Published by INTERSPUTNIK Kft.

Effective from 22 August 2023 28.

1. Introduction of the data controller

The controller of the personal data is Intersputnik Kft. (tax number 14335941-2-41; hereinafter referred to as the “Controller“), which is the operator of the Light Art Museum (LAM, hereinafter referred to as “LAM“) independent art exhibition space.

The Data Controller is committed to the protection of personal data of its customers and partners and considers of utmost importance the respect of the right to informational self-determination of its customers. The Data Controller treats personal data confidentially and takes all security, technical and organisational measures to ensure the security of the data.

Contact details:

    • E-mail address: info@lam.xyz
    • Phone number: +36 70 575 3999
    • Postal address: 1054 Budapest, Hold utca 13.
2. About the specific processing operations

Visiting the LAM is possible for the general public for a fee, for which tickets can be purchased on the website of the Data Controller: https://lam.xyz/. (the website and its subpages hereinafter: Website).

Visiting the Website and purchasing tickets involves the processing of personal data.

Personal data will be processed as described in this Privacy Notice and in accordance with and in compliance with Regulation (EU) 2016/679/EU of the European Parliament and of the Council (hereinafter: GDPR) and Act CXII of 2011 (hereinafter: Infotv.).

2.1. Google AdWords Enhanced Conversions

If you interact with our website or advertisements, with your consent, we process your personal data when using the Google AdWords Enhanced Conversions cookie.

This cookie allows to track and optimize the effectiveness of our advertisements by providing insight into users’ interactions with our site and advertisements.

The data we collect:

  • Conversion data: Data about the actions you performed on our website after clicking on one of our ads (type of conversion, time and data about the ad you clicked on).
  • Device and browser information: IP address, browser type, operating system and device identifiers to ensure that tracking works properly.
  • Cookies and Tracking Technologies: We use cookies and similar technologies to track interactions with our website and our advertisements.

We use data collected through Google AdWords for the following purposes:

  • Optimization: We use the collected data to fine-tune our advertisements and improve their effectiveness.
  • Analysis: By analyzing the conversion data, we gain insight into the choices of our users, thereby promoting the development of user experiences and the personalization of our offers.

If you do not wish to participate in Google AdWords Enhanced Conversions tracking, you may withdraw your consent at any time, or change your browser settings to disable cookies, or use browser add-ons that disable tracking.

Cookie life: 2 years, the data will be processed during this time or until you withdraw your consent.

Further information on the use and operation of the Google Ads Enhanced Conversions cookie can be found at https://www.google.de/intl/de/adsense/start.

For detailed information on using customer data, see  https://support.google.com/adspolicy/answer/7475709?hl=hu.

2.2. Data processing in relation to ticketing

The purpose of the processing of personal data is the sale of tickets through the website of the Data Controller, the issuing of invoices related to the sale and the sending of tickets to the data subject, ensuring participation in the Event for the ticket holder.

Scope of the data processed:

I. For billing:

Name and address of the customer, ticket details.

II. To confirm your purchase:

Buyer’s e-mail address.

III. To make the payment:

Bank card details.

IV. To establish the discounts:

Fact of eligibility (student, pensioner), type of ticket (adult, child, family), coupon code, fact of guided tour.

V. To change the date:

The details of the ticket and the data contained in the e-mail sent by the data subject.

VI. For contact details:

E-mail address and phone number.

Legal basis for processing:

In case of point I:

Fulfilling a legal obligation.

Act CXXVII of 2007 – VAT Act, § 169

In case of point II:

Fulfilling a legal obligation.

Act CVIII of 2001 – Ekertv. § 6 (2)

In case of points III-V:

Performance of the contract between the parties.

In case of point VI:

The Data Controller’s legitimate interest in business continuity and the maintenance of contacts.

The data source is the customer concerned. We are unable to verify the identity of the customer, so it is your responsibility and obligation as a customer to provide your own personal data when making a purchase. If you do not provide us with the necessary information to conclude a contract, you will not be able to buy a ticket and you will not be able to visit the exhibition space.

