PRIVACY NOTICE
FOR JOB APPLICANTS

After accepting the privacy notice, it is possible to proceed to the career portal.

1. Introduction

Rampart Gasztronómia Kft. reserves the right to change this notice at any
time. Naturally, it will notify the
data subjects of any changes in a timely manner.
Rampart Gasztronómia Kft. is committed to protecting the personal data of its clients
and partners, and considers it of paramount importance to respect its clients' right
to informational self-determination. Rampart Gasztronómia Kft. treats personal data confidentially,
and takes all security, technical, and organisational measures that guarantee the
security of the data.

2. The type of personal data, the purpose, legal basis and
   duration of data processing
   The data processing principles of Rampart Gasztronómia Kft. are in line with the current legislation
   regarding data protection, in particular with the following:
   • Regulation (EU) 2016/679 of the European Parliament and of the Council (27 April 2016) on the
   protection of natural persons with regard to the processing of personal data and on
   the free movement of such data, and repealing Directive 95/46/EC
   (General Data Protection Regulation, GDPR);
   • Act CXII of 2011 on the Right to Informational Self-Determination and on Freedom of Information
   (Infotv.)
   • Act V of 2013 on the Civil Code (Ptk.)
   • Act CLV of 1997 on Consumer Protection (Fgytv.)
   • Act XC of 2017 on the Code of Criminal Procedure (Be.)
   • Act XCIII of 1993 on Occupational Safety and Health (Munkavéd. tv.)
   • Act C of 2000 on Accounting (Számv. tv.)
   • Act C of 2003 on Electronic Communications (Eht.)
   • Act CLXIV of 2005 on Trade (Kertv.)
   • Act CXXXIII of 2005 on the Rules of Personal and Property Protection and Private Investigation
   Activities (SzVMt.)

• Act CXXVII of 2007 on Value Added Tax (Áfa. tv.)
• Act XLVIII of 2008 on the Basic Conditions and Certain Limits of Economic Advertising Activity (Grt.)
• Act XXV of 2023 on Complaints, Public Interest Disclosures, and Rules Related to the
Reporting of Misconduct (Panasztv.)
• Decree of the Ministry of National Economy No. 19/2014 (IV. 29.) NGM on the procedural rules for
handling warranty and guarantee claims for goods sold within the framework of a contract between a consumer and an enterprise
(Szav. r.)

3. Details of the Data Controller
   Name: Rampart Gasztronómia Kft.
   Registered office: 1146 Budapest, Istvánmezei út 3-5.
   Company registration number: 01-09-959713
   Tax number: 23314988-2-42
   Email: info@rampartgastro.hu

4. The purpose of data processing
   Applying for a job vacancy at Rampart Gasztronómia Kft., conducting the selection procedure,
   including holding face-to-face and online interviews, as well as necessary
   communication, and in connection with this, logging applications and
   preserving logging-related data in a database.

5. The legal basis of data processing
   The legal basis for data processing is the voluntary consent of the data subject (Article 6(1)(a) of the
   GDPR).

6. Scope of processed data
   The type of personal data processed: name (surname, first name) (mandatory), phone number
   (mandatory), email address, position applied for, type of work applied for
   (mandatory), restaurant applied for, time of application, and if the
   applicant (optionally) attaches a CV and/or writes a comment, the data contained in the CV
   and/or comment (optional) (typically information in the comment related to
   availability); specifically and typically the following data in the CV: name/birth name, place of residence, phone number, email address, place and date of birth,
   citizenship, source of learning about the job opportunity, how many hours and what
   time of day they can work, time and duration of regular commitments affecting work,
   highest level of education (name of school, major, year of graduation), details of ongoing studies, language proficiency data, area of work experience, and information related to job search, plans, acceptable travel time, acceptable net

salary, qualities related to work, job performance, socialising, as well as cover
letters, CVs, applications and other personal data
provided therein), furthermore, the fact of face-to-face and online interviewing and other information
recorded during the interviews.
The system logs applications with the following data: ID number,
job offer ID, date and time of creation and modification, pseudonymised version of the
applicant's data (first and last characters of the name, first two and last characters of the phone number, first two and last five characters of the
email address), cooperative ID, employment type,
job role ID).

