Privacy Notice

Bozó Kft. carries out forestry service activities (including the manufacture of agricultural and forestry machinery, and forestry and other forest management activities), in the course of which it processes data in order to provide its services.
In operating the mainforest.hu website (hereinafter: Website), Bozó Kft. (hereinafter: Service Provider) processes the personal data of persons requesting quotations and enquirers via the website (hereinafter collectively: Data Subjects).

1. Contact details of the data controller

Name: Bozó Kft.
Registered office and mailing address: Carolina utca 9., 7960 Sellye, Hungary
Representative's name and phone number: Mátyás Gázsity, +36 30 712 0779
Email: bozokft@gmail.com

2. Scope of personal data processed

We request different personal data from users to access different services, in line with the principle of data
minimisation. This Privacy Notice applies exf data of natural persons visiting theWebsite, since personal data can only be interpreted in relation to natural persons.
Anonymous information collected by the data controller in a way that excludes personal identification and cannot be
linked to a natural person does not constituemographic data collected without beinglinked to the personal data of identifiable persons, and therefore not allowing a connection to a natural person, does not constitute personal data.
The data processed are listed below:

2.1 Persons requesting quotations

- Name
- Email address
- Phone number

2.2 Enquirers

- Name
- Email address
- Phone number

2.3 Children's data

Our products and services are not intended for persons under the age of 16, and we ask that persons under 16 do not provide personal data to the Data Controller. If we become aware that we have collected personal data from a child
under 16, we will take the necessary steps t possible.

3. Cookie (anonymous user identifier) notice

The Data Controller places an anonymous user identifier (cookie) on the Data Subject's computer, which in itself cannot identify the Data Subject in any way. Cookies are only capable of recognising the Data Subject's device; they do not store IP addresses and do not transmit IP addresses, as personal data, to the Service Provider. The cookies used are simple, short, small text files. No personal data or information needs to be provided, as the User does not
transfer any personal data to the Service Prused; data exchange takes place solelybetween devices.

Own cookies required for the website to function

Placing certain cookies on the Data Subject'he website to function. They make the website load faster, allow the browser to store certain website information, and help ensure that the website's modules work as intended.

S_TOKEN (4 hours)
Function: Keeps the visitor logged in while browsing after logging in.

S_LANG (Session)
Function: Stores the visitor's preferred language code so that error pages (e.g. 404) load in the preferred language
rather than reverting to the website's defau

COOKIE-CONSENT (1 year)
Function: Prevents the cookie bar from reapppted. If the Data Subject selects "OK", their choice is saved and no further consent will be requested for 1 year.

KRID (Session)
Function: Relevant for registration and shopping cart functions. Ensures that products remain in the cart if the user leaves the cart and continues browsing, and that the user is not logged out while browsing a registered area.

Analytics cookies

To obtain website traffic and other web analder uses the services of independentanalytics servers, namely Hotjar and Google Analytics. These providers can give the Data Subject detailed information
on how measurement data is processed.
In the case of Google Analytics, the Service Provider has configured the website code so that Google Analytics anonymises the Data Subject's IP address, making it no longer identifiable, before it is transferred to the Service Provider. You can read more about this technology here:
https://support.google.com/analytics/answer/6004245?hl=en
The purpose is to use the anonymised informaftware to analyse website traffic andfunctional use in order to improve the user experience (e.g. providing optimised navigation, the order in which
information is presented on a subpage).
These measurements do not store any data about users that could identify them, neither IP addresses nor personal data.
Google LLC's privacy policy is available at https://policies.google.com/privacy?hl=en
Hotjar's privacy policy is available at httpcies/privacy
The respective providers can provide further information about the cookies used:
More information about Hotjar cookies:
https://help.hotjar.com/hc/en-us/articles/11rmation
Information on the identification and characteristics of Google Analytics and Google Tag Manager cookies:
https://support.google.com/analytics/answer/
https://developers.google.com/analytics/devguides/collection/ga4/tag-options

Advertising cookies

The Service Provider may use modern online marketing solutions, specifically Google Ads and Facebook advertising.
These advertising solutions use cookies to oe system show Data Subjects advertisementsthat match their current interests rather than irrelevant ones. On the Portal, the Service Provider uses remarketing
codes provided by Google Ads and Facebook. Rkies.
The installed cookie does not transmit personal data to the Service Provider; it only helps ensure that advertisements relating to the Service Provider's products and services are displayed to the Portal's visitors on other websites in
the Google Display Network that they later vnformation:
https://policies.google.com/technologies/ads
https://www.facebook.com/privacy/policies/cookies/
Google AdSense cookies: https://support.goog?hl=en
https://policies.google.com/technologies/cookies#types-of-cookies

Manual override of automatic advertising preferences, intervention and settings options

The User may disable cookies and personalise advertisements at any time in the Google or Facebook advertising settings.
The Data Subject can manage the privacy settings of their Google account here: https://myaccount.google.com/privacy
Facebook account privacy settings are availar the privacy and advertising settings tabs:
https://www.facebook.com/ads/preferences

Stopping or blocking the use of cookies

Changing browser settings:
The "Help" function in the menu bar of most browsers provides information on how to:
• disable cookies,
• accept new cookies,
• instruct the browser to set a new cookie, or
• disable other cookies.

