Privacy Policy and User Notice

Privacy Policy and User Notice

of padthai WOKSTAR mobile application

1.Introduction 

R.T.B. Restaurant Limited Liability Company (hereinafter referred to as “Padthai”), the Operator of the padthai WOKSTAR mobile application considers it important to respect and enforce the data processing rights of all natural persons concerned (hereinafter referred to as “you”). In handling, recording, processing and transmitting your personal data, Padthai acts in accordance with Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (hereinafter: Infotv.), REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Regulation (EC) No 95/46/EC (GDPR), and other legal provisions on data protection. 

Please note that where the legal basis for processing is your consent, you have the right to withdraw your consent at any time, without prejudice to the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal. Please send your request for withdrawal of consent to one of our contact details set out in point 2. 

In cases where the legal basis for the processing is the legitimate interest of Padthai, you have the right to object to the processing. Please send your objection request to one of our contact details set out in point 2.

2.Who is the data controller?

Name: R.T.B. Restaurant Limited Liability Company (hereinafter referred to as “Padthai”)

Registered office (postal address): 1122 Budapest, Bíró utca 7.

Company registration number: 01-09-201806

VAT number: 24103114-2-43

Statistical number: 24103114-5610-113-01

2.1 Where can the data controller be contacted? 

by post: 1122 Budapest, Bíró utca 7.

by e-mail: support(at)padthaiwokbar.com 

2.2 Who is the Data Protection Officer?

The Data Protection Officer: Boda Csaba

E-mail address: boda.csaba(at)padthaiwokbar.com

3.What are the basic principles of data processing and on what legal basis is data processed?

3.1. Principles of data management

Padthai will process your personal data only to the extent and for the period strictly necessary for the purposes for which it is collected.

In the course of data processing, Padthai ensures the accuracy, completeness and timeliness of the data processed. 

3.2 Legal grounds for data processing

The legal basis of the processing carried out by Padthai varies from one processing to another. The individual legal bases are set out in the list in section 4.

4.What are the data processing operations, their purposes, what data are processed by Padthai and for how long?

5. How does Padthai have your personal data?Padthai will only process personal data that you provide to us. 6. Where do we store the data?Padthai will store your personal data electronically through its data processor, as its hosting provider, as set out in section 7.1.5. 7. Will a data processor be used? 7.1 Padthai uses the following data processors to process the data, which act solely on Padthai’s instructions and do not collect, store or process personal data for their own purposes.7.2. Padthai will send your order-related data, such as your telephone number, e-mail address, billing data, delivery address (in case of home delivery) to the restaurant concerned for the purpose of fulfilling your order, so the data processors of your personal data may be the operators of the Padthai group of restaurants listed below8. What measures does Padthai take to ensure the security of the personal data it processes?8.1. Padthai designs and implements its processing operations in such a way as to ensure the highest level of protection of your privacy when applying the Infotv., the GDPR and other rules applicable to data processing.8.2. Padthai shall ensure the security of the data, take the technical and organisational measures and establish the procedural rules necessary to enforce the Infotv., GDPR and other data and confidentiality protection rules.8.3. Padthai shall take appropriate measures to protect the data against, in particular, unauthorized access, alteration, unauthorised disclosure, deletion or destruction, accidental destruction or damage, and loss of access due to changes in the technology used.8.4.Where Padthai uses automated systems for the processing of personal data, Padthai will take additional measures to ensure that.

• • prevent unauthorised data entry;
  • preventing the use of automatic data-processing systems by unauthorised persons using data transmission equipment;
  • the verifiability and ascertainability of the bodies to which personal data have been or may be transmitted using data transmission equipment;
  • the verifiability and ascertainability of which personal data have been entered into automated data processing systems, when and by whom;
  • the recoverability of the installed systems in the event of a failure, and
  • that errors in automated processing are reported.

