Data processing information regarding support packages

THE

Rueda Pictures Ltd.

Headquarters: 1134 Budapest, Dévai utca 22-24. A. building. 9th floor. door 38

Tax number: 22932763-2-41

Company registration number: 01-09-384616

Email address: [email protected]

Phone number: +36302771767

(” Company “)

on the website https://konektfilm.com/#packages (” Website “), we inform you of the data protection of natural persons with regard to the processing of personal data and of the free movement of such data, as set out in this notice, and of Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (“GDPR”).

1.              Conclusion and fulfillment of a support contract

1.1           Description of data processing:

You can enter into a sponsorship agreement with the Company on the Website, according to which you undertake to support the production of the film entitled KONEKT (” Film “), and in return, the Company will provide compensation according to the selected sponsorship package.

A detailed description of the sponsorship packages and the services provided by the Company is contained on the Website.

This section provides information regarding the data processing necessary for the conclusion and performance of the sponsorship agreement between you and the Company. Please note that you will be entitled to the services undertaken by the Company within the framework of the sponsorship packages – with the exception of the digital certificate that is part of the services – only when and to the extent that the Film is shown in at least one Hungarian cinema or becomes available on at least one streaming service provider available in Hungary.

We also inform you that the performance of certain elements of the service, depending on the nature of the given element of the service, is only possible at a specific time (e.g. event, function) and/or only on the condition of making a specific legal statement (e.g. consent to the creation and use of images or sound recordings; acknowledgement of the data protection information or consent to the processing of personal data). Accordingly, data processing related to the performance of certain elements of the service (i.e. data processing related to certain forms of support) can only take place if you make certain declarations necessary for the provision of the service prior to the provision of the given service and provide the necessary consent. You will be informed about the data processing related to the performance of the service elements related to the form of support you have chosen (information about which elements is available on the Website) – if necessary for the given service element – prior to the performance of the given service element, on the basis of which you can decide whether to make the declaration.

1.2           Purpose and legal basis of data processing:

Purpose of data processing:

The purpose of data processing is to enable us to conclude and fulfill the support contract with you, and, if you are concluding a contract on behalf of a legal entity, to maintain contact with you.

In this context, the purpose of data processing in both cases is to inform you from time to time about the status of the production of the project you support through the contract, i.e. the Film.

Legal basis for data processing:

The legal basis for data processing is Article 6(1)(b) of the GDPR (“performance of a contract with the data subject”) and point (c) (“fulfillment of a legal obligation of the controller”), given that a contract is concluded between you and the Company, and in connection with the performance of the contract, the Company is subject to tax and accounting obligations.

If you are entering into a contract on behalf of a legal entity, the legal basis for processing your contact data is the legitimate interest of the Company (GDPR Article 6(1)(f)). The Company’s legitimate interest is to be able to contact you during the performance of the contract.

1.3           The scope of personal data concerned:

If you are the contracting party:

last name; first name; email address; billing address

If you are entering into a contract on behalf of a legal entity:

last name; first name; email address; company name, company tax number, billing address

1.4           Duration of data processing:

If you conclude a support contract as a private individual, we will process your personal data set out in point 1.3 above – with the exception of your email address – for 8 years in order to fulfil our accounting obligations, which is the period for the retention of accounting documents (see Section 169 (2) and Section 166 (1) of Act C of 2000 on Accounting). An accounting document is a document issued by the data controller (e.g. invoice, contract) that supports the accounting settlement (recording) of the economic event. We will process your email address for 5 years after the fulfilment of the support contract (which is the general civil law limitation period).

If you are a contractual contact person, we will retain your personal data for the duration of the contract – including the warranty period – or for one year from the date of change of contact person.

In the event of a legal dispute, we will process the personal data necessary for the dispute until the final resolution of the dispute.

1.5           The circle of persons authorized to view the data within the Company’s organization:

The Company’s executive has access to your personal data as per this point.

1.6           The circle of persons authorized to view the data outside the Company’s organization:

Your personal data under this point will be accessed by RACKFOREST KFT. (registered office: 1132 Budapest, Victor Hugo utca 11. 5. em. B05001.), as a data processor providing hosting services, and KBOSS.hu Kft. (postal address: 1031 Budapest, Záhony utca 7/D.), as a data processor providing the szamlazz.hu service.

2.              Send newsletter

2.1           Description of data processing:

You have the opportunity to subscribe to our newsletter, in which we inform you about our film projects, among other things.

2.2           Purpose and legal basis of data processing:

The purpose of data processing is:

The purpose of data processing is to be able to send you the newsletter.

Legal basis for data processing:

The legal basis for data processing is your consent pursuant to Article 6(1)(a) of the GDPR.

Your consent under this section may be withdrawn at any time, free of charge, by emailing [email protected] . The withdrawal of consent does not affect the lawfulness of data processing based on consent prior to its withdrawal.

2.3           The scope of personal data concerned:

last name; first name; email address

2.4           Duration of data processing:

We will process the data according to this point until you withdraw your consent.

