Privacy policy
Overview
Name: SMP Solutions Ltd.
Address: 1138 Budapest, Madarász Viktor Street 47–49, Block 2, 3rd floor.
Representative of the data controller: Edward László Papp, Chief Executive Officer
Data Controller’s Data Protection Officer: Gill & Murry Ltd.
Contact details for the Data Protection Officer: adatvedelem@smp.hu
This information notice constitutes a unilateral commitment by the data controller in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (27 April 2016) and the relevant Member State legislation.
This notice may be amended and/or withdrawn unilaterally by the Data Controller at any time, provided that the Data Subjects are informed at the same time. Notification shall be effected by publication on the website or, depending on the nature of the change, by direct notification to the Data Subjects.
2. Purpose of data processing
2.1 Ensuring IT business continuity and data backup
IT: Operation of systems and infrastructure, including the operation of workstations, servers and network components, as well as the archiving and backing up of data and its restoration in the event of a disaster.
Legal basis for data processing: Pursuit of the Data Controller’s legitimate interests (Article 6(1)(f)). - The Data Controller’s legitimate interest lies in the monitoring, maintenance, installation, troubleshooting, regular backup and archiving of IT systems in order to maintain business operations.
Scope of data processed: All categories of digital data collected or processed by the Data Controller, including private telephone numbers for the new user form
Planned retention period for data processing: 30 days in the case of data backups for the IT system; in the case of data archiving, the last working day of April in the second year following the backup
Data processors: Management system provider
Recipients: not specified
Source of data collection: Data provided by the data subject, the data subject’s employer or the data subject’s partner
2.2 Issuing invoices and the related mandatory documentation for the provision of services
Issuing invoices and the related mandatory documentation for the provision of services (work sheet, certificate of completion). Compliance with the Accounting Act
Legal basis for data processing: Compliance with a legal obligation to which the data controller is subject (Article 6(1)(c)).
Scope of data processed: Billing name and address, email address, contact person’s name, job title, signature
Planned retention period for data processing: The date of disposal, nine years after the exhibition
Data processors: administrative system provider
Recipients: Authority
Source of data collection: Data provided by the data subject, the data subject’s employer or the data subject’s partner
2.3 Event registration
Management of registrations for events organised by the data controller, including family days and educational events.
Legal basis for data processing: Consent of the data subject (Article 6(1)(a))
Scope of data processed: Name, Company name, Job title, Email address, Telephone number
Number of adult guests, Number of child guests (under 16)
Planned duration of data processing: Until the data subject withdraws their consent
Data processors: Event organiser, Hostess service provider, Security service provider, Marketing agency
Recipients: not specified
Source of data collection: Data provided by the data subject
2.4 Event organisation and management of related documentation
Corporate events, team-building sessions, in-house training or compulsory information sessions organised by the data controller. Recording attendance at the event.
Legal basis for data processing: Pursuit of the Data Controller’s legitimate interests (Article 6(1)(f)). – The Data Controller’s legitimate interest is to organise an event for its staff at which attendance is compulsory for members of the organisation.
Scope of data processed: Name; for business partners: company name, job title, email address, telephone number and name
Planned duration of data processing: Until the data subject’s objection is deemed valid, but no later than the next event of the same nature, or no later than the last working day of May in the second full year following the event.
Data processors: Event organiser, Hostess service provider, Security service provider, Marketing agency
Recipients: not specified
Source of data collection: Data provided by the data subject, the data subject’s employer or the data subject’s partner
2.5 Data processing in connection with the organisation and running of events
The processing of registrations for events and training sessions organised by the data controller, and for matters relating to such events.
Legal basis for data processing: Pursuit of the Data Controller’s legitimate interests (Article 6(1)(f)). – The Data Controller’s legitimate interest lies in the processing of data carried out for the purpose of ensuring the efficient organisation of events organised by the organisation.
