This Privacy Notice (“Privacy Notice”) provides you with information regarding the processing of your personal data carried out by ONplusultra Kft. (registered seat: H-6000 Kecskemét, Klauzál Gábor tér 8. 3. em.; email: on@onplusultra.com; “Controller”, “We” or “Us”) via the onplusultra.com website (“Website”) and the ONplusultra iOS and Android applications (hereinafter together: “Application”) provided by Us.
Please be aware that no data protection officer is operating in relation to data processing carried out by Us.
When We process your Personal Data on the basis of our legitimate interest (see below under section II) You have the right to object to that processing (for further explanation, see section IV). If You wish to exercise this right, please contact Us at the email contact details specified above.
Definitions used in this Privacy Notice
In this section you can find the definitions for the purpose of this Privacy Notice.
“Personal Data” means any information relating to you through which We can identify you directly or indirectly; it means in particular your name, identification number, location data, online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of yours.
“Data Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
“You” means any user of the website or the application or any other identifiable natural person whose data is processed by Us.
“Service(s)” means all the services provided by Us on the Website or through the Application.
“Data Processor” means a natural or legal person, public authority, agency or other body which processes Personal Data on behalf of Us.
I. Data Processing Principles
We process your Personal Data in compliance with all the relevant laws, fairly and in a transparent manner.
We process your Personal Data only for specified and legitimate purposes as described in this Privacy Notice.
We do not process your Personal Data which is not adequate, relevant or necessary for the purposes set out in this Privacy Notice.
We do our best to keep your Personal Data accurate and up to date. We take every reasonable step to ensure that inaccurate Personal Data is erased or rectified without delay.
We keep your Personal Data in a form which enables Us to identify You for no longer than needed, for the purposes for which your Personal Data is processed.
We process your Personal Data in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage.
II. Why, and how are We processing your Personal Data?
In most cases, We are processing your Personal Data in order to provide You with our Services. However, other purposes may apply (e.g., to fulfill our statutory obligations). Please find detailed information on the purpose and other relevant circumstances of processing categorized by the purposes below.
We will always process your Personal Data in compliance with European standards on data protection. We provide an adequate level of protection to your Personal Data by E.U. standards, even in cases when We transfer your Personal Data outside the European Economic Area.
Please note, that in the event of any inquiries coming from state, administrative or investigative authorities, We may be obligated to provide these authorities with your Personal Data.
a. Registration
The purpose of processing your Personal Data: Registration on the Services.
The legal basis for the processing: Our legitimate interest in creating and managing your account and being able to provide Services as requested by You.
The categories of Personal Data concerned: Data provided by You, in the course of the registration and database ID generated by Us to store your data.
The period for which the Personal Data will be stored: This data will be deleted 30 days following the deletion of your profile.[2]
b. Using the Services
The purpose of processing your Personal Data: We process your Personal Data while You are using our Services. This data is necessary for providing our Services to You, enhancing our Services, payment purposes, as well as for information security purposes.
The legal basis for the processing: Our legitimate interest in creating and managing your accounts and being able to provide Services as requested by You, in improving existing features and developing new functions to remain competitive, being able to collect fees for our Services, providing secure Services and avoiding fraudulent use.
The categories of Personal Data concerned: Data provided by You, in the course of the registration, or while you are using Our Services, logged event data, data necessary for invoicing Our Services, and payment.
The period for which the Personal Data will be stored: This data will be deleted 5 years following the deletion of your profile.
c. Newsletters and direct marketing offerings
The purpose of processing your Personal Data: Informing You about ONplusultra news, and our best offers.
The legal basis for the processing: Your consent.
The categories of Personal Data concerned: Data provided by You when subscribing to the newsletters, marketing offerings.
The period for which the Personal Data will be stored: We will store the relevant Personal Data until You revoke your consent (e.g., You unsubscribe from our newsletter).
d. Customer support, and contacting us via e-mail
The purpose of processing your Personal Data: Provide more efficient and timely support to You when using our Services.
The legal basis for the processing: Our legitimate interest in helping You to fix bugs or unintended functioning in an efficient and timely manner, increasing your loyalty and retaining our customers.
The categories of Personal Data concerned: Data provided by You when reaching out to us.
The period for which the Personal Data will be stored: This data will be deleted 5 years following the day your profile is deleted. For messages sent by non-registered users, We may also store the messages for 5 years following their delivery.
e. Safety Button (GPS based safety function for runners)
The purposes of processing your Personal Data: Providing the functions relating to the safety button. The user can manually activate the Safety Button when running outside. If the runner unexpectedly stops the device will start emitting light and loud noise signals, and send a notification to a predetermined e-mail address or telephone number.
The legal basis for the processing: Our legitimate interest in being able to provide Services as requested by You.
Geo-location data will only be processed based on the consent of the data subject.
The categories of Personal Data concerned: Data necessary for the provision of services, geo-location data, contact information of third parties (addressees of the emergency notification[3] ).
