DATA MANAGEMENT INFORMATION

 

Table of contents

 

  1. DATA CONTROLLER AND WEBSITE OPERATOR.
  2. SCOPE OF THE PRIVACY NOTICE.

TERMS USED IN THE PRIVACY NOTICE.

COMPLIANCE WITH THE DATA PROCESSING PRINCIPLES.

  1. PERSONAL DATA PROCESSING ACTIVITIES.
  2. Processing of data relating to panel membership.
  3. Messaging.
  4. Data on statements made by electronic means.
  5. Information about cookies.
  6. DATA SECURITY.

VII. RIGHTS OF DATA SUBJECTS.

VIII. ENFORCEMENT OPTIONS.

  1. ACCESS TO AND AMENDMENT OF THE PRIVACY NOTICE.

The purpose of this notice is to provide information to users of the www.median.hu Website and the Medián Voice service, accessible from the subdomain www.hangado.median.hu, on the details of the personal data processing activities that take place when they visit the website and use our services, in accordance with the provisions of the EU General Data Protection Regulation (GDPR)[1].

 

The rules of access to the website and the use of certain services are governed by the provisions of the General Terms and Conditions (GTC) posted on the Website.

 

  1. DATA CONTROLLER AND WEBSITE OPERATOR

Name of the service provider.

 

Registered office/address: 1124 Budapest, Fürj u. 2.B.

 

Address: 112425, Budapest, Hungary, 1124ján, address: 10276107-2-43,

 

Company registration number: 01 09 462730

 

Telephone number: 06 1 250 4322

 

E-mail: median@median.hu

 

Represented by Endre Hann, Managing Director, László Beck, Managing Director

 

Contact details of the Data Protection Officer: adatvedelem@median.hu

 

Hosting provider:

 

Company name: Neucom Ltd.

 

Registered office.

 

1144 Budapest, Gvadányi utca 33-39.

 

e-mail: info@rackforest.hu

 

 

 

Depot provider:

 

Company name: Rackforest Ltd.

 

Headquarters,

 

e-mail: info@rackforest.hu

 

  1. SCOPE OF THE PRIVACY NOTICE

This Privacy Notice applies to the personal data processing activities that take place when you use the Sites operated by us and covers the operator of the Website (hereinafter referred to as „the Website”) and all users.

 

The provisions of this notice will enter into force on 26 February 2021.

 

III. TERMS USED IN THIS PRIVACY NOTICE

The terms used in the Privacy Notice shall have the same meaning as defined in the General Terms and Conditions.

 

 

 

The terms relating to data protection shall be interpreted in accordance with Article 4 of the GDPR and Article 3 of the Infotv[2].

 

  1. COMPLIANCE WITH DATA PROCESSING PRINCIPLES

We will do our utmost to protect the personal data of our users and to ensure the rights of the data subjects, and therefore, in accordance with the legal requirements

 

We will carry out our data processing activities lawfully, fairly and transparently to the data subject, as set out in this privacy statement;

we process personal data only for specified, explicit and legitimate purposes;

we only process personal data which is necessary for the purposes of the processing and is adequate for the purposes for which it is intended, or, in accordance with the principle of data minimisation, strictly necessary for the purposes for which it is intended;

we aim to keep our records accurate and up to date;

we retain data only for as long as necessary to achieve the purposes for which they are processed or, in the case of processing based on a legal obligation, for the period of time specified by law;

we take all reasonable technical and organisational measures to protect the data;

take responsibility for ensuring that our processing activities comply with the law.

  1. PERSONAL DATA PROCESSING ACTIVITIES
  2. Processing of data relating to panel membership

 

 

Median Ltd. offers the possibility of registration on the Median Voter page for persons aged 16 and over who are interested in participating in public opinion and market research to visitors/users of the page and to all persons who have previously given their consent to Median Ltd. to send them enquiries about online research by providing their e-mail address. On the basis of the consent given by providing an e-mail address, when Medián Kft. sends a request for Medián Listener registration from its own mailing system, the recipients have the possibility to withdraw their consent by clicking on the link provided in the e-mail, i.e. to unsubscribe from the mailing list. The e-mail addresses will be processed until the consent is withdrawn. The withdrawal of consent does not affect the lawfulness of our previous processing.

