1. General information

The www.metristeel.hu website (hereinafter referred to as “Website”) The owner and operator is The METRIPOND-M 93 Mérleggyártó Kft. (METRIPOND-M 93 Kft., Address: 6800 Hódmezővásárhely, Bajcsy-Zs. u. 70., Company registration number: 06 09 002507, Tax number: 11087199206, hereinafter referred to as: “Service Provider”).
The purpose of this Policy is to set out the data protection and data processing principles and policies applied by the Service Provider.

We would like to inform you that Section 20(1) of Act CXII of 2011 on the Right to Self-Determination in Matters of Information and Freedom of Information (hereinafter: “Infotv.”) stipulates that the data subject (hereinafter: the user) must be informed, prior to the commencement of data processing, whether such processing is based on consent or is mandatory.

Before data processing commences, the data subject must be informed clearly and in detail of all facts relating to the processing of their data, in particular the purpose and legal basis of the data processing, the identity of the person authorised to carry out the data processing and data handling, and the duration of the data processing.

Furthermore, in accordance with Section 6(1) of the Information Act, the data subject must also be informed that personal data may be processed even if obtaining the data subject’s consent is impossible or would entail disproportionate costs, and the processing of personal data

• is necessary for compliance with a legal obligation to which the data controller is subject, or
• it is necessary for the purposes of the legitimate interests pursued by the data controller or a third party, and the pursuit of those interests is proportionate to the restriction of the right to the protection of personal data.

If, due to the person’s lack of legal capacity or for some other unavoidable reason, they are unable to give their consent, then to the extent necessary to protect their own or another person’s vital interests, and to avert or prevent an immediate danger threatening the life, physical integrity or property, the data subject’s personal data may be processed whilst the obstacles to consent remain in place.

The consent or subsequent approval of a minor’s legal representative is not required for the validity of a legal declaration containing the consent of the minor, who has reached the age of 16.

Under the Information Act, the above information must also cover the data subject’s rights and remedies in relation to the data processing in question.

However, where it is impossible to inform the data subjects personally, or where doing so would entail disproportionate costs, the information may also be provided by publishing the following details:

a) the fact that data is being collected,

b) the group of data subjects,

c) the purpose of the data collection,

d) the duration of the data processing,

e) the identity of any potential data controllers who are entitled to access the data,

f) az érintettek adatkezeléssel kapcsolatos jogainak és jogorvoslati lehetőségeinek ismertetése, valamint

g) where the data processing is subject to registration in the data protection register, the registration number of the data processing.

In light of the information provided above, please read the following Policy carefully. We would also like to draw your attention to the fact that the Service Provider is entitled to amend its data processing principles unilaterally, in accordance with the relevant legislation.

The amended data processing principles shall come into force upon their publication on the website.

Please be advised that the Service Provider processes, stores and handles the data on the above website in compliance with the data protection legislation in force at any given time. The relevant rules are set out in this Privacy and Data Processing Policy, which, in addition to setting out data processing methods, also sets out measures relating to data protection and the secure handling of personal data.

The Service Provider is committed to protecting the privacy rights of visitors to the Website, which is of paramount importance to us. However, please bear in mind that the security of information transmitted over the internet cannot be fully guaranteed.

2. The statutory definitions and interpretations of the terms used in these Regulations are as set out in Section 3 of the Info Act

personal data: data that can be linked to the data subject – in particular the data subject’s name, identification number, and one or more factors specific to their physical, physiological, mental, economic, cultural or social identity – as well as any conclusions drawn from such data concerning the data subject;

data subject/user: any natural person who is identified, or can be identified – directly or indirectly – on the basis of any specific personal data;

consent: a voluntary and unequivocal expression of the data subject’s will, based on adequate information, by which they give their unambiguous consent to the processing of their personal data – whether in full or in relation to specific operations;

data controller: a natural or legal person, or an organisation without legal personality, which, either alone or jointly with others, determines the purposes of data processing, makes and implements decisions relating to data processing (including the means used), or has such decisions implemented by a data processor it has commissioned;

data processing: any operation or set of operations carried out on the data, irrespective of the procedure used, including, in particular, the collection, recording, organisation, storage, alteration, use, retrieval, disclosure, alignment or combination, blocking, erasure and destruction of data, as well as the prevention of further use of the data, the taking of photographs, audio or video recordings, and physical characteristics suitable for identifying a person (e.g. fingerprint or palm print, DNA sample, iris scan) recording;

