Purpose and scope of the Privacy Notice

1.1 The Association of Innovative Pharmaceutical Manufacturers - Hungary (registered seat: 1077 Budapest, Kéthly Anna tér 1.; registration number: 01-02-0005205; hereinafter referred to as "Data Controller") acknowledges that it is bound by the provisions of this Privacy Notice (hereinafter referred to as "Notice"). The Data Controller undertakes to process personal data obtained in the course of the operation of the Data Controller and its Website (https://www.aipm.hu) (hereinafter referred to as the "Website") in accordance with the provisions of this  Notice and the applicable laws.

1.2. The aipm.hu Website and the subpages accessible from it are online interfaces for public information related to the activities of the Data Controller. The texts quoted on the Website are predominantly texts of the author's own origin. In the case of texts quoted from other sources, the bibliography of the sources is indicated in all cases.

1.3. The purpose of this Notice is to set out the principles for the processing of Personal Data provided by the Data Subject (see 2.6.) when contacting the Data Controller through the Website or otherwise..

2. Definition of terms

Terms used in this Notice shall have the following meanings:

2.1. Data processing shall mean the performance of technical tasks related to processing operations, irrespective of the method and means used to perform the operations and the place of application, provided that the technical task is performed on the data;

2.2. Data processor shall mean a natural or legal person or an organization without legal personality which processes personal data on the basis of a contract, including a contract based on legal provisions;

2.3. Data processing shall mean any operation or set of operations which is performed upon personal data, regardless of the procedure used, such as, but not limited to, collection, recording, recording, organisation, storage, alteration, use, retrieval, disclosure, alignment or combination, blocking, erasure and destruction, as well as the prevention of further use of personal data, the taking of photographs, audio or video recordings, the recording of physical characteristics which can be used to identify a person (e.g. fingerprints, palm prints, DNA samples, iris scans, etc.);

2.4. The Data Controller shall mean the natural or legal person, or organization without legal personality, who or which independently or jointly determines the purpose of processing personal data, makes decisions regarding the processing (including the tools used) and executes them, or has them executed by a data processor;

2.5. Transfer shall mean making personal data available to a specified third party;

2.6. Data subject shall mean any natural person who is identified or can be identified, directly or indirectly, on the basis of any specified personal data;

2.7. GDPR shall mean  the Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Regulation (EC) No 95/46/EC (General Data Protection Regulation);

2.8. Third party shall mean a natural or legal person or an organisation without legal personality, other than the data subject, the controller or the processor.;

2.9. Authority shall mean the Hungarian National Authority for Data Protection and Freedom of Information (“NAIH”), established in accordance with the provisions of the Fundamental Law to ensure the right to information self-determination, freedom of information and protection of personal data, and the rightful access to data of public interest and public data, and to monitor and promote the exercise of these rights;

2.10. Consent shall mean a voluntary and explicit expression of the Data Subject's wishes, based on appropriate information, by which he or she gives his or her unambiguous consent to the processing of personal data concerning him or her, whether in full or in relation to specific operations;

2.11. Info Act means Act CXII of 2011 on the Right to Information Self-Determination and Freedom of Information;

2.12. Personal Data means personal data that can be associated with the Data Subject – in particular, but not exclusively, the Data Subject's name, identification mark, and one or more factors specific to their physical, physiological, mental, economic, cultural, or social identity – as well as the inference that can be drawn from the personal data concerning the Data Subject.

3. Principles of Data Processing

3.1. The Data Controller processes personal data solely for specified, explicit, and lawful purposes, in order to exercise a right or fulfill an obligation; the data is collected and processed in compliance with the principles of fairness and lawfulness.

3.2. The Data Controller ensures that the data processing complies with the purpose of the processing at every stage, and that the personal data is adequate, relevant, and not excessive in relation to the purpose of further processing.

3.3. The Data Controller only processes personal data that is essential for the purpose of processing and is suitable for achieving that purpose. The Data Controller processes personal data only to the extent and for the duration necessary to achieve the purpose. Personal data is stored in a form that allows the identification of the data subject only for as long as necessary to achieve the purposes of data collection or further processing.

4.Purpose and Legal Basis of Data Processing

4.1. The purpose of the processing carried out by the Data Controller is (i) to provide online content, (ii) to identify the Data Subject, to maintain contact with the Data Subject, (iii) to identify the Data Subject's rights, (iv) to produce statistics and analyses, (v) to protect the rights of the Data Subjects, (vi) to enforce the legitimate interests of the Data Controller. The Controller shall not use Personal Data for purposes other than those set out in this Clause 4.1.

