PRIVACY NOTICE

I. Purpose and Scope of the Notice

This privacy notice (hereinafter: the “Notice”) provides information to the data subjects who are natural persons, pursuant to Articles 13–14 of the GDPR, on the personal data processing activities carried out by MUSTANG Kereskedelmi és Szolgáltató Korlátolt Felelősségű Társaság (registered seat: 1038 Budapest, Hegesztő utca 6/b.; company registration number: 01-09-069644; tax number: 10403686-2-41; represented by: Csák Máté György, managing director, acting independently; e-mail: info@mustang-kft.com; hereinafter: the “Company”).

The Notice covers all data processing activities of the Company, in particular:

• a)

  the data processing connected with visiting the Company’s website (www.mustang-kft.com and www.mustangkft.com) and with contacting the Company through the website;

• b)

  the data processing connected with the electronic surveillance system (camera system) operated at the Company’s premises (https://www.e-cegjegyzek.hu/);

• c)

  the data processing relating to the Company’s employees and job applicants;

• d)

  the data processing carried out in connection with the Company’s agricultural contract work activity, in the course of the performance of contracts concluded with clients.

The processing of personal data is governed by the following legislation and recommendations:

• 1.

  Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: the “GDPR”);

• 2.

  Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (hereinafter: the “Infotv.”) — with its provisions in force applicable to data processing falling within the scope of the GDPR;

• 3.

  Act CXXXIII of 2005 on the Rules of Personal and Property Protection and Private Investigation Activities (hereinafter: the “Szvmt.”) — in its provisions relating to the operation of the camera system;

• 4.

  Act I of 2012 on the Labour Code (hereinafter: the “Mt.”) — in its provisions relating to the processing of employees’ data;

• 5.

  Act C of 2000 on Accounting;

• 6.

  Act LXXV of 2010 on Simplified Employment;

• 7.

  the recommendations of the National Authority for Data Protection and Freedom of Information (hereinafter: the “NAIH”) and the data protection practice developed by it.

The Company treats the personal data received confidentially and takes all necessary measures to ensure their security. The Company processes personal data solely for the purposes set out in this Notice and in accordance with the applicable legislation. Personal data may only be transferred to a third party with consent, on the basis of this Notice.

We provide information to anyone about the data stored about them, if requested in writing at the electronic address info@mustang-kft.com or at the postal address. The erasure or rectification of personal data may also be requested at the aforementioned addresses.

This Notice is available on the Company’s website, as well as at the Company’s registered seat and premises. Amendments to the Notice shall enter into force upon publication on the website.

II. The Data Controller

For the interpretation of the concepts used in this Notice, the definitions contained in Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information and in Regulation (EU) 2016/679 (the GDPR) are authoritative.

Natural persons who are in an agency, employment or other legal relationship with the Company, and who act on the Company’s instructions or on its behalf, and who come into contact with personal data in the course of their data processing or data processing–related tasks, perform their duties in compliance with the obligations arising from the legislation applicable to them, from this Notice and from other internal instructions; the Company assumes full responsibility for their activities.

Data Protection Officer: The Company is not obliged to appoint a data protection officer pursuant to Article 37 of the GDPR. Data protection questions and requests may be addressed to the Company at the e-mail address info@mustang-kft.com, or by post at the registered seat. Please indicate in the subject of the letter or on the envelope: “Data processing information/complaint”.

III. Legal Basis for the Processing

The legal basis for processing varies by processing purpose, on which this Notice contains a detailed description. The Company carries out data processing on the basis of one of the following legal grounds:

• a)

  The consent of the data subject (Article 6(1)(a) of the GDPR): the voluntary, specific, informed and unambiguous consent of the data subject for one or more specific purposes. By providing and submitting his/her personal data in the course of contacting the Company, the data subject expressly consents to the processing of the data provided for the given purpose. The personal data originate directly from the data subjects. If his/her data is submitted by a third party, the data subject shall be informed thereof, and, in the event of an objection, the data shall be deleted.

• b)

  Performance of a contract (Article 6(1)(b) of the GDPR): processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract, for example data provided in the course of concluding a contract.

• c)

  Compliance with a legal obligation (Article 6(1)(c) of the GDPR): processing is necessary for compliance with a legal obligation to which the controller is subject (e.g. accounting, tax, labour law, social security obligations — mandatory processing). Where the processing of personal data is prescribed by legislation, the processing is mandatory. The collection and transmission of data to the competent national tax and customs authority is mandatory in connection with the insurance relationship, pursuant to the legislation on the rules of taxation and Act LXXV of 2010 on Simplified Employment (in the case of employment, simplified employment relationships, and agency relationships).

• d)

  Pursuit of legitimate interests (Article 6(1)(f) of the GDPR): processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject. Where the Company relies on legitimate interest, it has carried out the balancing-of-interests test and has established that the Company’s legitimate interest is, in the given case, proportionate to the interests and fundamental rights of the data subject; upon the data subject’s request, the Company shall provide information on the outcome of the balancing-of-interests test.

Where personal data has been collected with the consent of the data subject, the controller may, in the absence of a contrary statutory provision, continue to process the data collected without any further separate consent, and also after the withdrawal of the data subject’s consent, for the purpose of compliance with a legal obligation applicable to it, or for the purpose of the pursuit of the legitimate interest of the controller or a third party, if the pursuit of that interest is proportionate to the restriction of the right to the protection of personal data.

