Padthai WOKSTAR Mobile Application Users’ Privacy Notice
1. Introduction
Padthai, the Operator of the WOKSTAR mobile application considers it important to respect and enforce the data processing rights of all natural persons concerned (hereinafter referred to as “you”). In handling, recording, processing and transmitting your personal data, Padthai acts in accordance with Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (hereinafter: Infotv.), REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Regulation (EC) No 95/46/EC (GDPR), and other legal provisions on data protection.
Please note that where the legal basis for processing is your consent, you have the right to withdraw your consent at any time, without prejudice to the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal. Please send your request for withdrawal of consent to one of our contact details set out in point 2.
In cases where the legal basis for the processing is the legitimate interest of Padthai, you have the right to object to the processing. Please send your objection request to one of our contact details set out in point 2.
2. Who is the data controller?
- Name: R.T.B. Restaurant Limited Liability Company (hereinafter referred to as “Padthai”)
- Registered office (postal address): 1122 Budapest, Bíró utca 7.
- Company registration number: 01-09-201806
- VAT number: 24103114-2-43
- Statistical number: 24103114-5610-113-01
- E-mail address: support@padthaiwokbar.com
3. What are the basic principles of data processing and on what legal basis is data processed?
3.1. Principles of data management
- Padthai will process your personal data only to the extent and for the period strictly necessary for the purposes for which it is collected.
- In the course of data processing, Padthai ensures the accuracy, completeness and timeliness of the data processed.
3.2 Legal grounds for data processing
- The legal basis of the processing carried out by Padthai varies from one processing to another. The individual legal bases are set out in the list in section 4.
4. What are the data processing operations, their purposes, what data are processed by Padthai and for how long?
| Name of data processing | Legal basis for data processing | Purpose of data processing | Scope of data processed | Duration of data processing |
|---|---|---|---|---|
| 1. Registration | Your explicit consent pursuant to Article 6(1)(a) GDPR | registration for the Padthai WOKSTAR mobile application | telephone number, e-mail address, full name – optional, month and day of birth | until the user is deleted |
| 2. User account creation and management | Article 6(1)(b) GDPR, Performance of the contract | create and manage a user account on the Padthai WOKSTAR mobile application | telephone number, e-mail address, full name – optional, month and day of birth, shipping address, location data, billing details, card details | until the user account is deleted |
| 3. User database | Pursuant to Article 6(1)(f) GDPR, the Data Controller, i.e. Padthai, has a legitimate interest in. (legitimate interest: running the application) | developing the content of the WOKSTAR mobile application creating a user database | phone number, e-mail address, browsing history on the site, the user’s content consumption habits in relation to the website, newsletters viewed, access data, date and time of visit | until the user account is deleted |
| 4. Fulfilling an order | Article 6(1)(b) GDPR, Performance of the contract | processing and fulfilling orders placed through the Padthai Loyalty mobile application, issuing and sending electronic invoices | phone number, e-mail address, order details, billing, data card data, delivery address | For account data (master data), 3 years from the last login. With regard to order data, eight years from the date of the order in accordance with Section 169 (2) of the Act on Accounting. Delivery data, location data are kept for five years in accordance with the general limitation period of the Hungarian Civil Code. |
| 5. Complaints handling | Compliance with the Legal Obligation pursuant to Article 6(1)(c) GDPR pursuant to Article 17/B of Act CLV of 1997 on Consumer Protection | investigate a complaint | phone number, e-mail address, additional information provided by the user | With regard to the minutes of the complaint and copies of the replies to the written complaints, three years pursuant to Section 17/A (7) of the Act on the Protection of the Rights of Persons with regard to the Protection of the Ombudsman. |
| 6. Newsletter | Your explicit consent pursuant to Article 6(1)(a) GDPR | If you have given your explicit consent during registration or later when using the mobile application, sending direct marketing messages (newsletter) including Padthai products and services. | e-mail address | until consent is withdrawn |
5. How does Padthai have your personal data?
Padthai will only process personal data that you provide to us.
6. Where do we store the data?
Padthai will store your personal data electronically through its data processor, as its hosting provider, as set out in section 7.1.5.
