Data Protection Policy

Privacy Policy

FOR DATA PROCESSING REALISED THROUGH THE SHMENTOR.HU WEBSITE

I Controller profile

Name of Controller: The National Union of Students in Hungary
Registration number of the Controller: 799656
Registered Seat of the Controller:1053 Budapest, Ferenciek tere 7-8.
E-mail address of the Controller:info@hook.hu
Representative of the Controller:László Murai, President

II Relevant major data processing-related laws

- - Act CXII of 2011 on Informational Self-Determination and Freedom of Information (hereinafter referred to as Info Act),

- - Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as: Regulation or GDPR),

- - Act V of 2013 on the Civil Code (hereinafter referred to as: Ptk).

III Principles applicable to data processing

• The Controller shall process personal data in a legal, fair and transparent manner.

• The Controller shall collect personal data exclusively with defined, unequivocal and legal purposes and shall not process the collected data in a manner not harmonised with these purposes.

• The Controller shall take all reasonable measures in order to ensure that the processed data is accurate and, if required, up-to-date. Should the Controller become aware of the fact that any of the personal data processed by them is inaccurate, the immediate erasure or rectification of said data shall be required.

• The Controller shall store personal data in a format that allows their identification exclusively for the required time period and/or the time period stipulated by the law.

• By applying the adequate technical and organizational measures, the Controller shall ensure the sufficient safety of personal data in order to avoid any incidental unauthorised or illegal processing, unintentional loss, destruction or damage of the personal data.

IV Characteristics of data processing

1 Data processing for utilising services provided through a website (registration)

Purpose of the data processing

Primarily, the purpose of the data processing is for you to utilise our services provided through the website, which requires your identification that is carried out through registering your profile. Secondly, we also process your data so you could provide information and interesting details about yourself, which can help you community integration and allow us to provide you with services that best suit your needs, including providing you with the most suitable mentor.

Scope of processed data

It is mandatory to provide the following data for your registration:

a) your name

b) country of origin

c) the higher education institute you’re studying at

d) the faculty and higher education programme you’re attending

e) your e-mail address

f) your sex

g) your password

Providing the following information is not compulsory, you can decide whether you wish to authorise us to process any of the following data:

a) your date of birth

b) your citizenship

c) your religion

d) data related to your health (e.g. allergies)

Legal grounds for data processing

The legal grounds for our data processing is Article 6, paragraph (1), point e) of the Regulation, i.e. the performance of our public duties.

You are authorised to subsequently erase your data which is not required for your registration, i.e. which you have provided to us at your own discretion. Should you choose to delete this data from your profile, their processing shall be discontinued. The legal grounds of this set of data is Article 6, paragraph (1), point a) of the Regulation.

Recipients of the provided personal data

The data you provide upon registration shall only be accessed by the administrator(s) of the HÖOK whose task(s) require said access.

The service provider involved in the operation of the website is authorise to process your data in relation to ensuring the operability of the website and remedying any possible errors. As the service provider is not authorised to determine the purpose and means of the data processing, they constitute a Processor.

Processor commissioned for the operation of the website: Roland Király individual entrepreneur (registered seat: 3300 Eger, Gyóni Géza utca 21/a.; tax number: 64371027-1-30)

The Processor may only process your personal data for the predetermined and contractually stipulated purpose, according to our instructions and has no authority to make independent decisions. Processor is bound by a confidentiality obligation and contractual guarantees in relation to the personal data it has been privy to during the fulfilment of its tasks.

Forwarding personal data to a third country or international organisation

Your above-listed personal data shall not be forwarded to any third countries or international organisations.

Duration of the data processing

The data you have provided shall be processed for no longer than 30 days subsequent to the termination of your registration.

You may delete data not required for your registration from your profile at any time, in which case we shall cease to process said data.

Automated decision-making and profiling

Neither of these is employed in the course of the data processing.

Provision of personal data

It is mandatory to provide the data for registration in order to access the services available through the website, while providing additional data (not required for registration) is voluntary.

2 Information on the cookies used by the website

Purpose of the data processing

Our website uses various cookies (files installed on the hard drives of the data subject’s computer) in order to optimise the services we provide. We use further cookies in order to ensure that our website is displayed according your needs. Furthermore, we utilise the services of Google Analytics through which additional cookies are installed on your computer; these are used by Google to prepare anonymous statistics for us in relation to our website traffic.

