Pursuant to Articles 12–14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: GDPR), BKK Centre for Budapest Transport (hereinafter: the Data Controller or BKK) provides the following privacy policy to data subjects regarding the processing of personal data in connection with the use of the MOL Bubi public bicycle-sharing system.
I. Details and contact information of the data controller; definitions of ‘personal data’ and ‘data subject’
Name of the Data Controller: BKK Budapesti Közlekedési Központ Zártkörűen Működő Részvénytársaság (BKK Centre for Budapest Transport)
Registered office: 1075 Budapest, Rumbach Sebestyén utca 19–21.
Contact details of the data protection officer: [email protected]
Telephone number (customer service): +36-1-3-255-255
For the purposes of this data processing Policy (hereinafter: Data Processing Policy), personal data means any information relating to an identified or identifiable natural person (hereinafter: Data Subject). A natural person is considered identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier (such as a name, number, location data, online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person).
The data subjects of the personal data processing operations described in this Privacy Policy are those natural persons who create an account registered in the MOL Bubi system and use the public transport service.
II. Description of the data processing procedure and the legislation governing data processing
The Data Controller processes personal data in accordance with Act XLI of 2012 on Passenger Transport Services, and pursuant to Municipal Decree No. 20/2012. (14 March) of the General Assembly of the Municipality of Budapest on the performance of transport organisation tasks in Budapest. To promote and develop cycling, the MOL Bubi public bicycle-sharing system has therefore been established within the territory of the City of Budapest; as a form of sustainable public transport accessible to all, it contributes to improving the capital’s transport situation, reducing environmental damage, promoting urban cycling and improving transport culture.
BO ID: or back-office ID, a unique identification number that clearly and unambiguously identifies the user.
OTP code: or One-Time Password, a login code which the system automatically generates and sends to the customer for the purpose of identification required to log in to the MOL Bubi app. It may be received via text message or email, depending on the chosen login method.
The main legislation governing data processing as set out in this Privacy Policy and the abbreviations used in this Privacy Policy are as follows:
Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR)
Act CXII of 2011 on the right to informational self-determination and freedom of information (Privacy Act)
Act XLI of 2012 on Passenger Transport Services (PT Act)
Municipal Regulation No. 20/2012 (14 March) of the General Assembly of the Municipality of Budapest on the performance of transport organisation tasks in Budapest (Appointment Decree)
Act CLV of 1997 on Consumer Protection (CP Act)
Act C of 2000 on Accounting (Accounting Act)
Act CL of 2017 on the Rules of Taxation (Taxation Act)
Act V of 2013 on the Hungarian Civil Code (Civil Code)
III. Description of the purposes of data processing, the legal basis for data processing, the scope of the data processed, and the duration of data processing
Source of personal data: Data subject
| Description and purpose of the data processing | Legal basis for data processing (In the case of Article 6(1)(c) or (e) of the GDPR, exact legal provision is specified)
|
Scope of personal data processed | Duration of data processing |
| Article 6(1)(e) of the GDPR, pursuant to Section 5(1)(1/a) of the Appointment Decree |
Name, email address, telephone number, residential address, date of birth, bankcard details, location data (GPS coordinates of the mobile device), location data relating to lock usage, BO identifier, payment balance, billing name, billing address, billing email address | BKK processes the personal data managed within the system for the duration of the operation of the Bubi 3.0 system (the term of the relevant contract), for the periods specified in the subsequent rows of the table for the respective data processing purposes. |
| Article 6(1)(b) of the GDPR, pursuant to which the processing is necessary for the performance of a contract to which the data subject is a party, or for taking steps at the request of the data subject prior to entering into a contract. |
surname and first name, address, date of birth, telephone number, email address
Bankcard details
Registration is also possible via a Google account.
|
The Data Controller will store the registrant’s personal data for 30 days following the start of registration; if the User does not activate their registration, the Data Controller will permanently delete the data after 30 days.
During this 30-day period, the Data Controller will process the registrant’s personal data solely for the purpose of facilitating the completion of their registration and may contact the registrant during this period only via a pop-up notification requesting that they complete their registration.
If, during this period, the registrant requests the deletion of their data, they may do so by emailing [email protected].
