A

B

C

D

E

F

Subject

Data Category

Data origin

Purpose of data management

Legal basis of data management

Duration of data management

User registered within Simple

name*

From Subject

a)     Concluding the contract, determination of its content, modification, completion thereof

b)     Invoicing of contractual charges

c)     Claim and law enforcement, fraud prevention and management

d)     User identification

e)     Ensuring communication

In case of processing purposes of column D/a) and b): Article 13/A E-commerce Act

In case of processing purposes of column D/a), d) and e):

GDPR Article 6 (1) b) Conclusion of Contract

In case of processing purposes of column D/b):

GDPR Article 6 (1) c) Fulfilment of legal obligation – in case of data necessary for the fulfilment of taxation obligations Act CL of 2019 on the order of taxation Section 78 (3) and 202 (1) shall apply. If the data are necessary for the fulfilment of the accounting obligations, Act C of 2000 on accounting sections 168-169 shall apply.

In case of processing purposes of column D/c):

GDPR Article 6 (1) f) Legitimate interest Fraud prevention and management 

If the data are necessary for the fulfilment of tax obligations, they will be stored for 5 years calculated from the last year from that calendar year in which the tax should have been reported or in the lack of reporting in which the tax should have been paid.

If the data are necessary for the fulfilment of the accounting obligations, retention period is 8 years.

Data processed for the purpose of enforcement of claims and rights, fraud prevention and fraud management purposes will be retained for a general limitation period of 5 years from the date of deletion of the Simple registration, provided that if civil, criminal, administrative or other official proceedings are initiated during this period, the data will be retained until the final conclusion of such proceedings.

In any other case the data shall be stored for 5 years after the termination of the registration (general term of statute of limitation).

e-mail address*

From Subject

a)    Concluding the contract, determination of its content, modification, completion thereof

b)   Invoicing of contractual charges

f)      Claim and law enforcement, fraud prevention and management

c)    User identification

d)   Ensuring communication

In case of processing purposes of column D/a) and b): Article 13/A E-commerce Act

In case of processing purposes of column D/a), d) and e):

GDPR Article 6 (1) b) Conclusion of Contract

In case of processing purposes of column D/b):

GDPR Article 6 (1) c) Fulfilment of legal obligation – in case of data necessary for the fulfilment of taxation obligations Act CL of 2019 on the order of taxation Section 78 (3) and 202 (1) shall apply. If the data are necessary for the fulfilment of the accounting obligations, Act C of 2000 on accounting sections 168-169 shall apply.

In case of processing purposes of column D/c):

GDPR Article 6 (1) f) Legitimate interest

If the data are necessary for the fulfilment of tax obligations, they will be stored for 5 years calculated from the last year from that calendar year in which the tax should have been reported or in the lack of reporting in which the tax should have been paid.

If the data are necessary for the fulfilment of the accounting obligations, retention period is 8 years.

Data processed for the purpose of enforcement of claims and rights, fraud prevention and fraud management purposes will be retained for a general limitation period of 5 years from the date of deletion of the Simple registration, provided that if civil, criminal, administrative or other official proceedings are initiated during this period, the data will be retained until the final conclusion of such proceedings.

In any other case the data shall be stored for 5 years after the termination of the registration (general term of statute of limitation).

phone number*

From Subject

a)    User identification

b)   Ensuring communication

GDPR Article 6 (1) b) Conclusion of Contract

For 5 years after the termination of the registration (general term of statute of limitation).

password*

From Subject

a)    User identification

b)   Ensuring communication

GDPR Article 6 (1) b) Conclusion of Contract

For 5 years after the termination of the registration (general term of statute of limitation).

e-mail address pertaining to a Facebook account(if it differs from the e-mail address of the Simple account)

From Subject

a)    User identification

b)   Ensuring communication

GDPR Article 6 (1) b) Conclusion of Contract

For 5 years after the termination of the registration (general term of statute of limitation).

name pertaining to a Facebook acount (if it differs from the name given in the Simple acocunt)

From Subject

a)    User identification

b)   Ensuring communication

GDPR Article 6 (1) b) Conclusion of Contract

For 5 years after the termination of the registration (general term of statute of limitation).

avatar pertaining to a Facebook account (profile picture)

From Subject

a)    User identification

b)   Personalizing the User account

GDPR Article 6 (1) a) Consent

3 months from the deletion of Simple account and Simple registration by the User.

e-mail address pertaining to a Google account (if it differs from the e-mail address of the Simple account)

From Subject

a)    User identification

b)   Ensuring communication

GDPR Article 6 (1) b) Conclusion of Contract

For 5 years after the termination of the registration (general term of statute of limitation).

name pertaining to a Google account (if it differs from the name given in the Simple acocunt)

From Subject

a)    User identification

b)   Ensuring communication

GDPR Article 6 (1) b) Conclusion of Contract

For 5 years after the termination of the registration (general term of statute of limitation).

e-mail address belonging to the Apple account (if it differs from the e-mail address of Simple account)

From Subject

a)      User identification

b)   Ensuring communication

GDPR Article 6 (1) b) Conclusion of Contract

For 5 years after the termination of the registration (general term of statute of limitation).

Age data (under 16 years or not) *

From Subject

c)    Ascertaining of parental consent necessity

GDPR Article 6 (1) c) Fulfilment of legal obligation – Request of parental consent – According to Article 8 of the GDPR, the parent exercising parental rights needs to grant the consent or needs to authorize it on behalf of the person younger than 16 years old.

For 5 years after the termination of the registration (general term of statute of limitation).

Phone identification code

Generated by the data conroller

a)     User identification

b)    Ensuring communication

GDPR Article 6 (1) a) Consent

For 5 years after the termination of the registration (general term of statute of limitation).

A

B

C

D

E

F

Subject

Data Category

Data origin

Purpose of data management

Legal basis of data management

Duration of data management

User registered within Simple

ID of the concluded transaction

From Subject

a)      Concluding the contract, determination of its content, modification, completion thereof

b)      Invoicing of contractual charges

c)     Claim and law enforcement

In case of processing purposes of column D/a) and b): Article 13/A E-commerce Act

In case of processing purposes of column D/a) and b):

GDPR Article 6 (1) b) Conclusion of Contract

In case of processing purposes of column D/c):

GDPR Article 6 (1) f) Legitimate Interest

If the data are necessary for the fulfilment of tax obligations, they will be stored for 5 years calculated from the last year from that calendar year in which the tax should have been reported or in the lack of reporting in which the tax should have been paid.

If the data are necessary for the fulfilment of the accounting obligations, retention period is 8 years.

Data processed for the purpose of enforcement of claims and rights will be retained for a general limitation period of 5 years from the date of deletion of the Simple registration, provided that if civil, criminal, administrative or other official proceedings are initiated during this period, the data will be retained until the final conclusion of such proceedings.

In any other case the data shall be stored for 5 years after the termination of the registration (general term of statute of limitation).

price of the concluded transaction

From Subject

a)     Concluding the contract, determination of its content, modification, completion thereof

b)    Invoicing of contractual charges

c)     Claim and law enforcement

In case of processing purposes of column D/a) and b): Article 13/A E-commerce Act

In case of processing purposes of column D/a) and b):

GDPR Article 6 (1) b) Conclusion of Contract

In case of processing purposes of column D/b):

GDPR Article 6 (1) c) Fulfilment of legal obligation – billing

In case of processing purposes of column D/c):

GDPR Article 6 (1) f) Legitimate Interest

If the data are necessary for the fulfilment of tax obligations, they will be stored for 5 years calculated from the last year from that calendar year in which the tax should have been reported or in the lack of reporting in which the tax should have been paid.

If the data are necessary for the fulfilment of the accounting obligations, retention period is 8 years.

Data processed for the purpose of enforcement of claims and rights will be retained for a general limitation period of 5 years from the date of deletion of the Simple registration, provided that if civil, criminal, administrative or other official proceedings are initiated during this period, the data will be retained until the final conclusion of such proceedings.

In any other case the data shall be stored for 5 years after the termination of the registration (general term of statute of limitation).