Detailed information on the Google Analytics service is available through the following link: https://www.google.com/analytics/terms/us.html

Cookies employed by our website

Type of cookie:
Name of cookie:
Function of cookie:
Expiration date of cookie*
Session analytics persistent cookie
_gid
Google provides little information on the function of the cookie; similarly to the _ga cookie, the _gid cookie is used to differentiate users. The cookie is installed on your computer as part of the Google Analytics service we are utilizing, therefore the function of the cookie is most likely to facilitate the collection of data to prepare anonymous statistics on our website traffic. No conclusions can be drawn on your person based on the cookie as the function of the cookie is the individual identification of your browser.
1 day
Session analytics persistent cookie
_ga
According to Google, the cookie is for distinguishing unique users visiting our website. The purpose of this is to gather information to prepare anonymous statistics on our website traffic. No conclusions can be drawn on your person based on the cookie as the function of the cookie is the individual identification of your browser.
2 years
Authentication permanent cookie
cookie-layer
Upon adjusting your cookies settings when visiting our website for the first time, the purpose of this cookie is to memorise your preferences related to the installation of cookies and when you visit our website again, it automatically applies your cookie settings.
3.5 months
Throttle request rate session cookie
_gat_gtag_UA
According to Google, the cookie is used to regulate the frequency of requests from your computer, which can control the data transmission speed from your computer. This is required to ensure the stable operation of our website even in the case of high traffic, which requires the identification of your computer.
2 minutes
Authentication session cookie
PHPSESSID
The function of the cookie is to create a so-called session ID on your computer when you log into the account you created on our website. The session ID allows us to identify you by providing your e-mail address and password, allowing you to access parts of our website which you could only access by providing said personal data. Without this cookie, even after logging in, every new data request (when logging in, you are at the main menu of your account and by clicking on the ‘my profile’ item on the main menu, this constitutes a new data request) would require you to provide your data again.
Until the end of the browsing process. (Logout or closing the browser.)
*The cookie will only remained installed for a certain period subsequent to installation and will be automatically deleted after the predefined period. Furthermore, in relation to cookies, we hereby inform you that prior to their expiry, you can manually remove installed cookies from your browser. Detailed information on this is available at the following link: https://support.google.com/chrome/answer/95647?co=GENIE.Platform%3DAndroid&hl=hu

Scope of processed data

Your IP address, operating system, the type of browser used on your computer and your user habits in relation to the use of our website.

Legal grounds for data processing

In the case of the PHPSESSID and _gat_gtag_UA cookies, the legal grounds for our data processing is Article 6, paragraph (1), point e) of the Regulation, i.e. the performance of our public duties, whilst in the case of _gid, _ga and cookie-layer cookies, the legal grounds is Article 6, paragraph (1), point a) of the Regulation.

Recipients of the provided personal data

Your provided data shall only be accessed by the administrator(s) of the HÖOK whose task(s) require said access as well as those entrusted with operating the website; your data shall not be forwarded to any third parties.

The operator of the website is authorised to process your data in relation to ensuring the operability of the website and remedying any possible errors. As they are not obliged to determine the purpose and means of the data processing, the operator of the website shall be regarded as a Processor.

Processor entrusted with the operation of the website: Roland Király individual entrepreneur (registered seat: 3300 Eger, Gyóni Géza utca 21/a.; tax number: 64371027-1-30)

Forwarding personal data to a third country or international organisation

Your above-listed personal data shall not be forwarded to any third countries or international organisations.

Duration of the data processing

In the case of the PHPSESSID and _gat_gtag_UA cookies (cookies required for the operation of the website), the duration of the processing of your personal data is listed under the “Cookies employed by our website” section, whilst in relation to the _gid, _ga and cookie-layer cookies, by providing consent, your personal data shall be processed until the withdrawal of consent. In the case of cookies that require consent, your consent may be withdrawn by deleting said cookies from your computer.

Due to the fact that cookies can be deleted in different ways or external programmes, depending on the browser type, this shall not be detailed in the present document, yet more information on the subject is available through the following links.

For detailed information on the manual removal of installed cookies, please refer to the following link: https://support.google.com/chrome/answer/95647?co=GENIE.Platform%3DAndroid&hl=hu

https://support.mozilla.org/hu/kb/weboldalak-altal-elhelyezett-sutik-torlese-szamito

https://support.microsoft.com/hu-hu/help/278835/how-to-delete-cookie-files-in-internet-explorer

https://support.apple.com/hu-hu/guide/safari/sfri11471/mac

Further options for deleting cookies include the use of various hard drive management programmes, such as the effective solution offered by CCleaner by Piriform, which you can install for free. (In relation to the CCleaner programme, we must note that we are not carrying out any promotional activities in relation to the software in question, merely offering assistance and relevant information by designating a specific software suitable for the removal of cookies, yet in light of the recent spyware scandal tied to the CCleaner programme, we primarily recommend using the means of removal outlined in the above-listed links.)

