______________________________________________________

Privacy Policy

of

UDEMX Szoftverfejlesztő és Tanácsadó

Korlátolt Felelősségű Társaság

______________________________________________________

1. Preamble:

UDEMX Szoftverfejlesztő és Tanácsadó Korlátolt Felelősségű Társaság (registered seat: 6720 Szeged, Dugonics tér 11, III. floor, door 26; company registration number: Cg.06-09-022329), as the data controller (UDEMX or Data Controller), processes personal data for the purpose of operating the StafétApp application (StafétApp).

UDEMX intends to fully comply with the legal requirements for the processing of personal data, in particular with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council (the Regulation or GDPR).

This Privacy Policy has been prepared on the basis of the Regulation and in accordance with Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (Infotv.).

Name and contact details of the data controller, service provider:

2. Explanatory provisions:

• GDPR (see above);

• processing: any operation or set of operations which UDEMX performs on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

• data processor: a service provider contracted by UDEMX, which is a natural or legal person, public authority, agency or any other body that processes personal data on behalf of the controller;

• personal data means any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity thereof;

• controller: a natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; should the purposes and means of the processing are to be determined by the law of EU or a Member State, the controller or specific criteria for the designation of the controller may also be determined by the law of EU or a Member State;

• data processor: a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller;

• consent of the data subject: a voluntarily given, specific, informed and unambiguous indication of the data subject's wishes by which he or she signifies, by a statement or by an act expressing his or her unambiguous consent, that he or she signifies his or her agreement to the processing of personal data concerning him or her;

• data subject: the natural person in respect of whom personal data are processed;

• data breach: a breach of security that results in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;

• recipient: the natural or legal person, public authority, agency or any other body, whether or not a third party, to whom or with whom the personal data are disclosed. Public authorities which may have access to personal data in the context of an individual investigation in accordance with Union or Member State law are not recipients; the processing of those data by those public authorities must comply with the applicable data protection rules in accordance with the purposes of the processing;

• third party: a natural or legal person, public authority, agency or any other body other than the data subject, the controller, the processor or the persons who, under the direct authority of the controller or processor, are authorised to process personal data.

3. Principles of data management

The Data Controller declares that the personal data shall be processed in accordance with the provisions of this Privacy Policy and shall be in compliance with the GDPR, the Infotv. and any other applicable legislation, particularly to the content of this Clause:

The processing of personal data must be lawful, fair and transparent for the data subject.

Personal data shall be collected only for specified, explicit, legitimate and a priori disclosed purposes.

The purposes for which personal data are processed must be adequate, relevant and limited to what is necessary.

Personal data must be accurate and up-to-date. Inaccurate personal data must be deleted without delay.

Personal data must be stored in a form which permits identification of data subjects for no longer than is necessary. Personal data may be stored for longer periods only if the storage is for archiving purposes in the public interest, scientific and historical research purposes or statistical purposes.

Personal data must be processed in a way to ensure adequate security of personal data, including protection against unauthorised or unlawful processing, accidental loss, destruction or damage, by using appropriate technical or organisational measures.

The principles of data protection shall apply to any information relating to an identified or identifiable natural person.

4. Important data management information

The purposes, legal basis, data subjects and duration of each processing operation carried out by UDEMX are indicated separately in the activities. The rights of data subjects are detailed below in this Clause, as they are the same for all processing activities.

The data subject may withdraw his or her consent to the processing at any time by sending an e-mail to the contact e-mail address. In the event of withdrawal of the user's consent to the processing of personal data, the Controller will no longer make StafétApp available.

The Data Controller and its employees and processors are entitled to access the data.

The user, as a data subject, may request the Controller to access, rectify, erase or restrict the processing of personal data relating to him or her and may object to the processing of such personal data and the data subject's right to data portability.

The data subject may withdraw his or her consent to the processing at any time, but this shall not affect the lawfulness of the processing carried out on the basis of the consent prior to its withdrawal.

The data subject may exercise the right to lodge a complaint with the supervisory authority.