For the validity of the declaration of intent containing the consent of a minor data subject who has reached the age of 16, the consent or subsequent approval of his/her legal representative is not required.

In respect of personal data necessary for the conduct of judicial or administrative proceedings initiated at the request or on the initiative of the data subject, the data subject’s consent must be presumed. The consent of the data subject shall be deemed to have been given in respect of personal data disclosed by him/her, or handed over by him/her for publication, in the course of his/her public activity.

In case of doubt, it must be presumed that the data subject has not given his/her consent.

The data subject is responsible for the accuracy of the personal data provided.

IV. Purpose of the Processing

Personal data may only be processed for a specified, lawful purpose, for the exercise of a right and the performance of an obligation. The processing must comply with this purpose at every stage; the collection and processing of data must be fair and lawful. Only personal data that is indispensable for the achievement of the purpose of the processing, and that is suitable for achieving the purpose, may be processed. Personal data may only be processed to the extent and for the duration necessary to achieve the purpose.

Processing takes place to the extent necessary for the performance of contracts concluded in connection with the services provided by the Company. The personal data processed are not used for private purposes; the processing at all times complies with the principle of purpose limitation.

The Company processes, for the purpose of invoicing the consideration arising from the contract, the personal data indispensable for determining the consideration and for invoicing (in particular data relating to the time, duration and place of the use of the service, the data subject’s name and billing address, and, where necessary, tax number).

The Company processes the personal data of employees required by law for the purpose of establishing, maintaining and terminating the employment relationship.

If the purpose of the processing has ceased or the processing of the data is otherwise unlawful, the data shall be deleted. A law may, for reasons of public interest — with the express designation of the scope of data — order the disclosure of personal data. In all other cases, the disclosure requires the consent of the data subject, and, in the case of special categories of data, his/her written consent.

The right to the protection of personal data and the personality rights of the data subject may not be infringed — unless a law provides otherwise — by other interests attaching to the processing, including the publicity of data of public interest.

V. Data Transfer

Persons entitled to have knowledge of the data: personal data may be processed by the controller’s staff and by its cooperating partners, in compliance with the principles set out in this Notice. The Company’s staff are subject to an obligation of confidentiality; they may only process and transfer data under the conditions set out in this Notice.

Personal data may be transferred, and different processing operations may be linked, only if the data subject has consented thereto, or if a law permits it, and if the conditions of processing are fulfilled in respect of each item of personal data.

Personal data may be transferred out of the country — regardless of the data medium or the method of data transmission — to a controller or processor located in a third country only if the data subject has expressly consented thereto, or if a law permits it, and an adequate level of protection of personal data is ensured in the third country during the processing or handling of the transferred data. The Company transfers the personal data provided to it, to the extent necessary to achieve the purpose of the processing, to its contracted partners operating within the European Economic Area. During the data transfer, data security is ensured, and the conditions of processing applicable to the personal data are also fulfilled at the receiving party.

Upon request, the Company shall send the data subject, by electronic means (e-mail), the recipients concerned by the transfer of his/her personal data, and appropriate information on the processing of his/her personal data.

Beyond the foregoing, the Company shall not transfer or disclose personal data to anyone without the data subject’s express written consent — except on the basis of a statutory authorisation or obligation.

The collection and transmission of data to the competent national tax and customs authority (electronically or on the form designated for this purpose) is mandatory in connection with the insurance relationship, pursuant to the legislation on the rules of taxation and Act LXXV of 2010 on Simplified Employment (in the case of employment, simplified employment relationships, and agency relationships), as well as for the purpose of payroll processing, to the payroll company.

VI. Data Processors

The Company engages data processors to carry out certain technical (IT) operations relating to the data. The data processors may process personal data in accordance with the Company’s instructions and in compliance with the applicable data protection provisions.

• 1.

  ATW Internet Kft.

  Company registration number: 01-09-736956

  Registered seat: 1138 Budapest, Esztergomi út 66. fsz. 1.

  Website: www.atw.hu

  Represented by: Koszik Mátyás or Dobay Gábor, managing director

  Task: server and hosting services

• 2.

  AGRO PROFI Mezőgazdasági Szolgáltató és Kereskedelmi Korlátolt Felelősségű Társaság

  Company registration number: 08-09-022699

  Tax number: 23596247-2-08

  Registered seat: 9330 Kapuvár, Rákóczi Ferenc utca 33.

  Website: www.mezogazdasagitanacsadas.eu

  Represented by: Dr. Kovács Tamás, managing director

  Task: bookkeeping, payroll processing, tax advisory services

VII. Data Processing Principles

The Company processes personal data in accordance with Article 5 of the GDPR, pursuant to the following principles:

• a.

  Lawfulness, fairness and transparency: processing must be carried out lawfully and fairly, and in a manner that is transparent to the data subject.

• b.

  Purpose limitation: personal data may only be collected for specified, explicit and legitimate purposes and may not be processed in a manner incompatible with those purposes. Further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered incompatible with the original purpose.

• c.

  Data minimisation: data must be adequate, relevant and limited to what is necessary in relation to the purposes of the processing.

• d.