 

If the user or the recipient of the e-mail invited to participate in the online research or to register registers on the Medián Voice site, he/she will be registered as a so-called Panel Member in our database.

 

Panel members will be able to fill in online research questionnaires and receive information about other types of research activities.

 

The information you provide during registration will be used to carry out our research activities in accordance with our Terms and Conditions.

 

The purpose of processing the data provided during registration is to ensure the participation of Panel Members in our public opinion and market research activities.

 

These activities include:

 

compiling target groups for each survey based on filtered data from the panel membership, such as demographic criteria or areas of special interest

sending research calls to Panel members by e-mail or telephone text message

conducting research, processing and monitoring its results,

the automated processing and quantification of Panel members’ activity, the provision of conditions for motivational draws

the organisation of prize draws for motivation purposes

The scope of the personal data we process:

Personal data processed

What is the purpose of this data?

Panel member name

To identify, distinguish and contact Panel members

E-mail address

To contact you, send you research invitations.

Telephone number

Contact

Sociodemographic data

Gender of panel member

To select the persons to be included in the research (sampling).

Postal code

Year of birth

marital status

family situation

number of children under 18 living in the household

highest level of education

main activity, monthly household income by category

additional data

Additional data may be requested in order to examine the social context of opinions and consumer behaviour and to improve the efficiency of the service delivery, e.g. bank usage patterns, travel habits, etc.

Address data

Delivery of prizes to winning Panel members (for higher value gifts, we will endeavour to be able to deliver in person and will ask for a photo ID to be presented to the Panel member to prove their identity.)

username, password, e-mail address

Create and operate a Panel Member account

registration time, IP address, browser, device

Operation and provision of services

name, points achieved by the panel member

The Median Voice system rewards registration, participation in surveys and activities of the panel member in connection with his/her panel membership with lottery tickets, which are collected on the basis of automated data processing. No profiling with significant legal effects on the data subject is carried out through automated data processing.

 

 

 

 

The data processing of the Medián Hangadó panel membership is based on the user’s voluntary informed consent by ticking a checkbox (Article 6(1)(a) GDPR), which the panel member may withdraw at any time without giving any reason, without prejudice to the lawfulness of our processing activities prior to the withdrawal of consent. Withdrawal of consent shall not have any adverse legal consequences for Paneltag. The Panel Member may decide at any time not to participate in our surveys and not to complete the questionnaire made available to him/her. Only online surveys not requiring registration may be participated in without providing data.

 

The demographic data required for the research activity will be processed under a pseudonym until the user account is maintained and after deletion of the user account, the data will be stored in an anonymised database of our analytical activity.

 

Withdrawal of consent to data processing also implies the deletion of the Panel member’s user account. This can be done at any time by the Panel Member by clicking on the link at the bottom of the user account or email notifications.

 

Sociodemographic data will be pre-screened in order to reach the target population of the research questionnaire. This is done in an automated way without processing personal data. Data from completed online research questionnaires are entered into our database in a completely anonymous way. We guarantee to the Panel Member that the answers given when completing the online questionnaire will be anonymised by a procedure that makes it impossible to identify the person who completed the questionnaire.

 

At all stages of the processing of the responses to the online survey, we guarantee the full anonymity of the respondent and the voluntary nature of the opinion expressed.

 

The results of the survey will not contain any data that could identify the respondent. It is therefore not possible to identify which questions each Panel member answered.

 

The number and serial number of individual lottery tickets assigned to the Panel member’s user ID will be processed in the prize draw. The winning Panel Member will be mailed their prize using their name and address.

 

The winner’s name, address and telephone number will be forwarded to the courier service that delivers and delivers the prize. The data will also be forwarded to our accounting processor for the purpose of paying the VAT due on the prize draw and for the related accounting and bookkeeping tasks.

