Privacy Notice

Data controller:

Name: OS Exhibitions Kft.
Registered office: 6000 Kecskemét, Rezeda utca 27.
Managing director: Ottó Fenyvesi

Tax number: 24751724-2-03
Customer service phone: +36203237072
Customer service e-mail: info@ottostudio-props.com

Hosting provider: Sybell Informatika Kft. (sybell.hu)

We do not disclose our customers’ data to third parties.

Description of data processing carried out in operating the online catalog

Information on the use of cookies

The Data Controller uses so‑called cookies when the website is visited. A cookie is a packet of information made up of letters and numbers that our website sends to your browser in order to save certain settings, facilitate use of the website, and help us collect some relevant, statistical information about our visitors.

Some cookies do not contain personal information and cannot be used to identify an individual user; however, some contain an individual identifier — a secret, randomly generated number — that your device stores, which can make you identifiable. The lifetime of each cookie is included in the description for that cookie.

Legal basis and lawful ground for cookies

The legal basis for the processing is your consent under Article 6(1)(a) of the Regulation.

Main characteristics of cookies used by the website

Strictly necessary cookies: These cookies are essential for using the website and enable basic website functions. Without them, many features of the site would not be available to you. The lifetime of these cookies is limited to the session.
Cookies improving the user experience: These cookies collect information about how users use the website, for example which pages are visited most often or which error messages occur. These cookies do not collect information that identifies the visitor; they work with general, anonymous data. We use the information to improve the website’s performance. The lifetime of these cookies is limited to the session.

If you do not accept the use of cookies, some functions will not be available to you. For information on deleting cookies, see:

Internet Explorer: http://windows.microsoft.com/en-us/internet-explorer/delete-manage-cookies#ie=ie-11
Firefox: https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer
Firefox (HU): https://support.mozilla.org/hu/kb/weboldalak-altal-elhelyezett-sutik-torlese-szamito
Safari: https://support.apple.com/kb/ph21411?locale=en_US
Chrome: https://support.google.com/chrome/answer/95647

To manage the cookies and similar technologies used (tracking pixels, web beacons, etc.) and related consents, we use the consent tool “Real Cookie Banner”. Details on how “Real Cookie Banner” works can be found at https://devowl.io/rcb/data-processing/.

The legal basis for the processing of personal data in this context are Art. 6 (1) (c) GDPR and Art. 6 (1) (f) GDPR. Our legitimate interest is the management of the cookies and similar technologies used and the related consents.

The provision of personal data is neither contractually required nor necessary for the conclusion of a contract. You are not obliged to provide the personal data. If you do not provide the personal data, we will not be able to manage your consents.

Data processed for the purpose of concluding and performing the contract

Several types of data processing may occur for the purpose of concluding and performing contracts. Please note that data processing related to complaint handling and warranty administration will only occur if you exercise one of the rights described below.

Detailed data processing for contract conclusion and performance

Contact

For example, when you contact us by e‑mail, contact form, or telephone with questions about a product.

Processed data: Data you provide during contact.

Retention period: We process the data only until the contact is closed.

Legal basis: Your voluntary consent provided by contacting the Data Controller. [Article 6(1)(a) of the Regulation]

Website registration

By storing data provided during registration, the Data Controller can offer a more convenient service (for example, the data does not need to be provided again when viewing the online catalog). Registration and sign-in are required to view the full online catalog.

Processed data: During processing the Data Controller handles your name, address, telephone number, e‑mail address, characteristics of purchased products and the time of purchase. If the user creates wish lists, the website saves them so they can be viewed later.

Retention period: Until you withdraw your consent.

Legal basis: Your voluntary consent given by registering with the Data Controller. [Article 6(1)(a) of the Regulation]

Processing of enquiries

Processing enquiries involves activities necessary for performing the contract.

Processed data: The Data Controller processes your name, address, telephone number, e‑mail address, characteristics of the purchased product, order number and time of purchase. If you send an enquiry, providing data is necessary for contract performance.

Retention period: We retain the data for 5 years in accordance with civil statute of limitations.

Legal basis: Performance of a contract. [Article 6(1)(b) of the Regulation]

Warranty handling

Data processing takes place in order to handle warranty claims. If you request warranty handling, providing the data is necessary.

Processed data: Buyer’s name, telephone number, e‑mail address, content of the complaint.

Retention period: Warranty complaints are retained for 5 years pursuant to consumer protection law.

Legal basis: Whether you turn to us for warranty handling is your voluntary decision; however, if you do, under Section 17/A(7) of Act CLV of 1997 on consumer protection we are obliged to retain the complaint for 5 years [Article 6(1)(c) of the Regulation].

Other consumer protection complaint handling

Data processing takes place to handle consumer protection complaints. If you file a complaint, providing the data is necessary.

Processed data: Buyer’s name, telephone number, e‑mail address, content of the complaint.

Retention period: Consumer protection complaints are retained for 5 years pursuant to consumer protection law.

