EURASIA LOGISTICS Kft.
CARoline Digital platform privacy notice
This notice has been prepared in accordance with the General Data Protection Regulation of the European Union, Act CXII of 2011 on Informational Self-Determination and Freedom of Information and other applicable legislation.
The notice addresses data processing related to the website https://live.digitalcaroline.hu operated by EURASIA LOGISTICS Korlátolt Felelősségű Társaság (registered office: 2500 Esztergom, Mátyás király utca 46.; company registration number: 11-09-022181) implemented in connection with the CARoline Digital interface ("Platform").
The Data Controller is the entity that determines the purposes and means of the use of personal data. The Data Subject is the individual whose personal data is processed by the controller.
Name of the Data Controller: EURASIA LOGISTICS Korlátolt Felelősségű Társaság ("Data Controller" or "We")
You can contact the Data Controller by:
• Phone number: +36 33 542 909
• e-mail address: dpo@eurasia.hu.
In all cases, our data is processed in accordance with the relevant legislation, according to the following principles:
• we process personal data legally, fairly and transparently. This means that we always provide you, as a Data Subject, with comprehensive information on why and how we process your personal data, as well as what rights you can exercise as a Data Subject in connection with the data processing. The processing we carry out always has a real, current and legitimate purpose. We never process personal data for non- or inadequately defined purposes, or for a purpose about which we have not informed you in advance.
• We do not process personal data that is not necessary for the purposes of the processing as set out in this notice.
• We process personal data for a limited period of time, at the end of which we permanently delete or anonymise it without the possibility of recovery.
• We do our best to ensure that your personal data is always accurate and up to date. We also ask for your cooperation in this, so if there are any changes to the personal data you have previously provided, please let us know. Please also let us know if you are no longer acting on behalf of one of our registered partners so that we can update our records accordingly.
• We will do our utmost to ensure the security of your personal data and to minimise the risks arising from unauthorised access, unauthorised disclosure or any other event. To this end, we use state-of-the-art IT systems that follow the principle of risk-proportionate protection, we only use partners with a trusted market reputation for the data processing, and we continuously ensure the data protection awareness and training of our staff.
• We respect your right to informational self-determination, which means that ultimately you as the Data Subject have the right to decide what happens to your personal data. Therefore, in the case of exercising any of the rights explained in this notice, we will individually examine your question or complaint and in each case provide a meaningful, detailed answer, and we also strive to ensure that the exercise of any data subject right can take place as smoothly as possible.
|
Personal data processed |
Purpose of Data Processing |
Legal Basis of Data Processing |
Retention period[2] |
|
Personal data provided during registration on the Platform: • the full name, e-mail address, telephone number, user status (master user, admin user, user) of the user registering the customer (Master user) and the user(s) added to the account, as well as the name of the customer registered by the user; • logging data (e.g. date of registration); • in the case of a sole trader, in addition to the above information, the tax number, registered office and billing details of the sole trader |
Enabling registration to the Platform and adding other user(s) to your account. Creating a user account. Ensuring password reset for the user account if necessary |
Legitimate interest in fulfilling the provisions of the General Terms and Conditions ("GTC") accepted during registration, if the data subject registers on behalf of an organization or is added as a user to an organization's account If the Data Subject registers as a sole trader, the fulfillment of the contract resulting from the acceptance of the GTC |
Until the deletion of the created user account or a change in the registered contact person |
|
Personal data processed in connection with the use of the Platform and orders placed on the Platform: • the full name, email address, phone number, user status of the user placing the order, and the name of the customer; • data related to the order placed (e.g. pick- up and drop-off location); • logged data relating to the user's activity on the Platform (e.g. the time of placing an order, the fact that he/she is the person placing the order, deleting or adding users, changes to his/her rights, etc.) |
Fulfillment of the contract created by accepting the GTC, maintaining contact during the fulfillment of the contract |
Legitimate interest in the performance of the terms of the GTC accepted at the time of registration, where the Data Subject is registering on behalf of an organisation. If the Data Subject registers as a sole trader, the fulfillment of the contract resulting from the acceptance of the GTC |
During the contract period, unless the user assigned to the customer is deleted before the customer is deleted |
|
Personal data required to send a fee request and invoice (full name of the |
Sending invoices and fee requests to the customer electronically, ensuring the |
The Data Controller's legitimate interest in sending invoices and requests for |
Until sending the invoice and fee request to the |
|
Personal data processed |
Purpose of Data Processing |
Legal Basis of Data Processing |
Retention period1 |
|
person concerned, e-mail address) |
fulfillment of obligations according to GTC |
payment and thus in fulfilling its obligations under the GTC, if the legal entity concerned is registered as a customer
Fulfillment of contractual obligations according to GTC, if the customer is classified as a sole trader |
customer. |
|
In the case of a sole trader customer, personal data required for issuing the invoice and request for fees: full name, e-mail address, registered office, tax number of the Data Subject. Where the Data Subject is acting on behalf of a particular organisation, the Data Controller shall, at the request of that organisation, also include the name of the Data Subject on the invoice issued by the Data Controller. |
