Rich Life - Privacy Policy

The following privacy policy (hereinafter: Policy) complies with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, hereinafter: "GDPR") and Act CXII of 2011 on informational self-determination and freedom of information (hereinafter: "Infotv."). It outlines the circumstances of personal data processing by Rich Group Ltd. (registered office: Reitter Ferenc utca 50, 1135 Budapest, company registration number: 01 09 333401, hereinafter: Company or Data Controller) during the operation of the richlife.ae website (hereinafter: Website) and the services provided through it.

The purpose of the Policy is to inform the data subjects of the personal data processing carried out through the Website, including both visitors browsing the Website and users availing themselves of the services provided by the Company on the Website, about the information falling within the scope of the GDPr's obligation to inform, including, among other things, the manner, purpose, legal basis, duration, scope of the processed data, any data transfers, the persons authorized to process or to have access to the data, as well as the data subjects' rights and remedies concerning the processing of personal data.

If any User feels that there are further questions, issues, or comments regarding the personal data processing processes realized through the Website, they are encouraged to contact us at info@richlife.ae.

After reading and understanding the Policy, Users decide whether to provide their personal data for using the Website. Data provision is voluntary, but Users are advised that in some cases, without providing the data, they will not be able to use the services requiring the provision of personal data or to use certain functions of the Website. These cases are indicated in the relevant service request form, in the separate information on the data processing concerned, or in this Policy.

Browsing the Website, making appropriate use of it, and availing oneself of the individual services is subject to the User's acceptance of the terms and conditions set out in this Policy. By visiting the Website, and in certain data processing cases, by using the services available on the Website, by applying for a classified ad on the Website, or by creating a user account, the User is required to familiarize themselves with this Policy and accept its provisions. If the User does not agree with any data processing operation according to the Policy, please do not use the Website or the contested service.

Name and Contact Details of the Data Controller and the Data Controller's Representative

For the purposes of personal data processing according to this Regulation, the Company qualifies as the data controller, whose essential details are as follows:

Company Name: Rich Group Ltd.

Registered Office: 1135 Budapest, Reitter Ferenc utca 50.

Company Registration Number: 01-09-333401

Legal Representative: Péter Weiler, CEO

Email: info@richlife.ae

Contact details of the Company's data protection officer: info@richlife.ae

List of data processors:

Company Name: KBOSS.hu Trading and Service Limited Liability Company (KBOSS.hu Ltd.)
Registered Office: 1031 Budapest, Záhony utca 7.

Company Registration Number: 01-09-303201

The Policy also applies when the User contacts the Data Controller or when the Data Controller contacts the User regarding the Services.

The Website contains links to websites operated by third parties and/or services provided by such third parties. In addition, when using the Services, it may happen that you provide your personal data to a third-party data controller. These data processing activities are subject to the privacy policies determined by the third party. In such cases, please read carefully both the relevant general terms and conditions and the privacy policy of the third-party data controller before ordering these services or providing your personal data to the third party. Given that all of these conditions, operations, and content are not under the control of the Company, the Company shall not be liable for them.

Definitions for Understanding the Information

Personal Data: any data or information that can directly or indirectly identify a natural person. Especially during the use of the Website, such data includes, besides natural person identifying data, photographs, gender, and age.

Data Subject: a natural person whose personal data is the subject of any data processing. The Company exclusively provides Services available on the Website to natural persons who have reached the age of 18, thus shaping its data processing processes accordingly. Considering that the consent of the legal representative is required for the statement of a child under the age of 16, the Company obtains the consent of the legal representative in all cases where such data processing addressed to such data subjects is carried out. For the purposes of the data processing described in this Information, the User of any service available on the Websites is considered a Data Subject.

Data Controller: the person who determines the purposes and means of processing personal data. In the course of providing the Services available on the Website, the data controller is the Company, but in certain processes, additional data controllers, apart from the Company, also carry out data processing activities. The Company qualifies as the data controller for all information and data processed regarding the User's visit, use of the Website, use of the Services available on the Website, information uploaded to the Website, and data collected by the Company during the User's activities on the Website.