Subject of the concluded transaction

(purchased product, service)

From Subject

a)     Concluding the contract, determination of its content, modification, completion thereof

b)    Invoicing of contractual charges

c)     Claim and law enforcement

In case of processing purposes of column D/a) and b): Article 13/A E-commerce Act

In case of processing purposes of column D/a) and b):

GDPR Article 6 (1) b) Conclusion of Contract

In case of processing purposes of column D/b):

GDPR Article 6 (1) c) Fulfilment of legal obligation – billing

In case of processing purposes of column D/c):

GDPR Article 6 (1) f) Legitimate Interest

If the data are necessary for the fulfilment of tax obligations, they will be stored for 5 years calculated from the last year from that calendar year in which the tax should have been reported or in the lack of reporting in which the tax should have been paid.

If the data are necessary for the fulfilment of the accounting obligations, retention period is 8 years.

Data processed for the purpose of enforcement of claims and rights will be retained for a general limitation period of 5 years from the date of deletion of the Simple registration, provided that if civil, criminal, administrative or other official proceedings are initiated during this period, the data will be retained until the final conclusion of such proceedings.

In any other case the data shall be stored for 5 years after the termination of the registration (general term of statute of limitation).

Shipping address

From Subject

a)     Concluding the contract, determination of its content, modification, completion thereof

b)    Claim and law enforcement

In case of processing purpose of column D/a): Article 13/A E-commerce Act

In case of processing purpose of column D/a):

GDPR Article 6 (1) b) Conclusion of Contract

In case of processing purposes of column D/b):

GDPR Article 6 (1) f) Legitimate Interest

If the data are necessary for the fulfilment of tax obligations, they will be stored for 5 years calculated from the last year from that calendar year in which the tax should have been reported or in the lack of reporting in which the tax should have been paid.

If the data are necessary for the fulfilment of the accounting obligations, retention period is 8 years.

Data processed for the purpose of enforcement of claims and rights will be retained for a general limitation period of 5 years from the date of deletion of the Simple registration, provided that if civil, criminal, administrative or other official proceedings are initiated during this period, the data will be retained until the final conclusion of such proceedings.

In any other case the data shall be stored for 5 years after the termination of the registration (general term of statute of limitation).

Billing name and address

From Subject

a)     Concluding the contract, determination of its content, modification, completion thereof

b)    Invoicing of contractual charges

c)     Claim and law enforcement, fraud prevention and fraud management

In case of processing purposes of column D/a) and b): Article 13/A E-commerce Act

In case of processing purposes of column D/a) and b):

GDPR Article 6 (1) b) Conclusion of Contract

In case of processing purposes of column D/b):

GDPR Article 6 (1) c) Fulfilment of legal obligation – in case of data necessary for the fulfilment of taxation obligations Act CL of 2019 on the order of taxation Section 78 (3) and 202 (1) shall apply. If the data are necessary for the fulfilment of the accounting obligations, Act C of 2000 on accounting sections 168-169 shall apply.

In case of processing purposes of column D/c):

GDPR Article 6 (1) f) Legitimate Interest

If the data are necessary for the fulfilment of tax obligations, they will be stored for 5 years calculated from the last year from that calendar year in which the tax should have been reported or in the lack of reporting in which the tax should have been paid.

If the data are necessary for the fulfilment of the accounting obligations, retention period is 8 years.

Data processed for the purpose of enforcement of claims and rights, fraud prevention and fraud management purposes will be retained for a general limitation period of 5 years from the date of deletion of the Simple registration, provided that if civil, criminal, administrative or other official proceedings are initiated during this period, the data will be retained until the final conclusion of such proceedings.

In any other case the data shall be stored for 5 years after the termination of the registration (general term of statute of limitation).

E-mail address, currency, type of payment, name , quantity and price of the product/services purchased, license plate of the vehicle in case of e-vignette and parking services

From the User

Issuing receipt

GDPR Article 6 (1) c) Fulfilment of legal obligation – in case of data necessary for the fulfilment of taxation obligations Act CL of 2019 on the order of taxation Section 78 (3) and 202 (1) shall apply. If the data are necessary for the fulfilment of the accounting obligations, Act C of 2000 on accounting sections 168-169 shall apply and sections 166, 167, 173 and 173/A of the Act CXXVII of 2007 on the value added tax.

If the data are necessary for the fulfilment of tax obligations, they will be stored for 5 years calculated from the last year from that calendar year in which the tax should have been reported or in the lack of reporting in which the tax should have been paid.

If the data are necessary for the fulfilment of the accounting obligations, retention period is 8 years.

In any other case the data shall be stored for 5 years after the termination of the registration (general term of statute of limitation).

GPS coordinates, if the User has authorized it

From Mobile device

Profiling – displaying of behavioural advertisements, learning about customer preferences

GDPR Article 6 (1) a) Consent

Until the consent is withdrawn.

A

B

C

D

E

F

Subject

Data Category

Data origin

Purpose of data management

Legal basis of data management

Duration of data management

User registered within Simple and turning to the customer service

name*

From Subject

a)     User identification

b)    Communication with the User in course of complaint management

c)     Completion of contract

d)    Complaint management

e)    Claim and law enforcement

GDPR Article 6 (1) f) Legitimate Interest

Within the general civil law limitation period following the complaint, that is 5 years from the submission of the complaint.

Data processed for the purpose of enforcement of claims and rights will be retained for a general limitation period of 5 years from the date of deletion of the Simple registration, provided that if civil, criminal, administrative or other official proceedings are initiated during this period, the data will be retained until the final conclusion of such proceedings.

e-mail address*

From Subject

a)     User identification

b)    Communication with the User in course of complaint management

c)     Completion of contract

d)    Complaint management

e)    Claim and law enforcement

GDPR Article 6 (1) f) Legitimate Interest

Within the general civil law limitation period following the complaint, that is 5 years from the submission of the complaint.

Data processed with the purpose of enforcement of claims and rights will be retained for a general limitation period of 5 years from the date of deletion of the Simple registration, provided that if civil, criminal, administrative or other official proceedings are initiated during this period, the data will be retained until the final conclusion of such proceedings.

registration number

From Subject

a)      User identification

b)     Communication with the User in course of complaint management

c)      Completion of contract

d)     Complaint management

e)     Claim and law enforcement

GDPR Article 6 (1) f) Legitimate Interest

Within the general civil law limitation period following the complaint, that is 5 years from the submission of the complaint.

Data processed with the purpose of enforcement of claims and rights will be retained for a general limitation period of 5 years from the date of deletion of the Simple registration, provided that if civil, criminal, administrative or other official proceedings are initiated during this period, the data will be retained until the final conclusion of such proceedings.

Data indicated in the minutes on the complaint: name of the consumer, address of the consumer, time, place and way of making complaint, detailed description of the complaint, list of documents, evidence submitted by the consumer, Simple”s statement on its standpoint on the consumer's complaint; if the complaint can be examined immediately, signature of the person acting on behalf of Simple and signature of the consumer - except for complaints fixed via phone or by using any other electronic communication services; place and date of the minutes, unique identifier of the complaint in case of complaint made via phone or by using electronic communication services.

From subject and/or determined by Simple

Keeping records of the complaint

GDPR Article 6 (1) c) – Legal obligation – Act CLV of 1997 on the consumer protection section 17/A (5) stipulates the mandatory elements of the minutes of complaints.

For 5 years from the date of the complaint

phone number

From Subject

a)      User identification

b)     Communication with the User in course of complaint management

c)      Complaint management

GDPR Article 6 (1) f) Legitimate Interest

Within the general civil law limitation period following the complaint, that is 5 years from the submission of the complaint.

recorded phone call

From Subject

a)      User identification

b)     Quality assurance

c)      Protection of consumers’ rights

d)     Proof of the content of the complaint

e)     Claim and law enforcement

GDPR Article 6 (1) c) Legal obligation – According to Articlée 17/B (3) of the Act CLV of 1997 on consumer protection all verbal complaint made via phone to the customer service and all phone communication between the consumer and the customer service shall be recorded. The sound recording shall be indicated with a unique identifier and shall be kept for 5 years.

Within the general civil law limitation period following the complaint, that is 5 years from the submission of the complaint.

subject of complaint

From Subject

a)     Complaint management

b)    Claim and law enforcement

GDPR Article 6 (1) f) Legitimate Interest

Within the general civil law limitation period following the complaint, that is 5 years from the submission of the complaint.

