Privacy policy

1. Introduction

UP! Light (hereinafter: UP! Light, the service provider, the data controller, the Company), as data controller, acknowledges the content of this legal notice as binding on itself.
The Company undertakes to ensure that all data processing related to its activities complies with the requirements set out in this policy and in the applicable legislation.
UP! Light is the operator of the uplight.hu website.

UP! Light reserves the right to amend this notice at any time. Naturally, it will notify its audience of any changes in due time.

UP! Light is committed to protecting the personal data of its customers and partners, and considers respecting its customers' right to informational self-determination to be of particular importance. The Data Controller treats personal data confidentially and takes all security, technical and organizational measures that guarantee the security of the data.

Below, UP! Light sets out its data processing principles and presents the requirements it has set for itself as data controller and complies with. Its data processing principles are in line with the applicable data protection legislation, in particular the following:

Act CXII of 2011 on the right to informational self-determination and on freedom of information;
Act V of 2013 on the Civil Code (Ptk.);
Act XLVIII of 2008 on the basic conditions and certain restrictions of commercial advertising (Grt.);
Act CVIII of 2001 (Ekertv.) on certain issues of electronic commerce services and information society services;
Regulation (EU) 2016/679 of the European Parliament and of the Council (27 April 2016) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: “GDPR”)

2. Definitions

data subject: any specific natural person who is identified, or can be identified directly or indirectly, on the basis of personal data;
personal data: data that can be associated with the data subject, in particular the data subject's name, identification number, and one or more pieces of knowledge characteristic of their physical, physiological, mental, economic, cultural or social identity, as well as any conclusion concerning the data subject that can be drawn from such data;
consent: a voluntary and definite expression of the data subject's wishes, based on adequate information, by which they give unambiguous consent to the processing of personal data concerning them, either fully or for specific operations;
data controller: the natural or legal person, or organization without legal personality, which alone or jointly with others determines the purpose of the processing of data, makes and implements decisions regarding the processing (including the means used), or has them implemented by a data processor;
data processing: any operation or set of operations performed on data, regardless of the procedure used, in particular collection, recording, organization, storage, alteration, use, retrieval, transmission, disclosure, alignment or combination, blocking, erasure and destruction, as well as preventing the further use of the data, taking photographs, sound or video recordings, and recording physical characteristics suitable for identifying a person (e.g. fingerprints or palm prints, DNA samples, iris images);
data transfer: making data accessible to a specific third party;
disclosure: making data accessible to anyone;
data erasure: making data unrecognizable in such a way that it can no longer be restored;
data processing (technical): performing technical tasks related to data processing operations, regardless of the method and means used to carry out the operations and the place of application, provided that the technical task is performed on the data;
data processor: the natural or legal person, or organization without legal personality, which processes data on the basis of a contract, including a contract concluded pursuant to a provision of law.

3. Company details

Our company details and contact information are as follows:

Name: UP! Light
Mailing address: 8412 Veszprém, Kincsási utca 4, door 1
Company registration number: 23895884
Tax number: 60859783-2-39
Phone: +36 30 333 0739
E-mail: info@uplight.hu
Representative of the data controller: Balázs Somogyi, sole proprietor, owner

4. Scope of personal data, purpose, legal basis and duration of processing

We draw the attention of those providing data to UP! Light to the fact that if they do not provide their own personal data, it is the data provider's obligation to obtain the data subject's consent. The data controller is not obliged to verify this. The data controller draws the partner's attention to the fact that if they fail to fulfill this obligation and the data subject therefore asserts a claim against the data controller, the data controller may pass on the asserted claim and the amount of the related damage to the partner.

We provide the following information regarding each of our data processing activities.

4.1. Quote requests and inquiries by direct contact

Interested parties may contact our Company directly by e-mail sent to the Company's address or by telephone.

Purpose of processing: maintaining contact, facilitating communication between the data subject and our Company, and enabling the closest and most effective cooperation possible.
Legal basis of processing: legitimate interest, Article 6(1)(f) GDPR
Scope of personal data processed: name of the requester/contact person; e-mail address, phone number and other information provided by the data subject
Duration of processing: 3 years after the validity period of the quote, or until the data subject objects
Recipients of personal data: the data controller does not transfer the data obtained to third parties, with the exception of the data processor(s) specified in section 7. The recorded data may only be accessed by the Data Controller's employees and the designated staff of the data processor(s).
Legitimate interest: our Company's legitimate interest in processing the data subject's data for direct marketing
Data subjects concerned: partners and data subjects inquiring directly (e.g. by e-mail or telephone) about the Company's services.

