Data Handling Policy

I. INTRODUCTION The purpose of this Privacy Policy is to provide data subjects with prior information regarding the processing of their personal data by KS Duna Limited Liability Company (Company registration number: 01 09 300383; tax number: 25990812-2-41) as Data Controller (hereinafter: “Controller”) in relation to the operation of the website www.kalvinsquare.hu (hereinafter: “Website”), pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, “GDPR”) and Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (“Info Act”).

The Controller pays particular attention to complying with the applicable legal provisions governing the processing of personal data, particularly the GDPR.

A data subject is any natural person whose personal data is processed by the Controller.

II. DATA CONTROLLER AND CONTACT INFORMATION With respect to data processed in relation to the operation of the Website, the Data Controller is KS Duna Kft..

Registered/Postal address: 1027 Budapest, Horvát utca 14-26. tax number: 25990812-2-41 Email: office@convergen-ce.com Company registration number: 01 09 300383; Court of registration: Metropolitan Court of Registration, Budapest The Controller does not appoint a data protection officer.

III. APPLICABLE LAWS The Controller processes personal data in accordance with the following laws:

• Regulation (EU) 2016/679 (GDPR)

• Act CXII of 2011 (Info Act)

• Act V of 2013 on the Civil Code (“Civil Code”)

• Act I of 2012 on the Labour Code (“Labour Code”)

IV. DEFINITIONS The terms defined in the GDPR apply. The most relevant terms include:

• Personal data: any information relating to an identified or identifiable natural person

• Processing: any operation performed on personal data

• Controller: the entity which determines the purposes and means of the processing

• Processor: the entity that processes personal data on behalf of the Controller

• Recipient: any entity to whom personal data is disclosed

• Third party: an entity other than the data subject, Controller or Processor

• Filing system: a structured set of personal data

• Data breach: a security breach leading to the accidental or unlawful destruction, loss, alteration or unauthorized disclosure of personal data

• Representative: designated person or organization representing the Controller

• Enterprise: an entity engaged in economic activity

• Technical and organizational measures: appropriate safeguards to ensure data protection under the GDPR

V. LEGAL BASES FOR DATA PROCESSING Processing is lawful only if at least one of the following applies:

• The data subject has given consent

• Processing is necessary for contract performance

• Processing is necessary to comply with legal obligations

• Processing is necessary to protect vital interests

• Processing is necessary for the performance of a task carried out in the public interest or official authority

• Processing is necessary for the purposes of legitimate interests pursued by the Controller or a third party

Only one legal basis is used per purpose, which may change during processing.

VI. DATA SECURITY The Controller selects and operates IT systems to ensure:

• Availability

• Authenticity

• Integrity

• Confidentiality

The Controller protects data against unauthorized access, alteration, transmission, disclosure, deletion, or destruction and ensures technical and organizational measures provide appropriate protection against related risks.

VII. PURPOSE, LEGAL BASIS, DATA SCOPE AND DURATION

Purpose	Processed Data	Legal Basis	Duration
Contact via online form	Name, Email address	GDPR Art. 6(1)(a) and (b)	Until consent is withdrawn or contract ends
Newsletter subscription	Name, Email address	GDPR Art. 6(1)(a)	Until unsubscribed

VIII. DATA PROCESSORS AND NEWSLETTERS The Controller does not transfer personal data to third parties without prior consent, except when legally required. Newsletter subscribers consent to marketing communication and may unsubscribe at any time. In case of unsubscription, personal data will be deleted accordingly.

EDM service provider: KS Duna Kft., 1027 Budapest, 14-26 Horvát Street.

IX. HOSTING PROVIDER Hosting provider for the Website: WebSupport Magyarország Kft. Address: 1119 Budapest, Fehérvári út 97–99. Email: support@websupport.hu Website: www.websupport.hu Data is stored on servers located in Hungary, with regular backups.

X. COOKIE POLICY The Website uses small data files (“Cookies”) for identifying the data subject. These are provided via Google Analytics. The use of the Website implies consent to store cookies. Cookies are retained for 30 days. Users may delete or block cookies in their browsers, although this may affect functionality.

Third-party providers (such as Google Inc.) may use cookies to display targeted advertisements based on previous visits.

XI. DATA SUBJECT RIGHTS The data subject has the right to:

• Rectification

• Erasure

• Restriction of processing

• Data portability

• Withdraw consent at any time

The Controller responds to complaints and requests within 30 days. In case of rejection, reasons will be provided.

XII. LEGAL REMEDIES If rights are violated, the data subject may contact: Hungarian National Authority for Data Protection and Freedom of Information (NAIH) Address: 1125 Budapest, Szilágyi Erzsébet fasor 22/C. Postal address: 1530 Budapest, Pf. 5. Phone: +36-1-391-1400 Email: ugyfelszolgalat@naih.hu Website: www.naih.hu

Legal remedy is also available through the competent court.

XIII. DATA TRANSFER, ACCESS Personal data collected via the Website is accessible only to authorized employees of the Controller.

XIV. MISCELLANEOUS Additional data processing activities not listed here will be communicated at the time of data collection. In case of official requests from authorities, the Controller may disclose personal data as required by law.

The Controller reserves the right to unilaterally amend this Policy, except for changes to purpose, scope or legal basis of processing.

XV. ENTRY INTO FORCE This Policy enters into force on June 18, 2018.