Terms of Use

PRIVACY NOTICE ON THE RIGHTS OF DATA SUBJECTS REGARDING THE PROCESSING OF PERSONAL DATA

IDENTIFICATION OF THE DATA CONTROLLER

The issuer of this notice, and at the same time the Data Controller:

Company name: The Tootem Kft.

Registered office: 4030 Debrecen, Álmos utca 5–7, Hungary

Company registration number: 09-09-035144

Tax number: 28844215-2-09

Legal representative: Attila Kovács

Phone: +36 30 522 3357

Email: hello@thetootem.com

Websites: www.thetootem.com, www.mozaikelmeny.hu

(hereinafter referred to as: the "Company")

IDENTIFICATION OF DATA PROCESSORS

A data processor is any natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller.

The use of a data processor does not require the prior consent of the data subject; however, the data subject must be informed accordingly. Therefore, we provide the following information:

Appointed Data Processors, Their Contact Details and Purpose of Processing

The Company may use external data processors for the processing of personal data it manages, provided that the processor's activity and the system used for data processing comply with the data protection and data security requirements defined in the Company's internal regulations.

Contracts concluded between the Company and the data processor must include provisions stating that the data processor acknowledges and complies with data protection and data security regulations, and that the Company is entitled to monitor compliance.

PRINCIPLES OF PERSONAL DATA PROCESSING

Personal data may be processed only with the consent of the data subject or on the basis of law, or—within the scope defined by law—local government decree.

Personal data may be processed only for specified purposes.

The data subject must be informed about the processing of their personal data in a verifiable manner.

Processed personal data must comply with the following requirements:

a) collected and processed lawfully and fairly;

b) accurate, complete, and where necessary kept up to date;

c) stored in a form that permits identification of data subjects only for the period necessary for the purposes of processing.

For statistical purposes, personal data may only be transferred in a form that clearly prevents identification of the data subject.

When obtaining consent, the Company considers the following three cumulative elements indispensable: voluntariness, clarity, and adequate information.

PROCESSING OF DATA OF JOB APPLICANTS, APPLICATIONS, CVs

Scope of Personal Data Processed

Name, date and place of birth, mother's maiden name, address and distance from the physical office, qualifications, photograph, phone number, email address, employer notes (if any), CV, motivation letter, completion of test assignments, competencies, skills required for the position, personality traits and behavioral style in relation to team fit.

Purpose of Processing

Evaluation of applications, selection process, and conclusion of an employment contract with the selected candidate. Applicants will be informed if they are not selected.

Legal Basis

Consent of the data subject, expressed through clear and affirmative action.

Duration of Storage

Until the evaluation of the application is completed. Personal data of non-selected applicants must be deleted. Data of applicants who withdraw their application must also be deleted.

The data controller may retain applications only with the explicit, clear and voluntary consent of the data subject, and only if retention is necessary to achieve a lawful purpose. Such consent must be requested after the recruitment process has concluded.

DATA PROCESSING RELATED TO CONTRACTS

Processing of Contracting Partners' Data – Customers and Suppliers

For the purpose of concluding, performing, terminating contracts, and granting contractual benefits, the Company processes the name, mother's maiden name, address and tax identification number of natural persons acting as customers or suppliers.

This processing is lawful even when carried out prior to contract conclusion at the request of the data subject.

Retention period: 5 years following termination of the contract.

The data subject must be informed prior to data processing that the legal basis is contract performance; such information may also be included in the contract.

The data subject must be informed if their personal data is transferred to a data processor.

Contact Details of Representatives of Legal Entity Partners

Processed data: name, address, phone number, email address.

Purpose: performance of contracts, business communication.

Legal basis: consent or contractual obligation.

Retention period: 3 years following the end of the business relationship or representative capacity.

SUMMARY OF DATA SUBJECT RIGHTS

Right to Prior Information

Data subjects are entitled to receive information about data processing before it begins.

Additional information may be requested at: hello@thetootem.com

Right of Access

Data subjects have the right to receive confirmation as to whether their personal data is being processed and, if so, to access such data and related information.

Registered webshop users may access their data after login at:

www.thetootem.com, www.mozaikelmeny.hu

Non-registered users may submit requests via: hello@thetootem.com

Right to Rectification

Data subjects may request correction of inaccurate personal data without undue delay and completion of incomplete data.

Right to Erasure ("Right to Be Forgotten")

Data subjects may request deletion of their personal data without undue delay if statutory conditions apply.

Right to Restriction of Processing

Data subjects may request restriction of processing where applicable.

Notification Obligation

The Data Controller informs all recipients of any rectification, erasure or restriction unless this proves impossible or involves disproportionate effort.

Right to Data Portability

Data subjects may receive their personal data in a structured, commonly used, machine-readable format (txt or csv) and transmit it to another controller.

Right to Object

Data subjects may object at any time to processing based on legitimate interest or public task.

Automated Decision-Making, Including Profiling

Data subjects have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

DATA SECURITY MEASURES

The Company maintains appropriate information security policies and protects personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access through technical and organizational measures, including:

• confidentiality obligations for employees

• access control via authorization levels

• firewall and antivirus protection

• secure electronic data processing systems

• monitored electronic communications

• physical protection of data and storage media

PRODUCT REVIEWS

Registration is not always required to submit product reviews. In such cases, only name and email address are required. Reviews are public. The Company reserves the right to remove unlawful or offensive content and assumes no responsibility for user opinions.

OTHER DATA PROCESSING ACTIVITIES

Registration on the Company's Website

Data stored: name, phone number, email

Retention: 3 years or until consent withdrawal

Newsletter Subscription

Newsletters are sent only with explicit, voluntary consent. Subscriptions can be cancelled at any time, preferably via automated unsubscribe options.

SOCIAL MEDIA DATA PROCESSING

The Company maintains Facebook, YouTube, TikTok, Instagram and LinkedIn pages for promotional purposes.

Content posted by users is governed by the respective platform's privacy policies. The Company is not responsible for unlawful content posted by users and may remove such content without prior notice.

WEBSITE VISITOR DATA AND COOKIES

Cookies are small data files stored on users' devices. Some cookies require consent, others do not. Detailed cookie information is available via a linked notice.

DATA PROCESSING IN THE WEBSHOP

Purchases made via the webshop constitute a contract. Personal data is processed for contract performance, invoicing, customer service, marketing, IT services and delivery.

Retention period:

• Registration/service duration or consent withdrawal

• Purchases: 5 years following the year of purchase

DIRECT MARKETING

Direct marketing communications are sent only with prior explicit consent.

Processed data: name, address, phone number, email, online identifier

Retention: until consent withdrawal

OWNERSHIP OF INFORMATION

All content on the Company's websites is owned by The Tootem Kft. and protected by Hungarian and international law. Unauthorized reproduction, modification or resale is prohibited.

By registering on the website, users accept this Privacy Policy.

Privacy Policy effective from: 5 November 2023, until revoked

The Tootem Kft.