4.2. Quote requests and inquiries via the website (uplight.hu)

Our company allows data subjects to request quotes electronically.

Purpose of processing: maintaining contact, facilitating communication between the data subject and our Company, and enabling the closest and most effective cooperation possible.
Legal basis of processing: the data subject's voluntary consent, Article 6(1)(a) GDPR.
Scope of personal data processed: name of the inquirer (first name, last name); e-mail address, phone number, company name and other information provided by the data subject.
Duration of processing: 3 years after the validity period of the quote, or until consent is withdrawn.
Recipients of personal data: the data controller does not transfer the data obtained to third parties, with the exception of the data processor(s) specified in section 7. The recorded data may only be accessed by the Data Controller's employees and the designated staff of the data processor(s).
Data subjects concerned: partners and data subjects inquiring via the website about the Company's services and products.

4.3. Data processing related to quote follow-up

Purpose of processing: the data controller's legitimate interest in keeping records of the data subject's data beyond the validity period of the quote for direct marketing purposes
Legal basis of processing: legitimate interest of the data controller, Article 6(1)(f) GDPR
Scope of personal data processed: contact person's last and first name; phone number; e-mail address
Recipients of personal data: the data controller does not transfer the data obtained to third parties, with the exception of the data processor(s) specified in section 7. The recorded data may only be accessed by the Data Controller's employees and the designated staff of the data processor(s).
Duration of processing: until the data subject objects
Legitimate interest: building business relationships with partners and quote requesters, providing accurate information to data subjects. Our Company's legitimate interest in processing the data subject's data for direct marketing
Data subjects concerned: recipients of quotes previously issued by the Company and the contact person(s) named in them.

4.4. Newsletter registration

Purpose of processing: sending e-mail newsletters, which may include commercial advertising, to interested parties, and providing information on current news
Legal basis of processing: the data subject's prior, voluntary consent, Article 6(1)(a) GDPR
Scope of personal data processed: name, e-mail address
Duration of processing: until voluntary consent is withdrawn or the data subject unsubscribes from the newsletter. Our Company processes the data provided by the data subject until consent is withdrawn. Upon withdrawal of consent, we delete the processed data from our newsletter database within 7 days at the latest, and will no longer send you newsletters.
Recipients of personal data: the data controller does not transfer the data obtained to third parties, with the exception of the data processor(s) specified in section 7. The recorded data may only be accessed by the Data Controller's employees and the designated staff of the data processor(s). You can unsubscribe from the newsletter at any time by writing to our Company at info@uplight.hu, or by clicking the unsubscribe icon in the newsletter.
Data subjects concerned: partners and data subjects subscribing to the Company's electronic newsletter.

4.5. Newsletter data (for newsletter subscriptions registered before May 25, 2018)

Purpose of processing: sending e-mail newsletters, which may include commercial advertising, to interested parties, and providing information on current news
Legal basis of processing: legitimate interest of the data controller, Article 6(1)(f) GDPR
Scope of personal data processed: name, e-mail address
Duration of processing: until the data subject objects
Legitimate interest: providing information, including commercial advertising and business offers, to data subjects who have subscribed to the newsletter. Our Company's legitimate interest in processing the data subject's data for direct marketing.
Recipients of personal data: the data controller does not transfer the data obtained to third parties, with the exception of the data processor(s) specified in section 7. The recorded data may only be accessed by the Data Controller's employees and the designated staff of the data processor(s). You can unsubscribe from the newsletter at any time by writing to our Company at info@uplight.hu, or by clicking the unsubscribe icon in the newsletter.
Data subjects concerned: partners and data subjects who subscribed to the Company's electronic newsletter before May 25, 2018.

4.6. Camera system

Cameras operate on the premises run by the data controller for the personal and property security of data subjects and for other purposes. Information signs draw data subjects' attention to their operation. The activities related to the operation of the camera system are set out in the premises' “Security camera data processing notice”, which is available on site.