7. Will a data processor be used?
Padthai uses the following data processors to process the data, which act solely on Padthai’s instructions and do not collect, store or process personal data for their own purposes.
| Company name | Headquarters | Company registration number | Tax number | Purpose of data processing | data processed by a data processor |
|---|---|---|---|---|---|
| 1. LINK Mobility Hungary Kft. | 1062 Budapest, Andrássy út 68. building C. 1. floor 1. | 01-09-694287 | 12598582-2-42 | Sending a confirmation SMS during registration. | the telephone number of the data subject, recorded during registration |
| 2. STRIPE, INC | 354 Oyster Point Blvd, South San Francisco, California, United States, 94080 | 4675506 | Checking the validity of the storage of the credit card data provided by the User, checking the collateral required to fulfil the order, detecting credit card fraud and abuse. | the details of the bank card concerned | |
| 3. Konstruktor Online Kft. | 8000 Székesfehérvár, Repkény utca 7. | 07-09-024291 | 24732806-2-07 | mobile app-related development and maintenance work | data related to the performance of development and maintenance work on the mobile application |
| 4. DEEPBLUE System Ltd. | 1064 Budapest, Vörösmarty utca 67. | 01-09-874425 | 13810380-2-42 | hosting provider | all personal data recorded on the mobile application, except the bank card details of the data subject |
7.2. Padthai will send your order-related data, such as your telephone number, e-mail address, billing data, delivery address (in case of home delivery) to the restaurant concerned for the purpose of fulfilling your order, so the data processors of your personal data may be the operators of the Padthai group of restaurants listed below
| Company name | Headquarters | Company registration number | Tax number |
|---|---|---|---|
| 1. Padthai Kft. | 1122 Budapest, Bíró utca 7. | 01 09 185359 | 24842321-2-43 |
| 2. Foodport Kft. | 1122 Budapest, Bíró utca 7. | 01 09 205941 | 25280900-2-43 |
| 3. Kardos Restaurant Kft. | 1122 Budapest, Bíró utca 7. | 01 09 209573 | 25342855-2-43 |
| 4. Padthaiwokbar Kft. | 1122 Budapest, Bíró utca 7. | 01 09 279618 | 25515862-2-43 |
| 5. Padwok Restaurant Kft. | 1122 Budapest, Bíró utca 7. | 01 09 304630 | 26151144-2-43 |
| 6. Padarka Food Kft. | 1122 Budapest, Bíró utca 7. | 01 09 304632 | 26151168-2-43 |
| 7. Padörs Wokbar Kft. | 1122 Budapest, Bíró utca 7. | 01 09 309719 | 26241850-2-43 |
| 8. Chilibrands Kft. | 1122 Budapest, Bíró utca 7. | 01 09 334072 | 26595056-2-43 |
| 9. Padnyolc Kft. | 1122 Budapest, Bíró utca 7. | 01 09 337109 | 26649100-2-43 |
| 10. Paduna Kft. | 1122 Budapest, Bíró utca 7. | 01 09 342139 | 26739191-2-43 |
| 11. Padthai Franchise Kft. | 1122 Budapest, Bíró utca 7. | 01 09 349875 | 27108778-2-43 |
| 12. Pad Stories Kft. | 1122 Budapest, Bíró utca 7. | 01 09 384350 | 29231214-2-43 |
| 13. Padka Kft. | 1122 Budapest, Bíró utca 7. | 01 09 997688 | 24248318-2-43 |
| 14. Street Kitchen Kft. | 1122 Budapest, Bíró utca 7. | 01 09 997799 | 24250144-2-43 |
| 15. Padthai Holding Kft. | 1122 Budapest, Bíró utca 7. | 01 09 286081 | 25730230-2-43 |
8. What measures does Padthai take to ensure the security of the personal data it processes?
8.1.
Padthai designs and implements its processing operations in such a way as to ensure the highest level of protection of your privacy when applying the Infotv., the GDPR and other rules applicable to data processing.
8.2.
Padthai shall ensure the security of the data, take the technical and organisational measures and establish the procedural rules necessary to enforce the Infotv., GDPR and other data and confidentiality protection rules.
8.3.
Padthai shall take appropriate measures to protect the data against, in particular, unauthorized access, alteration, unauthorised disclosure, deletion or destruction, accidental destruction or damage, and loss of access due to changes in the technology used.
8.4.
Where Padthai uses automated systems for the processing of personal data, Padthai will take additional measures to ensure that:
- prevent unauthorised data entry;
- preventing the use of automatic data-processing systems by unauthorised persons using data transmission equipment;
- the verifiability and ascertainability of the bodies to which personal data have been or may be transmitted using data transmission equipment;
- the verifiability and ascertainability of which personal data have been entered into automated data processing systems, when and by whom;
- the recoverability of the installed systems in the event of a failure, and
- that errors in automated processing are reported.
