Valid from 15.09.2023.

1. GENERAL INFORMATION

ALDI Magyarország Élelmiszer Bt. (registered seat: 2051 Biatorbágy, Mészárosok útja 2.; e-mail address: adatvedelem@aldi.hu; “ALDI”) necessarily processes certain information qualifying as “personal data” within the meaning of Article 4 (1) of the EU General Data Protection Regulation No. 2016/679 (“GDPR”) about the persons acting as contact persons on behalf of the other party, as data subjects (“Contact Data”) to enter into, perform, amend or terminate business or other contractual relationships with its partners and potential partners, in particular: suppliers, eligible organisations, experts and consultants, business partners, and to communicate with the media (online and print media, television, radio, etc. – “Media”) (collectively, “Communication” - including the handling of any potential legal claims).

This privacy notice (“Notice”) provides information on the processing of Contact Data, as well as on the rights and remedies of data subjects related to processing.

This Notice does not affect the other notices and policies of ALDI. The contents of this Notice shall be interpreted jointly with the other notices and policies of ALDI.

2. READING, ACCESSING AND AMENDMENT OF THIS NOTICE

This Notice is available in electronic form on the Company's website at https://www.aldi.hu/hu/customer-services/privacy-policy.html.

ALDI reserves the right to amend or withdraw this Notice unilaterally, with immediate effect following the amendment, at its own discretion anytime, in accordance with the effective legal regulations. This Notice may be amended, in particular, if necessary due to changes in legal regulations, practices of the data protection authority, business needs, newly identified security risks or feedback from data subjects.

ALDI will make the amended effective text of the Notice available electronically in the same manner as detailed above.

3. SCOPE OF DATA PROCESSED AND PURPOSES OF DATA PROCESSING

3.1. Communication with Suppliers

The Contact Data processed by ALDI for Communication with potential or existing suppliers (“Supplier”), the purposes of processing, the legal basis for processing, the duration of processing and the persons entitled to access the data are detailed below.

Suppliers will fill in and send to ALDI a supplier datasheet for recording in ALDI’s procurement systems. Such datasheet contains the name, telephone number, emergency telephone number and e-mail address of the person acting as the contact person of the Supplier.

Data Controller	ALDI
Scope of personal data processed:	Supplier’s contact data: name of the contact person phone number of the contact person emergency phone number of the contact person email address of the contact person communication received from the contact person (mails, instructions, notices)
Persons entitled to learn the processed personal data:	Within ALDI’s work organisation: ALDI’s procurement employees, managers, leaders; employees of ALDI’s administration department working with supplier invoices
Purposes of processing:	Creation, performance, amendment, termination of supplier contracts; establishment, exercise and defence of legal claims in relation to potential or existing contracts and the related business communication.
Legal basis for dataof processing:	Legitimate interest in contacting, communication and handling legal claims (Article 6(1)(f) of the GDPR), in the case of a private individual supplier (e.g. sole trader), the conclusion and performance of the contract (Article 6(1)(b) of the GDPR). It is in ALDI’s legitimate interest to conclude and perform contracts with the Supplier, for which it is inevitable to process the Contact Data. Considering the nature of processing and the scope of the data processed (primarily workplace Contact Data), the interests or fundamental rights and freedoms of the data subjects that require the protection of their personal data do not override the legitimate interests of the controller. Contact Data are provided by stipulating that the Supplier, as the party providing the data has the appropriate legal basis to process the contact person’s personal data (typically the contact person is an employee or executive officer of the Supplier and his/her work telephone number and email address are provided).
Duration of processing:	The personal data (name, telephone number) contained in the Supplier datasheet are stored during the term of the contractual cooperation with the Supplier, until it is updated (e.g. in the event of appointing a new contact person) or deleted (e.g. in case of terminating the contractual cooperation with the Supplier). If the contract with the Supplier is not concluded or the contractual cooperation is terminated, the Supplier datasheet will be destroyed upon the expiry of the 5-year general limitation period under civil law. If a contract is concluded with the Supplier, the processed personal data will be deleted after the period of 8 years following the termination of the contract in order to comply with the accounting requirements.
Data processor:	For processing, ALDI does not employ so-called “data processors” (who would process the data on behalf of and on the basis of the instructions of ALDI).
Recipients of personal data:	The personal data are not transferred to other third parties.
Information on data security:	ALDI will store the possible minimum personal data as necessary for the performance of the contracts to be concluded with the Supplier. Only authorised persons have access to the Contact Data provided, and the data can only be uploaded, edited or copied with proper authorisations granted only to ALDI employees involved in Communication with the Supplier, who will delete such data without delay following the expiry of the retention period. The Contact Data will be stored on ALDI’s own server in a folder to which only the employees with proper authorisations will have access.

