Privacy Notice

INTRODUCTION AND PURPOSE OF THIS NOTICE

The purpose of this notice (“Notice”) is to provide natural persons (“Data Subjects”) who come into contact with MarkedNest Kft.’s services or applications, in accordance with 2016/679/EU Regulation (“GDPR”), with transparent and plain information about the circumstances of the Controller’s data processing activities, including the purposes, legal bases and duration of processing; the persons authorised to access the data; the Recipients to whom the data may be disclosed; and the rights and remedies available to Data Subjects in connection with the processing of their personal data.

The Notice also contains information on the technical and organizational measures implemented by the Controller, taking into account the nature, scope, context and purposes of the processing and the risks of varying likelihood and severity to the rights and freedoms of natural persons, in order to ensure full compliance with the constitutional principles of data protection and the requirements of data security.

DETAILS AND CONTACT INFORMATION OF THE CONTROLLER

Name of the Controller: MarkedNest Kft. (“Controller”)

Registered office: 17 Mogyoró utca, Pomáz, 2013 Hungary

Company registration number: 13-09-249044

Website: app.markednest.com

Email: privacy@markednest.com

1. BASIC PRINCIPLES

Personal data may be collected, stored, otherwise processed or transferred, or subjected to any other operation (“Processing”), only where the purpose of the Processing is sufficiently specified and lawful, an appropriate legal basis is available, and the lawfulness of the Processing is ensured throughout its entire duration. The Controller is responsible for ensuring compliance with the following principles in relation to its Processing activities:

• for all Processing, personal data must be processed lawfully, fairly and in a transparent manner;
• personal data may be processed only for specified and explicit purposes and may not be further processed for purposes incompatible with the original purpose; the purpose and means of Processing and the necessity of the Processing must be proportionate and properly documented;
• the Processing of personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
• personal data must be accurate and kept up to date; every reasonable step must be taken to rectify or erase inaccurate or outdated personal data;
• personal data may be stored only for as long as is necessary for the purposes of the Processing; personal data may not be processed after the applicable retention period has expired;
• personal data must be processed in a manner that ensures the rights of Data Subjects and the availability, integrity and confidentiality of the data;
• Controller is responsible for compliance with the requirements of the GDPR and must be able to demonstrate such compliance (accountability).

2. DEFINITIONS

Application: MarkedNest is a SaaS sales intelligence solution which collects data on company managers and stakeholders. The application monitors event organizer company website’s and signals when a target person is attending an event as a speaker or panelist, thereby allowing the user to meet with the target person.

Controller: natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data and makes and implements, or has a Processor implement, decisions concerning the Processing. MarkedNest Kft. is the Controller in respect of the Processing activities described in this Notice.

Processing: any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means.

Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller under a contract with the Controller, including a contract concluded pursuant to a statutory provision.

Recipient: a natural or legal person, public authority, agency or another body, to which the Personal Data is disclosed, whether or not a third party distinct from the Controller or the Data Subject. Public authorities which may receive personal data in the framework of a particular inquiry in accordance with a legal act of the European Union or Member State law (for example, an investigation conducted by an authority in the exercise of its supervisory powers) shall not be regarded as Recipients.

Data Subject: an identified or identifiable natural person about whom the Controller processes any information constituting Personal Data. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, date of birth or online identifier (for example, an IP address), or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

For the purposes of this Notice, a Data Subject may be (i) those company managers and stakeholders whose data is collected from the Hungarian company register and from event organizer websites, (ii) users of the application.

EEA: European Economic Area.

Third country: any state that is not an EEA state.

Third party: a natural or legal person, public authority, agency or body other than the Data Subject, Controller or Processor.

Consent: any freely given, specific, informed and unambiguous indication of the Data Subject’s wishes by which the Data Subject, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Personal Data: any information relating to a Data Subject by which the Data Subject can be identified, directly or indirectly. Anonymous information collected by the Controller in a manner that excludes personal identification and cannot be linked to a natural person does not constitute personal data. Nor do demographic data collected without linking them to the personal data of identifiable persons, so that no connection can be established with a natural person.