Scope of data processed: Name, Company name, Job title, Email address, Telephone number
Planned duration of data processing: The last working day of April in the first year following the conclusion of the event.
Data processors: Event organiser, Hostess service provider, Security service provider, Marketing agency
Recipients: not specified
Source of data collection: Data provided by the data subject, the data subject’s employer or the data subject’s partner
2.6 Taking photographs and video footage at events and posting them on social media.
The Data Controller takes photographs and makes video recordings of the events it organises, which it may publish on its website and on its Facebook and LinkedIn pages, as well as store in its own organisational databases.
Legal basis for data processing: Pursuit of the Data Controller’s legitimate interests (Article 6(1)(f)). – The Data Controller’s legitimate interest is the company’s personalised communication on its own website and on social media.
Scope of data processed: facial and body images
Planned duration of data processing: Until the data subject objects
Data processors: Photography and video service provider, marketing agency
Recipients: social media pages
Source of data collection: Data provided by the data subject
2.7 Management of documentation relating to the operation of quality management systems.
Data processing operations relating to personal data contained in documentation pertaining to the ISO 9001 quality management system.
Legal basis for data processing: Pursuit of the Data Controller’s legitimate interests (Article 6(1)(f)). – The Data Controller’s legitimate interest lies in the preparation and management of documentation required by supervisory bodies and in accordance with data processing requirements necessary for the efficient operation of the business.
Scope of data processed: Name, signature, job title
Planned duration of data processing: The last working day of April in the first year following the 3-year certification cycle, or until the Data Subject lodges a valid objection.
Data processors: Quality assurance consultants, Auditors
Recipients: Certification bodies
Source of data collection: Data provided by the data subject, the data subject’s employer or the data subject’s partner
2.8 The author’s record in the technical design documentation
Recording details relating to the author in the documentation for security and IT system designs.
Legal basis for data processing: Compliance with a legal obligation to which the data controller is subject (Article 6(1)(c)).
Scope of data processed: Name, identification number proving eligibility
Planned retention period for data processing: On the first annual data deletion date following the 20th year after the project’s completion.
Data processors: Subcontractors involved in the project
Recipients: Client
Source of data collection: Data provided by the data subject, the data subject’s employer or the data subject’s partner
2.9 Management of an electronic camera-based parking system and recording of entries
Operation of a video-based parking system for staff and visitors. Recording of daily entry and exit data, as well as details of the parking space.
Legal basis for data processing: Pursuit of the data controller’s legitimate interests (Article 6(1)(f)). – The legitimate interest in data processing is the protection of the data controller’s property and that of its guests, and the control of access.
Scope of data processed: Name, time of entry and exit, vehicle registration number, facial and body images, parking space
Planned retention period for data processing: the last working day of April following one year after the last recorded access
Data processors: not specified
Recipients: not specified
Source of data collection: Data provided by the data subject
2.10 Compliance with the obligations laid down in legislation relating to training.
Registration of training participants in the FAR system.
Legal basis for data processing: Compliance with a legal obligation to which the data controller is subject (Article 6(1)(c)).
Scope of data processed: Name as used, birth name, mother’s name, place and date of birth, username, password
Planned duration of data processing: The last working day of April in the second year following the termination of the employment contract, or until the Data Subject lodges a valid objection
Data processors: not specified
To: Pest County Government Office
Source of data collection: Data provided by the data subject, the data subject’s employer or the data subject’s partner
2.11 Data processing relating to the administration of training courses subject to notification and authorisation.
FAR system notification and authorisation procedure.
Legal basis for data processing: Compliance with a legal obligation to which the data controller is subject (Article 6(1)(c)).
