Privacy policy for the processing of personal data

EvoCask considers it a fundamental obligation to fully ensure the right to the protection of personal data in the course of its operations, – and therefore we will use all means at our disposal and in all possible ways to process your data in full compliance with the EU Regulation 2016/679 (“General Data Protection Regulation“) and other applicable laws. Given that one of the main purposes of the underlying legislation is to ensure transparency, we intend to inform you in this document about the collection, use, transfer and, last but not least, protection of your personal data – in particular, when you interact with us through our products and/or services via our website or other mobile applications.

We reserve the right to update and amend this Privacy Policy from time to time to ensure that the terms and conditions set out herein always reflect the current way in which we process personal data and that they comply in full with applicable legal obligations. In the event that any of the provisions of this Privacy Policy should change as described above, we will post an amended version of this Privacy Policy on our website and therefore please check this Privacy Policy from time to time for the most up-to-date content.

Who are we and how can you contact us?

EvoCask Hungary is a company incorporated under the laws of Evocask Ltd. ) (hereinafter collectively referred to as “Evocask” or “we”). Please note that our companies are joint controllers for the purposes of processing your personal data under the applicable data protection legislation.

Your views are important to us and we are happy to share any information that we may have about the processing of your data. Therefore, if you have any questions, we encourage you to contact the EvoCask Data Protection Officer at for information.

What categories of personal data do we process?

Generally, we collect your personal data directly from you, so when we collect it you have control over the type of information you share with us. For example, we may receive the following information from you:

• When creating your EvoCask account, you provide us with your email address, first and last name;
• In addition, on your personal page in the EvoCask interface (My Account) you can provide additional information such as: nickname, mobile phone number, landline phone number, date of birth, highest level of education, shipping address, secondary email address, credit card details, etc.;
• When you place an order, you provide us with information about yourself, the product you wish to purchase, your shipping address, billing information, payment method selected, phone number, etc.

You have the option to register for the EvoCask interface via your Facebook or Google account. If you choose any of the above options, the selected link will redirect you to the Facebook Admin / Google LLC page where the respective service provider will inform you about how they (Evocask) process the data they transfer to us. You can read the privacy policies of Facebook and Google respectively by clicking on the following links:

https://www.facebook.com/about/privacy

https://policies.google.com/privacy

If you choose to use the “My Preferences” service, you will provide us with information such as: name, preferred gender, preferred number/size, preferred brand.

In order to make your online experience more personalized and our offers more tailored to your preferences, we may also collect and process certain information about your browsing and user behavior during your visits to our website and when using our smartphone application. Please read the section below on the purposes of the processing for more information on the conditions under which this is done.

We may store and collect data on our website and smartphone application that we process through cookies and similar technologies in accordance with the relevant Cookie Policy.

We do not collect or process in any way sensitive data that qualify as special categories under the General Data Protection Regulation. In line with this, we also do not collect or process data of minors under the age of 16 at the time of providing the data.

What is the purpose and legal basis of the processing?

We may use your personal data for the following purposes:

1. To provide the EvoCask services to you

This general purpose includes the following uses, where applicable:

• To create and manage your user account on the EvoCask interface;
• Creating and creating an EvoCask account, creating and managing your EvoCask account, and processing orders, including receiving, reviewing, shipping and billing orders;
• Canceling orders or any other matters related to the order of goods or services purchased;
• Handling returned goods in accordance with the relevant legal provisions;
• Refund of goods in accordance with the applicable legal provisions;
• Providing support services, including answering questions you may have with us about products and services advertised by EvoCask or in relation to a particular order.

The processing of your data for the above purposes is in most cases necessary for the conclusion and performance of the contract between Evocask and you. In addition, the processing of certain data in this context is required by law, including the laws on taxation and accounting.

Use of the “My Preferences” service.

2. To improve our services

We are working to ensure that we always provide you with the best possible service and online shopping experience. To do this, we need to collect and use information about your shopping habits, among other things, by conducting market research directly or with external partners and by asking you to complete a satisfaction survey after an order.

These activities are carried out on the basis of our legitimate business interests, but we will always ensure that your fundamental rights and freedoms are not infringed in the course of such activities.

3. For marketing activities

We would like to keep you informed of our current offers and latest news about products of interest to you. To this end, we will send you general and thematic newsletters at regular intervals through our electronic channels (e-mail / SMS / mobile notifications / banners, pop-up messages / etc.) and inform you about products similar to or complementary to those you have previously purchased or ordered. We would also like to display other commercial enquiries and personalised offers via our website or mobile app. In order to provide you with information that may be of interest to you, we may use certain information about your shopping habits (e.g. products viewed / products added to wish lists / products purchased) for user profiling purposes. In all cases, we will ensure that such processing and treatment is carried out with the utmost respect for your rights and freedoms and we will ensure that the processes and measures used in the processing do not have any adverse legal consequences for you, nor do they restrict or affect your rights in any particular way.