Automated decision-making and profiling

Neither of these is employed in the course of the data processing.

Provision of personal data

Providing data by logging into the website is automatic and obligatory, with the exception of data processing based on consent, in which case the data processing is based on express and voluntary consent.

3 Data processing related to the application for Events

Purpose of the data processing

Primarily, the purpose of the data processing is to record your application for an organised event, which requires your identification. Secondly, the purpose of the data processing is to provide us with data that is required for you to employ services related to the event.

Scope of processed data

In relation to applications for events, we primarily process your name and contact information (e-mail address, phone number), yet on an occasional basis, it may be necessary to provide further information in order to employ certain services tied to the event in question.

Insofar as participating in the event requires providing further data, we shall provide further information on the nature of the data processing in advance.

Legal grounds for data processing

The legal grounds for our data processing is Article 6, paragraph (1), point e) of the Regulation, i.e. the performance of our public duties.

Recipients of the provided personal data

The data you provide shall only be accessed by the administrator(s) of the HÖOK whose task(s) require said access. Additionally, based on individual settings, other applicants applying for the event may see that you are attending said event.

Your data may be forwarded to the service providers hosting the event; in this case, these service providers shall be regarded as a Processors. When forwarding your data to the service provider hosting the event, we shall provide you with additional information on said forwarding.

Forwarding personal data to a third country or international organisation

Your above-listed personal data shall not be forwarded to any third countries or international organisations.

Duration of the data processing

Your data shall be processed for 30 days subsequent to the event.

Automated decision-making and profiling

Neither of these is employed in the course of the data processing.

Provision of personal data

Applying for the event requires the provision of data.

4 Data processing related to the dispatching of e-mail

Purpose of the data processing

The purpose of the data processing is to allow you to contact all users registered through the website so you could communicate with one another via messaging. This includes contacting your mentor, other registered students and the instructors hosting our courses via messaging.

Beyond contacting one another via messaging, in relation to the events and courses, you may also get involved in a public discussion (Wall chat) with those who attend said event or course. You may regulate the visibility of your participation in an event based on your individual settings. Detailed information on the WALL chat service is included in our General Terms and Conditions.

Scope of processed data

Your name, the contents of your message and the name of the recipient of the message.

Legal grounds for data processing

The legal grounds for our data processing is Article 6, paragraph (1), point e) of the Regulation, i.e. the performance of our public duties.

Recipients of the provided personal data

The data you provide upon registration shall only be accessed by the administrator(s) of the HÖOK whose task(s) require said access and those you have sent a message to.

Processor entrusted with the operation of the website: Roland Király individual entrepreneur (registered seat: 3300 Eger, Gyóni Géza utca 21/a.; tax number: 64371027-1-30)

Forwarding personal data to a third country or international organisation

Your above-listed personal data shall not be forwarded to any third countries or international organisations.

Duration of the data processing

Your data shall be processed until the erasure of your registration.

Automated decision-making and profiling

Neither of these is employed in the course of the data processing.

Provision of personal data

Upon using the messaging function, the provision of data is automatic and mandatory.

5 Data processing related to profile pictures

Purpose of the data processing

The purpose of our data processing is to provide you with the opportunity of uploading a single image for your profile, allowing other users (data subjects) to easily recognise and identify you, thus facilitating your community integration, which is one of the basic goals of the creation and operation of the network.

Scope of processed data

The image you uploaded to the interface featuring your likeness.

Legal grounds for data processing

The legal grounds for our data processing is Article 6, paragraph (1), point e) of the Regulation, i.e. the performance of our public duties.

Recipients of the provided personal data

The data you provide upon registration shall only be accessed by the administrator(s) of the HÖOK whose task(s) require said access and those who applied for the event you wish to attend.

Processor entrusted with the operation of the website: Roland Király individual entrepreneur (registered seat: 3300 Eger, Gyóni Géza utca 21/a.; tax number: 64371027-1-30)

Forwarding personal data to a third country or international organisation

Your above-listed personal data shall not be forwarded to any third countries or international organisations.

Duration of the data processing

The processing of your data shall take place until you erase your data.

Automated decision-making and profiling

Neither of these is employed in the course of the data processing.

Provision of personal data

The data is provided on a voluntary basis.

6 Data processing related to applications for our courses

Through our website, we provide you with the opportunity of attending various courses. The purpose of these courses is for you to familiarise the culture of our country and to help overcome the communication challenges arising through cultural differences. At the end of the weekly training sessions included in the course, there is an opportunity to complete a worksheet consisting of questions as well as a final worksheet at the end of the semester, allowing you to win valuable prizes by providing the right answers.