Personal data will be deleted after the general limitation period of 5 years, with the exception of data related to invoicing, which we are obliged to keep for 8 years pursuant to Article 169 of Act C of 2000 – Act on Accounting.

2.3. Data management in relation to gift vouchers

The gift voucher is not personal, it is sent to the e-mail address provided by the customer in electronic form, so it does not constitute separate processing. Our procedures for gift vouchers are also governed by the section on ticketing.

2.4. Contact

When you contact us via one of our contact details (email address, phone number, postal address, Facebook messenger, Instagram), for example to enquire about our services, make a complaint or exercise your data subject rights, we process your personal data for the purposes of communicating with you and responding to your request.

We process different types of data depending on the form of contact you choose and the content of the request. This may include your name, email address, telephone number or address, social media identifier and any personal data you provide to us in your enquiry or otherwise bring to our attention.

A kapcsolatfelvétel esetén adatai megadásával Ön észszerűen számíthat az adatkezelésre. Ezzel együtt is tiltakozhat az adatok kezelése ellen. Tiltakozás esetén az adatkezelést megszüntetjük, adatait töröljük.

By providing your data when you contact us, you can reasonably expect the processing to take place. You may also object to the processing of your data. If you object, we will stop processing and delete your data.

The data will only be used to contact you and respond to your enquiry. Our processing is based on our legitimate interest in contacting and responding to you and, and in case of a data subject’s request, to comply with our legal obligation to protect your data.

Depending on the form of the contact, your data will be transmitted to the respective partner, e.g. in case of e-mails, they will be processed by the e-mail service provider.

The data are stored on our hosting service provider’s servers. Your data will be deleted after 5 years from the date of our last contact with you.

2.5. Data processing in connection with sending newsletters

The purpose of the newsletter is to send our offers and information to those who give their prior consent, in order to promote and inform about our services.

The personal data processed are the name and e-mail address of the subscriber. When you subscribe to the newsletter, the IP address provided by your ISP, as well as the date and time of subscription, will be stored in order to investigate possible misuse of your e-mail address.

The legal basis for the processing is the explicit consent given when subscribing to the newsletter. The data will be processed until the consent is withdrawn. You can withdraw your consent at any time by using the link in the newsletter or by sending a message to our e-mail address. If you withdraw your consent, your data will be deleted and we will no longer send you newsletters.

Your subscription data will be transferred to our website and newsletter service partner.

2.6. Data processing in relation to our social media pages

Social media service providers (Facebook, LinkedIn, etc.) have different interpretations of the data processing that takes place when they operate business pages on their platforms. This affects you in that it determines, in relation to these sites, who will be the primary source of information about your data activities and who you can exercise your data subject rights against.

The logic behind the difference is not easy to understand, not only as a stakeholder but also as a business user. In order to be present on these platforms, we can only accept the different approach of service providers, which are non-negotiable issues due to their size and economic weight. The differences are summarised below.

2.6.1. Social networking sites with which we carry out so-called shared data management

In relation to our pages on these social networking sites, we are jointly responsible with the relevant service provider for the lawful processing of personal data that results from your visit to or interaction with our pages.

Details of the processing we carry out can be found in this Privacy Notice. For more information on contact details of service providers and details of joint processing, please click here:

    • Facebook Page analytics (provider: Meta Platforms)

https://www.facebook.com/legal/terms/page_controller_addendum

    • Instagram (provider: Meta Platforms)

https://www.facebook.com/legal/terms/page_controller_addendum

If you have any questions about your personal data, the service provider concerned will be the first to be able to provide you with information. As a data controller, we do not have access to the data relating to the user processed by the service provider in relation to the site, beyond the visible activities (reactions, comments, shares, etc.), but only to the anonymised statistical analyses aggregated from them.

