Privacy Policy

KAMM, kammanufaktur.com

Last updated: 28 September 2026

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter as: “GDPR”) present privacy policy (hereinafter as: “Policy”) contains all information regarding the processing of personal data provided to

Company name: 616 Werks Korlátolt Felelősségű Társaság
Registered seat: 1052 Budapest, Deák Ferenc tér 3. (MEYER & LEVINSON emelet)
Company registration number: 01-09-278823
Tax number: 25502327-2-41
Registered at: Metropolitan Court of Budapest as Company Registration Court
Represented by: Márk Attila Gázser acting on behalf of URS Racing Kft. as managing director
E-mail: info@kammanufaktur.com

(hereinafter as: “Service Provider”; “We”; “KAMM”)

This Policy applies to individuals visiting the website (hereinafter as: „Website”) of the Service Provider under the domain https://kammanufaktur.com/ requesting or downloading KAMM brochures, submitting inquiries through the Website, subscribing to KAMM newsletters, contacting KAMM by e-mail, and individuals whose personal data are processed through the analytics and marketing technologies described in this Policy (hereinafter collectively referred to as: “Data Subjects”)

The purpose of this Policy is to provide transparent information on why, how and for how long KAMM processes personal data and on the rights available to Data Subjects in connection with such processing.

I. A few data privacy related definitions to better understand the Policy

Personal data

means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Processing

means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Controller

means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by EU or Member State law.

Processor

means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Third Party

means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

Data forwarding

Means the disclosure of personal data to specific third parties.

Data Subject

Everybody who shares his/her personal data with the Service Provider through the Website or via other channels or whose personal data is processed by the Service Provider otherwise. For example, You who reads this Policy.

Consent of the data subject

means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Personal data breach

means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.

Most of the above definitions are used by the GDPR. The full text of the GDPR is available at https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN The above list is not complete so should you need more information or explanation do not hesitate to contact us.

II. Principles of data processing

The Service Provider shall process the personal data of the Data Subject in accordance with the following principles laid down in Article 5 Section (1) of the GDPR:

processes personal data lawfully and fairly and in a transparent manner ("lawfulness, fairness and transparency");
collects personal data only for specified, explicit and legitimate purposes and does not process them in a way incompatible with those purposes ("purpose limitation");
the personal data processed are adequate, relevant and limited to what is necessary for the purposes for which they are processed ("data minimization");
ensure that the personal data are accurate and, where necessary, kept up to date and take all reasonable steps to ensure that personal data which are inaccurate for the purposes for which they are processed are erased or rectified without undue delay ("accuracy");
store the personal data in a form which permits identification of Data Subjects for no longer than is necessary for the purposes for which the personal data are processed ("limited storage");
process personal data in a manner to ensure appropriate security of personal data, including protection against unauthorized or unlawful processing, accidental loss, destruction or damage, by implementing appropriate technical or organizational measures ("integrity and confidentiality")

III. In which cases do we process personal data?

The Service Provider shall process the personal data of the Data Subject in the following cases, taking into account the principles described in Chapter II above:

Browsing the Website;
Requesting a brochure;
Inquiry;
Newsletter subscription;
Cookies.

IV. Which data, for which purpose and for how long do we process?

In each of the cases set out above, the legal ground for processing personal data may be:

In accordance with article 6 Section (1) Point a) of the GDPR the freely given, specific, informed and unambiguous consent of the Data Subject (hereinafter as: „Consent”).
In accordance with article 6 Section (1) Point b) of the GDPR processing is necessary for the performance of a contract to which the Data Subject is party to or in order to take steps at the request of the Data Subject prior to entering into a contract (hereinafter collectively as: „Performance of Contract”).
In accordance with article 6 Section (1) Point c) of the GDPR processing is necessary for compliance with a legal obligation to which the controller is subject (hereinafter as: „Compliance”).
In accordance with article 6 Section (1) Point f) of the GDPR processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party (hereinafter as: „Legitimate Interest”).

Considering that we are unable to limit the scope of personal data sent to us by individual Data Subjects through certain means of communication since we have no control over the personal data that a Data Subject may voluntarily disclose. We therefore kindly ask you not to provide personal data that are not necessary for the purpose of your communication. Where we receive personal data which are not necessary for the relevant purpose, we will not use such data for any additional purpose and will erase them where their continued retention is not required by law or for the establishment, exercise or defence of legal claims.