4.7. Data processing related to ensuring the operation of information technology services

Purpose of processing: UP! Light may use so-called "cookies" (temporary markers) on its websites, which allow faster access to them. By "cookies" we mean information data that is only active during a given customer session and is placed on the Customer's computer by the website for faster identification. The Customer can always request that cookies be disabled by changing their browser settings; however, disabling them may slow down or prevent access to some parts of the site and the use of certain functions.
The session cookies used avoid having to resort to other IT tools that are potentially harmful to the confidentiality of customers' navigation, and do not allow identifying personal data to be obtained.
Users can delete cookies from their own computer or disable the use of cookies in their browser. Cookies can usually be managed in the browser's Tools/Settings menu, under the Privacy settings, under the name cookie.
Legal basis of processing: the voluntary consent of the data subject (User), Article 6(1)(a) GDPR.
The User gives voluntary consent to the processing by accepting the notice and declaration that pops up when starting to browse the website, or by continuing to browse.
Scope of personal data processed: IT data processing concerns the data required for the operation of the “cookies” used to run the website and for the use of the log files applied by the web hosting provider.
Duration of processing: until the session ends
Recipients of personal data: the data controller does not transfer the data obtained to third parties, with the exception of the data processor(s) specified in section 7. The recorded data may only be accessed by the Data Controller's employees and the designated staff of the data processor(s).
Data subjects concerned: every User visiting the website, regardless of whether they use the services available on the website.

5. Other data processing

We provide information about data processing not listed in this notice at the time the data is collected. We inform our customers that certain authorities, bodies performing public duties and courts may contact our company to request personal data. Our company discloses personal data to these bodies, provided the body concerned has specified the exact purpose and scope of the data, only to the extent strictly necessary to achieve the purpose of the request, and only if the fulfillment of the request is required by law.

6. Transfer of personal data to a third country or an international organization

Our Company does not transfer your personal data described above to any third country or international organization.

7. Information on the use of data processors

In the course of processing, the data controller transfers data to the data processor(s) contracted by it for the performance of the contract.
Categories of recipients: system administration provider, accounting and payroll provider, server hosting, web hosting provider

8. Children

Our services are not intended for persons under the age of 16, and we ask that persons under 16 do not provide Personal data to the Data Controller.
If we become aware that we have collected personal data from a child under 16 (with the exception of data processed in accordance with legal requirements), we will take the steps necessary to delete the data as soon as possible.

9. Automated decision-making

Our Company does not use automated decision-making in its data processing procedures or data collection.

10. Method of storing personal data, security of processing

Our company's IT systems and other data storage locations are located at the registered office and on servers provided by the data processor. Our company selects and operates the IT tools used for processing personal data in the course of providing the service in such a way that the processed data:

is accessible to those authorized to access it (availability);
has ensured authenticity and authentication (authenticity of processing);
can be verified as unchanged (data integrity);
is protected against unauthorized access (data confidentiality).

We pay particular attention to data security, and we also take the technical and organizational measures and establish the procedural rules necessary to enforce the guarantees under the GDPR. We protect the data with appropriate measures, in particular against unauthorized access, alteration, transfer, disclosure, deletion or destruction, as well as accidental destruction, damage, and becoming inaccessible due to changes in the technology used.

The IT systems and networks of our company and our partners are protected against computer-assisted fraud, computer viruses, computer intrusions and denial-of-service attacks. The operator ensures security with both server-level and application-level protection procedures. Daily data backups are in place. Our company takes all possible measures to prevent personal data breaches; should such a breach occur, we act without delay, in accordance with our incident management policy, to minimize the risks and remedy the damage.

11. Rights of data subjects and legal remedies

The data subject may request information about the processing of their personal data, and may request the rectification of their personal data and, with the exception of mandatory processing, their erasure or withdrawal, and may exercise their right to data portability and to object in the manner indicated when the data was collected, or via the data controller's contact details above.

The rights of data subjects and their legal remedies are set out below and communicated to data subjects on the basis of Act CXII of 2011 and Regulation (EU) 2016/679.

The right to information, also known as the data subject's “right of access”: under Act CXII of 2011 and Article 15 of Regulation (EU) 2016/679, at the data subject's request, the Data Controller provides information on

the data it processes and the categories of personal data,
the purpose of processing,
the legal basis of processing,
the duration of processing,
where applicable, the period for which the data will be stored, or if this is not possible, the criteria used to determine that period,
where applicable, if the data was not collected from the data subject, all available information about its source,
where applicable, automated decision-making, including profiling, and meaningful information about the logic involved and the significance of such processing, and
the envisaged consequences for the data subject,
the details of the data processor, if one was used; the circumstances and effects of any personal data breach and the measures taken to remedy it; and
in the case of transfer of the data subject's personal data, the legal basis, purpose and recipient of the transfer.

