Edenred Magyarország Korlátolt Felelősségű Társaság [Edenred Hungary Limited] (head office/official mailing address: H–1134 Budapest, Váci út 45. , company registration number: 01-09-266926; electronic contact details: ugyfelszolgalat-hu@edenred.com and dpo.hungary@edenred.com; web address: https://adatvedelem.edenred.hu/adatkezelesi-tajekoztato/; phone: +36 1 413 3333, represented by: Krisztián Balázs, hereinafter: Programme Owner) in accordance with the related legislative provisions specifying the protection of personal data¹ , informs the users of its services on the processing of data it applies.

The Programme Owner provides employers (hereinafter: Client) services in the context of which the Issuer and Programme Owner shall give the employees of the Client (hereinafter: Card Holder) non-transferable microchip plastic card protected with a PIN code that can be used for paying the full or partial consideration for goods sold or services sold by the Participating Vendor.

The Issuer and the Programme Owner pays prompt attention on the protection of personal data, and for this reason it permanently takes due care to guarantee fair and transparent processing the essential requirement of which is to provide appropriate information on the processing of data. This Data Processing Policy provides among others information on the processing of your personal data during the provision of service by PrePay Solutions Ltd. (member of the Edenred group; head office: 6th Floor, 3 Sheldon Square, Paddington, London, W2 6HY UK; hereinafter: and the Programme Owner and data processing for advertising purposes: the source and scope of acquiring the processed data, the legal basis, purpose and term of the data processing, the rights concerning and the options of choice between personal data, and it also includes all the contact details in which the Data Subject can get answers to his questions on the Issuer and the Programme Owner’s practice of data protection.

Summary of the processing of data processing activities related to the Programme Manager’s service provided to the Client
Data Controller The Programme Manager
The purposes of the processing Performance of the Services included in the Client GTC: administration related to production, crediting and use of the Card
Legal basis of data processing Conclusion and performance of a contract in the interest of the Data Subject [Article 6 (1) (b) of GDPR].
Scope of the processed data Data Subject’s surname; Data Subject’s forename; name on card (21 characters at most); date of birth; permanent residence (postal code, town, street, number); mailing address if other than residence (postal code, town, street, number); Data Subject’s email address; Data Subject’s mobile phone number; amount to be credited; serial no. of card; habitual residence in Hungary if Data Subject is a foreigner; workplace of the Data Subject; name, position, phone number and email address of the Client’s representative and contact person
Term of data processing Total duration of the service and 6 years following its termination (until the limitation period of the possible claims concerning the Service)
Processors PPS EU SA, a company registered in Belgium under the number 0712.775.202 (1160 Brussels, boulevard du Souverain 165 boîte 9, Belgium).
purpose of data processing: management of card balances, authorisation of card transactions, online balance inquiries, issue and activation of Cards, crediting of e-money allocated for this purpose to the cards, providing access to data (e.g. transaction history, available balance), processing of transactions
Programming Pool Romania (registered office: Strada Transilvaniei 18A, Baia Mare, Romania)
purpose of data processing: supply of software supporting Services related to the Card, IT support
Idemia Hungary Kft. (registered office: Tó-Park, hrsz.: 3301/21., 2045 Törökbálint, Tópark utca)
purpose of data processing: manufacturing of cards
Y-Collective Kft. (registered office: H–7628 Pécs, Arany János u. 24.)
purpose of data processing: extranet operation, processing of card orders, operation of website and Edenred Mobile Application; IT support activity
The Rocket Science Group LLC d/b/a MailChimp (registered office: 675 Ponce De Leon Ave NE, Suite 5000 Atlanta, Georgia 30308, USA)
purpose of data processing: sending of information e-mails concerning the Services (system messages, amendment of the GTC, update of the mobile application)

 

Summaries merely serve the purposes of convenience. Please read the complete information.


