{"id":349,"date":"2021-03-20T17:16:38","date_gmt":"2021-03-20T17:16:38","guid":{"rendered":"https:\/\/szemredialapitvany.org\/adatvedelmi-nyilatkozat\/"},"modified":"2022-11-25T08:59:01","modified_gmt":"2022-11-25T07:59:01","slug":"privacy-policy","status":"publish","type":"page","link":"https:\/\/szemredialapitvany.org\/en\/privacy-policy\/","title":{"rendered":"Privacy Policy"},"content":{"rendered":"

This is an English translation of the Foundation’s Hungarian-language privacy documents. In case of any discrepancy, the Hungarian version shall prevail.<\/em><\/p>\n

Data Management and Data Protection Policy<\/strong><\/p>\n

The Board of Trustees of the Szemr\u00e9di Charitable Foundation for the Students of Pannonhalma (Szemr\u00e9di K\u00f6zhaszn\u00fa Alap\u00edtv\u00e1ny a Pannonhalmi Di\u00e1kok\u00e9rt; registered seat: Gy\u00f6ngyvir\u00e1g u. 43\/B., 2030 \u00c9rd, Hungary; hereinafter: the Foundation) lays down the Foundation’s data management and data protection policy (hereinafter: the Policy) as follows.<\/p>\n

1. Scope of the Policy and governing legislation
\n1.1. Personal scope of the Policy
\nThe personal scope of the Policy covers
\na) persons carrying out data processing activities on behalf of the Foundation (the Foundation’s executive officers, employees, or persons working for the Foundation under any other legal relationship), and
\nb) natural persons whose personal data the Foundation manages or processes (data subjects), and, in the case of a deceased data subject, their relatives.<\/p>\n

1.2. Material scope of the Policy
\nThe material scope of the Policy covers the personal data managed or processed by the Foundation as a data controller or data processor.<\/p>\n

1.3. Related legislation
\nThis Policy primarily serves compliance with the following legislation:
\na) Regulation (EU) 2016\/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\/46\/EC (“General Data Protection Regulation”);
\nb) Hungarian Act V of 2013 on the Civil Code (“Civil Code”);
\nc) Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (“Info Act”).
\nUnless otherwise provided in this Policy, the terms used herein shall be interpreted in accordance with the applicable legislation.<\/p>\n

2. Data management by the Foundation
\n2.1. Principles
\n2.1.1. In order to enforce the data subjects’ rights to their personal data, the Foundation respects the principles of data protection law; accordingly, it
\na) processes personal data lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);
\nb) processes personal data only for specified, explicit and legitimate purposes (“purpose limitation”);
\nc) processes only personal data that are adequate and relevant for the purposes of processing, to the extent necessary (“data minimisation”);
\nd) ensures that personal data are accurate and, where necessary, kept up to date, and takes every reasonable step to ensure that personal data that are inaccurate with regard to the purposes of processing are erased or rectified without delay (“accuracy”);
\ne) stores personal data in a form which permits identification of data subjects for no longer than is necessary for the purposes of processing (“storage limitation”);
\nf) processes personal data in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (“integrity and confidentiality”);
\ng) processes personal data in such a way that it is able to demonstrate compliance with the above principles (“accountability”).<\/p>\n

2.2. Legal basis of data processing
\n2.2.1. The Foundation processes personal data only if
\na) the data subject has given consent to the processing of his or her personal data;
\nb) processing is necessary for the performance of a contract with the Foundation to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into such a contract;
\nc) processing is necessary for compliance with a legal obligation to which the Foundation is subject;
\nd) processing is necessary in order to protect the vital interests of the data subject or of another natural person;
\ne) processing is necessary for the purposes of the legitimate interests pursued by the Foundation or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
\n2.2.2. Where the legal basis of processing is that set out in point 2.2.1 e), a prior balancing test shall be carried out. As part of this test,
\na) the legitimate interest of the Foundation or of the third party shall be identified;
\nb) the interests or fundamental rights and freedoms of the data subjects which require the protection of personal data shall be examined.<\/p>\n