The scope of the data processed:
- The person authorised to represent the adult education provider
- – surname and first name
- – place and date of birth
- – his mother’s name
- – nationality
- – the date on which the right of representation commenced
- The Head of Department
- – surname and first name
- – place and date of birth
- – his mother’s name
- – nationality
- – the number of the document certifying their university or college qualification and their qualification in pedagogy or andragogy, and the name of the institution that issued the document
Planned duration of data processing: The last working day of April in the second year following the termination of the employment contract, or until the Data Subject lodges a valid objection
Data processors: not specified
To: Pest County Government Office
Source of data collection: Data provided by the data subject
2.12 Storage and handover of professional CVs to the client
The preparation and storage of professional CVs for staff and subcontractors, and their submission to the client during the preparatory phase of a given project for professional review.
Legal basis for data processing: Pursuit of the Data Controller’s legitimate interests (Article 6(1)(f)). - It is in the Data Controller’s legitimate interest, for the purpose of meeting the Client’s audit requirements, to process the professional CVs of project managers, employees and representatives of subcontractors and to provide them to the Client.
Scope of data processed: Name, photograph, details of professional qualifications and experience, professional CV
Planned duration of data processing: The last working day of April in the second year following the termination of the employment contract, or until the Data Subject lodges a valid objection.
Data processors: not specified
Recipients: Client
Source of data collection: Data provided by the data subject
2.13 Recording and displaying meeting room bookings at the entrance to the meeting room
Meeting room booking, display
Legal basis for data processing: Pursuit of the Data Controller’s legitimate interests (Article 6(1)(f)). – The Data Controller’s legitimate interest is to record and publish meeting availability within the organisation in order to ensure efficient time management.
Scope of data processed: Name, title of meeting
Planned deadline for data retention: Each year, data older than one year prior to the last working day of April is deleted.
Data processors: not specified
Recipients: not specified
Source of data collection: Data provided by the data subject
2.14 Protection of property, ensuring personal safety and safeguarding physical well-being through the use of an electronic video surveillance system.
Operation of an electronic video surveillance system by the data controller at the entry points to secure areas and in the passageways.
Legal basis for data processing: Pursuit of the Data Controller’s legitimate interests (Article 6(1)(f)). – The Data Controller’s legitimate interest lies in the protection of its assets and the control of access to them.
Scope of data processed: Facial and body images, video recordings
Planned duration of data processing: 14 days
Data processors: not specified
Recipients: not specified
Source of data collection: Data provided by the data subject
2.15 Monitoring of operations using an electronic video surveillance system to facilitate the handling of any complaints
Operation of a CCTV system in those areas where the handover process for warehouse goods takes place.
Legal basis for data processing: Pursuit of the Data Controller’s legitimate interests (Article 6(1)(f)). – The Data Controller’s legitimate interest lies in recording the equipment handed over and the associated documentation in order to resolve any disputes.
Scope of data processed: Facial and body images, video recordings
Planned duration of data processing: 14 days
Data processors: not specified
Recipients: not specified
Source of data collection: Data provided by the data subject
2.16 Management and filing of contracts
Management and filing of contracts, Filing of contracts relating to the data controller’s activities; managing the contact details of the contracting parties upon the conclusion of a contract and keeping these up to date; managing the details of the contracting parties’ authorised representatives and keeping these up to date
Legal basis for data processing: Pursuit of the data controller’s legitimate interests (Article 6(1)(f)). – It is in the data controller’s legitimate interest to keep a record of the contact person’s details.
Scope of data processed: Name, telephone number, job title, email address, signature
Planned duration of data processing: Until the data subject’s objection is deemed valid.
Data processors: not specified
Recipients: not specified
Source of data collection: Data provided by the data subject or the data subject’s employer
2.17 Maintaining contact with partners, customers and suppliers
Maintaining contact, sending system messages relating to the service, issuing quotations, placing orders, concluding contracts, managing and recording contact details, personal contact, taking orders by telephone, Reconciling and updating contact details, documentation relating to partner visits, project management, and maintaining contact whilst participating in a consortium or supplier group. Managing and maintaining contact with participants in training programmes carried out as part of a project
Legal basis for data processing: Pursuit of the Data Controller’s legitimate interests (Article 6(1)(f)). – The Data Controller’s legitimate interest in recording contact details for the purpose of performing contracts
Scope of data processed: Name, address, email address, telephone number, unique identifier,
Planned duration of data processing: Until the data subject objects
Data processors: Operator of the management system
Recipients: not specified
Source of data collection: Data provided by the data subject or the data subject’s employer
2.18 Recording of postal items
Record-keeping of postal items relating to the data controller’s activities
Legal basis for data processing: Pursuit of the data controller’s legitimate interests (Article 6(1)(f)). – It is in the data controller’s legitimate interest to keep a record of the contact person’s details.