  Accuracy: data must be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes of the processing, are erased or rectified without delay.

• e.

  Storage limitation: personal data must be stored in a form which permits identification of the data subject for no longer than is necessary for the purposes for which the personal data are processed. Personal data may be stored for longer periods only if the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the implementation of the appropriate technical and organisational measures required to safeguard the rights and freedoms of data subjects.

• f.

  Integrity and confidentiality: processing must be carried out in such a manner as to ensure appropriate security of personal data through the application of appropriate technical or organisational measures, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.

Accountability: the Company is responsible for compliance with the foregoing, and must be able to demonstrate such compliance.

VIII. Rights of the Data Subject

If you feel that the Company has infringed your right to the protection of personal data, please contact us at the electronic address info@mustang-kft.com, or at our postal address, so that we may remedy any possible infringement. Please indicate in the subject of the letter or on the envelope: “Data processing information/complaint”.

The data subject may request information on the processing of his/her personal data, and may request the rectification or — except in the case of processing ordered by law — the erasure of his/her personal data. At the request of the data subject, the Company shall provide information on the data processed by it about him/her, on the purpose, legal basis and duration of the processing, on the name and registered seat of the data processor and its activities in connection with the processing, and on who receives or has received the data and for what purpose.

The Company shall provide the requested information in writing, in an intelligible form, within the shortest possible time from the submission of the request, but no later than within one month — in justified cases within a maximum of two months. The provision of information is free of charge, if the person requesting the information has not yet, in the current year, submitted a request for information to the controller in respect of the same category of data. In other cases, a reasonable fee may be charged, the amount of which the controller shall communicate before providing the information. Any fee already paid must be reimbursed if the data was processed unlawfully, or if the request for information led to a rectification.

The controller draws the data subjects’ attention to the fact that information must be refused if this is required, pursuant to a law, an international treaty or a binding legal act of the European Union, for reasons of the external and internal security of the State — including national defence, national security, the prevention or prosecution of criminal offences, the security of the penal enforcement system — as well as for reasons of state or local government economic or financial interests, the significant economic or financial interest of the European Union, and the prevention and detection of disciplinary and ethical offences related to the exercise of professions and of breaches of labour law and occupational safety obligations — including in every case control and supervision — and furthermore for the protection of the rights of the data subject or of others.

The data subject may exercise the following rights:

1. Right of access to information and to personal data (Article 15 of the GDPR)

The data subject shall have the right to obtain confirmation as to whether the Company processes his/her personal data, and, if so, shall be entitled to obtain access to the personal data, as well as information on the purpose of the processing, the categories of data processed, the recipients, the data retention period, the data subject’s rights, and the available remedies.

2. Right to rectification (Article 16 of the GDPR)

The data subject shall have the right to obtain from the Company, without undue delay upon request, the rectification of inaccurate personal data concerning him/her, and to request the completion of incomplete personal data. The Company is obliged to rectify personal data that does not correspond to reality. The Company shall notify all those to whom the data was previously transmitted for the purposes of processing of the rectification; such notification may be omitted if it does not infringe the legitimate interest of the data subject, having regard to the purpose of the processing.

3. Right to erasure (Article 17 of the GDPR)

The Company shall erase personal data if its processing is unlawful; if the data subject so requests; if the data is incomplete or incorrect and this state cannot lawfully be corrected, provided that erasure is not excluded by law; if the purpose of the processing has ceased; if the statutory retention period of the data has expired; or if a court has so ordered. The Company shall notify all those to whom the data was previously transmitted for the purposes of processing of the erasure.

4. Right to restriction of processing (Article 18 of the GDPR)

The data subject shall have the right to obtain from the Company, upon request, the restriction of processing where:

• a.

  the data subject contests the accuracy, correctness or completeness of the personal data processed by the controller, and the accuracy of the personal data processed cannot be established beyond doubt, for the period enabling the controller to clarify the existing doubt;

• b.

  the erasure of the data would be warranted, but on the basis of the data subject’s written statement or the information available to the controller it may reasonably be assumed that the erasure of the data would infringe the legitimate interests of the data subject — for the period during which the legitimate interest justifying the omission of erasure exists;

• c.

  the erasure of the data would be warranted, but the preservation of the data as evidence is necessary in the course of investigations or proceedings determined by law conducted by or with the involvement of the controller or another body performing public functions — in particular criminal proceedings — until the final or legally binding conclusion of that investigation or proceeding;

• d.

  the erasure of the data would be warranted, but the preservation of the data is necessary for the controller’s compliance with its documentation obligation — for ten years from the erasure of the data processed.

During the period of restriction of processing, the controller, or the data processor engaged by it, may, in respect of the personal data affected by the restriction, carry out data processing operations other than storage only for the purpose of asserting the legitimate interest of the data subject, or as provided for by law, international treaty, or a binding legal act of the European Union.

5. Right to data portability (Article 20 of the GDPR)

The data subject shall have the right to receive the personal data that he/she has provided to the Company in a structured, commonly used, machine-readable format, and to transmit such data to another controller (in the case of processing based on automated processing, and based on consent or a contract).

6. Right to object (Article 21 of the GDPR)

The data subject may object to the processing of his/her personal data if the processing of the personal data is necessary solely for the purposes of the legitimate interests pursued by the controller or the recipient, except where the processing is ordered by law.