Possible consequences of failing to provide data: the data subject cannot
apply for the job vacancies published by Rampart Gasztronómia Kft.

7. The duration of data processing
   • up to one year from the date of submission of the application;
   • one year in respect of data recorded during logging;
   • 30 days in respect of CVs submitted during personal application at the
   restaurant.

8. Data transfer and data processors
   The data may only be accessed by employees and contracted partners involved in the selection
   process. No data is transferred to third parties, except in the case of a legal
   obligation.
   Data Processors Registered Office Data processing task
   hrfelho.hu Kft. 1119 Budapest, Bártfai u. 15-17

9. 
   

Operation, maintenance,
and support of the HR Cloud
software

9. Rights of data subjects
   The data subject is entitled to:

• request information

• request access to their data

• request rectification

• request erasure

• request restriction of processing

• data portability

• object to the processing of data

• withdraw their consent

10. Method of storing personal data, security of data processing
    Rampart Gasztronómia Kft. and its data processors, taking into account the state of the art and the cost of implementation,
    as well as the nature, scope, context and purposes of processing and the risk of varying
    likelihood and severity for the rights and freedoms of natural persons, shall implement
    appropriate technical and organisational measures to guarantee a level of data security appropriate to the degree of risk.
    For the processing of personal data, Rampart Gasztronómia Kft. selects and operates the IT
    tools used in such a way that the processed data:
    • is accessible to those authorised to access it (availability);
    • has its authenticity and authentication ensured (authenticity of processing);
    • has its integrity verifiable (data integrity);
    • is protected against unauthorised access (confidentiality).
    Rampart Gasztronómia Kft. protects the data with appropriate measures, in particular against
    unauthorised access, alteration, transfer, disclosure, erasure or destruction,
    as well as accidental destruction, damage, and against becoming inaccessible due to changes in the technology
    employed.
    In order to protect electronically managed databases in its various records,
    Rampart Gasztronómia Kft. ensures with appropriate technical solutions that stored data – unless
    permitted by law – cannot be directly linked and assigned to the
    data subject.
    In view of the current state of technology, Rampart Gasztronómia Kft. provides technical, organisational
    and structural measures to protect the security of data processing that provide a level of protection
    commensurate with the risks associated with data processing.
    During data processing, Rampart Gasztronómia Kft. preserves:
    • confidentiality: protects information so that only those authorised can access it;
    • integrity: protects the accuracy and completeness of the information and the processing method;
    • availability: ensures that when an authorised user needs it, they can indeed
    access the desired information, and the related tools are available.
    The IT systems and networks of Rampart Gasztronómia Kft. and its partners involved in data processing
    are equally protected against computer-aided fraud, espionage, sabotage, vandalism, fire and flood, as well as computer viruses, computer intrusions and
    denial-of-service attacks. The operator ensures security through server-level and
    application-level protection procedures. Users are informed that electronic messages

transmitted over the internet, regardless of protocol (email, web, ftp, etc.) are vulnerable to
network threats that lead to dishonest activity, contract disputes, or the disclosure or modification
of information. To protect against such threats, the data controller takes all reasonable precautions.
It monitors systems in order to record all security discrepancies and to provide evidence in
the event of any security incident. System monitoring also allows for the verification of the
effectiveness of the security measures applied.
Rampart Gasztronómia Kft., as data controller, maintains a record of any personal data breaches,
indicating the facts related to the personal data breach, its effects and the remedial actions taken.
Rampart Gasztronómia Kft. shall report any personal data breach to the National Authority for Data Protection
and Freedom of Information without delay and, if possible, no later than 72 hours after
becoming aware of it, unless the personal data breach is unlikely to result in
a risk to the rights and freedoms of natural persons.

