Privacy Notice

Introduction

DIGIT-NOW GmbH (Johannastrasse 15, 45130 Essen, Germany; commercial register number: HRB 34817; registered with Amtsgericht Essen; Tax ID: DE36308417) (hereinafter the “Service Provider” or “Data Controller”) is subject to the following Privacy Policy.

Pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, “GDPR”), we provide the following information.

This Privacy Notice governs the processing of data on the following websites/mobile applications: https://digit-now.com/

This Privacy Notice is available at: https://digit-now.com/adatkezeles.pdf

Amendments to this Policy enter into force upon publication at the above address.

Data Controller and Contact Details

Operating Company: DIGIT-NOW GmbH
Address: Johannastrasse 15
45130 Essen
Germany
Authorised Managing Director: Tamas Haurik
Phone: +49 175 267 0953
E-mail: tamas.haurik@digit-now.com
Website: https://digit-now.com/
Registration Number: HRB 34817
Register Court: Amtsgericht Essen
Tax ID: DE36308417

Definitions

1. “Personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
2. “Processing” means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
3. “Controller” means a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing personal data; where those purposes and means are determined by Union or Member State law, the controller or the criteria for its nomination may be provided for by such law.
4. “Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
5. “Recipient” means a natural or legal person, public authority, agency or other body to which personal data are disclosed, whether a third party or not. Public authorities receiving personal data in the framework of a particular inquiry in accordance with Union or Member State law are not regarded as recipients; their processing must comply with applicable data protection rules for the purposes of the processing.
6. “Consent of the data subject” means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they, by a statement or clear affirmative action, signify agreement to the processing of personal data relating to them.
7. “Personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

Principles Relating to Processing of Personal Data

Personal data must be:

8. processed lawfully, fairly and transparently in relation to the data subject (“lawfulness, fairness and transparency”);
9. collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes; further processing for archiving in the public interest, scientific or historical research or statistical purposes in accordance with Article 89(1) is not considered incompatible with the original purposes (“purpose limitation”);
10. adequate, relevant and limited to what is necessary for the purposes of processing (“data minimisation”);
11. accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that inaccurate personal data, having regard to the purposes of processing, are erased or rectified without delay (“accuracy”);
12. kept in a form permitting identification of data subjects for no longer than necessary for the purposes of processing; longer storage is permitted insofar as data are processed solely for archiving in the public interest, scientific or historical research, or statistical purposes in accordance with Article 89(1), subject to appropriate safeguards for data subjects’ rights and freedoms (“storage limitation”);
13. processed in a manner ensuring appropriate security, including protection against unauthorised or unlawful processing and accidental loss, destruction or damage, using appropriate technical or organisational measures (“integrity and confidentiality”).

The controller is responsible for, and must be able to demonstrate, compliance with these principles (“accountability”).

The controller declares that its processing complies with the principles stated in this section.

Contacting Us

1. Collection of data, categories of data processed and purposes of processing:

An e-mail address does not necessarily have to contain personal data.

2. Data subjects: all individuals who send a message using the contact form.
3. Duration of processing and deadline for erasure: where any of the conditions set out in Article 17(1) GDPR applies, processing continues until the data subject requests erasure.
4. Persons authorised to access personal data and recipients: personal data may be processed by the controller’s authorised employees.
5. Rights of data subjects relating to processing:

• The data subject may request access to, rectification, erasure or restriction of processing of their personal data.
• The data subject has the right to data portability and to withdraw consent at any time.

6. Requests for access, erasure, correction, restriction of processing or data portability may be made:

• by post to Johannastrasse 15, 45130 Essen, Germany;
• by e-mail to tamas.haurik@digit-now.com;
• by telephone at +49 175 267 0953.

