1. Name and contact details of the data controller:
Name: European Chinese Supply Chain Zrt.
Company registration number: Cg. 01 10 049896
Tax number: 26389686-2-41
Head office: 1133 Budapest, Váci út 76.
Email: info@ecsc-logistics.com
2. Customer support, handling customer enquiries via the email address, forms and other channels published on the ECSC website
The European Chinese Supply Chain Zrt. (hereinafter referred to as the ECSC or the Data Controller) provides the channels through which you can contact it in connection with its services and activities. One of these channels is the Customer Service / Registration Forms sub-menu on www.ecsc-logistics.com, where the inquirer can submit his/her request by providing personal data.
2.1. Legal basis for processing:
For the purpose of processing inquiries about the ECSC’s services, operations and activities, the processing of personal data is necessary for the purposes of pursuing the ECSC’s legitimate interests in responding to the inquiries, ensuring the satisfaction of the inquirer, avoiding possible complaints and preserving its reputation, thereby ensuring that it is considered a reliable economic operator in the market for its services [Article 6 (1) (f) of the General Data Protection Regulation[1]].
If the request constitutes a complaint, the processing of the data is necessary to fulfil the legal obligation provided for in Article 17/A of Act CLV of 1997 on Consumer Protection (hereinafter referred to as the “Fgytv.”). [Article 6 (1) (c) of the General Data Protection Regulation]
If the content of the contact constitutes the exercise of a right concerning the processing of the data subject’s data, the processing of personal data is necessary for the fulfilment of the legal obligations provided for in Article 12 of the General Data Protection Regulation. [Article 6 (1) (c) of the General Data Protection Regulation]
2.2. The data processed:
| processed data set | the purpose of the processing of the data set |
| name of the consumer [Section 17/A (5) a) of Fgytv.], name of the inquirer/data subject | to identify the consumer, data subject to be included in the record of the complaint |
| consumer’s address, notification address [Section 17/A (5) a) of Fgytv.], address of the inquirer/data subject | to send the replyto be included in the record of the complaint |
| consumer/inquirer/data subject’s e-mail address | to send the reply, to keep in contact |
| consumer/inquirer/data subject consumer/ data subject’s telephone number | to send the reply, to keep in contact |
| personal data contained in the documents submitted, described or provided in the request made by the consumer/inquirer/data subject [Section 17/A (5) c) of Fgytv.] | for supporting, verifying, establishing the legitimacy of, or fulfilling the consumer’s/inquirer’s/data subject’s request |
| signature of the consumer [Section 17/A (5) e) Fgytv.] signature of the inquirer/data subject | to verify that the request originates from the consumer/inquirer/data subjectto be included in the record of the complaint |
| the unique identification number of the complaint [Section 17/A (4) and (5) g) Fgytv.] | in the case of a verbal complaint by telephone, for the purpose of identifying, recording and retrieving the recording of the complaintto be included in the record of the complaint |
| place, time and manner of lodging the complaint [Section 17/A (5) b) of Fgytv.] place, time and manner of lodging the consumer’s/inquirer’s/data subject’s request | for the registration of the complaint,to be included in the record of the complaintfor the registration of enquiries |
| the place and time of recording the minutes [Section 17/A (5) f) Fgytv.] | to be included in the record of the complaint |
| personal data processed in the course of the provision of the service concerned by the type of case | for investigating, supporting, verifying and establishing the legitimacy of the consumer’s request |
| Consignee’s address | as additional verification data for the identification of the consignment |
| Destination country | as additional verification data for the identification of the consignment |
| Parcel ID | Used to identify a consignment |
| Webshop name/url address | This information will make it easier to identify whether the ECSC is competent to deal with the submission |
| Any other personal data contained in the text of the notification or in an attachment sent by the data subject to the Data Controller |
2.3. Purpose of data processing
The ECSC processes the data for the purpose of enabling the consumer/inquirer/data subject to
- meet their requests,
- investigate their requests and complaints,
- answer them,
- record within the time limit prescribed by law,
- provide credible evidence of their content
- to fulfil its duty to make a statement in the course of the supervisory authority’s proceedings and for the purposes of the effective conduct of the official investigation and the establishment of the facts of the case under investigation.