We process statistical data on the basis of our legitimate interest related to our social media presence.

2.6.2. Community site, where we are considered a data controller in its own right

The YouTube service provider and our company are separately responsible for the lawful processing of personal data that is generated as a result of your visit to or interaction with our site on these social platforms. Therefore, you can contact both parties in case of a question regarding data processing.

Details of the processing we carry out can be found in this Privacy Notice.

The data is processed for as long as you remain a user of that social networking site and interact with our site in any way.

You can find more information about the contact details of the service provider and the details of its data processing here:

    • YouTube (provider: Google Ireland Limited – Google LLC)

https://policies.google.com/privacy?hl=hu&gl=hu

    • Google Maps

On our website, we use Google LLC’s Google Maps (API) to display our address on a map to make it easier for you to find us.

The map on our site does not process any data about you. However, if you plan your route to us via our site, the data relating to this (e.g. your IP address, approximate location) will be transmitted to Google’s servers in the USA.

Google will analyse your activity on the map based on its own legitimate interests, even if you do not have a Google Account or are not logged in to one. If you do have a Google Account and are logged in to it, data about your activity on our site will be linked to that account. We have no control over the creation of such user profiles, which you can object to by contacting Google.

Please consider the above risks before you decide to use Google Maps!

You also have the option to generally block such cookie-based tracking requests to you and similar cookie-based tracking requests. To do this, you will need to change your browser settings and disable JavaScript-based tracking. We recommend that you contact your browser’s support page for more information. If you disable cookies, you will not be able to use the map service.

    • You can find the privacy policy for Google services here:

https://policies.google.com/privacy

    • And the additional terms and conditions for Google Maps here:

https://www.google.com/intl/hu/help/terms_maps/

3. Access to data, data processing and data transmission

3.1. Access to data

The personal data that we process are only accessible to our employees who are authorised to that by virtue of their job. Our employees are only entitled to access the data that they need to process in order to carry out their duties.

Our employees and third parties who have access to the data (data processors) are bound by confidentiality obligations in relation to data processing.

3.2. Data processing

Subcontractors we use to provide our services may eventually have access to your personal data during their activities – for example, messages sent to us are transferred to us via our email service provider. Our subcontractors therefore work in complete confidentiality and provide contractual guarantees that they will fully comply with our instructions and the applicable data protection regulations. Your data will remain under our control even if we use a data processor.

We employ the following data processors:

    • Hosting provider
    • Web developer
    • E-mail service provider
    • Ticketing
    • Accountant

3.3. Transmission of data

We will only transfer your personal data to third parties in special circumstances, for example to comply with a legal obligation to which we are subject, typically at the request of a court or other authority, or if you have explicitly consented to the transmission.

We keep separate records of ad hoc transmissions, which we make available to data subjects on request.

3.4. Transfer of personal data to a third country or international organisation

As a data controller, we transfer your personal data to a third country based on your consent or our legitimate interest, but we will only do so if we have received adequate assurances from our contributors that with regard to the third country data processing, there are effective rights and remedies available in relation to your data.

Your personal data will not be transferred to any international organisation.

4. Rights of the data subject

Your ownership on your personal data will be maintained for the duration of the processing. As a data subject, you have the right to access, rectify, erase or restrict the processing of your personal data, to object to the processing of your data and, in certain cases, the right to data portability.

For details of your rights, please see Articles 14-22 of the GDPR.

To exercise your data subject rights, please contact us using one of the contact details provided. We will respond to your request as soon as possible and at the latest within one month.

We will not charge you any costs in the process of fulfilling your request.

If you wish to exercise your rights as data subject, this will involve your identification and the Data Controller will need to communicate with you as necessary. Therefore, in order to identify you, you will be required to provide personal data (identification will only be based on data that we as Data Controller otherwise process about you) and your request will be available in the email account of the Data Controller within the time period indicated in this notice for contacting you.

