The controller
This notice has been prepared on the basis of Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, GDPR) and Act CXII of 2011 on the right to informational self-determination and on freedom of information (Infotv.).
The controller:
- Company name
- XXL SalesHouse Kft.
- Registered office
- 6000 Kecskemét, Máriahegy 173.
- Company registration number
- 03-09-130219
- Registry court
- Kecskeméti Törvényszék Cégbíróság
- Tax number
- 22981231-2-03
- EU VAT number
- HU22981231
- Representative
- Takács Krisztián
- Phone
- +36 70 588 5353
- Website
- os.xxlsales.hu
For data protection matters and to exercise your rights, please write to us at info@xxlsaleshouse.com. We are not required to designate a data protection officer.
What data do we process, for what purpose and for how long?
We only ask for data that is strictly necessary for the given purpose. The table below sets out the details for each processing activity.
| Processing activity | Data processed | Legal basis | Retention |
|---|---|---|---|
| Displaying the website and ensuring its security | IP address, time of the request, address of the page opened, browser type (server log) | Legitimate interest – the secure operation of the service and the prevention of misuse [Article 6(1)(f) GDPR] | no more than 30 days |
| Trying the demo (“Try it”) | name, email address, a hash of the chosen password, time of consent, IP address, browser type, time and number of the confirmation, logins and role selections, status and end date of access | Your consent [Article 6(1)(a) GDPR] | until consent is withdrawn, for no more than 2 years |
| Quote requests and communication | name, email address, phone number, company name (if provided), language of the quote, answers given and features selected in the wizard, message, IP address, browser type | Steps taken at your request prior to entering into a contract [Article 6(1)(b) GDPR] and your consent to being contacted [Article 6(1)(a) GDPR] | for 2 years from the quote request; if a contract is concluded, in accordance with the legislation applicable to the contract and to accounting |
| Use and protection of the test environment | activity log: time of the pages opened and operations performed, size and number of uploads, and at login the IP address and browser type | Legitimate interest – the secure operation of the test environment free from misuse, and improving the service [Article 6(1)(f) GDPR] | the data and files of the test environment are deleted after 30 days; the activity log is kept together with the tester’s data for no more than 2 years |
| Website statistics | page opened, time, language, domain of the referring page, campaign tag, device type, browser and operating system; the visitor is identified by a daily-changing, irreversible hash – no IP address or cookie is stored | Legitimate interest – improving the website [Article 6(1)(f) GDPR] | no more than 400 days |
| Bot filtering | a check value computed by the browser when the form is submitted and the time taken to fill it in; for filtered submissions the reason, the domain of the email address, an irreversible hash of the IP address and the browser type | Legitimate interest – preventing misuse and fake registrations [Article 6(1)(f) GDPR] | no more than 1 year |
| Cookies and browser storage | see the cookie policy | Storage strictly necessary for providing the service [Directive 2002/58/EC Article 5(3)] | see the cookie policy |
The data entered in the test environment (messages, orders, uploads) is not your data but fictitious demonstration data; please do not enter any real personal data there. Should you nevertheless do so, it will be permanently deleted together with the test environment at the end of the trial.
Who may access your data?
Your data may be accessed by the operator’s authorised staff, exclusively for the purposes set out above. As processor, the hosting provider named in the legal notice stores the data of the website and the demo, and emails are delivered by the website’s own mail server.
We do not sell your data, do not transfer it to third parties for marketing purposes and do not transfer it outside the European Economic Area. The website uses no external analytics, advertising or social media tracking tools – it measures visits on its own server, without cookies – and it also loads fonts from its own server, so no external provider is informed of your visit.
Upon request by an authority or court, in cases prescribed by law, we may disclose the data to the competent body.
Your rights
In relation to data processing, you have the following rights:
- Access: you may request information on whether we process data about you and, if so, which data, for what purpose and for how long [Article 15 GDPR].
- Rectification: you may request the correction of inaccurate data and the completion of incomplete data [Article 16].
- Erasure (“right to be forgotten”): you may request the erasure of your data if it is no longer needed or if you have withdrawn your consent [Article 17].
- Restriction: you may request that your data – for example, for the duration of a dispute – only be stored but not used [Article 18].
- Data portability: you may request that the data you have provided be transmitted in a machine-readable format to you or to another controller [Article 20].
- Objection: you may object at any time to processing based on legitimate interest [Article 21].
- Withdrawal of consent: you may withdraw your consent at any time without giving reasons; this does not affect the lawfulness of processing prior to the withdrawal [Article 7(3)].
You may send your request to info@xxlsaleshouse.com. We will respond to your request without undue delay and in any event within one month; where justified, this period may be extended by a further two months, of which we will inform you. As a general rule, the response is free of charge.
We do not carry out automated decision-making or profiling.
Remedies
If you feel that we have infringed your data protection rights, please contact us first – we will endeavour to remedy the problem promptly. You may also lodge a complaint with the supervisory authority:
- Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
- Registered office: 1055 Budapest, Falk Miksa utca 9–11.
- Postal address: 1363 Budapest, Pf. 9.
- Phone: +36 (1) 391-1400 · Email: ugyfelszolgalat@naih.hu · Website: www.naih.hu
In the event of an infringement of your rights, you may also turn to the courts; at your choice, you may also bring proceedings before the regional court (törvényszék) competent for your place of residence or place of stay.
Data security
We receive data over an encrypted connection (HTTPS) and store it on access-protected servers. The access link token and the password are stored only as hashes, cookies are encrypted or signed, every tester works in a separate database, and the demo and quote request forms operate with protection against misuse (rate limiting, bot filtering).
We do not knowingly process the data of persons under the age of 16; the website is intended for businesses.
Amendments to this notice
We may amend this notice in the event of changes to legislation or to our data processing. The version in force at any given time can be read on this page; in the event of a material change, we will inform you again when you open the website.