Az Edenred Magyarország Korlátolt Felelősségű Társaság [Edenred Hungary Limited] (head office/official mailing address: 1134 Budapest, Váci út 45., company registration number: 01-09-266926; electronic contact details: ugyfelszolgalat-hu@edenred.com and dpo.hungary@edenred.com; web address: https://edenred.hu/hu/; phone: +36 1 413 3333, represented by: Krisztián Balázs, hereinafter referred to as: Programme Owner) in accordance with the related legislative provisions specifying the protection of personal data, informs the users of its services on the processing of data it applies.

The Programme Owner provides employers (hereafter: Client) services concerning the allowances issued in an electronic form according to the act on Personal Income Tax, in the context of which, the Clients provides its employees (hereafter: Card Owner) a non-transferable magnetic stripe or microchip plastic card protected with a PIN code that can be used for paying the full or partial consideration for goods sold or services rendered by the Participating Vendor, within the scope permitted by law.

The Programme Owner pays prompt attention on the protection of personal data, therefore it permanently takes due care to guarantee fair and transparent processing the essential requirement of which is to provide appropriate information on the processing of data. This Data Processing Policy provides among others information on the processing of your personal data during the provision of service by the Programme Owner and data processing for advertising purposes: the source and scope of acquiring the processed data, the legal basis, purpose and term of the data processing, the rights concerning and the options of choice between personal data, and it also includes all the contact details in which the Data Subject can get answers to his questions on the Programme Owner’s practice of data protection.

 

Summary of the processing of data concerning the Service provided by the Programme Owner to the Client
Data Controller In the processing of personal data regarding the contract concluded between the Programme Owner and the Client, the Client is the Controller and the Programme Owner is the Processor.
The purposes of the processing Performance of the Services included in the GTC by the Client
Legal basis of data processing The legal basis of the processing of data is the execution of the Contract [Article 6 (1) (b) of GDPR].
Scope of data processed Data Subject’s surname; forename; name on card (21 characters at most); date of birth; permanent residence (post code, town, street, number); correspondence if other than residence (post code, town, street, number); e-mailing address; cell phone number; amount to upload; serial No. of card; habitual residence in Hungary if Data Subject is a foreigner; workplace address
Term of data processing Total duration of the service and 5 years following its termination (until the limitation period of the possible claims concerning the Service)
Processors Programme Owner Purpose of the processing: Provision of Edenred Card Service
PrePay Solutions Ltd. (member of the Edenred group; head office: London: 6th Floor, 3 Sheldon Square, Paddington, London, W2 6HY  UK) purpose of the data processing: management of card balances, authorisation of card transactions, online balance inquiries, issuance and activation of Cards, crediting of e-money allocated for this purpose to the cards, providing access to data (e.g. transaction history, available balance), processing of Transactions; as regards PrePay Solutions Ltd. as the issuer of the card, the processing of data of the Data Subject shall be considered as if it took place in the territory of Hungary, inasmuch the data get processed within the European Union (United Kingdom).
Idemia Hungary Kft. (head office: Tó-Park land reg. No.: 3301/21., H-2045 Törökbálint, Tópark utca, Hungary) purpose of data processing: manufacturing of cards;
Y-Collective Kft. (head office: H-7628 Pécs, Arany János u. 24., Hungary) purpose of data processing: extranet operation, processing of card orders, operation of website and application; IT support activity

 

The summaries serve only as an easy overview, please read the full prospectus.

 

Summary of the processing of data concerning the Service provided by the Programme Owner to the Card Holder
Data Controller In the processing of personal data regarding the contract concluded between the Programme Owner and the Card Holder, the Programme Owner is the Processor.
The purposes of the processing The Card Holder’s compliance with the Services included in the GTC
Legal basis of data processing The compliance with the Contract concluded between the Programme Owner and the Card Holder [Article 6 (1) (b) of the GDPR]
Scope of data processed Data Subject’s surname; forename; name on card (21 characters at most); date of birth; permanent residence (post code, town, street, number); correspondence if other than residence (post code, town, street, number); e-mailing address; cell phone number; amount to upload; serial No. of card; Data of the transaction; habitual residence in Hungary if Data Subject is a foreigner; Account history; workplace address
Term of data processing Total duration of the service and 5 years following its termination (until the limitation period of the possible claims concerning the Service)
Processors PrePay Solutions Ltd. (member of the Edenred group; head office: London: 6th Floor, 3 Sheldon Square, Paddington, London, W2 6HY  UK) purpose of the data processing: management of card balances, authorisation of card transactions, online balance inquiries, issuance and activation of Cards, crediting of e-money allocated for this purpose to the cards, providing access to data (e.g. transaction history, available balance), processing of Transactions; as regards PrePay Solutions Ltd. as the issuer of the card, the processing of data of the Data Subject shall be considered as if it took place in the territory of Hungary, inasmuch the data get processed within the European Union (United Kingdom).
Idemia Hungary Kft. (head office: Tó-Park land reg. No.: 3301/21., H-2045 Törökbálint, Tópark utca, Hungary) purpose of data processing: manufacturing of cards;
Y-Collective Kft. (head office: H-7628 Pécs, Arany János u. 24., Hungary) purpose of data processing: extranet operation, processing of card orders, operation of website and application; IT support activity