Legal basis: Filing a complaint is your voluntary decision; however, if you do, under Section 17/A(7) of Act CLV of 1997 on consumer protection we are obliged to retain the complaint for 5 years [Article 6(1)(c) of the Regulation].

During registration, sending enquiries and newsletter subscription the IT system stores technical data related to consent for later proof.

Processed data: Time of consent and the subject’s IP address.

Retention period: Due to legal requirements, consent must be provable later; therefore data is stored until the applicable limitation period after the processing ends.

Legal basis: Article 7(1) of the Regulation prescribes this obligation. [Article 6(1)(c) of the Regulation]

Marketing processing

Processed data: Name, address, e‑mail address, telephone number.

Retention period: Until the data subject withdraws consent.

Legal basis: Your voluntary consent given by subscribing to the newsletter. [Article 6(1)(a) of the Regulation]

Personalized advertising (sending and displaying)

Processed data: Name, address, e‑mail address, telephone number.

Retention period: Until you withdraw your consent.

Legal basis: Your separate voluntary consent given when collecting the data. [Article 6(1)(a) of the Regulation]

Remarketing

Remarketing is implemented using cookies.

Processed data: Data processed by the cookies described in the cookie notice.

Retention period: The storage period of the given cookie. More information:

Google general cookie information: https://www.google.com/policies/technologies/types/
Google Analytics information: https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage?hl=hu
Facebook information: https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen

Legal basis: Your voluntary consent given by using the website. [Article 6(1)(a) of the Regulation]

Further processing

If the Data Controller intends further processing, prior information will be provided on the essential circumstances of that processing (legal basis, purpose, categories of processed data, retention period).

Please note that the Data Controller must comply with lawful written data requests from authorities. The Data Controller keeps a record of transfers in accordance with Section 15(2)–(3) of the Information Act (which authority, which personal data, on what legal basis, when it was transferred), and will provide information on this record upon request unless prohibited by law.

Data processing for storage of personal data

Processor name: The processor carries out storage of personal data under a contract with the Data Controller. The processor is not authorized to access personal data. The company mentioned above performs the data processing activities related to goods delivery.

Rental prices and payment terms

Prices shown next to products on the website are indicative and apply to 7‑day rentals. Final pricing may be affected by, for example, rental duration and the number of items. Prices do not include delivery costs. Minimum rental period: 7 days.

Delivery charges

If you entrust us with organizing delivery of rented items, delivery costs are calculated individually. The renter bears the delivery costs.

Payment terms

(Payment terms are listed here — provide specific terms if needed.)

Delivery information

The buyer must check on receipt that the ordered items were delivered and that the delivered items match the order in quantity and visible quality. Any complaint must be reported immediately to the delivery person and to the website’s customer service. If the renter does not accept the items at the pre‑agreed time, the failed delivery costs are borne by the renter.

Offer validity period

The final price of the item(s) you wish to rent on our website is guaranteed only after confirmation (sent by e‑mail). We reserve the right to change prices until order confirmation.

Accounting data processing

Processor name:

Under a written contract, the processor assists the Data Controller in accounting for financial documents. In doing so, the processor handles the subject’s name and address to the extent necessary for accounting records for the period required by Section 169(2) of the Accounting Act, after which it will delete them without delay.

Invoice processing

Processor name: www.szamlazz.hu

The processor assists the Data Controller in keeping accounting records of invoices under contract. It processes the subject’s name and address to the extent necessary for accounting records for the period required by Section 169(2) of the Accounting Act, after which it deletes them.

Rights available to you regarding data processing

During the retention period, you are entitled to the following rights under the Regulation:

the right to withdraw consent
access to personal data and information related to processing
the right to rectification
the right to restriction of processing
the right to erasure (the “right to be forgotten”)
the right to object
the right to data portability

If you wish to exercise your rights, identification will be required and the Data Controller will need to communicate with you. For identification we will require personal data that the Data Controller already processes about you. Complaints related to data processing will be available in the Data Controller’s e‑mail account within the time limits specified in this notice. If you were a buyer and wish to be identified for complaint or warranty handling, please provide your order identifier so we can identify you. The Data Controller will respond to data processing complaints within 30 days at the latest.

You may withdraw consent to data processing at any time; if you do, we will delete the provided data from our systems. Please note that withdrawing consent for an unfulfilled order may prevent us from completing delivery. If the purchase has already been completed, invoicing data cannot be deleted due to accounting rules. If you owe us money, we may continue to process data necessary to pursue claims even after consent withdrawal based on legitimate interest.

Right of access to personal data

You are entitled to obtain confirmation from the Data Controller whether your personal data are being processed and, if processing is ongoing, to:

obtain access to the personal data processed about you, and
be informed about: the purposes of processing; categories of personal data processed about you; the recipients or categories of recipients to whom personal data have been or will be disclosed; the planned storage period or, if not possible, the criteria for determining that period; your right to request rectification, erasure or restriction of processing, and to object where processing is based on legitimate interest; the right to lodge a complaint with a supervisory authority; where the data were not collected from you, any available information about the source; the existence of automated decision‑making (including profiling), and, where applicable, meaningful information about the logic involved and the possible consequences for you.