 

The data processed in accordance with the legal requirements (Article 6(1)(c) GDPR) will be kept for 8 years after the draw.

 

Except in cases provided for by law, personal data provided by Panel Members will not be disclosed to third parties, either free of charge or for commercial reasons.

 

The sending of the research questionnaires and the transmission of the anonymous research results to Median Ltd. will be provided by the CapITris system of Adertis Ltd. (registered office and postal address: 1133 Budapest, Gogol u. 13., tax number: 14781218-2-41, company registration number: 01-09-919558, e-mail: info@adertis.hu).

 

Panel members’ data are stored on our own server or by RackForest Kft. (1132 Budapest, Victor Hugo utca 18-22. 3rd floor 300/a., e-mail: info@rackforest.hu )

 

  1. Sending messages

By filling in the contact form on the Website, users can send us a message. The data provided here (name, e-mail address, subject) will be processed in our mail system for six months after the questions asked in the e-mail have been answered. The legal basis for the processing is Article 6(1)(a) of the GDPR, i.e. the user’s consent is required for the processing, which he or she can give us by ticking the box before the consent form before sending the data. The content of the privacy notice can also be consulted by the user prior to providing his/her data by clicking on the link in the text next to the checkbox.

 

  1. Information on statements made electronically

The user’s user ID (pseudonym), timestamp and IP address of the remote computer are stored in a separate database in connection with the consent statements provided by the user in the checkbox during registration or when sending a message, in order to comply with the legal obligation to provide proof of consent (Articles 6(1)(c) and 7(1) GDPR).

 

  1. Information about cookies

In operating our Website, it is important to facilitate the browsing of our visitors, to help them navigate between pages and to return to the content they have viewed.

 

In addition, in order to improve our services, we also want to know what content visitors to our site have viewed, what they were most interested in, how long they spent viewing content and what features they used on the site.

 

Of course, we want our visitors to return to our site and use our services after they have finished browsing.

 

Without knowing who is browsing our site by name, we can gain important information about our visitors’ habits and preferences, which allows us to provide our visitors with the quality of browsing experience and services they want.

 

We do this by using cookies that are not able to identify the user, but are only able to recognise the browsing device used by the visitor. We therefore do not store any information about our visitors in the form of cookies that would allow us to contact them by phone, email or even postal mail. We do not store any information about visitors in cookies, except for the browser ID, browsing time, pages visited, content viewed.

 

What are cookies? Cookies are small data files placed on visitors’ browsing devices, cookies in English, which are intended to be read back by the Website on a subsequent visit and to remember, among other things, the content viewed by the user, preferences, contributions, favourite content, password, etc. Some cookies are essential for the functioning of a website, some are important to enable the site to remember the actions performed by the visitor through the cookies (functional cookies), some are used to measure and analyse the website’s traffic data (statistical cookies) and some are used for the marketing activities of the company to allow the display of targeted advertisements to the user, to allow the user to access other platforms even after he/she has finished browsing (marketing cookies). A cookie usually contains the name of the website from which it came, its „lifetime” (i.e. how long it stays on the device) and its value, which is usually a randomly generated unique number.

 

In terms of expiry date, cookies can be either browsing cookies, which are deleted from the visitor’s computer when the website is closed, or persistent cookies, which are stored on the visitor’s device until the expiry date (or until the User disables the cookie).

 

We place a cookie bar on the website to ensure that visitors are informed of the type of cookies we use and can give the consent required to place each cookie.

 

We choose the cookies we use so that we can improve the functionality of the site, improve the user experience and measure the effectiveness of our advertising.

 

This only requires that we store the appropriate cookies based on the unique identifier assigned to the user’s browser. Without the user’s consent, we may use cookies that are technically necessary for the provision of the service, including any information stored by cookies that is necessary for the proper functioning of the website. Cookies that require consent can be enabled or disabled at the user’s discretion during browsing.