2.4. Duration of processing:
The ECSC will keep the data related to the consumer’s/inquirer’s/data subject’s request for five (5) years after the request has been submitted, as ECSC may have a legal dispute with the data subject that can be enforced before a court of law.
The ECSC must keep a record of complaints and responses for 3 years. [Section 17/A. (7) of Fgytv.]
If the processing of the data is necessary for the establishment, exercise or defence of any legal claim (e.g. legal proceedings) in connection with the consumer’s/inquirer’s/data subject’s request, ECSC will process the data for the period necessary for the establishment, exercise or defence of the legal claim.
2.5. The parties involved in the processing of the data, the recipients of the data:
The ECSC manages the registration forms by operating a cloud-based customer management system, which is provided by MiniCRM Zrt. (1075 Budapest, Madách Imre út 13-14. company registration number: 01 10 047449) as the data processor.
Some elements of the IT infrastructure are provided by Magyar Posta Zrt. (1138 Budapest, Dunavirág utca 2-6., company registration number: 01 10 042463).
Other business related entity involved in the logistics process which has relevant information for the submission, it is necessary to respond to the request in a professional manner. If this business entity is located outside the European Union, the international data transfer takes place on the basis of Article 49(1)(c) of the General Data Protection Regulation, i.e. the data transfer is necessary for the conclusion or performance of a contract between the data controller and another ordinary or legal person serving the interests of the data subject.
3. Request for quotation
The ECSC, as a service provider, provides the channels through which those interested in its services can contact it and request a quotation. This can be done www.ecsc-logistics.com by clicking on the “request for quotation” button on the home page under the individual quotation request section.
3.1. Legal basis for processing:
The ECSC processes the data of the natural persons concerned, including self-employed persons, who initiate the contact on their own behalf for the purpose of preparing a contract for a business relationship, including the request for a quotation, and, in case of acceptance of the quotation, for the conclusion of the contract, because it is necessary for the performance of these activities. [Article 6 (1) (b) of the General Data Protection Regulation]
The ECSC has a legitimate economic interest in the processing of the data of persons who initiate a request for quotation as contact persons of legal persons (e.g. companies), in order to be able to directly and efficiently serve the potential customer’s interest in placing an order and thus facilitate the establishment of a business relationship, otherwise the contact and the quotation could only be made through general contact details, which would make it difficult to send the quotation to the appropriate and competent person. [Article 6 (1) (f) of GDPR]
The appropriate legal basis for the provision of contact details to the ECSC in the legal relationship between the legal person and its contact person must be provided by the legal person.
3.2. The data processed:
| processed data set | the purpose of the processing of the data set |
| e-mail address of the requestor of the quotation | in the context of the request for quotation, for the purpose of contacting |
| All personal data provided by the requestor of the quotation in the e-mail | For example, the data needed to evaluate, respond to, evaluate and address the requestor. |
3.3. Purpose of data processing
The data will be processed by ECSC for the purposes of providing a quotation, negotiating further terms of the contract and concluding and performing the contract.
3.4. Duration of processing:
The ECSC will process the data of the data subjects acting on their own behalf, if a quotation is not finally agreed between the parties, until the end of 90 days following the end of the consultation on the request for quotation. If the ECSC makes an quotation but does not start negotiating further terms of the contract, the data will be processed for 5 years from the date of the quotation, for 5 years after the conclusion of the negotiation of further terms of the contract, if no contract is concluded, and, if the contract is concluded, until the end of the 8th year following the end of the accounting report of the calendar year following the calendar year of the termination of the contract, pursuant to Section 169 Subsection (2) of Act C of 2000 on Accounting.