IV.1. Browsing the Website

Scope of data processed	Purpose of processing	Legal ground for processing	Naming the legitimate interest	Duration of processing
Source IP address (together with: date and time of the request; request type; requested URL; protocol version; response status code; response size; referrer information; browser and user-agent information)	Ensuring the secure, stable and reliable operation of the Website, detecting and investigating technical errors, attempted misuse and unauthorised access, and protecting the Service Provider's IT systems	Legitimate Interest	The Service Provider's legitimate interest in maintaining the security, integrity, availability and proper technical operation of the Website and its IT infrastructure	Maximum 11 days from the date of the relevant server request

Scope of data processed

Source IP address (together with: date and time of the request; request type; requested URL; protocol version; response status code; response size; referrer information; browser and user-agent information)

Purpose of processing

Ensuring the secure, stable and reliable operation of the Website, detecting and investigating technical errors, attempted misuse and unauthorised access, and protecting the Service Provider's IT systems

Legal ground for processing

Legitimate Interest

Naming the legitimate interest

The Service Provider's legitimate interest in maintaining the security, integrity, availability and proper technical operation of the Website and its IT infrastructure

Duration of processing

Maximum 11 days from the date of the relevant server request

When you access the Website, your browser necessarily communicates with our web server. For security and technical purposes, the web server records the technical information listed above in server log files. These data are not used for marketing purposes and are automatically deleted within a maximum of 11 days.

Separately from the server logging described above, the Service Provider operates an internally developed counter which records page views and the duration of page views. The counter does not record IP addresses and does not place cookies or similar identifiers on the Data Subject's device and does not otherwise create an identifier that enables Service Provider to identify or single out an individual visitor. The information generated by this counter therefore does not constitute personal data within the meaning of Article 4 Section (1) GDPR.

IV.2. Requesting a brochure

Scope of data processed	Purpose of processing	Legal ground for processing	Duration of processing
First and last name of the Data Subject	Providing access to the requested KAMM brochure; registering and maintaining the Data Subject as a prospective customer; identifying the relevant country/market; providing market-specific information; and contacting the Data Subject by e-mail in relation to KAMM vehicles, product information and related sales opportunities	Consent	Until the withdrawal of the Data Subject's consent, but in any event no longer than 24 months following the Data Subject's last interaction with the Service Provider, unless a contractual relationship is subsequently established or another legal ground justifies further retention.
E-mail address of the Data Subject	Providing access to the requested KAMM brochure; registering and maintaining the Data Subject as a prospective customer; identifying the relevant country/market; providing market-specific information; and contacting the Data Subject by e-mail in relation to KAMM vehicles, product information and related sales opportunities	Consent	Until the withdrawal of the Data Subject's consent, but in any event no longer than 24 months following the Data Subject's last interaction with the Service Provider, unless a contractual relationship is subsequently established or another legal ground justifies further retention.
Country / region of the Data Subject	Providing access to the requested KAMM brochure; registering and maintaining the Data Subject as a prospective customer; identifying the relevant country/market; providing market-specific information; and contacting the Data Subject by e-mail in relation to KAMM vehicles, product information and related sales opportunities	Consent	Until the withdrawal of the Data Subject's consent, but in any event no longer than 24 months following the Data Subject's last interaction with the Service Provider, unless a contractual relationship is subsequently established or another legal ground justifies further retention.

Scope of data processed

First and last name of the Data Subject

Purpose of processing

Providing access to the requested KAMM brochure; registering and maintaining the Data Subject as a prospective customer; identifying the relevant country/market; providing market-specific information; and contacting the Data Subject by e-mail in relation to KAMM vehicles, product information and related sales opportunities

Legal ground for processing

Consent

Duration of processing

Until the withdrawal of the Data Subject's consent, but in any event no longer than 24 months following the Data Subject's last interaction with the Service Provider, unless a contractual relationship is subsequently established or another legal ground justifies further retention.

