GAME RULES AND MANAGEMENT INSTRUCTIONS Promotional game "Earthquake Sweepstakes" (hereinafter referred to as the Game)

1. Short description of the Game.

The Promoter is running a promotional game to promote its newsletters, during which it will draw prizes among the Players who enter the Game.

2. The Organiser and Promoter of the Game.

Garzon Plaza Ltd.

Seats:	Győr, Vasvári Pál u. 1/b, 9024
the central administration:	Győr, Vasvári Pál u. 1/b, 9024
cg.	08 09 015113
tax number:	13995803-2-08
are represented by:	Matusz Balázs Charles

(hereinafter referred to as Organiser)

3. Duration of the Game.

20 June 2023 00:00 - 25 November 2023 24:00

4. Location of the Game.

https://ottevenyikastely.hu/ (previous and following Website)

5. Conditions of participation.

The Game is open to all persons who, by using the https://ottevenyikastely.hu/ website, subscribe to the Organiser's newsletter and accept these Rules (as described above and hereinafter Player).

If the Player does not wish to participate in the Game after his/her application, he/she may [email protected]-to the Promoter by sending a letter to the Promoter, in which case the Promoter will remove the Player from the lottery database.

6. How the Game works.

Players will be drawn by the Promoter at 12:00 on 14 November 2023.

7. Winnings.

The following Prize will be drawn by the Promoter at the Prize Draw (as defined above and hereinafter Prize draw)

• ?
• ?

8. Receipt of the Prize.

In order to transfer the Prizes, the Promoter will contact the winners directly using the email address or telephone number provided during the newsletter subscription process and will make it public on the Promoter's Facebook page. The Winner will be contacted within 30 (thirty) calendar days after the draw, and the non-winner will not be contacted separately by the Promoter.

9. Data management.

The data controller is.

The Game Organiser is the data controller.

e-mail address: Data Protection Officer:

[email protected] Dr. Zsuzsanna Ducsay LL.M., attorney-at-law (Ducsay Law Office; registered office: 1124 Budapest, Apor Vilmos tér 25-26.; e-mail: [email protected]

The Data Controller informs the Player that the provision of his/her data is voluntary, however, the provision of such data is a prerequisite for participation in the Game, as the Data Controller cannot conduct the Game without the provision of the personal data indicated.

Purpose of the processing.

The Game will be conducted in accordance with these Rules.

Legal basis for processing.

Article 6(1)(a) of the GDPR, i.e. the consent of the Player (or hereinafter referred to as the "Data Subject"), which he/she gives by ticking the appropriate box in the User Account window in Section 6 of these Rules and clicking on the "I Play" button.

In this context, the Data Controller explicitly invites the Player to withdraw his consent to the processing as provided above at any time, by means of a declaration addressed to the Data Controller in an informal form, which does not affect the lawfulness of the processing until the consent is withdrawn.

In the event of withdrawal of consent, the Controller shall delete the Player's data within 24 (twenty-four) hours of the withdrawal, unless there is another legal basis for further processing.

Source of data.

With regard to the User Account in which the data is stored, the Data Controller presumes that the source of the data is the Player himself.

The data processed.

The name provided by the Player and the e-mail address, telephone number, first and last name provided by the Player when creating the User Account.

Duration of processing.

Data processing in connection with the Game shall continue until the withdrawal of consent, but no later than 8 (eight) calendar years from the end of the Game.

Recipients and Data Processors.

In principle, the controller does not intend to disclose personal data to others, and the following persons may act as processors in principle.

