1. General provisions

Gladiátor III Property Investment Fund (registered office: H-1095 Budapest, Máriássy utca 7.; represented by: GLADIÁTOR Befektetési Alapkezelő Zártkörűen Működő Részvénytársaság, registered office: H-1095 Budapest, Máriássy utca 7.; company registration number: Cg.01-10-049232; represented independently by: Sándor Gyáfrás Chief Executive Officer,
contact information: hancza(at)wing(dot)hu; hereinafter: Gladiátor III) operates the website https://hungariaofficepark.hu/ (hereinafter: Website).

The Website contains information related to the office rental service provided by Gladiátor III (hereinafter: Service) and facilitates the ordering of the Service.

The purpose of this privacy notice is to inform visitors to the Website and customers of the Service about the details of the processing of their personal data.

Gladiátor III, as controller, is responsible for the processing of personal data (collection, use, processing, storage, maintenance, etc. thereof) in accordance with applicable data protection laws, including in particular the General Data Protection Regulation of the European Union (EU Regulation 2016/679, hereinafter: GDPR).

2. Purpose of the processing of personal data and the legal basis for the processing of personal data

We process your personal data for the purpose of contacting you, at your request, in connection with the Service, introducing you to our Service and keeping in touch with you for the purpose of concluding a contract.

Legal basis for the processing if you are acting as a representative of a company:

• in the case of your data processed for the purpose of contact and introduction of services, your consent (Article 6 (1) (a) GDPR, consent),
• thereafter, during the communication for the conclusion of the contract, legitimate interest of Gladiátor III to contract with the company you represent in order to provide the Service through your data and by contacting you (Article 6 (1) (f) GDPR, legitimate interest).

If you are a natural person and acting on your own behalf:

• we process your data processed for the purpose of contact and introduction of services on the basis of your consent (Article 6 (1) (a) GDPR, consent),
• thereafter, during the communication for the conclusion of the contract, we process your personal data to conclude the contract (GDPR Article 6 (1) (b), contracting)

In addition to the above, when you visit our website, you will find information on the data related to website usage and its processing (cookies) in section 9 of this notice, and you can use the settings specified therein to determine the cookie settings and thus the processing of your Website usage data. In the case of data processed for the purpose of operating the Website, in order to ensure the functionality and essential functions of the Website (essential or necessary cookies), the legal basis for the processing is the legitimate interest of Gladiátor III (Article 6 (1) (f) GDPR, legitimate interest). For all other cookies, the legal basis for processing is your consent (Article 6 (1) (a) GDPR, consent).

3. The personal data we process

Your personal data we process is the data you provide when requesting a quote on the Website and which we collect about you when you use the Website.

Personal data provided when requesting a quote: name, email address, phone number.

4. Storage of personal data

Your personal data is stored on servers in use for the internal mail system (MS Office 365) used by our company. Microsoft’s information on this: https://www.microsoft.com/hu-hu/trust-center/privacy/data-location.

Should the details of the contract be recorded after the contact, the data will be stored on the servers of our contractual partner, Wing Zrt. (H-1095 Budapest, Máriássy utca 7.), which operates the server itself.

To ensure the security of your personal data, we have put in place internal organisational and state-of-the-art technical measures, in particular the following:

• Authorisation of access to personal data is determined based on internal authorisation procedures, and only those of our employees have access to the data, and only to those data, for whom and to which it is absolutely necessary, respectively.
• Systems and devices that contain or store personal data can only be accessed with user ID and password authentication.
• During the session, we use screen savers to prevent access to data on unused computers that require a password after a certain time and can be locked manually.
• We apply internal rules regarding password security (length, complexity and frequency of password change) and the use of passwords.
• Using firewalls prevents unauthorised access through the Internet.
• Access to data processing systems and workstations is logged.
• Remote access through the (SSL) VPN gateway is logged.
• Granting/modification of the access is logged.

In the case of consent-based data processing, we will actively process your personal data until the withdrawal of the consent, and for the purpose of concluding the contract, we will actively process your data until the conclusion of the contract between the parties or the failure to contract. Thereafter no substantive processing operation will take place, the emails containing the data will be archived. Data can be retrieved from archived emails only in special cases. Archived e-mails are deleted after 5 years, the legal basis for their retention is the legitimate interest of the controller in its secure operation.

We process your personal data processed through cookies for the period specified in our cookie information.

5. Data transfer

We do not transfer personal data about you to third parties other than the processors listed, unless required to do so by an authority, court or law.

6. Your rights regarding personal data

You may request information on the processing of your personal data, and may request the rectification of or, unless processing is mandatory, the erasure or blocking of your personal data through the controller’s contact details specified in this notice.

At your request, Gladiátor III will provide information on your data it processes or processed by the sub-processor it has engaged, or its source, the purpose, legal basis and duration of the processing, the name, address and activities of the processor related to the processing, and in the case of data transfer, the legal basis and the recipient thereof. The controller shall provide the information in an intelligible form, at the request of the data subject, in writing, as soon as possible after the submission of the request, but no later than within 30 days (unless otherwise provided by other law). This information is free of charge if the person requesting the information has not yet submitted a request for information to the controller for the same set of data in the current year. In other cases, Gladiátor III will charge you for the costs.

Gladiátor III will correct the personal data if it is inaccurate and the accurate personal data is at its disposal.

Gladiátor III will block personal data if the data subject so requests or if, on the basis of the available information, it can be presumed that the erasure would harm the data subject's legitimate interests. Blocked personal data may only be processed for as long as the purpose of the processing, which precluded the erasure of personal data, exists.

Gladiátor III will specify the personal data it processes if the data subject disputes its correctness or accuracy, but the incorrectness or inaccuracy of the disputed personal data cannot be clearly established.

