1. Visitor data management – information on the use of cookies

Introduction

The Data Controller handles the personal data of visitors to the Data Controller’s website https://incognito.hu/ (hereinafter: website) (hereinafter: Visitor) in accordance with the provisions contained in the information sheet according to this annex.

Data controller details:

• Company name: Bio Gasztro Trade and Catering Limited Liability Company
• Headquarters: H-1061 Budapest, Liszt Ferenc Square 3.
• Company registration number: 01 09 993636
• Tax number: 24166812-2-42
• Representative: Ferhat Hamdi Güray
• Phone number: +36 70 639 0094
• E-mail address: info@incognito.hu
• Website: https://incognito.hu

1. The website visitor must be informed about the use of cookies on the website, and the visitor’s consent must be requested for this.
2. During the visit, the range of data affected by the cookies (the range of managed data), depending on the type of cookies, may include, among other things, the IP address used by the Visitor, the type of browser, the characteristics of the operating system of the device used for browsing (e.g., set language), the time of the visit, the visited (sub)page function or service, action, click.
3. The purpose of data management is to ensure the functional operation of the website, its use, to ensure access to website services, to increase the efficiency of the service, to increase the user experience, to make the use of the website more convenient, to analyze the website, to place and display advertisements.
4. The legal basis for data management is the voluntary consent of the person concerned – the Visitor – which can be given or rejected by checking the checkbox in the cookie bar on the website. The choice is made by ticking the checkbox and saving the choice. By saving, we store your choice and provide the Visitor with the use of the website accordingly. It should be taken into account that certain functions of the site may not work correctly if the use of cookies is rejected. CVIII of 2001 on certain issues of electronic commercial services and information society services. Act (Elkertv.) 13/A. According to § (3), the provider of the website may process the personal data that is technically absolutely necessary for the provision of the service for the purpose of providing the service. If the other conditions are the same, the service provider must choose and in all cases operate the tools used in the provision of services related to the information society in such a way that personal data is only processed if this is absolutely necessary for the provision of the service and the fulfillment of other goals defined by law , but also in this case only to the necessary extent and for the duration.

Recipients: the processed data may be forwarded to the accommodation provider and IT service companies, whose contact details the Data Controller informs the Visitor as follows:

Hosting company:

– Company name: DotRoll Ltd.
– Headquarters: H-1148 Budapest, Fogarasi Road 3-5.
– Phone number: +36 – 1 – 432 – 3232
– E-mail address: support@dotroll.com
– Website: https://dotroll.com

IT provider:

– Entrepreneur: Kovács Ferenc EV
– Registration number: 58435274
– Headquarter: H-1204 Budapest, Wesselényi Street 144.

1. Duration of data management: according to the cookie settings of the browser.
2. Learn more about cookies
   A cookie is data that the visited website sends to the browser running on the visitor’s device (computer, tablet, mobile phone, etc.) so that it stores it and later the same website can load its content. Cookies can be valid, they can be valid until the browser is closed, or for an unlimited time. The cookie does not identify the user, but the device or browser used by the user, but it can be used to identify the person through this. The danger lies in the fact that the user is not always aware of this and it may be possible for the user to be followed by the website operator or another (third) service provider whose content is integrated into the page (e.g. Google Analytics), thus creating a profile created from it, and in this case the content of the cookie can be considered personal data. The types of cookies are usually distinguished according to the functions they fulfill or the purposes of application, there is no uniform terminology for this, and there may be overlap between the individual groups.

   a) Technically essential cookies: they are also called session cookies or functional cookies. Their essence is that without them the site would simply not work functionally, they provide the minimum conditions necessary for the proper functioning of the website. These are necessary to identify the user, e.g. to manage whether you entered, what you added to the cart, etc. This is typically the storage of a session ID, the rest of the data is stored on the server, which is therefore more secure. Other terminologies call all cookies that are deleted when you exit the browser a session cookie (a session is a browser usage from start to close). The duration of the data management of these cookies applies only to the visitor’s current visit, this type of cookie is automatically deleted from the computer when the session ends or when the browser is closed.

   b) Usage-facilitating cookies: these are also called in different ways: analysis, analysis, page development or statistics cookies. These cookies remember the user’s choices, for example in what form the user wants to see the page. These types of cookies essentially mean the setting data stored in the cookie.

   c) Cookies providing advertising display and related to social media: these are also called performance cookies, experience cookies, and marketing cookies. They don’t have much to do with “performance”, that’s usually the name given to cookies that collect information about the user’s behavior, time spent, and clicks on the visited website. They are also connected to social media. These are typically third-party applications (e.g. Google Analytics, AdWords). These are suitable for profiling the visitor.