The ECSC will process the data of the contact persons of the legal entities until the end of the 90 days following the end of the consultation on the request for a quotation, if the quotation is not finally made as a result of the consultation between the parties. In case a bid is made by the ECSC but the negotiation of further terms and conditions of the contract is not started, the ECSC will process the data for 5 years from the date of the bid, for 5 years from the date of the conclusion of the negotiation of further terms and conditions of the contract, in case of no contract, for 5 years from the date of the conclusion of the negotiation of terms and conditions, and in case of a contract, for 5 years from the date of the conclusion of the contact. If the contact details of the contact person who negotiated the contract and the contractual terms are recorded in the contract, then, in view of the accounting nature of the contract, the data will be processed until the end of the 8th year following the end of the accounting report for the calendar year following the calendar year in which the contract is terminated, pursuant to Section 169 Subsection (2) of Act C of 2000 on Accounting.
4. Tracking
The ECSC, as consolidator, ensures that the consignee/parcel identifier and postal code (hereafter referred to as consignees) can view the logistics and delivery process of each shipment, depending on the type of shipment, and check the status of the delivery process through the website.
4.1. Legal basis for processing:
The legal basis for the processing is the legitimate interest of the ECSC, as consignees expect a modern logistics company to provide them with such an opportunity. [Article 6 (1) (f) GDPR]
4.2. The data processed:
| processed data set | the purpose of the processing of the data set |
| Shipment ID | pseudonymous data assigned to a shipment, for which natural person recipients may be registered, so that they can be |
| consignee’s postcode | is used as an additional control data to verify that the query originates from the authorised party |
| the fact and date of receipt of the shipment by ECSC | data relating to the consignee’s natural person consignment which allows the consignee to be traced |
| the fact and date of delivery of the consignment to the carrier | data relating to the consignee’s natural person consignment which allows the consignee to be traced |
| the fact and date of arrival of the shipment in the country of destination | data relating to the consignee’s natural person consignment which allows the consignee to be traced |
| the fact and date of delivery of the shipment | data relating to the consignee’s natural person consignment which allows the consignee to be traced |
4.3. Purpose of data processing
With this service, ECSC ensures that consignees can view the individual logistical and transport processes of their shipments and track the individual processes.
4.4. Recipient of the personal data processed
In the operation of the tracking subpage the Gemeric Consulting Kft. (headquarters: 1025 Budapest, Zöldlomb utca 4/A I. em. 3. ajtó, company registration number: 01 09 422531) is involved as data processor.
4.5. Duration of processing:
The ECSC will provide this facility to the consignees for sixty days after the date of receipt of the shipment by the ECSC as consolidator.
5. Rights of the data subject
The ECSC provides detailed information on the following rights of the data subject under the General Data Protection Regulation below:
- withdrawal of consent
- request for access (information)
- request for the correction of data
- request for the deletion of data
- request for the restriction of processing
- objection to data processing
- request for human intervention in case of automated decision-making
- request for data portability
5.1. Withdrawal of consent
Where the ECSC processes personal data on the basis of the data subject’s consent, the data subject has the right to withdraw his/her consent at any time without restriction. By doing so, the data subject expresses that he/she no longer wishes to have his or her data processed by ECSC. However, this does not affect the lawfulness of the processing carried out before the withdrawal. As a consequence of the withdrawal of consent, the ECSC will delete the personal data processed on the basis of the consent. The data will only be deleted if the processing is necessary
- to perform a contract to which the data subject is a party or to take steps at the request of the data subject prior to the conclusion of the contract,
- for the performance of a legal obligation or a task carried out in the public interest, or
- to protect the vital interests of the data subject or others; or
- to pursue the legitimate interests of the ECSC or third parties.
5.2. Access (information) request
Data subjects can request at any time to be informed whether the ECSC is processing their data and, if so, they can have access to it.