Scope of data processed: Name, address
Planned duration of data processing: The last working day of April following the fifth full year after the start of data processing.
Data processors: Portó Budapest Kft.
Recipients: Magyar Posta
Source of data collection: Data provided by the data subject or the data subject’s employer
2.19 Recording tasks, comments and faults reported by clients and documenting them in the IT system (fault ticket management system, worksheet management system).
Recording the status and completion of tasks, the time spent on them, and maintaining full documentation of task management. Via a web interface and an online form, the Data Controller’s clients’ employees are able to report technical issues, faults, service requests and change requests within the scope of the services provided by the Data Controller. Provision of evidence of working hours to the authorities and clients, with access to documentation upon request.
Legal basis for data processing: Pursuit of the Data Controller’s legitimate interests (Article 6(1)(f)). – The Data Controller’s legitimate interest lies in the systematic processing of reports received from its clients for the purposes of recording tasks and verifying accounts.
Scope of data processed: Name, email address, date of the report and a description of the incident, Signature
Planned duration of data processing: Until the end of the financial accounting period relating to the fault ticket (minimum 8 years) or until the data subject lodges a valid objection.
Data processors: Atlassian, Microsoft
Recipients: Authority, Client
Source of data collection: Data provided by the data subject or the data subject’s employer
2.20 Data processing in connection with Regulation GDPR
Data processing in connection with Regulation GDPR.
Legal basis for data processing: Compliance with a legal obligation to which the data controller is subject (Article 6(1)(c)).
Scope of data processed: Name, email address
Planned retention period for data processing: Not to be deleted
Data processors: Legal adviser, Adviser GDPR
Recipients: Authority, DPO
Source of data collection: Data provided by the data subject
2.21 Handling reports of anonymous misconduct with a view to investigating the report and rectifying or putting an end to the conduct that is the subject of the report
In the event of an unlawful act or omission, or one presumed to be unlawful, or other misconduct, the Data Controller shall process the personal data of the person under investigation (whose conduct or omission gave rise to the report) and of persons in possession of relevant information.
Legal basis for data processing: Compliance with a legal obligation to which the data controller is subject (Article 6(1)(c)).
Scope of data processed: The details provided in the report by the persons under investigation and those in possession of relevant information
Planned duration of data processing: Until the complaint has been investigated (in the event of rejection) or until the conduct forming the subject of the complaint has been rectified.
Data processors: not specified
Addressees: the body authorised to conduct the proceedings
Source of data collection: Data provided by the reporting party
2.22 Processing of data for the purposes of legal and other claims in connection with reports of misuse
The data controller shall retain the personal data it processes for the purpose of enforcing claims for the duration of the general limitation period following the provision of such data
Legal basis for data processing: Pursuit of the data controller’s legitimate interests (Article 6(1)(f)). – The data controller’s legitimate interest is to retain the personal data of data subjects with whom it has a relationship for the duration of the general limitation period.
Scope of data processed: data necessary for the claimant, the person under investigation and persons in possession of relevant information to assert their legal claims (name, address, place and date of birth, mother’s name)
Planned duration of data processing: 5 years from the date of notification
Data processors: not specified
Addressees: the body authorised to conduct the proceedings
Source of data collection: Data recorded by the data controller for other data processing purposes
2.23 Handling reports of specific instances of misconduct, investigating such reports and taking action to remedy or put an end to the conduct that is the subject of the report
Where information is reported concerning an act or omission that is unlawful or presumed to be unlawful, or any other abuse, the Data Controller shall process the personal data of the reporting person, the person under investigation and any persons in possession of relevant information
Legal basis for data processing: Compliance with a legal obligation to which the data controller is subject (Article 6(1)(c)).
