- Details of Controller Name of controller: Gattyán Foundation (Gattyán Alapítvány) Registered office: 1101 Budapest, Expo tér 5-7. Registration number: 01-01-0012819 Website: https://gattyanalapitvany.hu/ E-mail address: firstname.lastname@example.org
- Laws and regulations serving as basis or background of the processing a) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, “GDPR”) b) Act CXII of 2011 on Informational Self-Determination and Freedom of Information (“Privacy Act”) c) Act V of 2013 on the Civil Code of Hungary (“Civil Code”) e) Act C of 2000 on Accounting (“Accounting Act”)
- Characteristics of the processing activities
3.1. Execution of payment transactions and invoicing In case the donor intends to provide Controller with a donation, the donation may take place by wire transfer or card payment. In the case of wire transfer, the Controller shall process the name and bank account number of the donor, as well as the amount of donation; in the case of payment via PayPal, the e-mail address of the donor and the amount of donation shall pe processed; in the case of card payment, the name, e-mail address, address, phone number of the donor and the amount of donation shall be processed. The Controller shall process the personal data in the course of the fundraising for the purpose of execution of payment transactions and for meeting the related statutory accounting obligations. The Controller shall issue and retain the invoices issued in connection with the payment of donation, as accounting supporting documents, for a retention period of 8 years as set out in Article 169 of the Act on Accounting, then the data shall be deleted. The ground for processing is the compliance with a legal obligation to which the Controller is subject (Article 6(1)c of GDPR). Based on the consent of the Data Subject, Controller shall forward the following personal data submitted on the website www.gattyanalapitvany (hereinafter: Website) to OTP Mobil Kft. (1093 Budapest, Közraktár u. 30-32.), as processor. Categories personal data forwarded: family name, given name, country, phone number, e-mail address. Purpose of data forwarding: providing users with customer support assistance, confirmation of transactions and fraud monitoring carried out for the protection of users. Controller shall not transfer personal data to third countries or to non-governmental organizations. Furthermore, no automated decision making or profiling shall be carried out in respect of the personal data processed.
3.2. Publication of the name of the donor On the basis of the consent given by the donor, the Controller shall publish the name of the donor on the Website. The purpose of the processing is to promote the fundraising activity of Controller. The ground for processing is the consent of the Data Subject (Article 6(1)a of GDPR). The processing is voluntary. The Data Subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. The Controller shall process the name of the donor until the withdrawal of the consent or the elapse of the term needed for the fulfillment of the purpose of the processing. Controller shall not transfer personal data to third countries or to non-governmental organizations. Furthermore, no automated decision making or profiling shall be carried out in respect of the personal data processed.
3.3. Processing of contact data of persons contacting the Controller The Controller processes the contact data of the persons contacting the Controller at the contact details set out on the Website, including the web form on the website, for the purpose of keeping contact, the ground for processing is to take steps at the request of the data subject prior to entering into a contract between the Data Subject and the Controller and the performance of the contract (Article 6(1)b of GDPR). The personal data shall be retained for the following periods of time: 5 years from the performance of the agreement under Article 6:22 of the Civil Code of Hungary (if no agreement is concluded by and between the parties, then the personal data shall be deleted after 2 months from the last communication). Controller shall not transfer personal data to third countries or to non-governmental organizations. Furthermore, no automated decision making or profiling shall be carried out in respect of the personal data processed.
3.4. Newsletters The Controller processes the name and e-mail address of the persons contacting the Controller via the web form on the Website or by other means in writing; the purpose of processing is to send newsletters; the ground for processing is the consent of the data subject (Article 6(1)a of GDPR). The newsletters sent by the Controller pertain to the activities of the Controller, the tasks planned and carried out by, and the initiatives pursued by, the Controller. The processing is voluntary. The Data Subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. The Controller shall process the name and e-mail address of the Data Subject until the withdrawal of the consent.
3.5. Processing of contact details and details of legal representatives set out in contract. In its agreements made with legal entities and associations not having legal personality, the Controller sets out the personal data (name and contact details) concerning the representative and contact person of the contracting person. The above specified personal data are processed for the following purposes: keeping smooth contact, providing information, consulting with respect to all legal and real acts related to the contract, which is carried out for the preparation, execution, performance of the agreement, management of complaints, resolving of issues, termination of the agreement, and enforcement of legal claims. The grounds for processing is the legitimate interest pursued by the Controller (Article 6(1)f of GDPR), which pertains to the followings: prompt and smooth, oral discussion of the questions and notifications with the contractual partner, that may arise in the course of the preparation, performance and termination of the agreement, resolution of any issues, management of complaints, and enforcement of legal claims , in order to take the necessary measures and – if necessary – record the contents thereof in written form. The Controller shall process the personal data concerning the contact persons and representatives for the retention period of 8 years set out in the Act on Accounting (Article 169 of the Act on Accounting), then the above personal data shall be deleted.
3.6. Processing of photographs. The events held with the participation of the representatives of the Controller may be photographed. With the exception of recordings made of a crowd, the Controller requests the consent of the data subject under Article 2:48, which may be given in writing or by conduct. The Controller pays attention that in the case of minor data subjects, the consent of the legal representative shall be made in written form. The Controller publishes the photographs on the Website, but the use of the photographs by third parties is not permitted without the prior written consent of the Controller. The Controller groups the photographs by events but shall not use them for identification purposes and shall not use facial recognition software on them.
3.8. Information on the cookies used on the Website
What is a cookie and what is its purpose?
Own and foreign cookies
On the one hand, the Controller may use own cookies on the Website, the purpose and function of which is determined by the Controller, without the influence of a third party. On the other hand, the Controller may allow third-party service providers to place foreign cookies on the Website for the reasons mentioned above. For example, in order to understand what content a user is viewing or what services they are using on the Website, what they are interested in, and how the Controller can improve its services, the Controller can enlist the help of a data analyzing service providers, including Google Analytics. The user can prevent the analysis performed by Google Analytics by installing the Google Analytics Browser Blocker (http://tools.google.com/dlpage/gaoptout).
Guaranteeing the safe operation of the Website
Analysis and research
How can the user manage the cookies?
If the user disables all cookies on the Website in the settings of their browser or device, they can use the services of the Website in a restricted manner.
This category of cookies enables the Website to remember the prior settings made by the eser (e.g. to display the Website in English or Hungarian language), thereby it provides the user with a higher level, more personalized service. The information collected by these cookies are anonymized and cannot serve for tracking the browsing activity of the user on other websites.