This data management notice relates to the event titled Vegan Summit Budapest, which will be organized by Empátia Sztori Nonprofit Kft. and held on November 7, 2026., http://vegansummit.hu/ It includes data management rules regarding ticket sales on the website, related website usage, and optional newsletter subscription, in accordance with the GDPR (Regulation (EU) 2016/679) and the relevant national laws.

1. Data Controller’s details:

Empatia Sztori Nonprofit Kft.

Company registration number: 03-09-135630
Address: 6100 Kiskunfélegyháza, Mártírok útja 1. D. lház. 1. em. 22. ajtó
Email: szerkesztoseg@prove.hu

2. The purpose of data processing:

• • Booking tickets, fulfilling orders

• • Contacting, confirmation, information dissemination

• • Billing, compliance with legal obligations

• • Sending a newsletter (with consent)

• • Ensuring the safe operation of website, preventing abuse

• • Statistical analysis, marketing communication (if provided)

3. Scope of processed data:

• • For ticket sales: the customer's full name, email address, phone number, billing address, company name (if applicable), and any other information related to the services ordered.

• • For newsletter: name, email address

• • Website visit: IP address, browser type, time of visit, viewed URL

4. The legal basis for data processing:

• • GDPR Article 6(1)(b): performance of a contract (ticket purchase)

• • GDPR Article 6(1)(c): fulfillment of a legal obligation (billing, VAT § 169)

• • GDPR Article 6(1)(a): consent (newsletter, marketing purposes, cookies)

5. Duration of data processing:

• • Ordering data: 2 years after the order 

• • Billing data: 9 years (Article 169 of the Accounting Act)

• • Newsletter: until the consent is withdrawn

• • Technical log data: 1 year

6. Data Processors:

6.1. In connection with the operation of the website

            Name: Hostinger
            Contact information: https://www.hostinger.in/customer-care

 

           Name: Antal Balázs ev. (Hexamind)

                Availability: hello@hexamind.hu

 

6.2. In connection with the sending of newsletters

            Name: MailerLite
            Contact information: https://www.mailerlite.com/support

6.3. In connection with social media platforms

            Our website also has several social media interfaces (for example Facebook, Linkedin, Instagram, You Tube); thus, if the User, for example, „likes” our page on Facebook or „follows” us on Instagram, we will be aware of all personal data related to their profile and accessible to the public. For information on data management on these sites, relevant information can be found in the respective service provider’s data management policy.

6.4. In connection with the issuance of an invoice

            Name: National Tax and Customs Office
            Website: https://www.nav.gov.hu/nav/kapcsolat

 

A http://vegansummit.hu/ During the fulfillment of the user’s purchases on the website, in order to fulfill the Empatia Sztori Nonprofit Kft’s account registration obligation, after the purchase the following billing information: company name, country, city, name of public space, house number, tax number will be transmitted to the Billingo online billing system operated by Billingo Technologies Zártkörűen Működő Részvénytársaság.

 

 

To Tickera LLC (16192 Coastal Highway, Lewes, Delaware 19958, County of Sussex, United States), operator of the ticketing system named Tickera. The participant’s first and last name, e-mail address will be submitted to Woodpecker.co sp. z.o.o., (29D Krakowska Street, Zip code: 50-424, Europe – Poland – Wrocław)

 

 

SimplePay Zrt. (1138 Budapest, Váci út 135-139.)

 

7. Data Security

7.1. Scope of persons entitled to access the data:

Our employees and the data processors are entitled to access the personal data of the Client to the extent necessary to perform the tasks assigned to their work. We take all necessary security, technical and organizational measures to guarantee the security of the data.

7.2. Organizational measures

Access to our IT systems is granted with a personal-related right. The „principle of necessary and sufficient rights” applies when allocating access; that is, our IT systems and services may be used by all employees only to the extent necessary for the performance of their duties, with corresponding rights and for the necessary duration. Only the person who is not restricted for security or other reasons (e.g., conflicts of interest) and possesses the professional, business, and information security knowledge necessary for its safe use may obtain access to our IT systems and services.

We and the data processors undertake strict confidentiality obligations in a written declaration and, in accordance with these confidentiality rules, are obliged to act in accordance with them in the course of our activities.

7.3. Technical measures

The data – with the exception of the data stored by our data processors – is stored on our own devices and in our data centers.

We protect our internal network with multilevel, firewall-based protection. The data is stored redundantly – that is, in multiple locations – to protect against destruction, loss, damage, and unlawful destruction due to failure of IT equipment.

We protect our internal networks from external attacks with multi-level, active, complex malware protection (e.g., virus protection).

We do everything we can to ensure that our IT tools and software continuously meet the technological solutions generally accepted in the market.