2.2.3. Where the outcome of the prior balancing test is not clear, additional safeguards shall be applied to protect the rights of the data subject.<\/p>\n

2.2.4. In accordance with the principle of accountability, the balancing test under points 2.2.2\u20132.2.3 and its outcome shall be documented.<\/p>\n

2.3. The data subject’s right to information
\n2.3.1. The Foundation obtains personal data primarily from the data subjects themselves; in this case, the consent form and the privacy notice annexed to this Policy apply.<\/p>\n

2.3.2. Where the Foundation does not obtain the personal data from the data subject, it shall provide the data subject with the following information:
\na) the contact details of the Foundation;
\nb) the name and contact details of the Chair of the Foundation;
\nc) the purposes of the intended processing of the personal data and the legal basis of processing;
\nd) the categories of personal data concerned;
\ne) the recipients or categories of recipients of the personal data;
\nf) where applicable, in the case of a transfer of personal data to third countries, the information specified in the General Data Protection Regulation;
\ng) the period for which the personal data will be stored or, if that is not possible, the criteria used to determine that period;
\nh) where the legal basis of processing is that set out in point 2.2.1 e), the legitimate interest of the Foundation;
\ni) information on the data subject’s right to request from the Foundation access to, rectification or erasure of personal data or restriction of processing, to object to processing, and on the right to data portability;
\nj) where processing is based on consent, information that consent may be withdrawn at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
\nk) information on the right to lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information as the supervisory authority;
\nl) the source of the personal data and, if applicable, whether the data came from publicly accessible sources.<\/p>\n

2.3.3. Taking into account the specific circumstances of the processing, the information under point 2.3.2 shall be provided to the data subject within a reasonable period after obtaining the personal data, but at the latest within one month. Where the personal data are to be used for communication with the data subject, the information shall be provided at the latest at the time of the first communication.<\/p>\n

2.3.4. The Foundation does not apply the rules on informing the data subject in the cases set out in Article 14(5) of the General Data Protection Regulation.<\/p>\n

2.4. The data subject’s right of access
\n2.4.1. At the data subject’s request, the Foundation informs the data subject whether or not personal data concerning him or her are being processed and, where that is the case, provides access to the personal data and informs the data subject of the following:
\na) the purposes of processing;
\nb) the categories of personal data concerned;
\nc) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
\nd) the envisaged period for which the personal data will be stored or, if that is not possible, the criteria used to determine that period;
\ne) the data subject’s right to request from the Foundation rectification or erasure of personal data or restriction of processing, and to object to such processing;
\nf) the right to lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information;
\ng) where the personal data were not collected from the data subject, any available information as to their source.<\/p>\n

2.4.2. Where personal data are transferred to a third country, the data subject has the right to be informed of the safeguards relating to the transfer.<\/p>\n

2.4.3. At the data subject’s request, the Foundation provides a copy of the personal data undergoing processing. For any further copies requested by the data subject, the Foundation may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, the information shall be provided in a commonly used electronic form, unless otherwise requested by the data subject. The right to obtain a copy shall not adversely affect the rights and freedoms of others.<\/p>\n

2.5. Right to rectification
\n2.5.1. At the data subject’s request, the Foundation rectifies inaccurate personal data concerning the data subject without undue delay and, taking into account the purposes of processing, ensures that incomplete personal data are completed at the data subject’s request.<\/p>\n

2.5.2. The right to rectification may be restricted only where the exceptions set out in the General Data Protection Regulation apply.<\/p>\n

2.5.3. The Foundation communicates any rectification to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. At the data subject’s request, the Foundation informs the data subject about those recipients.<\/p>\n