4.2. The processing of Personal Data is based on the Data Subject's voluntary, explicit and informed Consent. The Data Subject has the right to withdraw his or her Consent at any time. The withdrawal of Consent does not affect the lawfulness of the Processing based on Consent prior to the withdrawal. On the basis of the Consent, the Data Subject expressly consents to the use of the Personal Data provided by the Data Subject or Personal Data generated about the Data Subject in the course of navigating on  the Website.

4.3. The Data Controller is entitled to record the IP address of the Data Subject when clicking on the Website in order to enforce the legitimate interests of the Data Controller, without the consent of the Data Subject.

4.4. The Data Controller's Website may use anonymous identifiers, i.e., so-called "cookies," for personalized service. Cookies are a series of unique identifiers or profile information that service providers place on the Data Subject's computer. When the Data Subject visits the same Website again, the Website can retrieve the data stored in the cookies and gather information about their further activities (e.g., storing the Data Subject’s settings, etc.). This series of identifiers is only capable of recognizing the Data Subject's computer, but it cannot individually identify the Data Subject. The Data Subject can delete the cookie from their computer and can configure their browser to block the use of cookies. By disabling cookies, the Data Subject acknowledges that the Website may not function fully without cookies. Through the use of cookies, the Data Controller processes the following personal data: demographic data (as per section 5.2) and interests, preferences (based on browsing history).

4.5. Information about cookies

What exactly is a cookie?

A cookie is a small file that is placed on your computer when You visit the Website. Cookies have various functions. Among other things, they collect information, remember the visitor's individual settings, are used, for example, when using online shopping carts, and generally make it easier for users to navigate the Website.
What cookies does the Website use and for what purposes?
The Website uses cookies for the following purposes:

•    To collect information about how You use the Website – by assessing which parts of our site you visit or use most often, allowing us to understand how to provide you with an even better user experience when you visit our site again.
•    To improve our Website.
•    To facilitate Your navigation on our Website and the use of its features, ensuring a seamless user experience, such as managing your session after logging in.

Strictly Necessary, Session Cookies

These cookies are necessary for users to browse our Website and use its features, such as remembering actions you performed on pages during a visit. The validity of these cookies applies only to Your current visit, and they are automatically deleted from Your computer once the session ends or the browser is closed. Please note that without the use of these cookies, we cannot guarantee the functionality of our Website for You.

Preference Cookies

These cookies allow us to remember Your choices related to our Website.

Performance Cookies

We use Google Analytics cookies to gather information about how our visitors use our Website. These cookies cannot personally identify You (they only partially record the IP address being used) and collect information such as which pages were viewed, which parts of the Website the user clicked on, how many pages were visited, the duration of individual sessions, and any error messages. All this information is collected with the aim of improving our Website and enhancing the user experience.

How to check and disable cookies?

All modern browsers allow you to change cookie settings. Most browsers automatically accept cookies by default, but this can usually be adjusted to prevent automatic acceptance and offer You the choice each time whether or not to allow cookies. Please note that since cookies are used to facilitate or enable the usability and processes of our Website, preventing or deleting cookies may result in users being unable to fully utilize the features of our Website, or the website may not function as intended in your browser.

4.6. The Data Subject warrants that, if they provide personal data of a third party, they have obtained the lawful consent of the relevant party. When any Data Subject provides their email address and other personal data (such as name, password, etc.), they also take responsibility for ensuring that the services are only accessed by them using the provided email address and personal data.

5.Scope of Processed Personal Data

5.1. If the Data Subject visits the Website, the Data Controller’s system automatically records the Data Subject's IP address.

6. Duration of Data Processing

6.1. The Data Controller processes the Data Subject’s data until the fulfillment of the data processing purposes described above, or until the Data Subject withdraws their consent, or until the Data Subject requests deletion of their data.

6.2. The data automatically recorded during the operation of the system will be stored in the system for as long as it is necessary to ensure the operation of the system, starting from the time of their generation. The Data Controller ensures that, except for cases mandated by law, these automatically recorded data cannot be linked to other personal data.

6.3. The Data Subject may object to the data processing at any time, request the termination of the data processing, cessation of certain methods of data processing, or request the deletion of data for specific purposes. In these cases, the duration of data processing lasts until the request is received and processed — the Data Controller will carry out this request promptly, but no later than within 10 working days.

6.4. According to point 7, a requested deletion may be denied (i) for the exercise of the freedom of expression and the right to information, or (ii) if the processing of personal data is authorized by law; and (iii) for the submission, enforcement, or defense of legal claims.