In the case of a completed registration, the Data Controller will process the registration data until the registration is cancelled. The data will be automatically deleted after 3 years of inactivity. |
After downloading the App and logging in, the system will display a pop-up window asking the User to authorise the App to use the ‘Location’ function. The App’s navigation function can only be used if the User authorises the App to use the ‘Location’ function. The User may disable this function on their device at any time. | Article 6(1)(a) of the GDPR: consent of the data subject | location data (GPS coordinates of the mobile device)
| Until consent is withdrawn or location data is disabled |
to provide the rental service, to document bicycle usage, The GPS system installed in the bicycles does not carry out continuous tracking; as a general rule, it records only lock-related activity (location of opening/closing).
| Article 6(1)(e) of the GDPR, and Section 5(1)(1/a) of the Appointment Decree |
Location data relating to locking/unlocking activities (opening/closing)
| For the duration of the user contract; for as long as the registration remains active; The data will be deleted after 3 years of inactivity (including registration details)
|
|
Pursuant to Article 6(1)(b) of the GDPR, data processing is necessary for the performance of the contract | Data provided during registration, the user’s payment balance, current product and rental contracts, billing name, billing address, billing email address (if different from the email address provided at registration), invoice reference number. The user account displays the User’s current product, the usage periods agreed in the MOL Bubi system and travel history. | For the duration of the user contract; for as long as the registration remains active; After 3 years of inactivity, the data will be deleted (including the registration details) |
| Article 6(1)(b) of the GDPR, performance of a contract |
| For the duration of the contract: for as long as the registration remains active; Data (including registration details) will be deleted after 3 years of inactivity
|
| Legitimate interests of the data controller pursuant to Article 6(1)(f) of the GDPR |
| For as long as the registration is active; data (including registration details) will be deleted after 3 years of inactivity |
| Article 6(1)(a) of the GDPR, the data subject’s consent |
| Until consent is withdrawn, or for as long as the registration remains active (until deleted by the user), or the data (including registration details) will be deleted after 3 years of inactivity Notifications will be deleted on the 60th day. |
|
Article 6(1)(a) of the GDPR, the data subject’s consent |
|
Until consent is withdrawn, or for as long as the registration remains active (until deleted by the user), or the data (including registration details) will be deleted after 3 years of inactivity |
| Compliance with a legal obligation under Article 6(1)(c) of the GDPR, pursuant to Articles 5(2), 7 and 21 of the GDPR |
| We process personal data following the cancellation of registration until the expiry of the general limitation period of 5 years, in accordance with Section 6:22 of the Civil Code. |
|
Article 6(1)(b) of the GDPR: performance of a contract | BO ID surname and first name, email address bankcard/credit card token details Transaction data (Transaction ID, Authentication ID, Service date, Transaction time, User ID, Validity start, Validity end, Name, Country, Postcode, Town, Street, House number, Legal relationship, Tokenised bankcard data, original invoice number, Email address, Tax identification number, Billing name, Billing country, Billing postcode, Billing town, Billing address, Invoice ID, Simple ID, Nevogate ID) | In connection with the enforcement of any claims, 5 years pursuant to Sections 6:21–6:25 of the Civil Code on limitation periods. |
| Article 6(1)(c) of the GDPR; compliance with a legal obligation pursuant to Section 169(2) of the Accounting Act |
|
In the event of a contract being concluded, for 8 years following the year in which the annual accounts relating to the year in which the last accounting document associated with the contract was issued were approved |
If, at the relevant time, the User has an outstanding balance in the MOL Bubi system which the system was unable to debit from the bankcard provided at the time of registration, no further usage periods may be purchased via this User account, and the data controller will deactivate the account. |
Pursuant to Article 6(1)(b) of the GDPR, the processing of the following data is necessary for the performance of the contract | surname and first name, address, date of birth |
For the duration of the user agreement; for as long as the registration remains active; The data will be deleted after 3 years of inactivity (including registration details)
If the account was deactivated because the system was unable to deduct the usage fee, the account will remain deactivated until financial settlement is made. |
