ONLINE PRIVACY POLICY

v2.0 (2018-05-25)

1. General Provisions

(1) During the controlling of natural person’s personal data in connection with the services provided under the Portal available through the domains vcc-live.hu; vcc-live.de; vcc.live; vcc-live.ro; vcc-live.pl, members of VCC Live Group and data controllers shall act in accordance with this Data Controlling Policy and Information.
By using the Portal, you agree to the provisions of this Data Controlling Information.
Members of the VCC Live Group form a group of enterprises as construed for the purposes of the GDPR. The controlling undertaking shall be the undertaking that can exert a dominant influence over the other undertakings by virtue, for example, of ownership, financial participation or the rules which govern it or the power to have personal data protection rules implemented. An undertaking which controls the processing of personal data in undertakings affiliated to it should be regarded, together with those undertakings, as a group of undertakings.

Members of the VCC Live Group

Data of the controlling company:

Company name: VCC Live Group Zártkörűen Működő Részvénytársaság
Registered seat: 6725 Szeged, Hópárduc utca 17., Hungary
Branch address: 1123 Budapest, Nagyenyed utca 8-14.
Company register number: 06-10-000447
Mailing address: 1123 Budapest, Nagyenyed utca 8-14., Hungary
Electronic (e-mail) address: info@vcc.live
VAT ID: 24670023-2-06

Data of controlled companies:

Company name: VCC Live Hungary Korlátolt Felelősségű Társaság
Registered seat: 1123 Budapest, Nagyenyed utca 8-14., Hungary
Company register number: 01-09-735941
Mailing address: 1123 Budapest, Nagyenyed utca 8-14., Hungary
Electronic (e-mail) address: info@vcc.live
VAT ID: 13452696-2-43
Data protection register No: NAIH-59503/2012. and NAIH-60651/2012

Company name: VCC Live Germany GmbH
Registered seat: Gontardstraße 11, 10178 Berlin, Germany
Company register number: HRB 190017 B
Mailing address: 1123 Budapest, Nagyenyed u. 8-14., Hungary
Electronic (e-mail) address: info@vcc.live
VAT ID: DE277993151

Company name: VCC Live Poland Sp.zo.o
Registered seat: 00-805 Warszawa, Chmielna 132/134, Poland
Company register number: 0000542073
Mailing address: 1123 Budapest, Nagyenyed utca 8-14., Hungary
Electronic (e-mail) address: info@vcc.live
VAT ID: PL 527279657

Company name: VCC Live RO Srl
Registered seat: Bucuresti, Sectorul 1, Strada Buzesti Nr. 50-52, Camera (Modul) 93, Etaj 11., Romania
Company register number: J40/13677/13,07,2017
Mailing address: 1123 Budapest, Nagyenyed utca 8-14., Hungary
Electronic (e-mail) address: info@vcc.live

Company name: VCC Live USA Inc.
Registered seat: State of Delaware, Centerville Road, Suite 400, City of Wilmington, County of New Castle, Delaware 19808
Mailing address: 1123 Budapest, Nagyenyed utca 8-14., Hungary
Electronic (e-mail) address: info@vcc.live

Center of activities: 1123 Budapest, Nagyenyed utca 8-14.

The representative of VCC Live Group:
Name: Tóth Szabolcs
email: szabolcs.toth@vcc.live
phone: +36 1 999 7400

VCC Live Group’s Joint Data Protection Officer:
name: dr. Seres Rita
email: rita.seres@vcc.live
phone: +36 1 999 7400

(2) The objective of this data protection information leaflet is to establish the scope of the controlled personal data and the method of data controlling, along with ensuring that the constitutional principles of data protection and the requirements of data security are adhered to. It aims to prevent unauthorized access to data, alteration, or unauthorized publication or use of data to protect natural person user’s privacy.

(3) To achieve the goals set out in subsection (2), your personal data will be handled confidentially, in line with the operational statutory provisions. We ensure their security and take the technical and organizational measures and create the procedural rules necessary to meet the pertinent statutory requirements and other recommendations.

(4) When controlling personal data, we adhere to the requirements of the operational data protection regulations, including individual industry regulations at all times. This especially pertains to the requirements of the regulation (EU) 216/679 of the European Parliament and Council (General Data Protection Regulation, hereinafter: GDPR).

