CCTV Policy

1. Purpose and scope of the notice

This notice (hereinafter: “Notice”) aims to define and provide information about the personal data processing practices of BalaLand Hotel Üzemeltető Kft., as the operator of Mövenpick Balaland Resort Lake Balaton (hereinafter: “Hotel”) (hereinafter: “Data Controller”), carried out via video recording devices (security cameras) operated within the Hotel and BalaLand Family Park. The purpose of this Notice is also to ensure the enforcement of constitutional principles of data protection, the right to informational self-determination, and data security requirements, as well as to ensure that everyone can control their personal data within the legal framework, understand the circumstances of its processing, and prevent unauthorized access, alteration, and disclosure. This Notice serves compliance with Article 13 of Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR). The scope of this Notice extends to data processing carried out via video recording devices within the Hotel and the Family Park.

2. Data controller details

Az Adatkezelő aktuális adatai a következők:

• Name: BalaLand Hotel Üzemeltető Limited Liability Company
• Registered office: 1026 Budapest, Pasaréti út 122-124.
• Company registration number: 01-09-404329
• Tax number: 32047679-2-41
• Email: hc089@movenpick.com
• Data Protection Officer: Anikó Ferenczy
• Email: aniko.ferenczy@movenpick.com
• Phone: +36302577751

3. Scope of data, purpose, legal basis, retention, data transfers

Processed data: The behavior of individuals present within the Hotel and the associated Family Park is recorded by means of video surveillance (image only) in certain areas of the Hotel and the Family Park that are open to customers. No audio is recorded by the Data Controller.
Purpose of data processing: The purpose of the Data Controller is to protect the property, physical integrity, and other legitimate interests of its guests, employees, itself, and any third parties, as well as to facilitate the enforcement of the data subjects’ rights.
Legal basis for data processing: The legitimate interests of the Data Controller, the data subjects, and society in the protection of property and personal safety (Article 6(1)(f) GDPR). The existence of the legitimate interest is supported by a balancing test carried out by the Data Controller.
Data retention period: Recordings are automatically deleted after 240 hours from the time of recording. Exceptions apply in cases where further processing is necessary for the enforcement of the rights of the data subject, the Data Controller, or a third party, or where there is a suspicion that the given recording may be required for the enforcement of any person’s legal claims.

4. Principles of personal data processing

(a) Personal data shall be processed by the Data Controller lawfully and fairly, and in a transparent manner for the data subject(s) (“lawfulness, fairness and transparency”). The Data Controller shall display the most important information on warning signs containing relevant information. Such information shall be placed at an appropriate distance from the monitored area, in a manner that enables data subject(s) to easily become aware of the circumstances of the surveillance prior to entering the monitored area.

(b) The Data Controller shall collect personal data solely for specified, explicit and lawful purposes as defined in this Notice, and shall process them in a manner compatible with those purposes (“purpose limitation”)

(c) Personal data must be adequate, relevant and limited to what is necessary in relation to the purposes of the data processing. Prior to the installation of the camera surveillance system, the Data Controller shall verify that it is appropriate, suitable and necessary for achieving the intended purpose. A camera surveillance system may only be installed if the purpose of the data processing cannot be achieved by means less intrusive to the fundamental rights and freedoms of the data subject (“data minimisation”).

(d) Personal data shall be stored in a form which permits identification of data subject(s) only for as long as necessary for the purposes for which the personal data are processed (“storage limitation”);

(e) The Data Controller shall ensure the appropriate security of personal data by applying suitable technical and organisational measures, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage (“integrity and confidentiality”).

(f) The Data Controller shall be responsible for compliance with points (a)–(e) and must be able to demonstrate such compliance (“accountability”).
The cameras may monitor the entire area of the Hotel and the associated Family Park that is open to customer traffic, as well as the façade and street frontage of the Hotel and the Family Park, including the designated street parking spaces, and the area of the Family Park.