The Company — with the simultaneous suspension of the processing — shall examine the objection within the shortest possible time from the submission of the request, but no later than within 15 days, and shall inform the requester in writing of the outcome. If the objection is well-founded, the Company shall be obliged to terminate the processing — including further collection and transfer of data — and to block the data, and shall notify of the objection, and of the measures taken on the basis thereof, all those to whom it has previously transmitted the personal data affected by the objection and who are obliged to take action in order to give effect to the right to object.

7. Automated decision-making and profiling

The Company does not apply automated decision-making (including profiling) with regard to data subjects.

Within five years following the death of the data subject, the data subject’s rights due to him/her in life, as set out in this Notice, in the Infotv., and in the GDPR, may be exercised by a person authorised by an administrative disposition made by the data subject, or by a statement made to the controller in a public document or a private document of full probative force — if the data subject has made several statements to one controller, the statement made at a later date shall prevail. If the data subject has not made such a declaration of intent, the close relative, within the meaning of the Civil Code, shall, even in the absence thereof, be entitled to exercise the rights to rectification and to objection, as well as — if the processing was already unlawful during the data subject’s lifetime, or if the purpose of the processing ceased upon the data subject’s death — the rights to restriction of processing and to erasure due to the deceased in life, within five years following the death of the data subject. The close relative who first exercises this entitlement shall be entitled to exercise the data subject’s rights under this point.

IX. Website

The Company operates the website at www.mustang-kft.com and www.mustangkft.com. Anyone may access this website, and may freely and without restriction obtain information on the website and on the pages linked to it, without disclosing their identity or providing their personal data. The website publishes static, informational content on the Company’s agricultural contract work activity, its contact details and its services. A contact form is available on the website for visitors; its completion and submission is in every case voluntary. No newsletter subscription or other messaging function is available on the website.

Data Processing through the Contact Form

By completing and submitting the contact form, the data subject may provide the following personal data: name, e-mail address, and any other data disclosed in the text of the message. The provision of the data is in every case voluntary.

Purpose of the processing: the receipt and answering of the visitor’s inquiry, and enabling contact and communication with the Company.

Legal basis of the processing: Article 6(1)(a) of the GDPR — the consent of the data subject, given by completing and submitting the form; or, where the inquiry is directed at a step preliminary to the conclusion of a contract, Article 6(1)(b) of the GDPR.

Duration of the processing: from the answering of the inquiry, or the conclusion of the related administration, except where the processing of the data is justified for a longer period on another legal ground (e.g. conclusion of a contract, assertion or enforcement of a legal claim).

Only the Company’s staff members authorised for this purpose have access to the data provided through the form.

The web server may automatically log technical information not linked to an identified person about visitors (e.g. IP address, time of visit, browser type, pages viewed). Personal data generally cannot be derived from this data; the Company stores such data solely for the purpose of ensuring the secure and uninterrupted operation of the website, for a maximum of 30 days (Article 6(1)(f) of the GDPR).

Where the legal basis for the processing is the Company’s legitimate interest, the Company has carried out, and may in the future carry out, in accordance with the relevant provisions of the GDPR, the balancing-of-interests test, which demonstrates that the Company’s legitimate interest connected with the given processing outweighs the data subject’s rights and freedoms relating to the processing. Upon a request to this effect, the Company shall provide information to the data subject.

The Company shall inform data subjects in advance of any data processing that may take place on the website by means of this privacy notice published on the website.

X. Cookies

The Company uses cookies to the extent strictly necessary for the operation and protection of the website (for example, to send the contact form securely). These do not require the data subject's consent. Beyond these, the website uses only the consent-based cookies described below.

You may reset your browser settings so that it rejects all cookies, or so that it indicates when a cookie is being sent. This can generally be done under the Tools/Settings menu, under the privacy settings — cookie designation. However, certain website functions may not work properly without cookies.

Google Ads conversion tracking

The Company measures the effectiveness of its Google Ads advertisements with Google Ads conversion tracking: it examines how many of the visitors who click an ad go on to send a message via the contact form. For this purpose Google places cookies in the data subject's browser (on the website's domain: _gcl_au, _gcl_aw), which record the fact and time of the click on the ad. In the Google Ads interface the Company sees aggregate figures only and does not identify individual visitors. The Company does not pass the data entered in the form (name, e-mail address, message) to Google.

Measurement starts only if the data subject consents to it in the banner displayed on the website. Without consent the website does not load Google's code, and no data is transmitted to Google.

Legal basis of processing: Article 6(1)(a) of the GDPR — the data subject's consent. Consent may be withdrawn at any time with the “Cookie settings” button in the website's footer; withdrawal does not affect the lawfulness of processing carried out before it. The website stores the data subject's choice in their browser and asks again after 12 months.

Recipient of the data: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), which acts as an independent controller in conversion tracking. Google may also transfer the data to the United States of America; Google LLC is certified under the EU–US Data Privacy Framework and thus, on the basis of the European Commission's adequacy decision, ensures an adequate level of data protection. Further information on Google's processing: https://policies.google.com/privacy

Duration of processing: the cookies placed on the website's domain expire after 90 days; for cookies managed on Google's own domains, see Google's privacy policy.

