Legal Disclaimer

Information

All information, data, conditions, definitions or descriptions appearing on the website are solely of informative nature, the usage of these is the user’s own responsibility. The information provided is not intended to replace or serve as substitute for any offer, advisory or other professional advice, consultation or service.

Copyright

As the content of the websites and downloadable documents on the websites of Cellum are under copyright protection, any unauthorised use of any materials on the site may violate trademark or other laws. All use other than for personal purposes of such materials requires prior written consent from Cellum.

Exclusion of liability

In no event shall Cellum or employees be liable for any direct, indirect, incidental, special, exemplary, punitive, consequential or other damages whatsoever (including, but not limited to, liability for loss of use, data or products), without regard to the form of any action, including, but not limited to, contract, negligence or other tortuous actions, arising out of or in connection with the Site, any content on or accessed by use of the Site, or any copying, display or other use thereof.

Privacy Policy

1. Introduction

Cellum Global Zrt. (Address: 8600 Siófok, Új-Piac tér 8., Hungary; Registry no.: Cg.: 14-10-300278, Tax no.: 23471625-2-14), hereinafter referred to as “Cellum”, “supplier”, or “data handler”), in its capacity as a data manager

1. agrees to be bound by the stipulations of this privacy policy;
2. warrants that its data management operations, rendered in connection with its services, shall comply with the requirements set forth in this privacy policy and in other relevant legislation;
3. maintains the power to amend this privacy policy at its own discretion at any time, in which case it will publish an appropriate announcement relating to the concerned amendments on the www.cellum.com website;
4. is committed to the protection of the personal data of its partners and users, and holds in high regard its clients’ right to informational self-determination;
5. manages the submitted personal data confidentially and takes all security, technological and organizational measures in order to guarantee the security of such data (“data security”);
6. publishes its data management principles in this document and presents the requirements that it has set forth for itself as a data manager and which it abides by;
7. declares, that its privacy policy is in compliance with the applicable data protection legislation at all times.

3. Principles

3. 1. During Cellum’s data management procedures, personal information can only be managed if
      1. the concerned party has given its consent to it, or
      2. for the sake of public interest, it is made compulsory by (a) an act of law or, based on the act of law and within the scope that such law defines, (b) a municipal regulation (“complusory data handling”).
   2. Personal information can only be managed for a definite purpose, for the sake of exercising rights and completing obligations. Data handling shall comply with the purpose of the data handling at all instances.
   3. Only personal information that is indispensable and suitable for attaining the goal of the data management process can be managed, and only to the extent and up to the period of time that is necessary for achieving such purpose.
   4. Personal information can only be managed with the client’s consent granted based on an adequate notice. The concerned party shall be informed in a clear, articulate and detailed manner on every aspects concerning the management of his/her data, in particular the purpose and legal basis of the data management, the entities allowed to manage and process the data, the duration of the data management process, and the entities to whom the data can become known. The notice must also cover the rights of the concerned party relating to the management of his/her data, and his/her possibilities for legal remedy. Personal data must meet the following criteria in order to properly qualify for data management:
      1. they have been recorded and are managed in a fair and lawful manner;
      2. they are accurate, complete and, provided it is necessary for the purpose of the data management process, up to date;
      3. the concerned party can only be identified for the time period that is necessary for the purpose of the data management process.
   5. It is forbidden to use any personal identifier that is common, uniform and can be used without limitation.
   6. Personal data can be forwarded to any third parties, and different data management processes can be linked together only if the concerned party has given its consent thereto, or it is permitted by the rules of law, and if the requirements and conditions for the data management are met for each piece of personal data.
   7. Personal data (including out-of-the-common personal data) – regardless to the type of data storage or transferring method – can only be transferred to a third-country data manager or data processor if the concerned party has given its express consent thereto, or if it is permitted by the rules of law, and further, if an adequate level of protection is ensured for the personal data during the management and processing of the transferred data in that third country.
   8. Data transfer to member states of the European Economic Area shall be considered as if it was data transfer within the territory of Hungary.