The exact locations and fields of view of the cameras are not disclosed in this Notice, as such disclosure would not be compatible with the purpose of the data processing.

5. Data subject rights

5.1 Upon the request of the data subject, the Data Controller shall provide information in writing, in a concise and intelligible form, on the following:
(a) whether the processing of the data subject’s personal data is ongoing at the Data Controller;
(b) the name and contact details of the Data Controller;
(c) the personal data of the data subject processed by the Data Controller and their source;
(d) the purpose of the processing of personal data and the legal basis for such processing;
(e) the duration of the data processing;
(f) the recipients or categories of recipients with whom or which the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
(g) the consequences of the data processing;
(h) the rights of the data subject;
(i) the circumstances, effects and the measures taken to remedy any potential data protection incident.
If a recording is stored concerning the data subject, the data subject(s) has the right of access pursuant to Article 15 of the GDPR. The right to request a copy shall not adversely affect the rights and freedoms of other persons. In certain cases, the Data Controller may not release a recording in which others can be identified. In order to ensure that the rights and freedoms of others are not impaired, the Data Controller shall use a technical solution or means to fulfil the data subject(s)’ right of access. If the video recording cannot be searched for personal data, the Data Controller shall be unable to identify the data subject. Therefore, the data subject shall be required to determine precisely (within a time frame) when he or she entered the monitored area. If the Data Controller is unable to identify the data subject, the Data Controller shall inform the data subject thereof.

5.2 Right to object

The data subject(s) shall have the right to object at any time to processing on grounds relating to his/her particular situation. In the case of camera surveillance, the objection may be made before entering, during or after leaving the monitored area.
If the data subject exercises the right to object, the controller shall act in accordance with Article 21 of the GDPR.
In the case of video surveillance for direct marketing purposes, the data subject has the right to object to the surveillance at any time, and in this case the data cannot be processed.

5.3 Right to rectification

The data subject may request the correction of inaccurate data concerning him or her processed by the Data Controller.

5.4 Right to erasure:

If any of the following reasons apply, the Data Controller shall, upon request of the data subject, erase the data concerning the data subject as soon as possible, but no later than within 5 working days:
(a) The data have been processed unlawfully (without legal authorisation or personal consent);
(b) the processing of the data is not necessary for the achievement of the original purpose;
(c) the data subject withdraws his or her consent to the processing and the Data Controller has no other legal basis for the processing;
(d) the data in question were collected in connection with the provision of information society services;
(e) the personal data must be erased for the performance of legal obligations to which the Data Controller is subject.
The Data Controller shall not be able to erase the data if the processing is necessary for any of the following reasons:
(a) It is necessary for the exercise of the right to freedom of expression and information;
(b) in the public interest;
(c) for archiving, scientific, research or statistical purposes;
(d) for the establishment or defence of legal claims.

5.5 Right to restriction of data processing

If any of the following reasons apply, the Data Controller shall restrict the processing of the data at the request of the data subject:
(a) The data subject disputes the accuracy of the data concerning him or her, in which case the restriction shall apply for the period until the accuracy and correctness of the data in question can be verified;
(b) the processing is unlawful, but the data subject requests that the data not be erased, but only requests the restriction of the processing;
(c) the data are no longer needed for the processing, but the data subject requests their continued storage for the exercise or defence of legal claims;
If the Data Controller imposes a restriction on any processed data, during the period of the restriction, the data concerned shall only be processed if and to the extent that:
(a) The data subject consents to this;
(b) it is necessary for the exercise or defence of legal claims;
(c) it is necessary for the exercise or defence of the rights of another person; (d) it is necessary for the exercise of public interest.

5.6 Right to data portability

The data subject has the right to request that the Data Controller transmit the data concerning him or her to another data controller in a commonly used, machine-readable format. The Data Controller shall comply with the request as soon as possible, but no later than within 30 days.