11. Remedies
    The data subject may request information about the processing of their personal data, and may request the rectification of their personal
    data, or – with the exception of mandatory data processing – its erasure, withdrawal, restriction of processing, and may exercise their right to data portability and object
    in the manner indicated at the collection of the data, or through the data controller's customer service.

11.1 Right to information:
At the request of the data subject, Rampart Gasztronómia Kft. shall take appropriate measures
in order to provide data subjects with all information relating to the processing of personal data referred to in Articles 13 and 14 of the GDPR,
and each communication under Articles 15 to 22 and 34 in a concise, transparent, intelligible and easily accessible form,
formulated clearly and plainly.

11.2 Right of access by the data subject:
The data subject shall have the right to obtain from the data controller confirmation as to
whether or not personal data concerning them are being processed, and, where that is
the case, access to the personal data and the following information: the purposes of the
processing; the categories of personal data concerned; the recipients or categories of
recipients to whom the personal data have been or will be disclosed, in particular recipients in third
countries or international organisations; the envisaged period for which the personal
data will be stored; the existence of the right to request rectification, erasure or restriction of processing
and the right to object; the right to lodge a complaint with a supervisory authority; the information

concerning the source of data; the existence of automated decision-making, including profiling,
and, at least in those cases, meaningful information about the logic involved, as well as the
significance and the envisaged consequences of such processing for the data subject. Where personal
data are transferred to a third country or to an international organisation, the data subject shall
have the right to be informed of the appropriate safeguards relating to the transfer.
Rampart Gasztronómia Kft. shall provide a copy of the personal data undergoing processing to the
data subject. For any further copies requested by the data subject, the data controller may
charge a reasonable fee based on administrative costs. At the request of the data subject,
the information shall be provided by Rampart Gasztronómia Kft. in electronic form.
At the request of the data subject – after verification of their identity and identification – information
may also be given orally.

11.3 Right to rectification:
The data subject shall have the right to obtain from Rampart Gasztronómia Kft. without undue
delay the rectification of inaccurate personal data concerning them and the completion of incomplete data.

11.4 Right to erasure:
The data subject shall have the right to obtain from Rampart Gasztronómia Kft. the erasure of personal
data concerning them without undue delay on one of the following grounds:
• the personal data are no longer necessary in relation to the purposes for which they
were collected or otherwise processed;
• the data subject withdraws consent on which the processing is based, and where
there is no other legal ground for the processing;
• the data subject objects to the processing and there are no overriding legitimate
grounds for the processing;
• the personal data have been unlawfully processed;
• the personal data have to be erased for compliance with a legal obligation in Union
or Member State law to which the controller is subject;
• the personal data have been collected in relation to the offer of information society
services.
The erasure of data cannot be initiated if the processing is necessary: for exercising
the right of freedom of expression and information; for compliance with a legal obligation
which requires processing by Union or Member State law to which the controller is subject, or
for the performance of a task carried out in the public interest or in the exercise of official
authority vested in the controller; for reasons of public interest in the area of public health,
or for archiving purposes in the public interest, scientific or historical research purposes or statistical
purposes; or for the establishment, exercise or defence of legal claims.

11.5 Right to restriction of processing:
At the request of the data subject, Rampart Gasztronómia Kft. shall restrict processing where one of
the following applies:
• the accuracy of the personal data is contested by the data subject, for a period
enabling the controller to verify the accuracy of the personal data;
• the processing is unlawful and the data subject opposes the erasure of the personal
data and requests the restriction of their use instead;
• the controller no longer needs the personal data for the purposes of the processing,
but they are required by the data subject for the establishment, exercise or
defence of legal claims; or
• the data subject has objected to processing; in this case, the restriction applies for
the period pending the verification whether the legitimate grounds of the controller
override those of the data subject.
Where processing has been restricted, such personal data shall, with the exception of storage,
only be processed with the data subject's consent or for the establishment, exercise or defence of
legal claims or for the protection of the rights of another natural or legal person or for reasons
of important public interest of the Union or of a Member State.
Rampart Gasztronómia Kft. shall inform the data subject before the restriction of processing is
lifted.

