This Policy aims to make every data processing activity clear for you and to ensure that you clearly understand the meaning of our data processing activities, their tools, their legal basis, and your rights granted to you in this respect.
When establishing the provisions of this Policy, we have taken into account the provisions of the Regulation (EU) 2016/679 of the European Parliament and the Council ('General Data Protection Regulation or 'GDPR'), Act CXII of 2011 on Informational Self-Determination and Freedom of Information ('Privacy Act'), Act V of 2013 on the Civil Code ('Civil Code'), Act CVIII of 2001 on Electronic Commerce and on Information Society Services ('E-Commerce Act'), and Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities ('Advertising Act').
When drawing up this Policy, we have also considered the National Authority for Data Protection and Freedom of Information recommendation on data protection requirements for preliminary information.
Name and contact details of the Data Controller
- Name: BSF Systems Kft.
- Registered office: H-6800 Hódmezővásárhely, Pál utca 50.
- Postal address: H-6800 Hódmezővásárhely, Pál utca 50.
- Telephone number: +36 20 230 0478
- E-mail address of Customer Care: firstname.lastname@example.org
- Website: www.grinsect.com
Name and contact details of Representative
- Name of Representative: Sándor Aszalai
- Postal address of Representative: H-6800 Hódmezővásárhely, Pál utca 50.
- E-mail address of Representative: email@example.com
- Telephone number of Representative: +36 20 230 0478
BSF Systems Kft. produces insect protein at an industry level for animal feeding purposes. In addition, it sells breeding technology equipment used for insect farming and various protein carrier products to its partners.
For further information about our activity, please visit www.grinsect.com.
Purpose and legal basis of data processing
We respect the protection of privacy of those who visit our website and webshop or are interested in our products; therefore, we collect and process exclusively those data that are essential for the purposes specified in this Policy. The use of our website and the purchase of our products are entirely voluntary, so any personal data that may be required for these will be sent to us voluntarily and will be handled based on consent, performance of a contract, or fulfillment of legal obligations, depending on the purpose.
Data processing – what kind of data do we collect and why?
By filling in our contact form, you may ask questions about our products, programs, and services, and you may contact us with your intention to cooperate, media inquiries, or ask any other questions. In this phase, please do not provide any personal data that is not necessary for this phase. During the contact phase, we request and process the following data:
- First and last name.
- E-mail address.
- The fact that the User has consented to Grinsect sending him messages with marketing content.
Optionally you can provide your phone number and, if applicable, the name of the Company from which you are getting in touch with us. As our interest is to sell our products, we understand that you provide us with your data to prepare/execute a future contract. Provision of data is voluntary. Your data shall be retained until the end of the limitation period for claims made under civil law, which is 5 years according to the legislation in force.
Request for unique offer:
By filling in our form to request a unique offer, you have the opportunity to inform us about your intention to place an individual order and request a quote in addition to the maximum order indicated on the webshop. In this phase, please do not provide any personal data that is not necessary for this phase. When you request an individual quote, we request and process the following data:
- Company name.
- Name of the contact person.
- E-mail address.
- Telephone number.
- Billing address.
- Delivery address (crucial to calculate the exact delivery fee).
- The fact that the User has consented to Grinsect sending him messages with marketing content.
As our interest is to sell our products, we understand that you provide us with your data to prepare/execute a future contract. Provision of data is voluntary; however, if we do not receive enough information to reply, we might be unable to fulfill your request or provide a quote. Your data shall be retained until the end of the limitation period for claims made under civil law, which is 5 years according to the legislation in force.
Feeding substrate supplier application:
By filling out our form for feeding substrate supplier partners, you can request more information about possible cooperation points or indicate your intention to cooperate with us by applying. In this phase, please do not provide any personal data that is not necessary for this phase. When filling out the application form, we ask for and process the following data from you on a mandatory basis: company name, last name, first name, e-mail address, mobile, and the fact that the User has consented to Grinsect sending him messages with marketing content. As our interest is to sell our products, we understand that you provide us with your data to prepare/execute a future contract. Provision of data is voluntary; however, if we do not receive enough information to reply, we might be unable to answer your questions, or we might be unable to cooperate. Your data shall be retained until the end of the limitation period for claims made under civil law, which is 5 years according to the legislation in force.
Reseller partner application:
By filling out the reseller application form, you can let us know that you would like to become a member of our reseller network and promote our products in the future. In this phase, please do not provide any personal data that is not necessary for this phase. When you apply to become a reseller, we request and process the following data:
- Store data: Shop/Store name, type, address, website, social media link
- Company data: name, registered seat, VAT number, a company register number, contact person's name, mobile, e-mail address
- The fact that the User has consented to Grinsect sending him messages with marketing content.
As our interest is to sell our products, we understand that you provide us with your data to prepare/execute a future contract. Provision of data is voluntary. Your data shall be retained until the end of the limitation period for claims made under civil law, which is 5 years according to the legislation in force.