3.2. Communication with eligible organisations

ALDI receives several sponsoring or cooperation requests in electronic form from eligible organisations (“Organisation”). Such requests are deleted after processing.

The Contact Data processed by ALDI for Communication with the Organisations, the purposes of processing, the legal basis for processing, the duration of processing and the persons entitled to access the data are detailed below.

Data controller	ALDI
Scope of personal data processed:	Contact Data of the Organisation: name of the contact person address of the contact person phone number of the contact person email address of the contact person data concerning the sponsorship or cooperation request (e.g. amount, date, content of the sponsorship, explanation of approval/rejection)
Persons entitled to learn the processed personal data:	Within ALDI’s work organisation: employees of ALDI’s department responsible for performing the assessment and administration of sponsorships employees responsible for communication, and managers signing the cooperation agreement ALDI’s employees working at the financial department
Purposes of processing:	Creation, performance, amendment, termination of sponsorship and cooperation contracts; establishment, exercise and defence of legal claims in relation to potential or existing contracts and the related business communication. Providing answer to the given Organisation in relation to the assessment of the sponsorship or cooperation request, as well as the fulfilment of obligations and exercising rights related to sponsorship or cooperation.
Legal basis of processing:	Legitimate interest in contacting and Communication with the given Organisation (Article 6(1)(f) of the GDPR). Considering the fact that the contacting is performed typically at the initiative of the data subject, the data subject has a particular interest in the processing of his/her personal data in relation to the subject matter of the request, and therefore, no right or freedom of the data subject can be identified which would hinder the processing.
Duration of processing:	The electronic requests received from the Organisations are deleted following processing. The recorded data are stored until the expiry of the 5-year limitation period under civil law, while the documents related to donations are stored for 8 years in accordance with the accounting regulations.
Data processor:	Az ALDI International IT Services Kft. (2051 Biatorbágy, Mészárosok útja 2.; phone: +36 23 533-75) as the processor operating ALDI’s customer service.
Recipients of personal data:	The personal data are not transferred to other third parties.
Information on data security:	ALDI will store the possible minimum personal data as necessary for the performance of the contracts to be concluded with the Organisations. Only authorised persons have access to the Contact Data provided, and the data can only be uploaded, edited or copied with proper authorisations granted only to ALDI employees involved in Communication with the organisations, who will delete such data without delay following the expiry of the retention period. The Contact Data will be stored on ALDI’s own server in a folder to which only the employees with proper authorisations will have access.

3.3. Communication with Experts

For the performance of certain tasks, ALDI employs experts and professional consultants (“Expert”).

The Contact Data processed by ALDI for Communication with the Experts, the purposes of processing, the legal basis for processing, the duration of processing and the persons entitled to access the data are detailed below.