11.6 Right to data portability:
The data subject shall have the right to receive the personal data concerning them, which they have
provided to a controller, in a structured, commonly used and machine-readable format
and have the right to transmit those data to another controller.

11.7 Right to object:
The data subject shall have the right to object, on grounds relating to their particular
situation, at any time to processing of personal data concerning them which is necessary for
the performance of a task carried out in the public interest or in the exercise of official
authority vested in the controller, or necessary for the purposes of the legitimate interests pursued
by the controller or by a third party, including profiling based on those provisions.
In the event of an objection, the controller shall no longer process the personal data unless the
controller demonstrates compelling legitimate grounds for the processing which override the interests,
rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
Where personal data are processed for direct marketing purposes, the data subject shall have
the right to object at any time to processing of personal data concerning them for such marketing,
which includes profiling to the extent that it is related to such direct marketing.

Where the data subject objects to processing for direct marketing purposes,
the personal data shall no longer be processed for such purposes by Rampart Gasztronómia Kft.
11.8 Automated individual decision-making, including profiling:
The data subject shall have the right not to be subject to a decision based solely on automated
processing, including profiling, which produces legal effects concerning them or
similarly significantly affects them.
The above right shall not apply if the decision is necessary for entering into, or performance of, a
contract between the data subject and a data controller; is authorised by Union or Member State law
to which the controller is subject and which also lays down suitable measures to safeguard the data
subject's rights and freedoms and legitimate interests; or is based on the data subject's explicit consent.
11.9 Right to withdraw consent:
The data subject shall have the right to withdraw their consent at any time. The withdrawal of
consent shall not affect the lawfulness of processing based on consent before its
withdrawal.
11.10 Procedural rules:
The data controller shall provide information to the data subject on action taken on a request
under Articles 15 to 22 of the GDPR without undue delay and in any event within one month of
receipt of the request. That period may be extended by two further months where necessary,
taking into account the complexity and number of the requests.
The data controller shall inform the data subject of any such extension within one month of receipt
of the request, together with the reasons for the delay. Where the data subject makes the request
by electronic form means, the information shall be provided by electronic means where possible,
unless otherwise requested by the data subject.
If the data controller does not take action on the request of the data subject, the controller shall
inform the data subject without delay and at the latest within one month of receipt of the request
of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory
authority and seeking a judicial remedy.
Rampart Gasztronómia Kft. shall provide the requested information and communications free of charge.
Where requests from a data subject are manifestly unfounded or excessive, in particular because
of their repetitive character, the data controller may either charge a reasonable fee taking into
account the administrative costs of providing the information or communication or taking the action
requested, or refuse to act on the request.
The data controller shall communicate any rectification or erasure of personal data or restriction of
processing carried out to each recipient to whom the personal data have been disclosed, unless
this proves impossible or involves disproportionate effort. The data controller shall inform the data
subject about those recipients if the data subject requests it.

The data controller shall provide a copy of the personal data undergoing processing to the data
subject. For any further copies requested by the data subject, the data controller may charge a
reasonable fee based on administrative costs. Where the data subject makes the request by electronic
means, the information shall be provided in a commonly used electronic form, unless otherwise requested by
the data subject.
11.11 Compensation and liability:
Any person who has suffered material or non-material damage as a result of an infringement of
the General Data Protection Regulation shall have the right to receive compensation from the controller
or processor for the damage suffered. A processor shall be liable for the damage caused by processing
only where it has not complied with obligations of the legislation specifically directed to processors
or where it has acted outside or contrary to lawful instructions of the controller.
Where more than one controller or processor, or both a controller and a processor, are involved in the
same processing and are responsible for any damage caused by processing, each controller or processor
shall be held liable for the entire damage to ensure effective compensation.
A controller or processor shall be exempt from liability if it proves that it is not in any way responsible
for the event giving rise to the damage.