In the case of payment by bankcard, the refund will automatically be credited to the same bankcard. If the Data Controller has the bankcard token details, the refund will be processed automatically. | Article 6(1)(c) of the GDPR, compliance with a legal obligation Compliance with the legal obligation set out in the provisions of the Accounting Act relating to the issuance of invoices |
Transaction details must be provided for identification purposes. The transaction can be identified using the following details: name, purchase amount, date and time, telephone number, and the first and last 4 digits of the bankcard. | In the case of transactions, the Data Controller retains the bank statement for incoming payments and refunded compensation; and, in the case of bankcards, the OTP POS list, for the period prescribed by the Accounting Act, i.e. in the case of accounting documents (and related documentation), for 8 years following the approval of the annual report for the year in which the accounting document was issued. |
| Article 6(1)(c) of the GDPR; compliance with a legal obligation pursuant to Sections 165–169 of the Accounting Act and Sections 77–78 and 202 of the Taxation Act | Billing name and address
| Invoicing details: Data Controller is obliged to retain electronic invoices issued in connection with the service for a period of 8 years following the issue of the last invoice. |
|
Article 6(1)(c) of the GDPR, compliance with a legal obligation, pursuant to Section 202(1) and Section 203(2) of the Taxation Act. | BO identifier bankcard/credit card token data transaction data (Transaction ID, Authentication ID, Service date, Transaction time, User ID, Validity start, Validity end, Name, Country, Postcode, Town, Street, House number, Legal relationship, Tokenised bankcard data, Original invoice number, Email address, Tax identification number, Billing name, Billing country, Billing postcode, Billing town, Billing address, Invoice ID, Simple ID, Nevogate ID) | The Data Controller is obliged to retain the data for 8 years. |
Users placed on the deny list in accordance with the General Terms and Conditions may not enter into a new contract or use the service. In such cases, BKK will deactivate the account and send a notification to the user. |
Pursuant to Article 6(1)(f) of the GDPR, based on the data controller’s legitimate interests | BO ID, name, email address, telephone number, residential address, date of birth |
The duration of placement on the deny list is subject to the unilateral decision of BKK |
| Article 6(1)(e) of the GDPR, pursuant to Section 5(1)(1/a) of the Appointment Decree | The identification and contact details of the person submitting the enquiry, as well as any personal data provided in connection with the enquiry and any documents supporting or relating to the enquiry.
| 8 years for complaints with financial implications; 3 years for other cases without financial implications |
| Compliance with the legal obligation under Article 6(1)(c) of the GDPR, pursuant to Article 12(2) and (6) of the GDPR |
| We store personal data until the expiry of the 5-year general limitation period, in accordance with Section 6:22 of the Civil Code.
|
| Compliance with a legal obligation under Article 6(1)(c) of the GDPR, pursuant to Section 17/A(9) of the CP Act |
| We store personal data until the expiry of the 5-year general limitation period, in accordance with Section 6:22 of the Civil Code.
|
| Article 6(1)(a) of the GDPR, the data subject’s consent |
Name, email address and telephone number of the data subject (natural person) | Until consent is withdrawn, but for a maximum of 1 year following the partner enquiry. |
| Article 6(1)(e) of the GDPR, pursuant to Section 5(1)(1/a) of the Appointment Decree | User ID, bicycle ID, journey records, device/application logs, error logs, customer service tickets, technical diagnostic data, timestamps, system events
|
During the troubleshooting process, and for as long as necessary for audit, security, legal and service development purposes
|
The Data Controller intends to carry out data processing activities for the purposes of “sending email messages to provide information on feature enhancements and other updates” and “maintaining a deny list”, which require the processing of personal data.
The legal basis for the data processing required for this is Article 6(1)(f) of the GDPR (data processing necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party).
According to the results of the balancing of interests carried out by the Data Controller in this regard:
The Data Controller considers that the legal basis for data processing for the purposes of ‘sending email messages to provide information on feature enhancements and other updates’ and ‘maintaining a deny list’ corresponds to the legitimate interest set out in Article 6(1)(f) of the GDPR. In the Data Controller’s view, the interests or fundamental rights and freedoms of the Data Subjects are not infringed during data processing in such a way as to override the Data Controller’s legitimate interest (the specific interests or fundamental rights and freedoms of the Data Subject do not take precedence over that interest).