data transfer: making the data available to a specific third party;

data erasure: rendering the data unrecognisable in such a way that it can no longer be recovered;

data processing: the performance of technical tasks relating to data processing operations, irrespective of the method or means used to carry out those operations or the location where they are carried out, provided that the technical task is performed on the data;

data processor: a natural or legal person, or an organisation without legal personality, which processes data on the basis of a contract concluded with the data controller – including a contract concluded pursuant to a statutory provision;

third person: a natural or legal person, or an organisation without legal personality, who or which is not the data subject, the data controller or the data processor;

protest: a statement by the data subject objecting to the processing of their personal data and requesting that the processing be discontinued or that the data be erased;

publication: making the data available to anyone;

data set: the totality of data held in a single register;

3. The legal basis and purpose of data processing

Personal data may only be processed for a specific purpose, for the purpose of exercising a right or fulfilling an obligation. At every stage of data processing, the processing must be in accordance with the purpose of the processing, and the collection and processing of data must be fair and lawful.

Only personal data that is essential for the fulfilment of the purpose of data processing and is suitable for achieving that purpose may be processed. Personal data may only be processed to the extent and for the duration necessary to fulfil that purpose.

Legal basis: Data processing is carried out on the basis of a voluntary declaration by users of the online content on the Website, made after they have been duly informed; this declaration includes the users’ express consent to the use of their personal data provided whilst using the site.

The legal basis for data processing, in accordance with Section 5(1)(a) of the Information Act, is the data subject’s voluntary consent. Please note that the user gives their consent to the Service Provider in respect of specific data processing activities by using the Website, registering on it, or voluntarily providing the requested data; in doing so, the user also accepts the data processing principles applied by the Service Provider.

Purpose: Please be informed that the data you provide is stored and processed by the Service Provider (hereinafter: “Data Controller”)—in accordance with the Act on Informational Self-Determination and Freedom of Information (Infotv.)—exclusively for the following purposes: to facilitate registration on the Website and/or the purchase of tickets; to identify the user as necessary for accessing services available via the Website and for the proper fulfillment of product orders; to conclude contracts with users and arrange for any associated delivery; to provide proof of order terms and document the proper fulfillment of orders; to handle invoicing; to send newsletters; and to ensure the provision of other services available on the Website.

Please note that, for the purposes set out above, data processing shall be carried out exclusively in the manner prescribed by law, to the extent and for the duration necessary to fulfil the purpose, and shall involve only such personal data as is strictly necessary for the fulfilment of the above purposes and suitable for achieving them.

4. Scope of personal data processed and method of recording

During registration, the following details are primarily recorded:

• surname and first name/company name
• email address,
• billing address (billing name, street name, house number, town/city, postcode, tax number),
• delivery address (recipient’s name, street name, house number, town/city, postcode),
• telephone number
• password
• IP address at the time of registration
• date of registration

Data technically recorded during the operation of the system consists of information from the user’s computer—generated while the service is being used—which the data controller’s system records as an automatic result of technical processes. The system automatically logs this data upon login or logout, without requiring any separate declaration or action from the user. Except in cases mandated by law, this data cannot be linked to other personal user data. Access to this data is restricted exclusively to the data controller.

The data recorded automatically is used for the purposes of compiling statistics, the technical development of the IT system and the protection of users’ rights.

Please note that the data controller shall not use, nor may it use, the personal data provided for any purposes other than those set out in these points. Personal data may only be disclosed to third parties or public authorities with the user’s prior, explicit consent, unless otherwise provided for by law.

Please note that the data controller does not verify the personal data provided to it. The person providing the data is solely responsible for its accuracy.

Please note that by providing their email address, all users accept responsibility for ensuring that they are the sole person using the service via the email address provided. In view of this undertaking, all liability relating to any logins made using a given email address rests solely with the user who registered that email address.

Please be informed that an IP address is a sequence of numbers that identifies your computer when it connects to an internet service provider, a local area network (LAN), or a wide area network (WAN). Web servers use this IP address to automatically identify your computer while you are online. The Service Provider may collect IP addresses for the purposes of system administration and monitoring site usage. However, users are not linked to their IP addresses; in other words, the user remains anonymous.