Scope of data processed: the details provided in the report by the person making the report, the person under investigation and any persons in possession of relevant information
Planned duration of data processing: Until the complaint has been investigated (in the event of rejection) or until the conduct forming the subject of the complaint has been rectified.
Data processors: not specified
Addressees: the body authorised to conduct the proceedings
Source of data collection: Data provided by the data subject and the person making the report
2.24 Register of visitors
Visitors wishing to enter the data controller’s premises are required, in accordance with the rules of ISO 27001 certification, to provide – following identification – - their personal data in the FORM maintained by the data controller prior to entering the data controller’s premises
Legal basis for data processing: Pursuit of the Data Controller’s legitimate interests (Article 6(1)(f)). – The Data Controller’s legitimate interest lies in the creation and management of the entry register required by the supervisory bodies.
Scope of data processed: name, place of work, date of arrival
Planned duration of data processing: 6 months from the date of entry
Data processors: not specified
Recipients: not specified
Source of data collection: Data provided by the data subject
2.25 Enforcement of legal or other claims; debt recovery
The data controller shall retain and process the personal data it holds for the purposes of enforcing legal claims and recovering debts for the duration of the general limitation period following the expiry of the retention period for the original purpose of data processing.
Legal basis for data processing: Pursuit of the data controller’s legitimate interests (Article 6(1)(f)) – The data controller has a legitimate interest in retaining the personal data of data subjects with whom it has a relationship for the duration of the general limitation period.
Scope of data processed: Data necessary for the enforcement of legal claims (name, address, place and date of birth, mother’s name, debt, amount of the claim, other claims
Planned duration of data processing: Until the end of the general limitation period applicable to the enforcement of the legal claim in question.
Data processors: not specified
Addressees: Court, public authority, legal representative
Source of data collection: Data provided by the data subject
2.26 Providing the data controller’s clients with the details of employees and subcontractors to enable them to access the client’s premises and carry out work there
Regular or occasional data transfers are necessary for the purposes of identification required for access to and the performance of work at the premises of the Client’s partners.
Legal basis for data processing: Pursuit of the Data Controller’s legitimate interests (Article 6(1)(f)) - The Data Controller’s legitimate interest lies in providing its clients with the details of employees and subcontractor contact persons carrying out work on site, so that the client can identify employees entering the site and carrying out work there, also having regard to the confidential nature of the work carried out.
Scope of data processed: Name, number of photo ID, job title, place of birth, date of birth, mother’s name, telephone number, expiry date of medical fitness certificate, permanent address, portrait (photograph)
Planned duration of data processing: Until the termination of the employee’s employment contract or the client contract.
Data processors: not specified
Recipients/Data controllers: The data controller’s clients
Source of data collection: Data provided by the data subject
2.27 Submission of a professional CV and other information required for the application to the organiser of the call for applications
The provision of the professional CVs of employees and subcontractors, and any other information required in the tender, for the purposes of submitting the tender and – should the tender be successful – carrying out the contract.
Legal basis for data processing: Pursuit of the Data Controller’s legitimate interests (Article 6(1)(f)) - It is in the Data Controller’s legitimate interest to provide the data and professional CV required by the contracting authority to the contracting authority in order to secure and successfully carry out contracts.
Scope of data processed: Name, photograph, details of professional qualifications and experience, professional CV
Planned duration of data processing: Until the closure of the call for applications or until the data subject’s objection is deemed valid
Data processors: not specified
Recipients/Data controllers: The organiser of the call for applications
Source of data collection: Data provided by the data subject
2.28 Monitoring the qualifications and professional development of employees and subcontractors’ staff
Keeping records of the manufacturing qualifications and skills of employees and subcontractor staff.