XI. Processing of Employee Data

Detailed information on the processing of employees’ data is contained in the Company’s Employee Data Processing Notice; for the purposes of uniform regulation, this Notice contains the following summary.

1. Processing of Job Applicants’ Data

Legal basis of the processing: Article 6(1)(b) of the GDPR — taking steps at the request of the data subject prior to entering into the employment contract, performance of a contract; Article 6(1)(f) of the GDPR — the Company’s legitimate interest.

Purpose of the processing: filling the vacant position, selecting the appropriate employee, and preparing for entering into a contract with him/her.

Duration of the processing: the data subject’s consent is valid for a fixed period of two years from the submission of the CV, which may, however, be withdrawn in writing by the data subject at any time, in the form of a request for erasure of the data. The Company shall delete the data upon the expiry of this period, or upon receipt of a request to withdraw consent.

In the case of an application submitted to the database (whether in response to a specific job advertisement or an unsolicited application), the Company processes the data for two years from their receipt, for the purpose of enabling unsolicited applicants to also participate in the selection process if the hiring of a new employee becomes necessary during this period. By submitting the CV, cover letter and other documents forming part of the application material, the data subject consents to the processing by the Company of his/her CV (and the personal data contained in the CV and in the other documents), name and electronic mailing address, for the purpose of assessing the advertised job application or a possible future vacant position. By submitting the CV, the data subject declares that the data provided corresponds to reality, that it was disclosed voluntarily; the data subject is responsible for the accuracy of the data provided.

The personal data processed by the Company may originate from the following sources:

• a.

  personal data provided voluntarily;

• b.

  publicly accessible, disclosed data relevant to the position applied for (e.g. LinkedIn, Facebook);

• c.

  data provided to a third party, where the data subject has consented to the transfer of the data.

If his/her data (e.g. CV) is sent to the Company by a third party, the Company shall inform the data subject thereof, and shall delete the data in the event of an objection. Data may also be taken over from records in which the data subject provided his/her data specifically for the purpose of job seeking, being aware of the fact of the data transfer.

The Company processes special categories of data (e.g. data concerning health, criminal personal data) only with separate written consent, and only where this is necessary for the selection process for the specific job offer applied for. The Company assumes no responsibility for special categories of data disclosed without its express request. Please ensure that the CV does not contain special categories of data, or data that is not relevant for the contract to be concluded (e.g. marital status, religion).

If, following a successful assessment, the applicant enters into a contractual relationship with the Company, the Company shall use the data provided in the application for the purpose of complying with statutory obligations, including labour law, tax and social security rules. If external verification of the data contained in the application material becomes necessary (e.g. reference check), the Company shall request the applicant’s prior written consent thereto.

2. Data Processing relating to the Employment Relationship

Purpose of the processing: the establishment, maintenance and termination of the employment relationship; compliance with statutory reporting and registration obligations.

Legal basis of the processing: Article 6(1)(b) of the GDPR — performance of the employment contract; Article 6(1)(c) of the GDPR — legal obligation (the Mt., the legislation on the rules of taxation, Sections 3 and 11 of Act LXXV of 2010 on Simplified Employment, the Tbj.); Article 6(1)(f) of the GDPR — legitimate interest.

Duration of the processing: during the existence of the employment relationship and thereafter for the period determined by the applicable legislation (payroll documents: for 5 years following the termination of the employment relationship; CVs: retained by the Company for two years).

The Company maintains personnel, as well as payroll and labour records, on its employees. The data in the personnel records may be used to establish facts relating to the employee’s employment relationship and for statistical reporting. The personal data processed include in particular: family and given name, place and date of birth, mother’s name, address, tax identification number, social security (TAJ) number, bank account number, identity card number, educational qualification, professional qualification and vocational qualification and the data of the documents certifying these, FEOR (occupation) code, the commencement, code and termination of the insurance relationship, the duration of any suspension of insurance, weekly working time, gross and net personal wage, job title, job description, managerial assignments, probationary period, data on disciplinary proceedings and sanctions, pay grade, length of employment, time creditable towards the employment relationship, data relating to classification, awards, prizes and other recognitions received, the nature of simplified work, in the case of casual work the number of working hours worked per day, place of work, telephone number, e-mail address, the data subject’s personal image, knowledge of foreign languages, and other data prescribed by legislation.

An employee notice has been prepared regarding the processing of employee data, the purpose of which is the prior information of employees about the processing. Where a declaration is necessary for the establishment, maintenance or termination of the employment relationship, in the course of obtaining the declaration the Company shall in every case draw the employee’s attention to the fact, legal basis and purpose of the processing. Where the validity of the declaration requires the presentation of a document (identity card, student card), the Company shall in no way process the data and/or image of the document, but the presentation and validity of the document shall be certified by the signature of the authorised employee.

The Company reserves the right, for certain positions (in particular managerial positions or positions involving the handling of money), on the grounds of a statutory requirement or the performance of another legal relationship, to make recruitment conditional upon the possession of a certificate of good conduct. The Company processes criminal personal data only with the data subject’s written consent; the purpose of processing criminal personal data is to decide on suitability for the given position, and therefore the Company processes such data only until the achievement of the purpose, i.e. until the decision. In certain justifiable cases, the managing director may decide, on an individual assessment, in favour of suitability for the position even where the certificate of good conduct contains an entry that does not jeopardise the Company’s objectives and principles.