Nevertheless, should the Service Provider consider it necessary to ensure compliance with the Website’s terms of use, or to protect the services or our other users, it may use IP addresses to identify users.

5. Duration of data processing, amendment and erasure of data

The processing of personal data provided on a mandatory basis during registration begins upon registration and continues until such data is deleted, the purpose for which it was collected has been fulfilled, or until any other date specified by law. In the case of non-mandatory data, processing continues from the time the data is provided until such data is deleted, the purpose for which it was collected has been fulfilled, or until any other date specified by law.

Please note that you may request information about your data held by the Service Provider at any time. You may request, free of charge and at any time, without having to provide a reason or face any restrictions, that your data be amended or deleted from the Service Provider’s database by contacting us via the following contact details:

• by email: info@metristeel.hu

6. Use of cookies

Please note that the Website operated by the Service Provider uses so-called ‘cookies’ to collect profile and status data, and to identify registered users of the Website,
to keep track of the “shopping basket” and to monitor visitors. Cookies are pieces of data that are temporarily stored on your computer’s hard drive from your web browser when you visit the Website, and which are necessary for you to use the Website. However, they cannot, on their own, be used to identify a visitor personally. Cookies provide additional functionality for the Website and enable us to measure its usage more accurately.

Under the Act on Information Self-Determination and Freedom of Information (Info Act), the use of cookies is permitted subject to your prior consent. You therefore have the option to either accept or decline cookies. You may reject cookies by adjusting your browser settings, or, if you prefer, you may choose to receive a notification before any cookies are stored. For more information on these features and to refine your cookie preferences, please consult the instructions or help section of your web browser. Please be advised that if you choose to decline cookies, you may not be able to fully utilize the interactive features of our website or other websites.

7. Newsletters, direct marketing (DM)

Please be informed that, in accordance with Section 6 of Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities, the user may provide prior and explicit consent for the Service Provider to contact them—using the contact details provided during registration (e.g., e-mail address or phone number)—for the purpose of sharing information regarding current promotions, general updates, or new services, and to process the personal data necessary for sending such promotional materials and newsletters. The user may make this decision at the time of registration or when modifying their registered data.

Please be advised that the Service Provider processes the following data for the purposes of its direct marketing activities: name, email address, (telephone number). Any visitor to the Website may subscribe to the newsletter. The Service Provider will process the data provided by the user until they unsubscribe. Only the data controller’s staff are authorised to process users’ personal data.

The Service Provider does not send unsolicited advertising messages or newsletters to its visitors and users. Users are entitled to unsubscribe from these at any time, free of charge, without giving any reason and without any restrictions, as indicated in the newsletter and/or advertising offer. Please note that, upon unsubscribing, the Service Provider will delete from its records the user’s personal data required for sending newsletters and advertising, and will not contact the user with further promotional offers.

8. Data transfer

Pursuant to the Act on the Right of Informational Self-Determination and on Freedom of Information (Info. tv.) and Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services, the Service Provider may engage data processors to process the personal data it handles. In the course of providing their services, such data processors are obliged to comply with the provisions of this Privacy Policy, the applicable laws, and the contract governing their legal relationship with the Service Provider. By visiting the Website or using the services provided on the Website, the user consents to the transfer of their personal data to any data processors engaged by the Service Provider for the purpose of data processing. The entity authorized to access the data is: Metripond-M93 Mérleggyártó Kft.

Data transfer:

Scope of data transferred: user’s name, telephone number, email address, home address/registered office, billing name and address, delivery address
Purpose of data transfer: to provide server services, including for the purpose of data storage

The Service Provider shall retain the personal data it has processed for the purposes of the user’s payment for and settlement of the service, the delivery of the product, and, where applicable, the processing of invoicing, until the user unsubscribes from the newsletter or the newsletter service is discontinued, unless otherwise provided for by the relevant legislation.

Please note that you may request the deletion of your personal data from the above data processors or data controllers at any time.

9. Data security

As a data security requirement, the Info Act stipulates that the data controller must plan and carry out data processing operations in a manner that ensures the protection of the privacy of the data subjects. The data controller—or, within the scope of its activities, the data processor—is obliged to ensure the security of the data; furthermore, it must implement the necessary technical and organizational measures and establish the procedural rules required to give effect to the Info Act and other regulations concerning data protection and the protection of confidential information. Data must be protected through appropriate measures, specifically against unauthorized access, alteration, transmission, disclosure, deletion, or destruction, as well as against accidental destruction or damage, and against becoming inaccessible due to changes in the technology employed.