Data processed with the purpose of enforcement of claims and rights will be retained for a general limitation period of 5 years from the date of deletion of the Simple registration, provided that if civil, criminal, administrative or other official proceedings are initiated during this period, the data will be retained until the final conclusion of such proceedings.

parameters of transaction in question

From Subject

a)     Complaint management

b)    Claim and law enforcement

GDPR Article 6 (1) f) Legitimate Interest

Within the general civil law limitation period following the complaint, that is 5 years from the submission of the complaint.

Data processed with the purpose of enforcement of claims and rights will be retained for a general limitation period of 5 years from the date of deletion of the Simple registration, provided that if civil, criminal, administrative or other official proceedings are initiated during this period, the data will be retained until the final conclusion of such proceedings.

A

B

C

D

E

F

Subject

Data Category

Data origin

Purpose of data management

Legal basis of data management

Duration of data management

User registered within Simple

Vehicle’s licence plate*

From Subject

a)     Concluding the contract, determination of its content, modification, completion thereof

b)    Invoicing of contractual charges

c)     Claim and law enforcement

In case of processing purposes of column D/a) and b): Article 13/A E-commerce Act

In case of processing purposes of column D/a) and b):

GDPR Article 6 (1) b) Conclusion of Contract

In case of processing purposes of column D/b):

GDPR Article 6 (1) c) Fulfilment of legal obligation – billing

In case of processing purposes of column D/c):

GDPR Article 6 (1) f) Legitimate interest

If the data are necessary for the fulfilment of tax obligations, they will be stored for 5 years calculated from the last year from that calendar year in which the tax should have been reported or in the lack of reporting in which the tax should have been paid.

If the data are necessary for the fulfilment of the accounting obligations, retention period is 8 years.

Data processed with the purpose of enforcement of claims and rights will be retained for a general limitation period of 5 years from the date of deletion of the Simple registration, provided that if civil, criminal, administrative or other official proceedings are initiated during this period, the data will be retained until the final conclusion of such proceedings.

In any other case the data shall be stored for 5 years after the termination of the registration (general term of statute of limitation).

Vehicle’s country denomination*

From Subject

a)     Concluding the contract, determination of its content, modification, completion thereof

b)    Invoicing of contractual charges

c)     Claim and law enforcement

In case of processing purposes of column D/a) and b): Article 13/A E-commerce Act

In case of processing purposes of column D/a) and b):

GDPR Article 6 (1) b) Conclusion of Contract

In case of processing purposes of column D/c):

GDPR Article 6 (1) f) Legitimate interest

If the data are necessary for the fulfilment of tax obligations, they will be stored for 5 years calculated from the last year from that calendar year in which the tax should have been reported or in the lack of reporting in which the tax should have been paid.

If the data are necessary for the fulfilment of the accounting obligations, retention period is 8 years.

Data processed with the purpose of enforcement of claims and rights will be retained for a general limitation period of 5 years from the date of deletion of the Simple registration, provided that if civil, criminal, administrative or other official proceedings are initiated during this period, the data will be retained until the final conclusion of such proceedings.

In any other case the data shall be stored for 5 years after the termination of the registration (general term of statute of limitation).

Parking location*

From Subject

a)     Concluding the contract, determination of its content, modification, completion thereof

b)    Invoicing of contractual charges

c)     Claim and law enforcement

In case of processing purposes of column D/a) and b): Article 13/A E-commerce Act

In case of processing purposes of column D/a) and b):

GDPR Article 6 (1) b) Conclusion of Contract

In case of processing purposes of column D/c):

GDPR Article 6 (1) f) Legitimate interest

If the data are necessary for the fulfilment of tax obligations, they will be stored for 5 years calculated from the last year from that calendar year in which the tax should have been reported or in the lack of reporting in which the tax should have been paid.

If the data are necessary for the fulfilment of the accounting obligations, retention period is 8 years.

Data processed with the purpose of enforcement of claims and rights will be retained for a general limitation period of 5 years from the date of deletion of the Simple registration, provided that if civil, criminal, administrative or other official proceedings are initiated during this period, the data will be retained until the final conclusion of such proceedings.

In any other case the data shall be stored for 5 years after the termination of the registration (general term of statute of limitation).

A

B

C

D

E

F

Subject

Data Category

Data origin

Purpose of data management

Legal basis of data management

Duration of data management

User registered within Simple

Vehicle’s licence plate *

From Subject

a)      Concluding the contract, determination of its content, modification, completion thereof

b)     Invoicing of contractual charges

c)      Claim and law enforcement

In case of processing purposes of column D/a) and b): Article 13/A E-commerce Act

In case of processing purposes of column D/a) and b):

GDPR Article 6 (1) b) Conclusion of Contract

In case of processing purposes of column D/b):

GDPR Article 6 (1) c) Fulfilment of legal obligation – billing

In case of processing purposes of column D/c):

GDPR Article 6 (1) f) Legitimate interest

If the data are necessary for the fulfilment of tax obligations, they will be stored for 5 years calculated from the last year from that calendar year in which the tax should have been reported or in the lack of reporting in which the tax should have been paid.

If the data are necessary for the fulfilment of the accounting obligations, retention period is 8 years.

Data processed with the purpose of enforcement of claims and rights will be retained for a general limitation period of 5 years from the date of deletion of the Simple registration, provided that if civil, criminal, administrative or other official proceedings are initiated during this period, the data will be retained until the final conclusion of such proceedings.

In any other case the data shall be stored for 5 years after the termination of the registration (general term of statute of limitation).

Vehicle’s country denomination *

From Subject

a)      Concluding the contract, determination of its content, modification, completion thereof

b)     Invoicing of contractual charges

c)      Claim and law enforcement

In case of processing purposes of column D/a) and b): Article 13/A E-commerce Act

In case of processing purposes of column D/a) and b):

GDPR Article 6 (1) b) Conclusion of Contract

In case of processing purposes of column D/c):

GDPR Article 6 (1) f) Legitimate interest

If the data are necessary for the fulfilment of tax obligations, they will be stored for 5 years calculated from the last year from that calendar year in which the tax should have been reported or in the lack of reporting in which the tax should have been paid.

If the data are necessary for the fulfilment of the accounting obligations, retention period is 8 years.

Data processed with the purpose of enforcement of claims and rights will be retained for a general limitation period of 5 years from the date of deletion of the Simple registration, provided that if civil, criminal, administrative or other official proceedings are initiated during this period, the data will be retained until the final conclusion of such proceedings.

In any other case the data shall be stored for 5 years after the termination of the registration (general term of statute of limitation).

Type of the Vehicle*

From Subject

a)      Concluding the contract, determination of its content, modification, completion thereof

b)     Invoicing of contractual charges

c)      Claim and law enforcement

In case of processing purposes of column D/a) and b): Article 13/A E-commerce Act

In case of processing purposes of column D/a) and b):

GDPR Article 6 (1) b) Conclusion of Contract

In case of processing purposes of column D/c):

GDPR Article 6 (1) f) Legitimate interest

If the data are necessary for the fulfilment of tax obligations, they will be stored for 5 years calculated from the last year from that calendar year in which the tax should have been reported or in the lack of reporting in which the tax should have been paid.

If the data are necessary for the fulfilment of the accounting obligations, retention period is 8 years.

Data processed with the purpose of enforcement of claims and rights will be retained for a general limitation period of 5 years from the date of deletion of the Simple registration, provided that if civil, criminal, administrative or other official proceedings are initiated during this period, the data will be retained until the final conclusion of such proceedings.

In any other case the data shall be stored for 5 years after the termination of the registration (general term of statute of limitation).

Data of the purchased vignette (type, period of validity)*

From Subject

a)      Concluding the contract, determination of its content, modification, completion thereof

b)     Invoicing of contractual charges

c)      Claim and law enforcement

In case of processing purposes of column D/a) and b): Article 13/A E-commerce Act

In case of processing purposes of column D/a) and b):

GDPR Article 6 (1) b) Conclusion of Contract

In case of processing purposes of column D/c):

GDPR Article 6 (1) f) Legitimate interest

If the data are necessary for the fulfilment of tax obligations, they will be stored for 5 years calculated from the last year from that calendar year in which the tax should have been reported or in the lack of reporting in which the tax should have been paid.

If the data are necessary for the fulfilment of the accounting obligations, retention period is 8 years.