¹Directive 2016/679/EU of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and on repealing Directive 95/46/EC (General Data Protection Regulation, GDPR); The text of the GDPR may be downloaded in any official language of the European Union via this link.

 

Summary of the processing of data concerning the Edenred Card Service provided by the Issuer to the Card Holder
Data Controller Issuer
The purposes of the processing Performance of Services specified in the Card Holder GTC
Legal grounds of data processing The performance of the GTC concluded between the Issuer and the Card Holder[Article 6 (1) (b) of the GDPR]
Scope of the processed data Data Subject’s surname; Data Subject’s forename; name on card (21 characters at most); date of birth; permanent residence (postal code, town, street, number); mailing address if other than residence (postal code, town, street, number); Data Subject’s email address; Data Subject’s mobile phone number; amount to be credited; serial no. of card; habitual residence in Hungary if Data Subject is a foreigner; account history; workplace of the Data Subject; Data Subject’s account number
Term of data processing Total duration of the service and 6 years following its termination (until the limitation period of the possible claims concerning the Edenred Card Service)
Processors Edenred Magyarország Kft.: (registered office: H–1134 Budapest, Váci út 45.), purpose of data processing: Operation of systems relating to the provision of services and supporting activity.

Programming Pool Romania (registered office: Strada Transilvaniei 18A, Baia Mare, Romania), purpose of data processing: supply of software supporting services related to the Card, IT support

Idemia Hungary Kft. (registered office: Tó-Park, lot nr.: 3301/21., H-2045 Törökbálint, Tópark utca, Hungary), purpose of data processing: manufacturing of cards;

Y-Collective Kft. (registered office: H–7628 Pécs, Arany János u. 24., Hungary), purpose of data processing: extranet operation, processing of card orders, operation of website and Edenred Mobile Application; IT support activity

The Rocket Science Group LLC d/b/a MailChimp (registered office: 675 Ponce De Leon Ave NE, Suite 5000 Atlanta, Georgia 30308, USA) purpose of data processing: data processing for the purposes of advertising – sending out newsletters: Sending of information e-mails concerning the Card services (system messages, amendment of the GTC, update of the Edenred Mobile application)

Summaries merely serve the purposes of convenience. Please read the complete information.

Summary of the processing of data by the Issuer concerning the Cardholders’ customer due diligence
Data Controller Issuer
The purposes of the processing Compliance with the obligation to perform customer due diligence and identification regarding the Cardholders
Legal basis of data processing Compliance with legal obligation [GDPR Article 6 (1) c)] and Sections 7–11 of the AML
Scope of the processed data Data Subject’s surname; Data Subject’s forename; Data Subject’s surname at birth; Data Subject’s forename at birth; Data Subject’s citizenship; Data Subject’s place and date of birth; maiden name of the Data Subject’s mother; Data Subject’s home address (postal code, town, street, number) or in the absence thereof, address of residence (postal code, town, street, number); type of Data Subject’s identification document; number of Data Subject’s identification document; Data Subject’s image; copy of the Data Subject’s documents
Term of data processing 8 years from the termination of the Service
Processors Edenred Magyarország Kft.: (registered office: H–1134 Budapest, Váci út 45.), purpose of data processing: contribution in the customer due diligence and identification activities.

Y-Collective Kft. (registered office: H–7628 Pécs, Arany János u. 24., Hungary), purpose of data processing: extranet operation, processing of card orders, operation of website and Edenred Mobile Application; IT support activity

 

Summary of the processing of data concerning the Programme Owner’s marketing / advertising activity
Data Controller The Programme Manager
The purposes of the processing Sending marketing / advertising messages to the Card Holder
Legal grounds of data processing The Data Subject’s consent [Article 6 (1) (b) of the GDPR and Section 6(1) of Act XLVIII of 2008 on the Basic Requirements of and Certain Restrictions on Commercial Advertising Activities]. The consent may be withdrawn at any time
Scope of the processed data The Data Subject’s surname; forename; e-mail address; mobile phone number;
Term of data processing Until the consent is withdrawn
Processors Y-Shift Kft. (head office: H–7636 Pécs Arany János utca 24., Magyarország) purpose of data processing: data processing for the purposes of advertising.

