BACEE Kft’s Data Protection Policy
1. Introduction
The purpose of this policy is to set out the approach of BACEE Kft. (the “Company”) to theprotection of Personal Data.
This policy applies to all consultants, contractors and temporary personnel engaged by theCompany, including any other parties that may obtain, use, create or maintain Company data.
2. Context
2.1 Scope
The Company collects and uses Personal Data about its partners and other individuals whocome in contact with it (referred to as Data Subjects), in the execution of its business activities.
In collecting and using Personal Data, the Company is committed to respecting the rights ofthese Data Subjects in relation to the processing of their Personal Data, and to complying withall applicable laws and regulations.
This Policy relates to the Company’s activities when it is acting as a Data Controller or as a
Data Processor as defined in the EU General Data Protection Regulation or local equivalentlegislation.
This policy supplements any other policies of the Company relating to information security anddata retention.
The Company may supplement and amend this policy by additional policies and guidelines
from time to time.
2.2 Applicable rules, laws and regulations
The Company is subject to the rules, regulation and laws of a number of jurisdictions, including,but not limited to:
EU Directive 2002/58/ EC.
Local Hungarian legislation relating to data protection
EU GDPR 2016/679
3. Obligations and Requirements
3.1 Responsibility
The policy of the Company is to process Personal Data in accordance with the applicable dataprotection laws and regulations, to protect the rights and freedoms of an individual.
3.2 Principles
The Company will observe the following principles in respect of the processing of Personal
Data:Process Personal Data fairly and lawfully in line with the individuals’ rights;

Ensure that the reasons for processing Personal Data are adequate, relevant and not excessive
for that purpose;
Ensure that Personal Data is kept up to date where necessary;
Ensure that Personal Data is kept only for as long as it is needed;
Ensure that Personal Data is protected from loss or misuse
Ensure that Personal Data is adequately protected when transferred across national borders
and/or shared with 3rd parties.
3.3 Fair and Lawful Processing
The Company will process Personal Data fairly and lawfully and will do so in the following
circumstances:
The processing is necessary to satisfy a legal obligation of the Company;
The processing is in the legitimate interests of the Company and does not unduly prejudice theprivacy of an individual;
Processing is necessary to fulfil the requirements of a contract with a Data Subject;
The Data Subject in question has consented to the processing of their Personal Data.
3.4 Purpose of Processing
In broad terms, the Company will collect and process personal data for the following purposes:
To meet its legal obligations.
To satisfy the legitimate interests of the Company in meeting its objectives and to provide soundgovernance and operational controls.
To meet the contractual obligations of the Company.
The Data Subject’s rights are protected by law. A Data Subject may request erasure, object orotherwise make representations to the Company, which the Company will act on in accordancewith its legal obligations.
3.5 Accuracy, adequacy, relevance and proportionality
Personal Data must be processed in a way that is accurate, adequate, relevant, and proportionate
for the purpose for which it was obtained.
Personal Data obtained for one reason may not be used for any other purpose not directly
connected to the original reason for its collection and processing (unless the individual inquestion has explicitly agreed to this additional processing, or, would otherwise reasonably
expect that their data may be used in this way).
The Company must ensure that Personal Data held by the Company is accurate and updated asrequired. If the Personal Data or circumstances of an individual change, this merits at least a
review of the Personal Data held by the Company.

All proposed changes to the processing of Personal Data will be considered so as to ensure thatthe proposed processing changes do not expose the Company to non-compliance or possible
data breach risks.
3.6 Data retention
Personal Data must not be retained for any longer than is necessary to satisfy the fair and lawful
reason for processing it.
3.7 Classification, Handling & Data Breach Reporting
The Company will classify and handle Personal Data in a manner, which is consistent with thispolicy and all applicable law. It will investigate any breach of its obligations and takeappropriate remedial actions; and make any applicable notifications.
3.8 Transfers
Personal Data can only be transferred in appropriate circumstances.
The Company may choose to utilize the services of a Data Processor and where it does so it
must ensure suitable steps are taken to protect the Personal Data it has collected as a Controller.
A Controller remains responsible for all aspects of the data collected on its behalf.
3.9 Rights of individuals
Data Subjects are entitled to send their inquiries related to the handling of their personal data inwriting to the Company by post, or by email to istvan.lengyel@bacee.com. Data Subjects areentitled to file a complaint or (submit a request for) a legal remedy regarding data processing
with the Hungarian National Authority for Data Protection and Freedom of Information or acourt.
According to articles 12-21 of the General Data Protection Regulation, Data Subjects areentitled to request the Company, as the Data Controller, to access, correct, delete or restrict theprocessing of their personal data and to object to the processing of such personal data in person,in written form by mail (H-1013 Budapest, Feszty Árpád utca 2.), by phone (+361 212 62 10)
or by email (istvan.lengyel@bacee.eu).
In the event of a breach of the Data Subject’s rights under the General Data Protection
Regulation, Data Subjects are entitled to lodge a complaint with the Data Controller at thecontact details provided above.
Data Subjects are also entitled to file a complaint with the Hungarian National Authority for
Data Protection and Freedom of Information (http://naih.hu/; 1055 Budapest, Falk Miksa utca
9-11; Postal address: 1374 Budapest, Pf. 603.; Phone: +36 (30) 683-5969; +36 (30) 549-6838
E-mail: ugyfelszolgalat@naih.hu).