General Privacy Notice

Company name: Property Solution Group Kft.
Registered office: 1016 Budapest, Derék utca 2.
Company registration number: 01-09-191972
Tax number: 24963200-2-41

Data controller and data processor roles

As a data controller, our company determines the purposes and means of processing personal data alone or jointly with others, and as a data processor it processes personal data on behalf of the data controller.

Data processing (controlling) means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Data processing on behalf of a controller is data handling of a technical nature, without any right of disposal or decision over the data.

Personal data means any information relating to an identified or identifiable natural person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

As a data controller and data processor, our company respects the privacy of all persons who provide personal data to it and is committed to protecting such data.

I.

Pursuant to Article 13 of the GDPR, our company provides the following information to data subjects:

Data controller details:

Company name: Property Solution Group Kft.
Registered office: 1016 Budapest, Derék utca 2.
Web page: psg-irodahazak.hu
Contact person: Fekete József Richárd, managing director
Phone: +36 20 381 3917
E-mail: info@psg-irodahazak.hu

Data processing:

Data processors:

CRM system

Name: DevMonkeys Software Kft. (MomoCRM)
Address: 1141 Budapest, Vízakna utca 4.
Phone: +36 20 500 1530
E-mail: hello@momocrm.hu
Website: https://momocrm.com/
Stored data: data stored in the CRM system
Operations: operation of the CRM system

Web analytics

Name: Google Ireland Limited
Address: Gordon House Barrow Street Dublin 4, Ireland
Phone: N/A
E-mail: N/A
Website: https://www.google.com/
Stored data: website visit data, visitor identification cookie
Operations: analysis of website visit data

Development, server services, data backups, email and document management

Name: e-Communication Kft.
Address: 1141 Budapest, Vízakna utca 4.
Phone: +36 1 613 2634
E-mail: hello@e-com.hu
Website: https://e-com.hu/
Stored data: correspondence, calendar entries, phone contacts, encrypted static files.
encrypted data backups
Operations: email service, document management, calendar service, hosting, server monitoring

Only the narrowest necessary group of people has access to servers containing live data.
All access is strictly logged and protected in multiple ways with SSH keys and passwords.
The data processor may only carry out instructions that are recorded in writing.
A written contract must be concluded between the data controller and the data processor, which must specify the data transferred by the data controller to the data processor and the activities the data processor performs with them.
Employees handling personal data are bound by confidentiality.
To guarantee data security, the data processor implements organisational and technical measures.
The data processor assists the data controller in fulfilling its obligations.
At the choice of the data controller, the data processor returns all personal data to the data controller or deletes it and deletes existing copies, with one exception: if Member State or Union law requires the storage of the data.
The data processor facilitates and allows audits and on-site inspections conducted by the data controller or by an auditor mandated by it.
If the data processor engages another data processor, the same obligations apply to it as were originally established by the contract between the data processor and the data controller.

Data protection officer:

Pursuant to Article 37 of the GDPR, our company is not obliged to appoint a data protection officer

Data protection requests: if you have any request or question regarding data processing, you can send your request by post to 1016 Budapest, Derék utca 2. or electronically to info@psg-irodahazak.hu. We will send our reply without delay, but no later than within 30 days, to the address you specify.

Data transfers abroad:

we do not transfer data outside the European Economic Area (EEA).

II.

Purpose, legal basis and duration of our company's data processing:

Purposes of data processing:

in connection with providing online and in-person real estate brokerage services, we process the data of those using the service on the basis of a quotation, order or contract, for the purpose of fulfilling legal obligations and maintaining client relationships;
marketing activities for potential clients;
processing the data of employees and applicants (under conditions set out in a separate policy);
processing the contact details of contractual partners for the purpose of performing the contract;
fulfilling client orders;
for the purpose of fulfilling obligations prescribed by law

Legal basis for data processing:

GDPR Article 6(1)(a): consent of the data subject
GDPR Article 6(1)(b): necessary for the performance of a contract
GDPR Article 6(1)(c): necessary for compliance with a legal obligation
GDPR Article 6(1)(a): legitimate interest, a balancing of interests is always required

Legal basis of individual data processing activities:

issuing invoices in accordance with accounting legislation: legal basis: GDPR Article 6(1)(c)
contact: legal basis (for the data of partners' employees, the data processing) legal basis: GDPR Article 6(1)(f). Legitimate interest of the data controller: business continuity.
processing employee data: GDPR Article 6(1)(b) and (c).
processing data of contractual partners: legal basis GDPR Article 6(1)(b)
marketing activities: legal basis: GDPR Article 6(1)(a).
A Facebook page is also operated for marketing purposes, but no separate database is created and no profiling takes place.
online registration legal basis: GDPR Article 6(1)(a)
operation of security cameras legal basis: GDPR Article 6(1)(f). Legitimate interest of the data controller: protection of property and, in the case of employees, the legitimate employer interest defined in the Labour Code.

When processing the personal data of a data subject on the basis of legitimate interest, we carry out a balancing of interests, during which:

we identify and record the legitimate interest
we identify and record the interests and rights of the data subject
assessment based on the principles of necessity and proportionality, purpose limitation, data minimisation and storage limitation
we inform the data subject about the balancing of interests

The data subject has the right to object, on the basis of which we no longer process the personal data, unless the processing is justified by compelling grounds (e.g. in the case of data that must necessarily be processed in connection with employment)
There are no compelling grounds in the case of direct marketing; in the event of an objection, the data must be deleted.
(Direct marketing includes advertisements that approach potential clients directly. This can be done electronically, by phone call, by post, etc. Special rules apply to each method. Here the data subject is the recipient of the advertisement, i.e. the person whom the advertisement reaches or targets. The personal data of the data subject may be processed, for example, by the operator of a website or webshop.)

Duration of data processing:

Due to legal obligations, we retain invoices for at least 8 years. The documents underlying invoicing are retained for 8 years.
Retention period of documents underlying employment: 50 years.
Data provided for contact purposes are retained for 1 year after the relationship ends.
Retention of data related to the performance of contracts: 5 years.

III.

Rights of data subjects:

right of access (to learn the data and whether data processing is taking place);
rectification of data that is outdated or incorrect;
erasure (only in the case of data processing based on consent);
restriction of the processing of data;
prohibiting the use of personal data for direct marketing purposes;
transfer of their personal data to a third-party service provider, or prohibiting such transfer;
requesting a copy of any personal data processed by the data controller; or
objecting to the use of personal data.

IV.

Personal data breach:

A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, the personal data processed.

Our company ensures a level of data security appropriate to the risk associated with data processing; in the event of a breach, without delay and no later than 72 hours after becoming aware of it, our data protection officer or, in the absence thereof, the data controller/data processor or its representative notifies the supervisory authority and also informs the data subject.

After becoming aware of a personal data breach, our company immediately takes the necessary security measures to eliminate and remedy the damage underlying the personal data breach.

We notify the data subject of the measures taken and their results.

V.

Information on legal remedies:

In Hungary, the data protection supervisory authority is the Hungarian National Authority for Data Protection and Freedom of Information (hereinafter: NAIH, address: 1125 Budapest, Szilágyi Erzsébet fasor 22/C, e-mail: ugyfelszolgalat@naih.hu). The data subject may lodge a complaint with the NAIH if they consider that the processing of personal data relating to them does not comply with legal requirements.

Judicial review may be initiated against the decision of the NAIH.

VI.

Information on records:

Our company processes and handles data lawfully, transparently and verifiably.

Dated: Budapest, 25 May 2018.

Fekete József Richárd managing director

Property Solution Group Kft.