Data Processor: a natural or legal person, or any other body that processes personal data on behalf of the data controller, performs data processing operations concerning personal data. The Company employs numerous data processors in its data processing processes, whose identity is indicated in relation to each data processing or reference is made to categories of data processors.

Data Processing: any operation or set of operations performed on personal data, whether automated or not, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction. Every process on the Website that involves the provision of personal data to the Company constitutes data processing.

Legal Basis for Data Processing: The Company typically processes personal data based on the conclusion or performance of a contract and for legal obligations applicable to the Company. Where expressly indicated at the time of data collection, the Company processes personal data based on the consent of the data subject. The Company provides information on the legal basis for each data processing. Data processing can only be carried out if there is an appropriate legal basis for it. In addition to those mentioned above, such legal basis may also include data processing based on the legitimate interests of the Company or when the processing is necessary to protect the vital interests of the data subject or another natural person.

Consent: permission given by the data subject to the data controller for the processing of their personal data for a specific purpose.

Purpose of Data Processing: the specifically defined purpose of processing personal data, such as the establishment or performance of a contract between the Company and the User.

Scope of Processed Data: the personal data processed is specified for each data processing by the Company.

Data Processing Period: the period during which the Company is entitled to process personal data, which is specified for each data processing by the Company.

Data Not Suitable for Identification: data recorded by the Company about Website users that is not suitable for directly or indirectly identifying a natural person.

Services: all services available on the Website or through the Applications for Users. This Information applies to the use of all available services related to classified ads and those associated with them, data processing related to subscribing to electronic direct marketing communications (newsletters, SMS messages), as well as personal data processing arising from the Company's participation in market research, competitions, or events related to the Services.

Consent: permission given by the data subject to the data controller for the processing of their personal data for a specific purpose.

Purpose of Data Processing: the specifically defined purpose of processing personal data, such as the establishment or performance of a contract between the Company and the User.

Scope of Processed Data: the personal data processed is specified for each data processing by the Company.

Data Processing Period: the period during which the Company is entitled to process personal data, which is specified for each data processing by the Company.

