Data protection

The SZBMRTT is an independent, non-profit learned society. This notice has been prepared in order to discharge the obligation to provide information laid down in Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: the GDPR).

The SZBMRTT has not appointed a data protection officer (DPO), as none of the conditions set out in Article 37(1) of the GDPR is met. In matters of data protection the Society may be approached at the contact details given above.

The notice extends to the processing of all personal data that the SZBMRTT processes on its website (szbmrtt.hu), in its newsletter and circular letter system, in its register of members, and in the course of its written and telephone contact with data subjects.

Applicable legal instruments:

• GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: the GDPR);
• Act CXII of 2011 — on the right of informational self-determination and on freedom of information;
• Act CLXXV of 2011 (Ectv.) — on the right of association, on public-benefit status, and on the operation and support of civil organisations;
• Act XLVIII of 2008 — on the basic conditions of economic advertising activity and on certain restrictions thereon;
• Act CVIII of 2001 — on certain questions of electronic commerce services and of services relating to the information society;
• Act V of 2013 (Ptk.) — the provisions of the Civil Code on the rights of personality.

The notice uses the concepts set out in Article 4 of the GDPR. Those occurring most frequently:

Personal data

any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Processing

any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

Restriction of processing

the marking of stored personal data with the aim of limiting their processing in the future;

Filing system

any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;

Controller

the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;

Processor

a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

Third party

a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;

Consent of the data subject

any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

4.1. Website, the collection of profile data and status data, newsletter system

The website of the SZBMRTT is freely accessible to anyone, without the provision of personal data (registration). In the course of a visit to the site the Society records only anonymous, aggregated statistical data, which contain no personal data.

For the collection of profile data and status data (for example IP address, browser type, date and time of entry) the SZBMRTT does not use so-called cookies.

In addition, the SZBMRTT operates a circular letter system for the continuing information of the members and supporters of the SZBMRTT, in connection with which it processes the personal data of members and supporters (full name, e-mail address) with the prior written consent of the addressee of the circular letter. The data subject may unsubscribe from the circular letter at any time by a message sent to the central electronic mail address of the SZBMRTT (office@szbmrtt.hu).

4.2. The processing of personal data, the rights of the data subject and the ensuring of their enforcement

Apart from processing based upon the consent of the data subject, the SZBMRTT processes and transmits personal data only in those cases in which it is obliged to do so by law. The SZBMRTT transmits the personal data made available to it to a third party only with the prior and express written consent of the data subject.

The SZBMRTT ensures the lawful processing of personal data by the application of appropriate technical means and organisational measures and of internal regulations. In the processing and protection of personal data the SZBMRTT acts with heightened circumspection. The SZBMRTT processes only accurate and up-to-date data, and only for as long as is necessary for the attainment of the purpose of the processing. If the purpose of the processing no longer obtains, the SZBMRTT erases the personal data of the data subjects without delay.

In respect of his or her personal data, or of part of them, the data subject may at any time, without giving reasons, exercise the following rights in writing:

• the right of access to personal data;
• the right to rectification;
• the right to erasure;
• the right to restriction of processing;
• the withdrawal of consent given to the processing.

The SZBMRTT acts without delay, and at the latest within 15 days of receipt of the request, upon the rectification, erasure or restriction of processing of the personal data processed by the SZBMRTT.

If, in the view of the data subject, the SZBMRTT processes his or her personal data without authorisation, he or she may object in writing to the processing. The SZBMRTT examines the objection — while suspending the processing of the data of the data subject — without delay, and at the latest within 15 days of receipt of the request, and informs the applicant in writing of the outcome of its examination.

In the event of an infringement of rights in connection with the processing of personal data, or if the imminent danger of such an infringement exists, the data subject or any third party may initiate an investigation by notification to the National Authority for Data Protection and Freedom of Information (NAIH):

The data subject may bring an action before a court against the controller if, in his or her view, the controller, or a processor commissioned by it or acting on its instruction, processes his or her personal data in breach of the provisions on the processing of personal data laid down by law or by a binding legal act of the European Union. The data subject may bring the action — at his or her choice — before the court competent according to his or her place of residence or place of stay.

The SZBMRTT receives questions, observations and proposals concerning the personal and other data processed by it at its central electronic mail address and at its postal address.

In the course of its processing activities the SZBMRTT engages processors of the following categories:

Hosting provider

Technical operation of the website, server-side logging, CDN, DDoS protection

Electronic mail service provider

Transmission and storage of the e-mail traffic arriving at and sent from the address office@szbmrtt.hu

Accountancy service provider

Maintenance of the Society's accounting records, the register relating to membership dues

Newsletter delivery service provider (if any)

Operation of the newsletter and circular letter system

The names and registered offices of the specific service providers are recorded by the SZBMRTT in its register of processing activities, and are made available at the request of the data subject within the framework of the right of access under Article 15 of the GDPR.

In accordance with Article 32 of the GDPR the SZBMRTT applies appropriate technical and organisational measures:

Technical

HTTPS encryption, firewall, access control, password protection, regular back-up, logging.

Organisational

internal data protection policy, obligation of confidentiality upon staff, maintenance of the register of processing activities, incident-handling procedure.

Data minimisation

the processing of the necessary data only.

Pseudonymisation and anonymisation

where possible, the data are processed in pseudonymised or anonymised form.

The SZBMRTT reserves the right to amend this notice. Every amendment receives a new version number, and the date of entry into force is indicated in the header of the document. Earlier versions are preserved in the Society's archive and are accessible upon request.