Data processed with the purpose of enforcement of claims and rights will be retained for a general limitation period of 5 years from the date of deletion of the Simple registration, provided that if civil, criminal, administrative or other official proceedings are initiated during this period, the data will be retained until the final conclusion of such proceedings.

In any other case the data shall be stored for 5 years after the termination of the registration (general term of statute of limitation).

A

B

C

D

E

F

Subject

Data Category

Data origin

Purpose of data management

Legal basis of data management

Duration of data management

User registered within Simple

IDFA of Users using iOS device, GPS ADID of Users using Android device

From Subject

Tracking and administering the redirection of the User from Simple Application to Foodora mobile application; transferring them to te operator of Foodora mobile application in order to account the contract between the Service Provider and the operator of Foodora mobile application, and to invoice the fees to Foodora. 

GDPR art. 6 (1) a): consent.

Until the withdrawal of the consent.

If the data are necessary for the fulfilment of tax obligations, they will be stored for 5 years calculated from the last year from that calendar year in which the tax should have been reported or in the lack of reporting in which the tax should have been paid.

If the data are necessary for the fulfilment of the accounting obligations, retention period is 8 years.

In any other case the data shall be stored for 5 years after the termination of the registration (general term of statute of limitation).

A

B

C

D

E

F

Subject

Data Category

Data origin

Purpose of data management

Legal basis of data management

Duration of data management

User registered within Simple

·  Volánbusz-BKSZ pass ID card number*

·  General pass ID Card number*

·  Pass ID card for persons with small children number*

·  Pass ID card for pensioners number*

·  Driving license number (card format)*

·  Passport number*

·  ID card number*

·  education ID card number under Government Decree No. 362/2011 (XII. 30.) – student ID card or pedagogue ID card*

·  Hungarian ID card number*

·  Hungarian relatives ID card number*

data subject

a)      Concluding contract, determining its content, amendment, fulfilment of the contract

b)     Invoicing the fees based on the contract

c)      Law and claim enforcement

d)     Establishing right for discount

In case of purposes in column D points a), b) and d): GDPR art. 6 (1) c) – fulfilment of legal obligations, legal provisions for this obligations:

E-Commerce Act 13/A §

Act CC of 2011 – 6. § (2)

Governmental Decree No. 356/2012 (XII.13.) 25. § (1)

Act XLI of 2012 7. § (1) – (5)

In case of purposes in column D points a), b) and d): GDPR art. 6 (1) b) – fulfilment of the contract

In case of purposes in column D point c): GDPR art. 6 (1) f) – Legitimate interest

5 years after the termination of the registration

Data processed with the purpose of enforcement of claims and rights will be retained for a general limitation period of 5 years from the date of deletion of the Simple registration, provided that if civil, criminal, administrative or other official proceedings are initiated during this period, the data will be retained until the final conclusion of such proceedings.

User registered within Simple

·  starting date of the validity of the Transport mobile ticket*

data subject

a)      Concluding contract, determining its content, amendment, fulfilment of the contract

b)     Invoicing the fees based on the contract

c)      Law and claim enforcement

In case of purposes in column D points a), b):

E-Commerce Act 13/A §

In case of purposes in column D points a), b) and d): GDPR art. 6 (1) b) – fulfilment of the contract

In case of purposes in column D point c): GDPR art. 6 (1) f) – Legitimate interest

5 years after the termination of the registration

Data processed with the purpose of enforcement of claims and rights will be retained for a general limitation period of 5 years from the date of deletion of the Simple registration, provided that if civil, criminal, administrative or other official proceedings are initiated during this period, the data will be retained until the final conclusion of such proceedings.

Subject

Data Category

User registered within Simple

Data of Bookline account (name, e-mail address)*

Mode of shipping*

Shipping address*

Order name*

A

B

C

D

E

F

Subject

Data Category

Data origin

Purpose of data management

Legal basis of data management

Duration of data management

User registered within Simple

Data of the saved Loyalty Card *

From Subject

Concluding the contract, determination of its content, modification, completion thereof

GDPR Article 6 (1) b) Conclusion of Contract

3 months from the deletion of Simple account and Simple registration by the User.

A

B

C

D

E

F

Subject

Data Category

Data origin

Purpose of data management

Legal basis of data management

Duration of data management

User registered within Simple

Number of the SuperShop card, date of birth of User cardholder *

From Subject

Concluding the contract, determination of its content, modification, completion thereof

GDPR Article 6 (1) b) Conclusion of Contract

Until the ceasing of the Simple registration.

A

B

C

D

E

F

Subject

Data Category

Data origin

Purpose of data management

Legal basis of data management

Duration of data management

      User registered within Simple

name on bank card*

From Subject

a)     Concluding the contract, determination of its content, modification, completion thereof

b)    User identification

c)     Claim and law enforcement, prevention and management of fraud

In case of processing purposes of column D/a) and b):

GDPR Article 6 (1) b) Conclusion of Contract

In case of processing purposes of column D/c):

GDPR Article 6 (1) f) Legitimate interest

Until deletion of the bank card by the User or at the latest until the termination of Simple registration.

number of bank card*

From Subject

a)     Concluding the contract, determination of its content, modification, completion thereof

b)    User identification

c)     Claim and law enforcement, prevention and management of fraud

In case of processing purposes of column D/a) and b):

GDPR Article 6 (1) b) Conclusion of Contract

In case of processing purposes of column D/c):

GDPR Article 6 (1) f) Legitimate interest

Until deletion of the bank card by the User or at the latest until the termination of Simple registration.

expiration date of bank card*

From Subject

a)     Concluding the contract, determination of its content, modification, completion thereof

b)    User identification

c)     Claim and law enforcement, prevention and management of fraud

In case of processing purposes of column D/a) and b):

GDPR Article 6 (1) b) Conclusion of Contract

In case of processing purposes of column D/c):

GDPR Article 6 (1) f) Legitimate interest

Until deletion of the bank card by the User or at the latest until the termination of Simple registration.

name of the bank issuing the bank card

From Subject

a)     Concluding the contract, determination of its content, modification, completion thereof

b)    User identification

c)     Claim and law enforcement, prevention and management of fraud

In case of processing purposes of column D/a) and b):

GDPR Article 6 (1) b) Conclusion of Contract

In case of processing purposes of column D/c):

GDPR Article 6 (1) f) Legitimate interest

Until deletion of the bank card by the User or at the latest until the termination of Simple registration.

bank card CVV/CVC code*

From Subject

a)     Concluding the contract, determination of its content, modification, completion thereof

b)    User identification

c)     Claim and law enforcement, prevention and management of fraud

In case of processing purposes of column D/a) and b):

GDPR Article 6 (1) b) Conclusion of Contract

In case of processing purposes of column D/c):

GDPR Article 6 (1) f) Legitimate interest

Until deletion of the bank card by the User or at the latest until the termination of Simple registration.

name of bank card

From Subject

a)     Concluding the contract, determination of its content, modification, completion thereof

GDPR Article 6 (1) b) Conclusion of Contract

Until deletion of the bank card by the User or at the latest until the termination of Simple registration.

