PRIVACY NOTICE AND POLICY ON THE HANDLING AND PROTECTION OF PERSONAL DATA

SPICE media production Korlátolt Felelősségű Társaság (seat: 1036 Budapest, Perc utca 8, hereinafter referred to as: Company) places great emphasis on compliance with the prevailing rules of data protection The Company does not collect any personal data directly through its website http://spicemediaproduction.com/ and it does not use any cookies. The Company respects and adheres to applicable statutory provisions, including especially Regulation EU 2016/679 of the European Parliament and of the Council (27 April 2016) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”).

Scope of this Policy

This notice and policy (“Policy”) applies to the personal information provided by data subjects within the scope of contacting the Company, or those collected through offline collection in connection with sales, marketing, partner and supplier engagement, together with those that come from third-party sources, including especially personal data received from model agencies who are in a contractual relationship with the Company. This Privacy Policy does not apply to the personal data of candidates applying for a job with the Company – the processing of personal data provided to the Company for such purposes is governed by “PRIVACY NOTICE AND POLICY ON THE HANDLING AND PROTECTION OF CANDIDATE DATA“ that is also available on the Company’s website.

The Company may unilaterally amend the Policy anytime.

Legal Bases

The Company handles personal data based primarily on the following legal bases:

Preparation for and performance of a contract: This legal basis is relevant for example in case of processing model data in order to plan and carry out a photo shoot or in case of correspondence with suppliers.

Compliance with a legal obligation: Data processing required by EU or national law, i.e. compulsory data processing based on a law or other statutory provisions. This is the basis of data processing carried out for example in case of correspondence with the tax authority.

Legitimate interest: This covers data processing activities required for the purposes of the Company’s or a third party’s legitimate interest. Data processing based on legitimate interest is always subject to a so-called “Balance of Interests” test, which assesses whether the Company’s legitimate interest is proportionate to the restriction of the data subject’s right to the protection of his/her personal data, privacy and how equilibrium between the interests of the Company and the interests of the data subject can be achieved.

Consent: The personal data of data subjects is often handled by the Company based on their consent. Any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action (for example by actively contacting the Company), signifies agreement to the processing of personal data relating to him or her shall qualify as consent. The data subject provides his/her consent freely at all times and is thus entitled to revoke it at will. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Purpose of Handling Personal Data

The Company declares that it handles the personal data of data subjects primarily for the following purposes:

1. business related purposes, including research and development in relation to the Company’s services; concluding and performing contracts with customers, suppliers and other business partners, especially organizing and conducting photo shoots with the support of model agencies and other partners; administering and paying for services, products and materials to and from the Company; managing contacts and marketing activities, together with the development, execution and analysis of market surveys and marketing strategies;
2. company management, including financial management, asset management, the management of the Company’s organization, preparing management reports and analyses, conducting internal audits and investigations
3. workplace health and safety, including the protection of any individual’s life and health, occupational health and safety at the workplace;
4. legal and regulatory compliance, including any administrative, declaration and reporting obligations, and any litigation or out of court administrative procedure.

Scope of Data Handled by the Company

Personal data handled by the Company are primarily the following:

1. contact data (for example name, telephone number, fax number, e-mail and postal address)
2. data pertaining to the owners and representatives of companies (suppliers, partners, etc.), - including especially public data available from the company registry;
3. data required to set up an online user profile (for example user name, password, security question and answer);
4. demographic and CV data (for example date of birth, age, sex, position/profession);
5. data pertaining to the appearance and clothing size of models (for example height, clothing size, eye color, tattoos);
6. any other personal data included in materials provided to the Company (for example the contents of an e-mail sent to contact the Company or portfolio photos of models).

Extent, limits and general principles of data handling

Personal data is handled by the Company to the extent and for the duration necessary to achieve the above defined purposes. Only personal data essential for the given purpose and suitable to achieve such purpose shall be handled.

