Valid from 12.09.2022.

1. GENERAL INFORMATION

ALDI Magyarország Élelmiszer Bt. (registered office: Mészárosok útja 2, 2051 Biatorbágy; e-mail: adatvedelem@aldi.hu; „ALDI” or the „Company”), in the course of liaising with suppliers, eligible organizations, experts and consultants as partners and potential partners ("Partner") in relation to entering into, performing, modifying, and terminating a business or other contractual relationship (collectively: "Contact"), necessarily processes certain information relating to persons acting as contact persons on behalf of the Partner as data subjects ("Contact Data") which is qualified as "personal data" within the meaning of Article 4(1) of the EU General Data Protection Regulation 2016/679 ("GDPR").

This Privacy Notice ("Notice") provides information on the processing of Contact Data and on the rights and remedies of data subjects in relation to the data processing.

This Notice is without prejudice to other ALDI notices and policies. The contents of this Notice should be read in conjunction with the Company's other notices and policies.

2. AWARENESS, AVAILABILITY AND AMENDMENTS OF THE NOTICE

This Notice is available in electronic form on the Company's website at https://www.aldi.hu/hu/customer-services/privacy-policy.html.

The Company reserves the right, at its sole discretion, to unilaterally amend or withdraw this Notice at any time, with effect from the date of amendment, in accordance with applicable law. In particular, this Notice may be amended if required by a change in law, data protection authority practice, business need, newly identified security risk, or feedback from the data subject.

The Company will make the amended current text of the Notice available electronically in the same manner as above.

3. SCOPE OF DATA PROCESSED AND PURPOSES OF DATA PROCESSING

3.1. Contact with Suppliers

The scope of the Contact Data processed by ALDI in connection with its relationship with suppliers as partners ("Supplier"), the purposes of the processing, the legal basis for the processing, as well as the duration of the processing and the parties entitled to access the data are described below.

Suppliers shall complete and send to ALDI a supplier form for recording in ALDI's procurement systems, which contains the name, telephone number, emergency telephone number and e-mail address of the authorised contact person of the Supplier.

Data controller	ALDI
Scope of personal data processed:	Supplier contact details: contact person’s name contact person's telephone number contact person's emergency telephone number contact person's email address communications from the contact person (letters, instructions, notifications)
Parties entitled to access the personal data processed	Within the ALDI organization: ALDI procurement staff, managers, executives; ALDI's supplier invoice staff of the administration department.
The purpose of data processing:	Contact keeping for establishment, performance, modification, termination of supplier contracts, liaising to enforce rights arising from the contract (day-to-day execution).
Legal basis for data processing:	Legitimate interest in entering into and maintaining contractual relations (Article 6(1)(f) GDPR); the conclusion and performance of a contract (Article 6(1)(b) GDPR), in the case of a private supplier (e.g. self-employed). ALDI has a legitimate interest in entering into and performing contracts with the Supplier, for which the processing of Contact Data is essential. Taking into account the nature of the processing and the scope of the data processed (primarily work contact data), the interests or fundamental rights and freedoms of the data subjects that require the protection of their personal data do not prevail over the legitimate interests of the controller. Providing of contact details is subject to the confirmation that the Partner, as the provider of data, has the appropriate legal basis for processing the personal data of the contact person (typically the contact person is an employee or executive officer of the Partner, and a work telephone number and e-mail address are provided).
The duration of data processing:	The personal data (name, telephone number) contained in the supplier form will be stored for the duration of the contractual cooperation with the Supplier, until it is updated (e.g. in case of appointment of a new contact person) or deleted (e.g. in case of termination of the contractual cooperation with the Supplier). If the contract with the Supplier is not concluded or the contractual cooperation is terminated, the supplier form will be destroyed upon expiry of the subsequent general limitation period of 5 years under civil law. If a contract is concluded with the Supplier, the personal data processed will be deleted 8 years after the termination of the contract, in order to comply with accounting requirements.
Data processor:	The data controller does not engage a data processor.
Recipient of personal data:	No recipient.
Information on data security:	ALDI stores as limited personal data as necessary for the performance of contracts with the Supplier. The contact data provided may only be accessed by authorised persons and may only be uploaded, edited or copied by authorised persons, which authorisation is only granted to ALDI employees involved in the contact with the Supplier, who will delete the data immediately after the expiry of the retention period. The contact details are stored on ALDI's own server in a folder to which only duly authorised employees have access.