Data Not Suitable for Identification: data recorded by the Company about Website users that is not suitable for directly or indirectly identifying a natural person.

```html

Definitions for Interpreting Information

Personal Data: any data or information based on which a natural person can be identified, either directly or indirectly. During the use of the Website, this particularly includes natural person identifying data along with photographs, gender, and age.

Concerned Party: a natural person whose personal data is the subject of any data processing. The Company exclusively provides Services available on the Website to natural persons who have reached the age of 18, thus it has structured its data processing processes accordingly. Considering that the consent of a legal representative is required for the declaration of a person who has not reached the age of 16, in all cases where such data processing activities are addressed to such data subjects, the Company obtains the consent of the legal representative. For the purposes of the data processing described in this Information, the Concerned Party is any user of the services available on the Websites.

Data Controller: the person who determines the purposes and means of processing personal data. In the course of providing Services available on the Website, when personal data processing occurs, the data controller is the Company, but in certain processes, additional data controllers outside the Company also carry out data processing activities. The Company qualifies as a data controller for all information and manages all data provided by Users for the purpose of visiting the Website, using the Website, using the Services available on the Website, uploading to the Website, and collecting data during User's activities on the Website.

Data Processor: a natural or legal person, or any other body that processes personal data on behalf of the data controller, carrying out data processing operations concerning personal data. The Company employs numerous data processors for its data processing operations, whose identities are indicated in connection with individual data processing operations or referred to as categories of data processors.

Data Processing: any operation or set of operations performed on personal data, whether by automated means or not, such as collection, storage, recording, disclosure, transmission, or use of personal data. Every process on the Website that results in personal data being made available to the Company constitutes data processing.

Consent: permission given by the data subject to the data controller for the processing of their personal data for a specific purpose.

Purpose of Data Processing: the specifically defined purpose of processing personal data, such as the establishment or performance of a contract between the Company and the User.

Scope of Processed Data: the personal data processed is specified for each data processing by the Company.

Data Processing Period: the period during which the Company is entitled to process personal data, which is specified for each data processing by the Company.

Data Not Suitable for Identification: data recorded by the Company about Website users that is not suitable for directly or indirectly identifying a natural person.

Personal data collected by the Data Controller and individual data processing

Below is information on what personal data the Data Controller collects from Users, and in certain cases, what personal data it receives from other sources regarding Users:

Registration, use following Website registration
Name and email address are mandatory for registration and subsequent access to the Services.

Use of Services on the Website
When using services requiring invoice issuance: billing data (billing name and address)
When using services including delivery: pick-up location and time, delivery address and time, and all information provided to the courier in advance
Information about the Services used, transaction data (e.g., advertisements, activity, messages exchanged with Users)
Information about the device and time of using the Service (e.g., IP address, access date and time, mobile device identifier).

Use of electronic direct marketing services
Identification and contact details necessary for direct contact (including name, email address, and phone number)
Opening, clicking, and traceability of messages and digital communications sent by the Company.

Participation in promotions, competitions
Identification data of participating Users necessary for conducting promotions, competitions, personal data used for delivery of prizes and contact (usually name, delivery address, email address)
In the case of personal participation, a photograph may be taken with the individual's voluntary consent.

Contact, communication:
Personal data provided by the User during any contact, especially through the Company's provided telephone, email contacts, postal mail, or Facebook, as well as data necessary for identification.

Participation in public opinion and market research
Voluntarily provided personal data by the User regarding themselves or their family circumstances, lifestyle, personal data requested by the Company for research purposes
User feedback and comments.

Personal data received from other sources
Data related to payment transactions for the determination and accounting of completed payments to the extent necessary for payment settlements
For package deliveries, regarding the completion of deliveries
Data collected by third-party partners for improving marketing communication and advertising activities, measurement (see particularly: Information on cookie-related data processing)
Contact data provided by employers, such as real estate agent data.

3.1. User Account

3.1.1. Creation, maintenance, deletion of User Accounts

The purpose of processing the personal data provided during the creation of the user account (Registration) is to enable the use of Services, such as placing advertisements or accessing paid Services, operating and providing messaging system Services, exercising rights arising from resulting legal relationships, and fulfilling obligations.

During the creation of the user account, the email address provided by the User is used by the Company for authentication of user registration, thus for unique identification of the User, whereby the precondition for creating a user account is the valid operation of the email address provided during registration. For certain Services specified in the Terms of Use, authentication of the User's mobile phone number is required, i.e., sending the verification code provided by the Company to the Company's mobile phone.

Among the personal data to be provided during registration, the personal data marked with an asterisk on the form are mandatory personal data, the provision of which is a precondition for the conclusion of the contract, and failure to provide them prevents the creation of the user account. Identification of the User's email address is a precondition for creating the user account. While using the user account, a user name can be provided, but for using the classified advertisement Services, providing a user name and phone number is mandatory.