| A legitimate interest exists |
The legitimate interest is sufficiently specific, genuine and current, as the data processing is actually necessary for the effective performance of the Data Controller’s business activities. |
| Data processing is necessary |
Data processing is necessary to fulfil the legitimate interest, as without it the Data Controller’s business objective – to provide its service as efficiently as possible whilst achieving the highest level of satisfaction – could not be realised. |
|
Data processing constitutes a proportionate restriction on the Data Subject | The interests, fundamental rights and freedoms of data subjects are not infringed upon during data processing. The data subject’s interests do not enjoy a higher level of protection than the Data Controller’s interests. Given that the data subject receives appropriate information about the data processing concerning them at the time of data collection, and that the effects of the data processing are entirely predictable due to the manner in which it is carried out, the balance of proportionality in this regard tilts in favour of the permissibility of the data processing. The proportionality of the restriction is also enhanced by the fact that the data controller provides the data subject with comprehensive, clear and easily understandable information at the time of data collection regarding the scope of the personal data being processed, the legal basis, method and duration of the data processing, and the data subject’s rights in relation to the data processing. |
In accordance with Article 21 of the GDPR, the Data Controller, clearly and separately from any other information, expressly draw the attention of natural persons who are data subjects to the fact that every data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of their personal data for the data processing purposes set out in this Policy, which are based on Article 6(1)(f) of the GDPR.
In such cases, the Data Controller may no longer process the personal data, unless the Data Controller demonstrates that the processing is justified on compelling legitimate grounds which override the interests, rights and freedoms of the Data Subject, or which relate to the establishment, exercise or defence of legal claims.
IV. The fact that automated decision-making, including profiling, takes place, as well as, at least in these cases, the logic applied and comprehensible information regarding the significance of such data processing and the likely consequences for the data subject
No automated decision-making or profiling takes place in the processing of personal data as detailed in this Privacy Policy.
V. Data security measures
The Data Controller undertakes to ensure the security of the personal data it processes. Taking into account the state of the art, the cost of implementation, the nature, scope, context and purposes of the processing, as well as the risks of varying likelihood and severity to the rights and freedoms of natural persons, shall take such technical and organisational measures and establish such procedural rules as are necessary to ensure that the data collected, stored or processed are protected, and to prevent their destruction, unauthorised use and unauthorised alteration.
The Data Controller also undertakes to require any third party to whom it transfers or discloses data on any legal basis to comply with data security requirements.
The Data Controller guarantees a level of data security commensurate with the level of risk, including, amongst other things, where applicable:
- the pseudonymisation and encryption of personal data,
- ensuring the ongoing confidentiality, integrity, availability and resilience of the systems and services used to process personal data (operational and development security, protection against and detection of intrusions, and prevention of unauthorised access),
- in the event of a physical or technical incident, the ability to restore access to personal data and the availability of such data in a timely manner (prevention of data breaches; vulnerability and incident management),
- a procedure for regularly testing, assessing and evaluating the effectiveness of the technical and organisational measures taken to ensure the security of data processing (maintaining business continuity, protection against malicious code, the secure storage, transmission and processing of data, and security training for our employees).
When determining the appropriate level of security, particular consideration must be given to the risks arising from data processing, specifically those resulting from the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to, personal data that is transmitted, stored or otherwise processed.
The Data Subject’s data is stored on the Data Controller’s secure internal servers, the protection of which complies with the highest standards of IT security. Remote access is permitted only to a limited group of authorised persons, exclusively via a virtual private network and following authentication. All operations carried out by Users and the Service Provider relating to data processing involving any changes are logged. The data is not copied onto any other physical data storage media.
The Data Controller operates the IT tools used for the processing of recorded personal data as follows:
- To ensure the protection of physical devices containing data relating to BKK.
- To ensure that only approved and authorised Users have access to the data used by the Data Controller.
- To ensure that only persons authorised to use the systems have access to the Data Controller’s data.
- To ensure that unauthorised persons cannot transmit, read, modify or delete the Data Controller’s data during data transmission or storage. The data being processed may only be accessed by the Data Controller, its employees and any data processor(s) engaged by it, in accordance with their respective authorisation levels; the Data Controller shall not disclose such data to any third party who is not authorised to access it. Employees of the Data Controller and the Data Processor may access personal data in a specified manner, in accordance with access levels, as assigned to the roles defined by the Data Controller and the Data Processor.
- To ensure that the Data Controller’s data is protected against accidental destruction or loss, and that, in the event of incidents causing such consequences, the Data Controller’s data can be accessed and restored in a timely manner.
- To ensure that the Data Controller’s data is handled separately from that of other clients. The Data Controller and the Data Processor shall classify and treat personal data as confidential. In order to protect the data files processed electronically in the various registers, the Data Controller shall ensure that the data stored in the registers – subject to the exceptions specified by law – cannot be directly linked to or attributed to the Data Subject.
- To ensure that the Data Processor regularly tests, reviews and evaluates the effectiveness of the technical and organisational measures outlined above.
