Purpose and Scope of the Policy The purpose of this Privacy Policy is to establish the data protection and handling principles and policies employed by Recsetár-Maioli Kinga EV (Registration number: 56099137, Tax ID: 57468477-1-43, hereinafter referred to as “EV”), which EV, as the data controller, obliges itself to adhere to.

This Privacy Policy contains the principles of processing Personal Data provided by Users. When drafting the provisions of this Policy, special consideration was given to the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council (“General Data Protection Regulation” or “GDPR”), Act CXII of 2011 on informational self-determination and freedom of information (“Infotv.”), Act V of 2013 on the Civil Code (“Ptk.”), as well as Act XLVIII of 2008 on the fundamental conditions and certain limitations of economic advertising activity (“Grtv.”).

Data Processing: Any operation or set of operations performed on Personal Data, regardless of the method used, including collection, recording, organization, structuring, storage, adaptation, alteration, use, retrieval, consultation, disclosure, transmission, dissemination, making available, alignment, or combination, restriction, erasure, or destruction.

2. Scope of Processed Personal Data During the visit to our website (mamasherpas.care), the following personal data will be processed:

• When subscribing to the newsletter and sending the newsletter, the User’s mandatory personal identification data to be provided: name, email address.
• When registering for programs (name, billing address, phone number, email address, expected date of birth).
• Data related to the User’s login computer or mobile device, generated during the use of the website and automatically recorded by the website system as technical results of processes, including Internet Protocol (IP) address, browser type, language settings, operating system, internet service provider (ISP), and timestamps. The data recorded automatically can be logged by the operator upon entry or exit without the User’s separate declaration or action. Except in cases required by law, these automatically recorded data cannot be linked to other personal user data. Only the operator of mamasherpas.care, Recsetár-Maioli Kinga EV, as the data controller, has access to this data.

3. Purpose of Data Processing The data described in point a) above will be processed for the following purposes:

• Registration for newsletter subscription.
• User identification.
• Ensuring communication between Recsetár-Maioli Kinga EV and the User.
• Aggregate, anonymized, statistical use of data, creating surveys, statistics, and reports.
• Sending electronic newsletters to the User if the User has explicitly consented to it on the website.
• Sending system messages related to the website and mamasherpas.care to the User’s email address.
• The User can freely subscribe to the newsletter separately from accepting this notice on the website, thus expressly allowing the sending of such content to the provided email address and the processing of the email address for this purpose. The User can unsubscribe from the newsletter at any time by clicking the unsubscribe button in the newsletter. The owner and operator of mamasherpas.care, Recsetár-Maioli Kinga EV, will ensure the removal of the email address from the newsletter list and that the User will not receive newsletters from that point onwards, immediately upon receiving notice of the unsubscribe, but no later than within 1 business day.

The data described in point b) above will be processed for the following purposes:

• User identification.
• Effective maintenance of the website.
• Tracking the behavior of website visitors.
• Analyzing trends.
• Collecting demographic data of Users in aggregate.

4. Legal Basis for Data Processing The legal basis for data processing includes the voluntary consent of Users according to Section 5(1)(a) of Act CXII of 2011 on informational self-determination and freedom of information (“Infotv.”), as well as the data processing authorization provided by Section 13/A of Act CVIII of 2001 on electronic commerce services and certain aspects of services related to the information society (“Elkertv.”). According to Elkertv., Users’ natural personal identification data (name, place and date of birth, mother’s maiden name, place and time of birth) and address may be processed without the User’s consent for the purpose of creating, defining, modifying, monitoring the performance, invoicing fees, and asserting claims arising from contracts related to services provided in connection with the information society. Additionally, the User’s natural personal identification data, address, and data concerning the time, duration, and location of service use may be processed without the User’s consent for the purpose of invoicing fees related to contracts related to services provided in connection with the information society.

By subscribing to the newsletter, the User accepts the provisions of this information regarding data processing and consents to the processing of their personal data in accordance with the extent, manner, scope, and duration defined in this notice, either actively or, in the absence of such, by visiting any page of the website.

5. Data Controller Data processing is carried out by Recsetár-Maioli Kinga EV. Name: Recsetár-Maioli Kinga Address: 1094 Budapest, Bokréta utca 20 Tax ID: 57468477-1-43 Email: contact@mamasherpas.care Phone: +36 30 4995828 Website: mamasherpas.care

6. Data Processing Duration Data related to financial transactions will be deleted 10 years after the financial transaction, or – Data not related to financial transactions will be deleted upon request immediately, but no later than within 30 days.

Persons Authorized to Access the Data Recsetár-Maioli Kinga EV employees, subcontractors, and authorized representatives have the right to access the User’s personal data.

7. Links to Other Websites By following the links on the website, you may leave the mamasherpas.com website and access content beyond it. Recsetár-Maioli Kinga EV is not responsible for the content, accuracy, and operation of websites created by third parties. We provide these links to the User in good faith. EV is not responsible for websites created by third parties that are indicated by the links or any changes to them. Placing links to other websites does not imply that EV supports, operates, or agrees with the content of the respective website. We encourage the User to become familiar with and carefully read the legal and data protection statements on other visited websites.

Information on the Rights of Data Subjects and Remedies Based on Sections 14 to 19 of the Infotv., the User can request the following from Recsetár-Maioli Kinga EV:

• Information about the processing of their personal data.
• Correction of their personal data.
• Deletion or blocking of their personal data.

The data controller will provide the requested information in writing, in an understandable form, within the shortest possible time from the submission of the request but no later than 30 days.

For remedies and complaints, you can contact the National Authority for Data Protection and Freedom of Information (NAIH): Headquarters: 1125 Budapest, Szilágyi Erzsébet fasor 22/c Mailing address: 1530 Budapest, Pf.: 5. Phone: +36 (1) 391-1400 URL: https://naih.hu Email: ugyfelszolgalat@naih.hu

In case of a breach of personal data protection, the User can file a lawsuit against the entrepreneur in accordance with the place of business of the individual entrepreneur (Budapest Capital Court). Data Security Recsetár-Maioli Kinga EV ensures that unauthorized third parties do not access the personal data managed by EV. For this purpose, EV takes all necessary technical and organizational measures and establishes procedural rules to ensure the security of data in accordance with Section 7 of the Infotv.

If EV detects unauthorized access or an attempt to access the User’s personal data managed and stored by the company, EV is obliged to immediately, but no later than within 24 hours of detection, prohibit access to the data and notify the User. The User is required to cooperate with EV in identifying unauthorized access and must provide the necessary data to EV and the competent authorities with jurisdiction without delay.