5.7 Right to legal remedy

(a) If you have any objections or problems regarding the
Data Controller’s data processing, please contact the Data Controller’s data protection officer, Anikó Ferenczy (contact details: aniko.ferenczy@movenpick.com ; +36302577751
(b) If the data subject believes that his/her rights have been violated by the Data Controller and/or the data processors, he/she is entitled to apply to the court with jurisdiction and competence in accordance with the Pp. The court shall proceed with the case ex officio.
(c) If the data subject wishes to file a complaint regarding data processing, he/she may do so at the National Authority for Data Protection and Freedom of Information, at the following contact details: registered office: 1125 Budapest, Szilágyi Erzsébet fasor 22/C.; mailing address: 1530 Budapest, Pf.: 5. Telephone: +36 1 391 1400; fax: +36 1 391 1410; e-mail address: ugyfelszolgalat@naih.hu; website: www.naih.hu.

Date: 14th April 2023. Budapest

Introduction

The Data Controller, in accordance with the provisions of the Constitution of the Republic of Hungary and the Act on the Protection of Personal Data, in compliance with its obligation specified in Section 31/A. (3) of the Act on the Protection of Personal Data, has drawn up its data protection and data security policy as follows in order to ensure the protection of personal data and to implement the Act on the Protection of Personal Data.

I. Interpretative provisions

1. data file: the set of data managed in a filing system;
2. data security: A system of technical, personal and organizational measures and procedures taken to protect the security criteria of data, such as confidentiality, integrity and availability.
3. data processing: the performance of technical tasks related to data processing operations, regardless of the method and means used to perform the operations and the place of application;
4. data processor: the natural or legal person or organization without legal personality who processes personal data on behalf of the data controller – including on behalf of the data controller – including on behalf of the legal provisions;
5. data processing: any operation or set of operations performed on data, regardless of the procedure used, such as collection, recording, recording, organization, storage, alteration, use, transmission, disclosure, alignment or combination, blocking, erasure and destruction, and preventing further use of data. Data processing also includes the taking of photographs, audio or video recordings, and the recording of physical characteristics suitable for identifying a person (e.g. fingerprints or palm prints, DNA samples, iris images);
6. data controller: BalaLand Hotel Üzemeltető Kft, 1026 Budapest, Pasaréti út 122-124. Fsz. A02 tax number: 32047679-2-41 company registration number: 01-09-404329, who or which determines the purpose of the data processing, makes and implements decisions regarding data processing (including the means used), or has them implemented by a data processor commissioned by it; B
   data erasure: making data unrecognizable in such a way that their recovery is no longer possible;

7. data transfer: if the data is made accessible to a specific third party;
8. data blocking: making the transmission, knowledge, disclosure, transformation, alteration, destruction, deletion, connection or coordination and use of data impossible permanently or for a specified period of time;
9. Avtv.: Act LXIII of 1992 on the protection of personal data and the publicity of data of public interest
10. data protection incident: Unlawful handling or processing of personal data, in particular unauthorized access, alteration, transmission, disclosure, deletion or destruction, as well as accidental destruction and damage.
11. confidentiality (secret): The characteristic of data that only a predefined group of users (authorized persons) is allowed access, and access by everyone else is illegal
12. loss of confidentiality: The loss of confidentiality is called disclosure, in which case confidential data becomes known and/or accessible to unauthorized persons.
13. Security incident: Any event that may have a detrimental effect on the confidentiality, integrity or availability of an IT device or the data stored on it.
14. data subject: Any specific natural person identified or directly or indirectly identifiable on the basis of personal data.
15. network: the set of organizational LANs, Internet remote access, CCTV(video surveillance system), computer communication and data transmission devices that enable data exchange between interconnected systems. 16. consent: The voluntary and definite declaration of the data subject’s will, which is based on appropriate information and by which he gives his unambiguous consent to the processing of personal data relating to him in full or in particular operations.
16. IT device: The user workstation, the server, the portable computing or telecommunications device, the video cameras, the digital image recording equipment, the data network device (hardware), together with the software that ensures its operation, which serves to support the work processes.
17. IT system: A set of computing devices, their structured connection. A complex, complicated system built from IT devices as building blocks.
18. IT system operator: A person or organization that performs the continuous operation, backup and restoration of the IT system.
19. public area: a state or municipally owned area for public use, which everyone can use without restriction in accordance with its intended purpose, including the part of the public area that serves as a public road;
20. public part of a private area: a private area that is