The employee is responsible for compliance with the applicable regulations, for the integrity, inviolability and availability of the personal data processed by him/her, and for data protection incidents and infringements arising from his/her intentional or negligent conduct.

3. Data Processing relating to Medical Fitness for Work

Medical fitness examinations may also take place during the existence of the employment relationship (periodic occupational health review). The employer is required to request the assessment of the employee’s fitness for the job from the occupational health physician pursuant to Annex 14 of NM Decree 33/1998 (VI.24.) and Annex 1 of EüM Decree 50/1999 (XI.3.). The Company must keep records containing special categories of (health) personal data in respect of the natural person. The Company does not become aware of, and does not process, data relating to medical fitness for work of any data subject beyond the extent going beyond the purpose. For the purpose of deciding on medical fitness for work, the Company decides on the medical fitness for work of the given (prospective) employee on the basis of the fitness result originating from the healthcare provider, and processes only the data certifying the fact of medical fitness. If it emerges, during the process of concluding the employment contract, that the given data subject is unfit for the position, the deadline and manner of the processing shall run in parallel therewith.

4. Data Processing relating to the Supervision of Employees

The Company may supervise employees in respect of their conduct connected with the employment relationship (Section 11(1)–(2) of the Mt.). The Company shall inform employees in advance of the use of the technical devices serving to supervise the employee.

Section 52(1)(a) of the Mt. provides that the employee is obliged to appear, at the place and time prescribed by the employer, in a condition fit for work. The Company prohibits, for every position, the employee from carrying out work while under the influence of alcohol. Breathalyser testing may take place at any time during working hours, and is carried out in accordance with the provisions of occupational safety legislation. Documentation is prepared in every case regarding the test: a record must be drawn up of a positive sample, or of the refusal of the test. The testing for alcohol influence may not involve the infringement of the employee’s human dignity; the Company may not abuse its right of supervision, and may not exercise it contrary to its purpose (e.g. it may not carry out the test several times a day without justification or out of personal vindictiveness, and no person without the relevant authority may order the test).

5. Tracking of Company Vehicles

Legal basis of the processing: Article 6(1)(f) of the GDPR — the Company’s legitimate interest (protection of the Company’s assets, consignment and cargo, organisation of work processes).

The order of use and accounting of the vehicles and agricultural machinery owned by the Company is determined by the managing director. The Company reserves the right to install a GPS tracking system in the vehicles and machinery owned by it. The vehicle may only be used in connection with the Company’s purposes, during which the tracking system continuously transmits a signal regarding the vehicle’s current position. Since the user of the vehicle can in every case be linked to the current position of the vehicle (distance travelled, destination), this qualifies as personal data; the Company shall in every case inform the employee using the vehicle thereof.

XII. Camera System

The Company operates an electronic surveillance system (camera system) at its Hegyeshalom branch premises. The cameras are placed at the entrances to the premises, in their immediate vicinity, and throughout the entire area of the premises. The camera system records images only; no audio recording is made.

The retention and use of the images created by the electronic surveillance system are governed by the following rules, having regard to the provisions of the Szvmt., as well as the relevant provisions of the GDPR and the Infotv.

Purpose of the camera system: the protection of property; the protection of human life, physical integrity and personal freedom; the prevention and evidencing of unlawful acts.

Legal basis of the processing: Article 6(1)(f) of the GDPR — the Company’s legitimate interest (protection of property and persons, prevention and evidencing of unlawful acts). In respect of our employees and contractual partners, the legal basis of the processing is likewise Article 6(1)(f) of the GDPR — the Company’s legitimate interest. The Company has carried out the balancing-of-interests test; the processing of the designated personal data as set out above is absolutely necessary for achieving the desired purpose, and restricts the data subject’s rights and legitimate interests proportionately to the purpose to be achieved.

Operator of the camera system: MUSTANG Kft. exclusively. Only the Company is entitled to access the recordings. The recordings are not disclosed to third parties — except in cases specified by law, or upon an official or judicial request.

Duration of the processing: the images recorded by the camera system are deleted within 3 (three) working days from recording, provided they are not used.

shall mean that the recording is intended to be used as evidence in judicial or other official proceedings. A person whose right or legitimate interest is affected by the recording may, within the above-mentioned deletion deadline (three working days) — by substantiating his/her right or legitimate interest — request that the data not be destroyed or deleted by its controller. The Company’s person designated to supervise the processing carried out through the camera system — in the absence of a data protection officer, the Company’s managing director — shall decide on the request within the shortest possible time. The recording thus designated must be exported and stored in compliance with the applicable data protection and data security rules.

Upon the request of a court or other authority, the recorded footage must be sent without delay. If no request is made, within thirty days of the deadline, that destruction be omitted, the recording shall be deleted.

The Company interferes with the private sphere of data subjects through the electronic surveillance system only to the necessary and proportionate extent. The Company does not, for any reason or in any manner, conduct electronic surveillance:

• a.

  for the purpose of monitoring the work intensity of its employees;

• b.

  for the purpose of influencing the workplace conduct of employees;

• c.

  in sensitive areas, in particular changing rooms, showers, toilets, or areas where employees spend their rest periods or breaks (rest room, designated smoking area);

• d.

  in public areas.