   You can find out more about Google Analytics cookies here:
   https://developers.google.com…

   You can find out more about Google AdWords cookies here:
   https://support.google.com…

   The following cookies are used on the https://incognito.hu/ website:

   Cookie name	Target	Expiration date	Read more
   ls-popup-*	Functionality	End of session	It is hosted by the LayerSlider WordPress plugin. It does not collect data.
   ls-popup-last-displayed	Functionality	2 years	It is hosted by the LayerSlider WordPress plugin. It does not collect data.
   PHPSESSID	Functionality	End of session	PHP stores the current state of the session here. It is used to distinguish individual visitors to the site. It is recorded whether the visitor is logged in.
   uvc	Social sharing	1 year	The page can be shared on various social channels. It is placed on the page by the AddThis WordPress plugin.
   loc	Social sharing	1 year	The page can be shared on various social channels. It is placed on the page by the AddThis WordPress plugin.
   mus	Social sharing	1 year	The page can be shared on various social channels. It is placed on the page by the AddThis WordPress plugin.
   ouid	Social sharing	1 year	The page can be shared on various social channels. It is placed on the page by the AddThis WordPress plugin.
   uid	Social sharing	1 year	The page can be shared on various social channels. It is placed on the page by the AddThis WordPress plugin.
   fr	Marketing	3 month	It enables the display of customized advertisements via the Facebook website.
   _gid	Marketing	1 day	It is placed on the page by the Google Analytics measurement code. It serves to distinguish users.
   _gat_UA-101358145-1	Marketing	90 days	It is placed on the page by the Google Analytics measurement code. It stores relevant information about the user related to running campaigns.
   _ga	Marketing	2 years	It is placed on the page by the Google Analytics measurement code. It serves to distinguish users.
   __atuvs	Social sharing	30 min.	The page can be shared on various social channels. It is placed on the page by the AddThis WordPress plugin.
   __atuvc	Social sharing	2 years	The page can be shared on various social channels. It is placed on the page by the AddThis WordPress plugin.
   woocommerce_items_in_cart	Functionality	End of session	It is placed on the site by the WooCommerce WordPress plugin. Information about the visitor’s basket is stored in it. No personal data is stored in it.
   woocommerce_cart_hash	Functionality	End of session	It is placed on the site by the WooCommerce WordPress plugin. Information about the visitor’s basket is stored in it. No personal data is stored in it.
   wp_woocommerce_session_*	Functionality	2 days	It is placed on the site by the WooCommerce WordPress plugin. It records where the products in the visitor’s basket are located in the database. No personal data is stored in it. The code at the end of the cookie is unique for each user.
   euCookie	Functionality	60 days	It stores the information that the visitor has accepted the cookies.

   Accepting and authorizing the use of cookies is not mandatory. You can reset your browser settings to reject all cookies or to notify you when a cookie is currently being sent. Although most browsers automatically accept cookies by default, they can usually be changed to prevent automatic acceptance and offer a choice each time.

   A legnépszerűbb böngészők süti beállításairól az alábbi linkeken tájékozódhat:

   • Google Chrome: https://support.google.com/ac…
   • Firefox: https://support.mozilla.org…
   • Microsoft Internet Explorer 11: http://windows.microsoft.com…
   • Microsoft Internet Explorer 10: http://windows.microsoft.com…
   • Microsoft Internet Explorer 9: http://windows.microsoft.com…
   • Microsoft Internet Explorer 8: http://windows.microsoft.com…
   • Microsoft Edge: http://windows.microsoft.com…
   • Safari: https://support.apple.com…

   However, we would like to point out that certain website functions or services may not function properly without cookies.

   Individual websites use cookies with different intensity, it is also possible that a website does not use them because it is not necessary for its operation, or only uses them to a minimal extent.

2. The visitor’s rights related to data management

It is important for the Data Controller that its data management meets the requirements of fairness, legality and transparency. To this end, the Visitor can request information about the management of his personal data, and can request the correction of his personal data or – with the exception of mandatory data management – deletion, he can request the restriction of the management of his personal data, he can withdraw his consent to data management, and he can also use the possibility of carrying his data, his right of access, and his right to protest . In order for the Visitor to be aware of his rights and the conditions for exercising them, we provide the following information to the Visitor.