User: natural or legal persons engaged in a contract with the Controller for the use of the Application

Website: the websites, www.markednest.com, app.markednest.com and their subpages.

Terms not specifically defined or capitalised in this Notice shall have the meanings assigned to them in the GDPR and other applicable legislation.

3. SOURCE OF PERSONAL DATA

By the nature of the Application the Controller primarily processes Data Subjects’ personal data on the basis of information collected from sources other than the Data Subject itself, such as purchased database built on the company register and event organizer platforms. Data Subject personal data might be added by the Users in which case the User itself records information pertaining to Data Subjects it is interested in. In such cases the scope of data recorded in the Application is outside the influence of the Controller making the User the data controller and the Controller the data processor under GDPR provisions.

Under the GDPR where a controller has not obtained personal data from the Data Subject itself, it provides the Data Subject with the information required under Article 14 GDPR, including, in particular, information about the source of the personal data and, where applicable, whether they came from publicly accessible sources. Such notification shall be provided to the Data Subjects within a reasonable time but no later than 30 days form the collection of the data.

Although the Controller endeavors to provide timely information to the Data Subjects whose data is obtained from third parties, by the nature of the Application providing the notice to the Data Subjects in due time is impossible, thus the Controller relies on legitimacy based on Article 14(5)b GDPR.

In other cases – e.g. in respect of user data - the Controller processes Data Subjects’ personal data on the basis of information provided by the Data Subjects themselves. In such cases the notice is provided to the Data Subjects during the course of the first interaction (registration).

Another source of information might be the Users who can upload personal data to the Application relating to those Data Subjects they wish to monitor. In such cases, the controller of personal data is the User, to whom the Controller will serve as Data Processor.

4. PURPOSES AND LEGAL BASES OF PROCESSING IN GENERAL

Controller processes personal data in order to provide its services, comply with legal obligations and, in certain cases, pursue the legitimate interests of Controller or third parties. Controller generally relies on the following legal bases:

• the Data Subject’s consent to the Processing, which is freely given, specific, informed and unambiguous and expressed by a clear affirmative action (for example direct-marketing Processing);
• performance of a contract for the use of particular services provided by Controller;
• compliance with a legal obligation to which Controller is subject (for example, under the Accounting Act); and
• in certain cases, the legitimate interests pursued by Controller or a third party (for example the provision of the Controllers services require data from, the establishment, exercise or defense of legal claims).

Where Processing is based on consent, the Data Subject has the right to withdraw consent at any time. Pursuant to Article 7(3) GDPR, the withdrawal of consent does not affect the lawfulness of Processing based on consent before its withdrawal.

5. WHO MAY ACCESS DATA SUBJECTS’ PERSONAL DATA AND WITH WHOM WE SHARE THEM

Personal data may be accessed, strictly on a need-to-know basis, by employees who participate in implementing or monitoring the purposes of the Processing, act in a representative capacity, or otherwise require access to perform their duties. The data may be accessed by the Controller and its internal staff as well as the Users who use the data for their business purposes.

Personal data processed by the Controller may also be disclosed to other natural or legal persons (“Recipients”). Recipients may include public authorities, regulatory authorities, other bodies performing public functions and courts where disclosure is necessary for compliance with a legal obligation, as well as third-party Processors.

Personal data may also be transferred in order to comply with a legal obligation.

The Controller does not transfer Data Subject personal data to third countries outside the EEA, all services used and all data disclosures remain within the territory of the EEA.

6. AUTOMATED DECISION MAKING AND PROFILING

The Controller does not carry out automated decision-making, including profiling in connection with the processing activities.

7. DATA PROCESSORS

While providing its services or carrying out certain activities the Controller uses third-party service providers (for example, IT and operational service providers). Where a contractual partner processes personal data on the Controller’s instructions, it qualifies as the Controller’s Processor. In the course of its activities, a Processor may in certain cases access and become acquainted with a Data Subject’s personal data.

Data Processors process personal data on Controller’s behalf, under a contract with Controller and for a specific purpose determined by Controller. Controller uses only Processors that provide sufficient contractual guarantees regarding the protection of personal data.

