This Data Management Notice (“ Data Management Notice ”) contains information about how Gálabau Kft. handles your personal data in the online store it operates on the https://yatasbedding.hu website (“Website”) and during related data management.

Data of Gálabau Kft.:

Name : GÁLABAU Industrial and Commercial Limited Liability Company

Headquarters and mailing address : 1045 Budapest, Pozsonyi u. 4/F

Email address : tamas@beretrade.hu

Company registration number : 01-09-691711

Name of the court of registration : Capital City Company Court

Tax number : 10569975-2-41

(hereinafter: " Data Controller ").

Please note that no data protection officer has been appointed in relation to the processed data.

When we process your Personal Data on the basis of legitimate interest, you have the right to object to such processing (for more information, see Section IV). If you wish to object to data processing, please contact us via the contact details found in this document and on the Website.

Concepts used in the brochure

The meaning of capitalized terms used in this Data Management Information is contained in the following paragraph.

Personal Data : any information about you, on the basis of which we can identify you directly or indirectly. Personal Data is a name, identification number, location data, online identifier or one or more factors relating to your physical, physiological, genetic, mental, economic, cultural or social characteristics.

Data management : Any operation or set of operations performed on Personal Data or data files in an automated or non-automated manner, such as the collection, recording, organization, segmentation, storage, transformation or change, query, insight, use, communication, transmission, distribution or otherwise by making available, coordinating or connecting, limiting, deleting or destroying;

You : the user or customer of the Website or the services we provide through it, especially the online store. Data processor : the natural or legal person, public authority, agency or any other body that processes personal data on our behalf.

Bere Group : From the Data Controller, Bere Trade Kft. (headquarters: 2142 Nagytarcsa, Asbóth Oszkár utca 7. company registration number: 13-09-211028) and NANNI Matrac Kft. (headquarters: 2142 Nagytarcsa, Asbóth Oszkár utca 7 . company registration number: 01-09-981287) company group.

I. Data Management Guidelines

a) We handle your Personal Data in a fair and transparent manner in accordance with legal requirements.

b) We only process your Personal Data for the legal purposes specified in this Data Management Information.

c) We do not process your Personal Data that are not suitable, relevant or necessary to achieve the data management goals set out in the Data Management Information.

d) We will do our best to keep your Personal Data accurate and up-to-date. We will take all reasonable steps to delete or correct inaccurate Personal Data.

e) We store your Personal Data in a form that allows us to identify you only for the purpose of processing the Personal Data and only for the necessary time.

f) We manage your personal data in a way that ensures the appropriate security of personal data management, including protection against unauthorized or illegal data management, accidental loss, destruction or damage.

II. Why and how do we manage your Personal Data?

In most cases, we process your Personal Data in order to provide you with our online store services. However, there may be other purposes for the processing of the data (e.g. fulfilling our obligations stipulated by law). Detailed information on the purposes of data management and other relevant circumstances of the management can be found below, grouped by purpose.

We do not carry out automated decision-making or profiling when handling Personal Data, otherwise we will inform you directly.

the. Newsletters and direct business inquiries

Purpose of personal data management : Information about Bere Group-related news and current offers. We use the provided data and other data about you in the records (e.g. what products you bought, what products you were interested in) in order to create personalized offers and prepare and send marketing inquiries sent using the direct inquiry method or in other ways. Data management may involve profiling, during which we can classify you into categories based on your interests in order to avoid sending you marketing messages that are presumably not of interest to you. In terms of data management, Bere Group members act as joint data controllers.

Legal basis for data management : Your consent.

Categories of processed Personal Data : Personal data provided by you, data related to the purchase, data created by us during data management (e.g. identification number, area of ​​interest).

Period of storage of personal data : The relevant Personal Data will be processed until consent is withdrawn (e.g. unsubscribing from the newsletter).

Recipients of Personal Data : During the processing of your Personal Data, we forward your data to our data processors who provide the necessary technical background for the data controllers. Such data processors are our online mail service provider, our online advertising service provider, our webshop engine, and our marketing technology service providers.

b. Provision of services available on the website

The purpose of handling Personal Data : Placement and processing of orders, related e-mail communication, delivery of orders, cancellation of orders or any other matters related to the order of purchased goods or services; handling returns and cancellations in accordance with the relevant legal provisions.

The legal basis for data management : the legitimate interest of the Data Controller based on point (f) of Article 6 (1) of the GDPR.

The legitimate interest of the data controller : the operation of the website, the conclusion, performance, monitoring and maintenance of sales contracts, compliance with the related legal obligations.

Scope of processed data : personal data of the customer suitable for identification and necessary for the purpose of contact (e.g. name, e-mail address, phone number), other data related to the fulfillment of the order (e.g. product type, delivery and billing address, comments). Duration of data management : in the case of data related to sales, for 5 years after the termination or fulfillment of the given contract, or from other activities related to the contract (e.g. cancellation). If an invoice is issued and personal data is included, then this data will be deleted at the end of the 8th year from the date of the invoice.

Recipients of Personal Data : data may be forwarded to partners involved in the performance and enforcement of the contract. Such data processors are our online mail service provider, our webshop engine, and our other technology service providers. During the delivery, we can transfer the data related to the delivery to our logistics partner.

c. Contact, complaint handling

Purpose of Personal Data Management : Management of the data of natural persons who contact the Data Controller or submit a complaint.