Data controller	ALDI
Scope of personal data processed:	Contact Data of Experts: name of the contact person address of the contact person phone number of the contact person email address of the contact person data related to expert tasks (e.g. duration, content, professional justification of expert activities, etc.)
Persons entitled to learn the processed personal data:	Within ALDI’s work organisation: employees of ALDI’s competent department responsible for Communication with the Experts, and the managers signing the cooperation agreement ALDI’s employees working at the financial department
Purposes of processing:	Creation, performance, amendment, termination of expert contracts; establishment, exercise and defence of legal claims in relation to potential or existing contracts and the related business communication.
Legal basis of processing:	Legitimate interest in contacting and Communication (Article 6(1)(f) of the GDPR), in the case of a private individual Expert (e.g. sole trader), the conclusion and performance of the contract (Article 6(1)(b) of the GDPR). It is in ALDI’s legitimate interest to conclude and perform contracts with the Expert, for which it is inevitable to process the Contact Data. Considering the nature of processing and the scope of the data processed (primarily workplace Contact Data), the interests or fundamental rights and freedoms of the data subjects that require the protection of their personal data do not override the legitimate interests of the controller. Contact Data are provided by stipulating that the party providing the data has the appropriate legal basis to process the contact person’s personal data (typically the contact person is an employee or executive officer of the party providing the data, and his/her work telephone number and email address are provided).
Duration of processing:	The Contact Data are stored during the term of the contractual cooperation with the Expert, until these are updated (e.g. in the event of appointing a new contact person) or deleted (e.g. in case of terminating the contractual cooperation with the Expert). If the contract with the Expert is not concluded or the contractual cooperation is terminated, the provided Contact Data will be destroyed upon the expiry of the 5-year general limitation period under civil law. If a contract is concluded with the Expert, the processed personal data will be deleted after the period of 8 years following the termination of the contract in order to comply with the accounting requirements.
Data processor:	For processing, ALDI does not employ so-called “data processors” (who would process the data on behalf of and on the basis of the instructions of ALDI).
Recipients of personal data:	The personal data are not transferred to other third parties.
Information on data security:	ALDI will store the possible minimum personal data as necessary for the performance of the contracts to be concluded with the Expert. Only authorised persons have access to the Contact Data provided, and the data can only be uploaded, edited or copied with proper authorisations granted only to ALDI employees involved in Communication with the Expert, who will delete such data without delay following the expiry of the retention period. The Contact Data will be stored on ALDI’s own server in a folder to which only the employees with proper authorisations will have access.

3.4. Communication with Business Partners and the Media

ALDI communicates with certain employees of the Business Partners and the Media and with other persons acting on their behalf, for which the processing of Contact Data is inevitable.

The Contact Data processed by ALDI for Communication with the Business Partners and the Media, the purposes of processing, the legal basis for processing, the duration of processing and the persons entitled to access the data are detailed below.

Data controller	ALDI
Scope of personal data processed:	Business Partner Contact Data: name email address phone number contents of the communication Media Contact Data: name email address phone number contents of the communication name of the given Media
Persons entitled to learn the processed personal data:	Within ALDI’s work organisation: employees of ALDI’s competent department
Purposes of processing:	Creation, performance, amendment, termination of contracts between ALDI and its Business Partners; establishment, exercise and defence of legal claims in relation to potential or existing contracts and the related business communication. Communication and cooperation between ALDI and the given Media; establishment, exercise and defence of legal claims in relation to potential or existing cooperation and media publications, and the related business communication.
Legal basis of processing:	ALDI performs Communication with its Business Partners and the Media on the basis of its legitimate interest specified in Article 6(1)(f) of the GDPR. ALDI’s legitimate interest: In case of Business Partners – to establish and maintain long-term and stable relationships with the Business Partners, mainly for continuously ensuring ALDI’s daily operation and for developing ALDI’s customer servicing. Excellent business relations and partnerships based on mutual advantages allow ALDI to operate efficiently, to remain competitive and to improve customer satisfaction. In case of the Media – communication with the Media is of strategic importance for ALDI to manage corporate issues efficiently, to build and defend its reputation, and to establish relationships with its customers. This includes primarily the following activities: communication with the Media allows ALDI to strengthen its business reputation, to clarify the facts related to any potential negative media coverages, and to provide replies. besides this, communication with the Media also allows ALDI to promote its products and campaigns, and to inform its customers in advertisements on the available products and special offers. via Media, ALDI can establish closer relations with the customers: Media (e.g. social media and online forums) allow ALDI to collect feedback and handle customer questions, to inform and educate customers (e.g. on healthy diet, ingredients of products and culinary habits). finally, communication with the Media allows ALDI to collect information on the changes of the legal regulations affecting its operation and the effects of such changes. Contact Data are provided by stipulating that the Business Partner or the given Media as the party providing the data has the appropriate legal basis to process the contact person’s personal data (typically the contact person is an employee or executive officer of the Business Partner or the given Media, and his/her work telephone number and email address are provided).
Duration of processing:	General data retention period: ALDI stores the Contact Data for 5 years calculated from the date when the underlying contractual relationship terminates or (if such date is different) from the date of the last communication with the contact person (inactivity). (Pursuant to Act V of 2013 on the Civil Code – “Civil Code” – claims lapse in 5 years). A contact person may become “inactive” if he is placed to another department of the Business Partner and ALDI gets another contact person, or if the employment relationship of the given contact person terminates at the given Media and is replaced by a new contact person. It is the legitimate interest of ALDI, the given Business Partner and the Media to know who was the predecessor of the contact person during the limitation period, what was the former correspondence and who can be referred to, who can be contacted for certain issues, if the background knowledge is required for former issues. If the Contact Data are contained in a document to be used for taxpayer obligations: the compulsory data retention period required by law is 5 years calculated from the last day of the calendar year in which the tax return, data reporting or reporting should have been performed, or in the absence of tax return, data reporting or reporting, the tax should have been paid (Sections 78 (3) and 202 (1) of Act CL of 2017 on the rules of taxation). If the Contact Data are contained in an accounting document: the compulsory data retention period required by law is 8 years (pursuant to Sections 168-169 of Act C of 2000 on accounting). In the practice, this is the case if the Contact Data are part of the documents supporting ALDI’s accounting, for example if the data are contained in documents related to contracts concluded between ALDI and the Business Partners (e.g. order) or on invoices. If the Contact Data are necessary for the establishment, exercise or defence of legal claims: the duration of processing is the period necessary for the preparation and the conducting of the procedure(s), and the period necessary for the final closing of the procedure or the exercising of the legitimate interest in other manner (e.g. out-of-court settlement). The created official documents are kept by ALDI in accordance with the rules governing the retention of the given document.
Data processor:	For processing, ALDI does not employ so-called “data processors” (who would process the data on behalf of and on the basis of the instructions of ALDI).
Recipients of personal data:	The personal data are not transferred to other third parties.
Information on data security:	Only authorised persons have access to the Contact Data provided. The data can only be uploaded, edited or copied with proper authorisations granted only to ALDI employees involved in Communication with the Business Partner and the Media, who will delete such data without delay following the expiry of the retention period. The Contact Data will be stored on ALDI’s own server in a folder to which only the employees with proper authorisations will have access.