If the data subject does not specifically state in their request what they want to know about the processing of their data, we will provide information about the following in addition to their data:
- how their data is processed by the ECSC
- where it got them (source of data),
- the purposes for which the ECSC processes their data (the purposes of the processing),
- what entitles the ECSC to process the data (legal basis),
- when and for how long the ECSC will process their data (duration),
- whether the ECSC uses a data processor to process their data,
- if it uses a data processor, then
- who it is (the name of the data processor),
- what is its address (the address of the data processor),
- what it does with the data (its activities in connection with data management),
- whether the ECSC has transferred their data to anyone and, if so, to whom (the recipient of the data transfer)
- what rights data subjects have in relation to the processing of their data
- if the ECSC processes data subjects’ data in such a way that a consequence or decision is produced on the basis of their data without human intervention, the fact, the way and the effects on the data subjects.
- where data subjects’ data are transferred outside the EEA (European Union Member States and Norway, Liechtenstein, Iceland) or to an international organisation, the ECSC’s arrangements for ensuring adequate data management in such cases.
In some cases, for example to prevent crime or for reasons of national security, the ECSC is required by law to withhold information.
5.3. Requesting correction (amendment) of data
The data subject may request the rectification of his/her data. If the ECSC is processing incorrect, untrue data, the data subject may request that the data be corrected and the correct, true data be processed.
The data subject must substantiate the truth of the data subject’s request for modification and must also prove that he/she is the person who can request the modification. Only in this way can the ECSC assess whether the new data is real and, if so, whether it can amend the old data.
If it is not clear whether the data being processed is correct or accurate, the ECSC will not correct the data, but will limit the data until the accuracy of the data is verified.
5.4. Requesting the deletion of data
The data subject may request the erasure of his/her data.
In the case of processing based on the consent of the data subject, the ECSC will consider the request for deletion as a withdrawal of consent and will delete the personal data. The data will not be deleted unless the processing is necessary
- to perform a contract to which the data subject is a party or to take steps at the request of the data subject prior to the conclusion of the contract,
- for the performance of a legal obligation or a task carried out in the public interest, or
- to protect the vital interests of the data subject or others; or
- to pursue the legitimate interests of the ECSC or third parties.
However, in the case of consent-based processing of the data, the data will be deleted in any event if the ECSC collects children’s data in connection with an online service offered to children. The ECSC does not provide such service though.
Where the data subject has requested the deletion of his/her data for processing necessary for the performance of a task carried out in the public interest by the ECSC [Article 6 (1) (e) of the General Data Protection Regulation] or on the basis of a legitimate interest pursued by the ECSC or a third party [Article 6 (1) (f) of the General Data Protection Regulation], the ECSC will consider it as an objection to the data processing. If the objection is justified (there is no reason why the data must be processed), the ECSC will delete the data.
Where the data need to be processed for the performance of a contract or in order to take steps at the request of the data subject prior to entering into a contract, to comply with a legal obligation, or to protect the vital interests (e.g. the life) of the data subject or of a third party, the ECSC will delete the data when the personal data are no longer necessary, regardless of the request for deletion.
In other cases, the ECSC will delete the data if it is found that the processing of the data is unlawful or if there is a legal obligation under Hungarian or EU law to delete the data.
The ECSC may not delete data that the ECSC is obliged to process because of a legal obligation or because of the performance of its tasks in the public interest or because of a public interest in the field of public health (e.g. to prevent an epidemic threat situation). It is also necessary to retain data which must be processed for the purposes of scientific research or archiving or statistical purposes or for the establishment, exercise or defence of legal claims.
5.5. Requesting the restriction of processing
The data subject may request that the ECSC restricts the processing of his/her data. In this case, the data subject’s data will not be used by the ECSC, but only stored. The ECSC will restrict the processing of the data subject’s data if the data subject
- disputes that the data processed by the ECSC is accurate, but still needs to verify the accuracy of the data concerned,
- objects to the deletion of his/her data by the ECSC and requests that they be kept,
- wants the ECSC to keep his/her data because the data subject wants to use it to pursue a legal claim (for example, to bring a lawsuit)
- objected to the processing and it remains to be examined whether the data subject’s objection is justified.
