DATA PROTECTION DECLARATION

Please read this Information carefully in order to understand how we handle your personal data and to learn about your rights regarding data processing.
Madagascar Aromas Commercial and Service Limited Liability Company, as data controller, respects the privacy of all persons who provide personal data and is committed to protecting it. According to Article 13 of the European Union General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council, hereinafter: GDPR), it provides the following information:

Data Controller's Details:

Company Name: Madagascar Aromas Commercial and Service Limited Liability Company
Registered Office: 2724 Újlengyel, Petőfi Sándor Street 41.
Website: https://madagascararomas.com, https://shop-madagascararomas.eu
Phone: +36 70 303 111 3
Email: mail@madagascararomas.com

Data Protection Requests:

If you have any requests or questions regarding data processing, you may send your request by post or electronically to the following address: mail@madagascararomas.com. We will send our response without delay, but no later than 30 days, to the address you requested.

Purposes of Data Processing:

The data controller processes data for the following purposes, in compliance with applicable laws:
a) Fulfillment of services provided on the website.
b) Contact by electronic means, telephone, SMS, and post.
c) Providing information about the Company's products, services, contract terms, and promotions.
d) Sending advertising materials electronically and by post.
e) Analyzing the use of the website, including the use of Google Analytics.
f) Processing personal data of service users in connection with the Company's business activities for the purposes of fulfilling legal obligations and maintaining customer relationships.
g) Marketing activities for potential customers, including data related to advertisements.
h) Processing data of employees and applicants.
i) Processing contact persons' data of partners.
j) Fulfillment of customer orders.
k) Organizing prize draws.
l) Facilitating internal administration.

Legal Bases for Data Processing:

a) Issuing invoices in accordance with accounting legislation: legal basis: GDPR Article 6(1)(c).
b) Contact: legal basis: GDPR Article 6(1)(f). For the data of employees of partners, the legal basis is balancing interests. The data controller's legitimate interest: business continuity.
c) Processing employee data: legal basis: GDPR Article 6(1)(b), (c).
d) Processing contractual partners' data: legal basis: GDPR Article 6(1)(b).
e) Marketing activities, including Google Analytics and advertising data: legal basis: GDPR Article 6(1)(a). The Company also operates a Facebook page for marketing purposes; however, no separate database creation or profiling takes place.
f) Online registration: legal basis: GDPR Article 6(1)(a).
g) Organizing prize draws: legal basis: GDPR Article 6(1)(a).

Duration of Data Processing:

Invoices are kept for at least 8 years due to legal obligations (payer data processing). Documents underlying invoice issuance are also kept for 8 years.
Documents underlying employment are kept for 3 years after termination of employment. Data provided for contact purposes is kept for 1 year following the end of the relationship. Data related to contract fulfillment is kept for 5 years after contract termination. Data processed for marketing purposes, including Google Analytics and advertising data, is kept until withdrawal of consent to data processing. Data processed for prize draws is kept until the final settlement of the prize draw.

Persons Authorized to Access Personal Data:

Your personal data may be processed by our Company's employees, who are authorized to access it in compliance with relevant legislation and principles.

Data Processors:

• ADÓ-DÓ PLUSZ Ltd., 3530 Miskolc, Görgey Artúr Street 8. 1/1 (accountant)
• Express One Hungary Ltd., 1239 Budapest, Európa Road 12 (courier service)
• Magyar Posta Ltd., 1138 Budapest, Dunavirág Street 2-6 (courier service)

The Company does not transfer personal data abroad, except if transferring personal data to a country outside the European Union member states, and the recipient of the transferred data provides appropriate guarantees regarding compliance with the Regulation.

Here is the literal English translation of the provided Hungarian text about data subject rights and purposes of data processing:

Your rights concerning the processing of your personal data

a) Right of access

You have the right to receive feedback from our Company regarding whether your personal data is being processed and, if so, to receive information about the personal data concerned, the purpose of data processing, the recipients with whom your data is shared, the planned duration of data processing, and other rights related to data processing.
Upon request, our Company will provide you with a copy of your personal data involved in data processing. For additional copies, our Company may charge a reasonable fee based on administrative costs.

b) Right to rectification

If the data concerning you is outdated or inaccurate for any reason, you may request the correction of the inaccurate personal data. Considering the purpose of data processing, you are also entitled to request the completion of incomplete personal data.