4. Scope of personal data, objective, ground and duration of data management

4. 1. All data management relating to the concerned party, taking place as part of Cellum’s various services shall be based on the voluntary consent of the concerned party.
   2. Data management in relation to mobile payment (technical) services
      1. Cellum shall, during the course of providing its various mobile payment (technical) services, (A) manage, and within this scope (B) transmit to (a) the merchants and (c) acquirer banks/financial institutions, participating in the clearance and completion of the given mobile payment service, the following personal data only, granted by the user through the client side mobile application platform. Such data shall be managed merely for the purpose of (i) using the mobile payment service by the service user, (ii) completing and (iii) tracking down the transactions by the participating entities:
         1. the mobile phone number of the service user;
         2. the card number, security code (CVV2/CVC2/CSC = the 3-digit number next to the signature field on the back of the bank card, or the PCSC, which is a 4-digit number on the front) and the maturity (i.e.: “Good Thru”) date of the bank card of the service user;
         3. the name of the service user (as it appears on the bank card);
         4. e-mail address, delivery address and billing address.
      2. These data are stored by Cellum until the service user deletes them from the mobile phone, or until the bank card expires. In these events, the data listed in section 4.2.1. are deleted from the system.
      3. In accordance with the above, Cellum sends to the service user’s mobile phone the notifications as well as the information about the transactions, as specified in the General Terms and Conditions.
   3. Personal data of visitors to Cellum’s website
      1. Cellum’s website, www.cellum.com can be visited – subject to the provisions set out in Sections 4.4., 4.5 and 4.6 – without giving away any kind of personal data. The visitor can learn about Cellum’s services through the website.
      2. In order for Cellum to be able to provide personalized services to the visitor, Cellum may place a data package called cookie on the visitor’s computer, in order to be able to remember the settings saved by the visitor. The visitor can delete the cookie anytime or set his/her browser to block cookies.
      3. The code of Cellum’s website may contain references arriving from or pointing towards third-party servers independent of Cellum, which assist the independent audit of traffic and other web-analytical figures concerning the website (Universal Analytics). The operator/supervisor of such independent servers has no access to any personal data and Cellum provides access only to aggregate figures. Detailed information on the management of such data shall be provided by the relevant third party. URL: www.google.com.
   4. Newsletter service
      1. Visitors can subscribe to Cellum’s newsletter service on Cellum’s website. Cellum will regularly send newsletters about its latest news to users who have opted in or consented to receiving these newsletters.
      2. In order to subscribe to the newsletter service, the user must provide the following information using the dedicated form on the website: (i) name, (ii) e-mail address, (iii) company name, (iv) business segment (finance, telephony, retail, IT, transport, fundraising, “Other, please specify”) and position held.
      3. Upon requesting the above data, but still prior to recording (submitting) them, Cellum shall notify the subscriber in a dedicated information field that his/her personal data shall become transferable to the data manager or data processor located in a third country, for the exclusive purpose of sending the newsletter, pursuant to the conditions set out in Section 3.7 above. A user may only subscribe to the newsletter service if he/she explicitly approves the transfer of his/her name, country and email address to the data manager or data processor located in the third country, as specified above. Cellum undertakes to ensure that the name, country and email address of the subscriber is transferred only to a third-country data manager and/or data processor whose country of location guarantees due level of protection of the transferred personal data during the management and processing.
      4. Cellum may only use the above personal data for the intended purpose, solely for (i) providing the newsletter service and (ii) sending marketing offers. Cellum will not forward or sell these data, with the exception stated in Section 7.1, to any third parties, not including the members of the company group, without the knowledge and consent of the user. The content of individual newsletters may vary depending on the data provided by the subscribers.
      5. Cellum may include in its newsletters offers from other Cellum group companies as well as that of Cellum’s clients.
      6. Cellum provides the possibility to unsubscribe from the newsletter service at any time. After unsubscribing, no personal data of the subscriber shall be managed anymore by Cellum, and those data will be destroyed without any delay.
   5. Data handling concerning Cellum’s restricted access PR, demo and other marketing purpose materials
      1. Cellum publishes certain PR, demo and marketing purpose materials on its website that can only be accessed by the user following voluntary provision of data. These restricted resources may only be distributed with the written express consent of Cellum.