 

The summaries serve only as an easy overview, please read the full prospectus.

 

Summary of the processing of data concerning the marketing / advertising activity of the Programme Owner
Data Controller Concerning the data processing regarding its marketing / advertising activity, the Programme Owner is the Data Controller.
The purposes of the processing Sending marketing / advertising messages to the Card Holder
Legal basis of data processing The Data Subject’s consent [Article 6 (1) (b) of the GDPR and Article 6 (1) of Act XLVIII of 2008 on the Basic Requirements of and Certain Restrictions on Commercial Advertising Activities]. The consent may be withdrawn at any time
Scope of data processed The Data Subject’s surname; forename; e-mail address; mobile phone number;
Term of data processing Until the withdrawal of the consent
Processors Y-Shift Kft. (head office: H-7636 Pécs Arany János utca 24., Magyarország) purpose of data processing: data processing for the purposes of advertising.
The Rocket Science Group LLC d/b/a MailChimp (head office: 675 Ponce De Leon Ave NE, Suite 5000 Atlanta, Georgia 30308, USA) purpose of data processing: data processing for the purposes of advertising – sending out newsletters

 

The summaries serve only as an easy overview, please read the full prospectus.

Definitions used in this Data Processing Policy match the definitions included in the General Terms and Conditions regarding the ordering, delivery and utilization of Edenred Voucher Cards and the Card Holder GTC. For enhancing the interpretation of the Data Processing Policy, we repeat certain definitions in the following:

Issuer” is PrePay Technologies Limited, a limited company registered in the UK with number 04008083, contact: United Kingdom, PO BOX 3883, Swindon, SN3 9EA. PrePay Technologies Limited was registered with number 900010, its e-money issuer licence was issued by and its supervisory authority is the Financial Conduct Authority.

Programme Owner or Data Controller’ is Edenred Magyarország Kft. (head office: 1134 Budapest, Váci út 45.), the Issuer’s payment intermediary.

Client” is a natural or legal person providing the Edenred Card to the Card Holder.

Card Holder’ is a natural person deemed by the Client eligible for using the Card to whom the Card is issued, and who undertakes to comply with the GTC concerning the Card Holder attached as Annex 6 of the GTC concerning Clients.

Edenred Card” or “Card”, according to Act CXVII of 1995 on Personal Income Tax (“PIT Act”), is a benefit given off in an electric form, supplied in the form of a non-transferable plastic card provided with a magnetic stripe or a microchip protected by a PIN code, that can be used for paying the full or partial consideration for goods sold or services rendered by the Participating Vendor, within the scope permitted by law. The Edenred Card contains a pre-paid benefit without credit function, bound to the holder’s name. The rules pertaining to Edenred Cards apply implicitly to the Parter Card provided by Edenred:

Gift Card: a Card the credited amount on which may be used for purchasing products and services concerning certain specified benefits specified by the PIT Act.

School Starter Card: a Card the credited amount on which may be used for purchasing schoolbooks, school materials and outfits concerning the regulations on certain specified benefits specified by the PIT Act.

Culture and Sports Card: a Card the credited amount on which – concerning the regulations on benefits specified by the PIT Act – may be used for purchasing tickets, passes for the recourse to cultural services (for exhibitions, theatrical, dance, circus or music performances provided by museums and arts facilities [exhibition sites], or for requisitioning cultural services provided by organizations carrying on public education activities) and registration fees to libraries, and for purchasing tickets and passes for sports events falling within the scope of the Sports Act.

Motivation Card: a Card the credited amount on which may be used for purchasing products and services concerning gift for business purposes specified by the PIT Act.

Edenred Card Service’ or ‘Service’ means the complex service provided by the Programme Owner to the Client and the Card Holders under these GTC concerning the ordering, delivery and use of Edenred Cards and the Card Holder GTC, in connection with the issuance and use of the Card.