2.6. Right to erasure
\n2.6.1. At the data subject’s request, the Foundation erases personal data concerning the data subject without undue delay where
\na) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
\nb) the data subject withdraws the consent on which the processing is based and there is no other legal ground for the processing;
\nc) the data subject objects to the processing and there are no overriding legitimate grounds for the processing;
\nd) the personal data of the data subject have been unlawfully processed;
\ne) the personal data have to be erased for compliance with a legal obligation under Union or Member State law to which the Foundation is subject;
\nf) the personal data have been collected in relation to the offer of information society services to children.<\/p>\n

2.6.2. The right to erasure may be restricted only where the exceptions set out in the General Data Protection Regulation apply.<\/p>\n

2.6.3. The Foundation communicates any erasure to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. At the data subject’s request, the Foundation informs the data subject about those recipients.<\/p>\n

2.7. Right to restriction of processing
\n2.7.1. At the data subject’s request, the Foundation restricts processing where<\/p>\n

a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
\nb) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
\nc) the Foundation no longer needs the personal data for the purposes of processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
\nd) the data subject has objected to processing carried out on the basis of legitimate interest or in the public interest, pending the verification whether the legitimate grounds of the controller override those of the data subject.<\/p>\n

2.7.2. The Foundation communicates any restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. At the data subject’s request, the Foundation informs the data subject about those recipients.<\/p>\n

2.8. Right to data portability
\n2.8.1. The data subject has the right to receive the personal data concerning him or her, which he or she has provided to the Foundation, in a structured, commonly used and machine-readable format, and has the right to transmit those data to another controller, where<\/p>\n

a) the processing is based on consent or on a contract as the legal basis under the General Data Protection Regulation, or
\nb) the processing is carried out by automated means.<\/p>\n

2.8.2. The exclusion and restriction of the right to data portability are governed by the rules of the General Data Protection Regulation.<\/p>\n

2.9. Right to object
\n2.9.1. The data subject has the right to object at any time, on grounds relating to his or her particular situation, to processing carried out in the public interest or on the basis of legitimate interest, including profiling. In this case, the Foundation may no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or which relate to the establishment, exercise or defence of legal claims.<\/p>\n

2.9.2. The right to object shall be explicitly brought to the attention of the data subject at the latest at the time of the first communication with the data subject, and shall be presented clearly and separately from any other information.<\/p>\n

2.10. Handling of personal data breaches
\n2.10.1. The Foundation notifies a personal data breach related to its processing to the Hungarian National Authority for Data Protection and Freedom of Information without undue delay and, where feasible, not later than 72 hours after having become aware of it. Where the notification is not made within 72 hours, it shall be accompanied by reasons for the delay. To comply with this obligation, persons working for the Foundation shall immediately inform the Chair of the Foundation’s Board of Trustees of any personal data breach that comes to their knowledge.<\/p>\n

2.10.2. Notification is not required where the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. The decision not to notify is made by the Chair of the Foundation’s Board of Trustees, having considered all the circumstances of the case.<\/p>\n

2.10.3. The Foundation keeps a record of personal data breaches, comprising the facts relating to the breach, its effects and the remedial action taken.<\/p>\n

2.10.4. The Foundation informs the data subject of a personal data breach without undue delay where the breach is likely to result in a high risk to the rights and freedoms of natural persons. This decision is made by the Chair, having regard to all the circumstances of the case, and is recorded in a memorandum.<\/p>\n

2.10.5. The Foundation does not notify the data subject of a personal data breach where
\na) it has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the breach, in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption; or
\nb) it has taken subsequent measures which ensure that the high risk to the rights and freedoms of the data subject is no longer likely to materialise; or
\nc) informing the data subjects would involve disproportionate effort, in which case the data subjects shall be informed by means of a public communication or a similar measure whereby they are informed in an equally effective manner.<\/p>\n