Blocking browser extensions:
If the Data Subject does not want Google Analytics to measure the above data in the manner and for the purposes described, they can install a browser extension that blocks it.

Using an external cookie management solution
The Data Subject may use external websites to manage which providers are permitted to carry out advertising cookie activity on their computer. One such solution is AdChoices.

4. Social media plugins

Plugins on the Portal are disabled by defaulkies. Plugins are only enabled when the DataSubject clicks the relevant button (e.g. likes an article, pins an image, or starts following the Service Provider's Facebook page using the "Like" button on the website). By enabling a plugin, i.e. clicking the "Like" button, the Data Subject establishes a connection with the social network and thereby clearly indicates their consent to the transfer of their data to Facebook/Twitter/LinkedIn/Pinterest/Instagram.
If the Data Subject is logged in to Facebook/Twitter/LinkedIn/Pinterest/Instagram, the social network may associate their visit with their social media account.

If the Data Subject clicks one of the above rowser transmits the relevant informationdirectly to that social network, where it is stored.

Information on the scope and purpose of data collection, the further processing and use of data by Facebook/Twitter/LinkedIn/Pinterest/Instagram, and the Data Subject's rights and settings for protecting their personal data can be found in the privacy policy of the relevant social network.
The user of the website's services acknowledges that, by using the website, they have consented to the processing of
their data by Google.

5. Technical data – log files

In order to provide the services, the system automatically logs the following data:
- the dynamic IP address of the user's computer
- depending on the user's computer settings,ating system used
- the user's activity in relation to the website
This data is used for technical purposes, such as analysing and subsequently checking the secure operation of the
servers. This is an automatic IT security prin server logs without any declaration fromthe data subject.
The above data is not suitable for identifying the user and the Data Controller does not link it with other personal
data. Log data is stored for 6 months from t

6. Legal basis and purpose of processing

6.1 Persons requesting quotations and enquirers

Processing is necessary for taking steps prior to entering into a contract. The purpose of processing is to provide Data Subjects with personalised service and, at their request, to send a quotation that may serve as the basis for a
subsequent contract or order.

6.2 Statistical cookies (Google Analytics)

The legal basis for processing is the Data Subject's consent (Article 6(1)(a) GDPR). The purpose is to analyse traffic to and use of the Website and to improve the user experience.

7. Duration of processing

7.1 Persons requesting quotations and enquirers

If a contract is concluded, data is processet and, in accordance with the Accounting Act, for 8 years following the year of performance. If no contract is concluded, i.e. the purpose has not been achieved,
the Service Provider processes the data unting the expiry of the quotation.

7.2 Statistical data

Data collected by Google Analytics is retained for 14 months; cookies last for a maximum of 2 years or until consent
is withdrawn.

8. Recipients of data, data transfers and data processing

The personal data collected from Data Subjects may be accessed by the Service Provider's internal staff and is not published. Data is transferred to third parties for processing purposes only at the request of the Data Subject, to
the recipient specified by the Data Subject.
The Service Provider may engage data processors to carry out tasks arising in the course of its activities (accounting, issuing electronic invoices, sending newsletters).
Categories of data processors and recipients

Name: S-KONTO Kft.
Registered office: Korongi tér 10., 7960 Sellye, Hungary
Category: accounting

Name: Számviteli Rendszer Kft.
Registered office: Tolnai u. 34., 8000 Székesfehérvár, Hungary
Category: electronic invoicing software

Name: DBI Szoftver Kft.
Registered office: Vágóhíd utca 2., 4034 Deb
Category: web hosting provider

Name: Google Ireland Limited
Registered office: Gordon House, Barrow Street, Dublin 4, Ireland
Category: web analytics (Google Analytics), only with the Data Subject's consent

9. Rights of Data Subjects and legal remedies

9.1 The Data Subject may request from the Data Controller:

a) information on the processing of their personal data,
b) rectification of their personal data,
c) erasure or restriction of processing of their personal data, except where processing is mandatory,
d) transfer of their personal data to another data controller.