 

Essential cookies help us to improve the usability of our Website by enabling basic functions such as site navigation

 

  1. DATA SECURITY

In our data management activities, we ensure compliance with our data protection and confidentiality obligations.

 

Data security is ensured by our hosting partners.

 

We take appropriate technical and organisational measures to protect data against unauthorised access, alteration, disclosure, disclosure, deletion or destruction, accidental destruction or damage, and against inaccessibility due to changes in the technology used.

 

In the event of a potential data breach, we have an appropriate incident management plan and records.

 

To prevent data from falling into the hands of unauthorised persons, we use encrypted channels for network encryption at all points. The website is accessible via HTTPS, the file server is remotely accessible via SSL secured channel, email and correspondence is encrypted using TLS/SSL.

 

All communication between certified websites, modules is encrypted (sha256RSA), internet based.

 

The database is backed up daily for a period of one week. Backups are also synchronised in encrypted form to an external server. The backups can only be restored from the database if the two-key encryption key is known.

 

The anonymised data of the research participants will be analysed solely to identify statistical correlations. The research results will be transmitted to the research client in a non-personally identifiable form as described above.

 

The database is hosted on a Virtual Private Server (VPS) in a server centre where 99.95% availability of the operating conditions is guaranteed (power supply, network access, air conditioning).

 

Probability of server failure: 0.05%.

 

Adequate measures have also been taken to monitor network activity and detect malicious software.

 

VII. RIGHTS OF DATA SUBJECTS

As a user or Panel Member concerned by data processing, you have the right to exercise your rights under Articles 15-22 of the GDPR as follows.

 

Information and access to personal data

 

You have the right to know the personal data we hold about you and information about how we process it, to request it at any time, to check what data we hold about you, and to have access to your personal data.

 

Your request for access to your data should be made in writing to us. Please provide us with the requested data in writing (electronically or by postal mail) as specified in the request. We are not able to provide you with oral information.

 

In the case of the exercise of the right of access, the information shall include the following data:

 

the scope of the data processed,

the purpose, time and legal basis of the processing in relation to the scope of the data processed,

to whom the data have been or will be transferred,

indication of the source of the data.

A paper or electronic copy of the personal data will be provided free of charge to the data subject for the first time. For subsequent copies, we may charge a reasonable fee based on administrative costs. In the event that you request a copy electronically, we will provide the information to you by email in a commonly used electronic format.

 

If, after being informed, you do not agree with the processing and the accuracy of the data processed, you may request the rectification, integration, erasure or restriction of the processing of personal data concerning you, object to the processing of such personal data or initiate the procedures described below.

 

Right to rectification, integration of personal data processed

 

We will correct or complete, without undue delay, inaccurate or incomplete personal data that you have provided to us in writing. We will inform any recipient to whom we have disclosed the personal data of the change, unless this proves impossible or involves a disproportionate effort.

 

Right to restriction of processing

 

You have the right to obtain restriction of processing if

 

contest the accuracy of the personal data, in which case the restriction will apply for a period of time that allows us to verify the accuracy of the personal data,

the processing is unlawful and you oppose the erasure of the data and instead request the restriction of their use,

the personal data are no longer necessary for the processing but you need them for the establishment, exercise or defence of legal claims,

you object to the processing, in which case the restriction will apply for a period of time until it is determined whether our legitimate grounds override your legitimate grounds.

Right to erasure (right to be forgotten)

 

We will delete personal data relating to the data subject without undue delay where one of the grounds set out above applies:

 

the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;

You withdraw your consent on which the processing is based and there is no other legal basis for the processing;

you object to the processing on grounds relating to your particular situation and there are no legitimate grounds for the processing;

you object to the processing of personal data relating to you for direct marketing purposes, including profiling where it is related to direct marketing,

the personal data have been unlawfully processed;

You may not exercise your right to erasure or blocking where processing is necessary:

 

For the exercise of the right to freedom of expression and information;

on grounds of public interest in the field of public health;

for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, where the exercise of the right of erasure would make such processing impossible or seriously impair it; or

for the establishment, exercise or defence of legal claims.