The information is free of charge if the person requesting it has not yet submitted a request for information on the same set of data to the Data Controller in the current year. In other cases, a fee may be charged. A fee already paid must be refunded if the data was processed unlawfully or if the request for information led to rectification.

The Data Controller draws data subjects' attention to the fact that, under Act CXII of 2011, information must be refused

if, on the basis of a law, an international treaty or a binding legal act of the European Union, the Data Controller receives personal data in such a way that the transferring controller indicates, at the time of transfer, a restriction of the rights of the data subject under the said Act or another restriction of its processing;
in the interest of the external and internal security of the state, such as national defense, national security, the prevention or prosecution of criminal offenses, the security of the enforcement of sentences, as well as in the economic or financial interest of the state or local governments, significant economic or financial interests of the European Union, and for the prevention and detection of disciplinary and ethical offenses related to the practice of professions and breaches of labor law and occupational safety obligations (including in all cases inspection and supervision), and for the protection of the rights of the data subject or others.

The Data Controller is obliged to notify the National Authority for Data Protection and Freedom of Information of rejected requests for information annually, by January 31 of the year following the year concerned.

Right to rectification: the data subject is entitled to have the Data Controller rectify inaccurate personal data concerning them without undue delay at their request. Taking into account the purpose of processing, the data subject is entitled to request that incomplete personal data be completed, including by means of a supplementary statement. At the same time, if the personal data does not correspond to reality and the correct personal data is available to the Data Controller, the Data Controller rectifies the personal data as a matter of obligation, even without the data subject's request.

Right to erasure, also known as the “right to be forgotten”: the data subject is entitled to have the Data Controller erase personal data concerning them without undue delay at their request, and the Data Controller is obliged to erase personal data concerning the data subject without undue delay, unless this is precluded by mandatory processing.

In addition to the above case, the Data Controller is obliged to erase the data under Act CXII of 2011 and Regulation (EU) 2016/679 of the European Parliament and of the Council if

the processing of the data is unlawful;
the data is incomplete or incorrect, and this cannot be lawfully remedied, provided that erasure is not precluded by law;
the purpose of processing has ceased, or the statutory time limit for storing the data has expired;
it has been ordered by a court or the Authority;
the personal data is no longer necessary for the purpose for which it was collected or otherwise processed;
the data subject objects to the processing and there are no overriding legitimate grounds for the processing;
the personal data must be erased to comply with a legal obligation under the law applicable to the Data Controller;
the personal data was collected in connection with the offer of information society services offered directly to children, as referred to in Article 8(1) of Regulation (EU) 2016/679.

If the Data Controller has made the personal data public for any reason and is obliged to erase it under the above, it takes reasonable steps, including technical measures, taking into account available technology and the cost of implementation, to inform other controllers processing the data that the data subject has requested the erasure of any links to, or copies or replications of, the personal data in question.

The Data Controller draws data subjects' attention to the limitations of the right to erasure, or “right to be forgotten”, arising from the EU regulation, which are as follows:

exercising the right to freedom of expression and information;
compliance with an obligation under Union or Member State law applicable to the controller that requires the processing of personal data, or the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
public interest in the area of public health;
archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) of Regulation (EU) 2016/679, insofar as the right to erasure is likely to render impossible or seriously impair such processing; or
the establishment, exercise or defense of legal claims.

Right to restriction of processing, also known as the right to blocking: the data subject is entitled to have the Data Controller restrict processing at their request.
If, based on the information available, it can be assumed that erasure would harm the legitimate interests of the data subject, the data must be blocked. Personal data blocked in this way may only be processed for as long as the processing purpose that precluded the erasure of the personal data exists.

If the data subject contests the accuracy or correctness of the personal data, but the incorrectness or inaccuracy of the contested personal data cannot be clearly established, the Data Controller blocks the data. In this case, the restriction applies for a period enabling the Data Controller to verify the accuracy of the personal data.