available to everyone without restriction, including that part of the public area into whose possession the person who is entrusted with the activity of personal and property protection comes under a civil law legal transaction, in particular a lease or leasehold relationship, provided that

1. a) the use of the area is organically linked to the activity carried out in the public part of the private area guarded by the person carrying out the activity of personal and property protection, serves its continuity and assistance, or
2. b) it serves to place the movable property of the data controller or the public using the public part of the private area;
3. integrity: The criterion of the existence, authenticity, integrity and completeness of data, which ensures that data, information or programs can only be changed by those authorized to do so and that they cannot be modified unnoticed.
4. regulation: the present data protection and data security regulations of the data controller
5. personal data: data that can be linked to any specific (identified or identifiable) natural person (hereinafter referred to as the data subject), and a conclusion that can be drawn from the data concerning the data subject. Personal data retains this quality during data processing as long as its relationship with the data subject can be restored. A person is considered identifiable in particular if he or she can be identified – directly or indirectly – on the basis of a name, an identification mark or one or more factors specific to his or her physical, physiological, mental, economic, cultural or social identity;
6. server: equipment and computers that store data and provide services are considered servers.
7. third party: a natural or legal person or an organisation without legal personality who is not the same as the data subject, the data controller or the data processor;
8. consent: any voluntary and specific indication of the data subject’s wishes, based on adequate information, by which the data subject signifies his or her unequivocal agreement to the processing of personal data relating to him or her, in whole or in part;
9. disclosure: if the data is made available to anyone;
10. objection: a statement by the data subject objecting to the processing of his or her personal data and requesting the termination of the processing or the deletion of the processed data;
11. company: the data controller
12. personal data filing system (filing system): any structured, functionally or geographically centralized, decentralized or dispersed file of personal data, which is accessible based on specific criteria;
13. operator: A person or organization that maintains, operates, maintains, repairs and operates the facilities of the data controller.
14. property protection security system: an electronic signaling and image surveillance system installed for property protection purposes on properties falling within the territorial scope of the Regulation, including electronic surveillance systems operated without recording for surveillance purposes or those that also allow audio or video recording (surveillance), electronic access control systems, burglar alarm systems, remote monitoring systems, security systems aimed at data and IT protection, as well as other electronic technical solutions that also allow signal and image transmission or light or sound signaling;
15. guest: consumers using the services of the data controller or service provider.

II. Scope of the rules

II.1. Personal scope

The personal scope of the Regulation extends to

• the data controller;
• all employees and collaborating partners of the data controller and persons entering the institution’s premises; who are in the data controller’s IT system: perform activities related to the creation or modification of software, the use and/or modification of hardware, data entry and/or data use;
• any natural person entering the premises of the institution.

II.2. Scope of the object

The scope of the Regulations covers:

• the data controller’s IT system;
• all documents, data and data carriers recorded and stored in the IT system, or created as a result of processing, regardless of their processing or production method and form of appearance;
• the entire life cycle of the IT application;
• the design, development, implementation and operation stages of application programs and their documentation;
• the implementation and operation stages of the basic and system programs necessary for the operation of IT equipment, and the storage and use of data carriers.

II.3. Territorial scope

The territorial scope of the Regulations covers:

• the locations of operation of the IT resources covered by the subject matter of the Regulations;
• the headquarters and all sites of the data controller;
• the entire area of MOVENPICK Balaland Resort Lake Balaton, including the Family Park

III. Property protection security system

The institution monitors entry and specific events with an IP server-based digital video recorder.