Right to data portability

 

Data portability allows you to obtain and further use your data processed in our databases in an automated way. In all cases, the right is limited to the data you provide, no other data (e.g. statistics or other technical data) can be made portable

 

You are the personal data contained in our databases:

 

in a structured, commonly used, machine-readable format,

You have the right to transmit it to another controller,

request direct transfer of the data to the other controller – if technically feasible.

Requests for data portability will only be granted on the basis of a request sent by email or post. We must verify that the data subject who is entitled to exercise this right does indeed wish to exercise it before we grant the request. To do this, you must provide the information you provided during registration in your request so that we can identify you.

 

Objection to the processing of personal data

 

For reasons relating to your particular situation, you may object at any time to the processing of your personal data on the basis of Article 6(1)(e) or (f) of the GDPR.

 

Right to withdraw consent

 

Where the legal basis for processing is your consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.

 

Deadline for fulfilling the request

 

We will investigate your request without undue delay but within one month of receipt of the request and inform you of the action taken. If necessary, taking into account the complexity of the request and the number of requests, this time limit may be extended by a further two months, but in this case you will be asked to state the reason for the delay.

 

VIII. ENFORCEMENT OPTIONS

The data subject may exercise his or her rights by sending a request by email or by post to:

 

Data Protection Officer e-mail address: adatvedelem@median.hu

 

E-mail address.

 

If, on the basis of the reply to your request, you have suffered or are at risk of suffering a violation of rights, we shall be entitled to invoke the GDPR and the Civil Code (2013. évi V. Act of 2013), you may assert your rights before the competent court of law of your place of residence or domicile, or you may also contact the National Authority for Data Protection and Freedom of Information (Address: 1055 Budapest, Falk Miksa utca 9-11., Postal address: 1363 Budapest, Pf. 9., Phone: +36 1 391 1400, Fax: +36 1 391 1410, E-mail: ugyfelszolgalat@naih.hu, Website: www.naih.hu).

 

  1. ACCESS TO AND MODIFICATION OF THE PRIVACY NOTICE

For our surveys not based on online questionnaires (focus groups, in-hall tests, personal interviews, telephone surveys, etc.), we will make available the Data Processing Notice at the same time as the call for research.

 

This notice can be downloaded from the Privacy Notice menu on the website. In addition, we will always draw the attention of visitors to the availability of the Privacy Notice in the data entry fields, ensuring that the data subject is informed in advance about the processing of his/her personal data.

 

We reserve the right to unilaterally amend the content of the Privacy Notice. In the event of a change, we will notify our users, but this will not affect the lawfulness of our previous processing.

 

If we wish to carry out further processing of data collected during browsing on the Website for purposes other than those for which they were collected, we will inform the data subjects of this in accordance with the law and provide the possibility of prior informed consent (in the case of personal data processing based on voluntary consent)

 

RELEVANT LEGISLATION, REGULATIONS

 

REGULATION (EU) No 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation); (The EU General Data Protection Regulation), (hereinafter referred to as „GDPR”),

Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (Infotv.),

Act CVIII of 2001 on certain aspects of electronic commerce services and information society services (Act CVIII of 2001 on certain aspects of electronic commerce services and information society services),

Act CXIX of 1995 on the Processing of Name and Address Data for Research and Direct Marketing Purposes (Kktv.),

Act LXVI of 1992 on the registration of personal data and addresses of citizens (Nytv.),

Act V of 2013 on the Civil Code (Civil Code Act),

Act XLVIII of 2008 on the Basic Conditions and Certain Restrictions on Commercial Advertising (Act XLVIII of 2008),

Act C of 2000 on Accounting (Accounting Act);

[1] The obligation to provide information is provided for in Articles 12-14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR).

 

[2] Article 3, paragraphs 3, 4, 6, 11, 12, 13, 16, 17, 21, 23, 24 of Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information.