Privacy notice and terms of use for the “Tastes of thyssenkrupp online CookBook” campaign

Thyssenkrupp Materials Hungary Zrt. (registered office: 1158 Budapest, Fázis u. 6., company registration number: 01-10-042333, tax number: 10870536-2-44) (hereinafter the “Controller”) processes the personal data of the persons (hereinafter collectively the “Data Subject”) who have participated in the company’s public fundraising campaign (hereinafter the “Campaign”).

In connection with the processing of data, thyssenkrupp Materials Hungary Zrt. hereby informs the Data Subjects about the personal data it processes in the course of the campaign, the principles and practices followed in the processing of personal data, the means and ways of exercising the rights of the Data Subjects and the basic rules of the game.

The Campaign:

The Tastes of thyssenkrupp online cookbook is a sustainable recipe collection inspired by great recipes submitted by our own colleagues. This is a unique opportunity for everyone to not only enjoy a culinary experience, but also to support a cause close to their heart.

The Tastes of thyssenkrupp CookBook is available at https://www.thyssenkrupp-materials-eastern-europe.com/en/sustainable-cookbook.

Once registered, participants will receive a cookbook by donating a minimum of €30 to the charity of their choice. All the donations raised will go to PLANT-MY-TREE or SOS Children’s Villages to help plant forests in Eastern Europe and support children and their families in need.

How can you get access to the recipe book and help the organisation of your choice?

Choose an organisation. Fill in the pop-up questionnaire and agree to the privacy statement and terms of participation.

Then donate at least €30 to the organisation by bank transfer and include ‘tastes of thyssenkrupp’ in the comment field of the transfer. Then email the transfer receipt to tkmh.marketing@thyssenkrupp-materials.com.

We will then send you the recipe book in digital format to the email address you provided during registration.

By providing the required data and by registering, the Data Subject accepts the Privacy Notice and expressly consents to the processing operations set out below.

By providing the necessary data and by registering, the Data Subject expressly consents to PLANT-MY-TREE or SOS Children’s Villages informing the Controller of the fact of the donation, so that the Controller can distribute the cookbook to the donors. The donated organisations shall provide the Controller with the name of the donor.

PRIVACY NOTICE

1. DEFINITIONS

(a) ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

(b) ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

(c) ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

(d) ‘restriction of processing’ means the marking of stored personal data with the aim of limiting their processing in the future;

(e) ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

(f) ‘recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;

(g) ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

(h) ‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;

2. SCOPE OF THE DATA PROCESSED, PURPOSE AND DURATION OF THE PROCESSING

The participant may request the rectification, deletion, completion or blocking of his or her data at any time without giving reasons and may exercise his or her right to data portability by sending a written request to thyssenkrupp Materials Hungary Zrt. at 1158 Budapest, Fázis u. 6. or by email to marketing.tkmh@thyssenkrupp.com.

3. PERSONS HAVING ACCESS TO DATA, PROCESSING OF DATA

The data may be accessed primarily by thyssenkrupp Materials Hungary Zrt. and employees of thyssenkrupp Materials Hungary Zrt., who will not disclose or transmit the data to any third party (parties) other than as specified in this Privacy Policy.

The Controller does not use a processor.

No automated decision-making or profiling will be carried out in connection with the processing.

4. DATA TRANSMISSION

The data provided by the data subject will not be transmitted.

5. DATA SUBJECT RIGHTS

5.1. Information and access to personal data

The Data Subject shall have the right to access his or her personal data stored by thyssenkrupp Materials Hungary Zrt. and information on the processing thereof, to request such information at any time, to check what data thyssenkrupp Materials Hungary Zrt. holds about him or her and to have access to such personal data. The Data Subject shall submit his or her request for access to the data in writing to thyssenkrupp Materials Hungary Zrt., which shall provide the requested data in writing (electronically or by post). Thyssenkrupp Materials Hungary Zrt. will not provide any oral information in this context.

In the event of exercising the right of access, the information shall include the following data:

– definition of the scope of the data processed,

– purpose, time and legal basis of the processing in relation to the scope of the data processed,

– data transmission: to whom the data have been or will be transmitted,

– indication of data source.

Thyssenkrupp Materials Hungary Zrt. will provide the data subject with a paper or electronic copy of the personal data free of charge. If the data subject requests a copy electronically, thyssenkrupp Materials Hungary Zrt. will provide the information to the data subject by email in a commonly used electronic format. If, after having been informed, the data subject does not agree with the processing or the accuracy of the data processed, the data subject may request the rectification, completion, erasure or restriction of the processing of personal data concerning him or her, as provided for in Section 5, or object to the processing of such personal data or initiate the procedure provided for in Section 6.

5.2. Right to rectification and completion of personal data processed

At the request of the data subject, thyssenkrupp Materials Hungary Zrt. shall, without undue delay, rectify inaccurate personal data indicated by the data subject in writing or complete the incomplete data with the content indicated by the data subject. Thyssenkrupp Materials Hungary Zrt. will notify any recipient to whom it has disclosed personal data of such rectification or completion, unless this proves impossible or involves a disproportionate effort. The data subject will be informed of the details of these recipients upon written request.