In order to protect data sets managed electronically within various registries, appropriate technical solutions must be implemented to ensure that the data stored in these registries—unless otherwise permitted by law—cannot be directly linked or associated with the data subject.

During the automated processing of personal data, the data controller and the data processor shall implement additional measures to prevent unauthorized data entry; to prevent the use of automated data processing systems by unauthorized persons via data transmission equipment; to ensure it is possible to verify and determine to which entities personal data have been or may be transmitted using data transmission equipment; to ensure it is possible to verify and determine which personal data were entered into the automated data processing systems, by whom, and when; to ensure the recoverability of the installed systems in the event of a malfunction; and to ensure that reports are generated regarding any errors occurring during automated processing.

When determining and implementing measures to ensure the security of data, the data controller and the data processor must take into account the current state of the art. Where there are several possible data processing solutions, the one that ensures a higher level of protection for personal data must be chosen, unless this would impose a disproportionate burden on the data controller.

10. The rights of data subjects/users

Under the provisions of the Info Act, the data subject may submit a request to the data controller

a) information regarding the processing of your personal data,

b) the rectification of their personal data, and

c) the erasure or blocking of their personal data (with the exception of data processing required by law).

At the request of the data subject, the data controller shall provide information regarding the data concerning the data subject that it processes, or that is processed by a data processor commissioned by it or acting on its instructions, the source of such data, the purpose of the data processing, its legal basis, its duration, the name and address of the data processor and the activities carried out in connection with the data processing, and – where the data subject’s personal data have been transferred – the legal basis for the transfer and the recipient of the data.

The data controller shall maintain a record of data transfers for the purposes of verifying the lawfulness of data transfers and informing the data subject; this record shall include the date of the transfer of the personal data processed by the data controller, the legal basis for the data transfer and the recipient, a specification of the scope of the personal data transferred, and any other information specified in the legislation governing data processing.

The data controller is obliged to respond to a request for information in writing, in a form that is easy to understand, as soon as possible after the request is submitted, but within a maximum of 30 days. The information shall be provided free of charge if the person requesting the information has not yet submitted a request for information to the data controller in the current year concerning the same set of data. In other cases, a fee may be charged.

If the personal data does not correspond to the facts, and the data controller has access to personal data that does correspond to the facts, the data controller shall rectify the personal data.
Personal data must be erased if

a) its processing is unlawful;

b) the data subject under Section 14 of the Info Act

as set out in point c);

c) where the entry is incomplete or incorrect – and this situation cannot be lawfully rectified – provided that the law does not preclude its deletion;

d) the purpose of the data processing has ceased to exist, or the statutory time limit for the storage of the data has expired;

e) it has been ordered by a court or the Authority.

Instead of erasure, the data controller shall block the personal data if the data subject so requests, or if, on the basis of the information available to the data controller, it can be assumed that erasure would prejudice the data subject’s legitimate interests. Personal data blocked in this way may be processed only for as long as the purpose of data processing which precluded the erasure of the personal data continues to exist.

The data subject, as well as all those to whom the data has previously been transferred for the purposes of data processing, must be notified of any rectification, blocking, marking or erasure. Notification may be omitted if this does not infringe the data subject’s legitimate interests in view of the purposes of the data processing.

If the data controller does not comply with the data subject’s request for rectification, blocking or erasure, it shall, within 30 days of receiving the request, provide in writing the factual and legal grounds for rejecting the request for rectification, blocking or erasure. Where a request for rectification, erasure or blocking is refused, the data controller shall inform the data subject of the right to seek judicial redress and of the possibility of lodging a complaint with the Authority.

11. Legal remedies

We would like to inform you that, as a user, you may object to the processing of your personal data under the Info. Act. if

• the processing or transfer of personal data is necessary solely for the fulfilment of a legal obligation to which the Service Provider is subject, or for the purposes of the legitimate interests of the Service Provider, the recipient of the data or a third party, unless the processing is required by law;
• a személyes adat felhasználása vagy továbbítása közvetlen üzletszerzés, közvéleménykutatás vagy tudományos kutatás céljára történik;
• in other cases specified by law.