2. Legal Basis for Data Controlling

We control the personal data disclosed to us by you through the Portal in compliance with the pertinent data protection regulations and base our respective activity on your express, prior, and voluntary consent.

You are entitled to withdraw your consent to controlling your data, however, such withdrawal shall not affect the lawfulness of the data controlling activities completed in accordance with the consent, prior to the withdrawal thereof.

3. Scope of Controlled Data, Purpose, and Term of Data Controlling

3.1 Newsletters

On our Portal, we offer the possibility to sign up for our newsletter. We only send you newsletters if you have given your consent to receive them by ticking the corresponding box on the Portal.

If you opt for our newsletter services, we will control the following data:

a. When subscribing to our newsletter, you have to disclose the following data:

• full name (optional)
• email address

b. If you subscribe to our newsletter services, in addition to the above, the following data will be stored/processed in connection with you:

• used/preferred language
• the domain name you subscribed our newsletter through
• date and time of subscription
• IP address

The objective of Data Controlling:

To continuously inform you, as a user with a subscription to our newsletter, about the latest news and information with regards to our services.

You may unsubscribe from our newsletter at any time, without restriction or justification, free of charge. In such cases, we will delete your data from our records without delay.

You can unsubscribe by clicking the link included in the newsletter or by emailing to marketing@vcc.live.

Legal Basis for Data Controlling: Your prior, voluntary approval

Term of Data Controlling: Until the withdrawal of your consent.

Data Processor: Mailchimp – The Rocket Science Group LLC (address: 675 Ponce de Leon Ave NE Suite 5000, Atlanta, GA 3038, https://mailchimp.com/)

3.2 Applications for Job Adverts and Uploading CV-s in under “Career”

On our Portal, you may apply for open positions under the menu “Careers”. You can apply by disclosing the following data and by uploading your CV:

• full name
• e-mail address
• telephone number
• short text message, which may contain personal data.

Purpose of data controlling: filling the advertised position; if consent to storing the application data is granted, a further purpose shall be your information about job openings matching your qualifications, skills and intentions.

Legal basis for data controlling: Your prior, voluntary approval

Term of data controlling:

• If you are not selected for the position you applied for, or you decide to withdraw your application before the applications are evaluated, the purpose of data controlling will cease to exist, and we delete your data and CV from our database.
• If, incidental to being informed about the results of your application, or when withdrawing your application, you give your express consent to retain your application for 24 months and/or to receive information about job openings that match your qualifications, we delete your data and CV from our database after the expiration of 24 months.
• If you are selected for the position, we will act in accordance with the rules of controlling our employees’ personal data, regarding which we will inform you when establishing employment relations.

Persons entitled to view the data:

• The HR Manager and HR team members involved in the selection process To the extent and duration absolutely necessary to carry out their tasks

Data processor: MiniCRM Zrt. (address: 1075 Budapest, Madách Imre út 13-14., https://www.minicrm.hu/)

3.3 Contacting Us through the Portal

On our Portal, you may initiate contact with us by disclosing certain data. When filling out the contact form, we give you an opportunity to subscribe to our newsletter, as per point 4.1.

When contacting us, you have to disclose the following data:

• Name
• Phone
• Email
• Number of operators
• Message
  
  

Purpose of data controlling: establishing contact
Legal basis for data controlling: Your prior, voluntary approval
Term of data controlling: Until the withdrawal of your consent.

In connection with your contacting us, in addition to the above, the following data will be controlled by us:

• The country, where you stayed at the time of contacting us
• The address of the URL-s of VCC Live Group you have previously visited (up to a 100 sites)
• If you signed up to our newsletter during contacting us, the fact of the subscription
• The URL address of the referrer site, where you were redirected to the website of VCC Live Group from.
• Your IP address
  
  

Purpose of data controlling: Preparation of a customized offer/cooperation
Legal basis for data controlling: Your prior, voluntary approval
Term of data controlling: Until the withdrawal of your consent.
Data processor: Pipedrive OÜ (address: Paldiski mnt 80, Tallinn 10617, Estonia, https://www.pipedrive.com/)

3.4 Use of Chat Application

You may initiate communication with the customer service staff by using the button “Live Chat” on the Portal.