The Rocket Science Group LLC d/b/a MailChimp (registered office: 675 Ponce De Leon Ave NE, Suite 5000 Atlanta, Georgia 30308, USA) purpose of data processing: data processing for the purposes of advertising – sending out newsletters

Summaries merely serve the purposes of convenience. Please read the complete information.

Definitions used in this Data Processing Policy match the definitions included in the General Terms and Conditions regarding the ordering, delivery and utilization of Edenred Voucher Cards and the Card Holder GTC. For enhancing the interpretation of the Data Processing Policy, we repeat certain definitions in the following:
2.1.1. “Edenred Card“ or “Card” is a non-transferable microchip plastic card protected with a PIN code where the Electronic Money covered by the amount of money having been transferred by the Client in advance, in relation to the given card is recorded, and that can be used for paying the full or partial consideration for goods sold or services rendered by the Participating Vendor. The rules pertaining to the Card shall be implicitly applicable to the Additional Card.
2.1.2. “Edenred Card Service” means the complex service provided by the Issuer to the Card Holder under the Card Holder GTC concerning the placing on the market and use of Edenred Cards and the Card Holder GTC.
2.1.3. “Electronic money” means the amount embodied by the claim against the issuer of the electronic money that is stored electronically – including magnetic storing –, issued against the receipt of funds for the purpose of performing payment transactions provided in the Act on the Pursuit of the Business of Payment Services and, beyond the issuer of the electronic money, also accepted by other natural and legal persons, economic entities without legal personality and individual entrepreneurs. The electronic money qualifies as a non-cash means of payment.
2.1.4. “Authority” means the Hungarian National Authority for Data Protection and Freedom of Information or the Belgian Data Protection Authority (Autorité de la protection des données – Gegevensbeschermingsautoriteit, APD-GBA).
2.1.5. “Card Holder” is a natural person deemed by the Client eligible for using the Card to whom the Card is issued, and who undertakes to comply with the Card Holder GTC.
2.1.6. “Participating Vendor” or “Participating Business” is a natural or legal person accepting the Card from the Card Holders (or Additional Card Holders) in the case of the sale of products or the provision of services, and where the Programme Manager made accepting the Cards technically available, and who placed out the Mastercard or Edenred Acceptance Mark.
2.1.7. “Issuer” is PPS EU SA, a company registered in Belgium under the number 0712.775.202 (1160 Brussels, boulevard du Souverain 165 boîte 9, Belgium). PPS EU is operating under the supervision of the National Bank of Belgium, and has been authorised by the same to issue electronic money and provide payment services.
2.1.8. “Programme Manager”: Edenred Magyarország Kft. (registered office: H–1134 Budapest, Váci út 45.), the Issuer’s payment intermediary.
2.1.9. “Service” means the complex service provided by the Programme Manager to the Client in relation to the ordering, crediting, delivery and utilisation of the Card in accordance with these GTC.
2.1.10. “Client” is a natural or legal person providing the Edenred Card to the Card Holder.

Data Subjects include the employees (Card Holders) of the employer (Client) ordering the Services of the Issuer and the Programme Owner, and – in case of a respective order – the close relatives of the Card Holders as Additional Card Holders (hereinafter referred: Data Subject).

The Issuer and Programme Manager obtains certain personal data of the Data Subject not directly from the Data Subject, but – having regard to the characteristics of the service – from the Client, concurrently with the Client’s placement of its Order. At the same time, however, the Issuer will also request such personal data from the Data Subject during the customer due diligence and identification procedure that are essential for the completion of the customer due diligence and the provision of the services related to the Card, while they are not required for the placement of the Order.