2.5           The circle of persons authorized to view the data within the Company’s organization:

The Company’s executive has access to your personal data as per this point.

2.6           The circle of persons authorized to view the data outside the Company’s organization:

The personal data of the Company pursuant to this point are accessed by RACKFOREST KFT. (registered office: 1132 Budapest, Victor Hugo utca 11. 5. em. B05001.), as a data processor providing hosting services, and The Rocket Science Group LLC d/b/a Mailchimp, as a data processor providing newsletter sending services. The Rocket Science Group LLC d/b/a Mailchimp is listed with active status in the EU Data Protection Framework.^[1]

3.              The data controller:

The data controller is the Company.

4.              Data transfer outside the EU/EEA:

No personal data will be transferred outside the EU/EEA.

5.              Automated decision-making, profiling:

Neither automated decision-making nor profiling takes place in connection with data processing.

6.              Safety measures:

We take all reasonable technical precautions to ensure that the stored data is secure and protected from third party access, including physical and IT security measures.

Description of the physical and IT security of the storage of personal data, technical and organizational measures taken to ensure data security:

The data can be accessed by those who absolutely need access to do their job. The administrative interface of the website is protected by a strong password and can be accessed with a unique login. The computers of individuals and organizations with access rights to the data are password-protected and equipped with virus protection.

7.              Your rights:

You have the following rights regarding the processing of your personal data:

a) right of access (Article 15 GDPR) : You have the right to be informed whether your personal data is being processed and, if so, to have access to the personal data and the information contained in this notice. We will provide you with a copy of the personal data that is being processed upon request.

b) right to rectification (Article 16 of the GDPR) : You have the right to request that we rectify inaccurate personal data concerning you without undue delay. You also have the right to request that incomplete personal data be completed.

c) right to erasure (Article 17 of the GDPR) : You have the right to request that we erase your personal data without delay, or to have your personal data erased without delay if, for example, the personal data are no longer necessary for the purposes for which they were collected or you withdraw your consent to the processing and there is no other legal basis for the processing.

The above provisions under this point c) shall not apply if (i) the processing of personal data is necessary for compliance with an obligation under Union or Member State law applicable to joint controllers requiring the processing of personal data, or (ii) the processing is necessary for the establishment, exercise or defence of legal claims.

d) right to restriction of processing (Article 18 of the GDPR): You have the right to request that we restrict the processing of your data, for example if (i) you contest the accuracy of the personal data, in which case the restriction shall apply for a period of time enabling us to verify the accuracy of the personal data, or (ii) we no longer need the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims.

***************************************************************************************

e) right to object (Article 21 of the GDPR): You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data by the controller based on its legitimate interests. In such a case, the controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

You also have the right to object at any time to the processing of your personal data for direct marketing purposes. In this case, the Company will no longer process your personal data.

***************************************************************************************

f) right to data portability (Article 20 GDPR): you have the right to data portability if the legal basis for the processing is point (a) or (b) of Article 6(1) GDPR, i.e. your consent or the performance of a contract with you. In this case, you have the right to receive the personal data concerning you which we have provided to you in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from us. You also have the right to request, where technically feasible, the direct transmission of your personal data to another controller.

g) right to information regarding the above rights (Article 12 GDPR) : we will inform you of the circumstances surrounding the processing of your data within one month of receipt of your request as set out in points a)-f) above. If necessary, taking into account the complexity of the request and the number of requests, this deadline may be extended by a further two months. We will inform you of the extension of the deadline within one month of receipt of the request, indicating the reasons for the delay.

h) right to lodge a complaint (Article 77 GDPR): You have the right to lodge a complaint with a supervisory authority – in particular in the Member State of your habitual residence, place of work or place of the alleged infringement – if you consider that the processing of personal data concerning you infringes data protection law. The complaint can be lodged with the National Data Protection and Freedom of Information Authority (address: 1055 Budapest, Falk Miksa u. 9-11.; telephone: +36 1 391 1400; fax: +36 1 391 1410; postal address: 1363 Budapest, Pf.: 9.; www.naih.hu; email: [email protected]) .

i) right to a court (Article 79 of the GDPR): You have the right to a judicial remedy if you consider that your data subject rights have been infringed as a result of the processing of your personal data not complying with data protection law. Proceedings against the Company must be brought before the courts of the Member State in which the Company is established. Such proceedings may also be brought before the courts of the Member State in which you have your habitual residence.

8.              For more information:

In order to handle your question or request as quickly and efficiently as possible, we ask that you contact us first. Further information regarding the processing of your personal data can be requested from Bálint Vígh by e-mail ( [email protected] ). Upon request, verbal information can also be provided, which must be recorded. If you request verbal information (e.g. by telephone), you must prove to the Company that you are who you say you are, and for this purpose we may request identification data from you. In the event of exercising your rights specified above, you must also contact Bálint Vígh.

Date: Budapest , May 7, 2025 .