Who are we?
About Chili Outdoors
The address of the website you are currently visiting is: www.chilioutdoors.com. The website is operated by:
Service provider: Zsigmond Tóth (sole trader)
Name: Zsigmond Tóth e. v.
Hosting provider:
Name: MikroVPS Kft.
What information do we collect?
Data processing in connection with the operation of the website
Chili Outdoors collects only the information strictly necessary for its operation, as detailed below.
In setting our data processing policies, we rely on the following standards:
- Regulation (EU) 2016/679 of the European Parliament and of the Council (27 April 2016) on the protection of natural persons with regard to the processing of personal data (GDPR)
- Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Info Act)
- Act CVIII of 2001 on certain issues of electronic commerce services and information society services (E-commerce Act)
- Act C of 2003 on Electronic Communications
Information about the use of cookies
What is a cookie?
The Data Controller uses so-called cookies (small text files) when you visit the website. A cookie is a small data file that is stored in your browser when you visit a website, and which the website can read back on a subsequent visit.
Some cookies do not contain personal information and are not suitable for identifying an individual user. For example, session cookies are essential for certain functions of the website and expire when you close your browser.
Legal basis for cookies:
The legal basis for processing is your consent pursuant to Article 6(1)(a) of the Regulation. By accepting the use of cookies when you first visit the website, you give your consent.
Main characteristics of the cookies used by this website:
- Google AdWords cookie: When someone visits our site, a visitor cookie is created — specific to that person — using the remarketing feature of Google AdWords. This cookie ensures that Google does not show you ads you have already interacted with.
- Google Analytics cookie: We use Google Analytics to analyse website usage. It places cookies on your device to collect anonymous statistical data about your visit.
- Session cookie: Necessary for site functionality. It expires when the browser is closed.
If you do not accept the use of cookies, certain functions of the website may not be available. You can delete cookies in your browser settings at any time.
Internet Explorer: http://windows.microsoft.com/en-us/internet-explorer/delete-manage-cookies#ie=ie-11
Firefox: https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer
Chrome: https://support.google.com/chrome/answer/95647?hl=en
Embedded content from other websites
Posts and pages on this website may include embedded content from third-party sources (e.g. videos, images, articles). Embedded content from other websites behaves in exactly the same way as if you had visited the other website directly.
These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction if you have an account and are logged in to that website.
If you do not accept the use of cookies, certain functions may not be available to you.
Data processed for the conclusion and performance of contracts
Several data processing activities may occur in connection with the conclusion and performance of a contract.
If you do not make a purchase through the website and are merely a visitor, we only store the technical information necessary for the operation of the website (see above).
Data processing for the conclusion and performance of contracts includes the following cases in detail:
- Contact: If you contact us by e-mail, via a contact form, or by phone, we process the data you provide (name, e-mail address, phone number, content of message) for the purpose of responding to your enquiry. Processed data: name, e-mail address, phone number, message content. Legal basis: your consent. Retention period: until withdrawal of consent.
- Booking: When you make a booking we process your personal data for the purpose of performing the contract. Processed data: name, e-mail address, phone number, number of participants, chosen date. Legal basis: performance of a contract (Article 6(1)(b) GDPR). Retention period: as required by applicable law.
Order processing
Data necessary for the performance of the contract are processed during the processing of bookings.
- Processed data: During the processing the Data Controller processes your name, address, phone number, e-mail address and the details of your booking.
- Purpose of processing: Fulfilment of the contract, confirmation of the booking.
- Legal basis: Performance of a contract (Article 6(1)(b) GDPR).
- Retention period: 5 years following the performance of the contract.
- Data processor: MikroVPS Kft. (hosting).
Invoice issuance
The data processing is carried out for the purpose of issuing an invoice compliant with applicable legislation and fulfilling the associated retention obligation.
- Processed data: Name, address, e-mail address, phone number.
- Purpose of processing: Issuing a legally compliant invoice.
- Legal basis: Legal obligation (Article 6(1)(c) GDPR), Act C of 2000 on Accounting.
- Retention period: 8 years.
- Data processor: Számlázz.hu (Kboss.hu Kft.).
Handling consumer complaints
The data processing is carried out for the purpose of handling consumer complaints.
- Processed data: Customer's name, phone number, e-mail address, content of the complaint.
- Purpose of processing: Handling complaints and fulfilling legal obligations.
- Legal basis: Legal obligation (Article 6(1)(c) GDPR).
- Retention period: 5 years.
Data processed in connection with verifying consent
During the booking or newsletter subscription process, the IT system records the moment of consent for verification purposes.
- Processed data: Timestamp of consent and the IP address of the data subject.
- Purpose of processing: Verifying that valid consent was given.
- Legal basis: Legal obligation.
- Retention period: Until the data subject withdraws consent.
Marketing data processing
Remarketing
- Processed data: Data processed by the cookies described in the Cookie Policy.
- Purpose of processing: Displaying personalised advertisements.
- Legal basis: Your voluntary consent, given by using the website.
- Retention period: Until withdrawal of consent.
Google general cookie policy: https://www.google.com/policies/technologies/ads/
Google Analytics policy: https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage
Facebook policy: https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen
- Legal basis: Your voluntary consent.
- Retention period: Until withdrawal of consent.
