Privacy Policy

General Data Processing Policy
This data processing information pertains to all personal data managed by Sturm und Drang Tanácsadó és Szolgáltató Kft.. It is accessible in online and internal company rule formats on the websites and social media managed by the company. In accordance with GDPR obligations, data subjects can find out why we request their voluntary consent to process their data, how long we retain it, and how we dispose of it. Personal data is processed in compliance with applicable laws for both legal obligation and business development purposes, and it will not be shared with third parties without the consent of the data subject.

Data controller information and contact details
• Name of data controller: Sturm und Drang Tanácsadó és Szolgáltató Kft.
• Address: 1121 Budapest, Csillagvölgyi út 4/e. fszt.1.
• Company registration number: 01-09-300937
• Name of the registering court: Metropolitan Court
• Tax number: 26082822-2-43
• Phone: +36 20 207 6608
• Email: info@sturm.hu
• Employees, agents, and collaborating partners of Sturm und Drang Tanácsadó és Szolgáltató Kft. are committed to protecting any data they acquire in their work and accepting related confidentiality obligations and compliance with the company's data management policies.

Data Processing Description:
Data processing is voluntary and can be initiated by the clear consent of users based on the information provided in this policy during website registration and product-related inquiries. It only extends to those data that users submit to the Data Controller during registration, modification, or inquiry and grant their consent for processing in accordance with the above.

Legal basis for data processing:
According to § 5 (1) of Act CXII of 2011 on the right to informational self-determination and freedom of information, the voluntary consent of the data subject, as well as the General Data Protection Regulation (GDPR) effective from May 25, 2018.

Scope of the data processing policy:
This data processing policy applies to all internet content services of the Data Controller, and also to documents maintained on paper.

Types of processed data:
Names and contact details provided by the user are considered personal data, which the Data Controller will not disclose, transmit, or publish to third parties. The email address provided by the user is also personal data, which the Data Controller will not disclose, transmit, or publish, except if the user initiates contact with the boat owner. Accordingly, the email address will not appear on any content pages provided by the Data Controller. The processed data will not be transmitted by the Data Controller, and various data processing activities will not be linked together.

Purpose of data processing:
For mandatory data given by the user, the purpose is to facilitate sending ordered services (notifications, newsletters, contracts, etc.). The stored data in the software during the viewing of the Data Controller's content pages is solely for statistical purposes. The Data Controller will not use personal data for purposes other than the specified ones. Personal data will only be transferred to third parties with the prior and detailed consent of the user based on comprehensive information. This does not apply when the law prescribes data transfer for the Data Controller as an obligation.

Duration of data processing:
For data that the user is required to provide, as long as the user is a member of the community (The Data Controller deletes the data within 5 business days after receiving the user's voluntary deletion request. If the user unlawfully and deceptively uses personal data, the Data Controller may delete all personal data simultaneously with the deletion of registration as described in the terms and conditions upon acquiring knowledge of it).

Data storage:
The Data Controller stores personal data on the server, only in digital form. Only those authorized personnel involved in fulfilling the services related to the managed data have access to it. For the security of the data, the Data Controller applies at least the industry-standard security system and ensures its regular updates and expansions, and will do everything expected to prevent unauthorized access to the managed data.
The Data Controller does not engage a data processor for data processing.
The data subjects are entitled to the rights specified in § 14 (1) a), b), and c) of Act CXII of 2011 concerning access to information, correction of data, and deletion of data.
Following the obligation outlined in § 15 (1) of Act CXII of 2011, the Data Controller deletes the processed data if its processing is unlawful; requested by the data subject; if it is incomplete or inaccurate – and this cannot be legally rectified, provided that the deletion is not prohibited by law; the purpose of processing has ceased, or the statutory retention period has expired; or it has been ordered by a court or the data protection commissioner.
The Data Controller will promptly notify the data subject of any corrections or deletions.

