Privacy policy

Legal background. Data processing is governed by Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.), Act C of 2000 on Accounting, and Regulation (EU) 2016/679 of the European Parliament and of the Council.

Legal basis. Your consent, under Infotv. Section 5(1)(a). If you withdraw your consent, the Data Controller fulfils the legal obligation set out in the Accounting Act under Infotv. Section 6(5)(a).

Purpose. To issue invoices in compliance with the law and to meet the obligation to keep accounting records. Under Section 169(1)–(2) of the Accounting Act, companies must keep the accounting documents that directly and indirectly support their accounting records.

Under Section 169(2) of the Accounting Act, issued invoices are kept for eight years from the date of issue. If you withdraw your consent, the Data Controller is still entitled under Infotv. Section 6(5)(a) to keep the personal data needed for invoicing for 8 years.

Legal background and basis: Infotv.; consent under Infotv. Section 5(1)(a).

Purpose: to deliver the goods you ordered, as you requested, with the help of our contract partner.

Data: name, address, email address, phone number.

Retention: for the duration of delivery of the ordered goods.

Legal background and basis: Infotv. and Act V of 2013 on the Civil Code; your consent under Infotv. Section 5(1)(a).

Purpose: storing the data you enter at registration lets us serve you more conveniently, for example so you don't have to re-enter it for a new purchase.

Data: name, address, phone number, email address, the products purchased and the date of purchase.

Retention: until you withdraw your consent.

The Data Controller has taken appropriate security measures to protect personal data against unauthorised access, alteration, transmission, disclosure, deletion or destruction, and against accidental destruction or damage, including damage resulting from changes in the technology used.

During the period of processing you have the right to information, to rectification, to erasure, to blocking and to object.

• Information. You may ask the Data Controller how your personal data is processed. As soon as possible, and no later than 25 days after your request, the Data Controller will tell you what data it processes, for what purpose, on what legal basis and for how long, and, where data was transferred, to whom and why.
• Rectification. You may ask for your personal data to be corrected. Requests are handled within 15 days.
• Erasure. You may ask for your personal data to be deleted; the Data Controller will do so within 15 days. This does not apply where the law requires the data to be kept, or where the Data Controller may keep processing it under Infotv. Section 6(5) (e.g. invoicing).
• Blocking. You may ask for your data to be blocked if deleting it would harm your legitimate interests. Blocked data may be processed only while the purpose that prevented its deletion exists.
• Objection. You may object to processing (a) where processing or transfer is necessary only to fulfil the Data Controller's legal obligation or to enforce the legitimate interest of the Data Controller, a data recipient or a third party, except for mandatory processing and processing under Infotv. Section 6(5); or (b) where your data is used or transferred for direct marketing, polling or scientific research without your consent. The Data Controller examines an objection as soon as possible, and within 15 days of receipt decides whether it is justified and informs you in writing.

If the Data Controller does not grant a request for rectification, blocking or erasure, it tells you in writing, or electronically with your consent, the factual and legal reasons within 25 days of receiving the request.

Under the Infotv., the Data Controller must register certain processing operations in the Data Protection Register.

Lufi Expressz Ltd. processes the personal data provided during registration and use of the site in accordance with Act LXIII of 1992 on the Protection of Personal Data and the Publicity of Data of Public Interest. Providing personal data on www.lufiplaza.hu is voluntary. The purpose of processing is to provide the services requested on the site. Lufi Expressz Ltd. ensures the security of the data and takes technical and organisational measures against unauthorised access, alteration, transmission, disclosure, deletion or destruction, and against accidental destruction and damage. Data is not disclosed to third parties.

Right to information. The data subject may request information about the processing of their personal data (Section 11(1)(a)). On request, the Data Controller informs the data subject about the data it or its processor processes, the purpose and legal basis of processing, the name, address and activities of the processor, and who has received the data and why. The Data Controller provides this in writing, in an intelligible form, within at most 30 days of the request. Information may be refused only where the law allows, and the Data Controller must give the reasons for refusal (Sections 12–13).

Rectification and erasure. The data subject may request rectification or erasure of their personal data (Section 14(1)). Personal data must be erased if (a) processing is unlawful; (b) the data subject requests it under Section 11(1)(b); (c) it is incomplete or incorrect and cannot lawfully be corrected, provided erasure is not excluded by law; (d) the purpose of processing has ceased or the statutory storage period has expired; or (e) a court or the Data Protection Commissioner has ordered it. The data subject and everyone to whom the data was previously transferred must be notified of the rectification or erasure, unless this does not harm the data subject's legitimate interests (Sections 14–15).

Objection. The data subject may object if (a) processing is necessary only to enforce a right or legitimate interest of the Data Controller or the data recipient, unless processing is required by law; (b) the data is used or transferred for direct marketing, polling or scientific research; or (c) objection is otherwise permitted by law. The Data Controller suspends processing, examines the objection as soon as possible but within 15 days, and informs the applicant in writing. If the objection is justified, it stops processing, including further collection and transfer, blocks the data, and notifies everyone to whom it previously transferred the data, who must also act on the objection. If the data subject disagrees with the decision, they may go to court within 30 days of being notified. If a data recipient cannot obtain data it needs to enforce its rights because of the objection, it may go to court against the Data Controller within 15 days of notification, and the Data Controller may join the data subject to the proceedings. If the court rejects the data recipient's claim, the Data Controller erases the data subject's personal data within 3 days of the judgment being delivered; it must also erase the data if the recipient does not go to court within the deadline. The Data Controller may not erase data whose processing is required by law, but the data may not be transferred to the recipient if the Data Controller agreed with the objection or the court found it justified (Section 16/A).

Judicial remedy. If their rights are violated, and in the case under Section 16/A(4), the data subject may go to court against the Data Controller. The court proceeds as a matter of priority. The Data Controller must prove that its processing complies with the law. The regional court of the Data Controller's seat has jurisdiction; the case may also be brought before the court of the data subject's residence, at the data subject's choice. A person without legal capacity may also be a party. If the court upholds the claim, it orders the Data Controller to provide the information, rectify or erase the data, annul the automated individual decision, respect the objection, or disclose the data required under Section 16/A(4). The court may order its judgment to be published, identifying the Data Controller, where data protection interests or the rights of a larger number of data subjects require it (Section 17(1)).

Compensation. The Data Controller must compensate damage caused to others by unlawful processing of the data subject's data or by breaching technical data protection requirements. It is also liable for damage caused by its processor. It is exempt if it proves the damage was caused by an unavoidable cause outside the scope of processing. No compensation is due to the extent the damage results from the injured party's intentional or grossly negligent conduct (Section 18(1)).