7.The Rights of the Data Subject

7.1 The Data Subject may request information regarding the data processing by sending an email to Show e-mail address or by sending a registered or certified letter to the address specified in point 11. The Data Subject may request that the Data Controller informs them whether their personal data is being processed, and if so, to provide access to the personal data processed by the Data Controller. The request for information may, among other things, include details about the scope of the processed personal data, its source, the purpose of the processing, the legal basis, the duration, and the identification of data processors.

7.2 The Data Subject may request the correction or modification of their personal data processed by the Data Controller. Considering the purpose of the data processing, the User may request the completion of incomplete personal data.

7.3 The Data Subject may request the restriction of the processing of their personal data by the Data Controller if the Data Subject disputes the accuracy of the processed personal data. This restriction applies for the duration that allows the Data Controller to verify the accuracy of the personal data. The Data Controller will mark the personal data it processes if the Data Subject disputes its correctness or accuracy, but the inaccuracy or incorrectness of the disputed personal data cannot be clearly determined. The Data Subject may also request the restriction of the processing of their personal data if the processing is unlawful, but the Data Subject opposes the deletion of the personal data and instead requests the restriction of its use. Additionally, the Data Subject may request the restriction of the processing of their personal data if the purpose of the processing has been fulfilled, but the Data Subject requires its processing by the Data Controller for the submission, enforcement, or defense of legal claims.

7.4 The Data Subject may request that the Data Controller provides the personal data provided by the Data Subject and processed by the Data Subject in an automated manner, in a structured, commonly used, machine-readable format, and/or that it is transferred to another data controller.

7.5 The Data Subject may object to the processing of their personal data (i) if the processing of the personal data is necessary solely for the fulfillment of a legal obligation of the Data Controller or for the enforcement of the legitimate interests of the Data Controller or a third party; (ii) if the purpose of the processing is direct marketing, public opinion polling, or scientific research; or (iii) if the processing is carried out for the performance of a task carried out in the public interest. The Data Controller will examine the legality of the Data Subject’s objection, and if the objection is found to be well-founded, the Data Controller will cease the processing and block the personal data. The Data Controller will also notify those to whom the personal data concerned by the objection has been previously transferred, informing them of the objection and the actions taken based on it.

8.Data Processor Engagement

8.1 If the Data Processing is carried out on behalf of the Data Controller by another entity, the Data Controller may only engage data processors who provide adequate guarantees regarding compliance with the requirements of the GDPR for data processing and the implementation of appropriate technical and organizational measures to protect the rights of the Data Subjects. The Data Processor may not engage any further data processors without the prior written authorization of the Data Controller, either on a case-by-case or general basis.

9.Data Transfer Possibilities

9.1 The Data Controller is entitled and obliged to transfer any Personal Data in its possession and lawfully stored to the competent authorities if required by law or by a legally binding authority decision. The Data Controller shall not be held liable for such data transfer or any consequences arising from it.

9.2 The Data Controller maintains a record of data transfers to ensure the legality of the transfer and to guarantee that the Data Subject is informed.

10. Data Subject's Remedies

10.1 It is recommended that the Data Subject contact the Data Controller with their complaint before seeking administrative or judicial remedies.
The contact details of the Data Controller's representative:

• Name: Dóra Papp 
• Phone number: +36 70 672 6363
• E-mail address: Show e-mail address

10.2 The Data Subject is entitled to file a complaint with the Authority in the event of a violation of their rights regarding Personal Data at the following contact details:

Hungarian National Authority for Data Protection and Freedom of Information

• Mailing address: 1363 Budapest, Pf.: 9.  
• Address: 1055 Budapest, Falk Miksa utca 9-11.  
• Phone number: +36 (1) 391-1400
• Fax: +36 (1) 391-1410
• E-mail address: Show e-mail address

10.3 The Data Subjects has the right to approach the court in case of violation of their rights, or if they disagree with the decision of the  Data Controller regarding their objection to the processing of their Personal Data. The court jurisdiction lies with the regional court, and the proceedings may also be initiated before the court of the Data Subject's place of residence or habitual residence.

11. Amendment of the Privacy Notice

11.1 The Data Controller is entitled to unilaterally modify this Notice. However, the Data Controller will inform the Data Subjects about any changes to this Notice that are necessary for the exercise of their rights or for the fulfillment of their obligations.

Association of Innovative Pharmaceutical Manufacturers - Hungary
Contact details:
Address: 1077 Budapest, Kéthly Anna tér 1.
Email address: Show e-mail address