- Data processors: Google LLC, Meta Platforms Ireland Ltd.
Prize draws
- Processed data: Name, e-mail address, phone number.
- Purpose of processing: Conducting the prize draw and notifying the winner.
- Legal basis: Your voluntary consent.
- Retention period: Until the prize draw concludes.
Further data processing
If the Data Controller intends to carry out further data processing, it will provide prior information about the essential facts of that processing (purpose, legal basis, duration, identity of the processor).
Please be aware that authorities may request data from the Data Controller on the basis of statutory powers. Where legally required, the Data Controller will comply with such requests.
Data processors and their activities
Name and contact details of data processors:
- Data processor: MikroVPS Kft. | Address: 1096 Budapest, Sobieski János utca 19-21/A | Activity: web hosting.
- Data processor: Számlázz.hu (Kboss.hu Kft.) | Activity: invoicing.
- Data processor: Google LLC | Activity: analytics, advertising.
Your rights in connection with data processing
During the period of data processing you are entitled to the following rights under the Regulation:
- right to withdraw consent
- right of access to personal data
- right to rectification
- right to erasure ('right to be forgotten')
- right to restriction of processing
- right to object
- right to data portability
We will respond to complaints related to data processing within 30 days at most. If you believe your rights have been infringed, you may contact the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) at www.naih.hu.
Right to withdraw consent
You may withdraw your consent to data processing at any time, without affecting the lawfulness of processing based on consent before its withdrawal. To withdraw consent, please contact us at: zsigmond@chilioutdoors.com.
Right of access to personal data
You have the right to receive feedback from the Data Controller as to whether your personal data is being processed, and if so, to access your personal data and the following information from the Data Controller:
- the purposes of the processing;
- the categories of personal data concerned;
- the recipients or categories of recipient to whom the personal data have been or will be disclosed;
- the envisaged period for which the personal data will be stored;
- the existence of the right to request rectification, erasure or restriction of processing and to object to processing;
- the right to lodge a complaint with a supervisory authority;
- if the data were not collected from you, all available information about their source;
- the existence of automated decision-making, including profiling.
The purpose of exercising this right is to verify and control the lawfulness of the processing.
The Data Controller provides access to personal data by making the data available at its registered office during business hours, upon prior appointment.
Right to rectification
You have the right to request that the Data Controller rectify inaccurate personal data concerning you without undue delay. Taking into account the purposes of the processing, you also have the right to have incomplete personal data completed.
Right to restriction of processing
You have the right to request that the Data Controller restrict processing where one of the following applies:
- you contest the accuracy of the personal data, for a period enabling the Data Controller to verify the accuracy;
- the processing is unlawful and you oppose erasure and request restriction instead;
- the Data Controller no longer needs the personal data for the purposes of processing, but you require them for the establishment, exercise, or defence of legal claims;
- you have objected to processing, pending verification of whether the Data Controller's legitimate grounds override yours.
Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise, or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest.
Right to erasure — 'right to be forgotten'
You have the right to request that the Data Controller erase personal data concerning you without undue delay where one of the following grounds applies:
- the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- you withdraw consent and there is no other legal basis for processing;
- you object to processing and there are no overriding legitimate grounds;
- the personal data have been unlawfully processed;
- the personal data must be erased for compliance with a legal obligation.
Erasure does not apply where processing is necessary:
- for exercising the right of freedom of expression and information;
- for compliance with a legal obligation;
- for the establishment, exercise, or defence of legal claims.
Right to object
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you, including profiling based on those provisions.
Where personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing, including profiling to the extent that it is related to direct marketing.
Right to data portability
Where processing is carried out by automated means, or where processing is based on your consent or on a contract with you, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit that data to another controller.
Where direct marketing is involved, you have the right to object at any time.
Automated individual decision-making
You have the right not to be subject to a decision based solely on automated processing — including profiling — which produces legal effects concerning you or similarly significantly affects you.
The above does not apply where the decision:
- is necessary for entering into, or performance of, a contract between you and the Data Controller;
- is authorised by Union or Member State law;
- is based on your explicit consent.
Registration with the data protection authority
Under the provisions of the Information Act, the Data Controller is required to register certain data processing activities with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).
Data security measures
The Data Controller declares that it has taken appropriate security measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.
The Data Controller takes all reasonable organisational and technical steps to ensure that personal data are not accidentally lost, damaged, or accessed by unauthorised persons.
Remedies
If you believe that the Data Controller has violated any provision of applicable data protection law, you may initiate an investigation by the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): www.naih.hu | postal address: 1055 Budapest, Falk Miksa utca 9-11.
You are also entitled to enforce your rights before a court. The court has jurisdiction to hear the case.
Amendments to the Privacy Policy
The Data Controller reserves the right to modify this Privacy Policy in order to comply with changes in data processing practices or applicable law.
If the Data Controller intends to process the collected data for a purpose other than the original purpose of collection, it will inform you in advance of the new purpose and all relevant facts, including:
- the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
- where the processing is based on legitimate interests, the specific legitimate interests pursued;
- the right to lodge a complaint with a supervisory authority.
Processing may only commence after this prior notification, where the legal basis for processing is consent.
This document was last updated in connection with the operation of the booking and sales system. The current version is in effect as of the date of publication on the website.