Privacy policy

1.1. The purpose of this Data Protection and Data Processing Policy (hereinafter referred to as the “Policy”) is to establish the data protection and data processing policy of the Hungarian Rectors’ Conference (registered office: 1068 Budapest, Benczúr u. 43. IV/3., Hungary; tax identification number: 18477113-2-42; court registration number: 06-03-0000002; hereinafter referred to as the “Service Provider” or “Data Controller”), taking into account the principles of data protection and data processing laid down by applicable law. Furthermore, the Policy aims to define the categories of personal data processed through the website operated by the Service Provider and accessible at www.mrk.hu (hereinafter referred to as the “Website”), to specify the methods of data processing, and to ensure compliance with the constitutional principles of data protection and data security requirements, as well as to prevent unauthorized access to, alteration, disclosure or use of personal data.

1.2. In pursuit of the above objectives, the Service Provider shall process the personal data of persons accessing or browsing the Website, including visitors who have registered on the Website (hereinafter referred to as “Registered Visitors”), visitors who have not registered on the Website (hereinafter referred to as “Visitors”), and persons who have engaged in activities identified as use of the Website on or after 19 September 2023 (hereinafter collectively referred to as “Users”), confidentially and in accordance with applicable laws and regulations. The Service Provider shall ensure the security of such personal data, implement the necessary technical and organizational measures, and establish appropriate procedural rules to ensure compliance with the relevant legal provisions and other applicable recommendations.

1.3. The Service Provider accepts no responsibility for the content of websites operated by third parties, whether such websites are accessible via links provided on the Website or contain links directing users to the Service Provider's Website.

1.4. In the event of any amendments or updates to this Policy, the Service Provider shall inform Users through its Website to ensure that they remain informed of any changes concerning the collection, use and disclosure of personal data.

1.5. If you have any questions regarding this Policy, please contact us at mrk@mrk.hu.

Name: Hungarian Rectors’ Conference
Registered Office: 1068 Budapest, Benczúr u. 43. IV/3., Hungary
Postal Address: 1068 Budapest, Benczúr u. 43. IV/3., Hungary
Tax Identification Number: 18477113-2-42
Court Registration Number: 06-03-0000002
Represented by: Dr. Béla Merkely, President
Registering Court: Szeged Regional Court
Email Address: mrk@mrk.hu

Name: Hrenko Kft.
Registered Office: 4461 Nyírtelek, Petőfi Sándor utca 4., Hungary
Email Address: info@hrenko.hu

• Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR).
• Act V of 2013 on the Civil Code.
• Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information.
• Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities.
• Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services.
• Act VI of 1998 on the Promulgation of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, signed in Strasbourg on 28 January 1981.
• Act CXIX of 1995 on the Processing of Name and Address Data for Research and Direct Marketing Purposes.

Data File: The entirety of data processed within a single filing system.

Data Processing Operations: All operations performed on personal data by a data processor acting on behalf of or under the instructions of the Data Controller.

Data Processor: Any natural or legal person, or organization without legal personality, which processes personal data on behalf of or under the instructions of the Data Controller, within the framework and under the conditions laid down by law or a binding legal act of the European Union.

Processing of Personal Data: Any operation or set of operations performed on data, irrespective of the method applied, including, in particular, the collection, recording, organization, storage, alteration, use, retrieval, transmission, disclosure, alignment or combination, restriction, erasure and destruction of data, as well as the prevention of further use of data, the taking of photographs, audio or video recordings, and the recording of physical characteristics suitable for identifying a person (e.g. fingerprints, palm prints, DNA samples or iris images).

Restriction of Processing: The marking of stored personal data with the aim of limiting their processing in the future.

Data Controller: Any natural or legal person, or organization without legal personality, which, independently or jointly with others, determines the purposes of processing personal data, makes and implements decisions concerning such processing (including the means used), or has such decisions implemented by a Data Processor, within the framework laid down by law or a binding legal act of the European Union.

Data Publisher: A body performing public functions which publishes on a website data provided to it by the body responsible for the data, where the latter does not publish such data itself.

Data Destruction: The complete physical destruction of the data carrier containing the data.

Data Transfer: Making data accessible to a specified third party.

Data Erasure: Rendering data unrecognizable in such a manner that their restoration is no longer possible.

Personal Data Breach: A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized transmission or disclosure of, or access to, personal data transmitted, stored or otherwise processed.

Administrator: A Registered Visitor who has administrator privileges within the System.

Identifiable Natural Person: A natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Personal Data: Any information relating to an identified or identifiable natural person (Data Subject).

Pseudonymization: The processing of personal data in such a manner that the personal data can no longer be attributed to a specific Data Subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

Recipient: Any natural or legal person, or organization without legal personality, to which personal data are made available by the Data Controller or the Data Processor.

Data Concerning Health: Personal data relating to the physical or mental health of a natural person, including data concerning the provision of healthcare services, which reveal information about the person's health status.

EEA State: A Member State of the European Union or another state that is a party to the Agreement on the European Economic Area, as well as a state whose nationals enjoy the same legal status as nationals of a state party to the Agreement on the European Economic Area under an international agreement concluded between the European Union and its Member States and a state that is not a party to the Agreement on the European Economic Area.

