Privacy Notice

I

General Section

Who processes your personal data? Who is the data controller?

In the course of processing your personal data, Next Ship Korlátolt Felelősségű Társaság (Next Ship Kft.) will act as the data controller.

What are the data controller’s contact details?

Next Ship Kft.’s

registered office: 2000 Szentendre, Pásztor utca 62/4.

branch office: 1036 Budapest, Perc utca 2.

telephone number: 06 20 621 7337

fax number: […]

e-mail address: hello@next-ship.com

Which data are considered to be personal data?

Personal data means any information relating to an identified or identifiable natural person (the “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Which personal data are included in the special categories of personal data?

Special categories of personal data are considered to be personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and genetic data and biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

Who is considered to be a data subject?

Next Ship Kft. may process the personal data of the following natural persons in particular:

• persons who subscribe to Next Ship Kft.’s newsletters (Chapter II/1)
• persons who fill the contact form (Chapter II/2)
• persons visiting the website https://www.next-ship.hu (Chapter II/3)

Which are the most important laws and regulations governing the processing activity of Next Ship Kft.?

Data processing is governed mainly by the following legislation:

• Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“General Data Protection Regulation” or “GDPR”)
• Act CXII of 2011 on the right of informational self-determination and on freedom of information

For what purpose, on what legal basis and for how long does Next Ship Kft. process personal data and which personal data are processed?

The purpose, legal basis and duration of processing personal data and a description of the personal data are given in the Special Section of this Privacy Notice.

Does Next Ship Kft. use automatic decision-making or profiling?

Next Ship Kft. does not use automatic decision-making and does not create profiles of data subjects from available data.

What rights do data subjects have?

Next Ship Kft. ensures the following rights for data subjects (Article 23, GDPR):

• the right to information,

• the right of access,
• the right to withdraw consent,
• the right to rectification,
• the right to erasure,
• the right to be forgotten,
• the right to restriction,
• the right to be informed about the recipients advised of the rectification or erasure of personal data, or the restriction of processing,
• the right to data portability,
• the right to object,
• the right to remedy.

The detailed explanation of the rights listed herein are contained by Appendix 1. of this Privacy Notice.

How can the data subject submit requests concerning data processing or for the withdrawal of the consent given for data processing?

The data subject may submit requests concerning data processing

• by post to the address: 1036 Budapest, Perc utca 2.,
• in person at the branch office of Next Ship Kft. (1036 Budapest, Perc utca 2.),
• by telephone (06 20 621 7337),
• by fax[…],
• by e-mail (hello@next-ship.com).

Dealing with the data subject’s requests

Next Ship Kft. will inform the data subject of the action taken in response to his or her request within one month of the receipt of the request. Where necessary, this time limit may be extended by another two months. Next Ship Kft. will inform the data subject of any such extension within one month of the receipt of the request, together with the reasons for the delay. If Next Ship Kft. does not act in response to the data subject’s request, it must provide information about the reasons for not taking action within one month of the receipt of the request, and advise the data subject of the option of lodging a complaint with a supervisory authority and seeking a judicial remedy.

Joint data processing

Next Ship Kft. is not involved in joint data processing activities.

Which data processor does the controller use?

Next Ship Kft. may use the services of data processors to process the personal data handled. Next Ship Kft. will only use a data processor who or which provides sufficient guarantees for the implementation of appropriate technical and organisational measures to ensure that the data processing complies with the legal requirements and that the rights of the data subjects are protected. The data processor may not engage an additional data processor without the prior written specific or general authorisation of Next Ship Kft.

Next Ship Kft. uses the companies below for data processing services:

• [x]

Does Next Ship Kft. transmit the personal data processed by it to third countries?

Next Ship Kft. does not transmit personal data to third countries on a regular basis.

What measures does Next Ship Kft. take to protect personal data?

Next Ship Kft. takes technical and organisational measures to protect the personal data processed by it, in particular against unauthorised access, alteration, transmission, disclosure, erasure or destruction, as well as accidental destruction, damage and inaccessibility due to changes in the technology used. To this end, inter alia,

• […].

Who is liable for damage caused by processing personal data?

Next Ship Kft. is liable for damage caused by the unlawful processing of personal data or a breach of the data security requirements and for an infringement of the data subject’s personal rights, and is obliged to compensate the damage if the violation is acknowledged or legally established. In the event of the infringement of the data subject’s personal rights, the data subject may claim restitution pursuant to Section 2:52 of Act V of 2013 on the Civil Code. Next Ship Kft. is also liable for any damage caused by the data processor used by it.

Next Ship Kft. will be exempt from liability if it proves that it is not in any way responsible for the event giving rise to the damage.

What legal remedies do you have as regards data processing?

In connection with the lawfulness of data processing, the data subject may initiate a procedure with the Hungarian National Authority for Data Protection and Freedom of Information (1055 Budapest, Falk Miksa utca 9-11, postal address: 1374 Budapest, Pf. 603, website: www.naih.hu, telephone: +36 (1) 391-1400, fax: +36 (1) 391-1410, central e-mail address: ugyfelszolgalat@naih.hu) or, at the choice of the data subject, apply to the court for the place where he or she is habitually or temporarily resident in Hungary or where Next Ship Kft. is based. The court of habitual or temporary residence in Hungary may be found on the web page http://birosag.hu/ugyfelkapcsolati-portal/birosag-kereso.

Next Ship Kft. has not appointed a data protection officer in the absence of a specific provision laying down such an obligation.

II

Special Section

Appendix 1.