3. Categories of personal data processed
\n3.1. Personal data processed by the Foundation in connection with the provision of support:
\na. name of the parent exercising parental custody or of the guardian
\nb. birth name of the parent exercising parental custody or of the guardian
\nc. place and date of birth of the parent exercising parental custody or of the guardian
\nd. mother’s name of the parent exercising parental custody or of the guardian
\ne. address of the parent exercising parental custody or of the guardian
\nf. social security (TAJ) number of the parent exercising parental custody or of the guardian
\ng. bank account number of the parent exercising parental custody or of the guardian
\nh. telephone number of the parent exercising parental custody or of the guardian
\ni. email address of the parent exercising parental custody or of the guardian
\nj. legal status of the parent exercising parental custody or of the guardian (parent exercising parental custody, guardian)
\nk. monthly net income and benefits of the parent exercising parental custody or of the guardian
\nl. name of the minor or adult student
\nm. mother’s name of the minor or adult student
\nn. place and date of birth of the minor or adult student
\no. social security (TAJ) number of the minor or adult student
\np. address of the minor or adult student
\nq. other financial, health or family status data provided by the parents for the support procedure
\nr. academic results of the minor or adult student and data on his or her service to the school
\ns. amount of support requested and the reasons for it
\nThe Foundation processes the above personal data related to support provided to beneficiaries on the basis of the beneficiaries’ consent and until such consent is withdrawn, but at the latest until the end of the support procedure (transfer of the amount of support). Any withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
\n3.2. Data processed in connection with donations made to the Foundation:
\nFor business entities:
\na. company name
\nb. registered seat
\nc. company registration number
\nd. tax number
\ne. managing director’s email address
\nf. managing director’s telephone number
\ng. managing director’s surname and first name<\/p>\n

For civil society organisations:
\na. name
\nb. registered seat
\nc. registration number
\nd. tax number
\ne. email address
\nf. telephone number
\ng. surname, first name and position of the legal representative<\/p>\n

For local governments:
\na. name
\nb. Hungarian State Treasury (M\u00c1K) registration number (PIR)
\nc. tax number
\nd. first name, surname, telephone number and email address of the mayor
\ne. registered seat<\/p>\n

For natural persons:
\na. name
\nb. tax identification number
\nc. email address
\nd. telephone number
\ne. address<\/p>\n

Pursuant to Section 169(2) of Hungarian Act C of 2000 on Accounting, data related to donations are processed for at least 8 years following the completion of the donation. If the donor consents, his or her name will be displayed among the donors on the Foundation’s website; the legal basis of this processing is the donor’s consent under Article 6(1)(a) GDPR. These data are processed until the donor withdraws his or her consent.
\nSince the personal data provided come directly from the data subjects, the person providing the data is responsible for the accuracy of the data and for reporting any changes to them.<\/p>\n

4. Joint controllership
\n4.1. In the case of joint controllership, the Foundation and the other controllers shall determine, in an arrangement that takes into account their respective roles and relationships vis-\u00e0-vis the data subjects, their respective responsibilities for compliance with the obligations under the General Data Protection Regulation, in particular as regards the exercise of the rights of the data subjects and the provision of information. In the arrangement, the Foundation and the other controllers shall designate a joint contact point for data subjects.<\/p>\n

4.2. The essence of the arrangement referred to in point 4.1 shall be made available to the data subject upon request.<\/p>\n

4.3. The rights of the data subject shall be ensured even if he or she wishes to exercise them otherwise than as provided in the arrangement referred to in point 4.1.<\/p>\n

5. Use of data processors, data processing agreements
\n5.1. As a controller, the Foundation uses only data processors that comply with the requirements of the General Data Protection Regulation. The data processing agreement shall be concluded in writing and shall meet the content requirements set out in this section.<\/p>\n

5.2. The data processing agreement shall stipulate that the processor may engage another processor only with the prior authorisation of the Foundation. Where the Foundation gives general authorisation for the engagement of further processors, the agreement shall stipulate that the processor must inform the Foundation of any change of the further processors engaged, and the Foundation may object to such further processor, which objection the processor must take into account.<\/p>\n

5.3. Where the processor engages the services of a further processor with the Foundation’s consent, the processor shall impose on that further processor the same data protection obligations as those set out in the agreement between the Foundation and the processor.<\/p>\n