Its main functions are as follows:

1. Video recording program: its task is to display the images of the cameras, process and save the images.
2. Playback program: it plays back the recorded image and sound, and it enables searching in the archived data.
3. Event viewer program: it records the most important messages and states of the program, with its help we can easily find out any incorrect settings and monitor the operation of the program.
4. Image viewer program: with its help you can view individual frames saved from the recording or playback program.
5. Event database browser program: it provides an access interface for database-based event management.
6. Video recording server: Target hardware, parameterized according to the target task. The built-in hard drives are suitable for recording large amounts of image material.

The device provides image recording and the possibility of playback of recordings. The video recorder and its backup storage are connected to the established IP network.

The software runs on 3 PC-based workstations. The number of recorders is determined by the number and type of cameras at the given site. The recorder is located in a closed office within the institution. Access is protected by a username and password. We store the recorded recordings on a separate hard drive intended for this purpose only. No separate backup copies of the recordings are made.

The placement and parameterization of each camera is done as follows:

Observation type	Placement	Fixed event	Storage time
Area monitoring	They were installed on walls and ceilings in various indoor and outdoor units of the buildings	Events in outdoor and indoor community areas, corridors, hallways, storage areas, stairwells, and offices are recorded	max. 15 day

The recorded recordings are automatically deleted after the set storage time has elapsed. The program can only be used after user login.

There are 78 surveillance cameras in the Hotel building and 53 in the Family Park.

Indoor cameras:     UNV IPC3614LE          Viewing angle: 111.1°~89.2°       

Outdoor cameras:  UNV IPC2322LBR3     Viewing angle: 146.5°~33.2

IV. Purpose of data processing

IV.1. General rules

Personal data may only be processed for the purpose and in the manner specified in this Policy, in order to exercise the rights and fulfill the obligations specified in the Policy. Data processing must comply with this purpose at all stages.

Only personal data may be processed that is essential for the achievement of the purpose of data processing, suitable for achieving the purpose, and only to the extent and for the period necessary for the achievement of the purpose.

Personal data may be processed – with the consent of the data subject – in particular if this is necessary to protect the vital interests of the data subject/s, to fulfill the contract concluded between the data subject and the data controller, or to enforce the legitimate interests of the data controller or a third party.

IV.2. Purpose of data processing

The purpose of the data processing carried out by the data controller is to improve order and security, and as part of this, to protect the personal and property of persons entering the institution, guests and employees of MOVENPICK Balaland Resort Lake Balaton and Family Park, and to increase the effectiveness of crime prevention.

V. Conditions of data processing, consent of the data subject

V.1. General rules

A person’s face and image are personal data, and the taking of the image and any operation performed on the data are considered data processing, which the data subject acknowledges upon entering the MOVENPICK Balaland Resort Lake Balaton and Family Park area. The data controller uses electronic surveillance systems exclusively in private areas or in the part of the private area that is public to those entering.

Electronic surveillance systems may not be used in places where surveillance may violate human dignity, especially in changing rooms, bathrooms, and toilets. The Regulations exclude surveillance in intimate situations.

V.2. Contribution and information

Personal data may therefore be processed if the data subject provides it

1. a) in writing;
2. b) orally;
3. c) with suggestive behaviour

Consent is a voluntary and definite expression of the data subject’s wishes, based on appropriate information, by which he or she gives his or her unequivocal consent to the processing of personal data concerning him or her – in full or in relation to certain operations.

It is considered indicative behavior and therefore consent if the data subject enters the premises of the institution despite the sign/sticker indicating camera surveillance!

 

At the request of the data subject, the data subject must be informed – clearly and in detail – about all facts related to the processing of his/her data, in particular the purpose and legal basis of the data processing, the person authorized to process and process the data, the duration of the data processing, and who may have access to the data. The information must also include the data subject’s rights and legal remedies in relation to the data processing.