General provisions on data processing:
Personal data may only be processed if
• the data subject consents, or
• it is mandated by law or a local government ordinance based on the authority given by law.
Personal data can only be processed for a specific purpose, in the exercise of rights, and the fulfillment of obligations. Data processing must meet this purpose at every stage.
Only such personal data can be processed which is essential for the realization of the purpose of data processing and only to the necessary extent and duration for achieving that purpose.
Personal data can only be processed with informed, unequivocal consent.
The data subject must be provided with clear and comprehensible information about all facts related to the processing of their data, particularly regarding the purpose and legal basis of data processing, the person entitled to data processing and data processing, the duration of data processing, and who may access the data. The information must also cover the data subject’s rights and remedies regarding data processing.
The processed personal data must meet the following requirements:
• their acquisition and processing must be fair and lawful;
• they must be accurate, complete, and, if necessary, up to date;
• their method of storage must be suitable for identifying the data subject only as long as necessary for the purpose of storage.
The use of general, uniform identification methods without restrictions is prohibited.
Personal data can only be transmitted and different data processing activities can only be linked if the data subject has consented, or if the law permits it, and if the conditions of data processing are met for each personal data.
Personal data may be transferred to a data controller or processor in a third country only if the data subject expressly consents to it, or if the law allows it, and if the appropriate level of protection of the personal data is ensured during its handling or processing in the third country. Transfers to EEA member states should be regarded as if data were being transferred within Hungary.
Personal data managed by Sturm und Drang Ltd., the purpose and duration of data processing:
• Name of data controller: Sturm und Drang Tanácsadó és Szolgáltató Kft.
• Areas of data processing: websites and other online platforms, office documentation
• Purpose of data processing: business (customer acquisition, communication, offers, newsletters, promotions, events, sending information via email, and other online forums, invoicing, etc.) accounting, labor
• Legal basis for data processing: The voluntary consent of the data subject (Act CXII of 2011 § 5 (1) a)), GDPR and applicable national regulations.
• Actual location of data processing: 1121 Budapest, Csillagvölgyi út 4/e. fszt.1.
• Scope of data subjects: newsletter subscribers, inquiry submitters, clients, partners, employees, online and offline visitors
• Level of automation in data processing: computerized, virus-protected, and multiple password protected on a dedicated server
• Data may be transmitted to third parties upon the data subject’s consent, for the purpose of achieving objectives.
• Data deletion deadlines by purpose:
• Online data: upon the data subject’s voluntary deletion request, which can be made at any time, also during data verification and updates (annually), if the data has reached its purpose.
• Customer data online and offline: one year; in the case of major system implementations, following the contract, for the duration of the warranty; maximum time defined by accounting laws.
• Camera recordings for the company's asset security will be updated every three days and stored on the server for 30 days, and maintained until the investigation is closed in case of an incident.
• Data on paper for office activities will be kept until the purpose is achieved, as well as for the duration specified by accounting laws.
Relevant legislation:
The data controller commits to conducting its activities in compliance with current legislation. These laws are as of the issuance of the present document:
• Act CVIII of 2001 on certain issues of electronic commerce services and information society services (hereinafter referred to as the electronic commerce act).
• Act XLVIII of 2008 on the basic conditions and certain restrictions of economic advertising activities (hereinafter referred to as the economic advertising act).
• Act CXII of 2011 on informational self-determination and freedom of information.
• EU Regulation 2016/679 on the protection of natural persons with regard to personal data processing and on the free movement of such data (GDPR).
• The current status of legislation is available on the website net.jogtar.hu.