5.4. The data processing agreement shall stipulate that the processor may process personal data only on the documented instructions of the Foundation. Where processing is required by law applicable to the processor, the processor shall inform the Foundation of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.<\/p>\n

5.5. The agreement shall stipulate that personal data may be processed only by persons who have committed themselves to confidentiality in writing or are under an appropriate statutory obligation of confidentiality.<\/p>\n

5.6. The agreement shall stipulate that the processor shall ensure the data security requirements set out in the General Data Protection Regulation.<\/p>\n

5.7. The agreement shall state that the processor shall assist the Foundation, by appropriate technical and organisational measures and insofar as this is possible, in fulfilling its obligation to respond to requests for exercising the data subject’s rights.<\/p>\n

5.8. The agreement shall stipulate that the processor assists the Foundation in ensuring compliance with its obligations concerning the security of processing, the notification of personal data breaches to the authority, the communication of personal data breaches to data subjects, data protection impact assessments and prior consultation. The agreement shall state that the processor shall inform the Foundation without delay of any personal data breach that comes to its knowledge.<\/p>\n

5.9. The agreement shall stipulate that, after the end of the processing, the processor shall, at the choice of the Foundation, delete all personal data or return them to the Foundation, and delete existing copies, unless Union or Hungarian law requires storage of the personal data.<\/p>\n

5.10. The agreement shall stipulate that the processor shall make available to the Foundation all information necessary to demonstrate compliance with the obligations laid down in the General Data Protection Regulation, and shall allow for and contribute to audits, including inspections, conducted by the Foundation or another auditor mandated by the Foundation.<\/p>\n

5.11. The agreement shall stipulate that the processor shall immediately inform the Foundation if, in its opinion, an instruction infringes the General Data Protection Regulation or other Hungarian or Union data protection provisions.<\/p>\n

6. Records of processing activities
\n6.1. The Foundation keeps records of its processing activities with specified content.<\/p>\n

6.2. The Chair of the Board of Trustees is responsible for keeping the records. Employees of the Foundation are obliged to report to the Chair any planned activities involving the processing of personal data. The Chair, after obtaining a legal opinion where necessary, records the change in the Foundation’s records.<\/p>\n

7. Final provisions
\n7.1. This Policy of the Foundation enters into force on 1 February 2025 for an indefinite period.<\/p>\n

 <\/p>\n

 <\/p>\n

Privacy Notice<\/strong><\/p>\n

The Szemr\u00e9di Charitable Foundation for the Students of Pannonhalma (registered seat: Gy\u00f6ngyvir\u00e1g u. 43\/B., 2030 \u00c9rd, Hungary; hereinafter: the Foundation) hereby informs the beneficiaries of the financial support provided by the Foundation, as well as the donors making donations to the Foundation, about the personal data processed in connection with the administration of donations, the practices followed in the processing of personal data, the measures taken to protect personal data, and the ways and means by which data subjects may exercise their rights.<\/p>\n

This privacy notice is based on the provisions of Regulation (EU) 2016\/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\/46\/EC (hereinafter: GDPR), Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (hereinafter: Info Act), and Hungarian Act V of 2013 on the Civil Code.<\/p>\n

1. The controller
\nname: Szemr\u00e9di K\u00f6zhaszn\u00fa Alap\u00edtv\u00e1ny a Pannonhalmi Di\u00e1kok\u00e9rt (Szemr\u00e9di Charitable Foundation for the Students of Pannonhalma)
\nregistered seat: Gy\u00f6ngyvir\u00e1g u. 43\/B., 2030 \u00c9rd, Hungary
\nrepresented by: Gabriel Jakobszen, Chair of the Board of Trustees
\nemail: iroda@szemredialapitvany.org
\nwebsite: https:\/\/szemredialapitvany.org\/
\nThe Foundation is responsible for the lawful processing of the personal data it processes.<\/p>\n

2. Name and contact details of the data protection officer
\nname:
\nemail:
\ntelephone:<\/p>\n

3. Legal basis and purpose of processing
\nProcessing of the data of supported persons:
\nUnder Article 6(1)(a) GDPR, the processing of the data of persons supported by the Foundation requires the consent of the supported person’s representative. The data subject has the right to withdraw his or her consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.<\/p>\n

