PRIVACY POLICY

Processing of data related to the Pannonia Scholarship Programme

We inform you that Széchenyi István University attaches great importance to the protection of personal data and wishes to ensure the right of individuals to self-determination in all circumstances.

Széchenyi István University manages any data – that came to our attention in the context of the Alumni Portrait programme and the International Alumni of the Year Award – in accordance with the provisions of Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Privacy Act), Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

1. Name of the Data Controller

Széchenyi István University (hereinafter: the University)

address: 9026 Győr, Egyetem square 1.

email: sze@sze.hu

phone number: +36(96) 503-400

website: uni.sze.hu

2. Applicable legislation of data processing

- Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);

- Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Privacy Act);

3. Subjects of data management

- Subject of the data processing: Processing of data related to the Pannonia Scholarship Programme

- The Data subjects: applicants for tha Pannonia Scholarship Programme

4. The scope of the processed data, the purpose, duration, legal basis and source of the data processing:
   • Data processing related to the application:

Scope of the data processed:

Student data: name and first name, gender, date of birth, nationality, OM identification number, NEPTUN/ETR identification, e-mail address, level of study, field of study code, level of education, sending and recieving university, degree programme, class, type of mobility, duration of mobility, start and end of mobility, recognition of Pannonia Programme credits, mixed mobility, the amount of scholarship;

Staff data (lecturer/researcher/administrative staff): name and first name, gender, date of birth, nationality, e-mail address, university, department, position, mobility related subject code, type of mobility, start and end of mobility, sending and recieving institution;

Purpose of processing: evaluation of the application

Legal basis for processing: Point e) of Subsection (1) of Article 6 of the GDPR

The data processing is necessary for the performance of the public interest tasks of Széchenyi István University as a private higher edication institution operating as a non-profit organisation.

Duration of the data processing: the data processing lasts for 10 years from the submission of the final report related to the programme (monitoring, control), in the case of non-winning applicants for 5 years from the decision of the Board of Trustees.

• Data processing related to the implementation of the programme

Scope of the data processed:

Student data: name and first name, gender, date of birth, nationality, OM identification number, NEPTUN/ETR identification, e-mail address, level of study, field of study code, level of education, sending and recieving university, degree programme, class, type of mobility, duration of mobility, start and end of mobility, recognition of Pannonia Programme credits, mixed mobility, the amount of scholarship;

Staff data (lecturer/researcher/administrative staff): name and first name, gender, date of birth, nationality, e-mail address, university, department, position, mobility related subject code, type of mobility, start and end of mobility, sending and recieving institution;

Purpose of processing: contracting, programme implementation

Legal basis for processing: Point e) of Subsection (1) of Article 6 of the GDPR

The data processing is necessary for the performance of the public interest tasks of Széchenyi István University as a private higher edication institution operating as a non-profit organisation.

Duration of the data processing: the data processing lasts for 10 years from the submission of the final report related to the programme (monitoring, control), in the case of non-winning applicants for 5 years from the decision of the Board of Trustees.

• Report on the programme

Scope of the data processed: personal data provided by participants in the programme in the programme report

Purpose of processing: Preparing report and statistics to meet the University’s reporting requirements; producing informational materials; conducting research, surveys and disseminating the results of the programme.

Legal basis for processing: Point e) of Subsection (1) of Article 6 of the GDPR

The data processing is necessary for the performance of the public interest tasks of Széchenyi István University as a private higher edication institution operating as a non-profit organisation.

Duration of the data processing: the data processing lasts for 10 years from the submission of the final report related to the programme (monitoring, control), in the case of non-winning applicants for 5 years from the decision of the Board of Trustees.

• How the data gets processed

The data will be processed for the sole purpose of managing mobility within the Pannonia Scholarship Programme.

The maximum duration of the processing is ten (10) years, the main purpose of which is to ensure the retrievability of the data. Access to the data is limited to the staff members concerned by their tasks.

5. Data transfer, data processing

In the context of this data processing, the University will only transfer personal data to the Tempus Public Foundation.

6. Data security measures

The University will ensure adequate security of personal data, including protection against unauthorized or unlawful processing, accidental loss, destruction or damage, by implementing appropriate technical or organizational measures.

7. Your rights regarding data management

Your data protection rights and remedies, and their limitations are set out in detail in the GDPR (In particular Articles 15, 16, 17, 18, 19, 21, 22, 77, 78, 79 and 82). At any time, you may request information about your data, request the rectification, erasure or restriction of your personal data, or object to the processing of data based on a legitimate interest.

You may exercise your rights through the following contact details:

in person: 9026 Győr, Egyetem square 1.

by phone: +3696 503 400

on e-mail: adatvedelem@sze.hu

DPO: dr. Pőcze Péter

Right to request information:

You may request information about the processing of your personal information at any time in written form, such as:

-what personal information is being processed

-the legal basis on which we process your personal data

-the purpose for which we process your personal data

-the source from which we process your personal data

-how long we process your personal data

-what data management rights apply to you

-whether we will pass on your personal data and to whom

Right to rectification:

You have the right to have inaccurate personal data about you rectified by the University upon request.

The right to have information deleted

You may request in writing that the University delete your personal data. This provision shall not apply to the extent that the processing is necessary for: compliance with an obligation under EU or Member State law to which the University is subject to and to whichthe processing of personal data is subject; or the establishment, exercise or defence of legal claims.

Right to restriction

At the written request of the Data Subject

1. a) the Data Subject debates the accuracy of the personal data, in which case the restriction shall apply for a period which allows the Data Controller to verify the accuracy of the personal data;
2. b) the processing is unlawful and the Data Subject opposes the deletion of the data and instead requests that their use be restricted;
3. c) the data controller no longer needs the personal data for thepurpose of data processing, but the Data Subject requests them in order to submit, enforce or protect legal claims

Your request for a restriction on data processing must lso indicate the reason for requesting the restriction.

Right to protest

You have the right to object to data processing based on a legitimate interest for reasons related to your own situation. In this case, the University will investigate your personal data processing on the basis of a balance of interests and, if your request is found to be well-founded, we will delete your personal data. We will inform you of the result of the investigation in every case.

Right to withdraw voluntary consent

Your consent to data management can be withdrawn at any time, and you can also request the deletion of your uploaded data if your consent is withdrawn. Withdrawal of consent shall not affect the legality of the data processing prior to withdrawal.

Common rules for the exercising of rights

The University shall, without undie delay, provide information in written form, in an accessible format, within one month of the reception of the application, on the measure taken in response to the application, or on its rejection and reason.If necessary, taking into account the complexity of the application and the number of applications, this period may be enxtended by a further two months.

8. Your law enforcement options

If you consider that the data processing is unlawful, you can apply to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) or a court as follows:

-Notification of the competent authority

If you consider that the processing of your personal data – or the exercise of your rights to access public data or data of public interest – has been infringed or is in danger, you may initiate an investigation with the supervisory authority:

Contact information of NAIH:

-Initiation of an official procedure

If you find the processing of your personal data illegal, you can initiate a civil lawsuit against the Data Controller. In Hungary, such a lawsuit falls within the the jurisdiction of the regional courts. You can find out about the jurisdiction and contact information of the courts on the following website: www.birosag.hu