Rights of the data subjects regarding data processing

Next Ship Kft. ensures the following rights for data subjects in cooperation with the data subjects in exercising these rights noting that Union or Member State law applicable to Next Ship Kft. may restrict the assertion of the rights of the data subject to the necessary and proportionate extent in order to protect the data subject or to protect the rights and freedoms of others or to enforce civil claims (Article 23, GDPR):

• the right to information:

Next Ship Kft. provides data subjects with the information required and specified by law in accordance with the principles of fair and transparent processing.

Next Ship Kft. provides the information specified by law to the data subject even where personal data have not been obtained from the data subject unless the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or Member State law, including a statutory obligation of secrecy,

• the right of access:

data subjects are entitled to obtain confirmation from Next Ship Kft. as to whether their personal data are currently being processed and, if that is the case, they are entitled to access their personal data and the information specified by law. Next Ship Kft. will provide a copy of the personal data undergoing processing to the data subject free of charge on one occasion. For any further copies requested by the data subject, Next Ship Kft. may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, Next Ship Kft. – unless otherwise requested by the data subject – will provide the information requested in a commonly used electronic format. The right to obtain a copy may not adversely affect the rights and freedoms of others (in particular a person deemed a client of Next Ship Kft. enforcing a civil claim) and access may be granted, irrespective of the request for a copy,

• the right to withdraw consent:

where the legal basis of data processing is the data subject’s consent, the data subject may withdraw consent for data processing at any time but the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. Next Ship Kft. may continue to process personal data after the withdrawal of consent for the purposes of fulfilling its legal obligations or legitimate interests provided that ensuring that the legitimate interest prevails is proportionate with the restriction of the right to the protection of personal data,

• the right to rectification:

the data subject may request Next Ship Kft. to rectify inaccurate or supplement missing personal data concerning him or her without undue delay,

• the right to erasure:

the data subject may request Next Ship Kft. to erase personal data concerning him or her without undue delay. The performance of such a request may only be denied in cases specified by law, in particular if data processing is necessary for compliance with a legal obligation which requires the processing of personal data laid down by Union or Member State law applicable to Next Ship Kft., or for the establishment, exercise and defence of legal claims. Where the law provides for an obligation of data processing, Next Ship Kft. may not erase the data of the data subject,

• the right to be forgotten:

this right compels Next Ship Kft. where it has made the personal data public and, in consequence of the right to erasure, is obliged to erase the personal data to take reasonable steps, including technical measures, taking account of available technology and the cost of implementation, to inform controllers which are processing the data that the data subject has requested the erasure of any links to, or copy or replication of, those personal data,

• the right to restriction:

the data subject may request Next Ship Kft. to restrict data processing if

• the accuracy of the personal data is contested by the data subject (in this case restriction is for a period that enables Next Ship Kft. to verify the accuracy of the personal data),
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead,
• Next Ship Kft. no longer needs the personal data for the purposes of the processing, but the data are required by the data subject for the establishment, exercise or defence of legal claims, or
• the data subject has objected to processing exercising the right to object pending the verification whether the legitimate grounds of Next Ship Kft. override those of the data subject,

• the right to be informed about the recipients advised of the rectification or erasure of personal data, or the restriction of processing:

Next Ship Kft. will inform all recipients to whom the personal data have been communicated of the rectification, erasure or restriction of the processing of the personal data at the data subject’s request unless this proves impossible or requires disproportionate effort. At the request of the data subject, Next Ship Kft. will provide information about such recipients,

• the right to data portability:

where the legal basis of data processing is the data subject’s consent or the performance of the contract, and the processing of personal data is carried out by automated means, the data subject has the right to

• receive the personal data concerning him or her, which he or she has provided to Next Ship Kft., in a structured, commonly used and machine-readable format,
• transmit those data to another controller without hindrance from Next Ship Kft.,
• where technically feasible, request Next Ship Kft. to directly transmit the personal data to another controller,

• the right to object:

the data subject has the right to object, on grounds relating to his or her particular situation, at any time to the processing of his or her personal data necessary for the performance of a task on the grounds of the legitimate interests of Next Ship Kft. or a third party. Next Ship Kft. will no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

• the right to remedy:

if the data subject considers that the processing of personal data relating to him or her infringes the legal regulations, the data subject has the right to lodge a complaint with a supervisory authority or to seek judicial remedy.

SOPRO –

“Where a data controller has an online presence, the WP29 recommends that the controller provides a privacy notice which is layered. The data subject should have a clear overview of the information available to them and on finding detailed information within the layers of the notice. The Guidelines provide that the first layer should always contain information on the processing which has the most impact on the data subject and processing which could surprise the data subject.”

There are various interpretations of that statement, while we understand some clients are taking the GDPR regulations more seriously than others, in order to meet our Compliance processes, we require all clients to include a statement in keeping with (or to the effect of) the statement set out below.

This is to ensure data subjects are notified of Sopro as an appointed data processor within the terms of their online privacy policy.

Clause for insertion as follows;

Third Party Processors
Our carefully selected partners and service providers may process personal information about you on our behalf as described below:
“Digital Marketing Service Providers
We periodically appoint digital marketing agents to conduct marketing activity on our behalf, such activity may result in the compliant processing of personal information. Our appointed data processors include:
(i)Prospect Global Ltd (trading as Sopro) Reg. UK Co. 09648733. You can contact Sopro and view their privacy policy here: http://sopro.io. Sopro are registered with the ICO Reg: ZA346877 their Data Protection Officer can be emailed at: dpo@sopro.io.”