6.1. Data processed for the purposes of complying with the Client GTC, term of the data processing

6.1.1. Programme Manager as data controller processes the following data in order to comply with the Client GTC, i.e. the provision of the Service to the Client:
• Data Subject’s surname
• Data Subject’s forename
• name on card (21 characters at maximum)
• date of birth
• permanent address (zip code, city, name and type of public area, house number)
• mailing address, if different from permanent address (zip code, city, name and type of public area, house number)
• Data Subject’s email address
• Data Subject’s mobile phone number
• amount to be credited
• card serial number
• in case of foreign Data Subject, the place of residence in Hungary
• Data Subject’s workplace
• Name, position, phone number and email address of the Client’s representative and contact person

6.1.2. Personal data is processed by the Programme Manager as data controller in connection with manufacturing the Card and the administration in connection with crediting and usage of the Card.

6.1.3. The Programme Manager will process the Data Subject’s data until the period required to achieve the purpose of the Client GTC, i.e. for the total duration of the Service and 6 years following its termination (until the limitation period of the possible claims concerning the Service).

6.2. Data processed for the purposes of complying with the Card Holder GTC, term of the data processing

6.2.1. The Issuer processes the following data as data controller in order to comply with the Card Holder GTC i.e. the provision of his Edenred Card Service by the Issuer to the Card Holder:
• Data Subject’s surname
• Data Subject’s forename
• name on card (21 characters at maximum)
• date of birth
• permanent address (zip code, city, name and type of public area, house number)
• mailing address, if different from permanent address (zip code, city, name and type of public area, house number)
• Data Subject’s email address
• Data Subject’s mobile phone number
• amount to be credited
• card serial number
• data of the transaction
• in case of foreign Data Subject, the place of residence in Hungary
• account history
• Data Subject’s workplace
• Data Subject’s bank account number

6.2.2. The Issuer will process the Data Subject’s data until the period required to achieve the purpose of the Card Holder GTC, i.e. for the total duration of the Service and 6 years following its termination (until the limitation period of the possible claims concerning the Edenred Card Service).

6.3. Data processed for the purpose of customer due diligence and customer identification, and the term of data processing
6.3.1. The Issuer processes the following data for the purpose of complying with its legal obligations (customer due diligence and customer identification):
• Data Subject’s surname
• Data Subject’s forename
• Data Subject’s surname at birth
• Data Subject’s forename at birth
• Data Subject’s citizenship
• Data Subject’s place and date of birth
• Data Subject’s mother’s birth name
• Data Subject’s postal address (failing this, address of residence)
• Type of Data Subject’s identification document
• Number of Data Subject’s identification document
• Data Subject’s image
• Copy of the Data Subject’s documents
6.3.2. The Issuer will process the Data Subject’s data for the period required for the fulfilment of its relevant legal obligations, i.e. for the total duration of the Edenred Card Service and 8 years following its termination.

6.4. Data processed for the purpose of marketing and advertising activity, term of the processing

6.4.1. During the data processing for advertisement purposes, the Programme Manager will send advertisements via phone (text message) or e-mails or push notifications (pop-up messages on mobile phones) to the Data Subject concerning the products of the Programme Manager, the Edenred Group and the Participating Vendors, and on the incidental campaigns, according to the Data Subject’s consent.

6.4.2. For this purpose it processes the following data:
• Data Subject’s surname
• Data Subject’s forename
• Data Subject’s email address
• Data Subject’s mobile phone number

6.4.3. The Programme Manager keeps record of the personal data of Data Subjects having made declaration of consent regarding the receipt of advertisements.

6.4.4. For sending advertisement, the Programme Manager keeps on processing the personal data processed per the declaration of consent provided by the Data Subject until revocation. The Data Subject can give his declaration of consent by ticking the relevant checkbox on the Programme Manager’s website or the Edenred mobile application. The Data Subject may revoke his consent at any time via the unsubscribe link at the bottom of the marketing letter sent to the provided e-mail address.