The information may be provided by publishing the fact of the data processing, the scope of the data subjects, the purpose of the data collection, the duration of the data processing and the accessibility of the data in a manner accessible to everyone on the institution’s website, since providing information to the individual would be impossible or would entail disproportionate costs.

The data subject may also give his/her consent within the framework of a written contract concluded with the data controller. In this case, the contract must contain all information that the data subject needs to know in terms of the processing of personal data – pursuant to this Act – in particular the definition of the data to be processed, the duration of the data processing, the purpose of use, the transmission of the data, the use of a data processor. The contract must clearly state that the data subject, by signing it, consents to the processing of his/her data as specified in the contract. However, taking into account the fact of the indicative conduct indicated in point c.), data recording may also take place without written consent!

According to the provisions of the Avtv., consent must be voluntary. In this case, voluntariness is ensured, since the activities and services performed by the institution do not constitute the satisfaction of a basic public need outside of the persons in legal relations with the institution, so the data subject is not forced to consent to data processing against his will, the employees and organizations in legal relations with the institution (SZM) accepted the rules simultaneously and thus gave their consent to the data recording. The data subjects have a meaningful choice, the principle of complete voluntariness applies.

Consent can also be given by suggestive behavior. Suggestive behavior is especially when a natural person staying there enters the area despite the information posted in the public part of the private area in accordance with the provisions of the Regulations.

V.3. Special rules for employees

In the case of employees, only voluntary consent can be considered a lawful authorization for data processing. In the case of employees, special care must be taken to ensure that all elements and conditions of consent are met, especially voluntariness. If the employee does not have a choice in whether to perform his or her work in an environment monitored by a camera or not, then we cannot speak of voluntary consent.

According to established data protection practice, a camera in the workplace for the purpose of monitoring the employee’s work or behavior at work cannot be placed in rooms where permanent work is carried out, and consequently, cameras cannot be operated in offices, staff locker rooms, or workplaces. Exceptions are workplaces where the life and physical integrity of the employee may be at risk.

A camera may only be operated for the purpose of protecting the life and physical integrity of employees if the danger actually exists and, direct, i.e., potential danger cannot be a constitutionally acceptable data processing purpose. A camera may not be placed and operated for any purpose in rooms designated for employees to take breaks during work, nor may a camera be placed in changing rooms, restrooms, or showers.

In justified cases, such as for the protection of valuable equipment, raw materials, or other valuables stored at the workplace, cameras may be placed and operated in rooms necessary for protection, such as primarily warehouses, and in the corridors leading to them, but the data subjects must be informed about their operation in a clearly visible place and manner.

During periods – such as outside working hours, weekends or holidays – when no one is generally allowed to be in the workplace, a camera may be operated for property protection purposes in rooms necessary for protection, and the images transmitted by it may be recorded. In exceptional and justified cases, when the interests of the data subject clearly require it, a camera may be operated in a room necessary for protection.

Specific form of contribution and information

Employee data processing consent.

VI. Use of data, data transfer

Only the person who needs to know the recorded image, sound, image and sound recording, and other personal data is entitled to know it, if this is necessary for the enforcement of their obligations under the Regulations and is indispensable for the prevention or interruption of the unlawful act. The name of the person who manages the recorded image, sound, image and sound recording, and personal data, or who is otherwise entitled to know it, the reason for and time of knowing the data must be recorded in the PROTOCOL (an exception is made if it occurs within the framework of a routine inspection).

Use is considered to be when the recorded image, sound, or image and sound recording, as well as other personal data are used as evidence in court or other official proceedings.

A person whose rights or legitimate interests are affected by the recording of the image, sound, or image and sound recording, or other personal data, may, within 3 (three) working days from the recording of the image, sound, image and sound recording, or other personal data, request, by proving his rights or legitimate interests, that the data controller not destroy or delete the data.