Under the EU regulation, data must be blocked if

the processing is unlawful and the data subject opposes the erasure of the data and requests the restriction of its use instead;
the Data Controller no longer needs the personal data for the purposes of processing, but the data subject requires it for the establishment, exercise or defense of legal claims; or
the data subject has objected to the processing; in this case, the restriction applies until it is established whether the Data Controller's legitimate grounds override those of the data subject.

Where processing is restricted (blocked), such personal data may, with the exception of storage, only be processed with the data subject's consent, or for the establishment, exercise or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.

The Data Controller hereby expressly draws data subjects' attention to the fact that the data subject's right to rectification, erasure and blocking may be restricted by law in the interest of the external and internal security of the state, such as national defense, national security, the prevention or prosecution of criminal offenses, the security of the enforcement of sentences, as well as in the economic or financial interest of the state or local governments, significant economic or financial interests of the European Union, and for the prevention and detection of disciplinary and ethical offenses related to the practice of professions and breaches of labor law and occupational safety obligations (including in all cases inspection and supervision), and for the protection of the rights of the data subject or others.
The Data Controller informs the data subject of the matters specified in their request, and/or rectifies the data, and/or erases and/or restricts (blocks) the data, or takes other steps in accordance with the request, without undue delay and at the latest within 30 days of receipt of the request, unless there are grounds precluding this.

The Data Controller notifies the data subject in writing of the rectification, erasure or restriction of processing, as well as everyone to whom the data was previously transferred or disclosed for processing. At the data subject's request, the Data Controller informs them of these recipients. Notification may be omitted if, in view of the purpose of processing, it does not harm the legitimate interests of the data subject, or if providing the information proves impossible or would involve disproportionate effort. The Data Controller is also obliged to notify the data subject in writing if the exercise of the data subject's rights cannot be fulfilled for any reason, and must specify the factual and legal grounds as well as the legal remedies available to the data subject: the possibility of turning to a court or to the National Authority for Data Protection and Freedom of Information.

The “right to data portability”: the data subject is entitled to

receive the personal data concerning them, which they have provided to the Data Controller, in a structured, commonly used, machine-readable format, and is also entitled to
transmit this data to another controller without hindrance from the controller to which the personal data was provided, where:
the processing is based on consent; and
the processing is carried out by automated means.

In exercising the right to data portability, the data subject is entitled to request, where technically feasible, the direct transmission of personal data between controllers.
Given the processing carried out by the Data Controller, the conditions for exercising the right to data portability are not met (there is no automated processing), so the data subject cannot exercise this right.

Right to object: the data subject may object to the processing of their personal data, including profiling, if

the processing (transfer) of the personal data is necessary solely for the enforcement of the rights or legitimate interests of the Data Controller or the recipient, except in the case of mandatory processing;
the personal data is used or transferred for direct marketing, public opinion polling or scientific research;
the exercise of the right to object is otherwise permitted by law.

Under Article 21(3) of Regulation (EU) 2016/679, the data subject may also object to the processing of personal data for direct marketing purposes, in which case the personal data may no longer be processed for this purpose.

Where personal data is processed for scientific or historical research purposes or statistical purposes, the data subject has the right to object, on grounds relating to their particular situation, to the processing of personal data concerning them, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
The Data Controller, while simultaneously suspending the processing, examines the objection within the shortest possible time from the submission of the request, but no later than within 30 days, and informs the applicant of the result in writing. If the applicant's objection is justified, the Data Controller terminates the processing, including any further data collection and transfer, blocks the data, and notifies everyone to whom it previously transferred the personal data concerned by the objection, and who are obliged to take measures to enforce the right to object, of the objection and the measures taken on its basis.

If the data subject does not agree with the Data Controller's decision, or if the Data Controller fails to meet the said deadline, the data subject is entitled to turn to a court within 30 days of its communication.
The data subject has the right to object in connection with automated decision-making.

Judicial remedy: in the event of a violation of their rights, the data subject may turn to a court. The court handles the case as a matter of priority. The Data Controller is obliged to prove that the processing complies with the provisions of the law.

In the event of a violation of the right to informational self-determination, you may file a report or complaint with:

National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1125 Budapest, Szilágyi Erzsébet fasor 22/c
Phone: +36 (1) 391-1400, Fax: +36 (1) 391-1410
Web: http://www.naih.hu
E-mail: ugyfelszolgalat@naih.hu

This English version is provided for information purposes. In case of any discrepancy, the Hungarian version shall prevail.