The purpose of chat communication is to maintain customer relations and may involve personal data.

Purpose of data controlling: initiating contact; general information with regards to questions you asked from us; reporting bugs

Legal basis for data controlling: Your prior, voluntary approval

Term of data controlling:

• for contact forms and for general information services, 1 year from recording the data
• for data associated with reporting bugs, 1 year from recording the data

3.5 Cookies

We place an anonymous identification file (cookie) on your device, which in itself is not suitable to identify you in any way. It is only suitable to recognize your device. No names, e-mail addresses or any other personal information is necessary, as when the solution is applied, you are not disclosing us any personal data. The exchange of data only happens between the devices.

The aim of handling cookies is to find out more about your information use preferences, thus being able to improve our services. It also aims to facilitate displaying customized pages and marketing (advertisement) material to you.

You may block the placement of cookies on your device any time by adjusting your browser settings. At the same time, please note that blocking cookies will cause certain services to not work properly.

What kind of cookies are we using?

There are cookies that are essential for the operation of the Portal. These are the so-called technically necessary cookies. We may use these cookies without your permission.

• Cookies storing data recorded by you: By closing the browser window, these cookies will be deleted from your device automatically. These cookies only serve the identification of your device and do not store any information associated with your person.
  
  

• Authentication session cookies: their purpose is to be able to identify users upon signing in, therefore, being able to ensure access to their personal pages. These cookies allow you to navigate to pages without having to sign in again and again upon each click.
  
  

• User-centered security cookies: These are cookies that are designed for exact tasks to enhance the security of services expressly requested by the user. These are for example the cookies that are used to detect repeated unsuccessful login attempts to the website or other, similar mechanisms created to protect the login system against fraud. Though session cookies are set to expire when the session ends (upon closing the browser window), security cookies are expected to have a longer expiration time to be able to do their job.
  
  

• We use customization cookies to store user preferences associated with the service through the website that are not linked to other permanent identifiers, such as user names. (For example, cookies pertaining to the preferred languages or the form of displaying search results).
  
  

There are cookies that are aiming to enhance user experience. These are the following:

• Cookies to improve performance: Collects data about your use of the portal. We are using Google Analytics cookies to understand our users’ behavior and preferences: what sub-sites they visit, how often, and for how long. These cookies only serve the identification of your device. The collection of data is anonymous.
  
  

• Targeted cookies: Allows us to display targeted, relevant ads to you. In addition, these cookies also facilitate connection to social media. They only serve the identification of your device. The collection of data is anonymous.
  
  

• We use remarketing services, for example, the remarketing services of Google AdWords to have our customized advertisements reach you. You may block these cookies in the control panel of your Google advertisement settings, as per the instructions thereof. For Google’s data protection policy with regards to advertisements, click here.

3.6 Use of Social Media Add-Ons (Facebook, Twitter, LinkedIn)

On our Portal, these add-ons are blocked by default. The add-ons are only allowed if your click on the respective button. By allowing the extension, you will create a connection with the social media platform and you authorize disclosure of your data to the platforms Facebook/Twitter/LinkedIn.

If you have a Facebook/Twitter/LinkedIn account, the given social media platform may link your visit to your account.

By clicking the corresponding button, your browser will transfer the pertinent information directly to the given social media platform and store it there.

• Twitter’s server will record data about your activity on the Portal and links these data with your Twitter account. Upon using the button “re-tweet”, these data will be available for Twitter users and/or published.
• When you are browsing on the Portal, through the integrating modules you build a direct datalink between your browser and Facebook’s server. Through this, Facebook receives the information that somebody from your IP address visited this Portal. If you are using these integrating modules (for example by clicking Like or Share, Comment, etc.) while you are logged in to your Facebook account, the relevant contents of the Portal will be linked to your Facebook profile. In such cases, Facebook will link your activities on the Portal to your Facebook account.
• LinkedIn’s server will record data about your activity on the Portal and links these data with your LinkedIn account. Upon using the LinkedIn button Share, these data will be available for LinkedIn users and/or published.
  