2. 1. Withdraw consent

In the case of data processing based on consent, the Visitor has the right to withdraw his consent at any time without reason. The revocation does not affect the legality of the data management based on consent, carried out prior to the revocation. However, the Data Controller will no longer carry out operations using the Visitor’s personal data and will delete them if there is no other legal basis for the processing of the Visitor’s personal data. The Visitor can withdraw his consent by contacting one of the contact details of the Data Controller listed in point I – and at the same time in the Introductory Part of this appendix.

2. 2. Access

The Visitor has the right to receive feedback from the Data Controller as to whether her personal data is being processed, and if such data is being processed, she/he is entitled to access the personal data and the following information

• purpose of data management;
• categories of the Visitor’s personal data;
• recipients or categories of recipients to whom or to whom the personal data has been or will be disclosed;
• where appropriate, the planned period of storage of personal data or, if this is not possible, the criteria for determining this period;
• the right of the Visitor to request from the data controller the correction, deletion or restriction of processing of personal data concerning her/him and to object to the processing of such personal data;(
• the right to submit a complaint to a supervisory authority;
• if the data was not collected from the Visitor by the Data Controller (the Data Controller is therefore the recipient of the data), all available information about their source;
• the fact of automated decision-making, including profiling, as well as, at least in these cases, comprehensible information about the logic used and the significance of such data management and the expected consequences for the data subject.

2.3. Visitor’s right of access: 

• does not cover anonymous data;
• according to Article 15 of the GDPR, it covers the personal data of the Visitor;
• does not cover personal data not relating to the Visitor;
• includes pseudonymized data that can be clearly linked to the Visitor.

At the request of the Visitor, the Data Controller provides access to the Visitor’s personal data in accordance with Article 15 of the GDPR, if:

• the Visitor requests confirmation from the Data Controller regarding the management of their data; and
• the Data Controller manages the Visitor’s personal data; and
• the Visitor requests access to her/his personal data.

The Data Controller will provide the Visitor with a copy of their personal data if:

• the Visitor requests confirmation from the Data Controller regarding the management of his personal data, and
• the Data Controller manages the Visitor’s personal data and
• the Visitor requests a copy of his personal data. If the Visitor requests additional copies of his personal data, the Data Controller may charge a reasonable fee for the administrative costs incurred in connection with the fulfillment of the request, which fee the Visitor must bear.

2.4. Rectification

The Visitor has the right to request that the Data Controller correct inaccurate personal data concerning the Visitor without undue delay. Taking into account the purpose of data management, the Visitor has the right to request the completion of incomplete personal data, including by means of a supplementary statement. The Visitor’s right to correct inaccurate data:

• does not cover anonymous data;
• according to Article 16 of the GDPR, it covers the personal data of the Visitor;
• does not cover personal data not relating to the Visitor; and
• includes pseudonymized data that can be clearly linked to the Visitor.

The Data Controller corrects the Visitor’s personal data in the following cases:

• the Data Controller manages the Visitor’s personal data and
• the given personal data is inaccurate and
• the Visitor requests the correction of her/his personal data.

The Data Controller supplements the Visitor’s personal data, if:

• the Data Controller manages the Visitor’s personal data and
• the given personal data is incomplete and
• the Visitor requests the completion of her/his personal data.

The Visitor is entitled to make an additional statement to the Data Controller. The Data Controller shall notify the recipients of the personal data (if any) of the correction of the Visitor’s personal data. However, the Data Controller will not notify the recipients of the correction of personal data if notification to the recipients proves to be impossible or would require a disproportionately large effort. At the Visitor’s request, the Data Controller informs the Visitor about the recipients.