Legal basis for data processing: Pursuit of the Data Controller’s legitimate interests (Article 6(1)(f)) - It is in the Data Controller’s legitimate interest to hold data on the qualifications and skills of its employees and subcontractors in order to participate in tenders and to ensure the efficient running of its business.
Scope of data processed: Name, photograph, name of the examination, examination reference number, date the qualification was obtained, details of the qualification
Planned duration of data processing: The data deletion date in the first year following the termination of the employment relationship or the termination of the subcontracting relationship, or until the data subject lodges a valid objection
Data processors: not specified
Recipients/Data controllers: not specified
Source of data collection: Data provided by the data subject or the data subject’s employer
2.29 Provision of guest Wi-Fi
The data controller provides Wi-Fi access to guests following registration.
Legal basis for data processing: Consent of the data subject (Article 6(1)(a))
Scope of data processed: Name, email address, employee’s email address (SMP)
Planned duration of data processing: For 1 year from the date of registration or until consent is withdrawn.
Data processors: not specified
Recipients/Data controllers: not specified
Source of data collection: Data provided by the data subject
2.30 Record-keeping for guest car park bookings
The data controller can reserve staff car park spaces for their guests, subject to availability, and the guest will receive confirmation of this by email.
Legal basis for data processing: Pursuit of the Data Controller’s legitimate interests (Article 6(1)(f)). - The Data Controller’s legitimate interest is to provide parking facilities for guests arriving by car and, to this end, to process data and keep a record of car park occupancy
Scope of data processed: Name, registration number, email address
Planned duration of data processing: 30 days from the date of the appointment
Data processors: not specified
Recipients/Data controllers: not specified
Source of data collection: Data provided by the employee who invited the data subject or by the data subjects themselves
2.31 Processing of data relating to contact persons, reporting parties and subcontractors in connection with the alarm monitoring service
In order to provide the emergency response service, the data controller processes the contact details of the contracted partner’s representatives, the details of the person making the report, and the details of the subcontractors’ representatives and personnel directly involved (patrol officers)
Legal basis for data processing: Pursuit of the Data Controller’s legitimate interests (Article 6(1)(f)). – The Data Controller’s legitimate interest lies in recording contact details for the purpose of fulfilling contracts
Scope of data processed: Contact persons: Name, email address, cancellation password, telephone number, Registrant: name, national identity card number, details provided in the registration form, Subcontractor’s employee (patrol officer): name, telephone number, signature
Planned duration of data processing: The date of data erasure four years after the termination of the partnership agreement, or upon the Data Subject’s objections being deemed valid
Data processors: not specified
Recipients/Data controllers: not specified
Source of data collection: Data obtained from the Data Subject’s employer or from the Data Subject
2.32 Making an audio recording of a report received in connection with the alarm monitoring service
The data controller makes an audio recording of any reports received in the course of providing the emergency response service.
Legal basis for data processing: Pursuit of the Data Controller’s legitimate interests (Article 6(1)(f)). - It is in the Data Controller’s legitimate interest to be able to verify reports in the event of a complaint or an enquiry from a regulatory authority, and to be able to trace back the details of the case for the purposes of investigation, in relation to both partner data controllers and partner subcontractors
Scope of data processed: Name, telephone number, details provided in the report (subject, date and time)
Planned duration of data processing: 3 months from the date of recording or until the Data Subject lodges a valid objection
Data processors: not specified
Recipients/Data controllers: not specified
Source of data collection: Data provided by the data subject.
3. Consequences of failure to provide data
Possible consequence of failure to provide data: The purpose of data processing will not be achieved.
4. Stakeholders
Partners under contract with the data controller and the contact persons designated by them, as well as representatives of natural persons or legal entities who purchase the Organisation’s products or use its services.