Processing for the purpose of donations:
\nThe legal basis for processing the donor’s personal data is the consent given by the donor under Article 6(1)(a) GDPR.
\nThe legal basis for processing the data necessary to fulfil the tax and accounting obligations arising in connection with the donation is Article 6(1)(c) GDPR.
\nThe Foundation processes the personal data set out in point 4 in order to establish eligibility for donations, to manage the donations made to the Foundation, to decide on grants on this basis, and to provide grants to the beneficiaries.<\/p>\n

4. Categories of personal data processed, duration of processing, source of the data
\nA) Personal data processed by the Foundation in connection with the provision of support:
\na. name of the parent exercising parental custody or of the guardian
\nb. birth name of the parent exercising parental custody or of the guardian
\nc. place and date of birth of the parent exercising parental custody or of the guardian
\nd. mother’s name of the parent exercising parental custody or of the guardian
\ne. address of the parent exercising parental custody or of the guardian
\nf. social security (TAJ) number of the parent exercising parental custody or of the guardian
\ng. bank account number of the parent exercising parental custody or of the guardian
\nh. telephone number of the parent exercising parental custody or of the guardian
\ni. email address of the parent exercising parental custody or of the guardian
\nj. legal status of the parent exercising parental custody or of the guardian (parent exercising parental custody, guardian)
\nk. monthly net income and benefits of the parent exercising parental custody or of the guardian
\nl. name of the minor or adult student
\nm. mother’s name of the minor or adult student
\nn. place and date of birth of the minor or adult student
\no. social security (TAJ) number of the minor or adult student
\np. address of the minor or adult student
\nq. other financial, health or family status data provided by the parents for the support procedure
\nr. academic results of the minor or adult student and data on his or her service to the school
\ns. amount of support requested and the reasons for it
\nThe Foundation processes the above personal data related to support provided to beneficiaries on the basis of the beneficiaries’ consent and until such consent is withdrawn, but at the latest until the end of the support procedure (transfer of the amount of support). Any withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
\nB) Data processed in connection with donations made to the Foundation:
\nFor business entities:
\ncompany name
\nregistered seat
\ncompany registration number
\ntax number
\nemail address
\ntelephone number
\nmanaging director’s surname and first name<\/p>\n

For civil society organisations:
\nname
\nregistered seat
\nregistration number
\ntax number
\nemail address
\ntelephone number
\nsurname, first name and position of the legal representative<\/p>\n

For local governments:
\nname
\nHungarian State Treasury (M\u00c1K) registration number (PIR)
\ntax number
\nfirst name, surname, telephone number and email address of the mayor
\nregistered seat<\/p>\n

For natural persons:
\nname
\ntax identification number
\nemail address
\ntelephone number
\naddress<\/p>\n

Pursuant to Section 169(2) of Hungarian Act C of 2000 on Accounting, data related to donations are processed for at least 8 years following the completion of the donation. If the donor consents, his or her name will be displayed among the donors on the Foundation’s website; the legal basis of this processing is the donor’s consent under Article 6(1)(a) GDPR. These data are processed until the donor withdraws his or her consent.
\nSince the personal data provided come directly from the data subjects, the person providing the data is responsible for the accuracy of the data and for reporting any changes to them.<\/p>\n

5. Access to the data, data security measures and data transfers
\nApart from the bodies entitled to carry out inspections, full access to the personal data provided by the data subjects is available only to the Board of Trustees, the Foundation’s employees bound by confidentiality, and the data processor, acting solely within their competence and for the performance of their tasks. The data are processed by email, on paper and stored on computers, in such a way that both the paper-based and the electronic documents are accessible only to the persons mentioned. Personal data stored on paper are kept at the Foundation’s registered seat; as regards data processed electronically, the Foundation ensures the protection of the personal data provided by appropriate IT security measures, including protection against unauthorised access and unauthorised alteration.<\/p>\n