The following entities provide data-processing services to Controller:

Google Cloud EMEA Limited, Registered Office: 70 Sir John Rogerson’s Quay Dublin 2, Ireland D02 R296, Compliance & Data Privacy Inquiry: https://support.google.com/cloud/contact/dpo?, Hosting and database service via Google Cloud and business correspondence via Google Workspace.

Scaleway, S.A.S., Registered office: 8, Rue de la Ville l’Évêque, 75008 Paris, email: privacy@scaleway.com ,Sending transactional and security messages.

Stripe Technology Company, Limited, Stripe Payment Europe, Limited, Registered office: One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland, email: dpo@stripe.com ,Card payment provider, subscription management

In such events, where the Users upload personal data, the Controller acts as a data processor for the User. In such cases it is the user who shall be held responsible for the lawfulness of the collection of the personal data.

8. SPECIFIC PURPOSES AND LEGAL BASES OF PROCESSING AND CATEGORIES OF PERSONAL DATA PROCESSED

8.1. Provision of services

Purpose of Processing: providing the services of the Application, collecting and displaying relevant and publicly available information to the Users about the Data Subjects.

Legal basis for Processing: legitimate interest of the Controller pursuant to Article 6(1)f GDPR

Categories of data processed: name, job title, employer name (represented company), region, short description, tag provided by the Application (speaker or panelist), date,time and URL of event the Data Subjects attends.

Duration of Processing: Data Subject personal data is erased immediately of the Data subject successfully objected against the data processing pursuant to Article 21 GDPR.

8.2. Use of cookies

The Controller uses cookies on the Website to ensure its proper operation and to improve its services. Cookies placed on the user’s device may constitute the user’s personal data.

When a user visits the Website, the Controller places a small data file known as a cookie on the user’s device. If the user visits the Website again, the browser returns the previously stored cookie, enabling the provider operating the cookie to link the current visit to earlier visits, but only in relation to its own content.

There are several types of cookies:

• Certain cookies are essential for the operation of the Website.
• Other cookies collect information about how the Website is used in order to make it more convenient and user-friendly.
• Session cookies are automatically deleted when the browser is closed.
• Persistent cookies may remain on the user’s device for a longer period.

Cookies operate on the Website solely to improve the user experience or automate the sign-in process.

Cookies may be placed on the user’s device only with the user’s consent. Consent may be given in the pop-up window displayed when the Website is visited and may be changed at any time in the browser.

Cookie settings for the most commonly used browsers are available by clicking the following links:

• Google Chrome: https://support.google.com/accounts/answer/61416?hl=hu
• Mozilla Firefox: https://support.mozilla.org/hu/kb/sutik-informacio-amelyet-weboldalak-tarolnak-szami?redirectlocale=hu&redirectslug=S%C3%BCtik+kezel%C3%A9se
• Microsoft Edge: https://support.microsoft.com/hu-hu/microsoft-edge/cookie-k-t%C3%B6rl%C3%A9se-a-microsoft-edge-ben-63947406-40ac-c3b8-57b9-2a946a29ae09

Cookies may be removed by changing the browser settings, using software capable of removing cookies, or deleting the browsing history. Please note, however, that deleting or disabling cookies may result in reduced Website functionality.

8.3. Account registration

Purpose of Processing: creating and maintaining a user account in the Application

Legal basis for Processing: performance of the contract with the User pursuant to Article 6(1)(b) GDPR if the User is a natural person, legitimate interest of the Controller and the User pursuant to Article 6(1)f GDPR if the User is a legal person.

Categories of data processed: name, username, job title, work email address, industry, country, city, industry interest, company details (size, revenue), IP address, log-in and audit log details, browser data

Duration of Processing: 5 years following the end of contractual relationship.

The Controller stores the data for the purpose of providing the services associated with registration and, without the Data Subject’s consent does not use or transfer them for any other purpose (for example, direct marketing).

8.4. Newsletter, direct marketing

Purpose of Processing: sending news and updates to the Users’ relating to their fields of interest and persons listed as target.

Legal basis for Processing: Data Subject’s consent pursuant to Article 6(1)(a) GDPR.

Categories of data processed: name, username, work email address

Duration of Processing: until the revocation of the consent by unsubscribing from the newsletter/DM.

