PRIVACY NOTICE
Application of the Data Protection and Data Management Policy
Name of the organisation:
Fehér-Szarka Zsófia, sole proprietor
Registered office:
1182 Budapest, Halomegyházi utca 2/B., Hungary
Person responsible for the content of this policy:
Fehér-Szarka Zsófia
Effective date:
1 December 2025
This policy establishes the rules relating to the protection of natural persons with regard to the processing of personal data and the free movement of such data. The provisions of this policy shall be applied during specific data processing activities, as well as when issuing instructions and notices governing data processing.
Data Protection Officer (DPO)
The obligation to appoint a Data Protection Officer applies to all public authorities or other bodies performing public tasks (regardless of the type of data they process), as well as to organisations whose core activities involve large-scale, systematic monitoring of individuals, or large-scale processing of special categories of personal data.
The organisation does not appoint a Data Protection Officer.
If a Data Protection Officer is appointed:
Name:
Position:
Contact details:
Scope of the Policy
This policy remains in force until revoked. Its scope covers the organisation’s officers, employees, and the organisation’s Data Protection Officer (if appointed).
Date: 1 December 2025
1. Purpose of the Notice
The purpose of this policy is to harmonise the provisions of the organisation’s other internal regulations relating to data processing, in order to protect the fundamental rights and freedoms of natural persons and to ensure the proper handling of personal data.
In the course of its activities, the organisation aims to fully comply with all legal requirements applicable to the processing of personal data, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council (the General Data Protection Regulation – GDPR).
An important objective of issuing this policy is also to ensure that, by becoming familiar with and complying with it, the organisation’s employees are able to process the personal data of natural persons lawfully.
Name: Fehér-Szarka Zsófia
Registered office: 1182 Budapest, Halomegyházi utca 2/B., Hungary
Tax number: 90628629-1-43
E-mail address: hello@atmointerior.com
Personal data must be processed lawfully and fairly, and in a transparent manner in relation to the data subject.
Personal data may only be collected for specified, explicit and lawful purposes.
The purpose of processing personal data must be adequate and relevant, and limited to what is necessary.
Personal data must be accurate and kept up to date. Inaccurate personal data must be erased without delay.
Personal data must be stored in a form that permits identification of data subjects only for as long as necessary. Storage for longer periods is permitted only where the data are processed for archiving purposes in the public interest, for scientific or historical research purposes, or for statistical purposes.
Personal data must be processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, by implementing appropriate technical or organisational measures.
The principles of data protection must apply to any information relating to an identified or identifiable natural person.
Employees of the organisation who process personal data may be subject to disciplinary, civil, administrative or criminal liability for unlawful processing. If an employee becomes aware that personal data under their control are inaccurate, incomplete or outdated, they must correct them or initiate their correction by the person responsible for recording the data.
As natural persons may be associated with online identifiers provided by the devices, applications, tools and protocols they use—such as IP addresses and cookie identifiers—these data, when combined with other information, may be used to create profiles of natural persons and to identify them.
Personal data may only be processed if the data subject has given their consent through a clear affirmative action, such as a written statement (including electronic form) or an oral declaration, indicating freely given, specific, informed and unambiguous consent to the processing of their personal data.
Consent to processing may also be given where the data subject selects a checkbox while browsing the website. Silence, pre-ticked boxes or inactivity do not constitute consent.
Consent may also be given where a user adjusts technical settings while using electronic services, or makes a statement or performs an action which, in the given context, clearly indicates the data subject’s consent to the processing of their personal data.
Health-related personal data include any data concerning the physical or mental health of the data subject which provide information about their past, present or future physical or mental health status. This includes, in particular:
Genetic data shall be defined as personal data relating to the inherited or acquired genetic characteristics of a natural person, resulting from the analysis of a biological sample taken from the data subject, in particular chromosomal analysis, DNA (deoxyribonucleic acid) or RNA (ribonucleic acid) analysis, or from the analysis of any other element enabling the extraction of equivalent information.
Children’s personal data deserve special protection, as children may be less aware of the risks, consequences and safeguards related to the processing of personal data and of their rights. This special protection should apply in particular to the use of children’s personal data for marketing purposes or for creating personal or user profiles.
Personal data must be processed in a manner that ensures an appropriate level of security and confidentiality, including protection against unauthorised access to personal data and to the equipment used for processing personal data, as well as against unauthorised use of such data.
All reasonable steps must be taken to ensure that inaccurate personal data are rectified or erased without delay.
6. Lawfulness of Processing
The processing of personal data shall be lawful only if at least one of the following conditions is met:
Based on the above, processing shall be considered lawful if it is necessary in connection with the performance of a contract or the intention to enter into a contract.
Where processing is carried out in order to comply with a legal obligation applicable to the controller, or where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, such processing must have a legal basis laid down in Union law or in the law of a Member State.