Fulfilling the accounting obligations relating to the transaction and issuing and sending invoices to the recipient |
The legal obligation to issue an accounting document under Article 165 (1) of Act C of 2000 on Accounting |
Until the end of the retention period pursuant to Article 169 of Act C of 2000 on Accounting (8 years) |
|
The personal data content of certain documents uploaded to the Platform in connection with the fulfillment of the contract (e.g. name of the signatory, position) |
Fulfillment of the contract resulting from the acceptance of the GTC |
Legitimate interest in the fulfillment of the terms of the GTC accepted during registration If the Data Subject registers as a sole trader, the fulfillment of the contract resulting from the acceptance of the GTC |
During the term of the contract |
|
Data required to answer questions and comments and to investigate exclusions, as well as to exercise data subject rights according to the GDPR |
Answering questions and comments, properly investigating exclusions |
Legitimate interest in responding to questions, comments and properly investigating exclusions |
Until the communication with the Data Subject has been successfully completed |
|
Ensuring the exercise of data subject rights according to the GDPR |
To comply with the legal obligation under Article 12(2) of the GDPR, under which the controller must facilitate the exercise of data subject rights |
||
|
All personal data indicated above, based on the case-bycase consideration of the Data Controller, in justified cases |
To enforce the Data Controller's legal claims, to defend its legal position and, in this context, to substantiate its claims in the event of a dispute or official proceedings |
The Data Controller's legitimate interest in pursuing legal claims, defending its legal position and its legitimate interest in being able to substantiate its claims in a possible dispute or administrative procedure |
5 years from the end of the contract period or from the date of the reply to the complaint (civil limitation period) If the court or official procedure actually takes place, until the final conclusion of the procedure |
|
Personal data processed |
Purpose of Data Processing |
Legal Basis of Data Processing |
Retention period1 |
|
Any personal data identified above that may be linked to a specific order, where, in the Data Controller's sole discretion, it is indispensable to support the specific economic event to which it relates |
Supporting and verifying the economic transaction between the parties |
The legitimate interest of the Data Controller in supporting and subsequently verifying economic events |
The Data Controller will keep the personal data – out of the above-mentioned personal data - that are used to support and verify an economic event realized with a specific order - in accordance with Art. 169 of Act C of 2000 on accounting - for 8 years. |
Recipient means any entity other than the Data Controller to which the Data Controller transfers personal data processed by the Data Controller or which has access to such personal data. Some of the recipients are independent data controllers, which means that they are independently responsible for the processing of the personal data provided to them. Other recipients act as processors of the Data Controller, which means that they perform certain operations on the data on the basis of instructions from the Data Controller, within the framework of an agreement with the Data Controller.
Below you will find information about these recipients:
|
Name of addressee |
Recipient status |
Purpose of data transfer |
|
Car dealers, locations |
independent data controllers: |
Carrying out the logistical operations necessary for the performance of the service under the GTC (transport, freight forwarding) and communication relating thereto |
|
External carrier companies |
independent data controllers: |
Carrying out carrier activities in accordance with the General Terms and Conditions |
|
Auditor |
independent data controller |
Performing audit tasks |
|
Law Firms |
independent data controller |
Legal representation in justified cases |
|
Courts, authorities |
independent data controllers: |
Participation in administrative or judicial proceedings, compliance with a request for data from the relevant authority or court |
You have the following rights in relation to the processing of your personal data. You may exercise these rights at any time, free of charge, through our contact details indicated in clause 1 above.
The Data Controller can only deal with your request to exercise your rights if it can identify you on the basis of the request, therefore, we ask for your cooperation in this respect. This measure also serves to protect personal data. Please state your request briefly in your own words. Each request is investigated individually.
We will evaluate your request immediately and, if necessary, take the appropriate steps based on it. After that, within a maximum of 1 month from the receipt of your request, we will inform you in a detailed response about the measures taken or, if they were not taken, about the reasons for this. If necessary, taking into account the complexity of the request and the number of requests, this deadline may be extended by a further two months. In such a case, we will inform you of the extension, stating the reasons for the delay, within one month of receipt of the request.
You have the right to request information on whether and how we process your personal data, including the purposes of the processing, the recipients to whom we have disclosed your data or the source from which we obtained the data, the retention period, your rights in relation to the processing and, in the case of transfers to third countries or international organisations, information on the safeguards relating to the transfer. In exercising your right of access, you also have the right to request a copy of the data. If the right of access adversely affects the rights and freedoms of others, in particular the business secrets or intellectual property of others, we are entitled to refuse its fulfillment to the necessary and proportionate extent. In the event that you request more than one copy of the above information, we will charge you a reasonable fee proportionate to the administrative costs of producing the additional copies.
At your request (e.g. in the event of a data change), we will correct the personal data processed about you.