In connection with the exercise of its rights and the fulfilment of its obligations, and after careful consideration of all the circumstances of the case, the controller may disclose personal data to a defined group of recipients whose members may change, consisting of the controller’s accountant, tax adviser, legal adviser, data protection officer and the persons managing its payment account identifiers. Apart from this group, no data are transferred to third parties, to other countries or to international organisations.<\/p>\n

6. Rights of the data subject in relation to data processing
\na) The data subject’s right of access to the personal data processed:
\nBeneficiaries of donations may request information about the personal data processed concerning them, the source of the data, the purpose, legal basis and duration of processing, the name and address of the data processor and its activities related to the processing, the circumstances and effects of any personal data breach and the measures taken to remedy it, and, in the case of data transfer, its legal basis and recipient.<\/p>\n

b) Rectification of the personal data processed:
\nThe data subject may request the rectification of his or her personal data if they do not correspond to reality, are inaccurate or need to be completed.
\nRequests under points a) and b) may be submitted by email to iroda@szemredialapitvany.org or by post addressed to the Foundation.
\nc) The data subject’s right to erasure of the personal data processed:
\nWithin the 8-year retention period, the erasure of personal data processed in connection with donations cannot be requested, unless the processing is unlawful.
\nd) The data subject’s right to restriction of his or her personal data:
\nIf the data subject contests the accuracy of the personal data processed, his or her personal data will be restricted, at his or her request, until the accuracy has been verified.
\ne) Right to data portability:
\nThe data subject may exercise his or her right to data portability and, in this context, may request that his or her data be provided in a structured, commonly used and machine-readable format or, where technically feasible, transmitted to a third party designated by the data subject.
\nThe Foundation fulfils requests for information on the personal data processed, rectification, erasure (withdrawal of consent to processing), restriction and data portability within 30 days of receipt of the request or, if this is not possible, notifies the data subject of the obstacle, stating the factual and legal reasons for the refusal, together with information on the available legal remedies.<\/p>\n

7. Legal remedies available to the data subject in relation to data processing
\nIn the event of unlawful processing, the data subject may first turn to the Foundation, as the controller of his or her personal data, to remedy the infringement. The data subject may also initiate an investigation with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) or bring the matter before a court.<\/p>\n

Anyone may initiate an investigation with the NAIH (seat: Falk Miksa utca 9\u201311., 1055 Budapest, Hungary; postal address: Pf. 9., 1363 Budapest, Hungary; email: ugyfelszolgalat@naih.hu) by filing a report alleging that an infringement has occurred in connection with the processing of his or her personal data, or that there is an imminent risk thereof.<\/p>\n

If the data subject considers that his or her rights have been infringed as a result of the Foundation’s processing, he or she may bring the matter before a court. The court handles such cases as a matter of priority.<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

This is an English translation of the Foundation’s Hungarian-language privacy documents. In case of any discrepancy,…<\/p>\n","protected":false},"author":5,"featured_media":0,"parent":0,"menu_order":99,"comment_status":"closed","ping_status":"closed","template":"fullwidth.php","meta":{"footnotes":""},"class_list":["post-349","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/szemredialapitvany.org\/en\/wp-json\/wp\/v2\/pages\/349","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/szemredialapitvany.org\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/szemredialapitvany.org\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/szemredialapitvany.org\/en\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/szemredialapitvany.org\/en\/wp-json\/wp\/v2\/comments?post=349"}],"version-history":[{"count":2,"href":"https:\/\/szemredialapitvany.org\/en\/wp-json\/wp\/v2\/pages\/349\/revisions"}],"predecessor-version":[{"id":351,"href":"https:\/\/szemredialapitvany.org\/en\/wp-json\/wp\/v2\/pages\/349\/revisions\/351"}],"wp:attachment":[{"href":"https:\/\/szemredialapitvany.org\/en\/wp-json\/wp\/v2\/media?parent=349"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}