7. Legal basis for processing: consent of the data subject, Article 6(1)(a) and (b) GDPR. By contacting us, you consent to the processing of the personal data provided when contacting us (name, telephone number and e-mail address) in accordance with this Policy.
8. Please note that:

• this processing is based on your consent and is necessary to prepare an offer;
• you must provide personal data in order to contact us;
• without the requested data you cannot contact the controller;
• withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Customer Relations

1. Collection, categories and purposes of processing:

2. Data subjects: all individuals who communicate with the controller by telephone, e-mail or in person, or who are in a contractual relationship with the controller.
3. Duration and erasure deadline: correspondence containing enquiries is retained until a data subject requests erasure, but for no more than two years.
4. Persons authorised to access data and recipients: authorised employees of the controller may process personal data in accordance with the principles above.
5. Data subjects’ rights:

• The data subject may request access to, rectification, erasure or restriction of processing of their personal data.
• The data subject has the right to data portability and withdrawal of consent at any time.

6. Requests regarding access, erasure, correction, restriction or portability can be submitted:

• by post to Johannastrasse 15, 45130 Essen, Germany;
• by e-mail to tamas.haurik@digit-now.com;
• by telephone at +49 175 267 0953.

7. Legal basis for processing. Please note that:

• processing is necessary to perform a contract and to provide an offer;
• you must provide personal data so that we can perform the contract or fulfil another request;
• without the data we cannot perform the contract or process your request.

Newsletter and Direct Marketing Activities

1. Pursuant to Section 6 of Hungarian Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities, the User may give prior and express consent for the Service Provider to contact them with advertising offers and other communications using the contact details provided at registration.
2. The Customer may also, having regard to the provisions of this Notice, consent to the Service Provider processing the personal data necessary to send advertising offers.
3. The Service Provider does not send unsolicited advertising. The User may unsubscribe from offers free of charge, without restrictions and without providing reasons. In that case, the Service Provider removes from its records all personal data needed for advertising messages and does not contact the User with further offers. The User can unsubscribe by clicking the link in the message.
4. Collection, categories and purposes of processing:

5. Data subjects: all individuals subscribing to the newsletter.
6. Purpose: to send electronic messages containing advertising (e-mail, SMS or push messages) and information about news, products, promotions and new functions.
7. Duration and erasure deadline: processing lasts until consent is withdrawn, i.e. until unsubscribing.
8. Persons authorised to access data and recipients: the controller and its sales and marketing employees may process the personal data, subject to the principles above.
9. Data subjects’ rights:

• The data subject may request access to, rectification, erasure or restriction of processing of their personal data;
• object to the processing of their personal data; and
• exercise the right to data portability and withdraw consent at any time.

10. Access, erasure, amendment, restriction, portability and objections may be requested:

• by post to Johannastrasse 15, 45130 Essen, Germany;
• by e-mail to tamas.haurik@digit-now.com;
• by telephone at +49 175 267 0953.

11. Data subjects may unsubscribe from the newsletter at any time, free of charge.
12. Please note that:

• processing is based on your consent and the legitimate interests of the Service Provider;
• personal data must be provided if you wish to receive our newsletter;
• without the data we cannot send you the newsletter;
• you can withdraw consent at any time by clicking “unsubscribe”;
• withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Use of Google Ads Conversion Tracking

14. The controller uses the online advertising programme “Google Ads” and its Google conversion tracking service. Google conversion tracking is an analytical service of Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; “Google”).
15. When a User reaches the website through a Google advertisement, a cookie necessary for conversion tracking is stored on their computer. These cookies have limited validity and do not contain personal data, so the User cannot be identified by them.
16. When a User visits certain pages of the website before the cookie expires, Google and the controller can see that the User clicked the advertisement.
17. Each Google Ads customer receives a different cookie; therefore Users cannot be tracked across the websites of Ads customers.
18. Data collected via conversion tracking cookies are used to compile conversion statistics for Ads customers who have opted for conversion tracking. Customers learn how many Users clicked their advertisements and reached a page containing a conversion tracking tag, but they receive no information that would identify individual Users.
19. If you do not wish to participate in conversion tracking, you may decline by blocking cookies in your browser; you will then not appear in conversion tracking statistics.
20. Further information and Google’s privacy policy are available at https://policies.google.com/privacy.

