DATA PROCESSING POLICY
OF THE DR. EVA KAHÁN FOUNDATION
This Data Processing Policy is effective as of 4 July 2018 and remains in effect until revoked.
I. Name of the data controller
Data controller: Dr. Éva Kahán Foundation (hereinafter: ‘the Foundation’ or ‘the Data Controller’)
Head office: 1133 Budapest, Garam utca 9., Hungary
Postal address: 1133 Budapest, Garam utca 9., Hungary
Email address: firstname.lastname@example.org
Telephone: +36 (1) 920 1197
II. Legislation under which data processing is performed
The effective legal regulations governing the processing of data in the scope of this Data Processing Policy:
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter: the ‘EU General Data Protection Regulation’);
- Act CXII of 2011 on the right of informational self-determination and on freedom of information.
III. Purposes and legal basis for data processing, personal data processed, duration of data processing, parties authorised to access personal data
Processing personal data included in application documents and curricula vitae submitted by applicants for art scholarships and grant programmes
The purpose of processing the data: We process the applications, curricula vitae and additional application materials submitted to the Foundation in response to our announced / published offers with the sole purpose to make decisions about the applicants’ suitability for our support. Accordingly, we are at liberty to view the personal data applicants make available to the Foundation only and exclusively during the application evaluation process and until the final evaluation of the applications at the latest.
The legal basis for data processing: The legal basis for processing the data contained in the applications, curricula vitae and additional application materials submitted to the Foundation is provided by the applicants’ consent, i.e. a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the applicants’ agreement to the processing of personal data relating to them for the data processing purposes specified in this section.
Legislative provision: Article 6 (1a) of the EU General Data Protection Regulation
Content and meaning of the consent: By sending their applications, curricula vitae and additional application materials to the Foundation in an electronic form, applicants give their consent to all data contained therein remaining accessible until the final closure of the application process.
Please also note that by sending us application documents containing your photo, you also agree to the Foundation using your image for data processing purposes under this section, as per Section 2:48 (1) of Act V of 2013 on the Civil Code.
Applicants can withdraw their consent any time. This withdrawal will, however, not affect the lawfulness of any data processing performed based on the valid consent beforehand.
You are hereby advised that you are not obliged to provide your personal data for the Foundation, but if those data are not provided, it will not be possible for us to consider your application or make a (final) judgement about it, nor will we able to notify you of the outcome.
|Personal data processed||Data processing period ends||People having the right to access personal data|
|applicant’s full name||when the consent is withdrawn||Foundation staff members taking part in the application evaluation process|
|applicant’s email address||when the consent is withdrawn||Foundation staff members taking part in the application evaluation process|
|any additional personal data the applicant legally provides at the request of the Foundation||when the consent is withdrawn||Foundation staff members taking part in the application evaluation process|
|any additional personal data the applicant voluntarily provides||when the consent is withdrawn||Foundation staff members taking part in the application evaluation process|
All applicants are hereby informed that the application evaluation process also includes the Data Processor checking any publicly available information the applicants created/published on social network sites. The Foundation notes and, also, has due regard to the fact that this method may only be used to acquire information relevant to the application.
The Foundation informs applicants that their email addresses do no need to contain personal data. This means that the email address does not need to contain, for example, the applicant’s name. It is left to the discretion of the applicant whether they provide an existing email address which contains information about their identity or not.
Applicants have exclusive responsibility for the authenticity and accuracy of all data they provide. The Foundation will not be held liable for any incompleteness in the provided data, nor for any consequences arising from the provision of incorrect data, and it expressly excludes any such liabilities to the fullest extent possible under applicable laws.
Except when legally bound to do so (i.e. when instructed by, e.g. the court, the police, the prosecution), the Foundation will not release any applications, curricula vitae or additional application materials to third parties either for statistical purposes or otherwise, will not disclose any personal data supplied to it, and will provide information on the evaluation of submitted applications, curricula vitae and additional application materials only and exclusively to the affected applicants.
The Foundation will not forward any personal data that applicants make available to us to any other European Union / European Economic Area member state or a third state, nor to any international organisations.
IV. Information on using the services of a data processor
The Foundation will use the services of data processors (e.g. bookkeeping firms, IT consultants, providers of legal services) on an ad hoc basis, depending on the given situation, and will always inform affected data subjects before doing so.
V. Brief description of the data processing operations performed on personal data and the related data security measures
The Foundation stores all documents containing personal data and available in an electronic form on computer(s) located at the Foundation’s head office. When the specified retention period is over or the consent is withdrawn, we erase from our computer(s) all relevant electronically stored personal data and destroy and discard all relevant hard copy documents in a way which, to our present knowledge, does not allow the future reconstruction of these data. The Foundation does not use any automated decision-making processes, nor does it build profiles using the personal data available to it.