5.3. Right to restriction of processing

The data subject shall have the right to obtain, upon written request, restriction of processing by thyssenkrupp Materials Hungary Zrt. if:

– the accuracy of the personal data is contested by the data subject, for a period enabling thyssenkrupp Materials Hungary Zrt. to verify the accuracy of the personal data;

– the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;

– thyssenkrupp Materials Hungary Zrt. no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; or

– the data subject has objected to processing pending the verification whether the legitimate grounds of thyssenkrupp Materials Hungary Zrt. override those of the data subject.

A data subject who has obtained restriction of processing shall be informed by thyssenkrupp Materials Hungary Zrt. before the restriction of processing is lifted.

5.4. Right to erasure (‘right to be forgotten’)

At the request of the data subject, thyssenkrupp Materials Hungary Zrt. shall erase the personal data concerning the data subject without undue delay where one of the following grounds applies: (i) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed by thyssenkrupp Materials Hungary Zrt; (ii) the data subject withdraws consent on which the processing is based, and where there is no other legal ground for the processing; (iii) the data subject objects to the processing on grounds relating to his or her particular situation and there are no legitimate grounds for the processing (iv) the data subject objects to the processing of personal data concerning him or her for direct marketing purposes, (v) the personal data are unlawfully processed by thyssenkrupp Materials Hungary Zrt; (vi) the personal data are collected in connection with the provision of information society services directly to a child. The data subject may not exercise the right to erasure or to be forgotten if the processing is necessary (i) for exercising the right to freedom of expression and information; (ii) for reasons of public interest in the area of public health; (iii) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in so far as the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing; or (iv) for the establishment, exercise or defence of legal claims.

5.5. Right to data portability

Data portability enables the data subject to obtain and further use the “own” data provided by him or her in the system of thyssenkrupp Materials Hungary Zrt. for his or her own purposes and through various service providers. In all cases, the right is limited to the data provided by the data subject, portability of other data (e.g. statistics, transaction data, etc.) is not possible. The data subject, with regard to the personal data concerning him or her, contained in the system of thyssenkrupp Materials Hungary Zrt, shall have the right to:

– receive them in a structured, commonly used and machine-readable format;

– transmit them to another controller;

– request the direct transmission of the data to another controller;

– if technically feasible within the system of thyssenkrupp Materials Hungary Zrt.

Thyssenkrupp Materials Hungary Zrt. will comply with requests for data portability only on the basis of a request sent by email or by post. In order to comply with the request, thyssenkrupp Materials Hungary Zrt. must ensure that the data subject who is entitled to exercise the right intends to do so. This requires the data subject to provide in his or her request the data that he or she has provided to thyssenkrupp Materials Hungary Zrt. on the Website or otherwise, in order to be able to identify the requesting data subject using the data in its system. Within the scope of this right, the data subject may at most request the portability of the data that he or she has voluntarily provided to thyssenkrupp Materials Hungary Zrt. Such data include name and email address. The exercise of this right does not automatically entail the deletion of the data from the systems of thyssenkrupp Materials Hungary Zrt.

5.6. Objection to the processing of personal data

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her, including profiling, and the data subject shall have the right to object at any time to the processing of personal data concerning him or her for direct marketing purposes, including profiling. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed by thyssenkrupp Materials Hungary Zrt. for such purposes. The data subject may object in writing (by email or post) or, in the case of a newsletter, by clicking on the unsubscribe link in the newsletter.

5.7. Exercise of the rights of the deceased data subject by others

Within five years of the death of the data subject, the rights of the deceased during his or her lifetime, such as the right of access, the right to rectification, erasure, restriction of processing, data portability and the right to object, may be exercised by the person authorised by the deceased by means of an instruction on administration or a declaration in a public or private document of full probative value made at thyssenKrupp Materials Hungary Zrt. If the deceased person has made more than one such declaration to thyssenKrupp Materials Hungary Zrt., the person named in the declaration made at a later date may exercise these rights.

If the deceased has not made such a declaration, the rights of the deceased during his or her lifetime and those set out in the previous paragraph may be exercised by the close relative of the data subject within five years of the death of the data subject (in the case of more than one close relative, the first to exercise the rights shall be the first to do so).

According to Section 8:1 (1) 1 of the Civil Code, a close relative is a spouse, a direct relative, an adopted child, a stepchild, a foster child, an adoptive parent, a step-parent, a foster parent and a brother or sister. The close relative of the deceased must provide proof of:

– the fact and date of the death of the deceased data subject by means of a death certificate or a court order, and

– his or her identity and, if necessary, his or her status as a close relative, by means of a public document. The person exercising the rights of the deceased shall have the rights and obligations of the deceased during his or her lifetime under the Privacy Act and the Regulation, in particular in proceedings against thyssenkrupp Materials Hungary Zrt. and before the Authority or the courts. Upon written request, thyssenkrupp Materials Hungary Zrt. shall inform the close relative of the action taken, unless the deceased has expressly prohibited this in his or her declaration.