Upon request by a court or other authority, the recorded image, sound, image and sound recording, and other personal data must be sent to the court or authority without delay. If no request is made within 30 (thirty) days of the request not to destroy, the recorded images, audio, video and audio recordings, and other personal data must be destroyed or deleted in parallel with the saturation of the hard disk (This occurs automatically when the hard disk used for data storage is full).

Photo and video recordings and personal data are copied or printed only under controlled circumstances and in all cases documented in the Data Access Log, only in case of suspicion of abuse or criminal offenses, for evidentiary purposes. When the internal procedure is closed, the stored data is destroyed under documented and controlled circumstances.

The recordings may not fall into the hands of an unauthorized person. Their transfer to the authorized authority is also carried out in a controlled and documented form.

The destruction of data storage devices that may not be erased due to damage is also carried out in a controlled and documented form in a specific protocol.

The data protection officer is responsible for compliance with the above.

VII. Delete data

A fundamental right protection requirement that exceeds the general protection of property (manifested in the threat to human life, physical integrity, and personal freedom) establishes a stronger restriction of the right to informational self-determination – manifested in the longer-term storage of the recording. A similar assessment also applies if the data processing carried out – beyond the technical protection of property – can be linked to a constitutionally protected purpose, the protection of public order and public safety. Accordingly, the Regulation allows the storage of recordings for a maximum of one year.

VIII. Data security

VIII.1. General rules

The data controller is obliged to ensure the security of the data and is also obliged to take the technical and organizational measures and establish the procedural rules that are necessary to enforce the data protection and confidentiality rules.

The data must be protected in particular against unauthorized access, alteration, transmission, disclosure, deletion or destruction, as well as against accidental destruction and damage. In order to ensure the technical protection of personal data, the data controller or the operator of the telecommunications or IT device must take special protective measures.

VIII.2. Technical data

Data recorder type: Pelco Video Expert Enterprise Physical location, protection

The software runs on one of the data recorders indicated above in the institution. The number of data recorders is determined by the number and type of cameras at the given site. The data recorder is located in a supervised, closed office space outside working hours.

Data storage

The recorded recordings are stored on a separate hard drive in the data recorder. No separate backup copies of the recordings are made.

Network access

The data recorder can be accessed within a local network with administrator and operator privileges. The network is protected from the Internet by a firewall. Access to the network from the Internet is possible via an encrypted VPN (Virtual Private Network) connection.

IX. Rights of the data subjects and their exercise

IX.1. Rights of the data subjects

The data subject may

• request information about the processing of his/her personal data;
• request the correction of his/her personal data or, with the exception of data processing prescribed by law, its deletion;
• inspect the data protection register kept by the Data Protection Commissioner, make a note of its contents and request an extract.

IX.2. Right to information

At the request of the data subject, the data controller shall provide information about the data it processes, the purpose, legal basis and duration of the data processing, who receives or has received the data and for what purpose. The data controller may not refuse to provide the information. The data controller shall provide the information in writing and in a plain language as soon as possible after the request has been submitted, but no later than 30 days.

The information is free of charge if the person requesting the information has not yet submitted a request for information to the data controller in the same area in the current year. In other cases, a reimbursement of costs corresponding to the actual costs incurred in providing the information may be determined. The reimbursement of costs already paid shall be refunded if the data has been processed unlawfully or the request for information has led to a correction.

IX.3. Right to correction

The data controller is obliged to correct inaccurate personal data.

IX.4. Right to deletion

Personal data must be deleted if

1. a) its processing is unlawful;
2. b) the data subject requests it (except if the data enables the detection of unlawful activity or its retention is necessary for this purpose);
3. c) it is incomplete or incorrect – and this condition cannot be legally corrected -, provided that deletion is not excluded by law;
4. d) the purpose of the data processing has ceased to exist or the period for storing the data specified in the Regulations has expired;
5. e) it has been ordered by a court or the Data Protection Commissioner.