The legal basis for data management : the legitimate interest of the Data Controller based on point (f) of Article 6 (1) of the GDPR, and the fulfillment of the legal obligation of the data controller pursuant to point (c) of Article 6 (1) of the GDPR.

The legitimate interest of the data controller : maintaining contact with the customer, handling complaints and fulfilling related legal obligations.

The scope of the processed data: the data included in the inquiry or complaint, the results of the investigation conducted by the Data Controller, minutes of the complaint and its handling.

Duration of data management: 5 years from the date of processing of the inquiry or complaint.

Recipients of Personal Data : Data may be forwarded to partners involved in handling inquiries and complaints. Such data processors are our online mail service provider, our webshop engine, our other technology service providers, and our external legal service providers.

III. Data processors

For the support services related to our business activities, we use the cooperation of data processors, and for the purpose of providing these services, we may forward your Personal Data to such service providers. The above II. point contains the categories of data processors we use. If you have any questions about our data processors, please feel free to contact us and we will provide further information.

We always guarantee the use of appropriate and suitable safeguards when transferring data outside the EEA.

In the case of our partners operating in the United States of America, we ensure that the Data Controller enters into general data protection clauses approved by the European Commission with such suppliers, if personal data is transferred to them.

ARC. Your rights regarding the data we manage

In relation to the data management activities carried out by us, you have the following rights in relation to your Personal Data:

• Right of access

You can request access from us regarding your Personal Data that we manage, as well as request information about the purpose of data management, the categories of data managed, to which recipients we forward and make your Personal Data available, as well as for what period of time we manage them, and about your rights regarding the processing of Personal Data by us and about the right to apply to the data protection authority. Furthermore, in the event that your Personal Data is not collected from you, but from another source, you have the right to receive information about the source of the data, as well as whether we use automatic decision-making or similar procedures, including the logic of their operation, as well as the data management in this form its significance and the expected consequences for you. You can also request information on whether and under what conditions we transfer your Personal Data outside the EEA.

If you request this, we will provide you with a copy of your Personal Data managed by us.

• right to rectification

You have the right to have inaccurate personal data about you corrected upon your request. You are entitled to request that incomplete personal data be completed by means of a supplementary statement.

• right to erasure

Upon your request, we will delete your Personal Data immediately, in the following cases:

a) the personal data are no longer needed for the purpose for which they were collected;

b) You withdraw your consent, which is the basis of the data management, and there is no other legal basis for the data management;

c) You object to data processing and there is no overriding legal reason for data processing;

d) the processing of your Personal Data is illegal;

e) your Personal Data must be deleted based on the applicable law.

Please note that we are entitled to refuse to delete your Personal Data if it is necessary, among other things, to ensure freedom of expression and information, to fulfill a legal obligation, or to submit, assert or defend legal claims.

• The right to restrict data processing

You have the right to request the restriction of data processing if one of the following conditions is met:

a) You dispute the accuracy of the personal data, in which case the limitation applies to the period that allows checking the accuracy of the personal data;

b) the data management is illegal and you oppose the deletion of the data and instead request the restriction of their use;

c) we no longer need the Personal Data for the purpose of data management, but you require them to present, enforce or defend legal claims.

If data management is subject to restrictions, such personal data may only be processed with your consent, with the exception of storage, or to assert, enforce or defend legal claims, or to protect the rights of another natural or legal person, or in the important public interest of the European Union or a member state .

• right to protest

If we process your Personal Data for direct business purposes, you have the right to object to the processing of your data for this purpose.

In addition, you have a general right to object to data processing, if the legal basis of the data processing activity is our legitimate interest or the legitimate interest of a third party.

• right to data portability

You have the right to receive the personal data you have provided to us in a segmented, widely used, machine-readable format, and you have the right to transfer this data to another data controller without us preventing you from doing so. Furthermore, you have the right to - if this is technically possible - request that we transfer your Personal Data directly to another data controller.

• the right to withdraw consent

You have the right to withdraw your consent at any time, which does not affect the legality of data processing based on consent, prior to the withdrawal.

We will take measures related to the exercise of your above rights without delay, but in any case within one month from the receipt of the request. If necessary, taking into account the complexity of the application and the number of applications, this deadline can be extended by another two months, of which we will notify you with the reasons.

If you submit such a request electronically, we will inform you electronically if possible, unless you request this in another form.

In the event that we do not take the necessary measures regarding your request, we will inform you of the reasons within one month of receiving the request.

If we have reasonable doubts about the identity of the natural person submitting the application, we may request the provision of additional information necessary to confirm the identity of the person concerned.

A. Remedies

If you do not agree with our answer or action, or feel that your rights have been violated, you can file a complaint with the National Data Protection and Information Freedom Authority (address: H-1055 Budapest, Falk Miksa utca 9-11, web: http://naih.hu/ ). In the event of a violation of your personal rights, you can contact the Metropolitan Court or the court competent for your place of residence (more information: https://birosag.hu/birosag-kereso).

VI. Miscellaneous Provisions

Please note that this Privacy Notice is regularly reviewed and amended as necessary. In the event that we change the prospectus, we will announce and publish it in the usual way (e.g. by e-mail or on the website). Please review our Data Management Notice from time to time.