5. Scope of mandatory data
The Data Controller does not specifically indicate which fields are mandatory on the individual data entry screens where all fields are mandatory. On screens where not all fields are mandatory, the Data Controller indicates the mandatory fields by displaying an asterisk (*).
6. Children
Our products and services are not intended for persons under the age of 18 and do not fall within the scope of information society services. We ask that persons under the age of 18 do not provide any personal data to the Data Controller. Should we become aware that we have collected personal data from a child under the age of 18, we will take the necessary steps to delete such data as soon as possible.
7. Information on the use of data processors
In the course of data processing, the data controller transfers the data to the data processor(s) contracted by it for the purpose of performing the contract.
Categories of data processors: These are set out in point 2 under ‘Purposes of data processing’.
8. The group of persons entitled to access the data
The data controller shall not disclose the data obtained to any third party, with the exception of the data processor(s) and recipients specified in point 7.
8.1 Access to IT backup data
The Data Controller stores IT backups in a separate location subject to access controls. Only staff working in IT operations may access the backed-up data, in accordance with the relevant documentation and procedures. In the event of a restore from a backup, there is a documented procedure for reviewing the data restored from the backup prior to its live use.
8.2 Access to data from the video surveillance system
The data controller does not disclose the recordings to third parties. Only the data controller’s designated staff may access the recordings.
The Data Protection Officer, the Head of Security, the IT operator and the Chief Executive Officer may access recordings previously captured by the electronic surveillance system. Upon request, the Data Subject may access recordings made exclusively of themselves only in the presence of one of the persons mentioned above. In all cases, access must be requested in writing from the Data Protection Officer.
The Data Controller shall draw up a record of each instance of access, which the company shall retain for one year.
8.3 Persons authorised to restrict access to images from the electronic surveillance system
Restrictions on recordings made by the electronic surveillance system may only be imposed in cases where the Data Controller has detected an incident that is likely to jeopardise the objective sought by the electronic surveillance system.
At the Data Subject’s request, the processing of recordings made exclusively of the Data Subject may be restricted. The Data Subject must submit a written request for such restriction to the Data Protection Officer, specifying the purpose and the expected duration of the restriction.
The Data Controller shall draw up a record of every step in the blocking process, which the Data Controller shall retain for 1 year.
8.4 Disclosure of data
The data controller does not disclose the recordings from the electronic surveillance system.
9. Processing of data received from third parties
If the User/Partner provides the Data Controller with the personal data of a natural person other than themselves, it is the sole responsibility of the User/Partner to ensure that such data has been provided with that natural person’s consent, with their knowledge and after they have been duly informed. The Data Controller is under no obligation to verify that these conditions have been met. The Data Controller draws the User’s/Partner’s attention to the fact that if they fail to fulfil this obligation and, as a result, the Data Subject asserts a claim against the Data Controller, the Data Controller may pass on the asserted claim and the amount of any related damages to the User/Partner.
10. Transfer of data to a third country or to an international organisation
The Data Controller will NOT transfer the Data Subject’s personal data or the recordings to a third country outside the European Economic Area or to an international organisation.
11. The rights of data subjects
The Data Subject may contact the Data Controller using the contact details set out in Point 1,
- You may request access to a copy of your personal data held by the data controller.
- you may request the rectification of your personal data,
- you may request information about the purpose and legal basis of data processing
- you may request the erasure of your personal data and the restriction of data processing,
You may exercise the above rights at any time.
The Data Subject may also send it to the Data Controller at one of the contact addresses specified in Point 1.
- You may request that your data be transferred to another data controller, provided that the data processing is based on a contract or consent and is carried out by the Organisation using automated means.
- may withdraw their previously given consent to the processing of their personal data
The Data Controller shall, within one month at the latest following the submission of the request – or, in exceptional cases, within a longer period permitted by law – either process or reject (giving reasons) the request. The Data Controller shall inform the Data Subject in writing of the outcome of the investigation.
11.1 The cost of providing information
The Organisation provides the measures and the necessary information free of charge on the first occasion.
