Data Processing Terms

1. Parties

Controller: the User (business) registered in Parlo. Processor: Szentiványi András Szilveszter e.v., 2800 Tatabánya, Előd vezér utca 18..

2. Subject, nature and purpose of the processing

Providing the Parlo service: storing and displaying the communication between the User and its clients (messages, files, tasks, approvals), sending notifications and keeping the log.

3. Duration

For as long as the contract with the User is in force. After the contract ends we delete the data within 30 days at the latest (including backups), unless the law requires longer retention.

4. Data subjects and categories of data

• Data subjects: the User's clients, their contacts and staff.
• Data: name, email address, company name, language; message content; uploaded files (images, videos, documents); tasks and approvals; the time of decisions and the IP address and browser used when deciding; the time portal links were used and login codes were requested.
• The service does not ask for special categories of data (e.g. health data). If the User uploads such data anyway, the User is responsible for it.

5. Obligations of the processor

• We process the data only on the User's instructions, to provide the service. The instructions are the use of the service and these terms.
• Everyone with access to the data is bound by confidentiality.
• We take the security measures required by Article 32 GDPR (see section 6 of the privacy notice).
• We help fulfil data subject requests (access, rectification, erasure etc.); if a data subject contacts us directly, we forward the request to the User.
• We notify the User of a personal data breach without undue delay, at the latest within 48 hours of becoming aware of it.
• We assist with data protection impact assessments and cooperation with the authority where our processing is concerned.
• When the contract ends we delete the data. Before that, the User can export projects as PDF.
• We provide the information needed to demonstrate compliance and, after prior agreement and within reasonable limits, allow audits.

6. Sub-processors

The User gives general authorisation to engage sub-processors. The current list is in section 4 of the privacy notice. We notify the User by email at least 30 days before engaging a new sub-processor; the User may object and, if no solution is found, terminate the contract. Sub-processors are bound by the same obligations.

7. Responsibilities of the User (controller)

• Ensures that the clients' data is processed lawfully (e.g. based on contract or legitimate interest) and informs them about it.
• Uploads only data needed for the joint work.
• Fulfils data subject requests, with our help.

8. Miscellaneous

These terms are governed by Hungarian law and the Terms of Service. Where the Terms of Service and these terms differ, these terms prevail regarding personal data.