Scope of processed data

In relation to our courses and the exam concluding said courses, we primarily process your name and contact information (e-mail address).

Insofar as participating in the event requires providing further data, we shall provide further information on the nature of the data processing in advance prior to commencing the data processing.

Legal grounds for data processing

The legal grounds for our data processing is Article 6, paragraph (1), point e) of the Regulation, i.e. the performance of our public duties.

Recipients of the provided personal data

The data you provide shall only be accessed by the administrator(s) of the HÖOK whose task(s) require said access. Additionally, based on individual settings, others attending the course may see that you are attending said course.

Your data may be forwarded to the instructor hosting the course; in this case, said instructors shall be regarded as a independent Processors.

Forwarding personal data to a third country or international organisation

Your above-listed personal data shall not be forwarded to any third countries or international organisations.

Duration of the data processing

Your data shall be processed for 30 days subsequent to the examination concluding the course.

Automated decision-making and profiling

Neither of these is employed in the course of the data processing.

Provision of personal data

Applying for courses requires the provision of data.

7 Data processing related to the handling of complaints

Purpose of the Data processing

In order to fulfil our legal obligation pursuant to Section 17/A of Act CLV of 1997 on Consumer Protection (hereinafter as Fgytv.), we shall provide an opportunity to file complaints orally or in writing, via e-mail or post – which are to be forwarded to our registered seat – in relation to our website and the services provided through our website. Insofar as the complaint is not filed in writing, we shall draw up minutes of the contents of the complaint and any submitted documents pursuant to Section 17/A paragraph (5) of the Fgytv., which shall include your personal data according to the contents of the present Policy.

Scope of processed personal data

The scope of personal data constituting the contents of the minutes is determined by law (Section 17/A. paragraph (5) of the Fgytv.), pursuant to which this includes the following personal data:

a) your name,

b) your address,

c) the place, date and form of submitting the complaint,

d) the detailed description of your complaint and the personal data included in the list of documents and evidence presented,

e) your signature in the case of complaints submitted in writing,

f) the individual identification number of the complaint.

Legal grounds for data processing

The legal grounds for our data processing is Article 6, paragraph (1), point e) of the Regulation, i.e. the processing of personal data in the performance of public duties.

Recipients of the provided personal data

The data you provide upon registration shall only be accessed by the administrator(s) of the HÖOK whose task(s) require said access and those who applied for the event you wish to attend.

We employed the following Processor for the storage of the letters of complaint sent to us: Telekom Nyrt. as web hosting service provider.

Processor may only process your personal data for the predetermined and contractually stipulated purposes, according to our instructions and has no authority to make independent decisions. Processor is bound by a confidentiality obligation and contractual guarantees in relation to the storage of the personal data it has been privy to during the fulfilment of its tasks.

Forwarding personal data to a third country or international organisation

Your above-listed personal data shall not be forwarded to any third countries or international organisations.

Duration of the processing of personal data

Pursuant to Section 17/A. paragraph (7) of the Fgytv., your personal data shall be stored for a period of 5 years.

Automated decision-making and profiling

Neither of these is employed in the course of the data processing.

Provision of personal data

The provision of your personal data is required for filing a complaint.

V The data subject’s rights in relation to the data processing
Right to be informed

The data subject has the right to be informed of the data processing, which is fulfilled by the Controller by providing access to the present Policy.

Processing based on consent

Insofar as the consent of the data subjects serves as the legal grounds of the processing, the data subject may withdraw their previous consent to data processing at any time. However, it’s important to keep in mind that the withdrawal of consent only applies to data for which the processing has no other legal grounds. Insofar as there are no other legal grounds for the processing of the data subject’s personal data, the Controller shall permanently and irrevocably erase the personal data subsequent to the withdrawal of consent. Pursuant to the Regulation, the withdrawal of consent shall have no bearing on the data processing carried out based on consent prior to said withdrawal.

Right of access

At the data subject’s request, the Controller shall subsequently inform them at any time as to whether their personal data is being processed and if so, Controller shall provide access to the following information:

a) purposes of the data processing;

b) the categories of the data subject’s personal data;

c) the recipients or categories of recipients to whom the personal data has been or shall be disclosed by the Controller, in particular recipients in third countries or international organisations;

d) the envisaged period for which the personal data shall be stored, or if not possible, the criteria used to determine said period;

e) they may request from the Controller rectification, erasure or the restriction of processing of their personal data and may object to such processing of personal data;

f) the right to lodge a complaint with a supervisory authority or to initiate judicial proceedings;

g) where the personal data are not collected from the data subject by the Controller, any available information as to their source;

h) insofar as automated decision-making, including profiling took place, the confirmation of said processes and at the very least in such cases, the meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Right to the rectification of personal data

At any time, the data subject shall have the right to obtain from the Controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

The Controller hereby states that data subjects should report any changes to their personal data as soon as possible, thus facilitating lawful data processing and the enforcement of their rights.