      2. In order to access these restricted resources, the user must provide the following data using the dedicated form on the website: (i) name, (ii) e-mail address, (iii) company name, (iv) business segment (finance, telephony, retail, IT, transport, fundraising, “Other, please specify”) and position held. The title of the downloaded resource is also recorded.
      3. 4.5.3. Upon requesting the above data, but still prior to recording (submitting) them, Cellum notifies the user that (i) it will only use the provided data for the intended purpose, it may use the provided personal data, (Ii) to send newsletters to the user pursuant to the terms and conditions set out in Section 4.4 above and to send sales and marketing offers in accordance with the provisions outlined in Section 4.6. The rules set out in Section 4.4.3 above shall be applicable to the cases set forth in this Section 4.5 as if those were written herein in full.
      4. Cellum may only use the above personal data (i) for the intended purpose), (ii) to the end of sending newsletters in accordance with Section 4.4 and marketing offers in accordance with Section 4.6, and (iii) it will not forward or sell these data, with the exception stated in Section 7.1, to any third parties, not including the members of the company group, without the knowledge and consent of the user.
      5. Cellum provides the possibility to unsubscribe from the newsletter service at any time in this case as well. After unsubscribing, no personal data of the user shall be managed anymore by Cellum, and those data shall be destroyed without any delay.
   6. Data management for the purpose of marketing offers
      1. Cellum may, using the collected data defined in Sections 4.4.2 and 4.5.2, contact the user for the purpose of sending sales and marketing offers. Cellum shall notify the user about this upon requesting these data, but still prior to recording (submitting) them. The rules set out in Section 4.4.3 above shall be applicable to the cases set forth in this Section 4.6 as if those were written herein in full.
      2. Cellum may only use the above personal data (i) for the intended purpose), (ii) to the end of sending newsletters in accordance with Section 4.4 and marketing offers in accordance with Section 4.6, and (iii) it will not forward or sell these data, with the exception stated in Section 7.1, to any third parties, not including the members of the company group, without the knowledge and consent of the user.
      3. Cellum provides the possibility to unsubscribe from the newsletter service and to opt out of receiving marketing offers at any time in this case as well. Unsubscribing from the newsletter shall be governed by Sections 4.4.6 and 4.5.4. The user can opt out from receiving marketing offers upon or after receiving such offers without further conditions in written form. After unsubscribing or opting out, no personal data of the user shall be managed anymore by Cellum, and those data shall be destroyed without any delay.
   7. Data management for the purpose of keeping contact
      1. Visitors can contact Cellum via e-mail using the contact form on its website.
      2. In order to contact Cellum using the contact form, the user must provide his/her name, country and e-mail address, and select an option from the “How did you find out about Cellum?” dropdown list on the dedicated form on the website.
      3. Personal data submitted in the above way shall be used by Cellum only for the specific goal requested by the visitor, and will not be used for the purpose of sending marketing and/or any other type of newsletter materials. Cellum will not transfer or sell such personal data to third parties – not including members of the company group – without the consent of the concerned party.
      4. Cellum will archive the above personal data following the final resolution of the matter and will store them for a period of no more than one (1) year from the date of submission.
   8. Data management related to Cellum’s clients
      1. Personal data submitted by clients shall be used by Cellum only for the intended business purpose. Cellum will not transfer or sell such personal data, with the exceptions stated in Section 7.1, to third parties – not including members of the company group – without the knowledge and consent of the concerned party.
      2. The data in question shall be destroyed by Cellum once the client relationship is terminated.
   9. Miscellaneous data management
      1. In the case of any other type of data management activities not listed in this document, Cellum will provide complete information when recording the data from the user/client.
      2. Cellum hereby informs all concerned parties that pursuant to Article 71.§ of the Act no.: XIX. of 1998 on Criminal Procedure, courts, public prosecutor’s offices and investigation authorities may contact Cellum requiring the handover of information, the dissemination/transmission of data, and the provision of documents, by setting a minimum eight (8), maximum thirty (30) days compliance deadline. Cellum is obligated to restore all encrypted or other data made unreadable for human eyes in any other manner into its original form before the handover, and make the content of the data accessible to the inquiring party. Cellum isrequired, unless otherwise provided by law, to comply with the inquiry within the set deadline or state the reason of its hindrance.
      3. Cellum will hand over personal data– provided that the authority has indicated specifically in its inquiry the exact objective and the scope of data – exclusively to the authorized authorities, and only to the extent only that is essential for the purpose of achieving the objective of the given inquiry.