The Service Provider shall examine the objection as soon as possible—but no later than 15 days—from the date of its submission, decide on its merits, and inform the applicant of its decision in writing. If the Service Provider finds the objection to be well-founded, it shall cease data processing (including any further collection or transfer of data) and block the data. Furthermore, it shall notify all parties to whom the personal data in question had previously been transferred—and who are required to take action to facilitate the exercise of the right to object—regarding the objection and the measures taken in response to it. If the user disagrees with the Service Provider’s decision, or if the Service Provider fails to meet the aforementioned deadline, the user may turn to a court of law within 30 days of the notification (or the expiry of the deadline). Additionally, the user may seek judicial recourse in the event of an infringement of their rights. The court shall handle the matter on an expedited basis.

The data controller is obliged to prove that the processing of data complies with the provisions of the law. The data recipient is obliged to prove the lawfulness of the data transfer.

The court has jurisdiction to hear the case. The case may also be brought before the court with jurisdiction over the data subject’s place of residence or place of stay, at the data subject’s discretion.

A party to the proceedings may also be a person who would otherwise lack legal capacity to be a party to the proceedings. The Authority may join the proceedings on behalf of the person concerned
may intervene to ensure the success of the case.

If the court grants the application, it shall order the data controller to provide information, to rectify, block or erase the data, to annul a decision taken by means of automated data processing, to take account of the data subject’s right to object, and to disclose the data requested by the data recipient.

If the court rejects the data recipient’s application, the data controller is obliged to erase the data subject’s personal data within 3 days of the judgment being delivered. The data controller is also obliged to erase the data if the data recipient does not bring the matter before the court within the specified time limit.

The court may order that its judgment be made public – including the publication of the data controller’s identifying details – if this is required in the interests of data protection and the protected rights of a large number of data subjects.

12. Compensation

If the data controller causes damage to another person through the unlawful processing of the data subject’s data or by breaching data security requirements, the data controller is obliged to compensate for such damage.

If the data controller infringes the data subject’s right to privacy by unlawfully processing their data or by breaching data security requirements, the data subject may claim compensation from the data controller.

The data controller shall be liable to the data subject for any damage caused by the data processor, and the data controller shall also be obliged to pay the data subject compensation for the infringement of their right to privacy caused by the data processor. The data controller shall be exempt from liability for the damage caused and from the obligation to pay compensation if it proves that the damage or the infringement of the data subject’s right to privacy was caused by an unavoidable cause falling outside the scope of the data processing.

No compensation for damages is payable and no compensation for pain and suffering may be claimed to the extent that the damage or the infringement of a personal right resulted from the deliberate or grossly negligent conduct of the person concerned.

13. Final provisions

Please be advised that the Service Provider is the sole rights holder of the information (text, images, videos, and other content) displayed or contained on the Website. The content and design of the Website are protected by both Hungarian and international law. Furthermore, it is prohibited to sell, publish, copy, alter (in any form), republish, or distribute information or articles originating from the Service Provider or the Website. We reserve all other rights regarding the published material and will, if necessary, enforce them through judicial or other legal channels.

Please do not use the Website if you do not agree with the above.

Should you have any further questions regarding data protection or data processing,
Please contact one of our staff members using the contact details below:

• e-mail: info@metristeel.hu
• tel.: +36 62 246-450

As part of the service we provide to our users, the Service Provider offers various links to access other third-party websites. The privacy policy set out here does not apply to these sites. Please check the legal and privacy policies of any websites you wish to visit via our links.

Please note that the Service Provider reserves the right to amend these Terms and Conditions unilaterally; such amendments shall come into effect upon their publication on the Website. We may also publish a notice on our Website regarding any particularly significant or substantial changes.

In view of this, we recommend that you keep up to date with our Privacy Policy. Please note that by continuing to use our website, you accept our Privacy Policy and any changes we may make to it.
Az adatkezelő adatvédelmi nyilvántartási száma:

14. Applicable legislation

In drawing up the Data Protection and Data Processing Policy, the following legislation was primarily taken into account and applied:

Act V of 2013 – on the Civil Code

Act CXII of 2011 – on the right to informational self-determination and freedom of information

Act CVIII of 2001 – on certain aspects of electronic commerce services and services relating to the information society

Act XLVIII of 2008 – on the fundamental conditions and certain restrictions governing commercial advertising activities

Act C of 2003 on Electronic Communications