The period for which the personal data will be stored: Data necessary for the provision of the Service will be deleted 5 years following the day your profile is deleted. Geo-location data will be deleted as soon as the Safety Button is turned off. [4]
F. Third Parties We Use
To be able to provide our Services to You and to run our business, We share Personal Data with recipients from the following categories: infrastructure as a service providers, IT developers, and IT maintenance professionals, platform as a service providers, application management providers, software development tools/environment providers, office management tool providers, collaborative office software providers, newsletter tool providers, messaging tool providers, support management tool providers, legal consultants, public authorities.
III. Transferring your Personal Data
Please note, that We are using Data Processors for business and related support services and these Data Processors receive your Personal Data for the purpose of providing Us with such services. Section II above describes the Data Processors We use.
We ensure that appropriate and suitable safeguards are in place when we transfer Personal Data to our business partners internationally, outside the EEA to countries that are not recognised by the European Commission as providing adequate protection[5] for personal data. In particular, We ensure that standard contractual clauses issued by the European Commission are in place with our business partners outside the EEA that receive Personal Data from Us.
IV. Your rights regarding the Data Processing carried out by Us
You have the following rights regarding Data Processing carried out by Us in relation to your Personal Data:
- right to access
You have the right to request from Us access to your Personal Data processed by Us and obtain information regarding the purpose of processing, what categories of Personal Data are processed, for or towards who We are transferring or disclosing your Personal Data, for what period We are processing your Personal Data, your rights in connection with Data Processing carried out by Us regarding your Personal Data, your right to lodge a complaint with a supervisory authority regarding the processing. Additionally, in the case We collect your Personal Data from other sources than from You, any available information as to the source, and the existence of automated decision-making and related information, including the logic involved, as well as the significance and the envisaged consequences of such processing for You, whether your Personal Data is transferred outside the EEA, and the conditions of these transfers.
We will provide You with a copy of your personal Data processed by Us in case You require Us to do so.
- right to rectification
You have the right to request Us to rectify your inaccurate Personal Data and to request Us to complete your incomplete Personal Data by means of providing Us with a supplementary statement.
- right to erasure
We erase any of your Personal Data if You request Us to do so in the event of the following:
- Your Personal Data is no longer necessary for the concerning purpose;
- You withdraw your consent and there is no other legal basis for the processing;
- You object to the processing and there are no overriding legitimate grounds for the processing;
- Your Personal Data has been processed unlawfully;
- Your Personal Data has to be erased according to relevant laws.
Please note that We are entitled to not erase your Personal Data if it is necessary – among others – for exercising the right of freedom of expression and information, compliance with legal obligation, establishment, exercise or defense of legal claims.
- right to restriction of processing
You have the right to obtain from Us restriction of processing where one of the following applies:
- You have contested the accuracy of your Personal Data, for a period enabling Us to verify the accuracy of your Personal Data;
- the processing is unlawful and You oppose the erasure of your Personal Data and request the restriction of their use instead;
- We need no longer your Personal Data for the purposes of the processing, but they are required by You for the establishment, exercise or defense of legal claims.
Where processing has been restricted, such Personal Data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State.
- right to object to processing
Where Personal Data is processed for direct marketing purposes, You have the right to object at any time to the processing of Personal Data concerning You for such marketing, which includes profiling to the extent that it is related to such direct marketing.
You also generally have the right to object to the processing of Personal Data where the legal basis of the processing activity is our legitimate interest, or the legitimate interest of a third party.
- right to data portability
You have the right to receive your Personal Data, which You have provided to Us, in a structured, commonly used and machine-readable format and have the right to transmit that data to another controller without hindrance from Us. You also have the right to have your Personal Data transmitted directly from Us to another controller, where technically feasible.
- right to withdraw your consent
You have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on your consent before its withdrawal.
We take actions requested in relation to exercising your above rights without undue delay and in any event within one month of receipt of your request. This period may be extended by two months where necessary, with a reasoned notification to You, taking into account the complexity and number of requests.
In the event when You make such a request by electronic means, We provide You with information by electronic means where possible, unless You request otherwise.
In case We do not take any action regarding your request, We will inform You as to the reasons within one month of receipt of your request. We will take necessary actions regarding exercising your rights in relation to the processing free of charge except when your request is manifestly unfounded or excessive.
In case We have reasonable doubts as to the identity of the natural person making the request, We may request additional information necessary to confirm the identity of such person.
V. Remedies
In case You do not agree with our response or action or if You consider that your rights have been infringed, You may lodge your complaint with the data protection supervisory authority in Hungary, or the EU Member State of your habitual residence, place of work or place of the alleged infringement, in particular, with the following supervisory authority:
Hungarian National Authority for Data Protection and Freedom of Information (address: HU-055 Budapest, Falk Miksa utca 9-11, mailing address: 1363 Budapest, Pf. 9.; tel.: +36-1-391-1400; e-mail: ugyfelszolgalat@naih.hu).
VI. Miscellaneous
Please note that We review this Privacy Notice on occasions and amend it as necessary. When We amend this Privacy Notice, We will announce and publish it by the usual means (e.g., via e-mail or on the Website). We encourage You to review this Privacy Notice regularly.