• the server provider providing the IT background is Hetzner Online GmbHIndustriestr. 2591710 Gunzenhausen, Germany
• the company providing accounting or bookkeeping services for its accounting records: ESZTOM Könyvelő- és Tanácsadó Korlátolt Felelősségű Társaság (registered office: 1134 Budapest, Lehel utca 12.);
• the Data Controller's auditor is BPO-AUDIT Auditing and Management Consulting Limited Liability Company; registered office: 5 Zichy Géza utca III. floor, Budapest, HU-1146 Budapest. 1-2.
• a company or individual entrepreneur providing a so-called customer relationship management system that may be used by the Data Controller.
• the Data Controller's legal representative, service provider providing assurance.
• FOXPOST Zrt. (registered office: 3300 Eger, Pacsirta utca 35/A.) as the carrier of the deliveries.

Data transfers to third countries.

The Data Controller does not transfer data to third countries.

Profiling and automated decision-making in individual cases.

The Data Controller does not use profiling or automated decision-making.

Description of the rights of the data subject - with the relevant official guidance.

Under Articles 57(1)(f) and 77(1) of the GDPR, all data subjects, including you, have the right to lodge a complaint with the Authority if you consider that the processing of personal data relating to you infringes the GDPR. However, the Authority's practical experience shows that in the vast majority of cases, data controllers would cooperate with data subjects and restore the lawfulness of the processing on their own initiative if they received a specific request for the processing they object to.

The Authority therefore Proposes to the Data Subject, to contact the data controllers directly before lodging a complaint in order to deal with cases more quickly and efficiently, and exercise your rights as a data subject by.

In principle, any data subject can apply to the controller:

• access to your personal data accessed from,
• your personal data correction,
• your personal data deletion of,
• the specific processing restrictions,
• your personal data portability,
• also to object against the processing of your personal data - THIS RIGHT OF DATA SUBJECTS SHALL NOT APPLY TO DATA PROCESSING THAT CONFLICTS WITH THESE RULES, IN VIEW OF THE LEGAL BASIS FOR THE PROCESSING.

The Data Controller hereby expressly draws the attention of the Data Subject to the fact that the right to object shall not apply to the processing covered by this Privacy Notice, given that none of the processing activities is based on the legitimate interests of the Data Controller or of a third party, nor is the processing carried out for reasons of public interest.

Whatever the request for the exercise of any of the data subject's rights, the Data Controller shall inform the Data Subject of the action taken in response to the request without undue delay and in any event within one month of receipt of the request. If necessary, taking into account the complexity of the request and the number of requests, this time limit may be extended by a further two months. However, the Data Controller shall inform the Data Subject of the extension of the time limit within one month of receipt of the request, stating the reasons for the delay.

If the Data Controller fails to take action on the Data Subject's request, the Data Controller shall inform the Data Subject without delay, but no later than one month after receipt of the request, of the reasons for the failure to act and of the possibility to lodge a complaint with the Authority and exercise his/her right to judicial remedy before the competent court in the place of residence or stay (for the contact details of the courts, please see the link below: http://birosag.hu/torvenyszekek).

If the Data Controller has reasonable doubts about the identity of the Data Subject when making a request to exercise a data subject's right, the Data Controller may request the Data Subject to provide additional information necessary to confirm his or her identity.

Information and action on requests from the data subject are, in principle, free of charge. However, where the request is manifestly unfounded or excessive, in particular because of its repetitive nature, the Data Controller may, taking into account the administrative costs of providing the information or information requested or of taking the action requested, charge a reasonable fee or refuse to act on the request. However, the burden of proving that the request is manifestly unfounded or excessive shall lie with the Controller.

Article 37 of the GDPR specifies the cases in which the controller and the processor shall appoint a DPO, although the appointment of a DPO by the Controller is not mandatory, but given that such a person has been appointed voluntarily, the Authority recommends that the Data Subject should generally seek the assistance of a DPO in such cases.

If the Data Controller fails to comply with a request of the Data Subject in a verifiable manner, taking into account the above time limits, the Authority shall investigate the matter on the basis of a complaint.