VI. Rights related to processing
a. The right to be informed
Using the contact options in Chapter I, data subjects can request the Foundation to provide information about the following:
- what personal data of theirs we process,
- on what legal basis,
- for what data processing purposes,
- what sources those data were obtained from,
- how long they are going to be processed,
- furthermore, they can also request information about what parties the Foundation has granted access to or forwarded their personal data, which of their personal data were accessed or forwarded, when and based on what legal regulations that access or forwarding took place.
The Foundation will provide the data subject with a copy of their personal data it has processed. The right to obtain a copy shall not adversely affect the rights and freedoms of others.
The Foundation will comply with the data subject’s request not later than within one (1) month, by sending them a mail using the data subject’s preferred contact option.
b. The right of rectification
Using the contact options in Chapter I, data subjects can request the Foundation to modify their personal data (e.g. they can have their email or postal addresses changed any time). The Foundation will comply with the request not later than within one (1) month and notify the data subject by sending them a mail using the data subject’s preferred contact option.
c. The right of erasure
Data subjects can request the Foundation to erase their personal data using the contact details in Chapter I.
The Foundation will refuse to comply with the erasure request if the Foundation is legally obliged to continue storing the personal data. When no such obligation applies, the Foundation will comply with the request not later than within one (1) month and notify the data subject by sending them a mail using the contact details provided for this purpose.
d. The right to restrict processing
Data subjects can use the contact details in Chapter I to request the Foundation to restrict processing of their personal data (this is implemented by clearly identifying that the processing of the data is restricted and ensuring that they are processed separately from other data). Data processing will remain restricted for as long as required for the purpose indicated by the data subject.
A data subject can request the restriction of data processing when, for example, they believe that the Foundation processed their personal data unlawfully but the authority or legal proceedings they initiated make it necessary that the Foundation should not erase their personal data. In this case, the Foundation will continue to store the documents also containing personal data (e.g. a curriculum vitae) until contacted by the relevant authority or court, and erase the data afterwards.
e. The right to object
Data subjects can use the contact details in Chapter I to object to processing their personal data, provided that they have legal grounds for that based on the provisions of the EU General Data Protection Regulation. In this case, the Foundation shall no longer process their personal data unless we demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
f. The right to data portability
Data subjects can use the contact details in Chapter I to indicate that they wish to exercise their right to data portability, provided that all relevant conditions set forth in the EU General Data Protection Regulation are met.
g. The right to file complaints with the Hungarian National Authority for Data Protection and Freedom of Information
Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint if the data subject considers that the processing of personal data relating to them infringes the EU General Data Protection Regulation (see the provisions under Chapter VII, point c.).
h. The right to receive compensation and damages
Any data subject who has suffered material or non-material damage because of an infringement of the EU General Data Protection Regulation shall have the right to receive compensation from the controller for the damage suffered (see the provisions under Chapter VII, point b).
VII. Enforcement options related to data processing
a. Initiate dispute settlement with the Foundation
The Foundation recommends that data subjects who claim that we process their personal data in a manner which is in violation of the law or constitutes abusive practice contact us first, using one of the contacts provided in Chapter I. The Foundation is deeply committed to ensuring full compliance with personal data protection requirements and the right to informational self-determination, therefore, we will make every effort to answer your questions / concerns / remarks as soon as possible but not later than within one (1) month.
b. The right to make a reference to the court
Data subjects have the right to seek judicial remedy if they consider that their rights under the EU General Data Protection Regulation have been violated due to their personal data not being processed in line with the EU General Data Protection Regulation.
Data subjects may decide to bring the civil action before the tribunal of their place of residence or stay (follow the link for a list and contact details of the tribunals: *****).
c. Initiate a Hungarian National Authority for Data Protection and Freedom of Information proceeding
Data subjects may file a report with the Hungarian National Authority for Data Protection and Freedom of Information to initiate an investigation, claiming that an infringement is imminent or has occurred related to the processing of their personal data.
Contact details of The Hungarian National Authority for Data Protection and Freedom of Information
- official email address: email@example.com
postal address: 1530 Budapest, Pf.: 5.
- telephone: +36 (1) 391 1400
- fax: +36 (1) 391 1410
- address: Hungary, 1125 Budapest, Szilágyi Erzsébet fasor 22/C
- website: www.naih.hu
The Foundation reserves the right to unilaterally change this Data Processing Policy any time and without giving reasons. If the Foundation changes this Data Processing Policy, we will properly inform all data subjects of that, in compliance with all effective legal regulations.