A notice has been prepared regarding the processing, the purpose of which is the prior information of data subjects about the processing. The notice is displayed at the entrances in a clearly visible location, and contains the name of the controller, the purpose of the processing, the data retention period, and the possibilities for exercising data subject rights.

XIII. Processing of the Data of Contractual Partners (Clients)

The Company carries out its agricultural contract work activity within the framework of agency/service agreements. Upon the establishment, maintenance and termination of the contractual relationship, the Company processes the personal data necessary for the performance of the contract.

Scope of data subjects: clients who are natural persons (private individuals, sole traders), as well as the natural person representatives and contact persons of clients that are legal persons.

Scope of personal data processed (in the case of a client who is a natural person): full name (name at birth), address, mother’s name, place and date of birth, tax identification number; other data necessary for the performance of the contract.

Purpose of the processing: the creation of the contract work agreement, determination and amendment of its content, monitoring of its performance, invoicing of fees arising therefrom, maintaining contact, identification, and the enforcement of claims.

Legal basis of the processing:

Article 6(1)(b) of the GDPR — performance of the contract;

Article 6(1)(c) of the GDPR — legal obligation (accounting, tax obligations);

Article 6(1)(f) of the GDPR — legitimate interest (maintaining contact, enforcement of claims).

Method of processing: both on paper and electronically.

Duration of the processing: during the existence of the contractual relationship; thereafter, pursuant to Section 169(2) of Act C of 2000 on Accounting, for 8 years from the issuance of the invoice (mandatory retention); in respect of other data, until the achievement of the purpose, or until the expiry of the civil law limitation period.

The Company transfers the personal data of contractual partners to third parties (e.g. accountant, accounting data processor) only to the extent necessary to achieve the purpose of the processing. If his/her data is sent to the Company by a third party, the Company shall inform the data subject thereof, and shall delete the data in the event of an objection.

XIV. Confidentiality

The Company is obliged to ensure that both it and its employees keep all personal data confidential, and that employees have access to personal data only to the extent necessary for the performance of their work. The Company is in particular obliged to ensure that all staff members involved in the processing of personal data receive appropriate training and are duly examined in respect of the processing of personal data.

XV. Security of the Processing

The Company treats personal data confidentially, and takes all IT and other measures conducive to secure data processing in connection with data storage and processing, in order to preserve the data. Accordingly, the data is protected by appropriate measures, in particular against unauthorised access, alteration, transfer, disclosure, erasure or destruction, as well as against accidental destruction and damage, and against inaccessibility resulting from a change in the technology applied.

The controller and the processor, having regard to the state of the art and the costs of implementation, as well as the nature, scope, context and purposes of the processing, and the risk of varying likelihood and severity for the rights and freedoms of natural persons, shall implement appropriate technical and organisational measures in order to guarantee a level of data security appropriate to the degree of risk (Article 32 of the GDPR), including, among others:

• a.

  the pseudonymisation and encryption of personal data;

• b.

  ensuring the ongoing confidentiality, integrity, availability and resilience of the systems and services used for the processing of personal data;

• c.

  the ability, in the event of a physical or technical incident, to restore in a timely manner access to personal data and the availability of the data;

• d.

  a process for regularly testing, assessing and evaluating the effectiveness of the technical and organisational measures taken to guarantee the security of the processing.

To ensure the security of personal data stored on computers or on the network, the Company applies the following measures and guarantee elements:

• a.

  the computers used in the course of data processing are owned by the Company, or the Company has a right over them equivalent to ownership rights;

• b.

  data found on the computer may only be accessed with a valid, personal, identifiable authorisation — at least a user name and password; the Company ensures that passwords are changed regularly, and in justified cases;

• c.

  data stored on the network server may only be accessed with appropriate authorisation, and only by persons designated for this purpose;

• d.

  once the purpose of the processing has been achieved and the deadline for the processing has expired, the file containing the data is irrecoverably deleted;

• e.

  the Company continuously ensures virus protection on the network used to process personal data;

• f.

  the Company prevents unauthorised network access by means of the available IT equipment.

To ensure the security of personal data processed on paper, the Company applies the following measures:

• a.

  the data may only be accessed by those authorised to do so; it may not be accessed by, or disclosed to, others;

• b.

  only persons in charge have access to documents under continuous active processing;

• c.

  the Company’s staff member carrying out the processing may only leave the room in which processing is taking place during the day if the data media entrusted to him/her are locked away, or the office is locked;

• d.

  upon completion of work, the Company’s staff member carrying out the processing shall lock away the paper-based data medium;

• e.

  if personal data processed on paper is digitised, the Company applies the security rules applicable to digitally stored documents.

XVI. Scope of Data Processed, Purpose of the Processing, Legal Basis of the Processing — Summary

XVII. Notification of a Data Protection Incident; Data Protection Officer

The Company shall notify a personal data breach to the competent supervisory authority (NAIH) without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons (Article 33 of the GDPR). Where the notification is not made within 72 hours, it shall be accompanied by reasons for the delay.