The legal basis for data processing is the creation and performance of the contract necessary for providing the Service.

The duration of data processing is aligned with the maintenance of the user account, i.e., until the user account is deleted.

Upon creation of the user account, the User can voluntarily assign additional profile data to their account beyond the mandatory data. Providing this data is not mandatory, and the User can modify or delete it according to their decision through personal settings accessed by logging into their account or request its deletion from the Company. Creating a personal profile: The User can supplement their profile data with a user name and profile picture, making their user profile personal, thus increasing trust within the user community. The legal basis for data processing is the consent of the User. The duration of data processing is until the User's deletion, or if missing, until the existence of the user account. Profile pictures are published on the Website and are visible in the User's public advertisement page.

Publicly disclosed contact information: Providing contact options is an available feature for the User; if they choose to make their phone number public or provide a public phone number in their personal settings. The purpose of data processing is to provide the opportunity for contacting the User outside the messaging system operated by the Company. The legal basis for data processing is the consent of the User. If a public phone number is provided, this data will be published on the Website and will be visible on the User's public advertisement page. The legal basis for data processing is the consent of the User. The duration of data processing is until the User's deletion, or if missing, until the existence of the user account. The provided data will not be made public.

Data related to the User's date of birth and gender can be used by the Company for segmenting personalized marketing messages for the User, if the User has previously allowed the sending of such messages to the Company. The legal basis for data processing is the consent of the User. The duration of data processing is until the User's deletion, or if missing, until the existence of the user account. These personal data are not public, and their provision is voluntary for creating and using the user account; the User can delete, modify, or request their deletion from the Company at any time.

Publicity of user profile data: The user name, registration date, and last login time will be published on the Website and among the profile data displayed next to the User's public advertisements. The legal basis for data processing is the Company's legitimate interest in the reliability of the Service and the legitimate interest of Users in obtaining information and assessing the reliability of other Users. Additionally, publishing the user name aids in identifying Users and contacting them. The duration of data processing is aligned with the maintenance of the user account, i.e., until the user account is deleted. If the User decides to make their phone number public, they accept that it will become public data on the Website, associated with the data mentioned in the previous paragraph.

3.1.2. Contracts with Business Organizations

According to the Terms of Use, business organizations as Users of the Services, who use the Services based on a separate agreement concluded in writing with the Company, provide the personal data of their contact persons, as well as the personal data of their employees acting on their behalf during the conclusion of the user contract. The Company processes these data for the establishment of legal relationships, exercising rights arising from them, fulfilling obligations, and maintaining contact with the User.

When concluding the contract, the personal data requested by the Company from the User, mostly contact data and data related to real estate agents, are prerequisites for concluding the contract. Failure to provide these data prevents the Company from concluding the contract.

The purpose of data processing is to establish the legal relationship, fulfill it, maintain contractual contact, and enforce related claims regarding the ordered Service.

The legal basis for data processing is the performance of the contract between the Company and the User regarding the Service, as well as the legitimate interest arising from it, i.e., the Company's and the contracted partner's legitimate interest in exercising and fulfilling their rights and obligations arising from the contract, including maintaining contact with the User.

The legal basis for processing data necessary for billing the Service fee is the fulfillment of legal obligations concerning the Company, namely the obligation according to Section 169 (2) of Act C of 2000 on Accounting to retain accounting documents and invoices for 8 years from the date of invoicing.

The duration of data processing is linked to the duration of the contract; however, in order to fulfill the legal obligation according to Section 169 (2) of Act C of 2000 on Accounting, the Company is obliged to retain accounting documents and invoices for 8 years from the date of invoicing.

The duration of data processing for contact data specified in individual contracts is 8 years from the termination of the contract. Personal data uploaded regarding Services used on the Website are subject to the data processing conditions specified in the Information provided.

3.1.3. Publication of Classified Advertisements

For registered Users on the Website, the prerequisite for uploading classified advertisements is providing the personal data mandatory as specified in the advertisement upload form (especially the name and phone number), among which, if the User has made it public, the User's phone contact will be published on the Website alongside the advertisement.

The legal basis for data processing is the establishment of a contractual relationship regarding the publication of advertisements, i.e., providing the User with a platform for publishing advertisements, preparing the service, providing the service, exercising rights arising from the legal relationship, and fulfilling obligations.

The duration of data processing is linked to the duration of the contract, i.e., until the classified advertisement is permanently deleted.

3.2. Marketing Data Processing

3.2.1. Newsletter

The Company sends electronic advertisements via email or SMS for the promotion of its Services available on the Website, its brand, and the services and products of its contracted partners to Users who have given their prior, express, and voluntary consent for this purpose.

The legal basis for data processing is the voluntary, prior, express consent of the data subject. Consent can be freely, without restriction or justification, withdrawn at any time via the customer service contact details (see point 3.3), and there is also an option to withdraw consent as indicated in the electronic advertisement. Accordingly, the duration of data processing lasts until the user withdraws their consent ("unsubscribe"), and if this does not occur, it lasts as long as the Company maintains the newsletter service.