The data subject shall have the right to obtain from the controller, upon his or her request, the erasure without undue delay of inaccurate personal data relating to him or her and the controller shall be obliged to erase without undue delay personal data relating to him or her, unless there is another legal basis for the processing.

Amendments or deletion of personal data may be initiated by e-mail, telephone or letter to the contact details given above.

It is important to emphasise that the withdrawal of the right to data processing by the data subject does not terminate the data subject's obligation to pay UDEMX. The fact of non-payment is in itself a ground for processing the data of the data subject, as it is related to his/her default of payment to UDEMX. The processing is a condition for the use of StafétApp.

5. Account registration

A prerequisite for using StafétApp is that the data subject registers an online user account (User Account) on the UDEMX interface, which can be accessed through StafétApp as a user interface. In relation to the User Account, UDEMX carries out the following data processing activities. It is important to note that the deletion of the StafétApp does not automatically entail the deletion of the User Account, therefore the data subject shall communicate the request for deletion of the User Account separately to UDEMX at the following email: [email protected] The deletion request shall be executed by UDEMX within 5 days of its receipt. Once the request for deletion has been executed, the data of the User Account will not be accessible to the data subject but will be processed by UDEMX in accordance with this notice until the end of the 6th year following the deletion, after which they will be permanently and irreversibly deleted.

6. Use of StafétApp

Subsequently to the registration of the User Account done by the data subject, the use of StafétApp application is possible online - Apple AppStore, Google Play Store - after downloading and accepting the relevant license agreement. The StafétApp is available free of charge and in a paid version, as well.

UDEMX keeps an electronic record of the persons using the StafétApp application and the teams formed by them in order to inform each team member. For the free version of StafétApp, the position of the person who is currently completing the race distance is displayed afterwards - not in real time – to his / her team members after he / she has checked in on the stage he / she has just completed. In the paid version of StafétApp, the position of the person completing the race course is visible in "real time" to the other team members of that competitor.

With StafétApp, UDEMX aims to increase the personal safety of the competitors in a given race by offering the possibility to determine the position of the team member completing the distance with approximate accuracy, even in the free version. The paid version, by comparison, provides an accurate location of the athlete completing the distance.

In addition to the personal safety aspects, StafétApp provides team members with a faster, more accurate and more timely changeover of the team member following the competitor who has completed the distance at the transition points at each stage.

UDEMX processes the following data of the users concerned as follows:

7. Location services

The paid version of StafétApp allows users to see their teammates' current geographical position in "real time" during the race. The positioning services described in this Clause apply only to the paid version of StafétApp.

8. Contact

The following data of registered data subjects are processed by UDEMX for the purpose of contacting them:

9. Providing payment receipt

UDEMX is obliged to issue receipts to the users of the pay-version of StafétApp, on the basis of which UDEMX shall use the services of Billingo Technologies Zártkörűen Működő Részvénytársaság (registered seat: Árbóc utca 6., HU-1133 Budapest; company registration number: Cg. 01-10-140802), the company that operates the invoicing software, Kurdi és Fiai Építőipari és Szolgáltató Kft. (registered seat: 1061 Budapest, Paulay Ede utca 26. fsz. 2.; company registration number: Cg. 01 09 562686), the company, which provides accountancy services and Magyar Bankholding Zrt., which handles banking operations, which are considered as data controllers in their own right.

The electronic storage of the data required for the receipt is: https://www.billingo.hu/adatkezelesi-tajekoztato

UDEMX will process the following personal data of the user concerned who uses StafétApp for the purposes of receipting:

• Name;
• E-mail;
• amount of claims;
• bank;
• bank account;
• amount of the pay-version.

10. Accountancy

UDEMX can meet its obligation to file tax returns and pay tax on the basis of the accounting receipts paid by the data subject using the paid version of StafétApp by sending the tax returns prepared by the accounting service provider to the tax authority and meeting its tax payment obligations on the basis of the returns. Only UDEMX staff and, in accordance with their own privacy policy, the service provider's staff have access to the data, and all are responsible for the security of the data.

11. Audit

Payment transactions made by data subjects using the paid version of StafétApp may be subject to scrutiny by the UDEMX auditor for public interest protection reasons.