Scope of data processed

E-mail address of the Data Subject

Purpose of processing

Legal ground for processing

Consent

Duration of processing

Scope of data processed

Country / region of the Data Subject

Purpose of processing

Legal ground for processing

Consent

Duration of processing

Where the Data Subject requests access to the KAMM brochure, the Service Provider requires the Data Subject to provide his or her name, e-mail address and country/region. The purpose of collecting these data is not limited to making the brochure available. The Service Provider also uses the information to register the Data Subject as a prospective customer, to identify the relevant market, to provide country- and market-specific information and to contact the Data Subject by e-mail in relation to KAMM vehicles, product information and related sales opportunities.

The country/region is required because certain KAMM product materials, visualisations, vehicle configurations and concepts may differ depending on the relevant market, including, for example, left-hand-drive and right-hand-drive configurations.

The legal basis for the above processing is the Data Subject's consent pursuant to Article 6 Section (1) Point (a) of the GDPR. Before submitting the brochure request, the Data Subject is informed that by clicking the “Receive the Brochure” button, he or she consents both to the processing of the personal data provided for the purposes described above and to being contacted by the Service Provider by e-mail in relation to KAMM products and related sales opportunities.

Providing the personal data and giving the above consent is a condition for submitting a brochure request through the Website. The Data Subject is under no statutory or contractual obligation to submit a brochure request.

IV.3. Inquiry

Scope of data processed	Purpose of processing	Legal ground for processing	Naming the legitimate interest	Duration of processing
First and last name of the Data Subject	Responding to the Data Subject's inquiry, providing the requested information, conducting related correspondence and, where the inquiry concerns a potential purchase or commissioning of a KAMM vehicle, taking steps at the Data Subject's request prior to entering into a potential contract.	Legitimate Interest for general inquiries not relating to a potential contract / Performance of contract where the inquiry relates to a potential contractual relationship	The Service Provider's legitimate interest in receiving and responding to business and general inquiries addressed to it	12 months following the last substantive communication relating to the inquiry, unless a contractual relationship is established or longer retention is necessary for the establishment, exercise or defence of legal claims
E-mail address of the Data Subject	Responding to the Data Subject's inquiry, providing the requested information, conducting related correspondence and, where the inquiry concerns a potential purchase or commissioning of a KAMM vehicle, taking steps at the Data Subject's request prior to entering into a potential contract.	Legitimate Interest for general inquiries not relating to a potential contract / Performance of contract where the inquiry relates to a potential contractual relationship	The Service Provider's legitimate interest in receiving and responding to business and general inquiries addressed to it	12 months following the last substantive communication relating to the inquiry, unless a contractual relationship is established or longer retention is necessary for the establishment, exercise or defence of legal claims
Country / region of the Data Subject	Responding to the Data Subject's inquiry, providing the requested information, conducting related correspondence and, where the inquiry concerns a potential purchase or commissioning of a KAMM vehicle, taking steps at the Data Subject's request prior to entering into a potential contract.	Legitimate Interest for general inquiries not relating to a potential contract / Performance of contract where the inquiry relates to a potential contractual relationship	The Service Provider's legitimate interest in receiving and responding to business and general inquiries addressed to it	12 months following the last substantive communication relating to the inquiry, unless a contractual relationship is established or longer retention is necessary for the establishment, exercise or defence of legal claims
Selected KAMM model or inquiry category	Responding to the Data Subject's inquiry, providing the requested information, conducting related correspondence and, where the inquiry concerns a potential purchase or commissioning of a KAMM vehicle, taking steps at the Data Subject's request prior to entering into a potential contract.	Legitimate Interest for general inquiries not relating to a potential contract / Performance of contract where the inquiry relates to a potential contractual relationship	The Service Provider's legitimate interest in receiving and responding to business and general inquiries addressed to it	12 months following the last substantive communication relating to the inquiry, unless a contractual relationship is established or longer retention is necessary for the establishment, exercise or defence of legal claims
Content of the message and any information voluntarily provided by the Data Subject in the inquiry	Responding to the Data Subject's inquiry, providing the requested information, conducting related correspondence and, where the inquiry concerns a potential purchase or commissioning of a KAMM vehicle, taking steps at the Data Subject's request prior to entering into a potential contract.	Legitimate Interest for general inquiries not relating to a potential contract / Performance of contract where the inquiry relates to a potential contractual relationship	The Service Provider's legitimate interest in receiving and responding to business and general inquiries addressed to it	12 months following the last substantive communication relating to the inquiry, unless a contractual relationship is established or longer retention is necessary for the establishment, exercise or defence of legal claims

Scope of data processed

First and last name of the Data Subject

Purpose of processing

Responding to the Data Subject's inquiry, providing the requested information, conducting related correspondence and, where the inquiry concerns a potential purchase or commissioning of a KAMM vehicle, taking steps at the Data Subject's request prior to entering into a potential contract.