The Company draws attention to the fact that communications sent by the Company related to the use of the Service, which include necessary information or technical instructions, or which contain essential information about the legal relationship, do not fall within the scope of communication according to this section.

Users can object to the processing of their personal data for direct marketing purposes at any time in writing or by email to info@richlife.ae via the Company's contact details provided in point 3.3. By clicking on the "Unsubscribe from the newsletter" button placed in newsletters/advertising emails sent by the Company via email, Users can express their objection, after which the Company will no longer send newsletters/advertising emails to the User.

3.2.2. Events

In order to promote the Company's Services and brand, the Company organizes various events for Users from time to time. The Company provides separate information about the data processing related to events, stating that the conditions set forth in this Policy apply to the exercise of the data subject's rights and to the unspecified terms of data processing in the event-specific information.

3.2.3. Prize Draws

In order to promote the Company's Services and brand, the Company organizes various prize draws for Users from time to time. The Company provides separate information about the data processing related to prize draws, stating that the conditions set forth in this Policy apply to the exercise of the data subject's rights and to the unspecified terms of data processing in the event-specific information.

3.3. Complaint Handling and Customer Service Data Processing

The Company's customer service accepts questions related to the Company's service and user inquiries at the following contact details, and in certain cases initiates communication with Users from the following contact details:
Email: info@richlife.ae

The Company processes the written details of complaints and inquiries submitted by Users based on the legal obligation of the Company in the case of persons qualifying as consumers under Act CLV of 1997 on Consumer Protection (hereinafter: Consumer Protection Act), based on the legal basis of contract performance for other Users, in certain cases based on the legitimate interest of the Company in ensuring the quality of its services, in accordance with the following data categories:

a) name and address of the complainant, as well as other data provided at the time of the complaint;
b) place, time, and method of submitting the complaint or inquiry;
c) detailed description of the complaint or inquiry;
d) other evidence presented by the User, including a list of these;
e) response letter sent to the User;
f) User's phone number.

The Company shall keep a record of user inquiries and, in the case of consumer complaints, data specified in Section 17/A (5) of the Consumer Protection Act (hereinafter: CPA), as well as a copy of the response, for a period of 2 years from the resolution of the matter, pursuant to Section 17/A (7) of the CPA.

The purpose of data processing related to complaints and disputed notifications made by Users is to resolve complaints, legal claims, disputes, investigate cases, and determine necessary actions.

3.4. Fraud Prevention, Detection, and Management

In order to monitor the activities of Users in using the Services, the Company may identify Users who, based on their activities, are reasonably suspected of abusing or using the Services in a manner contrary to the Terms of Use of the Websites. If the Company identifies such activity, it may revoke User's rights to use the Website Services and, upon detecting illegality, take necessary steps to investigate the matter.

The Company informs the User of any restrictions or prohibitions imposed on them regarding the Services. The Company also informs the User that they have the right to object to data processing. In the event of objection by the User, the Company shall immediately restrict the processing of the User's personal data for the period until it is determined whether the legitimate interests of the data controller Company prevail over the legitimate interests of the User.

The legal basis for data processing is the legitimate interest of the Company, the Users of the Website, and other third parties to filter out and prevent illegal and bad-faith activities on the Website and to ensure that all Users use the Website in accordance with the Terms of Use. The duration of data processing is the duration of user activity on the Website. This activity by the Company concerns the personal data processing defined in points 3.1 – 3.5, for which the underlying legal basis for this data processing is as per this point.

3.5. Fraud Detection and Claims Processing

For the purpose of asserting claims against Users, protecting and enforcing the legitimate interests of the Company or third parties, detecting and preventing fraud and other criminal activities, the Company shall store and retain the data specified in points 3.1, 3.1.2., 3.1.3., 3.2., 3.3., 3.4., and 3.5 for a period of 24 months from the termination of the legal relationship based on the primary legal basis, particularly storing and preserving advertisements in a restricted database designed for this purpose. Access to the database is limited to employees or agents of the Company authorized to participate in enforcement actions.

The legal basis for data processing is the enforcement of the legitimate interests of the Company and other Users of the Website as described above.

The Company uses personal data specified in points 3.4. and 3.5. only in cases where its processing becomes necessary due to a complaint, notification, or infringement by the advertiser or third party, authority, in order to assert claims resulting from an advertisement placed on the Website or a Service used, so that the occurrence of the infringement, injury can be determined, the possible responsible party identified, and the injury remedied. Such cases include, for example, when a User complains to the Company about an advertisement, claiming that it violates the User's rights (e.g., copyright) or legitimate interests. This also includes situations where at the initiative of a User, official, police, or other proceedings are initiated due to an infringement related to an advertisement (e.g., misleading advertisement). In these cases, the Company processes data available concerning the User involved or related to the advertisement in order to uncover potential infringements. Without such data processing, uncovering and addressing such infringements would be disproportionately difficult and would violate the legitimate interest of Users to use the Services safely with minimal risk of infringement. It would particularly result in disproportionate harm, worse than the harm from processing personal data, if potentially illegally acting (e.g., fraudulent) advertisers could avoid accountability by simply having their data deleted by the Company.