IX.5. Right to object

The data subject may object to the processing of his or her personal data if

1. the processing is unlawful;
2. the processing (transfer) of personal data is necessary solely for the exercise of the rights or legitimate interests of the data controller or the data recipient;
3. the use or transfer of personal data is for the purpose of direct marketing, public opinion polling or scientific research;
4. the exercise of the right to object is otherwise permitted by law.

The data controller is obliged to examine the objection – while simultaneously suspending the data processing – within the shortest possible time from the submission of the application, but no later than 15 days, and to inform the applicant of the result in writing. If the objection is justified, the data controller is obliged to terminate the data processing – including further data collection and transmission – and block the data. If the data subject does not agree with the decision made by the data controller on the basis of the above, he or she may appeal to the court within 30 days of its notification.

IX.6. Right to refer to court

In the event of a violation of his or her rights, the data subject may take legal action against the data controller. The court may proceed with the case out of turn. The data controller must prove that the data processing complies with the provisions of the law. The court of the data controller’s registered office shall have jurisdiction over the lawsuit. The lawsuit may also be initiated – at the choice of the data subject – before the court of the data subject’s place of residence (place of stay). A party to the lawsuit may also be a person who does not otherwise have legal capacity to sue.

If the court grants the request, it shall oblige the data controller to provide information, correct or erase the data, annul the automated individual decision, and take into account the data subject’s right to object. The court may order the publication of its judgment – by publishing the data controller’s identification data – if the interests of data protection and the rights of a larger number of data subjects protected by this Act so require.

IX.7. Right to compensation

The data controller is obliged to compensate for damage caused to others by unlawful processing of the data subject’s data or by breach of technical data protection requirements.

The data controller is also liable to the data subject for damage caused by the data processor. The data controller is exempt from liability if it proves that the damage was caused by an unavoidable cause outside the scope of data processing. Damage does not have to be compensated to the extent that it resulted from the intentional or grossly negligent conduct of the injured party.

IX.8. Right to contact the data protection commissioner – right to complaint

Anyone may contact the Data Protection Commissioner if, in their opinion, they have suffered a legal infringement or are at imminent risk of such infringement in connection with the processing of their personal data or the exercise of their rights to access data of public interest or data made public in the public interest, unless court proceedings are ongoing in the given case. No one may suffer any disadvantage as a result of a report made to the Data Protection Commissioner. The reporter is entitled to the same protection as a public interest reporter.

The provisions of Act LIX of 1993 on the Parliamentary Commissioner for Citizens’ Rights (hereinafter: the Obtv.) shall apply to the proceedings and measures of the Data Protection Commissioner, with the exceptions specified in the Avtv.

X. Notification

X.1. Reporting obligation

The data controller is obliged to notify the territorially affected notary of

1. a) the purpose of the data processing;
2. b) the type of data and the legal basis for their processing;
3. c) the range of data subjects;
4. d) the source of the data;
5. e) the type of data transmitted, the recipient and the legal basis for the transmission;
6. f) the deadline for the deletion of each type of data;
7. g) the name and address (registered office) of the data controller and – if any – of the data processor, the place of actual data processing or data processing and the data processor’s activity related to data processing;
8. h) the name and contact details of the internal data protection officer.

X.3. Notifying changes

Any changes to the reported data must be reported to the local notary within 8 days.

XI. Internal data protection officer

The data controller appoints an internal data protection officer with a higher education degree.

The internal data protection officer shall:

1. a) cooperate and provide assistance in making decisions related to data processing and in ensuring the rights of data subjects;
2. b) monitor compliance with the provisions of the Avtv. and other laws relating to data processing, as well as internal data protection and data security regulations and data security requirements;
3. c) investigate the reports received and, in the event of detection of unauthorized data processing, call on the data controller or data processor to terminate it;
4. d) regularly review the internal data protection and data security regulations;
5. e) make a change notification in accordance with Section X.3 of the Regulations;
6. f) maintain the internal data protection register;
7. g) provide training in data protection knowledge as necessary.

Effective: February 1, 2023