A

B

C

D

E

F

Subject

Data Category

Data origin

Purpose of data management

Legal basis of data management

Duration of data management

        User registered within Simple

name on the bank card*

From Subject

a)     Concluding the contract, determination of its content, modification, completion thereof

b)    User identification

c)     Claim and law enforcement, prevention and management of fraud

In case of processing purposes of column D/a) and b):

GDPR Article 6 (1) b) Conclusion of Contract

In case of processing purposes of column D/c):

GDPR Article 6 (1) f) Legitimate Interest

Until deletion of the bank card by the User or at the latest until the termination of Simple registration.

number of the bank card*

From Subject

a)     Concluding the contract, determination of its content, modification, completion thereof

b)    User identification

c)     Claim and law enforcement, prevention and management of fraud

In case of processing purposes of column D/a) and b):

GDPR Article 6 (1) b) Conclusion of Contract

In case of processing purposes of column D/c):

GDPR Article 6 (1) f) Legitimate Interest

Until deletion of the bank card by the User or at the latest until the termination of Simple registration.

expiration date of the bank card*

From Subject

a)     Concluding the contract, determination of its content, modification, completion thereof

b)    User identification

c)     Claim and law enforcement, prevention and management of fraud

In case of processing purposes of column D/a) and b):

GDPR Article 6 (1) b) Conclusion of Contract

In case of processing purposes of column D/c):

GDPR Article 6 (1) f) Legitimate Interest

Until deletion of the bank card by the User or at the latest until the termination of Simple registration.

name of the bank issuing the bank card

From Subject

a)     Concluding the contract, determination of its content, modification, completion thereof

b)    Claim and law enforcement, prevention and management of fraud

In case of processing purpose of column D/a)

GDPR Article 6 (1) b) Conclusion of Contract

In case of processing purposes of column D/b):

GDPR Article 6 (1) f) Legitimate Interest

Until deletion of the bank card by the User or at the latest until the termination of Simple registration.

bank card CVV/CVC code*

From Subject

a)     Concluding the contract, determination of its content, modification, completion thereof

b)    User identification

c)     Claim and law enforcement, prevention and management of fraud

In case of processing purposes of column D/a) and b):

GDPR Article 6 (1) b) Conclusion of Contract

In case of processing purposes of column D/c):

GDPR Article 6 (1) f) Legitimate Interest

Until deletion of the bank card by the User or at the latest until the termination of Simple registration.

e-mail address

from subject or mercjant

a)     sending notification related to the payment in the SimplePay services with a bankcard registered in the Simple System

b)     identifying the User

GDPR Article 6 (1) b) Conclusion of Contract

Until deletion of the bank card by the User or at the latest until the termination of Simple registration.

A

B

C

D

E

F

Subject

Data Category

Data origin

Purpose of data management

Legal basic of data management

Duration of data processing

Recipient of the invitation

e-mail address*

User registered within Simple

Concluding the contract, determination of its content, modification, completion thereof

User identification

GDPR Article 6 (1) f) Legitimate interest

30 days calculated from the sending of the Invitation.

A

B

C

D

E

F

Subject

Data Category

Data origin

Purpose of data processing

Legal basis of data processing

Duration of data processing

User registered within Simple

name*

From Subject

Electronic direct marketing content, such as newsletter, sending of an advertisement with the method of direct business acquisition

GDPR Article 6 (1) a) Consent

Until the consent is withdrawn.

e-mail address*

From Subject

Electronic direct marketing content, such as newsletter, sending of an advertisement with the method of direct business acquisition

GDPR Article 6 (1) a) Consent

Until the consent is withdrawn.

In case of push notification and in-app messages: Simple account

From Subject

Electronic direct marketing content, such as newsletter, sending of an advertisement with the method of direct business acquisition

GDPR Article 6 (1) a) Consent

Until the consent is withdrawn.

A

B

C

D

E

F

Subject

Data Category

Data origin

Purpose of data processing

Legal basis of data processing

Duration of data processing

Persons participating in the promotion

name*

From Subject

Participation in a promotion or prize game,

Communication, Notification of the participant about the result,

Participant identification

If participation in the promotion is subject to an application or registration in the promotion: consent pursuant to Article 6(1)(a) of the GDPR

If participation in the promotion is automatic by making a purchase and is not subject to a separate application or registration in the game:

GDPR Article 6(1)(f): legitimate interest.

90 days after the draw date.

In case of consent: until the withdrawal of consent, if sooner than the above processing period.

e-mail address*

From Subject

Participation in a promotion or prize game,

Communication, Notification of the participant about the result,

participant identification

Transaction ID of the payment transaction conducted on the payment site of SimplePay and Simple Application

From Subject

Participation in a promotion or prize game

Time of the payment transaction conducted on the payment site of SimplePay and Simple Application

From Subject

Participation in a promotion or prize game

ID number of the transaction carried out for participating in the Promotion.

From Subject

Participation in a promotion or prize game, draw

A

B

C

D

E

F

Subject

Data Category

Data origin

Purpose of data processing

Legal basis of data processing

Duration of data processing

Winner

Mailing address (if it differs from living address)

From Subject

Taking over of the prize

GDPR Article 6 (1) b) Fulfilment of a contract

After 5 years from the end of the promotion

tax ID

From Subject

Fulfilment of taxation obligations

GDPR Article 6 (1) c) Legal obligation

If the data are necessary for the fulfilment of tax obligations, they will be stored for 5 years calculated from the last year from that calendar year in which the tax should have been reported or in the lack of reporting in which the tax should have been paid.

If the data are necessary for the fulfilment of the accounting obligations, retention period is 8 years.

In any other case the data shall be stored for 5 years after the termination of the registration (general term of statute of limitation).

Place and date of birth

From Subject

Taking over of the prize, identification of the winner

GDPR Article 6 (1) b) Fulfilment of a contract

Number of ID card

From Subject

a)     Taking over of the prize, identification of the winner

GDPR Article 6 (1) b) Fulfilment of a contract

Mother’s name

From Subject

a)     Taking over of the prize, identification of the winner

b)     Fulfilment of taxation obligations

In case of data processing purpose in column D point a): GDPR Article 6 (1) b) Fulfilment of a contract

In case of data processing purpose in column D point b): GDPR Article 6 (1) c) Legal obligation

Video and sound recording

From subject

Use for marketing purposes in order to promote the activity and services of Simple.

GDPR Article 6 (1) a) - consent

Until withdrawal of consent

A

B

C

D

E

F

Subject

Data Category

Data origin

Purpose of data processing

Legal basis of data processing

Duration of data processing

Winner

Name*

From Subject

Identification of the proxy taking over the prize

GDPR Article 6 (1) f) Legitimate interest

After 3 months from the end of the promotion

Place and date of birth*

From Subject

Identification of the proxy taking over the prize

GDPR Article 6 (1) f) Legitimate interest

Number of ID card*

From Subject

Identification of the proxy taking over the prize

GDPR Article 6 (1) f) Legitimate interest

Address*

From Subject

Identification of the proxy taking over the prize

GDPR Article 6 (1) f) Legitimate interest

A

B

C

D

E

F

Subject

Data Category

Data origin

Purpose of data processing

Legal basis of data processing

Duration of data processing

Winner

Name*

From Subject

Identification of the proxy taking over the prize

GDPR Article 6 (1) f) Legitimate interest

After 3 months from the end of the promotion

Address*

From Subject

Identification of the proxy taking over the prize

GDPR Article 6 (1) f) Legitimate interest

A

B

C

D

E

F

Subject

Data Category

Data origin

Purpose of data processing

Legal basis of data processing

Duration of data processing

User registered within Simple

name*

From Subject

Sending system messages in order to fulfil the contract

GDPR Article 6 (1) b) Fulfilment of the contract

3 month after the termination of the contract

e-mail address*

From Subject or in case of SimplePay Hero Wallet service from the Merchant

Sending system messages in order to fulfil the contract

GDPR Article 6 (1) b) Fulfilment of the contract

3 month after the termination of the contract

In case of push notification: Simple account

From Subject

Sending system messages in order to fulfil the contract

GDPR Article 6 (1) b) Fulfilment of the contract

3 month after the termination of the contract

A

B

C

D

E

F

Subject

Data Category

Data origin

Purpose of data processing

Legal basis of data processing

Duration of data processing

User registered in Simple System

name

From data subject

a)     Increasing the effectiveness, further development of Simple Application, development of new products

b)     measuring the use of Simple Application, preparing statistics

c)     profile making: analysing and predicting the personal characteristics and preferences of the Users and based on that sending customised offers, advertisements to the users who have granted separate consent to receiving electronic direct marketing messages

In case of purposes in column D/a) és b): GDPR 6. cikk (1) bek. f) point: Legitimate interest

In case of purpose in column D/c): GDPR 6. cikk (1) bek. a) point: Consent

Until deletion of Simple registration

e-mail address

From data subject

Until deletion of Simple registration

in case of push and in-app messages: Simple account

From data subject

Until deletion of Simple registration

answers of the questions

From data subject

Until deletion of Simple registration

A

B

C

D

E

Érintett

Adat kategória

Adatkezelés célja

Adatkezelés jogalapja

Adatkezelés időtartama

User registered in the Simple System, signed into the Simple Social function and granted permission to display

E-mail address registered in the Simple system

Providing Simple Social services

Article 6 (1) a) of the GDPR: consent

Until the withdrawal of the consent, in lack of it until the termination of the Simple registration

