The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the individual, information may also be provided orally, provided that the identity of the individual is proven by other means.
The Company will respond without unreasonable delay and by no means later than within one month of receipt to the request of an individual whereby such person exercises his/her rights about the measures taken upon such request (see articles 15-22 of the GDPR). This period may be, if needed, extended by further two months in the light of the complexity of the request and the number of requests to be processed. The Company notifies the individual about the extension also indicating its grounds within one months of the receipt of the request. Where the request has been submitted by electronic means, the response should likewise be sent electronically unless the individual otherwise requests.
In case the Company does not take any measure upon the request, it shall so notify the individual without delay but by no means later than in one month stating why no measures are taken and about the opportunity of the individual to lodge a complaint with the data protection authority and to file an action with the courts for remedy.
The data subject’s right of access
The affected person has the right to obtain confirmation from the Company whether or not personal data concerning him/her are being processed. Where the case is such, then he/she is entitle to have access to the personal data concerned and to the following information:
a) the purposes of the processing;
b) the categories of personal data concerned;
c) the recipients or categories of recipient to whom the personal data have been or will be disclosed;
d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
e) the right of the affected person to request from the Company rectification or erasure of personal data or restriction of processing of personal data concerning the affected person or to object to such processing;
f) the right to lodge a complaint with a supervisory authority;
g) where the personal data are not collected from the data subject, any available information as to their source.
The Company provides a copy of the personal data undergoing processing to the data subject. The Company may charge a reasonable fee based on administrative costs for requested further copies. Where the affected person submitted his/her request in electronic form, the response will be provided to him/her by widely used electronic means unless otherwise requested by the data subject.
1. Right to rectification
The data subject has the right to request that the Company rectify inaccurate personal data which concern him/her without undue delay. In addition, the data subject is also entitled to have incomplete personal data completed e.g. by a supplementary statement or otherwise.
2. Right to erasure (’right to be forgotten’)
The affected person has the right that when he/she so requests, the Company erase the personal data concerning him/her without delay where one of the following grounds applies:
a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed by the Company;
b) the affected person withdraws consent on which the processing is based, and is no other legal ground subsists for the processing;
c) the affected person objects to the processing and there are no overriding legitimate grounds for the processing;
d) the personal data have been unlawfully processed;
e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the Company is subject;
f) the collection of the personal data occurred in connection with offering services regarding the information society.
The above points (a)-f) shall not apply to the extent that processing is necessary, among other things, for:
a) exercising the right of freedom of expression and information;
b) compliance with a legal obligation which requires processing by Union or Member State law to which the Company is subject;
c) archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in so far as the right referred to in paragraph (1) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
d) the establishment, exercise or defence of legal claims.
3. Right to restriction of processing
The affected person has the right to obtain a restriction of processing from the Company where one of the following applies:
a) the accuracy of the personal data is contested by the affected person, for a period enabling the Company to verify the accuracy of the personal data;
b) the processing is unlawful and the affected person opposes the erasure of the personal data and requests the restriction of their use instead;
c) the Company no longer needs the personal data for the purposes of the processing, but the affected person requires them for the establishment, exercise or defence of legal claims;
d) the affected person has objected to processing based on the legitimate interest of the Company pending the verification whether the legitimate grounds of the Company override those of the affected person.
Where processing has been restricted under the above points a)-d), such personal data shall, with the exception of storage, only be processed with consent of the affected person or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
The Company informs the affected person whose request has served as grounds for the restriction based on the aforesaid, before the restriction of processing is lifted.
4. Notification obligation regarding rectification or erasure of personal data or restriction of processing
The Company will communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The Company informs the affected person about those recipients if he/she so requests.
5. Right to data portability
The individual has the right to receive the personal data concerning him/her, which he/she has provided to the Company in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the Company, where:
a) the processing is based on consent or on a contract; and
b) the processing is carried out by automated means.
In exercising the right to data portability pursuant to paragraph 1, the individual shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
Exercising the aforesaid right shall not contravene to provisions concerning the right to erasure (‘right to be forgotten’) and, further, this right shall not harm the rights and freedoms of others.
6. Right to object
The affected person has the right to object, on grounds relating to his/her particular situation, at any time to processing of personal data concerning him/her for the purposes of legitimate interests. The Company will no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the affected person or for the establishment, exercise or defence of legal claims.
Where personal data are processed for scientific or historical research purposes or statistical purposes, the affected person, on grounds relating to his/her particular situation, has the right to object to processing of personal data concerning him/her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
7. Right to lodge a complaint with a supervisory authority
The affected person has the right to lodge a complaint with a supervisory authority, in particular in the Member State of his/her habitual residence, place of work or place of the alleged infringement if he/she considers that the processing of personal data relating to him/her infringes the GDPR. In Hungary, the competent supervisory authority is the Hungarian Authority for Data Protection and Freedom of Information (http://naih.hu; 1530 Budapest, Pf.: 5.; telephone: +36-1-391-1400; fax: +36-1-391-1410; e-mail: firstname.lastname@example.org)
8. Right to an effective judicial remedy against a supervisory authority
The affected person has the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning him/her.
The affected person has the right to an effective judicial remedy where the supervisory authority which is competent does not handle a complaint or does not inform him/her within three months on the progress or outcome of the complaint lodged.
Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established.
9. Right to an effective judicial remedy against the Company or the processor
The affected person, without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority, has the right to an effective judicial remedy where he/she considers that his/her rights under the GDPR have been infringed as a result of the processing of his/her personal data in non-compliance with the GDPR.
Proceedings against the Company or a processor shall be brought before the courts of the Member State where the Company or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the affected person has habitual residence. In Hungary, the competent court is the tribunal. The affected person has the right to initiate proceedings at the tribunal of his/her domicile or place of residence. You can find information on the competent courts at www.birosag.hu.