2.5. Deletion

The Data Controller is obliged to delete the affected data based on the Visitor’s request to delete personal data if the following conditions are met. The Data Controller is obliged to delete the Visitor’s personal data without undue delay if:

1. the Data Controller manages the Visitor’s personal data and
2. the Visitor requests the deletion of his personal data and
3. at least one of the following conditions (a-f) is fulfilled:

• the personal data are not necessary to achieve the purposes for which they were collected by the Data Controller, and the Visitor does not request the restriction of data processing instead of deletion;
• data management is based on the Visitor’s consent and the Visitor withdraws this consent, and there is no other legal basis for data management;
• the Visitor objects to data processing on the basis of Article 21 (1) of the GDPR (as stated in point 2.7 of the information contained in this appendix) and there is no overriding legal reason for data processing, or the data subject objects to data processing for the purpose of obtaining direct business (including also profiling, if it is related to direct business acquisition);
• the personal data was handled illegally (without legal basis) by the Data Controller, and the Visitor does not request the restriction of data processing instead of deletion;
• the personal data must be deleted in order to fulfill the legal obligation prescribed by EU or member state law applicable to the Data Controller;
• the collection of personal data took place in connection with the offering of information society-related services (i.e. information society-related services offered directly to children) referred to in Article 8 (1) of the GDPR. ”), the Data Controller is not obliged to delete the data even if the Deletion prerequisites exist, if the data management:
• or the purpose of fulfilling an obligation under EU or Member State law applicable to the Data Controller requiring the processing of the given personal data(s), or
• it is necessary for the submission, enforcement and defense of legal claims. If the Data Controller has disclosed the data of the Visitor affected by the deletion in any way and is obliged to delete them based on the above, it will take reasonable steps, including technical measures, taking into account the available technology and the costs of implementation, in order to inform the data controllers handling the data that the The Visitor has requested from them the deletion of the links to the personal data in question or the copy or duplicate of this personal data. The Data Controller shall notify the recipients of the personal data (if any) of the deletion of the Visitor’s personal data. However, the Data Controller will not notify the recipients of the deletion of personal data if notifying the recipients would be impossible or would require a disproportionately large effort. At the request of the Visitor, the Data Controller informs the Visitor about the recipients.

2.6. Limitation of data management

According to Article 18 of the GDPR, the Visitor may request the restriction of the processing of her/his personal data if one of the following occurs:

• the Visitor disputes the accuracy of the personal data: in this case, the limitation applies to the period that allows the Data Controller to check the accuracy of the personal data; obsession
• the data management is illegal and the Visitor opposes the deletion of the data and instead requests the restriction of its use; obsession
• The Data Controller no longer needs the personal data for the purpose of data management, but the Visitor requires them to submit, enforce or defend legal claims; obsession
• the Visitor has objected to data processing in accordance with Article 21 (1) of the GDPR: in this case, the restriction applies to the period until it is determined whether the legitimate reasons of the data controller take precedence over the legitimate reasons of the data subject.

The right of the Visitor to request the restriction of the processing of her/his personal data:

• does not cover anonymous data;
• according to Article 18 of the GDPR, it covers the personal data of the Visitor;
• does not cover personal data not relating to the Visitor; and
• includes pseudonymized data that can be clearly linked to the Visitor.

The Data Controller shall notify the recipients of the personal data (if any) of the restrictions on the processing of the Visitor’s personal data. However, the Data Controller will not notify the recipients of such a restriction if notifying the recipients would be impossible or would require a disproportionately large effort. At the request of the Visitor, the Data Controller informs the Visitor about the recipients.
If the Data Controller restricts the processing of the Visitor’s personal data on the basis of the above, he is only entitled to the following:

• may store such personal data;
• may process such personal data based on the consent of the Visitor;
• may process personal data even without the consent of the Visitor for the purpose of presenting, validating, protecting their legal claim or protecting the rights of another natural or legal person or in the important public interest of the Union or a member state.

If the processing of the Visitor’s data has been restricted in accordance with the above, the Data Controller is obliged to inform the applicant in advance of the lifting of the restriction.

2.6. Data portability

If the Data Controller handles the Visitor’s personal data automatically, the Visitor is entitled to receive the personal data relating to the Visitor provided by the Visitor to the Data Controller in a segmented, widely used, machine-readable format, and is entitled to transfer this data to another data controller without the Data Controller hindering this, and is also entitled to request the direct transmission of this data by the Data Controller to another data controller.

The Visitor’s right to data portability:

• does not cover anonymous data;
• covers the personal data of the Visitor;
• does not cover personal data not relating to the Visitor;

and covers pseudonymized data that can be clearly linked to the Visitor.

2.7. Protest

The Data Controller separately informs the Visitor that, in the case of data processed to assert the legitimate interests of the Data Controller or a third party, the Visitor has the right to object to the processing of their personal data based on this legal basis at any time for reasons related to their own situation.