Data Security

The Company processes your personal data in a confidential manner, in compliance with relevant statutory provisions and takes steps to ensure data security. The Company enforces the technical and organizational measures and implements the processes required to prevent the destruction, unauthorized use or unauthorized alteration of personal data. The Company obligates every third party to whom it may transfer or provide personal data in accordance with relevant statutory provisions to also ensure the adoption of such data security measures.

Recipients of Personal Data

Within the scope of data transfer – excluding data transfer based on statutory provisions – the Company shall only transfer personal data to recipients seated within the European Union or who can guarantee an adequate level of protection for data handled as required by the GDPR.

Data Processors

To assist its business activity, the Company may use the services of third parties, which services may include the processing of personal data. Such third parties (“Data Processors”) shall process data in accordance with the Company’s instructions and prevailing statutory provisions. Only the personal data required for the fulfillment of the given purpose shall be transferred to the given Data Processor.

You may request further information about the entities acting as data processors at the e-mail address website@spicemediaproduction.com

Third Parties

Company may – especially in order to ensure performance of obligations stipulated by law - be entitled and obliged to transfer personal data to given third parties for certain purposes including specifically courts, authorities, the police, public prosecutors, local municipalities, or state security services.

Rights of Data Subjects

The Privacy Act and the GDPR defines your rights regarding the handling and transfer of your personal data by the Company.

Data subjects may request access to personal data pertaining to them, may request their rectification, erasure, the restriction of processing and they may object to data processing. Data subjects are further entitled to data portability and remedies.

Right of Access

Data subjects are entitled to access their personal data and the following information:

• purposes of data handling;
• categories of personal data concerned;
• categories of recipients to whom their personal data have been or will be disclosed, including especially recipients outside the EU;
• in case of recipients outside the EU, the data subjects are entitled to request confirmation that any data transfer is subject to adequate guarantees;
• the envisaged storage period or the criteria used to determine such period;
• rights of the data subject;
• the right to lodge a complaint with a supervisory authority;
• where personal data was not collected directly from the data subject, any available information as to their source;
• information pertaining to automated decision-making including profiling carried out in relation to the data subject’s personal data.

In case the data subject submitted his/her request electronically, the information shall also be provided in a commonly used electronic form, unless otherwise requested.

Before complying with a request, the Company may ask the data subject to further specify his/her request regarding the information and data handling activities it pertains to.

In case the data subject’s right of access may adversely affect the rights and freedoms of others, especially regarding trade secrets, intellectual property or personal data, the Company is entitled to refuse compliance with the request as necessary and proportionate.

In case the data subject requests the above information in multiple copies, the Company may charge a reasonable fee based on administrative costs for such additional copies.

Rectification of Personal Data

Data subjects may request the rectification of incorrect or incomplete data. The Company may, if applicable, require data subjects to properly verify any data rectified – especially by means of presenting a relevant document. The Company shall comply with such rectifications requests without undue delay.

Upon rectifying the data subject’s data, Company shall – if possible - promptly also inform any person to whom Company previously transferred the data subject’s data subject to rectification, unless informing such party would involve disproportionate effort. Company shall inform the data subject of such recipients upon request.

Objection Against the Handling of Personal Data

Data subjects are entitled to object any time against the processing of their personal data on grounds relating to their particular situation in case of:

• processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Company; or
• processing necessary for the purposes of the legitimate interests pursued by the Company or by a third party;
• including profiling based on the above provisions.

In such cases, Company shall no longer process such personal data, i.e. such data must be erased, unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

The data subject is entitled to request the Company to restrict the processing of his/her personal data where one of the following applies:

• the accuracy of the personal data is contested by the data subject (in this case the restriction applies for the period enabling the Company to verify the accuracy of the data);
• the processing is unlawful but the data subject requests the restriction of the usage of data instead of their erasure;
• the Company no longer needs the personal data, but they are required by the data subject for the establishment, exercise or defense of legal claims;
• the data subject objects to the processing based on the Company’s legitimate interest and there are no overriding legitimate grounds for the processing (in this case the restriction applies for the period required to verify whether the legitimate grounds of the Company override those of the data subject).

Where the processing of personal data has been restricted, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the EU or of an EU member state.