Profile picture registered in the Simple System

Providing Simple Social services

Article 6 (1) a) of the GDPR: consent

Until the withdrawal of the consent, in lack of it until the termination of the Simple registration

Recently used Simple services

Providing Simple Social services

Article 6 (1) a) of the GDPR: consent

Until the withdrawal of the consent, in lack of it until the termination of the Simple registration

List of Facebook friends

Providing Simple Social services

Article 6 (1) a) of the GDPR: consent

Until the withdrawal of the consent, in lack of it until the termination of the Simple registration

Name, profile picture, e-mail address registered on Facebook profile

Providing Simple Social services

Article 6 (1) a) of the GDPR: consent

Until the withdrawal of the consent, in lack of it until the termination of the Simple registration

User registered in the Simple System and marked as friend by other Simple User in the Simple Social function 

E-mail address registered in the Simple system

Providing Simple Social services

Article 6 (1) a) of the GDPR: consent

Until the withdrawal of the consent, in lack of it until the termination of the Simple registration

Profile picture registered in the Simple System

Providing Simple Social services

Article 6 (1) a) of the GDPR: consent

Until the withdrawal of the consent, in lack of it until the termination of the Simple registration

Recently used Simple services

Providing Simple Social services

Article 6 (1) a) of the GDPR: consent

Until the withdrawal of the consent, in lack of it until the termination of the Simple registration

List of Facebook friends

Providing Simple Social services

Article 6 (1) a) of the GDPR: consent

Until the withdrawal of the consent, in lack of it until the termination of the Simple registration

Name, profile picture, e-mail address registered on Facebook profile

Providing Simple Social services

Article 6 (1) a) of the GDPR: consent

Until the withdrawal of the consent, in lack of it until the termination of the Simple registration

User registered in the Simple System and recommended as a friend in case of other Simple User in the framework of friend recommendation

E-mail address registered in the Simple system

Providing Simple Social services

Article 6 (1) a) of the GDPR: consent

Until the withdrawal of the consent, in lack of it until the termination of the Simple registration

Profile picture registered in the Simple System

Providing Simple Social services

Article 6 (1) a) of the GDPR: consent

Until the withdrawal of the consent, in lack of it until the termination of the Simple registration

Recently used Simple services

Providing Simple Social services

Article 6 (1) a) of the GDPR: consent

Until the withdrawal of the consent, in lack of it until the termination of the Simple registration

Name, profile picture, e-mail address registered on Facebook profile

Providing Simple Social services

Article 6 (1) a) of the GDPR: consent

Until the withdrawal of the consent, in lack of it until the termination of the Simple registration

A

B

C

D

E

Data subject

Data category

Purpose of data processing

Legal basis of data processing

Retention period

User registered with Simple

Registered e-mail address of the User, place of login (Simple Website, Simple Application, etc), time of login, e-mail address used for login

Protection of the User’s Simple account, avoiding and decreasing abuse of the User’s Simple account, ensuring data security

GDPR art. 6 (1) a): consent.

Simple sends the login notifications to the User based on the User’s consent until his/her registration in the Simple System is terminated, unless the User withdraws his/her consent earlier, in which case Simple will not send the User such login notices.

Type of cookie

Purpose of cookie

Google Analytics

Generating visitors’ statistics, development of the Website and the Simple Application

Google Adwords Remarketing

Use of the advertising services provided by Google LLC, displaying targeted, segmented advertisements

Facebook Pixel és Custom Audience

generating statistics on the visitors from the Facebook.com website

Use of the remarketing services provided by Facebook, Inc. for displaying targeted, segmented advertisement on Facebook.com.

A

B

C

D

E

Subject

Data Category

Purpose of data processing

Legal basis of data processing, cookie type

Duration of data processing

User registered within Simple

language of the application

a)      Personalization of the application,

b)      Communication,

c)      Determination of the language of automatic notifications

GDPR Article 6 (1) f) Legitimate interest

Necessary for the operation of the application.

Until the deletion of the application

unique hardware ID generated upon installation

User identification

GDPR Article 6 (1) f) Legitimate interest

Necessary for the operation of the application.

Until the deletion of the application

key chain data required to identify and authenticate the User

User identification

GDPR Article 6 (1) f) Legitimate interest

Necessary for the operation of the application.

Until the logging out of the application

e-mail address used for logging in

User identification

GDPR Article 6 (1) f) Legitimate interest

Necessary for the operation of the application.

Until the logging out of the application

type of log in(e-mail, Google+ or Facebook account)

User identification

GDPR Article 6 (1) f) Legitimate interest

Necessary for the operation of the application.

Until the logging out of the application

double-hashed version of the user password for the tasks requiring less stonger authentication (e.g. re-log in)

User identification

GDPR Article 6 (1) f) Legitimate interest

Necessary for the operation of the application.

Until the logging out of the application

hashed version of the user password hashelt for the tasks requiring stonger authentication (e.g. payment)

User identification

GDPR Article 6 (1) f) Legitimate interest

Necessary for the operation of the application.

Until the logging out of the application

regarding EP card upload,  the number of the most recently used EP card is saved

Streamlining, customizing the application,  increasing user experience 

GDPR Article 6 (1) a) Consent

Until the logging out of the application

regarding money transfer function, the number of the most recently used bank card is saved 

Streamlining, customizing the application,  increasing user experience 

GDPR Article 6 (1) a) Consent

Until the logging out of the application

date of last  password modification

Ensuring safety

GDPR Article 6 (1) f) Legitimate interest

Necessary for the operation of the application.

Until the deletion of the application

date of last log in

a)      Ensuring safety,

b)      Understanding of circle of interests,

c)      Customizing the application,

d)      Displaying  advertisement, sending of personalized offer

In case of column C/a) purpose: GDPR Artcile 6 (1) f) Legitimate interest

Necessary for the operation of the application.

In case of processing purposes of column C/b) – d):

GDPR Article 6 (1) a) Consent – marketing cookie

Until the deletion of the application

maximum amount of payment without password

Ensuring safety

GDPR Article 6 (1) f) Legitimate interest

Necessary for the operation of the application.

Until the deletion of the application

registration date

a)      Understanding of circle of interests,

b)      Customizing the application,

c)      Displaying  advertisement, sending of personalized offer

GDPR Article 6 (1) a) Consent – marketing cookie

Until the deletion of the application

registration channel

a)      Understanding of circle of interests,

b)      Customizing the application,

c)      Displaying  advertisement, sending of personalized offer

GDPR Article 6 (1) a) Consent – marketing cookie

Until the deletion of the application

fact of registration from a social media network

a)      Understanding of circle of interests

b)      Customizing the application

c)      Displaying  advertisement, sending of personalized offer

GDPR Article 6 (1) a) Consent – marketing cookie

Until the deletion of the application

A

B

C

D

E

Subject

Data Category

Purpose of data processing

Legal basis of data processing

Duration of data processing

User registered within Simple

bank card profile data (card ID, card status, card data)

User identification

GDPR Article 6 (1) f) Legitimate interest

Necessary for the operation of the application.

Until the deletion of the application

Card transaction data (card ID, transaction timestamp ID, log)

a)     User identification,

b)    plausibility,

c)     Claim and law enforcement,

d)    Understanding of circle of interests,

e)    customizing the application,

f)      displaying  advertisement, sending of personalized offer

In case of processing purpose of column C/a) – c):

GDPR art. 6 (1) f) Legitimate interest

Necessary for the operation of the application.

In case of processing purposes of column C/d) -f):

GDPR Article 6 (1) a) Consent – marketing cookie

Until the deletion of the application

Environmental data (latitude, longitude – location, wallett status, remote url)

a)     Understanding of circle of interests,

b)    customizing the application,

c)     displaying  advertisement, sending of personalized offer

GDPR Article 6 (1) a) Consent – marketing cookie

Until the logging out of the application

Mobile Keys (mobile key set, ID, type, value, ID card)

Ensuring safety

GDPR Article 6 (1) f) Legitimate interest

Necessary for the operation of the application.

Until the logging out of the application

Transaction report status data (token unique refernce, timestamp)

a)     Conclusion of contract,

b)    plausibility

c)     Claim and law enforcement

GDPR Article 6 (1) f) Legitimate interest

Necessary for the operation of the application.