- To ensure the security of its IT systems, the Data Controller protects them with a firewall and uses antivirus and anti-malware software to prevent both external and internal data loss. The Data Controller has also ensured that all incoming and outgoing communications, in whatever form, are properly monitored to prevent misuse.
VI. Data processors, data transfer
| Name and registered office of the data processor |
Activities carried out by the data processor | Personal data processed by the data processor |
|
Citybike Global S.A. Spain 08006 Barcelona, Carrer de Tuset, 20–24, 2nd floor Citybike Global S.A. Hungarian Branch (registered office: 1097 Budapest, Gubacsi út 32, Building C) |
Operation and development of the MOL Bubi system | All personal data listed in Table III |
|
Neosoft Informatikai Szolgáltató Kft. 8000 Székesfehérvár, Távirda utca 2/A 2. em. 1. | Provision of the platform required for sending mass newsletters to BKK’s registered customers listed in its own database. | town, date of registration, full name, email address, country, postcode |
|
Nevogate Payment Services Kft. 1066 Budapest, Nyugati tér 1-2. | Processing of payment transactions, as well as strong customer authentication and the detection of fraud and abuse | In the case of file uploads used to create bulk payment transactions and bulk payment links, the personal data contained in the source file and the processed file; and in the case of payment links created manually or via API, the personal data provided during link generation |
| SimplePay Zrt. | 1138 Budapest, Váci út 135–139, Building B, 5. em |
Bankcard payment service | user ID, customer’s email address, billing details: name, address, transaction details |
Data processors are authorised to process the above personal data for the duration of their contract with the Data Controller and for the period specified by law in connection therewith.
The Data Controller informs the user that, when redirected to the SimplePay website during a bankcard payment (in the case of Recurring and one-click card registration, the user ID, the purchaser’s email address and billing details: name, address) are transferred to SimplePay Zrt. as the data processor of BKK Zrt. The nature and purpose of the data processing activities carried out by the data processor can be viewed in the SimplePay Data Protection Policy at the following link: https://simplepay.hu/adatkezelesi-tajekoztatok/
In the event of a request from a public authority or court, the data requested by the authority or court will be forwarded to that authority or court.
VII. Your (the data subject’s) rights and the procedure for exercising them
The Data Controller shall, without undue delay but within one month of receiving the request, inform the data subject, via the contact details provided by them, of the measures taken in response to the request as set out below. If necessary, taking into account the complexity of the request and the number of requests, this time limit may be extended by a further two months. The Data Controller shall inform the data subject of any extension of the time limit within one month of receiving the request, stating the reasons for the delay.
As a data subject, you may exercise the rights set out below using the contact details provided:
In person:
At BKK customer service centres.
In writing:
- by post: to the customer service address, 1075 Budapest, Rumbach Sebestyén u. 19-21.
- by email: to the customer service email address bkkbkk.hu
Your right to information
The Data Controller is obliged – provided that the personal data originates from the Data Subject at the time of collection – to make the following information regarding data processing available to Data Subjects:
- the Data Controller’s name, contact details and representative;
- the contact details of the data protection officer;
- the purposes of the intended processing of personal data and the legal basis for the processing;
- in the case of data processing based on legitimate interests, the legitimate interests of the Data Controller or a third party;
- the recipients of the personal data;
- the period for which the personal data will be stored;
- whether the Data Controller intends to transfer the personal data to a third country or to an international organisation;
- information on the rights to which the Data Subject is entitled;
- in the case of data processing based on consent, the right to withdraw consent;
- the right to lodge a complaint with the supervisory authority;
- whether the provision of personal data is required by law or under a contractual obligation, or whether it is a prerequisite for entering into a contract;
- the fact of automated decision-making, including profiling.
The obligation to provide the information set out above need not be fulfilled if the Data Subject already possesses the information contained in these points.
Where the personal data have not been obtained from the Data Subject, the Data Controller shall provide the Data Subject with the above information, as well as the following additional information:
- the categories of the Data Subject’s personal data;
- the source of the personal data and, where applicable, whether the data originates from publicly available sources.
If the personal data were not obtained from the Data Subject, the obligation to provide information need not be fulfilled if:
- the Data Subject already has the information,
- it proves impossible to provide the information or would require a disproportionate effort,
- the collection or disclosure of the data is expressly required by Union law or applicable Hungarian law applicable to the Data Controller, or
- the personal data must remain confidential pursuant to a professional duty of confidentiality laid down in EU or applicable Hungarian law.