In the event of the Visitor’s objection, the Data Controller may no longer process the personal data, unless the Data Controller proves that the data processing is justified by compelling legitimate reasons which take precedence over the interests, rights and freedoms of the Visitor, or which are necessary for the submission, enforcement or If personal data is processed for scientific and historical research or statistical purposes in accordance with Article 89 (1) of the GDPR, the Visitor has the right to object to the processing of personal data concerning the Visitor for reasons related to their own situation, except , if the data management is necessary for the execution of a task carried out for reasons of public interest.

2.8. Information on safeguards for data transfer to third countries

The Data Controller does not forward the Visitor’s data to recipients in third countries.

2.9. Deadline for handling the Visitor’s requests

The Data Controller is related to Visitor data management – 2.1-2.8. to the request as written in points, and 3.1. 2.1-2.8. you can make your requests according to points in the following way:

• writing, by post with the following address: in writing, H-1061 Budapest, Liszt Ferenc Square 3. 
• sent by e-mail to the following address: info@incognito.hu

The Data Controller is obliged to inform the Visitor without undue delay, but no later than within 1 (one) month from the date of receipt of the request, according to 2.1-2.8. on measures taken as a result of your request according to points. If necessary, taking into account the complexity of the request and the number of requests received by the Data Controller, this deadline can be extended by another 2 (two) months. The Data Controller shall inform the Visitor of the extension of the deadline, indicating the reasons for the delay, within 1 (one) month from the date of receipt of the request. If the Visitor submitted the request electronically, the information must be provided electronically, if possible, unless the Visitor requests otherwise. If the Data Controller does not take measures following the Visitor’s request, it shall inform the Visitor without delay, but at the latest within 1 (one) month of the receipt of the request, of the reasons for not taking action, and of the fact that the Visitor may file a complaint with a supervisory authority and use the also with the right to judicial remedy.

If the Data Controller learns that it no longer needs any personal data for data management purposes, the Data Controller is obliged to inform the affected person in writing (including electronic information):

• about the relevant data; and about that
• Article 17 (3) of the GDPR does not allow the processing of data either; and
• if the data subject does not exercise his right to restrict data processing according to Article 18 of the GDPR within 1 month from the date of notification, the Data Controller will permanently delete the data concerned as part of the normal review and deletion procedure; and
• if you request the limitation of data management (for the submission, enforcement or defense of legal claims), you may request information about the recipients to whom the Data Controller forwarded the relevant data.
• If the Data Controller becomes aware that the processing of personal data is unlawful, it is obliged to inform the affected person in writing (including electronic information) that:
• whose personal data the Data Controller handles illegally (for example, without a legal basis); and
• Article 17 (3) of the GDPR does not allow the processing of data either; and
• if the data subject does not exercise his right to limit data processing according to Article 18 of the GDPR within 1 month from the date of notification, the Data Controller permanently deletes the data concerned within the framework of the extraordinary deletion procedure; and

if you request the limitation of data management, you can request information about the recipients to whom the Data Controller forwarded the relevant data.

3. The visitor’s remedies

If, according to the Visitor’s point of view, the Data Controller, as a Data Controller, handles the Visitor’s personal data in an inappropriate manner, contrary to the law, or if, according to the Visitor’s point of view, the Data Controller, as a Data Controller, did not comply with his request to exercise his rights, or in an inappropriate manner, several legal remedies can also be used by the Visitor.

3.1 Filing a complaint with the National Data Protection and Freedom of Information Authority

If, according to the Visitor’s point of view, the Data Controller has not complied with the provisions of the GDPR during its data management activities, the Visitor may apply for legal remedies, including a complaint, to the National Data Protection and Freedom of Information Authority at one of the following contacts:

• Headquarters: 1055 Budapest, Falk Miksa utca 9-11.
• Mailing address: 1363 Budapest, Pf.: 9.
• Phone number: +36 (1) 391-1400
• Fax: +36 (1) 391-1410
• E-mail: ugyfelszolgalat@naih.hu
• Website: http://www.naih.hu

3.2 Court enforcement

In addition to the official legal remedy, the Visitor also has the opportunity to go to court if, according to the Visitor’s point of view, the Data Controller did not comply with the provisions of the GDPR during its data management activities, and thus the Data Controller violated the Visitor’s rights contained in the GDPR during the processing of the Visitor’s personal data. . When initiating court proceedings, the Visitor may also decide to initiate the court proceedings before the court of the Member State of the Visitor’s address or place of residence.