In most cases, our marketing communications will be carried out with your prior consent, which you can give by ticking the box that says “I want to be notified of the best offers!”. You can change your mind and withdraw your consent at any time by following the instructions below:

• by changing your account settings in the “My Account/Notifications and Newsletters” menu;
• by clicking the “I wish to unsubscribe” link in the bottom section of the messages you receive from us; or
• by contacting EvoCask using the contact details set out above.

We use certain of our marketing activities to promote and improve our commercial operations for our legitimate business interests. However, in all cases where we use information related to you for our legitimate business interests, we will do so with the utmost care and diligence and with the utmost guarantee that your fundamental rights and freedoms are not violated. However, you can ask us to stop processing your personal data for marketing purposes at any time by using any of the methods described above, and we will endeavour to respond to your request as soon as possible.

4. To protect our legitimate business interests

Situations may arise where the exercise of our rights and business interests and the protection of our commercial activities may require us to disclose certain information. Such situations may include, but are not limited to, the following:

• protection and other precautions against cyber-attacks that may compromise the security of the website and users of the Evocask platform;
• measures to prevent and detect possible fraud attempts, including the transmission of relevant information to the competent authorities and public authorities;
• measures to address any additional risks.

Our authorization for the types of processing and handling described above is based on our legitimate business interest to protect our own commercial activities, while at the same time ensuring that the measures we take or envisage to take take into account the principles of balance and proportionality between our own interests and your fundamental rights and freedoms.

In addition, in certain cases, we will carry out processing and treatment subject to our legal obligations, in particular to safeguard the principles and values required by applicable law in the context of the transaction in question.

For how long do we keep your personal data?

As a general rule, your personal data will be stored for as long as you have an Evocask account. However, you can request us to delete certain data or to terminate your user account at any time, and we will respond to your request without exception, while ensuring that certain data comply with legal retention requirements, even after the termination of your user account.

If you do not have an Evocask account, as a general rule, we are obliged to retain all information relating to your order for a period of 3 [three] years from the date of the order. As described above, we may be required to store certain data beyond the three-year period in accordance with applicable legal retention requirements.

Who do we transfer your personal data to?

In some cases, we may transfer your personal data to parties in the following categories of sharing or give them access to certain of your personal data:

• Our partners who provide market research services;
• our marketing / telemarketing service customers;
• our financial/banking service partners;
• our courier and express delivery suppliers;
• companies belonging to the same group as Evocask;

To comply with our legal obligations and to protect our legitimate economic interests, we disclose certain personal data to public authorities.

We fully guarantee that any private entity identified as a third party may access your data only in full compliance with the legal provisions on data protection, information security and confidentiality, and only to the extent contractually agreed with such entity.

To which countries do we transfer your personal data?

As a general rule, we store and process your personal data within the European Union and the European Economic Area (EEA).

In the event that we transfer your personal data outside the European Union or the EEA, the transfer will be based on (a) a decision by the European Commission that the third country concerned provides an adequate level of protection, (b) binding corporate rules or (c) standard contractual clauses adopted by the European Commission. In addition, if it is determined that any of these measures is not sufficient to ensure an adequate level of protection, additional technical and/or organisational security measures will be adopted on a case-by-case basis in accordance with the recommendations of the European Commission.

You can contact us at any time using the contact details provided above to find out more about the countries to which we transfer your data and the safeguards that apply to those transfers.

How do we protect the security of your personal data?

We are committed to ensuring the security of your personal data by taking technical and organisational measures that meet industry standards.

We keep your personal data on secure servers using state-of-the-art encryption algorithms and storage expansion mechanisms.

Please note that, despite our best efforts to protect your personal data, the security of information transmitted over the World Wide Web in general and other public networks can never be guaranteed and such data may be intercepted and used by unauthorised third parties. We are not responsible for the vulnerability or susceptibility of systems outside our control.

What rights do you have?

The General Data Protection Regulation gives you a number of rights in relation to personal data. You can request access to your data, request the rectification of data that is incorrectly recorded in our records, or object to the processing of your personal data. You also have the right to lodge a complaint or objection with the competent supervisory authority or to bring an action before the competent court. Depending on the circumstances, you have the right to request the erasure of your personal data, the restriction of processing or the blocking of your data, and the portability of your data.

For more information on these rights, please see the table below.

To exercise your rights, you can contact us using the contact details above. Please read the following points carefully if you wish to exercise your rights:

Identification. We respect the confidentiality of all records containing personal information, so please send us your request for such records from the email address associated with your Evocask account. If you use a different email address, we reserve the right to verify your identity through an additional set of questions in an identification process.

Fees. We will not charge you a fee for exercising your rights to your personal information unless your request for disclosure or access is unfounded, unnecessarily repetitive, disproportionate or excessive, in which case we will provide the information or access for a reasonable fee. In any event, we will notify you of any request for a fee in advance of processing the request.

Deadline for response. We will respond to all valid requests within a maximum of one month, unless the request is particularly complex or you have sent several requests at the same time, in which case we will respond to you within a maximum of three months. If we need more than one month to process your request, we will always let you know. In this context, we may ask you to provide more information about what data or documents you need and what, if any, concerns you have about them, in order to respond to your request as accurately as possible. This will enable us to help you more quickly and shorten the time it takes to respond.