9.2 At the Data Subject's request, the Data Controller shall, within 30 days of receipt of the request at the latest, provide written information on the Data Subject's data processed by it or by a data processor engaged by it or on its instructions, the source of the data, the purpose, legal basis and duration of processing, the name and address of data processor and its activities related tohe Data Subject's personal data has beentransferred, the legal basis and recipient of the transfer.

Information is provided free of charge if the person requesting it has not yet submitted a request for information on the same subject to the Data Controller in the current year. In other cases, the Data Controller may charge a fee, provided that any fee already paid shall be refunded if the data was processed unlawfully or the request for information led to rectification.
In order to verify the lawfulness of data transfers and to inform the data subject, the Data Controller keeps a data transfer register containing the date of transfer of the personal data it processes, the legal basis and recipient of the transfer, the scope of the personal data transferred, and other data specified in the legislation requiring theprocessing.
In order to monitor measures relating to personal data breaches and to inform the Data Subject, the Service Providekeeps a register of personal data breaches crsonal data concerned, the scope and numberof Data Subjects affected, the date, circumstances and effects of the breach, the measures taken to remedy it, and other data specified in the legislation requiring the processing.

9.3 The Data Subject is entitled at any time to request the rectification of incorrectly recorded data or its erasure. Such requests must be submitted in writing by post or email. The Service Provider will delete the data within 3    working days of receipt of the request, afte. Erasure does not apply to processingrequired by law (e.g. accounting regulations); the Service Provider retains such data for the required period.
                                                                                                                   9.4 The Data Subject may also request the reeir data or the transfer of their data toanother data controller. The Service Provider restricts the processing of personal data if the data subject so requests, or if, based on the information available to it, it can be assumed that erasure would harm the Data      Subject's legitimate interests. Personal datonly be processed for as long as the purposeof processing that precluded the erasure of the personal data persists.

The Data Subject, and all those to whom the data was previously transferred for processing, must be notified of rectification, restriction and erasure. Notification may be omitted if, in view of the purpose of processing, this does not harm the Data Subject's legitimate interests.
If the Service Provider does not fulfil the Data Subject's request for rectification, restriction or erasure, it shall, within 30 days of receipt of the request, state in writing the factual and legal reasons for rejecting the request.                                                                                                           
The Data Subject may also send the following to the Data Controller at one of the contact addresses specified in section 9.5:                                                                                                       • a request for their data to be transferredwhere processing is based on a contract orconsent and is carried out by the Service Provider by automated means;
• a withdrawal of consent previously given to processing.

The Data Subject may object to the processing of their personal data. The Service Provider shall examine the objection as soon as possible, but no later than 15 days after the request is submitted, decide whether it is justified, and inform the applicant of its decision in writcation, erasure or restriction is rejected,the Data Controller shall inform the Data Subject of the possibility of seeking judicial remedy and of lodging a complaint with the Authority.

Information on data security measures:
The Data Controller ensures data protection by design and by default. To this end, the Data Controller applies
appropriate technical and organisational mea
• precisely regulate access to data;
• grant access only to persons who need the data to perform their tasks, and even then only to the minimum data necessary to perform those tasks;
• carefully select the data processors it engages and ensure data security through appropriate data processing agreements;
• ensure the integrity, authenticity and protection of the data processed.
The Data Controller applies reasonable physical, technical and organisational security measures to protect Data Subjects' data, in particular against accidental, unauthorised or unlawful destruction, loss, alteration, disclosure,
use, access or processing. In the event of kr use of personal data that poses a high risk to the data subject, the Data Controller shall notify the Data Subject without delay.
Where the transfer of a Data Subject's data ller ensures appropriate protection of thetransferred data, for example by encrypting the data set. The Data Controller bears full responsibility for the processing of Data Subjects' data carried out by third parties.
The Data Controller also ensures, through appropriate and regular backups, that Data Subjects' data is protected against destruction or loss.

9.5 The data subject may exercise their rights using the following contact details:
Mailing address: Carolina utca 9., 7960 Sellye, Hungary
Email: bozokft@gmail.com
The Data Subject may contact the Service Provider's staff with any questions or comments regarding data processing using the contact details in section 9.5.

9.6 Under the GDPR, the Hungarian Act on Informational Self-Determination and Freedom of Information (Info Act), and
the Hungarian Civil Code (Act V of 2013), th

• lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) (Szilágyi Erzsébet fasor 22/c., 1125 Budapest, Hungary; www.naih.hu), or

• enforce their rights before a court.

9.7 If, in order to use a service, during registration or when subscribing to a newsletter, the Data Subject has provided the data of a third party, or has caused damage in any way while using the Website, the Service Provider is entitled to claim damages from the Data Subjce Provider will provide all possibleassistance to the competent authorities in establishing the identity of the infringing person.