Right to erasure

The data subject shall have the right to obtain from the Controller the erasure of personal data concerning him or her without undue delay where one of the following grounds applies:

a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed by the Controller;

b) the data subject withdraws consent on which the processing is based and where there are no other legal grounds for the processing;

c) the data subject objects to the processing and there are no overriding legitimate grounds for the processing, or the data subject objects to processing carried out for direct marketing purposes;

d) the personal data has been unlawfully processed by the Controller;

e) the personal data must be erased for compliance with a legal obligation in European Union or Member State law;

f) the personal data has been collected in relation to offering information society services.

Right to restriction of processing

The data subject shall have the right to obtain from the Controller restriction of processing where one of the following applies:

a) the accuracy of the personal data is contested by the data subject; in such cases, the restriction is for a period enabling the Controller to verify the accuracy of the personal data;

b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;

c) the Controller no longer requires the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; or

d) the data subject has objected to processing; in such cases, the restriction is for a period pending the verification whether the legitimate grounds of the Controller override those of the data subject.

Right to object

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her when the processing is necessary for the purposes of the legitimate interests of the Controller pursuant to Article 6, paragraph (1), point f) of the Regulation or when necessary for the performance of a task in the exercise of official authority vested in the Controller pursuant to Article 6, paragraph (1), point e) of the Regulation, including profiling based on said provisions.

Where personal data is processed for direct marketing purposes (i.e. dispatching letters of information), the data subject shall have the right to object at any time to processing of personal data concerning him or her for such purposes, which includes profiling to the extent that it is related to such direct marketing. Should the data subject object to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

Procedures for the enforcement of the data subject’s rights

The data subject may exercise the above-listed rights by dispatching a request via an electronic mail sent to the info@hook.hu address or via post sent to the Controller’s registered seat or presenting it in person at the Controller’s seat. Subsequent to receiving the data subject’s request, Controller shall carry out the examination and fulfilment of said requests without undue delay. Controller shall consider the request and inform the data subject on related measures taken within 30 days of receipt of said request. Insofar as the fulfilment of the request is not possible, Controller shall inform the data subject within 30 days on the reasons for denying the request and their right to judicial remedy.

Within five years after the death of the data subject, his/her rights relating to data processing as determined by the present Policy may be exercised by a person authorised for administrative representation as specified by public document or private document of full probative value by issuing a statement to this end to the Controller - insofar as the data subject made multiple statements to a single Controller, according to the latest of said statements. In the absence of suitable authorisation, close relatives pursuant to the Civil Code of Hungary are entitled to exercise the deceased person's rights pursuant to Article 16 (right to rectification) and Article 21 (right to object), furthermore - insofar as the data processing was unlawful prior to or the purpose of the data processing has ceased to exist upon the death of the data subject - those pursuant to Article 17 (right to erasure) and Article 18 (right to restriction of processing) of the Regulation. The rights pursuant to this paragraph may be exercised by close relatives who are the first to validate said entitlement.

VI Data subject’s right to judicial remedy
For the sake of enforcing the data subject’s right to judicial remedy, the data subject may refer claims against the Controller to a court of law should they deem that the Controller or their commissioned Processor or one acting according to their instructions are processing their data in violation of the provisions of the law on the processing of personal data or the provisions of the binding legal acts of the European Union. The court shall resolve such matters in an expedited trial. The adjudication of the proceedings falls under the competence of the regional court of justice. At the data subject’s choice, proceedings may be filed as per the data subject’s habitual place of residence or abode or through the competent regional court of justice as per the Controller’s registered seat (Municipal Court of Budapest).

All parties may initiate a review against the Controller by submitting a report (complaint) to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) with claims to infringement on the processing of personal data or the immediate likelihood thereof, the Controller’s restriction of the enforcement of data processing-related rights or in the case of the refusal of a request for the enforcement of said rights. Reports may be filed through one of the following points of contact:

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)

Mail address: 1530 Budapest, Pf.: 5.

Address: 1125 Budapest, Szilágyi Erzsébet fasor 22/c

Telephone: +36 (1) 391-1400

Telephone: +36 (1) 391-1410

E-mail: ugyfelszolgalat@naih.hu

URL: http://naih.hu

Budapest, 2020.11.10

____________________________

The National Union of Students in Hungary

Represented by: László Murai, President