Participating Vendor” or “Participating Business” is an entity accepting Edenred Cards from the Card Holders (or Partner Card Holders) in case of the sale of products or the provision of services, and where the Programme Owner makes accepting cards technically available.

Data Subjects include the employees (Card Holders) of the employer (Client) ordering the Services of the Programme Owner, and – in case of a respective order – the close relatives of the Card Holders as Additional Card Holders (hereinafter referred to as Data Subject)

4.1 The Programme Owner would acquire the the personal data of the Data Subject not directly from the Data Subject, but, in regard to the characteristics of the Service, from the Data Subject’s employer (Client), concurrently with the ordering by the employer of the card issued by the Programme Owner.

4.2 The Data Subject would activate the Card provided to him by his employer on the website https://myaccount.edenredkartya.hu/#/login, by creating a user account providing the e-mail address or the serial number of the card, or by entering his user account already created by providing his e-mail address and password. In activating/entering, the Data Subject shall not provide personal data regarding the Data Subject provided by the Data Subject’s employer to the Programme Owner, the electronic system applied by the Programme Owner would associate them with the Data Subject. The Data Subject would accept the GTC concerning the Card Holder (hereinafter referred to as: GTC) during the activation/entering, and in this context, he would get information on the data processing by learning the Data Processing Policy being an integral part of the GTC.

4.3 The main purpose of the Edenrend card Pro application is to enable the Card Holders to electronically register their Edenred Cards and to trace their personal expenses. The Data Subject would activate the Card provided to him by his employer in the Edenred card Pro application by creating a user account providing the e-mail address or the serial number of the card, or by entering his user account already created by providing his e-mail address and password. In activating/entering, the Data Subject shall not provide personal data regarding the Data Subject provided by the Data Subject’s employer to the Programme Owner, the electronic system applied by the Programme Owner would associate them with the Data Subject. The Data Subject would accept the GTC concerning the Card Holder during the activation/entering, and in this context, he would get information on the data processing by learning the Data Processing Policy being an integral part of the GTC.

6.1 Data processed for the purposes of complying with the Client GTC
6.1.1 Programme Owner as Data Processor processes the following data in order to comply with the Client GTC i.e. the provision of the Service:

  • Data Subject’s last name;
  • Data Subject’s first name;
  • Name on card, 21 characters at maximum;
  • Date of birth;
  • Permanent address (zip code, city, name of public area, type of public area, house number);
  • Mailing address, if different from permanent address (zip code, city, name of public area, type of public area, house number) (mandatory);
  • Data Subject’s e-mail address;
  • Data Subject’s mobile phone number;
  • Amount and value to be credited;
  • Card Serial No.;
  • In case of foreign Data Subject, the place of residence in Hungary;
  • Address of the Data Subject’s workplace.

6.1.2 Personal data would be processed by the Programme Owner as Data Processor in connection with manufacturing the Card and the administration on the crediting and usage of the Card.

6.1.3 The Programme Owner will process the Data Subject’s data until the period required to achieve the purpose of the Client GTC, i.e. the total duration of the Service and 5 years following its termination (until the limitation period of the possible claims concerning the Service).

6.2 Data processed for the purposes of complying with the Card Holder GTC
6.2.1 Programme Owner processes the following data in order to comply with the Card Holder GTC i.e. the provision of his Service:

  • Data Subject’s last name;
  • Data Subject’s first name;
  • Name on card, 21 characters at maximum;
  • Date of birth;
  • Permanent address (zip code, city, name of public area, type of public area, house number);
  • Mailing address, if different from permanent address (zip code, city, name of public area, type of public area, house number) (mandatory);
  • Data Subject’s e-mail address;
  • Data Subject’s mobile phone number;
  • Amount and value to be credited;
  • Card Serial No.;
  • Data of the transaction.
  • In case of foreign Data Subject, the place of residence in Hungary;
  • Statement of account;
  • Address of the Data Subject’s workplace.

6.2.2 The Programme Owner will process the Data Subject’s data until the period required to achieve the purpose of the Card Holder GTC, i.e. the total duration of the Service and 5 years following its termination (until the limitation period of the possible claims concerning the Service).