Legal ground for processing

Legitimate Interest for general inquiries not relating to a potential contract / Performance of contract where the inquiry relates to a potential contractual relationship

Naming the legitimate interest

The Service Provider's legitimate interest in receiving and responding to business and general inquiries addressed to it

Duration of processing

12 months following the last substantive communication relating to the inquiry, unless a contractual relationship is established or longer retention is necessary for the establishment, exercise or defence of legal claims

Scope of data processed

E-mail address of the Data Subject

Purpose of processing

Legal ground for processing

Legitimate Interest for general inquiries not relating to a potential contract / Performance of contract where the inquiry relates to a potential contractual relationship

Naming the legitimate interest

The Service Provider's legitimate interest in receiving and responding to business and general inquiries addressed to it

Duration of processing

Scope of data processed

Country / region of the Data Subject

Purpose of processing

Legal ground for processing

Legitimate Interest for general inquiries not relating to a potential contract / Performance of contract where the inquiry relates to a potential contractual relationship

Naming the legitimate interest

The Service Provider's legitimate interest in receiving and responding to business and general inquiries addressed to it

Duration of processing

Scope of data processed

Selected KAMM model or inquiry category

Purpose of processing

Legal ground for processing

Legitimate Interest for general inquiries not relating to a potential contract / Performance of contract where the inquiry relates to a potential contractual relationship

Naming the legitimate interest

The Service Provider's legitimate interest in receiving and responding to business and general inquiries addressed to it

Duration of processing

Scope of data processed

Content of the message and any information voluntarily provided by the Data Subject in the inquiry

Purpose of processing

Legal ground for processing

Legitimate Interest for general inquiries not relating to a potential contract / Performance of contract where the inquiry relates to a potential contractual relationship

Naming the legitimate interest

The Service Provider's legitimate interest in receiving and responding to business and general inquiries addressed to it

Duration of processing

IV.4. Newsletter subscription

Scope of data processed	Purpose of processing	Legal ground for processing	Duration of processing
E-mail address of the Data Subject	Sending newsletters, product news, updates, invitations and other marketing communications by e-mail, and documenting the consent given by the Data Subject.	Consent	Until withdrawing consent i.e. unsubscribing from the newsletter
Date and time of subscription	Registering the date on which the Data Subject's express consent was given	Consent	Until withdrawing consent i.e. unsubscribing from the newsletter

Scope of data processed

E-mail address of the Data Subject

Purpose of processing

Sending newsletters, product news, updates, invitations and other marketing communications by e-mail, and documenting the consent given by the Data Subject.

Legal ground for processing

Consent

Duration of processing

Until withdrawing consent i.e. unsubscribing from the newsletter

Scope of data processed

Date and time of subscription

Purpose of processing

Registering the date on which the Data Subject's express consent was given

Legal ground for processing

Consent

Duration of processing

Until withdrawing consent i.e. unsubscribing from the newsletter

IV.5. Cookies

Cookies are data packages that are sent by our webservers to Your computer automatically, where they are stored, depending on the type of the cookie, for a definite period of time.

In order to ensure the smooth operation of the Website, certain cookies (known as session cookies) are automatically installed on Your computer when You visit the Website. The purpose of such cookies is to ensure the security of the Website, to preserve the data recorded on our online forms, to display multimedia content and to balance the traffic on the Website. Personal data collected through the use of these cookies (in particular the IP address of Your computer) will be processed for our legitimate interest in the safe and smooth operation of the Website for the duration of Your stay on our Website. Closing Your browser will automatically delete them from Your computer.