Until the logging out of the application

Token unique reference list (token unique reference card ID)

a)     Conclusion of contract,

b)    plausibility

c)     Claim and law enforcement

GDPR Article 6 (1) f) Legitimate interest

Necessary for the operation of the application.

Until the logging out of the application

e-mail address used for logging in

User identification

GDPR Article 6 (1) f) Legitimate interest

Necessary for the operation of the application.

Until the logging out of the application

type of log in (e-mail, Google+ or Facebook account)

a)     User identification,

b)    understanding of circle of interests,

c)     customizing the application,

d)    displaying  advertisement, sending of personalized offer

In case of processing purpose of column C/a):

GDPR art. 6 (1) f) – Legitimate interest

Necessary for the operation of the application.

In case of processing purposes of column C/b) -d):

GDPR Article 6 (1) a) Consent – marketing cookie

Until the logging out of the application

double-hashed version of the user password for the tasks requiring less stonger authentication (e.g. re-log in)

User identification

GDPR Article 6 (1) f) Legitimate interest

Necessary for the operation of the application.

Until the logging out of the application

hashed user password, fingerprint encrypted version

User identification

GDPR Article 6 (1) f) Legitimate interest

Necessary for the operation of the application.

Until the deletion of the application

Number of successful transactions

a)     understanding of circle of interests,

b)    customizing the application,

c)     displaying  advertisement, sending of personalized offer

d)    statistics, analysis

GDPR Article 6 (1) a) Consent

-          marketing and statistical, analysing cookies

Until the deletion of the application

regarding EP card upload,  the number of the most recently used EP card is saved

a)     Streamlining, customizing the application,

b)    Increasing user experience 

GDPR Article 6 (1) a) Consent

Until the deletion of the application

regarding money transfer function, the number of the most recently used bank card is saved 

a)     Streamlining, customizing the application,

b)    Increasing user experience 

GDPR Article 6 (1) a) Consent

Until the deletion of the application

e-mail address used for the last log in is saved 

a)     Streamlining, customizing the application,

b)    Increasing user experience 

GDPR Article 6 (1) a) Consent

Until the deletion of the application

user API level

Ensuring safety

GDPR Article 6 (1) f) Legitimate interest

Necessary for the operation of the application.

Until the deletion of the application

Message center, last shown message and timestamp

a)     Conclusion of contract,

b)    plausibility

c)     Claim and law enforcement

In case of processing purpose of column C/a):

Fulfilment of contract

In case of processing purposes of column C/b) and c):

GDPR Article 6 (1) f) Legal Interest

Until the deletion of the application

Taxi order dialogue data

a)     Conclusion of contract,

b)    plausibility

c)     Claim and law enforcement

In case of processing purpose of column C/a):

Fulfilment of contract

In case of processing purposes of column C/b) and c):

GDPR Article 6 (1) f) Legal Interest

Until the logging out of the application

Parking GPS verification dialogue data

a)     Conclusion of contract,

b)    plausibility

c)     Claim and law enforcement

In case of processing purpose of column C/a):

Fulfilment of contract

In case of processing purposes of column C/b) and c):

GDPR Article 6 (1) f) Legal Interest

Until the logging out of the application

Wallet PIN

User identification

GDPR Article 6 (1) f) Legitimate interest

Necessary for the operation of the application.

Until the deletion of the application

Wallet app payment ID

User identification

GDPR Article 6 (1) f) Legitimate interest

Necessary for the operation of the application.

Until the deletion of the application

digitalization of Wallet Card ID

a)     User identification,

b)    Conclusion of contract,

c)     plausibility

d)    Claim and law enforcement

GDPR Article 6 (1) f) Legitimate interest

Necessary for the operation of the application.

Until the deletion of the application

unlocked phone timestamp

Ensuring safety

GDPR Article 6 (1) f) Legitimate interest

Necessary for the operation of the application.

Until the logging out of the application

mobile payment being blocked by  EULA

a)     Conclusion of contract,

b)    plausibility

c)     Claim and law enforcement

In case of processing purpose of column C/a):

Fulfilment of contract

In case of processing purposes of column C/b) and c):

GDPR Article 6 (1) f) Legal Interest

Until the deletion of the application

safe keyguard

Ensuring safety

GDPR Article 6 (1) f) Legitimate interest

Necessary for the operation of the application.

Until the deletion of the application

changed Keyguard

Ensuring safety

GDPR Article 6 (1) f) Legitimate interest

Necessary for the operation of the application.

Until the deletion of the application

Simple is not the default payment application 

a)     Understanding of circle of interests,

b)    customizing the application,

c)     displaying  advertisement, sending of personalized offer

GDPR Article 6 (1) a) Consent

Until the deletion of the application

Application settings

(language, newsletter subscription, fingerprint ID usage, notifications, Facebook connection in place or not, parking notifications, taxi notifications, cinema notifications)

a)     Understanding of circle of interests,

b)    customizing the application,

c)     displaying  advertisement, sending of personalized offer

GDPR Article 6 (1) a) Consent – marketing cookie

Until the deletion of the application

date of last password modification

Ensuring safety

GDPR Article 6 (1) f) Legitimate interest

Necessary for the operation of the application.

Until the deletion of the application

date of last log in

a)     Ensuring safety,

b)    Understanding of circle of interests,

c)     customizing the application,

d)    displaying  advertisement, sending of personalized offer

In case of processing purpose of column C/a):

Fulfilment of contract

In case of processing purposes of column C/b) - d):

GDPR Article 6 (1) f) Legal Interest

Until the deletion of the application

maximum amount of payment without password

Ensuring safety

GDPR Article 6 (1) f) Legitimate interest

Necessary for the operation of the application.

Until the deletion of the application

registration date

a)      Understanding of circle of interests,

b)     customizing the application,

c)      displaying  advertisement, sending of personalized offer

GDPR Article 6 (1) a) Consent – marketing cookie

Until the deletion of the application

registration channel

a)      Understanding of circle of interests,

b)     customizing the application,

c)      displaying  advertisement, sending of personalized offer

GDPR Article 6 (1) a) Consent – marketing cookie

Until the deletion of the application

fact of registration from a social media network 

a)      Understanding of circle of interests,

b)     customizing the application,

c)      displaying  advertisement, sending of personalized offer

GDPR Article 6 (1) a) Consent – marketing cookie

Until the deletion of the application

Data Category

Purpose of data processing

Legal basis of data processing

Duration of data storage

AAID (Anonym Application Identifier)

Identifying the application on the User’s device.

GDPR Article 6 (1) b) performance of a Contract

Data is automatically deleted upon the termination of the application registration. Before this, data is stored for a maximum period of 14 months.

Token (including push tokens of third parties)

Entailing the sending of push notifications in the application on the User’s device.

GDPR Article 6 (1) a) Consent

Name of topic

Indicating the topic of the push notifications to which User subscribed

GDPR Article 6 (1) a) Consent

Personal data in notification

Sending push notifications to the User

GDPR Article 6 (1) a) Consent

The notification is stored for 1 day.

Profil ID

The unique identifier of the connection between the application and the User, which is generated by Simple and which is used during the account verification process.

GDPR Article 6 (1) b) performance of a Contract

The identifier is encrypted in a way that it cannot be decrypted and is stored on the device. Following the deletion of the application, the data is automatically deleted.

Message notification (message delivery notification, open, delete, auto-delete upon expiry, turning-off warning notification

Used for the purpose of preparing the notification report.

GDPR Article 6 (1) a) Consent

Data is automatically deleted upon the termination of the application registration. Before this, data is stored for a maximum period of 14 months.

Name and purpose of data processing

Legal basis of data processing

data categories

Duration of data processing

Data processing concerning the enforcement of the data subjects’ data protection rights (see clause 8)

GDPR Article 6 (1) c) (the data processing is necessary for fulfilling the legal obligation of Data controller)

Legal obligation: making possible the exercising of the data subjects' rights stipulated in a GDPR Articles 15-22 and documentation of the other steps concerning the request.

Personal data submitted to the Data controller in connection with the data protection requests: in case of private persons, legal entities and other organisations turning to the Data controller the contact details of the contact persons necessary for communication with them (in particular: name, address, phone number, e-mail address), content of the request, steps concerning the request, documents concerning the request. For example: if the data subject requests in e-mail to erase all of his/her data based on the GDPR, and the Data controller fulfils this request, the Data controller will keep the e-mail about the request for erasure.