```html

3.6. Authority Data Provision

The Company complies with requests for the release of personal data, which are lawful and duly communicated, by providing the requested personal data to the requester, regarding data processing related to the Services or data processing carried out through the Website.

The Company discloses all personal data to the competent authority or court that initiates the request for data release in criminal proceedings, which complies with legal provisions creating a legal obligation for the Company to transfer the specified personal data.

The legal basis for data processing is the fulfillment of legal obligations applicable to the Company and ensuring the legitimate interests of the Company or a third party, justifying the validity of the official data provision by the Company in legal proceedings, and ensuring the Company's participation in the proceedings.

3.7. User Activity

The Company utilizes data on User activity on the Website, including browsing behavior and Service usage data, for the development and measurement of the success of its Services. The legal basis for data processing is the legitimate interest of the Company to understand the demand and interests of its customer base regarding the Services, thus enabling the Company to develop its products and Services accordingly and receive feedback on the success of its business activities.

User Notices

4.1. Under 16

The Company provides services available on the Website exclusively to natural persons who have reached the age of 16 and possess full legal capacity.

If any data processing activity of the Company involves personal data of minors under the age of 16, the Company obtains the prior and voluntary consent of the legal representative of the minor for data processing.

4.2. Other Persons Providing Data

The use of the Website is only possible by providing one's own, real, and accurate personal data. The User is solely responsible for any damage and claim resulting from providing non-own, unreal, or inaccurate personal data during the use of the Services.

4.3. Advertisements

The Company stores advertisements uploaded by Users to the Website. Thus, if a User provides personal data in an advertisement, they acknowledge that the Company processes such data during the term of the relevant advertising contract for the purpose of compiling statistics, operating its database, monitoring and ensuring the quality of the Website, and tracking user activities and habits.

The legal basis for data processing is the legitimate interest of the Company in operating, developing, and monitoring the database and Services it operates. The duration of data processing related to storing classified ads corresponds to the duration of the relevant classified advertising contract.

4.4. Accuracy

If there is any modification or change in the User's data managed by the Company during the data processing period (except for data processing related to fraud prevention and verification or data processing required by law for retention obligations imposed on the Company), the User is obliged to immediately notify the Company of the change via the contact details specified in section 3.3., ensuring that the data managed by the Company about them is accurate and up-to-date at all times.