3.2. Contact with Eligible organizations

ALDI receives a number of requests for grant or cooperation in electronic form from eligible organizations as Partners ("Organization"), which are deleted upon receipt.

The scope of the Contact Data processed by ALDI in connection with its Contacts with Organizations, the purposes of the processing, the legal basis for the processing, the duration of the processing and the persons entitled to access the data are described below.

Data controller	ALDI
Scope of personal data processed:	Organisational contact details: contact person’s name contact person’s address contact person's telephone number contact person's email address data relating to requests for grant or cooperation (e.g. amount, time, content, reasons for approval/rejection)
Parties entitled to access the personal data processed	Within the ALDI organisation: employees of the ALDI department responsible for the administration and management of grants employees responsible for liaison and the managers signing the cooperation contract ALDI's employees responsible for financial matters
The purpose of data processing:	Establishment, performance, amendment and termination of grant contracts. Responding to requests for grant or cooperation from the organisation concerned and fulfilling obligations and exercising rights in relation to grant or cooperation.
Legal basis for data processing:	Legitimate interest in contacting or maintaining contact with the Organisation concerned (Article 6(1)(f) GDPR). Given that contact is typically initiated by the data subject, the data subject has an explicit interest in the processing of his or her personal data in relation to the subject matter of the request, and therefore no data subject rights, or freedoms can be identified which would prevent the processing.
The duration of data processing:	Electronic requests received from Organisations will be deleted after processing. Records are kept until the expiry of a 5-year civil law statute of limitations, and donation records are kept for 8 years in accordance with accounting standards.
Data processor:	Az ALDI International IT Services Kft. (Mészárosok útja 2, 2051 Biatorbágy; Tel: +36 23 533-75) as the data processor for ALDI's customer service.
Recipient of personal data:	There is no recipient other than the data processor.
Information on data security:	ALDI stores as limited personal data as necessary for the performance of contracts with the Organization. The contact data provided may only be accessed by authorised persons and may only be uploaded, edited or copied by authorised persons, which authorisation is only granted to ALDI employees involved in the contact with the Organization, who will delete the data immediately after the expiry of the retention period. The contact details are stored on ALDI's own server in a folder to which only duly authorised employees have access.

3.3. Contact with Experts

ALDI uses experts and professional consultants ("Experts") to perform certain tasks, the scope of the Contact Data processed by ALDI in connection with its Contact with Experts as Partners, the purposes of the processing, the legal basis for the processing, the duration of the processing and the persons entitled to access the data are described below.

Data controller	ALDI
Scope of personal data processed:	Expert contact details: contact person’s name contact person’s address contact person's telephone number contact person's email address data related to the expert tasks (e.g. time, content, professional justification, etc.)
Parties entitled to access the personal data processed	Within the ALDI organisation: the employees of the ALDI department responsible for liaison with the Experts and the managers signing the cooperation contract ALDI's employees responsible for financial matters
The purpose of data processing:	Contact keeping for establishment, performance, modification, termination of expert contracts, liaising to enforce rights arising from the contract (daily/weekly or on-demand execution).
Legal basis for data processing:	Legitimate interest in entering into and maintaining contractual relations (Article 6(1)(f) GDPR); the conclusion and performance of a contract (Article 6(1)(b) GDPR), in the case of a private expert (e.g. self-employed). ALDI has a legitimate interest in entering into and performing contracts with the Expert, for which the processing of contact details is essential. Taking into account the nature of the processing and the scope of the data processed (primarily work contact data), the interests or fundamental rights and freedoms of the data subjects that require the protection of their personal data do not prevail over the legitimate interests of the controller. The transfer of contact details is subject to the condition that the transferor has an appropriate legal basis for processing the personal data of the contact person (typically the contact person is an employee or manager of the party transferring the data and a work telephone number and e-mail address are provided).
The duration of data processing:	The Contact Data is stored for the duration of the contractual cooperation with the Expert, until it is updated (e.g. in case of appointment of a new contact person) or deleted (e.g. in case of termination of the contractual cooperation with the Expert). If the contract with the Expert is not concluded or the contractual cooperation is terminated, the contact details will be destroyed upon expiry of the subsequent general limitation period of 5 years under civil law. If a contract is concluded with the Expert, the personal data processed will be deleted 8 years after the termination of the contract, in order to comply with accounting requirements.
Data processor:	The data controller does not engage a data processor.
Recipient of personal data:	The processing does not involve a recipient.
Information on data security:	ALDI stores as limited personal data as necessary for the performance of contracts with the Expert. The contact data provided may only be accessed by authorised persons and may only be uploaded, edited or copied by authorised persons, which authentication is only granted to ALDI employees involved in the contact with the Expert, who will delete the data immediately after the expiry of the retention period. The contact details are stored on ALDI's own server in a folder to which only duly authorised employees have access.