With Your consent given on the Website, the following types of cookies may be installed on Your computer for the following purposes:

Cookies for web analytical measurements and for statistical purposes (e.g., Google Analytics). These are important to us because we are provided with information about the specific characteristics of our visitors (IP address, city, type of device, browser, operating system You are using, and what sub-pages You have visited on our site). We use the information generated through these technologies for statistical analysis and reporting in order to understand the use of the Website and improve our Website and marketing activities.
Remarketing cookies (such as Google AdWords) allow us to analyze how You use our site and, consequently, to display personalized content to You, including advertising on online platforms outside our site (e.g., other websites or social media).

You may find information on Google Analytics cookies here: https://developers.google.com/analytics

Remarketing cookies (e.g. Google Ads cookies and Conversion Linker), which allow us to analyze how You use our website and, based on this, display personalized content and advertisements to you, including on online platforms outside our website (e.g. on other websites or social media platforms).

You may find information on Google AdWords cookies here: https://support.google.com/adwords/answer/2407785?h1=hu

You may find information on Conversion Linker here: https://support.google.com/tagmanager/answer/7549390?hl=en

In addition, we distinguish between session-specific cookies and persistent cookies. A cookie valid for a single session only survives until the User closes the browser. Permanent cookies continue to live and are not automatically deleted when You close Your browser. Why do they stay there and what's good about it? Well, such persistent cookies, for example, help to make the site run faster and remember things that the User has set for himself/herself on the Website.

You can manage cookies in Your browser's settings. How these settings are set depends on the type of Your browser.

Accepting or enabling the use of cookies is not mandatory. You can reset your browser settings to reject all cookies or to notify you when a cookie is being sent. Cookies can also be managed in your browser settings. The way to adjust these settings depends on the type of browser you use.

You may find information on cookie settings for the most popular browsers on the following link:

Google Chrome: https://support.google.com/chrome/answer/95647?hl=hu-hu&p=cpn_cookies
Firefox: https://support.mozilla.org/hu/kb/sutik-informacio-amelyet-weboldalak-tarolnak-szami
Internet Explorer / Edge: https://support.microsoft.com/hu-hu/help/17442/windows-internet-explorer-delete-manage-cookies
Safari: https://support.apple.com/hu-hu/HT201265

We use Meta Pixel to understand how visitors use our Website and to measure the effectiveness of our advertising. Meta Pixel may collect information about your interactions with the Website, such as page views and actions taken on the Website, and may help us determine whether an advertisement resulted in a visit or other conversion.

You may find information on Meta Pixel here: https://www.facebook.com/business/tools/meta-pixel

We use Google Tag Manager to manage certain analytics and advertising technologies on our Website. Through Google Tag Manager, we may use Google Analytics 4, Google Ads conversion tracking, Google Ads remarketing and a Conversion Linker.

These technologies may collect information about how You interact with our Website, such as the pages you visit, the links or buttons you click, and how far you scroll on a page. We use this information to understand how our Website is used, measure the effectiveness of our advertising and, where applicable, show You more relevant advertisements.

Where the Data Subject consents to analytics or marketing technologies, data concerning the Data Subject's Website interactions may be transmitted to Google Ireland Limited in connection with Google Analytics 4, Google Ads and Google Tag Manager, and to Meta Platforms Ireland Limited in connection with Meta Pixel. The subsequent processing of such data by these providers is governed by the applicable service terms and privacy information of the respective provider

V. Where and how is my personal data stored?

Personal data is stored electronically by the Service Provider on cloud-based servers or its internal servers for data storage.

The internal server is provided by UMBRELLA Kreatív Műhely Kereskedelmi és Szolgáltató Korlátolt Felelősségű Társaság (registered seat: 1036 Budapest, Perc utca 2. III. em., company registration number: 01-09-994695, hereinafter as: “Umbrella”) which acts as a data processor on behalf of the Service Provider.

The servers used for this purpose are physically located in the server room operated by OfficeLink Korlátolt Felelősségű Társaság (registered seat: 1138 Budapest, Váci út 188., company registration number: 01-09-194726, hereinafter as: „OfficeLink”). OfficeLink provides the server-room infrastructure services to Umbrella and therefore acts as a sub-processor in relation to the processing of personal data. Both the data processor and the sub-processor may process personal data only to the extent necessary to provide their respective technical and hosting services and in accordance with the applicable data protection requirements.

Where a Data Subject requests a brochure or submits an inquiry through the Website; or subscribes to the Service Provider's newsletter, the personal data provided in connection with the relevant request or registration are also transferred to and stored in a Google Spreadsheet (Google Sheets) used by the Service Provider for managing such requests and registrations.