Use of Google Analytics

21. This website uses Google Analytics, a web analytics service of Google Inc. (“Google”). Google Analytics uses so-called “cookies”, text files stored on your computer, to analyse how the User uses the website.
22. Information generated by the cookies about the User’s use of the website is generally transmitted to and stored on a Google server in the United States. When IP anonymisation is activated on the website, Google truncates the User’s IP address beforehand within EU Member States or other states party to the Agreement on the European Economic Area.
23. Only in exceptional cases is the complete IP address sent to a Google server in the United States and truncated there. On behalf of the website operator, Google uses this information to evaluate website use, compile reports on website activity and provide other services relating to website and internet use.
24. Google does not combine the IP address transmitted by the User’s browser as part of Google Analytics with other data held by Google. Users may prevent cookies from being stored by adjusting their browser settings, although this may mean that some website features cannot be used in full. Users may also prevent Google from collecting and processing cookie-generated information about their use of the website (including their IP address) by downloading and installing the browser plug-in available at https://tools.google.com/dlpage/gaoptout?hl=hu.

Cookie Management

1. Under the original Policy, prior consent is not required for the use of cookies for password-protected sessions, shopping baskets, security, necessary functions, functional purposes and website statistics.
2. Data processed: unique identification number, dates and times.
3. Data subjects: all visitors to the website.
4. Purpose of processing: identifying Users and tracking visitors.
5. Duration of processing and deadline for erasure:

6. Persons authorised to access data: the controller states that it does not process personal data through the use of cookies.
7. Rights of data subjects: cookies can generally be deleted under Tools/Settings, usually in the Privacy section of a browser.
8. Legal basis: consent is not required if cookies are used solely to carry out the transmission of a communication over an electronic communications network, or are strictly necessary to provide an information society service explicitly requested by a subscriber or User.
9. Most browsers used by our Users allow choices about which cookies are saved and enable specific cookies to be deleted. Restricting cookies on certain websites or blocking third-party cookies may prevent full use of our website. Information on adjusting cookie settings in common browsers is available at:

• Google Chrome: https://support.google.com/chrome/answer/95647?hl=hu
• Internet Explorer: https://support.microsoft.com/hu-hu/help/17442/windows-internet-explorer-delete-manage-cookies
• Firefox: https://support.mozilla.org/hu/kb/sutik-engedelyezese-es-tiltasa-amit-weboldak-haszn
• Safari: https://support.apple.com/hu-hu/guide/safari/sfri11471/mac

Facebook Pixel

The Facebook Pixel is code that enables reporting on conversions on the website, the creation of target audiences and detailed analytics for the website owner about visitors’ use of the site. The Facebook remarketing pixel tracking code can be used to display personalised offers and advertising to website visitors on Facebook. The Facebook remarketing list cannot be used to identify individuals. Further information on the Facebook Pixel is available at https://www.facebook.com/business/help/651294705016616.

Processors Used

Hosting Provider

1. Activity carried out by the processor: hosting services.
2. Name and contact details of the processor:

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen
Germany
Website: https://www.hetzner.com
E-mail: data-protection@hetzner.com

3. Data processed: all personal data provided by the data subject.
4. Data subjects: all Users of the website/mobile application.
5. Purpose: making the website/mobile application available and ensuring its proper operation.
6. Duration and erasure deadline: until termination of the agreement between the controller and hosting provider, or until the data subject submits an erasure request to the hosting provider.
7. Legal basis: Article 6(1)(c) and (f) GDPR, and Section 13/A(3) of Hungarian Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services. Legitimate interests include proper operation of the website and protection against attacks and fraud.