If the Data Subject requests the same data for a second time within a month, and that data has not changed during that period, the Data Controller will charge an administrative fee.
- Administrative costs are accounted for on the basis of the current minimum wage converted to an hourly rate.
- The number of working hours spent on providing information, charged at the aforementioned hourly rate.
- Furthermore, in the event of a request for information in paper form, the cost of printing the reply at cost price and the postage costs.
11.2 Refusal to provide information
If the data subject’s request is clearly unfounded, or if the data subject is not entitled to receive the information, or if the Organisation, as the data controller, is unable to prove that the data subject is in possession of the requested information, the data controller shall reject the request for information.
If, due to the particularly repetitive nature of the data subject’s request – which is excessive – the Organisation may refuse to act on the request if
- This is the third time within a month that the Data Subject has submitted a request to exercise their rights under Articles 15–22 in relation to the same matter.
11.3 The right to protest
The data subject has the right to object at any time to the processing of their personal data on the grounds of legitimate interests or the exercise of official authority.
In such cases, the Organisation may no longer process personal data unless it demonstrates that the processing is justified on compelling legitimate grounds which override the interests, rights and freedoms of the data subject, or which relate to the establishment, exercise or defence of legal claims.
If it determines that the grounds for the objection are well-founded, it shall cease data processing – including data transfer and further data collection – as soon as possible. It shall notify all those to whom it has previously transferred the Data Subject’s data of the objection.
There is no charge for processing the request, except in the case of unfounded or excessive requests, for which the Data Controller may charge a reasonable fee commensurate with its administrative costs. If the Data Subject disagrees with the decision taken by the Data Controller, they may bring the matter before a court.
12. Information on data security measures
The Data Controller processes the data in a closed system in accordance with the requirements of its Information Security Policy.
The Data Controller ensures that data protection is built in by default. To this end, the Data Controller implements appropriate technical and organisational measures to ensure that:
- regulates access to data in detail;
- grant access only to those persons who require the data in order to carry out their duties, and even then, access should be limited to the minimum amount of data necessary to perform those duties;
- select data processors appointed by it with due care and ensure the security of the data by entering into an appropriate data processing agreement;
- ensure the integrity (data integrity), authenticity and protection of the data processed.
The Data Controller shall implement reasonable physical, technical and organisational security measures to protect the Data Subject’s data, in particular against accidental, unauthorised or unlawful destruction, loss, alteration, disclosure, use, access or processing. The Data Controller shall notify the Data Subject without delay in the event of any unauthorised access to or use of personal data which is known to the Data Controller and which poses a high risk to the Data Subject.
Where it is necessary to transfer a Data Subject’s data, the Data Controller shall ensure that the transferred data is adequately protected, for example by encrypting the data file. The Data Controller bears full responsibility for the processing of a Data Subject’s data carried out by third parties.
The Data Controller also ensures, through appropriate and regular backups, that the Data Subject’s data is protected against destruction or loss.
13. Legal remedies
Any data subject who, in their opinion,
(a) if the Data Controller restricts the exercise of the data subject’s rights or rejects a request to that effect, the data subject may lodge a complaint with the National Authority for Data Protection and Freedom of Information to initiate an investigation into the lawfulness of the Data Controller’s action;
(b) in the course of processing your personal data, the Data Controller breaches the legal provisions governing the processing of personal data,
- may request that the National Authority for Data Protection and Freedom of Information conduct a data protection investigation, or
- You may bring a claim against the Data Controller in court and, at your discretion, may also bring the proceedings before the court with jurisdiction over your place of residence or place of stay.
Contact details for the National Authority for Data Protection and Freedom of Information:
Chair: Dr Attila Péterfalvi,
Address: 9–11, Falk Miksa Street, 1055 Budapest.
Postal address: 1363 Budapest, PO Box 9.
Tel: +36-1-3911400
Email: ugyfelszolgalat@naih.hu