Access to this Google Spreadsheet is restricted to the Service Provider and those members of its personnel who are authorised to access the relevant personal data. Google provides the technical infrastructure for Google Sheets and processes the data in connection with the provision of that service in accordance with its applicable data processing terms.

The Service Provider takes all necessary technical and organizational steps and precautions to protect personal data and its quality, ensuring continuous availability of physical, electronic, and procedural safeguards that comply with regulations applicable to personal data. These include, among others, operating servers in secure locations and protecting IT equipment with passwords and firewalls.

Despite the above, the Service Provider does not accept liability for the damage, destruction, or unauthorized access of data in the event of technical failure, natural disaster, terrorist act, or criminal offense.

VI. How can You withdraw Your consent if the ground for processing is based on consent?

Consent given for optional analytics and marketing technologies may be withdrawn or modified at any time through the ‘Cookie settings’ link available on the Website. Consent given for newsletters or other electronic marketing communications may be withdrawn at any time by using the unsubscribe link included in the relevant message or by contacting the Service Provider at info@kammanufaktur.com or a mail sent to the Service Provider's registered seat address or in case of newsletter subscription by clicking on the "Unsubscribe" button at the bottom of the email.

Please note that the withdrawal of consent does not affect the lawfulness of the data processing prior to the withdrawal.

VII. What rights do You have in connection with processing Your personal data?

Request for information (right to access): You may request information about the processing of Your personal data at any time, either in person, at our registered seat address, in writing by sending a registered letter or by email to info@kammanufaktur.com.

Pursuant to Article 15 Section (1) of the GDPR, a request may include information on the data processed, their source, purpose, legal ground, duration, name and address of any processor, processing activities and Your rights in relation to processing. In the case of data transfer, to whom and for what purpose Your data have been or will be transferred.

Where the Service Provider has reasonable doubts concerning the identity of the person submitting a request, it may request additional information necessary to confirm the identity of the Data Subject. Any such verification measure will be proportionate to the nature of the request and the personal data concerned.

Rectification: You may at any time request the rectification, modification or amendment of Your data in the same manner described above. We can also do this only on the basis of a request from a credible source presented when submitting the request.

Restriction: You may request that we restrict the processing of our personal information in particular if:

a) You argue the accuracy of the personal data we process. In this case, the limitation refers to the period during which the accuracy of the data is checked.
b) Although the legal ground for processing does not stand for us, but You are requesting us in writing to keep them for the purpose of filing, asserting or defending any legal claim You may have

Objection: If we process Your personal data on the ground of legitimate interest, You may at any time object to the processing of Your personal data. In such cases, we will review the legality of the objection and, if it is well established, we terminate the processing of data and notify anyone to whom the personal data subject to the objection may have been previously transmitted.

Deletion (“Right to be forgotten”): You may request the deletion of Your personal data at any time for any of the reasons set out in Article 17 Section (1) of the GDPR.

We may refuse deletion if the processing of Your personal data is required by law or if it is necessary to enforce our legal claims. We will always inform You about the refusal of the request for deletion. Once it is deleted, the data cannot be recovered.

Transfer of Personal Data (Portability): You may at any time request us to transfer the data processed in connection with You in a structured, widely used, machine-readable format to You or to another controller. Where the processing is based on consent or on a contract and is carried out by automated means, the Data Subject may request to receive the personal data provided by him or her in a structured, commonly used and machine-readable format and, where technically feasible, request their transmission to another controller.

We kindly ask You to not exercise the above rights improperly, but only if it has a real ground or if any of the conditions set out in the GDPR actually exist.

VIII. Embedded and external third-party content

Certain pages of the Website contain video content hosted by YouTube. The YouTube player is used in privacy-enhanced mode and is not loaded until the Data Subject actively chooses to play the relevant video. If the Data Subject initiates playback, the browser establishes a connection with YouTube/Google and technical information, including the Data Subject's IP address and information concerning the browser or device, may be transmitted to Google. Further processing is carried out in accordance with Google's applicable privacy information.

The Website may also display videos originally published on KAMM's own Instagram account.