c) Right to erasure

Our Company deletes your personal data if it is no longer necessary for the purpose for which it was processed; if data processing is unlawful; if you withdraw your consent to data processing and there is no other legal basis for processing; if you object to the processing and there is no overriding lawful ground for processing; and if it is required by legal obligations applicable to our Company. You may indicate your intention to delete your personal data by sending an email to mail@madagascararomas.com.

d) Right to restriction of processing

You are entitled to request restriction of processing if any of the following apply:
a) You contest the accuracy of your personal data, in which case the restriction applies for the period that allows our Company to verify the accuracy of your personal data;
b) The data processing is unlawful, but you oppose deletion and request restriction of use instead;
c) Our Company no longer needs your personal data for processing purposes, but you require them for the establishment, exercise, or defense of legal claims; or
d) You objected to data processing, in which case the restriction applies pending the determination whether our Company's legitimate grounds override yours.

e) Right to prohibit the use of personal data for direct marketing

You have the right at any time to prohibit the use of your personal data for direct marketing purposes, in which case our Company will no longer send commercial advertising to you.

f) Right to data portability

If data processing is based on your consent or a contract with you and is automated, you have the right to receive your personal data provided to us in a structured, commonly used, machine-readable format and also to transfer such data to another data controller.

g) Right to object

You have the right to object to the processing of your personal data if such processing is necessary for the data controller's or a third party's legitimate interests, or if your personal data is used or transferred for direct marketing, public opinion polling, or scientific research purposes.

Purpose and legal basis of data processing

The purposes of data processing carried out by the Data Controllers include:
a) Delivering printed publications of the Company to partners;
b) Identifying partners, maintaining contact with partners;
c) Processing and storing CVs sent by users until the CV owner instructs the cessation of storage;
d) Identifying user rights (services available to the user);
e) Ensuring the provision of services available through the Company's websites;
f) Displaying personalized content and advertisements, conducting statistics, including Google Analytics data;
g) Assisting customization of services used by the user and advertisements, use of convenience functions;
h) Handling and managing individual user queries;
i) Preparing statistics and analyses;
j) Direct business or marketing communications (e.g., newsletter, eDM), including data related to advertisements;
k) Providing storage space for user-generated content (e.g., comments, chat, blog, forum, etc.);
l) Organizing, conducting sweepstakes in individual cases, notifying winners, and providing prizes;
m) Keeping records of the Controller's employees as prescribed by law, submitting declarations and reports;
n) Recruiting and selecting potential employees of the Controller;
o) Developing the IT system technically;
p) Protecting users' rights;
q) Enforcing the legitimate interests of the Controller;
r) Assisting in the conclusion and fulfillment of contracts in the Controller's scope of activities.

The Company may use the data made available by users during service use to form user groups and display targeted content and/or advertisements on the Company's websites for these groups.

The Data Controller may process personal data for any of the above data processing purposes.

The Data Controllers do not use the provided personal data for purposes other than those specified herein.

Here is the literal English translation of the provided Hungarian text about user rights, data modification, deletion, and related data management policies:

User Rights, Enforcement, Data Modification, and Deletion

The User may request that any Data Controller inform them whether their personal data is being processed, and if so, provide access to the Personal Data processed.
Personal Data provided by the User related to a given Service can be viewed in the login system settings and on the profile pages corresponding to the Services.

Regardless, the User may request information about the processing of Personal Data or may declare and decide on its deletion at any time by sending a registered or certified letter to the Data Controller's address.

Additionally, requests sent to the email address mail@madagascararomas.com will be processed, and the User's data will be deleted within 30 days at the latest.

The Data Controller considers a request for information sent by letter authentic if the User can be clearly identified based on the submitted request. A request sent by email is only considered authentic if sent from the User's registered email address; however, this does not exclude the possibility that the Data Controller may identify the User by other means before providing information. The request for information may include data managed by the Data Controllers, their sources, purposes, legal bases, duration, names and addresses of Data Processors, data processing activities, and, in the case of data transfer, to whom and for what purpose the User's data has been or is disclosed.

The User may request correction or modification of Personal Data managed by Data Controllers. Considering the purpose of data processing, the User may request the completion of incomplete Personal Data. Personal Data provided by the User related to a given Service can be modified in the login system settings or on the profile pages of the relevant Services. After fulfilling a request for modification, previous (deleted) data cannot be restored.

The User may request deletion of Personal Data managed by Data Controllers.
Deletion may be refused (i) for the exercise of freedom of opinion and information; or (ii) if a law authorizes processing of Personal Data; and (iii) for the assertion, exercise, or defense of legal claims. The User will always be informed by the Data Controller of the refusal to delete, including the reason for the refusal. After fulfilling a deletion request, previous (deleted) data cannot be restored.