Requests to verify lawfulness of processing and multiple requests may result in a reasonable fee to cover administrative costs. Access is provided after identification: the Data Controller will send the data and information by e‑mail, or, if you have an account, you may view and verify your processed personal data by signing into your user account. Please indicate in your request whether you ask for access to personal data or information about processing.

Right to rectification

You have the right to request that the Data Controller rectify inaccurate personal data concerning you without undue delay.

Right to restriction of processing

You have the right to request restriction of processing where one of the following applies:

you contest the accuracy of the personal data — restriction applies while the Data Controller verifies accuracy;
processing is unlawful but you oppose erasure and request restriction instead;
the Data Controller no longer needs the data for processing purposes but you need them for establishment, exercise or defense of legal claims;
you objected to processing based on legitimate interest pending verification whether the Data Controller’s legitimate grounds override your rights.

Restricted personal data may only be processed, apart from being stored, with your consent, to establish, exercise or defend legal claims, to protect another natural or legal person’s rights, or for important public interest of the Union or a Member State. The Data Controller will notify you before lifting the restriction (at least 3 working days in advance).

Right to erasure (right to be forgotten)

You have the right to require the Data Controller to erase personal data without undue delay where one of the following applies:

the personal data are no longer necessary for the purposes for which they were collected;
you withdraw consent and there is no other legal basis for processing;
you object to processing based on legitimate interest and there is no overriding legitimate ground;
the data were unlawfully processed and this is established by a complaint;
erasure is required by Union or Member State law to which the Data Controller is subject.

Where the Data Controller has made personal data public and is required to erase it, it shall take reasonable steps (considering available technology and implementation costs) to inform controllers processing the data that you have requested erasure of links or copies. Erasure does not apply if processing is necessary for freedom of expression and information, compliance with a legal obligation (e.g., accounting records retention), public interest, or establishment/exercise/defense of legal claims (e.g., outstanding claim against you or ongoing complaint).

Right to object

You have the right to object at any time on grounds relating to your particular situation to processing based on legitimate interest. The Data Controller shall no longer process your personal data unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or for establishment, exercise or defense of legal claims. If processing is for direct marketing, you may object at any time and processing for such purposes will cease, including profiling related to direct marketing.

Right to data portability

If processing is carried out by automated means or is based on your consent, you have the right to receive the personal data you provided to the Data Controller in a structured, commonly used and machine‑readable format (e.g., XML, JSON, CSV) and, where technically feasible, request direct transmission to another controller.

Automated decision‑making

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. In such cases, the Data Controller must provide adequate safeguards, including the right to obtain human intervention, to express your point of view and to contest the decision.

The above does not apply if the decision is necessary for entering into or performing a contract between you and the Data Controller, authorized by Union or Member State law with safeguards to protect your rights, or based on your explicit consent.

Registration in the data protection register

Under the Information Act, the Data Controller had to register certain processing operations. That mandatory registration requirement ceased on 25 May 2018.

Data security measures

The Data Controller declares that it has implemented appropriate security measures to protect personal data against unauthorized access, alteration, transmission, disclosure, erasure or destruction, accidental loss and damage, and against becoming inaccessible due to changes in technology. The Data Controller will do its best within organizational and technical means to ensure processors also implement adequate security measures when handling your personal data.

Remedies

If you consider that the Data Controller has violated any legal provision on data processing or has not complied with a request, you may initiate an investigation by the National Authority for Data Protection and Freedom of Information (mailing address: 1530 Budapest, Pf.: 5., e‑mail: ugyfelszolgalat@naih.hu). You may also bring a civil action in court against the Data Controller if legal provisions were breached or a request was not honored.

Modification of the privacy notice

The Data Controller reserves the right to amend this privacy notice in ways that do not affect the purpose or legal basis of processing. Continued use of the website after the amendment takes effect constitutes acceptance of the modified privacy notice.

If the Data Controller intends to process collected data for purposes other than those for which they were collected, it will inform you before such processing about:

the storage period of personal data or, if not possible, the criteria for determining that period;
your right to request access to, rectification, erasure or restriction of processing of personal data, and to object to processing based on legitimate interest, and the right to data portability if processing is based on consent or a contract;
in case of consent‑based processing, that you can withdraw consent at any time and the right to lodge a complaint with the supervisory authority;
whether provision of personal data is a statutory or contractual requirement or a precondition to enter into a contract and the possible consequences of failure to provide the data;
whether automated decision‑making is used (including profiling) and, where applicable, meaningful information about the logic involved and the significance and envisaged consequences for you.

Processing may start only after you give consent where consent is the legal basis.

This document contains all relevant information about the data processing connected to the operation of the webshop pursuant to Regulation (EU) 2016/679 (GDPR) and Act CXII of 2011 (Information Act).