Inquiry on the outsourced rearing unit model concept:
By filling in our outsourced rearing unit model form, you may request further information about possible cooperation, or by applying, you may inform us about your intention to cooperate. In this phase, please do not provide any personal data that is not necessary for this phase. When you inquire about our program, we request and process the following data: company name, name of contact person, e-mail address, mobile, and the fact that the User has consented to Grinsect sending him messages with marketing content. As our interest is to sell our products, we understand that you provide us with your data to prepare/execute a future contract. Provision of data is voluntary; however, if we do not receive enough information to reply, we might be unable to fulfill your request or provide a quote and answers. Your data shall be retained until the end of the limitation period for claims made under civil law, which is 5 years according to the legislation in force.
You can apply directly to one of the positions you like on our careers page for the open positions in Grinsect. When applying, we ask for and process the following data: Applicant's name, e-mail address, telephone number, salary request, CV with photo, cover letter, and the fact that the User has consented to Grinsect sending him marketing messages. The legal basis for data processing when applying to our HR database is your prior and voluntary consent. If you fill out your application incompletely with inadequate data, we may not be able to consider your application valid. We may store your data for different periods:
- a) if we do not select you for the position you applied for, or if you decide to withdraw your application during the selection process, your data will be deleted immediately.
- b) upon notification in case of negative evaluation, you expressly consent to the storage of your application material for a further 24 months to notify you of our job opportunities in the event of a vacancy in a suitable position. We will process your data until revocation, but at the latest, it will be deleted after 24 months.
- c) if you are selected for a particular position, you will be subject to the rules for processing the data of our employees, which are set out in Annex 3 of the employment contract.
Our Company regularly sends a newsletter to those interested in Grinsect, its products, updates, news, and other topics related to insect protein. In our letters, our subscribers can read about the latest studies, be the first to know about the new products, the latest plans, results, and successes of Grinsect, read about our partner programs, and learn about our partners' exciting news.
When you subscribe to our newsletter, we collect your last name, first name, e-mail address, and the fact that the User has consented to Grinsect sending him marketing messages. The legal basis for collecting data is your consent. Provision of data is entirely voluntary; if you do not grant your consent, we cannot send you our newsletter. You can unsubscribe from our newsletter anytime by clicking on the link at the bottom of each letter. Then we will delete your data and will not send you more newsletters. We process your data until you unsubscribe from the newsletter. You may request to have your data deleted not only online but also by sending a mail to H-6800 Hódmezővásárhely, Pál utca 50. and via e-mail at firstname.lastname@example.org.
On our webshop, www.grinsect.com, you may create your user account, which can be a tool but not an exclusive condition for purchase on our webshop. By completing the registration process, you establish a direct and confidential relationship with BSF Systems Kft. You must provide your username, e-mail address, and password when registering. The legal basis for collecting data is your consent, and the Provision of data is entirely voluntary. We use the data provided during registration exclusively for registration.
BSF Systems Kft. operates a webshop on grinsect.com, where you may purchase the Company's products offered for sale. Data processed during purchase: customer's data – last name, first name, e-mail address, telephone number, delivery date – country, region, postcode, town, street, house number, payment method, and billing data – name/company name, tax number, billing address). The customer's and delivery data shall be retained until the end of the limitation period for claims made under civil law, which is 5 years according to the legislation in force. We shall retain your data related to billing for 8 years after the closure of the business year following the mandatory statutory provisions; providing these data is obligatory.
Social media sites, other data processing
We also keep in touch with you on social media sites such as Facebook, Instagram, Linkedin, and Youtube so we can see your registered name and public account. In this case, the data processing takes place on social media sites, so the duration and method of data processing, as well as the possibilities of deleting or modifying the data, are governed by the social media policy. Upon request from the authorities, in case of contacting other bodies based on legal authority, we are obliged to provide information, to disclose and hand over data. In this case, we will only provide the data that is strictly necessary to achieve the purpose of the request.
Remarketing and conversion tracking solutions:
Our Company conducts PPC online marketing campaigns and performs remarketing activities with the help of which it makes contact with those visitors, users who have previously visited our website, webshop. The activity aims to increase brand awareness and conversion (for example, payment by Barion) through online – Facebook, Google – targeted ads. The legal basis of data processing is your consent, which you may grant or refuse when visiting the website. Provision of data is voluntary; if you do not consent to be contacted by us during our online marketing activity, you will not receive any ads of this kind. Our Company shall retain the data until the withdrawal of your consent.
Who will get your data?
The employees of BSF Systems Kft may process your data and those data processors who have entered into a contract with us. In addition, your data may only be processed by our employees, data processors, and their direct employees to the extent necessary to achieve the purpose of the data processing and for the period provided by the legal basis.
Data processors shall not make autonomous decisions, they are entitled to act exclusively according to the contract concluded with us and the instructions provided. Therefore, we control the work of our data processors. Our data processors are entitled to employ further data processors only if our consent is granted.