The NAIH provides information on the data protection requirements for data processing on the websites of the parties. recommendation taking into account the website https protocol We use it, which means a higher level of data security For http protocol Compared to.

8. Cookies

In order for our website to function properly, in some cases we place small data files on the User’s computer device, just as most modern websites do.

We provide information about the data management related to cookies in a separate privacy notice.

9. Other provisions

9.1 Data collection activity

We may collect data about the activity of Users that cannot be linked to any other data provided by the User during registration or when using other websites or services.

9.2. Data processing for different purposes

If we intend to use the provided data for a purpose other than the original purpose of data collection, we will inform the Users about this and obtain their prior, express consent, or provide them with the opportunity to prohibit the use.

9.3. Registration obligation

We keep a record of the data processing activities we carry out in accordance with our responsibility (record of data processing activity) in accordance with Article 30 of the GDPR.

9.4 Data protection incident

A data protection incident is a security breach that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access to processed personal data. In the event of a data protection incident, we are required to take action in accordance with Articles 33 and 34 of the GDPR. We record data protection incidents, detailing the facts surrounding the incident, its effects, and the measures taken to remedy it.

9.5. Amendment

We are entitled to modify this Notice unilaterally at any time.

Data Controller: Empátia Sztori Nonprofit Kft.

10. The relevant legislation

In developing the Information, the Data Controller took into account the relevant applicable legislation and the most important international recommendations, with particular regard to the following:

• • Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR);

• • Law V of 2013 on the Civil Code (Ptk.);

• • Act CXXX of 2016 on Civil Procedure (Pp);

• • the Accounting Act of 2000 C. (Számv. tv.);

• • the CLV Act of 1997 on consumer protection (Fgytv.);

• • Law No. 23 of 2001 on Certain Questions Relating to Electronic Commerce Services and Information Society-Related Services (Elkertv.)

11. Concepts related to the processing of personal data

• • Data controller: the legal entity that determines the purposes and means of processing personal data;

• • Data management: any operation or set of operations, whether automated or non-automated, performed on personal data or datasets, including collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

• • Data transfer: the disclosure of the data to a specific third party;

• • Data deletion: the data is rendered unrecognizable in such a way that its recovery is no longer possible;

• • Data annotation: the provision of the data with an identification mark for the purpose of distinguishing it;

• • Restriction of data processing: the indication of the personal data stored for the purpose of limiting their future processing;

• • Data destruction: the complete physical destruction of the data carrier containing the data;

• • Data processor: the legal entity that processes personal data on behalf of the data controller;

• • Addressee: the natural or legal person, public authority, agency or any other body to whom or which the personal data is disclosed, regardless of whether that third party is a third party;

• • cookie: a small data package (text file) sent by the web server and placed on the user's computer for a specified period of time; depending on the time of the user's visit, the server may also add it again at subsequent visits; that is, if the browser sends back a previously saved cookie, the cookie management service provider has the option of linking the user's current visit with previous ones, but only in respect of its own content;

• • concerned/user: an identified or identifiable natural person; an identifiable natural person is a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

• • third person: a natural or legal person, a public authority, an agency or any other body that is not the same as the data subject, the data controller, the data processor or the persons who, under the direct supervision of the data controller or the data processor, have been authorized to process personal data;

• • consent of the person concerned: the voluntary, specific and informed consent of the data subject, expressed by a clear declaration or an unequivocal act of confirmation, in which the data subject indicates that he or she agrees to the processing of personal data concerning him or her;

• • IP address: In all networks where communication is carried out using the TCP/IP protocol, server machines have an IP address, i.e., a unique identifier, which enables the identification of the machines on the network. It is well known that every computer connected to a network has an IP address through which it can be identified.

• • personal data: any information concerning the person concerned.;

• • protest: the affected person's statement objecting to the processing of their personal data and requesting the cessation of the processing or the deletion of the processed data.

12. Rights affected

12.1. Access

The User is entitled to, upon request submitted to one of our contact points, access the personal data we process about them. In this context, the User will be informed of the following:

• • whether the processing of your personal data is ongoing;

• • purposes of data processing;

• • the categories of personal data concerned;

• • the recipients or categories of recipients with whom the personal data have been or will be disclosed;

• • the planned duration of the storage of personal data;

• • rights;

• • legal remedies;

• • information regarding the data sources.

The User may also request the provision of a copy of their personal data subject to data processing. In this case, the personal data will be made available in a structured, widely used, computer-readable format (PDF/XML) or in a printed version on paper. Requesting a copy is free of charge.

12.2. Correction

The User – based on the request submitted through our contact details – is entitled to request the correction of inaccurate personal data concerning them that we process, and the addition of incomplete data. If we do not have the information necessary to correct or supplement information that is not in line with reality, we may request the submission of this additional information and verification of its accuracy. As long as the data cannot be corrected or supplemented – in the absence of additional information – we will restrict the processing of the personal data of the affected person, and the operations performed on it – with the exception of storage – will be temporarily suspended.