8.5.
Padthai will take into account the state of the art when determining and applying measures for data security. Padthai will choose among several possible data processing solutions the one that ensures a higher level of protection of personal data, unless this would impose a disproportionate burden on Padthai.
9. In which cases may personal data be transferred to third parties?
Padthai does not transfer users’ personal data to third parties.
10. What are your rights and how can they be enforced?
You have a number of rights when your personal data is processed and you can exercise them at any time. The Data Controller lists these rights below, together with what each right means for you. You may exercise your rights by sending a request to one of the contact details of the Controller set out in point 2.
Right to withdraw consent
The data processing set out in points 1 and 6 of the table in point 4 is based on your consent, which you have the right to withdraw at any time. Such withdrawal shall not affect the lawfulness of the processing that took place before the withdrawal. Please send your request for withdrawal of consent to one of our contact details set out in point 2.
Right of access and rectification of personal data
You have the right to access, copy, correct or update your personal data at any time. Under the right of access, you are entitled to receive information about:
- a) the purposes of the processing;
- b) the categories of personal data concerned;
- c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
- d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
- e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
- f) the right to lodge a complaint with a supervisory authority; and
- g) the fact of automated decision-making, including profiling (which in this case is the identification of personal preferences and interests based on the personal data in the database and the sending of direct marketing based on this).
We understand the importance of this, so if you wish to exercise these rights, please contact us using one of the contact details set out in section 2.
Right to data portability
Your personal data is portable. This means that they can be moved, copied and transmitted electronically. If you wish to exercise your right to data portability, please contact us using one of the contact details set out in section 2.
Right to erasure of personal data
You have the right to request the erasure of your data if:
- your personal data is no longer necessary for the purpose(s) for which it was collected; or
- you withdraw your prior consent to the processing of your personal data and there is no other legal basis for the processing; or
- objects to the processing of your personal data;
- the processing of personal data is not lawful; or
- the deletion of your personal data is justified on grounds of compliance with the law.
However, the Controller is not obliged to comply with your request if the processing is necessary:
- to exercise the right to freedom of expression and information;
- for the purposes of complying with an obligation under Union or Member State law to which the controller is subject to which the processing of personal data is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
- on grounds of public interest in the field of public health;
- for archiving purposes in the public interest, scientific and historical research purposes or statistical purposes, where the deletion of the data would be likely to render impossible or seriously impair such processing; or
- to bring, enforce or defend legal claims.
If you wish to exercise this right, please contact us using one of the contact details set out in section 2.
Right to restriction of processing
You may restrict the processing of your personal data if:
- a) believes that the personal data held about you is inaccurate; or
- b) the processing of personal data is not lawful, but instead of requesting their erasure, you would prefer to restrict their processing; or
- c) your personal data are no longer needed by the Controller for the purpose(s) for which they were originally collected, but you need them for the purpose of bringing or pursuing a legal claim or defending against a claim; or
- d) You have objected to the processing of your personal data and are awaiting confirmation as to whether your interests in objecting override the legal basis for the processing.
If you wish to restrict the processing of your personal data, please contact us using one of the contact details set out in section 2.
The right to protest
You can object to the processing of your personal data at any time. If you wish to do so, please contact us using one of the contact details set out in section 2.
Automated decision-making
Since we determine your preference, interests and the subject of direct marketing messages based on your personal data in the database described in point 4.3, you have the right to tell us if you disagree with your personal preference, interests or the subject of direct marketing messages that we have determined, to express your disagreement, or to contact us to have a member of our staff check that we have determined your preference and interests correctly. If you wish to exercise this right, please contact us using any of the contact details set out in section 2.
11. What are the consequences of unlawful processing? Right to apply to a supervisory authority
11.1.
Padthai shall compensate you for any damage caused by the unlawful processing of your data or by any breach of data security.
11.2.
If Padthai also infringes the personal rights of the data subject by unlawfully processing your data or by breaching data security requirements, you may also claim damages from Padthai.
11.3.
If Padthai refuses to exercise any of your rights, or if you are not satisfied with our response, or if you wish to lodge a complaint, you may take your case to a civil court or to the National Authority for Data Protection and Freedom of Information (address: 1055 Budapest, Falk Miksa utca 9-11.; postal address: 1363 Budapest, Pf.: 9.; telephone number: +36 (1) 391-1400; email address: ugyfelszolgalat@naih.hu) as supervisory authority.
Done at Budapest, 17 December 2024
Follow us
on instagram