  

Further information with regards to the scope and purpose of data collection, further processing of your data by Facebook/Twitter/LinkedIn, your rights to the protection of your personal data are available in the privacy statement of Facebook/Twitter/LinkedIn.
https://www.facebook.com/policy.php
https://twitter.com/privacy
https://www.linkedin.com/legal/privacy-policy

3.7 Log Files

To allow the use of the services and technical operation of the website, along with statistical purposes, the system automatically logs the following data:

• dynamic or static IP address of your device
• depending on your device settings, the type of your browser and operating system
• your activities associated with the website
• date and time of the activity

Term of data storage: 90 days from recording the data

Purpose of data controlling: On one hand, the use of these data serves technical purposes, such as analysis and a subsequent check of safe operation of servers. On the other hand, these data are used for creating visitor statistics and to analyze user preferences to improve our services.

The above data are not suitable to identify you and they are not linked to other personal data.

Any personal data associated with you may be controlled by us for purposes other than the purposes specified above – especially to improve the efficiency of services or for market research – provided that we have specified the purpose of data controlling in advance and have your consent.

These data may not be linked to your identification information and may not be disclosed to third parties without your approval.

Prior to using our services, we allow you to familiarize with the types of data controlled by us and the purposes of such data controlling, including controlling of data not directly linked to you.

3.8 GDPR E-Book

VCC Live has compiled a comprehensive overview of the implications of GDPR for Contact Center operations, which is available to everyone and can be freely downloaded from VCC Live’s website.

Controlled personal data: first name, last name, email address

Purpose of data controlling: making the ebook available

Legal basis for data controlling: Your prior, voluntary approval [GDPR Article 6 (1) a.) point]. You are entitled to withdraw your consent to controlling your data, however, such withdrawal shall not affect the lawfulness of the data controlling activities completed in accordance with the consent, prior to the withdrawal thereof. You can revoke your consent by sending an email to legal@vcc.live

Term of data controlling: 10 working days

Recipients of personal data: our own employees, agents, and other contributors who need to view such data to fulfil their professional functions or the tasks assigned to them. We shall ensure that individuals are entitled to view the data controlled by us adhere to the provisions of this Privacy Policy and the applicable statutory requirements at at all times.

4. Information and Contact Details of Data Processors:

Information on data processors used by us is available in point 3.

During our data controlling activities, in addition to what’s established in point 3, we use the following data processors:

• To gain access to the Portal’s independent visitor numbers and other web analytics data, we use the software Google Analytics. Therefore, with regard to these data, Google Inc. acts as a data processor. Google Inc.’s Privacy Policy is available at http://www.google.com/intl/hu ALL/privacypolicy.html. By using the Portal you give your consent to Google to process your data.
• Data of the server service provider: Vultr Holdings Corporation (14 Clifford Ave., Suite 300, Metropark South, Matawan, NJ 07747)

We reserve the right to use further data processors other than the ones listed above, provided that we publish such data processors’ names and addresses until, but the latest at the time of the start of data processing.

5. Persons entitled to view personal data

Our own employees, agents, and other contributors who need to view such data to fulfill their professional functions or the tasks assigned to them. We shall ensure that individuals are entitled to view the data controlled by us adhere to the provisions of this data controlling information leaflet and the applicable statutory requirements at all times.

6. Your Rights with regards to Data Controlling

6.1 Right to Request Information

(1) Upon your request, we inform you in writing about your data controlled by us and/or processed by the data processor instructed by us, their sources, the purpose, legal basis and term of data controlling, the name and address of the data processor and its activities concerning the data processing – if your personal data are transmitted, the legal basis and recipient of such transmission – without delay, but within 25 days from submission of your corresponding request the latest.

(2) This information is provided free of charge. However, if the request is clearly unfounded, or – especially if it is repetitive – exaggerating, considering the administrative costs of providing the requested information or taking the requested measures:

1. we may charge you a reasonable fee, or
2. we may deny your request.

The burden of proof that the request is clearly unfounded, or exaggerating is on us at all times.

