Data Processing Notice

1. Purpose, scope, and governing legislation of the Data Processing Notice

The purpose of this notice is to set out the data protection and data processing principles applied by https://adeledan.com, as well as the organization’s data protection and data processing policy, which the organization, as data controller, recognizes as binding upon itself.
When drafting the provisions of the Policy, the organization took particular account of Regulation (EU) 2016/679 of the European Parliament and of the Council (the “General Data Protection Regulation” or ‘GDPR’), Act CXII of 2011 on the right to self-determination in relation to information and freedom of information (the ” Infotörvény) and Act V of 2013 on the Civil Code (“Ptk.”).

The scope of this Data Processing Notice extends to data processing related to the website available at https://adeledan.com (hereinafter: “Website”). The Data Processing Notice is valid until revoked. The purpose of the Data Processing Notice is to harmonize the provisions of the organization’s other internal regulations regarding data processing activities in order to protect the fundamental rights and freedoms of natural persons and to ensure the proper processing of personal data.

2. The data controller

Name: NighTales (legal name: Adél Dancsik, Pen name: Adéle Dan, Adèle Dan)
French business identification number (SIRET) : 937685592-00019
City: Orsay, France
Email: adele.dan.author@gmail.com
Data controller’s company registration number: 937685592-00019
Registered office: [Orsay, France]
Data protection officer: Adél Dancsik
The data controller is an organization registered in France.

3. Key terms and definitions

• GDPR (General Data Protection Regulation) is the new Data Protection Regulation of the European Union.
• Data controller: a natural or legal person, public authority, agency, or any other body that determines the purposes and means of processing personal data, either alone or jointly with others. Where the purposes and means of processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
• Processing: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
• data processor: a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller.
• personal data: any information relating to an identified or identifiable natural person (data subject); an identified natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• third party: a natural or legal person, public authority, agency or any other body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or the processor, are authorized to process personal data.
Consent of the data subject: any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
• Restriction of processing: marking stored personal data with the aim of limiting their processing in the future.
• Erasure: rendering data unrecognizable in such a way that their restoration is no longer possible.
• Data breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.
• enterprise: a natural or legal person engaged in economic activity, regardless of its legal form, including partnerships and associations engaged in regular economic activity;
• information society service: a service within the meaning of Article 1(1)(b) of Directive (EU) 2015/1535 of the European Parliament and of the Council (19);

4. Data processing principles

Personal data:
• must be processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”)
• shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; shall not be considered incompatible with the original purpose for further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) (“purpose limitation”)
• be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimization”)
• they must be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (“accuracy”)
• they must be stored in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, for scientific or historical research purposes or statistical purposes, having regard to the implementation of appropriate technical and organizational measures required in this Regulation in order to safeguard the rights and freedoms of the data subject (“storage limitation”)
• processing must be carried out in such a manner that appropriate technical or organizational measures are implemented to ensure appropriate security of personal data, including protection against unauthorized or unlawful processing, accidental loss, destruction or damage (“integrity and confidentiality”)
The data controller is responsible for compliance with the above and must be able to demonstrate such compliance (“accountability”).

5. Purpose of data processing

The Data Controller processes personal data for specific purposes only. Data is collected and processed fairly and lawfully. The Data Controller shall endeavor to process only personal data that is essential for the purpose of data processing and suitable for achieving that purpose. Personal data may only be processed to the extent and for the duration necessary to achieve the purpose.

6. Scope of data processed

CONTACT FORM, CONTACT FORM,
Purpose of data processing: establishing contact, maintaining contact, providing information, requesting information.
Legal basis for data processing: voluntary consent of the data subject, Article 6(1)(a) of the GDPR.
Scope of data processed: surname, first name, email address,
Deadline for data deletion: 2 years from the last contact
Data transfer: does not occur
The deletion or modification of personal data can be initiated in the following ways:
• by email: info@adeledan.com

NEWSLETTER
Purpose of data processing: marketing information
Legal basis for data processing: voluntary consent of the data subject, Article 6(1)(a) of the GDPR and Section 6(1) of the Advertising Act
Scope of data processed: name, email address,
Deadline for data deletion: until the data subject unsubscribes
Data transfer: to the newsletter mailing system
The deletion or modification of personal data can be initiated in the following ways:
• by email: via the unsubscribe link provided in the newsletter

7. Method of data processing

The Data Controller stores the data subject’s data on its own servers and temporarily on the Data Controller’s computers. Only the Data Controller has access to the personal data of data subjects.
The provision of data is always voluntary, i.e. the data subject is free to decide whether to provide the requested personal data. If the data subject consents, the Data Controller will process the data in accordance with the applicable laws and within the limits of the data subjects’ consent.
In order to prevent the unauthorized use of personal data and related abuses, the Data Controller applies extensive technical and operational security measures. We regularly review our security procedures and develop them in line with technological developments.