Third party rights. We are under no obligation to respond to your request if complying with the request would violate the rights or freedoms of another data subject or third party.

Right of access

You may ask us to:

– Confirm that we are processing your personal data;

– Provide you with a copy of the personal data that is the subject of the processing;

– provide you with further information about your personal data, in particular about what data we hold, the purposes of the processing, with whom we share this data and whether we transfer this data abroad, how we protect this data, how long we store this data, what rights you have in relation to this data, how and in what form you can lodge a complaint and, finally, where we obtained your data from, if we have not provided you with this information before the notification under this point.

Right to rectification

You may ask us to correct or complete inaccurate or incomplete personal data about you.

We may verify the truthfulness or accuracy of the data concerned before correcting the erroneous data.

Right to erasure or oblivion

You may request the deletion of your personal data, but only if,

– where the data concerned is no longer necessary for the purposes for which it was collected; or,

– if you have withdrawn your consent (where processing is based solely on consent); or,

– where you exercise your right to object; or,

– where the personal data concerned have been unlawfully processed; or,

– where the erasure of the data concerned is required by law.

We are not obliged to comply with your request to delete your personal data if the processing of your personal data is necessary and justified for the following reasons:

– to comply with an obligation under EU or Member State law; or

– to assert, exercise or defend legal claims.

In addition to the above, there may be other circumstances in which we are not obliged to comply with your request to erase your personal data, but in particular, we may refuse your request in the cases listed above.

Please note that before exercising your right to erasure under this section, you are advised to download from your EvoCask account and save all documents (meaning in particular: invoices, warranty letters) related to orders from EvoCask, whether the billing party named in the order was you or another person or entity. If you fail to take the above action before exercising your right of deletion, these documents will be lost and EvoCask will not be able to replace them for you after the data deletion procedure and the termination of your EvoCask account, including the deletion of all its data and documents, is a non-reversible, definitive process.

Right to restriction of processing (blocking right)

You may request that we restrict the processing of your personal data (i.e. block your data), but only if one of the following conditions is met:

– if you contest the accuracy of the personal data for the time necessary to verify this; or,

– where the processing is unlawful and you object to the erasure of the data; or,

– where the data concerned are no longer necessary for the purposes for which they were collected but their erasure is precluded by the establishment, exercise or defence of legal claims; or,

– if you have exercised your right to object and our examination of the lawfulness of our procedure is still pending.

We may continue to use your personal data in the event of the exercise of the right of blocking, provided that:

– we have obtained your consent to do so; or,

– if the use (existence) of the data concerned is necessary to enforce a right or legitimate interest before a court; or

– where the use (existence) of the data concerned is necessary to protect the rights of another natural or legal person.

Ensuring data portability (right to data portability)

You may ask us to provide your personal data in a structured, commonly used, machine-readable format, and you have the right to have that data transferred to another controller if

– the processing is carried out solely with your consent and is based on a contractual authorisation set out in an agreement you have entered into; and

– the processing is carried out by automated means.

Right to object

You have the right to object to the processing of your personal data at any time on grounds relating to your particular situation, if you consider that your fundamental rights and freedoms override our commercial interests.

You can also object at any time, without giving reasons, to the processing of your personal data for direct marketing purposes (including user profiling), where it is related to direct marketing, in which case we will stop the processing as soon as possible.

Implementation of automated processes

As a data subject, you may request that we exempt you from the scope of decisions made solely by automated processes, but only in the case that,

– if a decision taken in such a process would have legal effects on you; or

– if you would be similarly significantly affected.

The right under this clause shall not apply if the decision is the result of automated decision-making:

– necessary for the conclusion or performance of a contract with you; or,

– if it is permitted under Union or Member State law which also lays down appropriate measures to protect your rights and freedoms and legitimate interests; or

– if it is based on your explicit consent.

Right to complain

You have the right to complain to the competent supervisory authority about the processing of your personal data. The main supervisory authority for all companies within the EvoCask Group under the applicable legislation is located in Hungary and can be contacted as follows:

Contact details of the data protection supervisory authority in Hungary:

 

Name: National Authority for Data Protection and Freedom of Information.

Headquarters.

Address for correspondence.

Telephone: +36-1-391-1400

Fax: +36-1-391-1410

Website: www.naih.hu

E-mail:

 

Without prejudice to your legal right to lodge a complaint with the supervisory authority, please contact us first and we guarantee that we will do our best to resolve your complaint amicably.

You can contact us by e-mail at the following address:

– By post or courier to the following address:

 

Evocask Ltd.

Evocask is located at 1, Rákóczi u., 7621 Pécs (CENTROPHONE Office Building), Hungary.

 

Please write on the letter that you want it to be delivered to the Data Protection Officer.

Again, please note that you can contact the EvoCask Data Protection Officer at any time by sending a request to any of the notification addresses provided.