5. Data storage, data security

5. 1. The user’s personal data are stored in an environment supervised by Cellum. Cellum’s information technology systems are supported by Cellum Zrt. (address: 2040 Budaörs, Távíró köz 4., Hungary) and MPP Zrt. (address: 2040 Budaörs, Távíró köz 4., Hungary). These organizations can only access data managed by Cellum in their quality as a data processors.
   2. For data management, Cellum chooses and operates the equipment used while providing its service in a way that ensures that the managed data:
      1. can be accessed only by the authorized parties (availability);
      2. is authentic and authenticated (authenticity of data management);
      3. its uniformity can be verified (data integrity);
      4. is protected against unauthorized access (data confidentiality, see section 5.4 below).
   3. During its data management procedures, Cellum ensures that data shall always be kept
      1. secret: as per the above, it protects the information so that only authorized parties can access them;
      2. uncompromised: it protects the accuracy and completeness of the information and the method of processing;
      3. available: it ensures that the authorized user can access the required information within reasonable time, whenever he/she needs to, by using the equipment available for this purpose.
   4. Cellum’s information technology system and network are protected against computer fraud, espionage, sabotage, vandalism, fire and flood, as well as computer viruses, hacker attacks and denial-of-service attacks. The system operator ensures security with server-side and application-side protection methods.
   5. Cellum hereby advises users that messages sent over the internet and/or mobile networks, regardless to the applied protocol (e.g.: e-mail, web, ftp, SMS, MMS, push, etc.) are vulnerable to threats that strive for or lead to fraudulent activity, the questioning of the validity/effectiveness of a contract, or aim to solicit or modify information. Cellum will take every precaution it can in order to prevent such threats, including the continuous upgrading of its systems, as well as maintaining its PCI DSS compliance and certificate.

6. Details and contact information of the data manager

1. Name: Cellum Global Zrt.
2. Address: 8600 Siófok, Új Piac tér 8., Hungary
3. Company registry number: Cg.: 14-10-300278
4. Tax number: 23471625-2-14
5. mail: contact@cellum.com