5.8. Deadline for complying with the request

ThyssenKrupp Materials Hungary Zrt. shall inform the data subject of the actions taken without undue delay, and in any case within one month of receipt of any request pursuant to Sections 5.1 to 5.6. If necessary, taking into account the complexity of the request and the number of requests, this deadline may be extended by a further two months, but in this case thyssenkrupp Materials Hungary Zrt. will inform the data subject within one month of receipt of the request, stating the reasons for the delay. If the data subject has submitted the request electronically, the information will be provided by thyssenKrupp Materials Hungary Zrt. electronically, unless the data subject requests otherwise.

6. OPTIONS FOR EXERCISING RIGHTS

The data subject may exercise his or her rights by sending a request by email or post. No rights can be exercised by telephone.

The data subject may contact the Controller with any complaints, comments or requests for the exercise of rights at the following contact details:

Name: thyssenkrupp Materials Hungary Zrt.

Mailing address: 1158 Budapest, Fázis u. 6.

Email address: marketing.tkmh@thyssenkrupp.com

The data subject cannot exercise his or her rights if thyssenkrupp Materials Hungary Zrt. proves that it is not in a position to identify the data subject. If the request made by the data subject is manifestly unfounded or excessive (in particular in view of its repetitive nature), thyssenKrupp Materials Hungary Zrt. may charge a reasonable fee for complying with the request or refuse to take action. The burden of proof is on thyssenkrupp Materials Hungary Zrt. If thyssenkrupp Materials Hungary Zrt. has doubts about the identity of the natural person submitting the request, it may request additional information necessary to confirm the identity of the requestor.

Pursuant to the Privacy Act, the Regulation and the Civil Code (Act V of 2013), the data subject may lodge a complaint with the National Authority for Data Protection and Freedom of Information (1055 Budapest, Falk Miksa u. 9-11, 1055; www.naih.hu) or exercise his or her rights before the competent tribunal in order to have his or her individual case adjudicated as a matter of priority.

7. PERSONAL DATA BREACH HANDLING

Personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed. In order to monitor the measures taken in connection with personal data breaches, to notify the supervisory authority and to notify the data subjects, thyssenKrupp Materials Hungary Zrt. will keep records containing the scope of personal data affected by the breach, the number and scope of the data subjects, the date of the breach, the circumstances and effects of the breach and the measures taken to remedy the breach. If thyssenkrupp Materials Hungary Zrt. considers that a particular breach poses a high risk to the rights and freedoms of data subjects, it will notify the data subject and the supervisory authority of the data breach without undue delay, but within 72 hours at the latest.

9.    DATA SECURITY

Thyssenkrupp Materials Hungary Zrt. undertakes to ensure the security of the data, to take technical measures to ensure that the data collected, stored or processed are protected and to take all necessary measures to prevent their destruction, unauthorised use or unauthorised alteration. It also undertakes to require any third party to whom it may transmit or disclose the data to comply with its obligations in this regard.

The Controller shall ensure the security of the data, so the Controller shall take appropriate measures to protect the data against unauthorised access, alteration, transmission, disclosure, deletion or destruction, accidental destruction or accidental damage and against inaccessibility resulting from changes in the technology used.

When determining and applying measures to ensure the security of the data, the Controller shall take into account the state of the art and shall choose among several possible processing solutions the one which ensures a higher level of protection of personal data, unless this would involve a disproportionate effort.

Within the framework of its IT security responsibilities, the Controller shall ensure, in particular:

a. the denial of access by unauthorised persons to the tools used for the processing (hereinafter the “processing system”);

b. the prevention of unauthorised reading, copying, modification or removal of data media;

c. the prevention of the unauthorised input of personal data into the processing system and the unauthorised access to, modification or deletion of personal data stored in the processing system;

d. the prevention of the use of processing systems by unauthorised persons via data transmission equipment;

e. that persons authorised to use the processing system have access only to the personal data specified in the access authorisation;

f. that it is possible to verify and establish to which recipients personal data have been or may be transmitted or made available using data communication equipment;

g. that it is possible to subsequently verify and establish which personal data were entered into the processing system, by whom and at what time;

h. the prevention of unauthorised access to, copying, modification or deletion of personal data during transmission or transport of data media;

i. that the processing system can be restored in the event of a malfunction;

j. that the processing system is operational, that any errors in its operation are reported, and that the personal data stored cannot be altered by the faulty operation of the system.

10. MISCELLANEOUS

Thyssenkrupp Materials Hungary Zrt. reserves the right to unilaterally amend this Privacy Notice without prior notice to data subjects via its website at https://www.thyssenkrupp-materials.hu/. After the entry into force of the amendment, the data subject may withdraw his or her intention to participate in the Prize Draw, otherwise he or she will be deemed to have accepted the amended Privacy Notice.

This Privacy Notice is effective from 12.04.2024.

thyssenkrupp Materials Hungary Zrt.