4.5. Scope of Authorized Personnel

Only those employees of the Company who are directly supervised by the Company and for whom accessing such data is necessary for the performance of their job duties have access to the personal data provided by the User, and they handle the data in accordance with the Company's internal rules and procedures at all times.

```html

4.6. Publicly Disclosed Personal Data

This Notice covers data processing activities concerning all personal data provided by Users to the Company during the use of the Website or collected by the Company about the User during this process. If a User voluntarily discloses any personal data, such disclosures are not covered by this Notice.

Data Transfers

In cases and for purposes specified in this Notice, the Company may transmit User's personal data to predetermined third parties to ensure the provision and performance of the Services and, upon prior notice to the User, may transfer personal data to data processors based on a contract for this purpose.

When processing data related to the provision of Services, the Company discloses or transfers personal data to the following recipients:

5.1. Intra-group Data Processing

The Company may transfer personal data to members of its Corporate Group (meaning Dating Central Europe Closed Joint Stock Company (Registered Office: 7623 Pécs, Szabadság utca 34.) and companies directly or indirectly controlled by it, affiliated companies) to serve the legitimate interests of the Group in business development, with the consent of the data subject if applicable. The Company concludes contracts ensuring the protection of personal data with the recipients belonging to the Corporate Group, where these recipients undertake to implement organizational and technical measures for data security and – even if the recipient is not a member of the EEA – apply the guarantees provided by European data protection law.

The Company may transfer personal data to data processors belonging to the Corporate Group based on a mandate for the provision of technical services related to the provision of Services.

5.2. Data Processor for Invoicing

Whenever the Company issues an electronic invoice for its chargeable services in compliance with the accounting and tax regulations applicable to it, it engages an electronic invoice issuing service provider. Currently, for Services purchased directly on the website using the OTP Simple service, the Company uses the data processing services of Számlázz.hu.

5.3. Provider of Payment Systems Available on the Website

Whenever the payment for the Services provided by the Company is made available online, it is carried out through payment services provided by third parties. The terms and conditions set forth in the data processing notices of the third-party service providers apply to these services.

```html

Rights of Data Subjects

The Company is committed to facilitating the exercise of data subject's rights. To this end, it has established and operates a secure online system that allows Users to easily and quickly access certain information and functions related to the exercise of their rights.

The Company provides Users with mandatory information and necessary responses related to the exercise of their rights in a concise, transparent, and understandable form.

The Company informs data subjects of the measures taken in response to their requests without undue delay, but in any case within one month from the receipt of the request by the Company. If necessary, taking into account the complexity and number of requests, this period may be extended by a further two months, and in such cases, the Company informs the data subject within one month of receipt of the request, indicating the reasons for the delay.

The Company provides information electronically for requests submitted electronically, unless the data subject requests otherwise.

If the Company does not take action on the data subject's request, it informs the data subject without undue delay, but no later than one month from the receipt of the request, of the reasons for not taking action and of the possibility of lodging a complaint and seeking judicial remedy.

6.1. Right to Information/Access

Users may request information from the Company via the contact details provided in section 3.3, by letter or email, to ascertain whether the Company is processing their personal data.

If such processing is underway, Users are entitled to request information from the Company regarding the following aspects of the data processing:

a) the purposes of the data processing; b) the categories of personal data concerned; c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, including recipients in third countries or international organizations; d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; e) the data subject's rights to request from the Company access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to such processing; f) the right to lodge a complaint with a supervisory authority; g) where the personal data are not collected from the data subject, any available information as to their source; h) the existence of automated decision-making, including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.

Users are entitled to receive access to their personal data, whereby the Company sends the requested personal data to the User in writing or by email.

```html

6.2. Right to Rectification

Users may request the Company via the contact details provided in section 3.3, by letter or email, to promptly modify any of their personal data, or request the completion of incomplete personal data. For example, users may change their username or any other registered personal data at any time.

6.3. Right to Erasure/Right to be Forgotten

Users can easily and conveniently request the Company to delete their user accounts without delay through the website created and operated by the Company.

In addition, if the legal conditions are met, Users are entitled to request the Company to delete their personal data if one of the following reasons applies:

a) the personal data are no longer necessary for the purposes for which they were processed by the Company;

b) the User withdraws consent on which the processing is based, and there is no other legal ground for the processing;

c) the User objects to the processing, and there are no overriding legitimate grounds for the processing;

d) the personal data have been unlawfully processed;

e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the Company is subject;

f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1) of the Regulation.

The Company provides the opportunity to exercise the data subject's rights via the contact details provided in section 3.3, in writing or by email.

If the Company has disclosed the User's personal data to third-party recipients in accordance with this Policy, the Company informs those recipients/data processors about the User's request for erasure of copies of the User's personal data.

6.4. Right to Restriction of Processing

Users may request the Company via the contact details provided in section 3.3, in writing or by email, to restrict the processing if one of the following applies:

a) the User contests the accuracy of the personal data, in which case the restriction shall apply for a period enabling the Company to verify the accuracy of the personal data;

b) the processing is unlawful, and the User opposes the erasure of the personal data and requests the restriction of their use instead;