8. Technical data and cookie management

Information about cookies can be found at the following link: https://adeledan.com/cookie-policy-eu/

9. Data transfer

The Data Controller shall only transfer personal data to third parties if the data subject has given their explicit consent to this, with knowledge of the scope of the data transferred and the recipient of the data transfer, or if the data transfer is authorised by law. The Data Controller shall document all data transfers and keep a record of them.

10. Data processing

The Data Controller is entitled to use data processors to perform its activities. Data processors do not make independent decisions; they are only entitled to act in accordance with the contract concluded with the Data Controller and the instructions received. The Data Controller supervises the work of data processors. Data processors are only entitled to use additional data processors with the consent of the Data Controller.

Data processors used by the Data Controller:

DATA PROCESSING ACTIVITIES RELATED TO WEB HOSTING SERVICES
Name of the data processor:
Registered office of the data processor:
Tax number:
Telephone number of the data processor:
Email address of the data processor:

Processing of all personal data provided by the data subject on the website for the purpose of the proper operation of the website.
Duration of data processing, deadline for data deletion: Until the termination of the agreement between the Service Provider and the Hosting Provider, or until the data subject submits a request for deletion to the Hosting Provider.

Legal basis for data processing: the User’s consent, Section 5 (1) of the Infotv. Article 6(1)(a) of the GDPR, and Section 13/A(3) of Act CVIII of 2001 on certain issues relating to electronic commerce services and information society services.

GOOGLE ANALYTICS DATA PROCESSING ACTIVITIES RELATED TO AGGREGATED DATA ANALYSIS
Name of the data processor: Google, Mountain View, California, United States
Registered office of the data processor: Ireland, Dublin, Barrow Street 4
Email address of the data processor: –
Based on a contract concluded with the Data Controller, the Data Processor uses the Data Processor’s service called Google Analytics, which helps both the Data Controller and the Data Processor to obtain a more accurate picture of their visitors’ activities.

DATA PROCESSING ACTIVITIES RELATED TO THE OPERATION OF THE WEBSITE
Name of the data processor:
Registered office of the data processor:
Tax number of the data processor:
Telephone number of the data processor:
Email address of the data processor:
The Data Processor maintains the Website at certain intervals on the basis of a written contract concluded with the Data Controller and backs up its database for security reasons.

DATA PROCESSING ACTIVITIES RELATED TO THE SENDING OF NEWSLETTERS
Name of the data processor: Adél Dancsik (PEN name: Adéle Dan, Adèle Dan)
Registered office of the data processor: Orsay, France
Tax number of the data processor: 937685592-00019
Telephone number of the data processor:
Email address of the data processor: adele.dan.author@gmail.com

11. External service providers

The Data Controller uses external service providers in the operation of the Website, with whom the Data Controller cooperates.
With regard to personal data processed in the systems of external service providers, the provisions of the external service providers’ own data protection policies shall apply. The Data Controller shall do everything in its power to ensure that the external service provider processes the personal data transferred to it in accordance with the law and uses it exclusively for the purposes specified by the User or set out below in this notice.
The Data Controller shall inform Users about the transfer of data to external service providers in this Notice.

External service providers:
• Meta Ltd.
• Pinterest
• Google, Mountain View, California, United States (Google Analytics aggregated data analysis, Google Adwords online advertising, use of YouTube social interfaces, etc.)

12. Data security, access to data

The Data Controller shall ensure the security of the data, take the technical and organizational measures and establish the procedural rules necessary for the enforcement of the applicable laws, data protection and confidentiality rules. The Data Controller shall protect the data by appropriate measures against unauthorized access, alteration, transmission, disclosure, deletion or destruction, as well as against accidental destruction and damage, and against becoming inaccessible due to changes in the technology used.
The Data Controller shall keep records of the data it processes in accordance with the applicable legislation, ensuring that the data is only accessible to those employees and other persons acting in the interests of the Data Controller (data processors) who need it for the performance of their duties. The data may only be accessed within the employee’s organization with logging. The Data Controller’s employees shall only perform individual searches and individual operations on the data at the request of the User or if this is necessary for the provision of the service.