Your right of access
You have the right to receive confirmation from the Data Controller as to whether your personal data is being processed, and if such processing is taking place, you have the right to access your personal data and the following information:
- the purposes of the processing;
- the categories of personal data relating to you that are being processed;
- the recipients or categories of recipients to whom the Data Controller has disclosed or will disclose your personal data, including, in particular, recipients in third countries or international organisations;
- where applicable, the envisaged period for which the personal data will be stored, or, if this is not possible, the criteria used to determine that period;
- your right to request from the Data Controller the rectification, erasure or restriction of the processing of personal data relating to you, and to object to the processing of such personal data;
- the right to lodge a complaint with a supervisory authority (in Hungary, the National Authority for Data Protection and Freedom of Information);
- if the data was not collected from you by the Data Controller, any available information regarding its source;
- the fact that automated decision-making, including profiling, is taking place, and, at least in such cases, the logic involved and comprehensible information as to the significance of such data processing and the likely consequences for you.
The Data Controller shall provide you with a copy of the personal data subject to processing. The Data Controller may charge a reasonable fee based on administrative costs for any further copies you request. If you have submitted your request electronically, the information must be provided in a commonly used electronic format, unless you request otherwise. The right to request a copy must not adversely affect the rights and freedoms of others.
Your right to rectification and completion
Upon your request, the Data Controller is obliged to rectify any inaccurate personal data concerning you without undue delay. Taking into account the purpose of the data processing, you are entitled to request that incomplete personal data be completed, including, amongst other things, by means of a supplementary statement.
Your right to erasure
You have the right to request that the Data Controller erases your personal data. The Data Controller is obliged to erase your personal data without undue delay in the following cases:
- the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
- you withdraw your consent on which the processing is based, and there is no other legal basis for the processing;
- you object to the processing of your personal data on grounds of public interest, the exercise of official authority or the legitimate interests of the data controller (or a third party), and there are no overriding legitimate grounds for the processing, or you object to the processing of your personal data for direct marketing purposes;
- the personal data has been processed unlawfully;
- the personal data must be erased in order to comply with a legal obligation under Union or Member State law (Hungarian law) applicable to the Data Controller;
- the personal data was collected in connection with the offering of information society services.
A request for erasure cannot be complied with if the processing is necessary:
- for the purposes of exercising the right to freedom of expression and the right to information;
- to comply with a legal obligation under Union or Member State law to which the data controller is subject, or to carry out a task carried out in the public interest or in the exercise of official authority vested in the data controller;
- on grounds of public interest in the area of public health;
- for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, in so far as the exercise of the right to erasure would render impossible or seriously jeopardise such processing;
- for the establishment, exercise or defence of legal claims.
Your right to restriction of processing
You have the right to request that the Data Controller restrict data processing if any of the following apply:
- you contest the accuracy of the personal data; in this case, the restriction applies for a period enabling the Data Controller to verify the accuracy of the personal data;
- the processing is unlawful and you oppose the erasure of the data, requesting instead that its use be restricted;
- the Data Controller no longer needs the personal data for the purposes of data processing, but you require it for the establishment, exercise or defence of legal claims; or
- the Data Subject has objected to the processing; in this case, the restriction applies for as long as it remains to be determined whether the Data Controller’s legitimate grounds override those of the Data Subject.
If data processing is restricted on the basis of the above, such personal data may, apart from storage, only be processed with your consent, or for the purpose of establishing, exercising or defending legal claims, or for the protection of the rights of another natural or legal person, or for reasons of substantial public interest of the Union or of a Member State. The Data Controller shall inform you in advance – if data processing has been restricted at your request – of the lifting of the restriction on data processing. The data will remain blocked for as long as the reason you have specified necessitates the storage of the data. You may request that the data be blocked, for example, if you believe that the Data Controller has processed your data unlawfully, but it is necessary for the purposes of administrative or judicial proceedings initiated by you that the Data Controller does not erase the data.
In this case, the Data Controller will continue to store the personal data until the authority or court makes a request, after which the Data Controller will delete the data.
Your right to object
You may object to the processing of your personal data if the legal basis for the processing is:
- the performance of a task carried out in the public interest or the exercise of official authority vested in the Data Controller, as set out in Article 6(1)(e) of the GDPR;
- the legitimate interests of the Data Controller or a third party, as set out in Article 6(1)(f) of the GDPR.