Data processors used by BSF Systems Kft. as Data Controller:
- Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) -statistical services, ad serving
- Meta Platforms Ireland Limited (4 Grand Canal Square, Dublin Ireland) – statistical services, ad serving
- LinkedIn Inc. (Gardner House, 2 Wilton Pl, Dublin 2, Ireland) - statistical services, ad serving
- Novaliann Tanácsadó Kft. (6723 Szeged, Bárka utca 3. 3. 8.) – digital campaign management
- Billingo Technologies Zrt. (1133 Budapest, Árbóc utca 6. I. emelet) – billing system
- R&R Services and More Kft. (6793 Forráskút, Átokháza dűlő 277.) – accounting
- Aut O'Mattic A8C Ireland Ltd. (25 Herbert Pl, Dublin, D02 AY86, Írország) – website and webshop provider
- Promesa Marketing Kft. (1133 Budapest, Gogol utca 13) – host
- HubSpot Ireland Limited (662880, Two Dockland Central, Guild Street Dublin 1, Írország) – CRM
- Mailchimp/ The Rocket Science Group, LLC (675 Ponce de Leon Ave NE Suite 5000 Atlanta, GA 30308 USA) – newsletter system
- Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) OneDrive Cloud Service – HR database storage
Data transfer statement
By accepting this Policy, you have the opportunity to carry out online bank card transactions. In connection with the realization of the webshop purchase as the purpose of data processing, the data related to the online purchases are transferred through the bank card acceptance network of Barion Payment Zrt. (H-1117 Budapest, Infopark sétány 1. I. épület 5. emelet 5.) to perform financial transactions, transaction security and transaction monitoring. The following data shall be transferred: last name, first name, delivery address, billing address, telephone number, e-mail address, payment related data.
A courier service carries out the delivery of orders placed in the webshop. Therefore, we transfer the following customer data (you) to the courier service – Magyar Posta Zrt., GLS Hungary Kft., XXL Futár – to deliver the products: full name, delivery address, e-mail address, telephone number, billing data, transaction data in case of cash on delivery.
If you do not consent to store your data in the system in this manner, please contact our Company via email@example.com.
Rights of the Data Subject, that is, your rights
As Data Subject, you may request information about the Processing of your data and to rectify or delete – with the exception of statutory data processing – your personal data by using any of our contact details or on our website in the Processing of personal data settings menu item.
At your request, we will provide you with information about your data that we process, the purpose of data processing, its legal basis, duration, name and address (registered office) of the data processor, activities related to the data processing and who and why will receive or have received the data.
We are obliged to provide the information free of charge in writing in a comprehensible manner as soon as possible after the request has been submitted but within a maximum of 1 month. We are also obliged to rectify personal data that are incorrect. We shall delete the personal data if its Processing is unlawful, the data subject requests the deletion, the data is incomplete or incorrect – and this cannot be rectified legally – provided that deleting the data is not unlawful, if the purpose of data processing no longer exists, the term for the storage of data specified by law has expired, or the deletion has been ordered by court or the data protection supervisory authority.
We shall notify the Data Subject and those who have received the data previously for the purpose of Processing about the rectification and deletion of data. We shall not send a notification if this does not harm the legitimate interests of the Data Subject with regard to the purpose of the data processing.
The Data Subject, that is you may object to the Processing of your personal data if the Processing (transfer) of the personal data is necessary exclusively for the enforcement of the data controller's rights, except when the data processing is required by law, the data is used or transferred for the purpose of public opinion polling or scientific research or the exercise of right to object is allowed by law.
As Data Controller – with simultaneous suspension of data processing – we are obliged to investigate the objection as soon as possible after the request has been submitted but within a maximum of 15 days, and inform the requestor in writing about the result. If the objection is justified, we shall terminate the data processing – including further data recording and data transfer – and notify all persons who have received the personal data subject to objection about the objection and the measures taken on the basis of the objection, and these persons are obliged to take action to enforce the right to object.
Lodging a complaint
If you find that we have violated any of your rights, please contact us via e-mail address firstname.lastname@example.org or by sending a mail to H-6800 Hódmezővásárhely, Pál utca 50. Upon your contact, we shall investigate the matter immediately.
In the event of a violation of your rights, you may refer the matter to court (at the competent court of the place where the company has its registered office).
You may exercise your right to lodge a complaint at the National Authority for Data Protection and Freedom of Information:
Principles relating to Processing of personal data
Personal data shall be
- processed lawfully, fairly and in a transparent manner in relation to the data subject ('lawfulness, fairness and transparency);
- collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes ('purpose limitation');
- adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ('data minimisation')
- accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay ('accuracy');
- kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to the implementation of the appropriate technical and organizational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject ('storage limitation');
- processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful Processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures ('integrity and confidentiality).
The data controller is responsible for the compliance with the above, and it shall be able to certify this compliance ('accountability').
Legal basis for our data processing
Processing shall be lawful only if and to the extent that at least one of the following applies:
- the data subject shall consent to the Processing of their personal data for one or for more specific purposes;
- the Processing is necessary for the performance of a contract in which the data subject is one of the parties or prior to the conclusion of the contract at the request of the data subject;
- the data processing is necessary to fulfill the legal obligation of the data controller.