4. RIGHTS OF THE DATA SUBJECTS IN RELATION TO PROCESSING

The data subject, i.e. the person whose personal data is processed in the course of the preparation, conclusion or performance of the contracts specified above, has the right to obtain information and access to his/her personal data (and to request a copy) at any time, and may request the rectification, erasure or restriction of processing. In relation to the above, you may contact ALDI’s contractual contact person at the address specified in the contract, the data protection coordinator at the email address adatvedelem@aldi.hu and by using the postal address 2051 Biatorbágy, Mészárosok útja 2. ALDI is obliged to comply with the requests specified above within one month. If necessary, taking into account the complexity of the request and the number of requests, such deadline may be extended by another two months. ALDI will inform you on the extension of the deadline within one month following the receipt of the request, indicating the reasons for the delay. If you have submitted your request electronically, the information will be provided electronically where possible, unless you request otherwise.

Your data protection rights and remedies concerning your personal data and the relevant provisions and limitations of the GDPR are contained in detail in the GDPR (in particular in Articles 12-22, 77-79 and 82 of the GDPR) and in the following sections.

Within the frameworks of this notice, ALDI specifically draws your attention to the fact that the Data Subject may object at any time, on grounds relating to his/her particular situation, to the processing of his/her personal data on the basis of ALDI’s legitimate interest. In such case, ALDI shall no longer process the personal data unless ALDI demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

4.1 Right of information

If ALDI processes personal data relating to the Data Subject, ALDI shall provide the Data Subject with information, even without the Data Subject’s request, on the most important features of the processing, such as the purpose, legal basis, duration of the processing, the identity and contact details of ALDI and its representative, the recipients of the personal data, as well as the Data Subject’s rights and remedies with regard to the processing (including the right to lodge a complaint with a supervisory authority) and, where the Data Subject is not the source of the data, on the source of the personal data and the categories of personal data concerned, if the Data Subject does not already have this information. ALDI provides this information by making this Notice available to the Data Subject.

4.2 Right of access

The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him/her are being processed, and, where that is the case, access to the personal data and certain information related to processing, including the purposes of the processing, the categories of personal data concerned, the recipients of the personal data, the (envisaged) duration of the processing, the rights and remedies of the data subject (including the right to lodge a complaint with a supervisory authority) and, where the data are not collected from the Data Subject, information about their source.