12.3. Right to information

Based on the request of the data subject, the Data Controller shall provide the data subject with the information listed in Articles 13 and 14 of the GDPR regarding the processing of personal data, as well as the information provided under Articles 15-22 and 34 in a concise, comprehensible form.

12.4. Cancellation

The User – based on the request submitted through our contact details – is entitled to request the deletion of the personal data concerning them that we process, provided that one of the following conditions is met:

• • we no longer need the data in question;

• • concerns arise regarding the legality of the processing of your data by us.

If, following a request from the User, we determine that there is an obligation to delete the personal data we process, we will cease processing the data and destroy the previously processed personal data. In addition, the obligation to delete personal data may also exist based on withdrawal of consent, exercise of the right to object, and legal obligations.

12.5. Restriction of data processing

The User – based on the request submitted through our contact details – is entitled to request the restriction of the processing of their personal data handled by us in the following cases:

• • concerns arise regarding the legality of the processing of personal data concerning him/her handled by us and requests restriction instead of the data being deleted;

• • we no longer need the data in question, but the User requires them to assert, exercise or defend legal claims.

We automatically restrict the processing of personal data in the event that the User disputes the accuracy of the personal data or exercises their right to object. In this case, the restriction applies for the period necessary to verify the accuracy of the personal data or, in the event of an objection, to determine whether there are grounds for continuing the processing.

During the restriction period, data processing operations may not be performed on the specified personal data; only the data can be stored. Personal data may only be processed in the case of restriction of data processing in the following cases:

• • based on the consent of the person concerned;

• • the presentation, enforcement or defense of legal claims;

• • the protection of the rights of other natural or legal persons;

• • It is an important public interest.

We will inform the Users in advance about the lifting of the restriction.

12.6 Right to withdraw

The data subject has the right to withdraw their consent to the Data Controller at any time in writing. In such a case, the Data Controller shall immediately and permanently delete all data that has been processed regarding the data subject and that is not required for the further storage in accordance with the law or for the enforcement or protection of legitimate interests. The legality of the processing carried out up to the withdrawal of the consent shall not be affected by the withdrawal of the consent.

12.7 Data portability

The User – based on the request submitted through our contact details – is entitled to request the provision of the personal data we process about them for their further use as determined by the User. In addition, the User may also request that their personal data be transmitted to another data controller designated by them.

This right is limited to the personal data provided by the User for the purpose of fulfilling the contract. There is no possibility of portability of other data. Personal data is made available to the User in a structured, widely used, machine-readable format (PDF/XML) or in printed form on paper.

We inform the User that exercising this right does not automatically result in the deletion of personal data from our systems. Furthermore, after the data has been transmitted, the User is also entitled to contact us again or to maintain contact with us.

12.8. Objection

The User – based on the request submitted through our contact details – may at any time object to the processing of their personal data for registration purposes. In this case, the Data Controller will examine whether the processing is justified by compelling legitimate reasons that take precedence over the interests, rights and freedoms of the User, or that relate to the submission, exercise or defense of legal claims. If we determine that such reasons exist, we will continue to process the personal data. Otherwise, the personal data will not be further processed.

12.9. Appeal

If, in the view of the affected party, the rights have been violated by the Data Controller and/or the data processors, the affected party is entitled to apply to the court with jurisdiction and competence according to the Pp. The court will rule on the matter out of order.

If the affected person wishes to file a complaint regarding data processing, they may do so with the National Data Protection and Freedom of Information Authority at the following addresses: headquarters: 1055 Budapest, Falk Miksa utca 9-11.; postal address: 1363 Budapest, Pf.: 9. Telephone: 06-1/391-1400; fax: 06-1/391-1410; e-mail address: ugyfelszolgalat@naih.hu; Website: www.naih.hu.

13. Transfer of personal data to a third country or an international organization

It does not materialize.

14. Automated decision-making, profiling

It does not materialize.

15. Data security measures

The data controller plans and implements data management operations in such a way that they ensure the protection of the privacy of data subjects during the application of the GDPR and other data protection laws. The data controller ensures the security of the data and takes the technical and organizational measures and develops the procedural rules necessary to enforce the GDPR and other data protection and confidentiality rules. It protects the data with measures proportional to the risk, in particular against unauthorized access, modification, transmission, disclosure, deletion or destruction, as well as against accidental destruction and damage, and against becoming inaccessible due to changes in the technology used. In this context, the Company stores the personal data of the data subject in a password-protected and/or encrypted database. The Company protects the data with firewalls and anti-virus programs within the risk-proportionate protection framework. It continuously monitors data protection incidents. The completed questionnaires are stored electronically on the controller's own server.