4.1. Right of information

You have the right to be provided with concise, transparent, intelligible and easily accessible information about the processing of your personal data, in clear and plain language, and we have prepared this policy with this aim and purpose in mind.

If we have not been clear or unambiguous enough about the processing of your data, or if you have any further questions about it, please do not hesitate to contact us at our contact details.

4.2. Right of access

At the data subject’s request, we will inform him or her, following his or her identification, whether we are processing his or her personal data or not, and, if so, the information comprises the details of the processing.

4.3. The right to rectification

If any of the data we process is inaccurate or incomplete, we will correct it at your request or complete it based on of your declaration.

4.4. Right to erasure (“right to be forgotten”)

At your request, we will delete your personal data if the processing has achieved its purpose; in the case of processing based on consent, if you withdraw your consent; or if you legitimately object to the processing; or if the processing would be unlawful; or if we need to delete your data to comply with a legal obligation.

Despite your request for deletion, we will only continue to process your data in special cases, in order to comply with legal obligations or to pursue legal claims.

4.5. Right to restriction of processing

At your request, we restrict the processing of data:

    • if your data that are believed to be inaccurate until they are verified;
    • where there is a suspicion of unlawful processing, if you oppose the erasure of your data, pending the investigation of the suspicion;
    • if the data are no longer necessary and you request the data to be deleted in order to exercise your legal rights, until such time as that request is complied with;
    • in the event of an objection to processing, until a decision on the objection is taken.

In these cases, except for storage, we will process the data only with your consent or for the purposes of pursuing legal claims or important public interests.

If we have restricted processing at your request, we will inform you in advance of the lifting of the restriction.

4.6. Our obligation to inform recipients

As Data Controller, we will inform all recipients to whom we have disclosed the personal data of any rectification, erasure or restriction of processing, unless this proves impossible or involves a disproportionate effort. Upon request, we will inform you of these recipients.

4.7. The right to data portability

We will send you, as Data Subject, at your request, your personal data that you have provided to us based on your consent or the contract concluded between us, and that we process, in a structured, commonly used, machine-readable format.

You may also request that we transfer this data directly to another controller.

4.8. The right to object

As a data subject, you can object at any time to the processing of personal data that we process about you based on our legitimate interest.

At your request, we will stop processing the data unless it is necessary for the exercise of our rights.

4.9. Automated individual decision-making, including profiling

We do not use automated decision-making or profiling in the processing.

4.10. Right to withdraw consent

If the processing of your personal data is based on your consent, you can withdraw your consent at any time. However, the withdrawal does not affect the lawfulness of the processing carried out on the basis of consent prior to the withdrawal.

4.11. Enforcement of rights relating to personal data after the death of the data subject

Within five years of the death of the data subject, the rights of the deceased during his or her lifetime may be exercised by a person authorised by the data subject by means of a declaration duly made to the Data Controller.

Even if the data subject has not made such a declaration, his or her close relative within the meaning of the Civil Code has the right to request the rectification of the personal data and to object to the processing of personal data based on his or her legitimate interest.

The person exercising the rights of the data subject shall provide appropriate documentary evidence of the fact and time of the death of the data subject and of his or her identity and, where applicable, of the identity of his or her status as close relative.

5. Complaints and other remedies available to the data subject

If you have any questions, comments or complaints about the processing of your personal data, please contact us and we will do our best to answer and arrange them.

    • E-mail address: info@lam.xyz
    • Phone number: +36 70 575 3999
    • Postal address: 1054 Budapest, Hold utca 13.

As a data subject, if you believe that you have been harmed by the processing of your personal data, you can also make a complaint directly to the Nemzeti Adatvédelmi és Információszabadság Hatóság (National Authority for Data Protection and Freedom of Information) (contact details can be found at https://naih.hu/).

You can also approach directly the courts to enforce your rights.

6. Changes to the policy

The Data Controller reserves the right to change this Privacy Notice at any time. It will of course inform its audience of any changes in due time.