Where the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the Company shall communicate the personal data breach to the data subject without undue delay (Article 34 of the GDPR). The communication to the data subject shall describe in clear and plain language the nature of the personal data breach, and shall communicate the name and contact details of the contact point where more information can be obtained; it shall describe the likely consequences of the personal data breach; it shall describe the measures taken or proposed to be taken by the Company to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

The data subject need not be informed if any of the following conditions is met:

• a.

  the Company has implemented appropriate technical and organisational protection measures, and those measures were applied to the data affected by the personal data breach — in particular measures (such as the use of encryption) that render the data unintelligible to any person who is not authorised to access it;

• b.

  the Company has taken subsequent measures which ensure that the high risk to the rights and freedoms of the data subject is no longer likely to materialise;

• c.

  it would involve disproportionate effort to inform the data subjects — in such cases, the data subjects shall instead be informed by means of publicly disclosed information, or a similarly effective measure shall be taken to ensure that data subjects are informed in an equally effective manner.

Where the Company has not yet notified the data subject of the personal data breach, the supervisory authority may, having considered the likelihood of the personal data breach resulting in a high risk, require the data subject to be informed.

The Company shall keep a record for the purpose of monitoring measures relating to the personal data breach and for informing the data subject, containing the scope of the personal data affected, the scope and number of persons affected by the personal data breach, the time, circumstances and effects of the personal data breach and the measures taken to remedy it, as well as any other data specified in the legislation prescribing the processing (Article 33(5) of the GDPR).

No data protection officer operates at the Company.

XVIII. Right to a Remedy

In the event of an infringement of his/her rights, the data subject may bring proceedings against the controller before a court or before the data protection authority. Recourse or a complaint may be lodged at the following contact details:

National Authority for Data Protection and Freedom of Information (NAIH)

If the data subject has lodged a complaint with the Company, and subsequently disagrees with the Company’s decision — in connection with data processing operations falling within the processor’s scope of activity, against the processor — he/she may, within 30 calendar days of its communication, apply to a court or to the NAIH, if he/she considers that the controller, or the processor engaged or acting on its instructions, processes his/her personal data in breach of the requirements laid down in the legislation or in a binding legal act of the European Union relating to the processing of personal data. The controller, or the processor, shall bear the burden of proving that the processing complies with the applicable requirements.

The court shall deal with the case as a matter of priority. The action may — at the data subject’s choice — also be brought before the competent regional court of the data subject’s place of residence or stay. A person who would otherwise not have legal capacity to be a party to proceedings may also be a party to the action. The NAIH may intervene in the action in the interest of the data subject’s success.

If the court grants the request, it shall order the controller: to terminate the unlawful data processing operation; to restore the lawfulness of the processing; or to engage in precisely defined conduct in order to ensure the enforcement of the data subject’s rights; and, where necessary, it shall also rule on the claim for damages or compensation for the infringement.

The court may order the publication of its judgment — with the publication of the controller’s identifying data — if this is required by data protection interests and the protected rights of a larger number of data subjects, if the judgment affects a wide range of persons, if the defendant controller or processor is a body performing public functions, or if the gravity of the infringement that occurred justifies publication.

If the controller causes damage to another by the unlawful processing of the data subject’s data or by breaching the requirements of data security, it shall be obliged to compensate for it (Article 82 of the GDPR). If the controller infringes the data subject’s personality rights by the unlawful processing of his/her data or by breaching the requirements of data security, the data subject may claim compensation for the infringement from the controller. The controller is liable to the data subject for damage caused by the processor, and the controller is obliged to pay the data subject the compensation for infringement of personality rights due for infringement caused by the processor. The controller shall be exempt from liability for damage caused and from the obligation to pay compensation for infringement if it proves that the damage or the infringement of the data subject’s personality rights was caused by an unavoidable cause outside the scope of the processing. Damage need not be compensated, and compensation for infringement may not be claimed, to the extent that the damage resulted from the intentional or grossly negligent conduct of the injured party.

Within five years following the death of the data subject, the data subject’s rights due to him/her in life, as set out in this Notice, in the Infotv., and in the GDPR, may be exercised by a person authorised by an administrative disposition made by the data subject, or by a statement made to the controller in a public document or a private document of full probative force — if the data subject has made several statements to one controller, the statement made at a later date shall prevail. If the data subject has not made such a declaration of intent, the close relative, within the meaning of the Civil Code, shall, even in the absence thereof, be entitled to exercise the rights to rectification and to objection, as well as — if the processing was already unlawful during the data subject’s lifetime, or if the purpose of the processing ceased upon the data subject’s death — the rights to restriction of processing and to erasure due to the deceased in life, within five years following the death of the data subject. The close relative who first exercises this entitlement shall be entitled to exercise the data subject’s rights under this point.

XIX. Closing Provisions

Hungarian law (the Infotv., the GDPR, and the relevant Hungarian legislation) governs any litigation, legal dispute, proceeding or claim connected with this Notice, irrespective of its nature, and the aforementioned matters shall be interpreted in accordance with this law.

The Company reserves the right to amend the Notice, and, in the event of changes in European Union or Hungarian legislation, to amend the Notice accordingly. A change in the processing may not entail the processing of personal data for a purpose different from the original purpose. The controller shall publish information to this effect on its website.

The temporal validity of this data processing notice runs from its publication on the website until its withdrawal. In the event of an amendment of the Notice, the most recent version shall be continuously uploaded; the Notice published on the website shall in every case be authoritative.

MUSTANG Kft.