4. THE RIGHTS OF DATA SUBJECTS REGARDING DATA PROCESSING

The data subject, i.e. the person whose personal data are processed in the preparation, conclusion or performance of the contracts specified above, has the right to obtain information about and access (including the right to request a copy) to the processing of his/her personal data at any time, as well as the right to rectification, cancellation or restriction of the processing. Regarding the above, the ALDI contractual contact person may be contacted at the address set out in the contract, the Data Protection Coordinator at the adatvedelem@aldi.hu e-mail address or at the Mészárosok útja 2, Biatorbágy HU-2051 postal address. ALDI must comply with requests regarding the above within one month. If necessary, taking into account the complexity of the request and the number of requests, this deadline may be extended by an additional two months. ALDI will inform the Data Subject of the extension within one month of receiving the request, stating the reasons for the delay. If the request was submitted electronically, the information shall be provided electronically where possible, unless requested otherwise.

Data protection rights and remedies and their limitations are set out in detail in the GDPR (in particular Articles 12-22, 77-79 and 82 of the GDPR) and the following sections.

In the context of notice, ALDI draws attention to the fact, that the Data Subject may object to the processing of his/her personal data based on the legitimate interests of ALDI for reasons relating to his/her own situation at any time. In such a case, ALDI may no longer process the personal data unless ALDI can demonstrate compelling legitimate grounds for the processing that override the interests, rights and freedoms of the Data Subject, or which are related to the establishment, exercise or defence of legal claims.

4.1 The right to information

Where ALDI processes personal data relating to the Data Subject, ALDI is obliged to provide the Data Subject with information, even without his/her request, on the main features of the processing, such as the purpose, legal basis, duration, the identity and contact details of ALDI and its representative, the recipients of the personal data and the rights and legal remedies with regard to the processing(including the right to lodge a complaint with a supervisory authority), and, where the Data Subject is not the source of the data, the source of the personal data and the categories of personal data concerned, if the Data Subject does not already have this information. ALDI provides this information by making the present notice available to Data Subjects.

4.2 The right to access

The Data Subject has the right to receive feedback from ALDI on whether his/her personal data are being processed and, if such processing is ongoing, the Data Subject has the right to access his/her personal data and certain information about the processing, including the purposes of the processing, the categories of personal data concerned, the recipients of the personal data, the (envisaged) duration of the processing, the rights and remedies of the data subject (including the right to lodge a complaint with a supervisory authority) and, in case of data not collected from the Data Subject, information about the source of the data.

Upon the request of the Data Subject, ALDI will provide the Data Subject with a copy of the personal data processed. ALDI may charge a reasonable fee based on administrative costs for any additional copies requested by the Data Subject. If the Data Subject has submitted the request electronically, the information will be provided in a commonly used electronic format unless requested otherwise. The right to request a copy must not adversely affect the rights and freedoms of others.

Upon request of the data Subject, ALDI will provide information about the possibility of obtaining a copy, how to obtain a copy, the possible costs and other details.