Processing shall also be considered lawful where it is necessary to protect the life or vital interests of the data subject or another natural person. In principle, processing of personal data based on the vital interests of another natural person may only take place if the processing cannot be carried out on another legal basis.
Certain types of personal data processing may simultaneously serve an important public interest and the vital interests of the data subject, for example where processing is necessary for humanitarian purposes, including monitoring epidemics and their spread, or in humanitarian emergencies, in particular in cases of natural or man-made disasters.
The legitimate interests of the controller—including any controller to whom personal data may be disclosed—or of a third party may constitute a legal basis for processing. Such legitimate interest may exist, for example, where there is a relevant and appropriate relationship between the data subject and the controller, such as where the data subject is a client of, or employed by, the controller.
The processing of personal data strictly necessary for the prevention of fraud shall also be considered a legitimate interest of the data controller. The processing of personal data for direct marketing purposes may likewise be regarded as being based on a legitimate interest.
In order to determine whether a legitimate interest exists, careful consideration must be given, among other factors, to whether the data subject can reasonably expect, at the time and in the context of the collection of the personal data, that processing for the given purpose may take place. The interests and fundamental rights of the data subject may override the interests of the controller where personal data are processed in circumstances in which the data subject does not reasonably expect further processing.
The legitimate interest of the controller also includes personal data processing carried out by public authorities, computer emergency response teams, network and information security incident response units, electronic communications network operators and service providers, as well as cybersecurity service providers, to the extent that such processing is strictly necessary and proportionate to ensure network and information security.
Processing of personal data for purposes other than those for which the personal data were originally collected is permitted only where such processing is compatible with the original purposes of collection. In such cases, no separate legal basis is required beyond the legal basis that permitted the original collection of the personal data.
The processing of personal data by authorities for the purpose of achieving objectives recognised by constitutional law or international public law of officially recognised religious organisations shall be considered to be carried out in the public interest.
The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, and data concerning a natural person’s sex life or sexual orientation, is prohibited unless the data subject has given explicit consent to the processing of such personal data for one or more specified purposes.
The processing of personal data relating to criminal convictions and offences, or related security measures, may be carried out only where such processing is conducted under the control of a public authority.
Where the purposes for which the controller processes personal data do not or no longer require the identification of the data subject, the controller shall not be obliged to retain, acquire, or process additional information in order to identify the data subject.
Where the controller can demonstrate that it is not in a position to identify the data subject, the controller shall, where possible, inform the data subject accordingly.
The principle of fair and transparent data processing requires that the data subject be informed of the fact of data processing and its purposes.
Where personal data are collected from the data subject, the data subject shall also be informed whether the provision of personal data is mandatory and of the possible consequences of failure to provide such data. This information may be supplemented with standardised icons in order to provide the data subject with a clear, easily understandable, and readily accessible overview of the intended data processing.
The information relating to the processing of personal data concerning the data subject shall be provided to the data subject at the time the data are collected, or, where the personal data have not been obtained from the data subject, within a reasonable period, taking into account the circumstances of the case.
The data subject shall have the right to access the personal data collected concerning them and to exercise this right easily and at reasonable intervals in order to verify the lawfulness of the data processing. Every data subject shall be entitled, in particular, to be informed of the purposes of the processing of personal data and, where possible, the period for which the personal data will be processed.
The data subject shall, in particular, have the right to have their personal data erased and no longer processed where the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed, or where the data subject has withdrawn their consent on which the processing is based.
Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time, free of charge, to the processing of personal data concerning them for such purposes.
In order to ensure that the storage of personal data is limited to the necessary period, the data controller shall establish deadlines for erasure or regular review.
The regular review period established by the head of the organisation is: 1 year.
The data controller shall apply appropriate internal data protection rules in order to ensure lawful data processing. This regulation covers the scope of authority and responsibility of the data controller.
The data controller is obliged to implement appropriate and effective measures and to be able to demonstrate that data processing activities comply with the applicable legislation.
Such regulation shall be adopted taking into account the nature, scope, context and purposes of the data processing, as well as the risks of varying likelihood and severity to the rights and freedoms of natural persons.
The data controller shall implement appropriate technical and organisational measures, taking into account the nature, scope, context and purposes of the data processing, as well as the risks of varying likelihood and severity to the rights and freedoms of natural persons. On the basis of this policy, the data controller shall review other internal regulations and update them as necessary.
The data controller or data processor shall maintain appropriate records of data processing activities carried out within their scope of responsibility. Every data controller and data processor shall cooperate with the supervisory authority and make these records available upon request for the purpose of monitoring the relevant data processing operations.
Right to Request Information
Any person may request information via the contact details provided regarding which of their data the organisation processes, on what legal basis, for what purpose, from which source, and for how long. Upon request, information shall be provided without undue delay, but no later than within 30 days, to the contact details specified.
Right to Rectification
Any person may request the correction of any of their personal data via the contact details provided. Such requests shall be acted upon without undue delay, but no later than within 30 days, and the person shall be informed accordingly.