6.2 Right to Erasure

(1) We shall delete personal data, if

1. controlling thereof is unlawful;
2. You withdraw your consent forming the basis of data controlling or you request deletion of your data from our database and there is no other legal basis for the controlling of such data;
3. the data are incomplete or wrong – and this condition may not be lawfully remedied – provided that deletion is not prohibited by law.
4. purpose of the data controlling ceased to exist, or the statutory term of retaining of data has expired;
5. deletion of the data was ordered by the court or the competent authority.

(2) Instead of deletion, we block the personal data, if the data subject requests us to do so, or based on the information available to the data subject, it can be assumed that deletion would infringe your legitimate interests. Personal data blocked this way may only be controlled until the purpose of data controlling precluding deletion of the personal data exists.

6.3 Right to Access

(1) You are entitled to receive feedback from us whether controlling of your personal data is in progress, and if this is the case, you are entitled to access to your personal data and the following information:

1. purpose of data controlling:
2. data categories of the affected personal data
3. recipients your personal data are or will be disclosed to, especially recipients in third countries or international organizations
4. the term of retaining data, or if not possible, the factors of establishment of this term
5. your right to request corrections, deletion or restriction of controlling of your personal data and your right to object against controlling of such personal data;
6. the right to submit grievances to any supervisory authority;
7. if you are not the data subject of such data, all available information with regards to their sources

(2) The copy of the personal data forming the subject of data controlling shall be disclosed to you. For further copies requested by you, we charge a reasonable fee, based on the data controller’s administrative costs. If the request was submitted electronically, we disclose the information in a widely used electronic format, except requested otherwise.

6.4 Right to Rectification

(1) Upon your request, we correct your personal data without delay.

(2) If the true and correct or supplementing data is not available, we base our correction/supplement on your supplementing statement.

6.5 Right to Object

(1) You may object against controlling your personal data, if

1. if controlling or transmission of personal data is necessary to fulfill our legal obligations or to protect our or third parties’ legitimate interests only, except where data controlling is mandatory;
2. if your personal data are used or transmitted for directly soliciting business, for opinion-polls or for scientific research; or
3. in any other cases defined by law.

(2) We examine your objection and suspend data controlling without delay, but within 15 days from submission of the request at the latest, and we inform you about the results in writing.
If the objection is justified, we shall cease controlling your data, including further data collection and data transmission, and block such data. We also shall inform all parties the respective personal data were transmitted to earlier about our measures. These entities shall take measures to grant such rights to objection.

If you do not agree with our decision, or, if we fail to fulfill the above obligations within the 15 days deadline, you may submit your redress request to the competent court within 30 days from receipt of the decision or from the last day of the above deadline.

6.6 Right to Restriction of Data Controlling

(1) We will restrict data controlling, if one the following circumstances exist:

1. You challenge the accuracy of the personal data;
2. Data controlling is unlawful, and you object to the deletion of your data, instead, you request the restriction of controlling thereof;
3. We no longer need your personal data for data controlling, but you request those for submission, representation or protection of your legal claims, or
4. You have objected to data controlling

(2) Except for storage, if data controlling falls under restrictions, the affected personal data may only be controlled with your consent, for submission, representation or protection of legal claims or to protect the rights of third parties (natural persons or legal entities), or if in the interest of the European Union or any member state.

6.7 Right to Data Portability

You shall have the right to receive the personal data concerning you, which you have provided to a controller, in a structured, commonly used, and machine-readable format, if data controlling is based on your consent or a respective agreement, and data controlling is carried out with automated methods.

If your request to rectify, restrict or delete your personal data may not be granted, we shall inform you about rejection of your request and its substantive and legal justification in writing within 25 days from receipt thereof.

Your rights under this point 7 may be restricted to safeguard the State’s internal or external security, including purposes of home defense, national security, crime prevention and -prosecution, law enforcement, to protect the economic- or financial interests of the State, to prevent and investigate disciplinary- and ethical offenses committed on the job or omission of employment law- and health and safety obligations – always including oversight and supervision -, and to protect your or third party rights.

7. Legal Redress

If you experience an infringement of your rights, you may request remedy from:

1. the competent supervisory authority in the member state
   • Contact details of supervisory authorities of the individual member states are available here:
     http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm
2. the competent court with jurisdiction over your area of permanent or temporary address.