10.1.1. request information about the processing of your personal data;
10.1.2. request access to your personal data;
10.1.3. request correction of your personal data;
10.1.4. request the deletion of your personal data;
10.1.5. request restriction of data processing;
10.1.6. object to data processing;
10.1.7. exercise your right to data portability.
10.2. If data processing is based on consent, the User has the right to withdraw his/her consent at any time.
10.3. The withdrawal of consent does not affect the lawfulness of data processing prior to withdrawal, nor does it affect data processing carried out by the Data Controller on other legal grounds, such as performance of a contract or compliance with a legal obligation.
10.4. The User may submit his/her request regarding the rights specified in this information to: info@derbyhungary.hu You can submit it by email or by post.
10.5. The Data Controller shall respond to the User's request within a maximum of 1 month. The information is generally free of charge. In the event of rejection, the Data Controller shall inform the User of his/her legal remedies.
11. Remedies
11.1. The User may file a complaint with the National Data Protection and Freedom of Information Authority (hereinafter: "the Authority").NAIH"):
11.1.1. Address: 1055 Budapest, Falk Miksa Street 9-11.
11.1.2. Mailing address: 1363 Budapest, P.O. Box: 9.
11.1.3. Email address: ugyfelszolgalat@naih.hu
11.1.4. Phone: +36 (1) 391-1400
11.1.5. Website: https://www.naih.hu/
11.2. The User also has the right to appeal to court in the event of the processing of his/her personal data.
12. Data security
12.1. The Data Controller ensures the security of personal data by means of appropriate technical and organizational measures and protects them in particular against unauthorized access, alteration, transmission, disclosure, deletion or damage.
12.2. The Data Controller strives to ensure that the IT systems used comply with data security requirements.
12.3. The Data Controller shall ensure, through appropriate technical and organizational measures, that only authorized persons have access to personal data.
12.4. The Data Controller's employees and collaborators, subject to a confidentiality obligation, may access personal data to the extent necessary to perform their duties.
12.5. The User is obliged to keep his/her password confidential.
13. Link to the GTC
13.1. This data processing information is www.derbyhungary.hu to be interpreted together with the General Terms and Conditions published on the website.
13.2. By registering, entering, bidding or using the services, the User declares that he has read and acknowledged this data processing information.
14. Amendment of the data processing information
14.1. The Data Controller is entitled to unilaterally amend this data management information.
14.2. The Data Controller makes the modified data processing information available by publishing it on the website.
14.3. Information related to data management is published on the derbyhungary.hu website.
14.4. This data management information is effective from the date of publication on the website.