Where we have previously disclosed the personal data concerned by the rectification to another person (such as a recipient as a data processor), we will inform those recipients of the rectification without undue delay after the rectification, provided that this is not impossible or does not involve a disproportionate effort. We will also inform you about these recipients upon request.
Please notify us if you are no longer affiliated with the organisation you registered with when registering on the Platform! C) Right to erasure (“right to be forgotten”)
If you request the deletion of any or all of your personal data, we will delete or anonymise it without undue delay, provided that:
• we no longer need the given personal data for the purpose for which it was processed;
• it is data processing that was based on our legitimate interests, but you have objected to the processing and there are no overriding legitimate grounds for continuing the processing (the burden of proof in this regard is on us); we have unlawfully processed the personal data despite our best efforts, or
• the personal data must be erased for compliance with a legal obligation.
Where we have disclosed the personal data concerned by this right to another person (such as a recipiet as a data processor), we will inform that person of the fact of deletion without undue delay after the deletion, provided that this is not impossible or does not involve a disproportionate effort. We will also inform you about these recipients upon request.
Please note that we are not under any obligation to delete your personal data in all cases, especially e.g. in the event that data processing is necessary for the submission, enforcement and protection of legal claims.
Restriction of processing means that we do not perform any operations on the data concerned, except for storage, nor do we use them.
You may request restriction of the processing of your personal data in the following cases:
• if you dispute the accuracy of the personal data we process - in which case the restriction applies for the period of time that allows us to verify the accuracy of the personal data;
• the processing is unlawful, but you do not want the personal data concerned to be deleted and instead request restriction of processing;
• we no longer need the personal data for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims; or
• You have objected to the processing - in this case, the restriction applies for the period until it is determined whether our legitimate grounds override your right to object, in other words, whether the processing can continue despite your objection.
Where we have disclosed the personal data covered by this right to another person (i.e. a recipient, such as a data processor), we will inform that person of the fact of erasure without undue delay after the restriction, provided that this is not impossible or does not involve a disproportionate effort. We will also inform you about these recipients upon request.
Where the legal basis for processing is the legitimate interest of the Data Controller, you have the right to object to the processing. In this case, the burden of proof is on us and we have no obligation to uphold the objection if:
• the processing is justified by compelling legitimate grounds which override your right to object, or
• the data processing is related to the submission, enforcement or protection of our legal claims.
Otherwise, in the event of your objection, the data processing will be terminated immediately.
Where the legal basis for processing is the performance of a contract with you, you may request that we provide your personal data to you in a structured, machine-readable format (e.g. as an email attachment) or, where technically feasible, directly to another data controller designated by you. In the event that the exercise of the right to data portability would adversely affect the rights and freedoms of others, we are entitled to refuse to comply with your request to the extent necessary and justified.
We will do our utmost to ensure that there is never any cause for complaint.
If you nevertheless consider that the data processing carried out by us violates the data protection legislation in force at all times, in particular the provisions of the General Data Protection Regulation, you have the right to file a complaint with the National Data Protection and Information Freedom Authority ("NAIH"). Contact details of NAIH:
Website: http://naih.hu/
Address: 1055 Budapest, Falk Miksa utca 9-11.
Mailing address: 1363 Budapest, P.f.: 9.
Telephone: +36-1-391-1400
Fax: +36-1-391-1410
E-mail: ugyfelszolgalat@naih.hu
You also have the right to lodge a complaint with a supervisory authority established in another EU Member State, in particular the one where you have your habitual residence, place of work or where the alleged infringement took place.
Irrespective of your right to complain, you can also take legal action in the event of a breach of the above rights. In our case, the competent court is the Tatabánya Regional Court, but you can also bring the case before the court of your place of residence.
You also have the right to take legal action against a legally binding decision of the NAIH that applies to you. You can also go to court if the NAIH does not deal with your complaint or does not inform you within three months of the procedural developments or the outcome of your complaint.
6. Processing of sensitive data
In the course of its processing as set out in this Notice, the Data Controller does not process any data that falls within special categories of personal data, such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data, health data or data concerning sex life or sexual orientation.
7. Profiling, automated decision making
No profiling or automated decision making takes place in the course of the processing of data as described in this notice.
This means that we do not analyse your personal data in any way to draw any further conclusions, nor do we use artificial intelligence or other technology to make any decisions about you without human intervention.
Effective as of: October 1, 2024
[1] A megőrzési idő végén az Adatkezelő a személyes adatokat anonimizálja. Az anonimizálást követően az adatok visszafordíthatatlanul elveszítik személyes adat jellegüket és többé már nem kapcsolhatók az érintetthez, azok alapján az érintett többé nem azonosítható, rá vonatkozó következtetéseket levonni nem lehet.
[2] At the end of the retention period, the Data Controller shall anonymise the personal data. After anonymization, the data irreversibly loses its personal data character and can no longer be linked to the Data Subject, the Data Subject can no longer be identified on the basis of it, and no conclusions can be drawn about it.