Such content is retrieved periodically by KAMM's own server through the Meta API and subsequently served to Website visitors from KAMM's server. The visitor's browser does not establish a connection with Meta solely as a result of viewing such gallery content, and no personal data concerning the visitor are transmitted to Meta through this functionality.

The Website may contain ordinary links to external websites and social media profiles. Following such a link results in the Data Subject leaving the Website, after which the processing of personal data is governed by the privacy practices of the relevant third party.

If You are logged in to any of these sites, it may occur that Your visit on the site will be attached to Your personal profile. If you click on the specific button, your browser will forward the relevant information directly to that social media site and store them there.

Information about the scope and purpose of the data collected, further processing of Your data and use of Your data by the social media provider, and Your rights regarding personal data can be found in privacy statements of the social media providers, which are available at:

Facebook: https://www.facebook.com/policy.php
Instagram: https://help.instagram.com/155833707900388
TikTok: https://www.tiktok.com/legal/privacy-policy-eea?lang=hu
YouTube: https://policies.google.com/privacy
X: https://x.com/hu/privacy

IX. To whom we transfer personal data and who has right to access it?

Your personal data will be treated confidentially and will not be disclosed to any third party, except as provided below.

IX.1. Correspondence (e-mail)

IX.1.1. Google Workspace

For e-mail communication the Service Provider uses the services of Google Inc. named Gmail GSuites as part of Google Workspace a business e-mail service provided by:

Company name: Google Ireland Ltd
Registered seat: Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland
Registration number: 368047
Represented by: Elizabeth Margaret Cunningham CEO
Phone: +353 1 436 1000
Data center: Dublin, Ireland

(hereinafter as: “Google”)

Google carries out its data processing within the European Union through its servers located in Dublin, meaning within the EU. If, for any reason, Google processes personal data outside the European Union, such processing ensures protection in accordance with the provisions of the GDPR. More information is available here: https://policies.google.com/privacy/frameworks

Google ensures data protection on multiple levels. For example, it physically secures the servers storing the data by keeping them in restricted areas monitored by security personnel and technicians. Access to server rooms is restricted among employees. At the infrastructure level, Google uses uninterruptible power supplies and other advanced technologies. At the data level, protection is ensured through restricted access, continuous system monitoring, encryption, and firewall protection. Google's privacy policy is available at the following link: https://policies.google.com/privacy

If, for any reason, Google processes personal data outside the European Union, the Data Subject's data will still benefit from the protection provided by the GDPR, in view of the European Commission's adequacy decision on EU-U.S. data flows.

IX.1.2. Microsoft 365

For e-mail communication, the Service Provider also uses the services of Microsoft 365 provided by:

Company name: Microsoft Ireland Operations Limited
Registered seat: One Microsoft Place, South County Business Park, Leopardstown, Dublin 18., Ireland
Registration number: 256796
Represented by: Satya Nadella CEO
Phone: +353 1 706 3117
Data center: Dublin, Ireland

(hereinafter as: “Microsoft”)

Microsoft processes the personal data of individuals residing in the European Union within the European Union, in Ireland. However, Microsoft may also transfer personal data to its parent company, Microsoft Corporation. In such cases, the data continues to benefit from protection under the GDPR considering the European Commission's adequacy decision concerning EU-US data transfers.

Microsoft's privacy-related information is available at the following links:

IX.2. Requesting a brochure, inquiry, and subscribing for the newsletter

As per stipulated above, the Service Provider forwards the necessary personal data to the provider of the internal server according to the following:

Company name: UMBRELLA Kreatív Műhely Kereskedelmi és Szolgáltató Korlátolt Felelősségű Társaság
Registered seat: 1036 Budapest, Perc utca 2. III. em., Hungary
Registration number: 01-09-994695
Represented by: Zoltán Balázs Hidvégi acting on behalf of Schirm Korlátolt Felelősségű Társaság as managing director

(hereinafter as: “Umbrella”)

Umbrella's privacy policy is available at the following link: https://web2025.umbrella.tv/privacy-policy

The data server's location is provided by the following as a sub-processor:

Company name: OfficeLink Korlátolt Felelősségű Társaság
Registered seat: 1138 Budapest, Váci út 188., Hungary
Registration number: 01-09-194726
Tax number: 23596175-2-41
Represented by: Csizmadia Csaba as managing director