8.5. Processing the data of contact persons, representatives and persons involved in performance

In the course of its activities, the Controller may enter into contractual relationships with legal persons and other entities (Users). To establish and maintain such contractual relationships, Controller and its partner require the personal data of their authorized representatives, contractual contact persons and persons involved in performance. Each party processes these data as an independent controller.

Purpose of Processing: preparing, concluding and performing the contract; settling claims arising from the contract; communication and administration during the term of the contract; accounting between the parties; and the mutual performance and enforcement of rights and obligations relating to use of the service.

Legal basis for Processing: the legitimate interest in proper contractual communication and administration and in the establishment, exercise and defence of legal claims arising from the contractual relationship, pursuant to Article 6(1)(f) GDPR.

Categories of data processed:

Representatives: name, specimen signature and job title indicating authority to represent.

Contact persons: name, contact details, company name, job title

Persons involved in performance: data strictly necessary for performing the contract (for example, contact details, position and job title).

Duration of Processing: data relating to the conclusion and performance of the contract are retained for five years after termination of the contract.

8.6. Performance of a contract with an individual customer

When providing its services, Controller may deal with individual customers as well as legal-person customers. The personal data of individual customers is necessary for concluding and performing the contract.

Purpose of Processing: preparing, concluding and performing the contract; communication and administration during the term of the contract; accounting between the parties; and the mutual performance and enforcement of rights and obligations relating to use of the service.

Legal basis for Processing: taking steps prior to entering into a contract and concluding and performing the contract pursuant to Article 6(1)(b) GDPR.

Categories of data processed: personal identification data required to conclude the contract, residential address, contact details.

Duration of Processing: data relating to the conclusion and performance of the contract are retained for five years after termination of the contract.

9. DATA SECURITY

To protect personal data and ensure their security, Controller implements technical, organizational, physical and training measures designed to ensure the security of Processing. These include, in particular, technologies forming part of its IT security infrastructure (for example, firewalls and data encryption), secure access controls and authorization-management systems that limit access rights to what is necessary for work purposes.

Access to documents stored in non-electronic form is granted only to employees and Processors whose duties require such access.

The information and communications technology devices used are protected by passwords, passcodes and other security measures, such as: two-factor identification; argon2id password hash; field-level encryption; encrypted backups; hash-chained audit log; TLS; contact data masking.

10. RIGHTS OF DATA SUBJECTS

Under the GDPR and subject to certain conditions, Data Subjects have the right to:

• receive information about the Processing of their personal data;
• obtain access to their personal data;
• obtain rectification of their personal data;
• obtain erasure of their personal data;
• obtain restriction of the Processing of their personal data;
• exercise the right to data portability;
• object to the Processing of their personal data (including objection to profiling and other rights relating to automated decision-making).

The Controller shall inform the Data Subject of action taken on a request to exercise the rights set out in this section without undue delay and in any event within one month of receipt of the request. Where necessary, taking into account the complexity and number of requests, that period may be extended by a further two months. The Controller shall inform the Data Subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the request is made electronically, the information shall, where possible, be provided electronically unless the Data Subject requests otherwise.

Data Subjects may contact the Controller with any question or comment concerning Processing using the following contact details:

• electronically, by sending an email to privacy@markednest.com
• by post, by sending a letter to the registered seat of the Controller

Additionally, Data Subjects also have the right to:

• lodge a complaint with the Controller in connection with the processing; and
• lodge a complaint with the competent supervisory authority or seek a judicial remedy

11. REMEDIES AVAILABLE TO DATA SUBJECTS

Data Subjects have the right to lodge a complaint concerning the processing carried out by the Controller. To facilitate the prompt and effective resolution of complaints the Controller recommends that Data Subjects first lodge their complaint with the Controller before moving forward to filing a complaint with the supervisory authority or seeking judicial remedy.

The Data Subject may lodge a complain concerning the processing of his/her personal data with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH – registered office: 1055 Budapest, Falk Miksa u. 9-11.; postal address: 1363 PO Box 9.; email: ugyfelszolgalat@naih.hu) or seek judicial remedy before the regional court being competent based on the Data Subject’s place of residence.