Newsletters sent by the Data Controller can be unsubscribed from via the unsubscribe link contained therein. Upon unsubscription, the Data Controller deletes the User's Personal Data from the newsletter database.

The User may request restriction of Personal Data processing if the User contests the accuracy of the processed Personal Data. In such cases, the restriction applies until the Data Controllers can verify the accuracy of the data. The Data Controllers will mark the contested Personal Data if the User disputes its accuracy, but the inaccuracy cannot be clearly established. The User may also request restriction of Personal Data processing if the processing is unlawful, but the User opposes the deletion and requests restriction instead.

Further, the User may request restriction if the purpose of processing has been fulfilled, but the User requires the data for the assertion, exercise, or defense of legal claims.

The User may request that Data Controllers provide the Personal Data made available and processed automatically by the User in a structured, commonly used, and machine-readable format and/or transfer it to another Data Controller.

The User may object to the processing of Personal Data if (i) it is necessary solely for compliance with a legal obligation or for the legitimate interests of the Data Controller or a third party; (ii) if processing is for direct marketing, opinion polling, or scientific research; or (iii) if it is carried out to perform a task in the public interest. The Data Controller will examine the legitimacy of the objection and, if justified, terminate processing, lock the processed Personal Data, and notify all recipients who previously received the contested Personal Data about the objection and measures taken accordingly.

Information on Remedies

If you have any complaints regarding the processing of your Personal Data, please contact our customer service or staff at mail@madagascararomas.com. Our Company will investigate the complaint and inform you within 30 (thirty) days about the investigation's results and measures taken.

If you believe that your personal data processing violates applicable laws, you may file a complaint with the data protection authority or take legal action.
In Hungary, the data protection supervisory authority is:

National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1125 Budapest, Szilágyi Erzsébet fasor 22/C
Email: ugyfelszolgalat@naih.hu

Data protection lawsuits fall under the court's jurisdiction. At the affected party's option, the lawsuit may also be initiated before the court in the party's place of residence or stay.

Madagascar Aromas Commercial and Service Limited Liability Company Data Protection and Data Management Policy

The purpose of this Policy is to record the data protection and management principles and policies applied by Madagascar Aromas Commercial and Service Limited Liability Company (registered office: 2724 Újlengyel, Petőfi Sándor Street 41, company registration number: 01-09-419733; hereinafter: the "Company"). The Company undertakes to ensure the security of Personal Data and adopts technical and organizational measures and procedural rules to ensure that collected, stored, and processed Personal Data is protected against destruction, unauthorized use, or unauthorized alteration. The Company also obliges all third parties to whom Personal Data may be transferred or disclosed to comply with these obligations.

Details of Data Processing

Scope of services available:

Viewing content without registration

Scope of processed data:

Data that the User may voluntarily provide: e-mail address, telephone number, name, residence/place of stay, product category ordered by the User, delivery and payment methods used by the User, total purchase amount, loyalty program customer ID created for the User.

Data technically recorded during system operation: data of the User's login computer, generated during the use of the service, and automatically recorded by the Data Controller's system through technical processes. Automatically recorded data is logged at login and logout without separate declaration or action by the User. This data cannot be linked to other personal data except in cases required by law. Only the Data Controller has access to the data.

The Company places a small data packet ("cookie") on the User's computer to serve personalized content, including Google Analytics and advertising data. Cookies aim to ensure the highest quality operation of the site to enhance user experience. The User can delete cookies or configure their browser to disable cookies. Disabling cookies may result in incomplete site functionality.

Purpose of Data Processing

Data processing's purpose is to ensure service provision at the URL, including Google Analytics and advertising data management.

Duration of Data Processing

Personal Data provided by the User is processed until the User unsubscribes from the service under the User's account name. Deletion takes place within 10 working days after receipt of the unsubscribe request.

In cases of unlawful or deceptive use of personal data or if the User commits a crime or attacks the system, the Data Controller is entitled to delete their data immediately upon termination of registration, but is also entitled to retain the data during investigations.

Information About Personal Data

If your personal data becomes available to third parties on the website without your consent or legal authorization, you may enforce your rights under GDPR by contacting mail@madagascararomas.com or via mail at 2724 Újlengyel, Petőfi Sándor Street 41. The above provisions only apply together with the General Terms and Conditions.