Right to Erasure
Any person may request the deletion of their personal data via the contact details provided. Upon request, the data shall be erased without undue delay, but no later than within 30 days, and the person shall be informed accordingly.
Right to Restriction of Processing
Any person may request the restriction (blocking) of their personal data via the contact details provided. The restriction shall remain in place for as long as the reason indicated makes the storage of the data necessary. The request shall be fulfilled without undue delay, but no later than within 30 days, and the person shall be informed accordingly.
Right to Object
Any person may object to the processing of their personal data via the contact details provided. The objection shall be examined within the shortest possible time, but no later than within 15 days from the submission of the request. A decision shall be made regarding its validity, and the person shall be informed of the decision.
Remedies Related to Data Processing
National Authority for Data Protection and Freedom of Information
Postal address: 1363 Budapest, P.O. Box 9.
Address: 1055 Budapest, Falk Miksa Street 9–11
Phone: +36 (1) 391-1400
Fax: +36 (1) 391-1410
Email: ugyfelszolgalat@naih.hu
Website: https://naih.hu
In the event of a violation of their rights, the data subject may initiate legal proceedings against the data controller or the data recipient. The court shall act in an expedited procedure. The action may be brought, at the choice of the data subject, before the competent court of the data subject’s place of residence or habitual stay.
Personal data must be protected by appropriate measures, in particular against unauthorised access, alteration, transmission, disclosure, deletion or destruction, as well as against accidental loss or damage and inaccessibility resulting from changes in applied technology.
To protect electronically processed data records, appropriate technical solutions must be applied to ensure that stored data cannot be directly linked to or assigned to the data subject.
When designing and implementing data security measures, the current state of the art must be taken into account. Among several possible data processing solutions, the one that ensures a higher level of protection of personal data must be chosen, unless this would impose a disproportionate burden on the data controller.
The designation of a Data Protection Officer is mandatory under the following conditions:
Where the appointment of a Data Protection Officer is mandatory, the following rules apply:
The data controller must ensure that the Data Protection Officer (DPO) is involved properly and in a timely manner in all matters relating to the protection of personal data. The resources necessary to maintain the DPO’s expert-level knowledge must be made available.
In performing their duties, the Data Protection Officer shall not receive instructions from anyone. The data controller or processor may not dismiss or penalise the Data Protection Officer in relation to the performance of their tasks. The Data Protection Officer reports directly to the highest level of management of the data controller or processor.
Data subjects may contact the Data Protection Officer regarding all issues related to the processing of their personal data and the exercise of their rights.
The Data Protection Officer is bound by confidentiality or an obligation of secrecy with regard to the performance of their tasks.
The Data Protection Officer may perform other tasks, provided that such tasks do not result in a conflict of interests.
A data protection incident is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.
In the absence of appropriate and timely measures, a data protection incident may result in physical, material or non-material damage to natural persons, including loss of control over their personal data, restriction of their rights, discrimination, identity theft or identity fraud.
A data protection incident must be reported to the competent supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless it can be demonstrated, in accordance with the principle of accountability, that the data protection incident is unlikely to result in a risk to the rights and freedoms of natural persons.
The data subject must be informed without undue delay if the data protection incident is likely to result in a high risk to the rights and freedoms of natural persons, in order to enable them to take the necessary precautionary measures.
In connection with its activities, the organisation may process personal data for administrative and record-keeping purposes.
The legal basis for such data processing is the voluntary and explicit consent of the data subject, provided on the basis of proper prior information. After detailed information has been given — covering the purpose, legal basis and duration of data processing, as well as the rights of the data subject — the data subject must be informed of the voluntary nature of the data processing. Consent to data processing must be recorded in writing.
Data processing for administrative and record-keeping purposes serves the following objectives:
Such data processing is based partly on legal obligations and partly on the explicit consent of the data subject (for example, for the purpose of an employment contract or registration as a partner on the website).
In the case of documents submitted to the organisation in written form that contain personal data (such as CVs, job applications or other submissions), the consent of the data subject shall be presumed. After the case has been closed, and in the absence of consent for further use, such documents must be destroyed. The fact of destruction must be recorded in a written report.
In the case of administrative data processing, personal data shall be included exclusively in the documents and records relating to the specific case. Such data shall be processed until the document serving as the legal basis for the processing is disposed of.
Data processing carried out for administrative and record-keeping purposes must be reviewed annually in order to ensure that the storage of personal data is limited to the necessary period. Inaccurate personal data must be deleted without delay.
Compliance with applicable legal requirements must also be ensured in the case of data processing for administrative and record-keeping purposes.
If the organisation intends to carry out data processing activities that are not covered by this policy, this internal policy must be appropriately supplemented in advance, and specific provisions corresponding to the new data processing purpose must be added.
Documents and regulations that are related to the data protection and data management policy — such as written consent statements for data processing or, in the case of websites, the mandatory privacy notices — must be attached to and managed together with this policy.