Upon the Data Subject’s request, ALDI shall provide the Data Subject with a copy of the personal data undergoing processing. For any further copies requested by the Data Subject, ALDI may charge a reasonable fee based on administrative costs. Where the Data Subject makes the request by electronic means, and unless otherwise requested by the Data Subject, the information shall be provided in a commonly used electronic form. The right to obtain a copy shall not adversely affect the rights and freedoms of others.

The Company will provide information on the possibility and the manner of issuing a copy, the costs, if any, and other details at the Data Subject’s request.

4.3 Right to rectification

The Data Subject shall have the right to obtain from ALDI without undue delay the rectification of inaccurate personal data concerning the Data Subject. Taking into account the purposes of the processing, the Data Subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

4.4 Right to erasure

The Data Subject has the right to request the deletion of his/her personal data processed by ALDI and ALDI is obliged to delete the personal data without undue delay if certain conditions are met. ALDI is obliged to delete personal data at the request of the Data Subject, inter alia, if the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; if the Data Subject withdraws his/her consent on the basis of which the data are processed and there is no other legal basis for the processing; or if the personal data have been processed unlawfully; or if the Data Subject objects to the processing and there is no overriding legitimate ground for the processing; or if the personal data must be deleted in order to comply with a legal obligation under Union or Member State law applicable to ALDI.

The above shall not apply where the processing is necessary:
a) for the exercise of the right to freedom of expression and information;
b) for the purposes of complying with an obligation under Union or Member State law that requires the processing of personal data that is applicable to the Company;
c) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, where the right of erasure would be likely to render such processing impossible or seriously jeopardise it;
d) for the filing, exercise or defence of legal claims.

4.5 Right to restriction of processing

The Data Subject shall have the right to obtain from ALDI restriction of processing where one of the following applies:
a) the accuracy of the personal data is contested by the Data Subject, for a period enabling ALDI to verify the accuracy of the personal data;
b) the processing is unlawful and the Data Subject opposes the erasure of the personal data and requests the restriction of their use instead;
c) ALDI no longer needs the personal data for the purposes of the processing, but they are required by the Data Subject for the establishment, exercise or defence of legal claims; or 
d) the Data Subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the Data Subject.

Where processing has been restricted under the above sections, such personal data shall, with the exception of storage, only be processed with the Data Subject‘s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

The Data Subject who has obtained restriction of processing pursuant to the above shall be informed by ALDI before the restriction of processing is lifted.

4.6. Right to object and automated decision-making

The data subject shall have the right to object, on grounds relating to his/her particular situation, at any time to processing of personal data. ALDI shall no longer process the personal data unless ALDI demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. The detailed description of ALDI’s legitimate interests is contained in the so-called “interest assessment (legitimate interest) test”, which shall be made available by ALDI at any time upon request.

Automated decision-making or profiling is not performed.

4.7 Frameworks of exercising rights

ALDI shall inform the Data Subject on the measures taken as a result of the request related to the aforesaid rights without unnecessary delay, within one month following the receipt of the request. If necessary, taking into account the complexity of the request and the number of requests, such deadline may be extended by another two months. ALDI will inform the Data Subject on the extension of the deadline within one month following the receipt of the request, indicating the reasons for the delay. If the Data Subject has submitted the request electronically, the information will be provided electronically where possible, unless the Data Subject requests otherwise.

If ALDI does not take action on the request of the Data Subject, ALDI shall inform the Data Subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with the competent data protection authority.

The aforesaid information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the Data Subject, the information may be provided orally, provided that the identity of the Data Subject is proven by other means.

The Data Subject shall have the right to lodge a complaint with a supervisory authority if the Data Subject considers that the processing of personal data relating to him/her infringes the provisions of the GDPR. In Hungary, the supervisory authority is: Hungarian National Authority for Data Protection and Freedom of Information (address: 1055 Budapest Falk Miksa u. 9-11.; phone: +36 1 391 1400; Fax: +36-1-391-1410, email: ugyfelszolgalat@naih.hu; website: http://naih.hu/; “NAIH”), and the Data Subject has right to judicial remedy.

In addition to the above, the Data Subject has right to an effective judicial remedy. Such lawsuits are subject to tribunal competence, which may be initiated by the Data Subject before the competent tribunal at his place of residence or place of stay, at his/her own discretion. The competences and contact details of the courts (tribunals) can be found on the following website: www.birosag.hu.

Biatorbágy, 15 September 2023