• Your right to access your personal data

On the basis of this right, the Data Subject is entitled to receive feedback from the Controller on whether or not his or her personal data are being processed and, if such processing is taking place, to have access to his or her personal data and to the information listed in the General Data Protection Regulation (e.g. the purposes of the processing, the legal basis for the processing, the recipients or categories of recipients of the personal data, and, in the case of transfers to third countries or international organisations, the information relating to; the duration or aspects of the processing, the data subject's rights, remedies, consequences of not providing the data).

The Data Controller shall provide the Data Subject with a copy of the personal data subject to processing. However, as a general rule, the Authority draws the attention of the data subject to the fact that the controller may charge a reasonable fee based on administrative costs for the additional copies requested and that the exercise of the right to request a copy must not adversely affect the rights and freedoms of others.

• Your right to rectify your personal data

On the basis of the right to rectification, the Data Subject shall have the right to obtain from the Data Controller, upon his or her request, the rectification of inaccurate personal data concerning him or her without undue delay, and the right to obtain the completion of incomplete personal data.

• Your right to have your personal data erased and "forgotten"

As a general rule, the Data Subject's right to erasure entitles the Data Subject to have his or her personal data erased by the Data Controller without undue delay upon his or her request, and the Data Controller is obliged to erase the data without undue delay under certain conditions.

The right to "be forgotten" is an extension of the right to erasure to the online environment, whereby, if the Data Controller has disclosed the Data Subject's personal data and is required to erase it, the Data Controller must take reasonable steps to inform the Data Controllers that process the Data Subject's personal data that the Data Subject has requested the erasure of links to or copies of the personal data.

In relation to this data subject right, it is important to note, however, that it is not possible to erase and "forget" personal data if one of the cases set out in Article 17(3) of the GDPR applies.

• Your right to restrict the processing of your personal data

The Data Subject has the right to have the Data Controller restrict, commonly known as block, the processing of his or her data at his or her request if one of the following conditions is met:

• the Data Subject contests the accuracy of his or her personal data. In this case, the restriction shall apply for the period of time that allows the Controller to verify the accuracy of such personal data;
• the processing is unlawful and the Data Subject opposes the erasure of the personal data and requests instead the restriction of their use;
• the Controller no longer needs the personal data for the purposes of processing, but the Data Subject requires them for the establishment, exercise or defence of legal claims;
• the Data Subject has objected to the processing; in this case, the restriction applies for the period until it is established whether the legitimate grounds of the controller prevail over those of the Data Subject.

 

• Your right to the portability of your personal data

On the basis of this right, the Data Subject has the right to receive personal data concerning him or her which he or she has provided to the Controller in a structured, commonly used, machine-readable format and the right to transmit such personal data to another controller without hindrance from the controller to which he or she has provided the personal data. You may exercise this right where the processing is based on consent or a contract and the processing is carried out by automated means.

In this context, the Data Controller also explicitly and repeatedly invites the Player to withdraw his/her consent to data processing as provided above at any time, by means of a declaration addressed to the Data Controller in an informal form, which does not affect the lawfulness of the processing until the consent is withdrawn.

In the event of withdrawal of consent, the Controller shall delete the Player's data within 24 (twenty-four) hours of the withdrawal, unless there is another legal basis for further processing.

 

The Data Subject's right to complain and seek redress.

The Data Subject shall have the right to lodge a complaint with the competent National Authority for Data Protection and Freedom of Information (hereinafter referred to as the "Authority") in relation to or in connection with the processing of personal data. Authority), or directly bring civil proceedings against the Data Controller before the competent court.

Contact details of the Authority, on the Authority's website at www.naih.hu ; the Authority's short telephone numbers are +36/1-391-14-00 and +36/1-391-14-10 and +36/30-683-5969 and +36/30-549-6838; e-mail address: [email protected], headquarters: 1055 Budapest, Falk Miksa utca 9-11.; postal address: 1363 Budapest, Pf. 9.; office gateway: short name: NAIH; KR ID: 429616918.