```html

c) the Company no longer needs the personal data for the purposes of the processing, but the User requires them for the establishment, exercise, or defense of legal claims; or

d) the User has objected to processing pending the verification whether the legitimate grounds of the Company override those of the data subject.

During the restriction of processing, such personal data, except for storage, shall only be processed with the User's consent, or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest.

The restriction shall remain in effect until the User's specified grounds require the storage of the data.

6.5. Right to Data Portability

Users may request the Company via the contact details provided in section 3.3, by letter or email, to receive their personal data concerning them, which they have provided to the Company, in a structured, commonly used, and machine-readable format and have the right to transmit those data to another controller without hindrance from the Company to which the personal data have been provided, where the processing is based on consent or on a contract, and the processing is carried out by automated means.

In exercising their right to data portability, the User has the right to have the personal data transmitted directly from one controller to another, where technically feasible.

6.6. Right to Object

Users may object at any time, via the contact details provided in section 3.3, by letter or email, to the processing of their personal data based on the legitimate interests of the Company or a third party. In this case, the Company shall not further process the personal data unless the Company demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the User or for the establishment, exercise, or defense of legal claims.

6.7. Remedies and Enforcement

If a User experiences unlawful data processing, it is advisable to send the complaint to the Company at the contact details specified in section 3.3, in writing, before initiating legal proceedings, as this allows the Company the opportunity to restore lawful conditions by itself.

By submitting a complaint (report) to the supervisory authority, the User may initiate an investigation on the grounds that their personal data processing has caused a breach or immediate threat thereof to their rights. The name and contact details of the supervisory authority are as follows:

National Authority for Data Protection and Freedom of Information

Address: 1125 Budapest, Szilágyi Erzsébet fasor 22/c

Mailing address: 1530 Budapest, Pf.: 5.

Email: ugyfelszolgalat@naih.hu

Phone: +36 (1) 391-1400

Fax: +36 (1) 391-1410

Website: www.naih.hu

If a User experiences unlawful data processing, they may initiate civil proceedings before a court. The jurisdiction of the court shall be determined by the user's choice. The list and contact details of the courts can be found at the following link:
http://birosag.hu/torvenyszekek.

Detailed legal provisions on remedies and the obligations of data controllers are provided in the Information Act (Infotv.) and the GDPR.

Data Security Measures

The Company ensures the security of the User's data by applying technical and organizational measures appropriate to the level of risk, protecting against unauthorized or unlawful processing, accidental loss, destruction, or damage, including ensuring the confidentiality, integrity, availability, and resilience of the IT systems and tools used for processing personal data.

For example, the Company uses IT tools, particularly firewalls, encryption, and physical security tools in its systems, and provides physical protection for all locations where the data can be accessed.

Measures ensuring integrity:
We use an encrypted https protocol during the operation of the Website. We store our data in a professional data center.

Measures ensuring availability and resilience:
We store our systems in physically separated, protected data centers.

We store user data in geo-redundant databases.

Review and Modification of the Notice

The circumstances of data processing may change from time to time, and the Company may at any time decide to supplement its ongoing data processing with a new data processing purpose, therefore the Company reserves the right to modify this Notice at any time. The Company will provide information about the changes on the Website.

Data Protection Officer: Zoltán Dupánovics

Rich Group Ltd. – 1135 Budapest, Reitter Ferenc Street 50.

Contact: e-mail: adatvedelem@dace.hu

All Personal Data That Can Be Provided on the Website

During registration: name, e-mail, phone number (in the case of a company: company name, tax number, headquarters)

When purchasing a package: company name, tax number, headquarters if requesting an invoice with VAT

All data listed in point 9 are mandatory to provide.