The ECSC shall inform the data subject in advance of the lifting of the restriction.
5.6. Objection to data processing
The data subject may also object to the processing of personal data concerning him or her. If this objection is justified, i.e. there are no compelling legitimate grounds for the processing, the ECSC will cease the processing and delete the data.
The data subject may object if the processing is necessary for the performance of a task carried out in the public interest by the ECSC [Article 6 (1) (e) of the General Data Protection Regulation] or on the basis of a legitimate interest pursued by the ECSC or a third party [Article 6 (1) (f) of the General Data Protection Regulation].
In many cases – for example, where the ECSC has collected data with the data subject’s voluntary consent – the data subject’s objection is in fact a request for the deletion of his/her data, expressed only as an objection.
If the data need to be processed for the performance of a contract or in order to take steps at the request of the data subject prior to entering into a contract, to comply with a legal obligation, or to protect the vital interests (e.g. the life) of the data subject or of a third party, the ECSC will delete the data when the personal data are no longer necessary, regardless of any objection.
The ECSC may not delete data that the ECSC is obliged to process because of a legal obligation or because of the performance of its tasks in the public interest or because of a public interest in the field of public health (epidemic situation) or because it is necessary for the establishment, exercise or defence of legal claims.
5.7. Requesting human intervention for automated decision-making
Automated decision-making means that an automated process produces an outcome for the data subject based on the data provided and there is no part of the process where a human has a role in what will happen to the data subject based on their data. For example, based on your data, your job application is automatically evaluated and if you do not meet the predefined criteria, you will automatically receive a rejection message.
In the case of such processing, the data subject may request that a person review the decision when
- such automated decision-making is based on the data subject’s consent, or ,
- it is necessary for the conclusion of a contract with him/her or for taking the steps necessary for the conclusion of a contract (e.g. for the processing of a request for the conclusion of a contract).
Where automated decision-making is required by law, no human intervention may be requested.
5.8. Requesting data portability
The data subject may request that the data which s/he has provided to the ECSC and which are processed in the IT system be provided to him/her by the ECSC in electronic format so that it can be transferred to another controller.
The data subject may request the portability of the data for processing based on his/ her consent [Article 6 (1) (a) of the General Data Protection Regulation] or necessary for the performance of a contract to which the data subject is a party or for taking steps at the request of the data subject prior to entering into a contract [Article 6 (1) (b) of the General Data Protection Regulation].
Upon request, the ECSC will provide the data in .xml or .csv format, depending on the functionality of the data management system.
If the data subject requests that ECSC transfer his/her data directly to another controller, the ECSC will check whether it has an adequate data link to allow the secure and lawful transfer of the data and, if so, will transfer the data directly.
6. Information on legal remedies
If you are concerned about the way the ECSC manages your personal data, we recommend that you first contact the ECSC with your complaint. We will always investigate your complaint and do our best to address it.
If you still have a complaint about the way the ECSC manages your data, or if you do not wish to lodge a complaint but wish to contact the authority directly, you can file a complaint with the National Authority for Data Protection and Freedom of Information (address: 1055 Budapest, Falk Miksa utca 9-11., postal address: 1363 Budapest, Pf. 9., E-mail: ugyfelszolgalat@naih.hu, website: www.naih.hu).
You also have the right to take legal action to protect your data. In this case, you are free to choose whether to bring your action in the courts for the place where you reside (permanent address) or in the courts for your domicile (temporary address) (http://birosag.hu/torvenyszekek).
You can find the court in your place of residence or domicile at http://birosag.hu/ugyfelkapcsolati-portal/birosag-kereso.
[1] Regulation 2016/679 of the European Parliament and of the Council (EU) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: GDPR or General Data Protection Regulation)