Where the right to object is exercised, the Data Controller may no longer process the personal data, unless it demonstrates that there are compelling legitimate grounds for the processing which override the interests and rights of the Data Subject, or which relate to the establishment, exercise or defence of legal claims.
Where personal data are processed for the purposes of direct marketing, the Data Subject has the right to object at any time to the processing of personal data concerning them for this purpose, including profiling, insofar as it is related to direct marketing. If the Data Subject objects to the processing of their personal data for the purposes of direct marketing at , their personal data may no longer be processed for that purpose.
Your right to data portability
You have the right to receive the personal data concerning you, which you have provided to a data controller, in a structured, commonly used and machine-readable format, and you have the right to transmit those data to another data controller without hindrance from the data controller to whom you have provided the personal data, where:
- the legal basis for the processing is your consent or the performance of a contract to which you are a party, and
- the processing is carried out by automated means.
When exercising your right to data portability, you are entitled – where technically feasible – to request that your personal data be transferred directly from one data controller to another.
Exercising the right to data portability shall not prejudice the right to erasure. The right to data portability does not apply where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. The right to data portability shall not adversely affect the rights and freedoms of others.
Your right to withdraw consent
You have the right to withdraw your consent to data processing at any time. Withdrawal of consent does not affect the lawfulness of data processing carried out on the basis of consent prior to withdrawal.
Your right to seek redress
Contacting the Data Controller
We recommend that, before initiating court or administrative proceedings, you send the Data Controller your enquiry or complaint regarding the processing of your personal data so that we may investigate it and resolve it to your satisfaction, or so that we may comply with any request or claim you have made under the previous point, provided it is well-founded.
The Data Controller shall, in the event of the Data Subject exercising any of their rights relating to data processing as set out in the previous point, a request for information regarding data processing, or an objection or complaint concerning data processing, the Data Controller shall investigate the matter without undue delay, within the timeframe prescribed by the applicable legislation, take appropriate action in response to the request, and provide the Data Subject with information regarding the matter. Where necessary, taking into account the complexity of the request and the number of requests, this time limit may be extended in accordance with the law.
If the Data Subject has submitted the request electronically, the Data Controller shall provide the information electronically where possible, unless the Data Subject requests otherwise. If the Data Controller does not take action in response to the Data Subject’s request without undue delay, but at the latest within the time limit specified by law, it shall inform the Data Subject of the reasons for failing to take action, the reasons for refusing to comply with the request, and that the Data Subject may initiate court or administrative proceedings in their case as set out below.
In order to exercise your rights relating to data processing, or if you have any questions or concerns regarding the data processed by the Data Controller, or if you wish to request information regarding your data, lodge a complaint, or exercise any of your rights as set out in the previous point, you may do so via the contact details of the Data Controller listed in Section I).
Initiating legal proceedings
The Data Subject may bring proceedings against the Data Controller or – in connection with data processing operations falling within the scope of the data processor’s activities – against the data processor, if they consider that the Data Controller, or the data processor commissioned by or acting on the instructions of the Data Controller, is processing their personal data in breach of the provisions laid down in legislation or in a binding legal act of the European Union relating to the processing of personal data.
The court has jurisdiction to hear the case. The case may also be brought – at the Data Subject’s discretion – before the competent court in the Data Subject’s place of residence or habitual residence. You may also bring a civil action against BKK. The case may generally be brought before the Municipal Court of Budapest, which has jurisdiction over BKK’s registered office, or – at your discretion – before the court in the area where you are resident.
Lodging a complaint with the supervisory authority
If you believe that the Data Controller is processing your data unlawfully – without prejudice to other administrative or judicial remedies – you are entitled to lodge a complaint with the National Authority for Data Protection and Freedom of Information (NAIH) (address: 1055 Budapest, Falk Miksa utca 9–11, postal address: 1363 Budapest, Pf. 9, email: ugyfelszolgalatnaih.hu , telephone: +36 (1) 391-1400, fax: +36 (1) 391-1410, website: www.naih.hu) – in particular in the Member State of your habitual residence, place of work or the place where the alleged infringement occurred – if you consider that the Data Controller is restricting the exercise of your rights or has rejected your request to exercise those rights (initiation of an investigation), and if, in your view, the Data Controller, or a data processor commissioned by or acting on the instructions of the Data Controller, infringes the provisions governing the processing of personal data laid down in legislation or in a binding legal act of the European Union during the processing of your personal data (request for the conduct of administrative proceedings).