(hereinafter as: “OfficeLink”)

OfficeLink's privacy policy is available at the following link: https://officelinkplus.com/privacy-policy/

Google also processes personal data on behalf of the Service Provider in connection with the use of Google Workspace, including Google Sheets used for the management of prospective customer and newsletter subscriber data and the mail merge functionality used for the distribution of newsletters

IX.3. Analytics and advertising providers

Where the Data Subject has consented to the use of analytics or marketing technologies, personal data relating to the Data Subject's use of the Website may be transmitted to Google Ireland Limited in connection with Google Analytics 4, Google Ads and Google Tag Manager, and to Meta Platforms Ireland Limited in connection with Meta Pixel, as described in Section IV.5 above.

X. To whom and in what cases are we required to disclose personal data?

The Service Provider may disclose personal data to courts, authorities or other public bodies where such disclosure is required by applicable law or a legally binding request. We will always inform You of the transfer when it becomes necessary.

XI. What are the responsibilities with regard to the personal data You provide?

When You provide us Your personal data, You are responsible for ensuring that the information and contributions You make are true and correct.

We ask You to provide us third-party data only if specifically authorized to do so by the third party. The Service Provider assumes no liability for any resulting claims.

If a third-party objects the processing of personal data by credibly verifying its identity, we will immediately delete third-party data without notifying You. Please only provide third-party personal data only if you have informed the third party of the availability of this Policy.

Please do not provide us with any personal data in addition to the data requested by the Service Provider and specified in Chapter IV above. If you provide the Service Provider with any personal data in addition to the data requested by the Service Provider, the Service Provider will immediately render it unrecognizable and irretrievably delete it, and excludes its liability for data that the data subject has voluntarily provided to the Service Provider without the Service Provider's request.

XII. Management of Personal data breach

The Service Provider documents personal data breaches in accordance with Article 33 Section (5) of the GDPR. Where a personal data breach is likely to result in a risk to the rights and freedoms of natural persons, the Service Provider will notify the competent supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of the breach. Where a breach is likely to result in a high risk to the rights and freedoms of Data Subjects, the affected Data Subjects will also be informed in accordance with Article 34 of the GDPR, unless an applicable exemption applies.

XIII. Data Protection Officer (DPO)

Pursuant to Article 37 of the GDPR appointment of a DPO is mandatory if:

a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity;
b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or
c) the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 and personal data relating to criminal convictions and offences referred to in Article 10.

With respect to that the Service Provider is not subject to any of the clauses above and because there is no other compelling reason to appoint a DPO we are not appointing anyone for this position.

XIV. Amendment of the Privacy Policy

The Service Provider may amend this Policy where changes in its processing activities, applicable law or other relevant circumstances make such amendment necessary. The current version will always be made available on the Website. Where an amendment materially affects the processing of personal data or the rights of Data Subjects, the Service Provider will take appropriate steps to bring the change to the attention of the affected Data Subjects

XV. Who You may contact for information regarding Your personal data or to exercise Your rights?

Please contact us with any inquiries in e-mail at info@kammanufaktur.com or by mail at 1052 Budapest, Deák Ferenc tér 3. (MEYER & LEVINSON emelet).

The Data Subject is entitled to exercise his / her rights related to the processing of personal data against the Service Provider as controller. If You wish to exercise Your rights, You must notify the Service Provider first.

If You feel that Your rights have been violated, You can complain to the National Authority for Privacy and Freedom of Information:

Name: National Authority for Privacy and Freedom of Information
Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary
Mailing address: 1363 Budapest, PO box: 9., Hungary
Phone: +36 1 391 1400
E-mail: ugyfelszolgalat@naih.hu
Website: http://www.naih.hu

In the event of a dispute arising out of or in connection with this the present Privacy Policy, its breach, validity or interpretation, the User may bring the dispute to the competent court under Act CXXX of 2016 on the Code of Civil Procedure (Code of Civil Procedure):

Name: Fővárosi Törvényszék (Metropolitan Court of Budapest Capitol)
Address: 1055 Budapest, Markó u. 27.
Mailing address: 1363 Bp. Pf. 16
Phone: +36 1 354 6000
E-mail: ft.elnokseg@birosag.hu
Website: https://fovarositorvenyszek.birosag.hu/