The Issuer and the Programme Owner will transmit and disclose the Data Subject’s data to the members of the Edenred Group² and its contractual partners³ (including natural persons) in the course and for the purpose of and to the extent required for providing the Service, in relation to the card use.

7.1. Data Processors belonging to the Issuer and the Programme Owner’s contractual partners employed for complying with the provision of the Service, and for performing the marketing / promotional activity, who will process the Data Subject’s data are:

  • Edenred Magyarország Kft.: (registered office: H–1134 Budapest, Váci út 45.), purpose of data processing: contribution in the customer due diligence and identification activities, operation of the systems connected with the provision of Service and assistance
  • Programming Pool Romania (registered office: Strada Transilvaniei 18A, Baia Mare, Romania)
    purpose of data processing: supply of software supporting services related to the Card, IT support
  • Idemia Hungary Kft. (registered office: Tó-Park, lot nr.: 3301/21., H-2045 Törökbálint, Tópark utca, Hungary)
    purpose of data processing: manufacturing of cards;
  • Y-Collective Kft. (registered office: H–7628 Pécs, Arany János u. 24., Hungary)
    purpose of data processing: extranet operation, processing of card orders, operation of website and Edenred Mobile Application;
  • Y-Shift Kft. (head office: H–7636 Pécs Arany János utca 24., Hungary)
    purpose of data processing:
  • The Rocket Science Group LLC d/b/a MailChimp (head office: 675 Ponce De Leon Ave NE, Suite 5000 Atlanta, Georgia 30308, USA)
    purpose of data processing: data processing for marketing purposes – sending of newsletters, Sending of information e-mails concerning the Card services (system messages, amendment of the GTC, update of the Edenred Mobile application)

The Rocket Science Group LLC d / b / a MailChimp provides adequate safeguards for the transfer of personal data by applying general data protection clauses pursuant to Article 46 (2) (c) of the GDPR.

9.1. The Issuer and the Programme Manager shall delete the Data Subject’s data upon the expiry of the data handling period.

9.2. The Issuer and the Programme Manager will ensure the security of the processed data and takes any measure against unauthorised access, modification, forwarding, disclosure, erasure or destruction, accidental destruction and deterioration, and inaccessibility due to the change of the technology applied, as well as in order to ensure an adequate protection of the Data Subjects’ personal data per the legislation.

9.3. The Issuer and the Programme Manager processes the Data Subject’s data automatically and manually in a computer database applying the measures necessary for maintaining the data security requirements, and it has arranged to have the processing of the Data Subject’s data within a closed system protected by password in any event and saved in a hard disk, and that these systems would be used by those authorised to know the data exclusively in relation to the provision of the service, in a strictly necessary extent.

9.4. Those authorised to know the personal data are the Issuer and the Programme Manager (the Issuer and the Programme Manager’s employees employed in a post that manage matters concerning the card use), the members of the Edenred Group, and the contractual partners of the Issuer and the Programme Manager.

9.5. The Issuer and the Programme Manager ensures to provide complete information about the data protection rules to those authorised to access the data. As a guarantee to data security, the senior executives and employees of the Issuer and the Programme Manager are bound by obligation of confidence and legal liability concerning the personal data learned in this regard.

11.1. Should the Programme Manager modify the GTC with an influence on the Data Processing Policy, it shall place an appropriate announcement on the website and shall send the modified policy to the e-mail address provided by the Data Subject so that the Data Subject may study it.

11.2. Where the Issuer and/or the Programme Manager intends to further process the personal data for a purpose other than that for which the personal data were obtained, it will provide the Data Subject prior to that further processing with information on that other purpose and with any relevant further information.

11.3. The Issuer and/or the Programme Manager shall inform the data subject at the latest on the first occasion of disclosing the data also to other recipient(s).

Effective from: 1 November 2021