Definitions applied by Sturm und Drang Consulting and Service Ltd. within the framework of the data protection management regulations sensu stricto, based on § 3 of Act CXII of 2011:
1. data subject: any identifiable natural person based on specific personal data;
2. personal data: any information that can be associated with the data subject – especially the data subject's name, identifier, and one or more factors regarding their physical, physiological, mental, economic, cultural, or social identity – and conclusions concerning the data subject that can be drawn from the data;
3. special data: -
4. criminal personal data: -
5. public interest data: information that is managed by an authority or entity performing a public task and related to its function or occurs as a result of public tasks, which does not fall under the category of personal data, recorded in any way or form, regardless of its method of management, independent of its independent or compiled nature, including assessments covering jurisdiction, competence, organizational structure, professional activities, efficiency, types of data held, laws governing operations, and contractual data;
6. publicly available data of public interest: every data other than those that fall under the category of data of public interest, the publication, recognizability, or accessibility of which is required by law in the public interest;
7. consent: the voluntary and definitive expression of the wishes of the data subject, based on appropriate information, providing unambiguous consent to the processing of relevant personal data – either fully or for specific operations;
8. objection: the data subject's declaration contesting the processing of their personal data and requesting the termination of data processing or deletion of processed data;
9. data controller: any natural or legal person, or organization without legal personality who independently or jointly determines the purposes of data processing, makes and implements decisions regarding data processing (including the tools used), or has it performed by a data processor in their charge;
10. data processing: any operation performed on data, regardless of the procedure used, including collection, recording, organization, storage, alteration, utilization, retrieval, transmission, publication, harmonization, or combination, blocking, deletion, and destruction of data, as well as preventing further use of the data, the taking of photographs, audio or visual recordings, and capturing physical characteristics (e.g., fingerprints, DNA samples, iris image) suitable for personal identification;
11. data transfer: making data accessible to a specified third party;
12. public disclosure: making data accessible to anyone;
13. data deletion: making data unrecognizable in such a way that their restoration is no longer possible;
14. data marking: applying an identifying label to distinguish data;
15. data retention: applying an identifying label to limit further processing of data for a certain period;
16. data destruction: the complete physical destruction of the data-bearing medium;
17. data processing: conducting technical tasks related to the data processing operations, irrespective of the methods and tools used to carry out those operations and the location where the application is performed, provided that the technical task is performed on the data;
18. data processor: a natural or legal person, or organization without legal personality who performs data processing based on a contract concluded with the data controller (including contracts established by legal provisions);
19. data controller: the public authority which has produced a public interest data that must be published electronically;
20. data provider: the public authority that publishes the data it has received from the data controller, if the data controller does not publish the data itself;
21. dataset: the totality of data managed in a register;
22. third party: a natural or legal person, or organization without legal personality that is not identical with the data subject, data controller, or data processor;
23. EEA state: a member state of the European Union and another state party to the Agreement on the European Economic Area, as well as any state whose citizen enjoys the same status by virtue of an international agreement concluded between the European Union, its member states, and states not party to the Agreement on the European Economic Area;
third country: any state that is not an EEA state.
Remedies:
The data subject may request information about the processing of their personal data, as well as request corrections to their personal data, and delete them – except in cases of legally prescribed data processing – in the manner indicated at the time of data collection, or via the customer service of the data controller.
Upon request, the data controller provides information about the personal data they manage, the purpose of data processing, its legal basis, duration, the name and address (headquarters) of the data processor, and activities related to data processing, as well as who has received or will receive the data and for what purposes. The data controller provides the information in writing in an understandable form within the shortest possible time from the submission of the request, but not exceeding 30 days. This information is free of charge if the requesting party has not submitted a request for information related to the same area to the data controller within the current year. Otherwise, the data controller may specify a fee.
The data controller deletes personal data if its processing is unlawful, requested by the data subject, the purpose of data processing has ceased, or the statutory retention period has expired, or it has been ordered by a court or the data protection authority.
The data controller informs the data subject and all those to whom the data has been transferred for processing about corrections or deletions. Notifications may be excluded if this does not infringe upon the legitimate interests of the data subject regarding their purpose of data processing.
The data subject may contest the processing of their personal data if
• the processing of personal data (transfer) is necessary solely for the enforcement of rights or legitimate interests of the data controller or the recipient, except where the processing is mandated by law;
• the personal data is used or transmitted for direct marketing, public opinion polling, or scientific research purposes;
• the law otherwise permits the exercise of the right to appeal.
The data controller will examine the objection and notify the applicant in writing within the shortest time following the request, but no longer than 15 days, while suspending the processing. If the objection is justified, the data controller terminates the processing – including further data collection and transfer – and blocks the data, as well as informs all individuals to whom the contested personal data has previously been transmitted to take action to enforce the objection.
If the data subject disagrees with the decision made by the data controller, they may appeal to the courts within 30 days from the notification of that decision.
The data controller cannot delete the data if it is mandated by law. However, the data may not be transferred to the recipient if the data controller agrees with the objection, and the court establishes the validity of the objection.
In case of violation of their rights, the data subject may turn to the courts against the data controller. The court acts on such matters without delay.
For remedies or complaints, one can contact the National Authority for Data Protection and Freedom of Information:
• Name: National Authority for Data Protection and Freedom of Information
• Address: 1125 Budapest, Szilágyi Erzsébet fasor 22/c.
Mail address: 1530 Budapest, Pf.: 5.
• Phone: +36 (1) 391-1400
• Fax: +36 (1) 391-1410
• Website: http://naih.hu
Data Protection Declaration:
The data controller may pass personal data to third parties such as carriers, subcontractors, etc., if the third party acts during the conclusion of a contract with the interested party based on a mandate contract between the data controller and the third party. The third-party data controller commits to lawful processing of the personal data received under the mandate contract. If the personal data is collected with the consent of the data subject, the data controller may process the collected data to comply with legal obligations related to them, or to exercise the interests of the data controller or third parties, provided that this interest is proportionate to any restrictions of rights related to the protection of personal data, without requiring further consent, and may continue processing even after the withdrawal of the data subject's consent.