The Data Subject may initiate civil proceedings against the Data Controller, applying the provisions of Act CXXX of 2016 on Civil Procedure, with the understanding that the case shall be subject to the jurisdiction of a court, the jurisdiction being determined either by the place of residence (or domicile) of the Data Subject or by the seat of the Data Controller, and the court shall act out of turn in the settlement of the claim.

However, before filing a complaint with the Authority or initiating possible civil proceedings, it may be useful for the Data Subject to notify the Data Controller directly of his or her grievance by sending an informal request to any of the contact details of the Data Controller as set out in this Notice or to any of the contact details of the Data Protection Officer. In such a case, the Data Controller shall contact the Data Subject directly, as soon as circumstances permit, in order to resolve the situation as soon as possible and on the basis of the consensus of the parties.

11. Miscellaneous provisions.

The Game is not considered a game of chance, it is considered a promotional game only under Act XXXIV of 1991 on the organisation of games of chance.

Tax liability in relation to the Prizes is borne by the Promoter.

The Promoter is not involved in providing the technical conditions necessary for participation in the Game.

The Promoter shall not be liable for any compensation, indemnity or other claim in connection with participation in the Game, or for any costs, damages or losses arising from or related to any errors, omissions or defects in the Game or its operation.

The Organiser excludes all liability for unforeseeable events beyond its control (force majeure) or the actions of third parties for which it is not responsible.

The Promoter excludes its liability for any damages suffered by the Player from any third party due to false, incorrect, inaccurate or incomplete information, participation of an incapacitated person or a person with limited legal capacity who is not eligible to participate without the consent of a legal representative, or any other cause.

The Promoter excludes all liability for any misuse of the participation in the Game.

By accepting these Game Rules, the Player acknowledges that the content, performance, message and data transmission and response speeds of the technical infrastructure of the Game are dependent on the server technology and may be adversely affected by factors beyond the control of the Promoter, such as (but not limited to) connection failure, server computer performance, network congestion, network congestion, coverage and the maintenance of a secure network connection. No claim shall be made or be enforceable against the Organiser in respect of any of the events set out in this paragraph.

The Organiser's executives, employees, agents and their close relatives, other direct contributors to the running of the Game and their close relatives are not eligible to become Players.

The Organiser disclaims any liability for any external attacks on the venue and the server running the venue, so-called SQL attacks. If, as a result of an attack on these websites or servers, the Players receive incorrect system messages regarding their prizes, winner/non-winner status, etc., the Promoter shall not be held liable for such cases and no claims may be made or enforced against it in such cases.

Players who, contrary to the spirit of the Game, participate in the Game in a team under the name of a natural person, or with a fictitious character, with mass-generated e-mail addresses, with the aim of increasing their chances of winning by such deceptive and unlawful conduct, may be excluded from the Game, by unilateral decision of the Promoter, with immediate effect. Such participants include, for example, persons associated for the purpose of participating in sweepstakes and other prize draws, who coordinate their actions in order to obtain prizes and combine the performances of several persons under one name, thereby depriving other Players who wish to play fairly of the chance to win. Such persons shall also include those who participate in the Game with false information. Participants or Players who engage in the dishonest conduct set forth in this paragraph shall be liable to compensate the Promoter for any damage caused to the Promoter in connection with the Game in the amount and when due, as set forth in the Promoter's written demand to that effect.

Any external interference with the registration of Players, sending of winning/non-winning messages, etc. by any means not available as part of the venue will result in the immediate disqualification of the Player.

The Organiser's server clock data will be used for the purposes of the Game.

The Player may not claim or enforce any right to exchange or convert the Prize into cash against the Promoter.

The Promoter reserves the right to amend these Rules and Conditions of the Game at any time without giving any reason, or to terminate the Game, in which case no claim may be made or enforced against the Promoter.

Any questions regarding the Game, its procedure and the prizes can be answered by the Promoter at the following contact details: [email protected]

 

Győr, 25 June 2023.

Garzon Plaza Ltd.