Duration of data processing: in lack of other data protection authority guidance: indefinite period of time.

Name and purpose of data processing

Legal basis of data processing

data categories

Duration of data processing

Archive the consents of the data subjects to the data processing and the withdrawal of those consents

GDPR Article 6 (1) c) (the data processing is necessary for fulfilling the legal obligation of Data controller)

Legal obligation: according to Article 7 (1) of GDPR if the data processing is based on consent, the data controller must be able to certify that the data subject has granted consent to the processing of his/her personal data.

If any data processing of the Data controller is based on consent, the Data controller archives the consent. The purpose of this procedure is to certify the legality of the consent in any time. If the data subject withdraws his/her consent, the Data controller keeps the withdrawal statement (and the communication related to that). The purpose of this procedure is that the Data controller must always be be aware of that a data subject withdrew his/her consent to a given data processing.

Duration of data processing: in lack of other data protection authority guidance: indefinite period of time.

Name and purpose of data processing

Legal basis of data processing

data categories

Duration of data processing

Data processing for the purpose of recöoring data protection breaches (including documentation of steps taken related to the management of the incidents)

GDPR Article 6 (1) c) (the data processing is necessary for fulfilling the legal obligation of Data controller)

Legal obligation: according to Article 33 (5) of GDPR the Data controller keeps records on data protection incidents by indicating the facts related to the data protection incident, their effects and the measures taken for remedy of the incident. This record makes the data protection authority able to control the compliance with the GDPR.

Personal data of the data subjects related to the data protection incident.

Duration of data processing: in lack of other data protection authority guidance: indefinite period of time.

Data processors’ name and address

Purpose of data processing

Information regarding data transfers to abroad

OTP Bank Plc. (seat: 1051 Budapest, Nádor u. 16.; Reg. Nr.: 01-10-041585;  Tax Nr.: 10537914-4-44)

a)    providing online bank card payment service in the Simple System, bank card authorization

b)   providing Simple with IT infrastructure

There is no data transfer to abroad.

Microsoft Corporation (USA - One Microsoft Way
Redmond, Washington 98052)

a)    provider of Microsoft 365 cloud service

Data is transferred to the USA.

Legal basis of transfer: Standard Contractual Clauses (SCC) based on the Data Protection Directive 95/46/EC as approved by the Article 29 Working Party based on the model contract 2010/87/EU, by virtue of which the data processor ensures that the personal data is processed and transferred in accordance with the EU data protection provisions. The SCC is available in the Microsoft Online Services Terms.

Mastercard Europe SA, Reg. Nr.: RPR 0448038446, seat: 198/A, Chaussée de Tervuren, 1410 Waterloo, Belgium

a)    conclusion of online bank card payment

There is no data transfer to abroad.

Visa Europe Services LLC (registered int he USA,  Delaware, acting through its London Branch Office (Reg. no of the Branch: BR007632) registered office: 1 Sheldon Square, London W2 6TT, VAT No: GB 840 111 776)

a)     conclusion of online bank card payment

There is no data transfer to abroad.

American Express Services Europe Limited (registered office: Belgrave House, 76 Buckingham Palace Road, London SW1W 9AX, United Kingdom, Reg. No: 1833139, Registered by: Companies House)

a)     conclusion of online bank card payment

There is no data transfer to abroad.

The Rocket Science Group LLC d/b/a MailChimp (seat: Georgia

675 Ponce De Leon Ave NE, Suite 5000
Atlanta, Georgia 30308)

a)    sending out of the newsletters, storage of the e-mail addresses in the newsletter database

Data is transferred to the USA.

Legal basis of transfer: Standard Contractual Clauses (SCC) based on the Data Protection Directive 95/46/EC as approved by the Article 29 Working Party based on the model contract 2010/87/EU, by virtue of which the data processor ensures that the personal data is processed and transferred in accordance with the EU data protection provisions.

The MailChimp SCC is available in Annex 3 of the MailChimp Data Protection Addendum: MailChimp Data Processing Addendum

SendGrid, Inc. (1801 California Street, Suite 500 Denver, Colorado 80202, USA)

a)      sending out of the newsletters, storage of the e-mail addresses in the newsletter database

Data is transferred to the USA.

Legal basis of transfer: Twilio Standard Contractual Clauses (SCC) based on the Data Protection Directive 95/46/EC as approved by the Article 29 Working Party based on the model contract 2010/87/EU, by virtue of which the data processor ensures that the personal data is processed and transferred in accordance with the EU data protection provisions.

The Twilio SCC also applicable to SendGrid is available here: Data Protection Addendum (twilio.com)

Wyze PFM LLC (seat: 1118 Budapest, Brassó út 144. 1^st floor 6.; Reg Nr.: 01-09-291453; Tax Nr.: 25829237-2-43)

a)   operation, maintenance, troubleshooting and development  of the IT background of SimpleBill service

There is no data transfer to abroad.

Aggreg8 LLC (seat: 6721 Szeged, Zárda u 8.; Reg Nr.: 06-09-023518, T: 25930423-2-06)

a)   development and improvement of the software background of SimpleBill service

There is no data transfer to abroad.

KBOSS.hu Kft., (Számlázz.hu, 1034 Budapest, Bécsi út 126-128., Reg. No: 01-09-303201, VAT No: 13421739-2-41)

a)     electronic billing services

There is no data transfer to abroad.

 N-Ware Kft. (Billzone.eu, 1139 Budapest, Gömb utca 26., Cg.: 01 09 921789   adószám: 14825679-2-41)

a)     electronic billing services in case of Interticket tickets

b)    issuing and sending receipts, data processed: e-mail address, currency, type of payment, name, quantity and price of the purchased products/services, license plate of the vehicle in case of parking and e-motorway ticket services

There is no data transfer to abroad.

Facebook, Inc. (USA)

a)      Profiling, advertising, analytics and measuring, online behavioural advertising

Data is transferred to the USA.

Legal basis of transfer: the Standard Contractual Clauses (SCC) in the Facebook Data Transfer Addendum based on the Data Protection Directive 95/46/EC as approved by the Article 29 Working Party based on the model contract 2010/87/EU, by virtue of which the data processor ensures that the personal data is processed and trasnferred in accordance with the EU data protection provisions.

The Data Transfer Addendum of Facebook is available here: Facebook.com

GOOGLE LLC (USA - Google Data Protection Office, 1600 Amphitheatre Pkwy
Mountain View, California 94043)

a)     Profiling, advertising, analytics and measuring, online behavioural advertising

b)    Firebase services

Data is transferred to the USA.

Legal basis of transfer:

The Standard Contractual Clauses (SCC) in the Google Ads Data Processing Terms based on the Data Protection Directive 95/46/EC as approved by the Article 29 Working Party based on the model contract 2010/87/EU, by virtue of which the data processor ensures that the personal data is processed and transferred in accordance with the EU data protection provisions.

The Google SCC is available here: Google Ads Data Processing Terms: Model Contract Clauses

The Standard Contractual Clauses (SCC) for Firebase services based on the Data Protection Directive 95/46/EC as approved by the Article 29 Working Party based on the model contract 2010/87/EU, by virtue of which the data processor ensures that the personal data is processed and transferred in accordance with the EU data protection provisions which are available here: Standard Contractual Clauses (google.com).

Survey Monkey Europe UC (2 Shelbourne Buildings, Second Floor, Shelbourne Road, Dublin 4, Ireland)

a)     ensuring questionnaire forms for subscription for games, promotions, answering questions in promotions, in which e-mail address, name and answers of the questions as personal data are processed

b)    ensuring questionnaire forms and surfaces for collecting and managing user remarks during the beta tests os Simple Application and System

There is no data transfer to abroad.

Quadron Kibervédelmi Kft. (1051 Budapest, Sas u. 10-12.; Cg. 01-09-189206)

Cyber security and cyber protection services and consulting

There is no data transfer to abroad.

Ondemand Kft. (1124 Budapest, Muskátli u. 6. 1. em. 1.; Cg. 01-09-173803)

Software development and support

There is no data transfer to abroad.

Etalon-Informatika Kft. (1132 Budapest, Kresz Géza u. 53/b.; Cg. 01-09-668817)

Professional support of IT infrastructure operation and system maintenance