COMPANY OPERATION MANAGEMENT KFT.
INTEREST BALANCING TEST
For data management entitled “Other personal data logged by the system” indicated in the data management information. The Company carries out the above-mentioned data management on the basis of a legitimate interest, in connection with which it has performed the interest balancing test as follows.
1. Identification of the legitimate interest of the controller
1.1. Purpose of data management
Secure website operation, ensuring the IT security of the system, and providing protection against congestion attacks that cause the unavailability of the website's services.
1.2. Presentation of a legitimate interest
The Company has a compelling legitimate interest to record the online identity (IP address) of users visiting the Website as well as other personal data generated in connection with browsing (date of browsing) in order to prevent external attacks on the Website and public electronic services.
Finding:
Based on the above, the interest of the Company in data management is lawful, clear and real, so the existence of a legitimate interest can be established.
2. Examining the need for data management
2.1. Why is data management needed to achieve this goal?
The above-mentioned goal can only be achieved by the Company by recording and automating the analysis of certain data of users visiting the website.
2.2. Are there other alternatives available to achieve this goal?
The Company does not have an alternative tool, procedure or solution that would enable it to achieve the above goal without data management.
If the above data management is not performed by the Company, there is a risk that the website or other services available from the website will become inaccessible, so the Company will not be able to provide its online services to its customers.
Finding:
Based on the above, it can be stated that data management is necessary to achieve the goal set by the Company.
3. Identification of the interests and rights of the parties involved
3.1. The Company's relationship with stakeholders
Stakeholders can have a variety of relationships with the Company; they may be persons who have previously contracted with the Company or wish to enter into a contract, are interested parties, or seek information.
3.2. Reasonable expectations, interests, fundamental rights or freedoms of the data subject
The data subject has a reasonable expectation that the Company will not take steps to allow the online identifiers (IP address) to be directly linked to the data subject's name or address and that the automatic recording and analysis of the online identifiers is solely for the secure operation of the Website.
3.3. The positive and negative effects of data management on the data subject
The data processing does not in itself have an adverse effect on the data subject, the data processing is not perceived by the data subject and is not viewed with legal effect.
Finding:
Based on the above, the Company has assessed and taken into account the interests and rights of the parties involved.
4. Result of the interest balancing test
4.1. Existence of a legitimate interest
It is in the undisputed interest of the Company to ensure the continuity of its online services, to detect external attacks in a timely manner and to respond to them with appropriate measures.
4.2. The need for data management
The processing of personal data is essential to achieve this goal.
4.3. Proportionality
The data subject's right to information self-determination may in certain cases be limited in a necessary and proportionate manner. It is in the interest of the Company to process the personal data of the data subject (indicated in the Data Management Information) for the purpose of the safe operation of the Website. Given that the personal data processed are retained and used only for the purpose and for the period necessary to achieve the purpose, they can only be accessed to a limited and strictly necessary extent. The Company ensures the safe storage of personal data and has taken into account the interests, rights and reasonable expectations of the data subject, so that in order to achieve the desired goal, it is proportionate to restrict the data subject's right to information self-determination.
Summary:
As a result of the consideration, it can be concluded that the data processing does not constitute an unnecessary and disproportionate restriction on the interests, fundamental rights or freedoms of the data subject. The data subject is already aware of the circumstances of the processing of personal data and the rights to which he or she is entitled. The data subject may object to the data processing.
Based on the above consideration, it can be stated that the data processing is necessary and proportionate, it does not cause unreasonable interference in the privacy of the data subject, the legitimate interest of the Company may serve as the legal basis for the data processing.