4.3 The right to rectification

The Data Subject has the right to have inaccurate personal data concerning him/her corrected by ALDI without undue delay upon request. Taking into account the purpose of the processing, the data Subject has the right to request the completion of incomplete personal data, including by means of a supplementary declaration.

4.4 The right to erasure

The Data Subject has the right to request the deletion of his/her personal data processed by ALDI and ALDI is obliged to delete the personal data without undue delay if certain conditions are met. ALDI is obliged to delete personal data at the request of the Data Subject, inter alia, if the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; if the Data Subject withdraws his/her consent on the basis of which the data are processed and there is no other legal basis for the processing; or if the personal data have been processed unlawfully; or if the Data Subject objects to the processing and there is no overriding legitimate ground for the processing; or if the personal data must be deleted in order to comply with a legal obligation under Union or Member State law applicable to ALDI.

The above shall not apply where the processing is necessary:

a) for the exercise of the right to freedom of expression and information;

b) for the purposes of complying with an obligation under Union or Member State law that requires the processing of personal data that is applicable to the Company;

c) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, where the right of erasure would be likely to render such processing impossible or seriously jeopardise it;

d) for the filing, exercise or defence of legal claims.

4.5 The right to restriction of the data processing

The Data Subject has the right to have ALDI restrict the processing of his/her data upon request, if one of the following conditions is met:

a) the Data Subject contests the accuracy of the personal data, in which case the limitation applies for the period of time that allows ALDI to verify the accuracy of the personal data;

b) the processing is unlawful, and the data Subject opposes the erasure of the data and instead requests the restriction of their use;

c) ALDI no longer needs the personal data for the purposes of processing, but the Data Subject requires them for the establishment, exercise or defence of legal claims; or

d) the Data Subject has objected to the processing; in this case, the restriction applies for the period until it is established whether ALDI’s legitimate grounds prevail over the legitimate grounds of the Data Subject.

If processing is restricted on the basis of the above, such personal data with the exception of storage may be processed only with the consent of the Data Subject, or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for important public interests of the Union or of a Member State.

ALDI shall inform the Data Subject in advance of the lifting of the restriction of processing if, at his/her request, the processing has been restricted on the basis of the above.

4.6. The right to object, automated decision-making

The Data Subject has the right to object to the processing of his/her personal data relating to his/her personal situation in cases described in Article 21 of the GDPR. Automated decision-making and profiling do not take place.

4.7 The framework for the exercise of rights

ALDI will inform the Data Subject without undue delay, but in any event within one month of receipt of the request, of the action taken in response to the request concerning his/her rights listed above. If necessary, taking into account the complexity of the request and the number of requests, this deadline may be extended by an additional two months. ALDI will inform the Data Subject of the extension within one month of receipt of the request, stating the reasons for the delay. If the Data Subject has submitted the request by electronic means, the information shall be provided by electronic means wherever possible, unless requested otherwise.

If ALDI does not take action on the request of the Data Subject, it will inform the Data Subject without delay, at the latest within one month of receipt of the request, of the reasons for its failure to act and of the right of the Data Subject to lodge a complaint with the competent data protection supervisory authority.

The above information must be provided in writing or by other, including electronic, means where appropriate. At the request of the Data Subject, information may also be provided orally, given that the identity of the Data Subject was proven by other means.

If the Data Subject considers that the processing of personal data concerning him/her infringes the provisions of the GDPR, he/she has the right to lodge a complaint with the supervisory authority, which in Hungary is the National Authority for Data Protection and Freedom of Information (address: 1055 Budapest Falk Miksa út 9-11.; postal address: 1363 Budapest, Pf. 9.; Telephone +36 1 391 1400; Fax: +36-1-391-1410, E-mail: ugyfelszolgalat@naih.hu; website: https://naih.hu/; the “NAIH”), and to exercise your right to judicial remedy.

In addition to the above, the Data Subject is entitled to effective judicial remedy. Such an action falls within the jurisdiction of the courts, which may, at the option of the person concerned, be brought before the courts having jurisdiction for the place of residence or domicile. Information on the jurisdiction and contact details of the court (court of appeal) can be found at the following website: www.birosag.hu

12.09.2022, Biatorbágy