6.3 Data processed for reasons of marketing / sending of advertisements, and the term of data processing
6.3.1
During the data processing for advertisement purposes, the Programme Owner will send advertisements via phone (SMS) or e-mails or push notifications (pop-up messages on mobile phones) to the Data Subject concerning the products of the Programme Owner, the Edenred Group and the Participating Vendors, and on the incidental campaigns, according to the Data Subject’s consent.
6.3.2 For this purpose it processes the following data:

  • Data Subject’s last name;
  • Data Subject’s first name;
  • Data Subject’s e-mail address;
  • Data Subject’s phone number;

6.3.3 The Programme Owner keeps record of the personal data of Data Subjects having made declaration of consent regarding the receipt of advertisements.
6.3.4 For sending advertisement, the Programme Owner keeps on processing the personal data processed per the declaration of consent provided by the Data Subject until revocation. The Data Subject can give his declaration of consent by ticking the relevant checkbox on the Programme Owner’s website or the Edenred card Pro application. The Data Subject may revoke his consent at any time via the unsubscribe link at the bottom of the marketing letter sent to the provided e-mail address.

7.1 The Programme Owner will transmit and disclose the Data Subject’s data to the members of the Edenred Group and its contractual partners (including natural persons) in the course and for the purpose of and to the extent required for providing the Service, in relation to the card use.

7.2 Data Processors belonging to the Programme Owner’s contractual partners employed for complying with the provision of the Service, and for performing the marketing / promotional activity, who will process the Data Subject’s data are:

  • PrePay Solutions Ltd. (member of the Edenred group; head office: London: 6th Floor, 3 Sheldon Square, Paddington, London, W2 6HY UK)
    purpose of the data processing: management of card balances, authorisation of card transactions, online balance inquiries, issuance and activation of Cards, crediting of e-money allocated for this purpose to the cards, providing access to data (e.g. transaction history, available balance), processing of Transactions; as regards PrePay Solutions Ltd. as the issuer of the card, the processing of data of the Data Subject shall be considered as if it took place in the territory of Hungary, inasmuch the data get processed within the European Union (United Kingdom).
  • Idemia Hungary Kft. (head office: Tó-Park land reg. No.: 3301/21., H-2045 Törökbálint, Tópark utca, Hungary)
    purpose of data processing: manufacturing of cards;
  • Y-Collective Kft. (head office: H-7628 Pécs, Arany János u. 24., Hungary)
    purpose of data processing: extranet operation, processing of card orders, operation of website and application;
  • Y-Shift Kft. (head office: H-7636 Pécs Arany János utca 24., Hungary)
    purpose of data processing: data processing for the purposes of advertising.
  • The Rocket Science Group LLC d/b/a MailChimp (head office: 675 Ponce De Leon Ave NE, Suite 5000 Atlanta, Georgia 30308, USA)
    purpose of data processing: data processing for the purposes of advertising – sending out newsletters

The Rocket Science Group LLC d/b/a MailChimp possesses a Privacy Shiled (https://www.privacyshield.gov/EU-US-Framework) qualification created according to the data protection framework agreement between the US and the EU, therefore, per Article 45 (1) of the GDPR, personal data may be transferred to it, ensuring an adequate level of protection.

9.1 The Programme Owner shall delete the Data Subject’s data upon the expiry of the data handling period.

9.2 The Programme Owner will ensure the security of the processed data and takes any measure against unauthorised access, modification, forwarding, disclosure, erasure or destruction, accidental destruction and deterioration, and inaccessibility due to the change of the technology applied, i.e. in order to ensure an adequate protection of the Data Subjects’ personal data per the legislation.

9.3 The Programme Owner processes the Data Subject’s data automatically and manually in a computer database applying the measures necessary for maintaining the data security requirements, and it has arranged to have the processing of the Data Subject’s data within a closed system protected by password in any event and saved in a hard disk, and that these systems would be used by those authorised to know the data exclusively in relation to the provision of the service, in a strictly necessary extent.

9.4 Those authorised to know the personal data are the Programme Owner (the Programme Owner’s employees employed in a post that manage matters concerning the card use), the members of the Edenred Group, and the Programme Owner’s contractual partners. The computer systems shall be protected by firewall and appropriate antivirus software.

9.5 The Programme Owner accomplishes the technical inspection of the system and takes prompt action in case any fault is detected or indicated.

9.6 The Programme Owner ensures to provide complete information about the data protection rules to those authorised to access the data. As a guarantee to data security, the senior executives and employees of the Programme Owner are bound by obligation of confidence and legal liability concerning the personal data learned in this regard.

11.1 Should the Programme Owner modify the GTC with an influence on the Data Processing Policy, it shall place an appropriate announcement on the website and shall send the the modified policy to the e-mail address provided by the Data Subject so that the Data Subject may study it.

11.2 Where the Programme Owner intends to further process the personal data for a purpose other than that for which the personal data were obtained, it will provide the Data Subject prior to that further processing with information on that other purpose and with any relevant further information.

11.3 The Programme Owner shall inform the data subject at the latest on the first occasion of disclosing the data also to other recipient(s).

Effective from: 16 July 2018.