13. Duration of data processing

The Data Controller shall delete personal data if
• its processing is unlawful: If it becomes apparent that the data is being processed unlawfully, the Data Controller shall delete it without delay.
• the data subject requests it (except for data processing based on legislation): The data subject may request the deletion of data processed on the basis of their voluntary consent. In this case, the Data Controller shall delete the data.
• the data is incomplete or incorrect, and this situation cannot be remedied lawfully, provided that the deletion is not excluded by law.
• the purpose of data processing has ceased to exist or the statutory time limit for storing the data has expired. As the Data Controller provides continuous service to the data subject, the relationship between the parties is not subject to a time limit. Based on the above, in the absence of a request from the data subject, the Data Controller shall process the data for as long as the relationship between the Data Controller and the data subject exists and as long as the Data Controller can provide services to the data subject. The Data Controller shall delete all other data if it is clear that the data will not be used in the future, i.e. the purpose of data processing has ceased to exist.
• ordered by a court or the National Data Protection and Freedom of Information Authority: If a court or the National Data Protection and Freedom of Information Authority orders the deletion of the data with legal force, the Data Controller shall carry out the deletion. Instead of erasure, the Data Controller shall block the personal data, after informing the data subject, if the data subject so requests or if, based on the information available, it can be assumed that erasure would prejudice the legitimate interests of the data subject. Personal data blocked in this way may only be processed for as long as the purpose of the data processing that precluded the deletion of the personal data exists. The Data Controller shall mark the personal data it processes if the data subject disputes its correctness or accuracy, but the incorrectness or inaccuracy of the disputed personal data cannot be clearly established. In the case of data processing required by law, the provisions of the law shall govern the erasure of data. In the event of deletion, the Data Controller shall render the data unfit for identification. If required by law, the Data Controller shall destroy the data carrier containing the personal data.

14. Customer relations

• If the data subject has any questions or problems while using our services, they can contact the data controller using the methods provided on the website (telephone, email, social media, etc.).
• The data controller shall delete the e-mails received, the data provided on Facebook, Instagram, Messenger, Pinterest, etc., together with the name and e-mail address of the interested party and other personal data provided voluntarily, after a maximum of 2 years from the date of data disclosure.
• We will provide information about data processing not listed in this notice at the time of data collection.
• In the event of an exceptional request from an authority or a request from other bodies based on legal authorization, the Service Provider is obliged to provide information, disclose and transfer data, and make documents available.
• In such cases, the Service Provider shall only disclose to the requesting party – provided that the exact purpose and scope of the data has been specified – the personal data that is strictly necessary to achieve the purpose of the request.

15. Rights related to data processing

Right to request information: Any person may request information via the contact details provided about what data the organization processes, on what legal basis, for what data processing purposes, from what sources, and for how long. Upon request, the information must be sent to the contact details provided without delay, but within a maximum of 30 days.
Right to rectification: Any person may request the modification of any of their data through the contact details provided. Upon request, action must be taken immediately, but within a maximum of 30 days, and the information must be sent to the contact details provided.
Right to erasure: Any person may request the erasure of their data via the contact details provided. Upon request, this must be done immediately, but within a maximum of 30 days, and information must be sent to the contact details provided.
Data that we are required to store for legal, statutory, or contractual reasons for the preservation of commercial records will be blocked instead of deleted to prevent its use for other purposes.
Right to blocking: Any person may request the blocking of their data via the contact details provided. The blocking shall remain in effect for as long as the specified reason necessitates the storage of the data. Upon request, this must be done immediately, but within a maximum of 30 days, and information must be sent to the contact details provided.
Right to object: Any person may object to the processing of their data via the contact details provided. The objection must be examined within the shortest possible time after the request is submitted, but within 15 days at the latest, a decision must be made on its merits, and the decision must be sent to the contact details provided.

16. Possibility of enforcing rights related to data processing

National Authority for Data Protection and Freedom of Information
Postal address: 1363 Budapest, Pf.: 9.
Address: 1055 Budapest, Falk Miksa utca 9-11.
Phone: +36 (1) 391-1400
Fax: +36 (1) 391-1410
Email: ugyfelszolgalat@naih.hu
Website: https://naih.hu

Issues not specified in this notice
Issues not specified in this notice are governed by Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act CXII of 2011 on the right to self-determination and freedom of information (Infotv).