The Company shall inform the data subject before the restriction of processing is lifted.

Upon restricting the processing of the data subject’s data, Company shall – if possible - promptly also inform any person to whom Company previously transferred the data subject’s data under restriction, unless informing such party would involve disproportionate effort. Company shall inform the data subject of such recipients upon request.

Erasure of Personal Data

The data subject may request the Company to erase personal data pertaining to him/her without undue delay where one of the following grounds applies:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise handled by the Company;
• the Company was processing personal data based on the data subject’s explicit consent, however the data subject withdraws his/her consent and there is no other legal ground for the processing;
• the personal data have been unlawfully processed;
• the personal data have to be erased for compliance with a legal obligation in EU or national law to which the Company is subject;
• the data subject objects to the processing and there are no overriding legitimate grounds for the processing.

The data subject must submit his/her request for erasure in writing or per e-mail and must indicate which personal data he/she requests to be erased and for which of the above purposes.

In case the Company complies with the data subject’s request for erasure, the personal data in question must be erased from all of Company’s registrations and the data subject must properly be informed thereof.

Upon erasing the data subject’s data, Company shall – if possible - promptly also inform any person to whom Company previously transferred the data subject’s data to be erased, unless informing such party is impossible or would involve disproportionate effort. The Company shall inform other data controllers that the data subject has requested the erasure of any copies or replications of such personal data. Company shall inform the data subject of such recipients upon request.

The Company shall not be obliged to erase personal data to the extent that data processing is necessary:

• for exercising the right of freedom of expression and information;
• for compliance with a legal obligation which requires processing by EU or Hungarian law;
• for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Company;
• for reasons of public interest in the area of public health;
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in so far as the data subject’s right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing;
• for the establishment, exercise or defense of legal claims.

Right to Data Portability

The data subject is entitled to receive the personal data he/she provided to the Company in a structured, commonly used and machinereadable format and have the right to transmit those data to another data controller, given that:

• the processing is based on consent or a contract, and
• the processing is carried out by automated means

Where technically feasible, the Company shall directly transmit personal data to another data controller in accordance with the data subject’s request. The right to data portability does not create an obligation for data controllers to adopt or maintain processing systems which are technically compatible.

In case the data subject’s right of data portability may adversely affect the rights and freedoms of others, especially regarding trade secrets, intellectual property or personal data, the Company is entitled to refuse compliance with the request as necessary and proportionate.

Remedies

In case the data subject believes that the handling of his/her personal data by the Company is in breach of prevailing statutory provisions pertaining to data protection, thus especially the GDPR, he/she is entitled to lodge a complaint with the National Data Protection and Freedom of Information Authority (seat: H1125 Budapest, Szilágyi Erzsébet fasor 22/c.; email address: ugyfelszolgalat@naih.hu; postal address: 1530 Bp. Pf.: 5, website: www.naih.hu; telephone number: +36 (1) 391-1400).

The data subject is entitled to lodge a complaint with any other supervisory authority, in particular in the EU member state of his/her habitual residence, place of work or place of the alleged infringement.

Without prejudice to the right to lodge a complaint, the data subject is entitled to judicial remedy in case his/her rights under the GDPR have been infringed.

The Company, as a Hungarian data controller may be brought before court in Hungary. The data subject may file such action either with the tribunal having jurisdiction based on the Company’s seat or the one with jurisdiction based on his/her own place of domicile. Contact data of Hungarian tribunals can be accessed here: http://birosag.hu/torvenyszekek.

In case the habitual residence of the data subject is in another EU member state, such proceedings may be brought before the regular courts of such state.

Who Can You Turn To?

Please turn to Kamila Utegenova (tel.: +36 70/313-4549; e-mail: website@spicemediaproduction.com) with any requests or questions regarding the handling of your personal data.

Automated Decision-making and Profiling

The Company does not engage in automated decision-making and profiling.

Miscellaneous

The present Data Protection Policy enters into force on May 21, 2018 and is valid until revocation by the Company.

The Company may unilaterally amend the present Data Protection Policy any time.