I. NATURADENT SERVICE LTD. hereby publishes its privacy and data protection principles and policy, which it accepts as binding.
In drawing up these rules, we have taken particular account of the provisions of Act LXIII of 1992 on the Protection of Personal Data and the Disclosure of Data of Public Interest and Act VI of 1998 on the Protection of Individuals with regard to Automatic Processing of Personal Data, ratifying the Convention of 28 January 1981, Strasbourg.
II. Data quality, i.e. the requirements applicable to personal data during automated processing:
- data must be obtained and processed fairly and lawfully;
- data must be stored only for specified and legitimate purposes and must not be used for any other purpose;
- the data must be proportionate to and compatible with the purpose for which they are stored and not excessive in relation to that purpose;
- the data must be accurate and, where necessary, timely;
- the data must be stored in a way that permits identification of the data subject for no longer than is necessary for the purposes for which the data are stored,
- personal data revealing racial or ethnic origin, political opinions, religious or other beliefs, health or sex life cannot be processed by automated means, unless adequate safeguards are provided by domestic law. This also applies to personal data relating to criminal convictions,
- appropriate security measures must be taken to protect personal data stored in automated data files against accidental or unlawful destruction or accidental loss, and against unauthorised access, alteration or dissemination.
III. Additional safeguards to protect the data subject:
Everyone has the right to
- to obtain information about the automated filing of personal data, its main purposes, the identity and the habitual residence or registered office of the controller of the filing;
- be informed, at reasonable intervals and without excessive delay or expense, whether or not personal data are stored in an automated dataset and to be provided with information about that data in a form that is comprehensible to him or her;
- have such data rectified or erased, where justified, in the simplest and quickest way possible;
- have a right of appeal if a request for information or, in justified cases, for disclosure, rectification or erasure, as provided for by law, is not complied with. At the request of the data subject, the controller shall provide information about the data processed by the controller or by a processor to whom the controller has delegated the processing, the purposes, legal basis and duration of the processing, the name and address (registered office) of the processor and the activities of the processor in relation to the processing, as well as the recipients and purposes for which the data are or have been obtained. The controller shall provide the information in writing and in an intelligible form within the shortest possible time from the date of the request, but not later than 30 days. In the event of a breach of the data subject's rights, the data subject may take the controller to court. The controller shall compensate any damage caused to another party by unlawful processing of the data subject's data or by a breach of the requirements of technical data protection. The controller is also liable to the data subject for damage caused by the processor. The controller shall be exempted from liability if he proves that the damage was caused by an unavoidable cause outside the scope of the processing. No compensation shall be payable in so far as the damage resulted from the intentional or grossly negligent conduct of the data subject.
Personal data may be processed if
- with the consent of the data subject, or
- it is ordered by law or by an ordinance of a local government, under the authority of the law and within the scope specified therein. The law may order the disclosure of personal data in the public interest, by expressly indicating the scope of the data. In all other cases, disclosure shall require the consent of the data subject, or, in the case of special categories of data, his or her written consent. In case of doubt, it shall be presumed that the data subject has not given his or her consent. The consent of the data subject shall be deemed to have been given in respect of the data communicated by him or her in the course of his or her public activities or transmitted by him or her for the purpose of disclosure.
Purpose limitation of processing: personal data may only be processed for specified purposes, for the exercise of a right or the performance of an obligation. The processing must comply with this purpose at all stages. Only personal data which is necessary for the purpose of the processing, which is adequate for the purpose, to the extent and for the duration necessary for the purposes of the processing, may be processed. Transfer of data, combination of processing: data may be transferred and different processing operations may be combined where the data subject has given his or her consent or where the law permits it and where the conditions for processing are met for each individual personal data. Data security: the controller or processor in the course of his or her activities shall ensure the security of the data and shall take the technical and organisational measures and establish the procedural rules necessary to enforce this Act and other data protection and confidentiality rules. Data, in particular personal data classified as state secrets and official secrets, shall be protected against unauthorised access, alteration, disclosure or deletion, damage or destruction.
IV. Data Protection Policy:
NATURADENT SERVICE LTD. undertakes to publish a clear, prominent and unambiguous notice informing users of the method, purpose and principles of data collection before any data of its users are collected, recorded or processed. In addition, in all cases where the collection, processing or recording of data is not required by law, NATURADENT SERVICE LTD. draws the user's attention to the voluntary nature of the data provision. In the case of mandatory data provision, the legal provision ordering data processing must also be indicated. The data subject must be informed of the purposes of the processing and of the persons who will process the data. The information on the processing shall also be provided where the law provides for the inclusion of data by transfer or linking from existing processing.
In all cases where NATURADENT SERVICE LTD. intends to use the data provided for purposes other than those for which they were originally collected, it shall inform the user thereof and obtain his/her prior express consent or provide him/her with the opportunity to prohibit such use. In any case, the restrictions set out in the Principles will be respected in the collection, recording and processing of data, and the data subject will be informed of the activities of the data subject, at his/her request, by electronic mail.
NATURADENT SERVICE LTD. undertakes not to impose any sanctions on any user who refuses to provide the optional data. NATURADENT SERVICE LTD. undertakes to ensure the security of the data, to take technical and organisational measures and to establish procedural rules to ensure that the data recorded, stored or processed are protected and to prevent their destruction, unauthorised use or unauthorised alteration. It also undertakes to require any third party to whom it may transfer or disclose the data to fulfil its obligations in this respect.