Other Processors (if any)

ClickUp

Social Media

25. Data collected and processed: the User’s registered name and public profile picture on social media websites such as Meta, Twitter, Pinterest, YouTube and Instagram.
26. Data subjects: individuals registered on the above social media websites who have “liked” the Service Provider’s social media page or contacted the controller through a social media platform.
27. Purpose: sharing, “liking”, following and promoting parts of the website, its products, promotions or the website itself on social media.
28. Duration, erasure deadlines, persons authorised to access the data, and rights: the relevant social media platform provides information about the source, processing, transfer method and legal basis. Because processing occurs on those platforms, their rules govern its duration and methods and the options for erasure and amendment.
29. Legal basis: the data subject’s voluntary consent to the processing of personal data on social media platforms.

Customer Contacts and Other Processing

30. If a data subject has a question or encounters a problem while using our services, they may contact the controller by the methods indicated on the website (telephone, e-mail, social media, etc.).
31. The controller deletes incoming e-mails, messages and data provided by telephone, via Meta and through other channels, including the enquirer’s name, e-mail address and other voluntarily provided personal data, no later than two years after disclosure.
32. Information about processing activities not listed in this Notice is provided when the data are collected.
33. In response to an exceptional official request or a request from another body authorised by law, the Service Provider must provide information, disclose or transfer data, or make documents available.
34. In such cases the Service Provider discloses personal data only to the extent strictly necessary for the stated purpose of the request and categories of data specified by the requesting body.

Rights of Data Subjects

1. Right of Access

You have the right to obtain confirmation from the controller as to whether personal data concerning you are being processed and, where this is the case, access to the personal data and the information listed in the GDPR.

2. Right to Rectification

You have the right to obtain from the controller, without undue delay, rectification of inaccurate personal data concerning you. Taking into account the purposes of processing, you have the right to have incomplete personal data completed, including by providing a supplementary statement.

3. Right to Erasure

You have the right to obtain from the controller erasure of personal data concerning you without undue delay, and the controller must erase such data without undue delay where the applicable conditions are met.

4. Right to Be Forgotten

Where the controller has made personal data public and is obliged to erase them, it will take reasonable steps, taking account of available technology and implementation costs, including technical measures, to inform other controllers processing the data that you have requested erasure of links to, or copies or replications of, those personal data.

5. Right to Restriction of Processing

You have the right to obtain restriction of processing from the controller where one of the following applies:

• you contest the accuracy of the personal data, for a period enabling the controller to verify their accuracy;
• the processing is unlawful and you oppose erasure and request restriction of their use instead;
• the controller no longer needs the personal data for processing, but you require them for the establishment, exercise or defence of legal claims;
• you have objected to processing, pending verification of whether the controller’s legitimate grounds override yours.

6. Right to Data Portability

You have the right to receive personal data concerning you which you have provided to a controller in a structured, commonly used and machine-readable format, and the right to transmit those data to another controller without hindrance from the controller to which they were provided (…)

7. Right to Object

Where processing is based on legitimate interests or the performance of a task in the exercise of official authority, you have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data, including profiling based on those provisions.

8. Objection to Direct Marketing

Where personal data are processed for direct marketing, you have the right to object at any time to processing of personal data concerning you for that purpose, including profiling insofar as it relates to direct marketing. If you object, the personal data may no longer be processed for those purposes.

9. Automated Individual Decision-Making, Including Profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

The preceding paragraph does not apply if the decision:

• is necessary for entering into, or performance of, a contract between you and the controller;
• is authorised by Union or Member State law applicable to the controller that also lays down suitable measures to safeguard your rights, freedoms and legitimate interests; or
• is based on your explicit consent.

Time Limit for Action

The controller will inform you of action taken on the requests above without undue delay and in any event within one month of receiving the request.

Where necessary, that period may be extended by two further months. The controller will inform you of an extension and the reasons for the delay within one month of receipt of the request.

If the controller does not act on a request, it will inform you without delay, and at the latest within one month of receipt, of the reasons for not taking action and of your right to lodge a complaint with a supervisory authority and seek a judicial remedy.