7. Data forwarding

7. 1. Cellum, pursuant to Sections 4.4, 4.5, 4.6 and 4.8 above, will forward the personal data of parties concerned to the following enterprises/subcontractors, and only for the purpose of (i) providing the newsletter services and (ii) sending marketing offers:
      1. name of the data processor: Cellum Austria GmbH.
         address: Stallburggasse 4, 1010 Wien
      2. name of the data processor: The Rocket Science Group, LLC
         address: 512 Means Street, Suite 404, Atlanta, GA 30318 USA
         e-mail address: customersupport@mailchimp.com
      3. scope of the personal data transfer: the user’s (i) name, (ii) e-mail address, (iii) company name, (iv) business segment (finance, telephony, retail, IT, transport, fundraising, “Other, please specify”) and position held.
      4. purpose of the personal data transfer: (i) providing the newsletter service, (ii) sending marketing offers. The user may unsubscribe from and/or opt out of these services, as specified in the newsletter, or upon or after receiving a marketing offer, without further conditions, at any time.
   2. Cellum, in relation to the mobile payment service outlined in Section 4.2 will forward the personal data of the concerned parties to the following enterprises/subcontractors, and only for the purpose of providing the newsletter services:
      1. Name of data processor(s) (1): the acquirer bank(s) or financial institution(s), participating in the acceptance/clearing of the transactions;
      2. Address of the data processor(s) (1): as it/they is/are set forth in the webpage of, or the contractual documentation relating to the mobile payment service;
      3. Name of data processor(s) (2): the merchant(s), participating in the clearing of the transactions;
      4. Address of the data processor(s) (2): as it/they is/are set forth in the webpage of the integrated merchant, or the contractual documentation relating to such service;
      5. Name of data processor (3): MPP Zrt.;
      6. Address of the data processor (3): 2040 Budaörs, Távíró köz 4.;
      7. Scope of forwarded data:
         • a. the mobile phone number of the service user;
         • b. the card number, security code (CVV2/CVC2/CSC = the 3-digit number next to the signature field on the back of the bank card, or the PCSC, which is a 4-digit number on the front) and the maturity (i.e.: “Good Thru”) date of the bank card of the service user;
         • c. the name of the service user (as it appears on the bank card);
         • d. e-mail address, delivery address and billing address.
      8. Purpose of forwarded data: to carry out financial transactions, and to monitor user transactions with the intent of customer care.

8. Legal remedy

8. 1. The concerned party may ask to be informed about the management of his/her personal data or – with the exception of the limitations set forth in the relevant legislation – may request that Customer Service delete such data, or can also personally do so by removing these data from his/her mobile phone. The concerned party understands that – given the absence of his/her personal data necessary for identifying the underlying bank cards behind the service – In the case of deleting or destroying his/her personal data in any of the above manner, he/she will not be able to use Cellum’s mobile payment services following to successful deletion.
   2. Upon request from the concerned party, Cellum, in its capacity as data manager, shall provide information on (i) the personal data managed by it or forwarded to a data processor for processing, as well as on the (ii) purpose, (iii) legal basis (iv) duration of the data management, (v) on the name and (vi) address of the data processor, (vii) its activities related to the data management, and on (viii) who and for what purpose has received or will receive the said data. The data manager shall provide a written and common sense language response to the request within the shortest possible deadline, but no later than within thirty (30) days following to the date of the request. In case the party concerned does not speak Hungarian, the information shell provided in English. Provided that the requesting party has not submitted another request for the same scope of data to the data manager in the current year, the granting of the above information will be free. The requiring party agrees that the data manager shall be entitled to bill for its costs and expenses to the requiring party in any other cases.
   3. Cellum shall delete personal data if the management thereof is illegal, if it is requested by the concerned party, if the purpose of the data management process is terminated, if the deadline set by the law for the data management expires, or if it is required by Court or the National Data Protection and Information Freedom Authority of Hungary.
   4. Cellum informs the concerned party about the correction or deletion of these data, as well as all other parties whom the data were previously forwarded to for the purpose of data management. Such notification may be omitted if, with regard to the purpose of the data management, it does not infringe the rightful interest of the concerned party.
   5. The party concerned may petition against the management of his/her personal data if
   1. the management or forwarding of personal data is necessary only for the fulfilment of the legal obligations or the pursuit of the rightful interests of the data manager or data recipient, unless the management of data is required by law (“mandatory data management”);
   2. the personal data is used or handled for the purpose of securing business, opinion polling or scientific research;
   3. the right to petition is otherwise provided by the law.
   6. Cellum (i) will examine the petition within the shortest possible deadline, but no later than within fifteen (15) days from the date of receiving the petition, (ii) will inform the requesting party in writing whether or not the petition has been found to be substantiated, and simultaneously to all this (iii) will suspend the related data management activities. In case the petition is found to be substantiated, the data manager – including any further data recording and -forwarding activities – will discontinue the management of the data will block the data and will inform all parties about the petition and the subsequent actions, whom the personal data subject to the petition were previously sent to, and who are required to take action in order to enforce the said right to petition.
   7. In case the requesting party disagrees with Cellum’s decision, he/she can apply to the Courts within thirty (30) days from the date of reception of Cellum’s notice.
   8. Cellum may not delete the data of the concerned party if its management was stipulated by law (mandatory data management). Notwithstanding the above, those data cannot be forwarded to the recipient if the data manager agrees with the petition, or if the Court has ruled the petition to be justified.
   9. In case the rights of the concerned party are infringed, he/she may apply to the Courts. The Court shall be acting out of turn. Cellum will, based on the Court’s ruling, indemnify the party concerned for damages due to illegal management of private data or failure to meet data security requirements.
   10. The data manager shall be responsible for damages caused by the data processor towards the concerned party. The data manager shall be exempt from liability if the damage was caused by unforeseeable circumstances beyond the scope of the data management (force majeure). Damages need not be indemnified for to the extent they have been caused by will or gross negligence of the injured party.
   11. Complaints related to Cellum’s management of data can be submitted to the National Data Protection and Information Freedom Authority, via one of the following:
       • Address: 1125 Budapest, Szilágyi Erzsébet fasor 22/c.
       • P.O. box: 1530 Budapest, Pf.: 5.
       • Phone no.: +36 1 391 1400
       • Fax no.: +36 1 391 1410
       • E-mail: ugyfelszolgalat@naih.hu