Gladiátor III will delete personal data if its processing is unlawful, the erasure is requested by the data subject, the processed data is incomplete or incorrect and this situation cannot be lawfully remedied, provided the erasure is not precluded by law, the purpose of processing has ceased or the time limit for the storage of the data specified by law has expired or it has been ordered by a court or the National Data Protection and Freedom of Information Authority.

Gladiátor III has 30 days to delete, block or correct personal data. If the controller does not comply with the data subject's request for rectification, blocking or erasure, it shall state the reasons for the refusal in writing within 30 days. Gladiátor III will notify of the rectification, blocking, marking or erasure the data subject and all recipients to whom the data was transferred for processing. Gladiátor III will not notify if it does not violate the legitimate interest of the data subject with regard to the purpose of processing.

The data subject may object to processing of their personal data if

• the processing or transfer of personal data is necessary only for compliance with a legal obligation of the controller or for the enforcement of the legitimate interest of the controller, the recipient or a third party, unless the processing is required by law;
• the use or transfer of personal data is for the purpose of direct marketing, opinion polls or scientific research;
• in other cases specified by law.

Gladiátor III shall examine the objection within the shortest time possible from receipt of the request, but no later than within 15 days, bring a decision whether it is justified and notify the applicant of the decision in writing. If the controller establishes that the data subject's objection is justified, it shall cease the processing, including further collection and transfer of the data and block the data concerned, as well as notify of the objection and the ensuing measures all recipients to whom any of this personal data had previously been transferred and who must take measures in order to enforce the right to object. If the data subject does not agree with the decision made by the controller, he or she may contest it in court within 30 days of the communication thereof.

In the event of any breach of their rights, the data subject may have recourse to court against the controller. Such cases will be given priority by the court. Gladiátor III shall be liable for any damage caused to others as a result of unlawful processing of the data subject's data or by any breach of data security requirements. The controller shall be exempted from liability if the damage was caused by unavoidable reasons beyond the scope of processing. The controller shall pay no compensation to the extent that it resulted from the intentional or grossly negligent conduct of the aggrieved person.

Remedies may be exercised at and complaints may be lodged also with the data protection authority:

National Data Protection and Freedom of Information Authority

Registered office: H-1055 Budapest, Falk Miksa utca 9-11.
Phone: +36 1 391 1400
Fax: +36 1 391 1410
Email: ugyfelszolgalat(at)naih(dot)hu
Website: http://www.naih.hu

7. Data processors

A Gladiátor III uses Microsoft Co. (mail service provider) and Wing Zrt. (servers) as data processors for the processing of personal data.

8. What may be the consequences of not providing us with your data?

If you do not provide us with your personal data:

• you will not be able to indicate your interest to us through our Website and thus will not receive information about our Service, as well as we will not be able to contact you;
• if you do not consent to the use of cookies, certain features of the Website may not work properly;
• we cannot answer your question.

9. Cookie information

Processing in relation to the operation of the website. The Company has its own website, available at https://hungariaofficepark.hu/. The website automatically collects data (through cookies, Google Analytics, etc.).

Visitors' entry into and exit from the website is facilitated by small data packages (hereinafter: cookies) placed on and retrieved from the IT device of the visitors by the website.

Cookies are designed to enable the proper functioning of the website, improved service efficiency and anonymised statistical data collection. Visitors can delete cookies from their IT devices or cookies are automatically deleted when the browser is closed. Alternatively, the visitor can also disable the use of cookies in their browser settings. Visitors can continue to use the website even if they had manually disabled cookies in their browser settings.

The website uses unique temporary “spublic” cookies to identify workflows, in other words, to find out whether a visitor is logged on to the website or not. This way, “spublic” cookies facilitate visitors’ entry into or exit from the website. “Spublic” cookies are temporary cookies automatically deleted from the visitor’s IT device when closing the browser or can be deleted manually by the visitor in the browser settings. The following cookies are used to help establish the statistical data below regarding visits to and usage of the website collected for this purpose:

whether the visitor came from a search engine, a keyword or a link (“utmz” cookie),
how many times the visitor visited the website (“utmb” cookie),
how long the visitor stayed on the website (“utma” and “utmv” cookie),
when did the visitor first visit the website (“utma” and “utmv” cookie), and
when did the visitor last visit the website (“utmc” and “utmv” cookie).

In addition, some cookies protect the website from being overloaded (“utmt” cookie), and some cookies used by Google Analytics also record the IP address of the visitor’s IT device for analytical, statistical and security purposes. Data are stored on the visitor’s IT device. The independent measurement and auditing of usage and other web analytics data of the website is facilitated by servers of Google Analytics as a third-party provider using the cookies above.

Detailed information about the processing of measurement data is provided by the controller of these data at https://www.google.com/analytics/, and more details on Google’s data protection guidelines are available at http://www.google.hu/intl/hu/policies/privacy/.

Data transferred from the website to Google Analytics servers cannot directly identify visitors by themselves, and can only identify the IP address of the IT device. Purpose of processing: the provider records visitor data in order to monitor the functioning of the service and to prevent misuse during visits to the website. Scope of data processed: date, time, IP-address of the user’s computer, the URL of the website visited, the URL of the previous website visited, information about the visitor’s operating system and browser. Page 2 Gladiátor III Property Investment Fund Privacy and Data Security Policy Legal basis for the processing: the consent of the data subject pursuant to Article 6(1)(a) of the GDPR, and Section 13/A (3) of Act CVIII of 2001 on Certain Aspects of Electronic Commerce Services and Information Society Services. Storage period: 30 days from accessing the website. Means of storage: electronic. The data subject may request information on the processing of his or her personal data, and may request the rectification of or, unless processing is required by law, the erasure of the data subject’s personal data in the manner specified at the time of data collection or by contacting the controller through its specified contact details.