Security of Processing

Taking account of the state of the art, implementation costs, and the nature, scope, context and purposes of processing, as well as risks of varying likelihood and severity to the rights and freedoms of natural persons, the controller and processor implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including, where appropriate:

35. pseudonymisation and encryption of personal data;
36. the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
37. the ability to restore availability and access to personal data in a timely manner in the event of a physical or technical incident;
38. a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures ensuring processing security;
39. storage of processed data so as to prevent access by unauthorised persons, using appropriate arrangements for the physical storage and filing of paper documents and a central access-rights management system for electronic data;
40. storage of electronically processed data in a manner that allows erasure at the end of the relevant retention period, or when otherwise necessary, including where different erasure periods apply; erasure must be irreversible;
41. removal of personal data from paper media using a shredder or specialised destruction service; physical destruction of electronic media under relevant disposal rules, or secure, irreversible erasure where necessary;
42. the specific data security measures listed below.

For the security of personal data processed on paper, the Service Provider applies the following physical safeguards:

43. Documents are kept in a secure, dry room that can be locked effectively.
44. Where personal data on paper are digitised, the rules for digitally stored documents apply.
45. An employee processing personal data may leave the room where processing takes place only after securing the entrusted data carriers or locking the room.
46. Personal data are accessible only to authorised persons and not to third parties.
47. The Service Provider’s building and premises are equipped with fire-protection and property-security systems.

IT Security

48. Computers, mobile devices and other data carriers used for processing are owned by the Service Provider.
49. Computer systems containing personal data used by the Service Provider have antivirus protection.
50. The Service Provider uses backups and archives to protect digitally stored data.
51. Only specifically designated persons with the necessary access rights may access the central server.
52. Data stored on computers can be accessed only using a username and password.

Notification of a Personal Data Breach to the Data Subject

Where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller will inform the data subject without undue delay.

The notification must describe the nature of the personal data breach in clear and plain language; provide the name and contact details of the data protection officer or other contact point; describe the likely consequences of the breach; and describe measures taken or proposed by the controller to address it, including measures to mitigate potential adverse effects where appropriate.

The data subject need not be informed where any of the following conditions is met:

• the controller has implemented appropriate technical and organisational safeguards and applied them to the affected data, in particular encryption or other measures rendering the data unintelligible to unauthorised persons;
• the controller has taken subsequent measures ensuring that the high risk to the data subject’s rights and freedoms is no longer likely to materialise;
• notification would involve disproportionate effort, in which case the data subjects must instead be informed by public communication or another similarly effective measure.

If the controller has not already informed the data subject, the supervisory authority may require it to do so after considering whether the breach is likely to result in a high risk.

Notification of a Personal Data Breach to the Authority

The controller must notify a personal data breach to the supervisory authority competent under Article 55 GDPR without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Notification after 72 hours must be accompanied by reasons for the delay.

Review in Cases of Mandatory Processing

Where the duration of mandatory processing or the periodic review of its necessity is not specified by law, a local government decree or a binding act of the European Union, the controller reviews at least every three years from the commencement of processing whether personal data processed by it, or by a processor acting on its behalf or under its instructions, are necessary for the purposes of processing.

The controller documents the circumstances and results of the review, retains that documentation for ten years following the review and makes it available to the Hungarian National Authority for Data Protection and Freedom of Information (the “Authority”) at its request.

Right to Lodge a Complaint

The original Policy states that complaints about alleged infringements by the controller may be submitted to the Hungarian National Authority for Data Protection and Freedom of Information:

Nemzeti Adatvédelmi és Információszabadság Hatóság
1055 Budapest, Falk Miksa utca 9–11.
Postal address: 1363 Budapest, P.O. Box 9
Telephone: +36 1 391 1400
Fax: +36 1 391 1410
E-mail: ugyfelszolgalat@naih.hu