8.5 Padthai will take into account the state of the art when determining and applying measures for data security. Padthai will choose among several possible data processing solutions the one that ensures a higher level of protection of personal data, unless this would impose a disproportionate burden on Padthai.9. In which cases may personal data be transferred to third parties? Padthai does not transfer users’ personal data to third parties. 10.What are your rights and how can they be enforced?You have a number of rights when your personal data is processed and you can exercise them at any time. The Data Controller lists these rights below, together with what each right means for you. You may exercise your rights by sending a request to one of the contact details of the Controller set out in point 2. Right to withdraw consentThe data processing set out in points 1 and 6 of the table in point 4 is based on your consent, which you have the right to withdraw at any time. Such withdrawal shall not affect the lawfulness of the processing that took place before the withdrawal. Please send your request for withdrawal of consent to one of our contact details set out in point 2.Right of access and rectification of personal dataYou have the right to access, copy, correct or update your personal data at any time. Under the right of access, you are entitled to receive information about:a) the purposes of the processing; b) the categories of personal data concerned; (c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations (d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; (e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;(f) the right to lodge a complaint with a supervisory authority; and(g) the fact of automated decision-making, including profiling (which in this case is the identification of personal preferences and interests based on the personal data in the database and the sending of direct marketing based on this).We understand the importance of this, so if you wish to exercise these rights, please contact us using one of the contact details set out in section 2.Right to data portabilityYour personal data is portable. This means that they can be moved, copied and transmitted electronically. If you wish to exercise your right to data portability, please contact us using one of the contact details set out in section 2.Right to erasure of personal data You have the right to request the erasure of your data if. 

• • your personal data is no longer necessary for the purpose(s) for which it was collected; or
  • you withdraw your prior consent to the processing of your personal data and there is no other legal basis for the processing; or
  • objects to the processing of your personal data; 
  • the processing of personal data is not lawful; or
  • the deletion of your personal data is justified on grounds of compliance with the law.

However, the Controller is not obliged to comply with your request if the processing is necessary:

• to exercise the right to freedom of expression and information;
• for the purposes of complying with an obligation under Union or Member State law to which the controller is subject to which the processing of personal data is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• on grounds of public interest in the field of public health;
• for archiving purposes in the public interest, scientific and historical research purposes or statistical purposes, where the deletion of the data would be likely to render impossible or seriously impair such processing; or
• to bring, enforce or defend legal claims.

If you wish to exercise this right, please contact us using one of the contact details set out in section 2.Right to restriction of processingYou may restrict the processing of your personal data if.a) believes that the personal data held about you is inaccurate; orb) the processing of personal data is not lawful, but instead of requesting their erasure, you would prefer to restrict their processing; or(c) your personal data are no longer needed by the Controller for the purpose(s) for which they were originally collected, but you need them for the purpose of bringing or pursuing a legal claim or defending against a claim; or d) You have objected to the processing of your personal data and are awaiting confirmation as to whether your interests in objecting override the legal basis for the processing.If you wish to restrict the processing of your personal data, please contact us using one of the contact details set out in section 2.The right to protestYou can object to the processing of your personal data at any time. If you wish to do so, please contact us using one of the contact details set out in section 2.Automated decision-makingSince we determine your preference, interests and the subject of direct marketing messages based on your personal data in the database described in point 4.3, you have the right to tell us if you disagree with your personal preference, interests or the subject of direct marketing messages that we have determined, to express your disagreement, or to contact us to have a member of our staff check that we have determined your preference and interests correctly. If you wish to exercise this right, please contact us using any of the contact details set out in section 2.11.What are the consequences of unlawful processing? Right to apply to a supervisory authority11.1 Padthai shall compensate you for any damage caused by the unlawful processing of your data or by any breach of data security. 11.2 If Padthai also infringes the personal rights of the data subject by unlawfully processing your data or by breaching data security requirements, you may also claim damages from Padthai. 11.3.If Padthai refuses to exercise any of your rights, or if you are not satisfied with our response, or if you wish to lodge a complaint, you may take your case to a civil court or to the National Authority for Data Protection and Freedom of Information (address: 1055 Budapest, Falk Miksa utca 9-11.; postal address: 1363 Budapest, Pf.: 9.; telephone number: +36 (1) 391-1400; email address: ugyfelszolgalat@naih.hu ) as supervisory authority.Done at Budapest, 23 January 2025