12. Payment operations

By accepting this Policy, the User acknowledges that the following personal data stored by UDEMX as the data controller in the stafetapp.eu user database will be transferred to OTP Mobil Kft. as the data processor.

The nature and purpose of the data processing activities carried out by the data processor can be found in the SimplePay Data Processing Information Notice at the following link: http://simplepay.hu/vasarlo-aff 

13. Payment services

Payment transactions made by the data subject using the pay-version of StafétApp shall be processed by the payment systems provided by the payment service provider under this point in relation to his UDEMX payment accounts. The data may only be accessed by employees of UDEMX or, in accordance with their own data management information, by employees of the payment service provider, and each of them is responsible for the secure handling of the data.

14. Receivables management

Should the data subject use the pay-version of StafétApp does not pay for the services provided by UDEMX, UDEMX will seek external assistance to recover the outstanding amount. Access to the data will be limited to the staff of the Data Controller and, in accordance with their own data management information, to the staff of the service provider, and each of them will be responsible for the secure handling of the data.

15. Rights is relation to data processing

The right to request information

The data subject may request information from the Data Controller, through the contact details provided, about the data subject's data, the legal basis for the data processing, the purpose of the data processing, the source of the data and the duration of the processing. Upon the data subject's request, the Controller shall send information without undue delay, but within 30 days at the latest, to the e-mail address provided by the data subject. 

The right to rectification

The data subject may request the Data Controller to amend any of his or her data through the contact details provided. The Data Controller shall take action on the data subject's request without undue delay, but within 30 days at the latest, by sending information to the e-mail address provided by the data subject.

The right to erasure

The data subject may request the erasure of his or her data by contacting the Data Controller via the contact details provided. Upon the data subject's request, the Data Controller shall do so without undue delay, but within 30 days at the latest, and shall send information to the e-mail address provided by the data subject.

The right to blocking

The data subject may request the blocking of his or her data by the Data Controller through the contact details provided. The blocking shall last as long as the storage of the data is necessary for the reason indicated by the data subject. At the request of the data subject, the Controller shall do so without undue delay, but within a maximum of 30 days, and shall inform the data subject by e-mail to the e-mail address provided by the data subject.

The right to protest

The data subject may object to the processing of his or her personal data using the contact details provided. The Data Controller shall examine the objection within the shortest possible time from the date of the request, but not later than 15 days, and shall decide whether the objection is justified and inform the data subject of its decision by e-mail.

Enforcement possibilities in relation to data processing

In the event of unlawful processing by the data subject, notify the Data Controller so that the lawful situation can be rectified within a short period of time.

Should the data subject considers that the lawful situation cannot be restored, he or she should notify the authority using the following contact details:

National Authority for Data Protection and Freedom of Information

Postal address: PO Box 5., HU-1530 Budapest

Address: Szilágyi Erzsébet fasor 22/c., HU-1125 Budapest

Phone: +36 (1) 391-1400

Fax: +36 (1) 391-1410

E-mail: ugyfelszolgalat (at) naih.hu

URL https://naih.hu

coordinates: N 47°30'56''; E 18°59'57''

16. Legal ground of data management

• REGULATION (EU) No 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Regulation (EC) No 95/46/EC (General Data Protection Regulation);

• Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information;

• Act LXVI of 1995 on public records, public archives and the protection of private archival material;

• Government Decree No 335/2005 (XII. 29.) on the general requirements for document management by public bodies;

• Act CVIII of 2001 on certain aspects of electronic commerce services and information society services; and

• Act C of 2003 on electronic telecommunications.

17. Miscellaneous

With respect to the data transferred within the scope of this Privacy Policy, the data controllers in their own right are individually responsible for the personal data processing they carry out on behalf of UDEMX.

This privacy notice is to be valid from 31 March 2023 until withdrawal.

UDEMX reserves the right to unilaterally modify this Privacy Policy at any time, with prior notice to the data subjects. Data subjects are to be informed by means of a notice on [https://stafetapp.eu/support] at latest one calendar day prior to the modification.