9. Definitions

Terms used in this Privacy Policy are defined as follows:

• „personal data”: means any data that can be associated with any specific (identified or identifiable) natural person (“concerned party”), or implications that can be inferred from such data relating to the concerned party. Data shall maintain its personal quality throughout the data management process so long as its connection with the concerned party can be restored. A person can be considered identifiable in particular if he/she can directly or indirectly be identified based on any traits relating to his/her (i) name, (ii) identification number, or one or more (iii) physical, (iv) physiological, (v) mental, (vi) economic, (vii) cultural or (viii) social identity.
• „approval”: means the voluntary and explicit expression, based on adequate information, the concerned party’s will, by which he/she gives unequivocal consent to the comprehensive or partial management of his/her personal data.
• „petition”: means a declaration from the concerned party expressing disapproval of the management of his/her personal data and requesting the discontinuation of the data management and/or the deletion of the managed data.
• „data manager”: means a natural or legal person, or an organization without legal personality, who/that determines the purpose of the data management, makes decisions (including the used equipment) regarding the data management and executes, or has the data processor to execute them.
• „data management”: means, regardless to the procedure applied, any or all actions performed on/with the data, such as (i) collecting, (ii) recording, (iii) saving, (iv) sorting, (v) storing, (vi) modifying, (vii) using, (viii) forwarding, (ix) publishing, (x) according or joining, (xi) blocking, deleting and destroying said data, as well as (xii) the prevention of its further use. Photographing, sound or video recording, and sampling physical traits suitable for the identification of the person (e.g. finger- or palm prints, DNS sample, iris image) shall also qualify data management activity.
• „data forwarding”: means when the data is made available to a specified third party.
• „publishing”: means when the data is made available to anyone.
• „data deletion”: means making the data unrecognizable in a way that it cannot be restored anymore.
• „data blocking”: means the marking the data with an identifier in order to permanently or temporarily limit its further management.
• ”data destruction”: means the complete physical destruction of the storage device holding the data.
• „data processing”: means the performing of technical tasks related to the data management processes, regardless to the methods and tools applied and/or the location where it takes place.
• „data processor”: means a natural or legal person or an organization without legal personality that processes the data on behalf of the data manager.
• „third party”: means a natural or legal person or an organization without legal personality that is not identical to the concerned party, the data handler, or the data processor.
• „third country”: means a country that is not a member of the European Economic Area.
• „EEA country”: means a member of the European Union or a party to the agreement on the European Economic Area, or a country whose citizens, based on an international treaty between the European Union and its member states on the one hand, and the country that is not party to the agreement on the European Economic Area on the other hand, enjoy the same legal status as the citizens of a state that is party to the agreement on the European Economic Area.
• „concerned party”: any specific natural person identified or – directly or indirectly – identifiable based on personal data.