Data Subject: Any identified or identifiable natural person.

Third Country: Any country that is not an EEA State.

Third Party: Any natural or legal person, or organization without legal personality, other than the Data Subject, the Data Controller, the Data Processor, or persons who, under the direct authority of the Data Controller or Data Processor, are authorized to perform operations involving the processing of personal data.

Consent: Any freely given, specific, informed and unambiguous indication of the Data Subject's wishes by which the Data Subject, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to them.

Data Accessible on Public Interest Grounds: Any data not falling within the definition of data of public interest, the disclosure, availability or accessibility of which is required by law in the public interest.

Joint Data Controller: A Data Controller which, within the framework laid down by law or a binding legal act of the European Union, jointly determines the purposes and means of processing with one or more other Data Controllers, and jointly makes and implements decisions concerning such processing (including the means used), or has such decisions implemented by a Data Processor.

Onward Transfer of Personal Data: The transfer of personal data to a Data Controller or Data Processor operating in a third country or within an international organization through another Data Controller or Data Processor operating in a different third country or within an international organization.

International Organization: An organization and its subordinate bodies governed by public international law, or any other body established by, or on the basis of, an agreement between two or more states.

Public Disclosure: Making data accessible to anyone.

Profiling: Any form of automated processing of personal data consisting of the use of personal data to evaluate, analyze or predict certain personal aspects relating to a Data Subject, in particular aspects concerning performance at work, economic situation, health, personal preferences or interests, reliability, behavior, location or movements.

System: A system operated by the Service Provider that performs specific functions on the Website and may only be accessed following registration.

The Website may be visited without providing personal data. However, certain services available on the Website require Users to provide specific information requested by the Service Provider.

The Data Controller processes personal data relating exclusively to natural persons on the Website, since personal data, by definition, relate only to natural persons. Anonymous information collected by the Data Controller in a manner that precludes personal identification and cannot be linked to a natural person shall not constitute personal data. The same applies to demographic data collected without being associated with the personal data of identifiable individuals, thereby preventing any link from being established to a natural person.

The Data Controller does not verify the personal data provided by Users, and the person providing such data shall bear sole responsibility for their accuracy and appropriateness.

The User warrants that, when visiting the Website and using the services provided by the Data Controller, they have lawfully obtained the consent of any other natural person whose personal data they provide or make accessible for processing (e.g. when publishing content created by the User).

The User shall bear full responsibility for any User-generated content uploaded to or shared through the Website or the services provided by the Data Controller.

When providing their personal data (e.g. username, identifier, password, etc.) during purchases, registration, commenting, submission of complaints or other activities, the User also assumes responsibility for ensuring that only they use the services through the email address provided or by using the credentials submitted.

Accordingly, all liability arising from logins performed using a registered email address and/or the associated credentials shall rest exclusively with the User who registered the email address and provided the relevant information. The Data Controller disclaims any legal or financial liability in connection with the processing of such data.

The Data Controller also disclaims any legal or financial liability for damages incurred by the User as a result of inaccurate, incomplete or outdated personal data provided when using any service offered by the Data Controller, particularly the User's name, residential address or email address, or as a result of the User's email account being unable to receive messages.

Users may contact the Data Controller through the Website. Such contact may be made for the purposes of general inquiries, submitting requests or registering for events.

Purpose of Processing: To establish contact with the User and respond to messages submitted by the User.

Categories of Personal Data Processed: Name, email address, any personal data included in the message and, optionally, telephone number, educational qualifications and job title.

Legal Basis for Processing: The User's consent.

Method of Processing and Data Storage: Personal data shall be processed until the communication has been concluded, but no later than the date on which the inquiry has been answered. No further processing operations shall be carried out thereafter; however, the email correspondence shall be archived.

Users may subscribe to a newsletter through the Website.

Purpose of Processing: To send informational newsletters containing news about higher education (press monitoring summaries) to subscribers of the newsletter service.

Categories of Personal Data Processed: Email address.

Legal Basis for Processing: The User's consent.

Method of Processing and Data Storage: Personal data or other information that can be linked to the User in connection with the newsletter service shall be processed until consent is withdrawn. Personal data relating to the distribution of newsletters shall be stored on the Data Controller's own server.

Purpose of Processing: To enable Users to familiarize themselves with the terms and conditions of the services provided in connection with registration for events organized by the Hungarian Rectors’ Conference (HRC) and to use such services.

Categories of Personal Data Processed: Name, email address, job title, institution and additional comments (e.g. food intolerances).

Legal Basis for Processing: The User's consent.

Method of Processing and Data Storage: Personal data shall be processed until the User objects to such processing or deletes their account. The Data Controller may delete inactive accounts where no login has occurred for a period of up to two calendar years.

Registered Users may freely modify any personal data provided on the Website, except for their registered email address. Registered Users may delete their name from the System by removing it from their profile.

Deletion of a User account may be requested by the User from their registered email address or, in the event of the User's legal incapacity, by a close relative from another email address.

In all cases, a request for account deletion may only be submitted by email addressed to the Service Provider at mrkmrk.hu.

The Data Controller places anonymous user identifiers (cookies) on the User's computer or mobile device. Such cookies do not, in themselves, enable the identification of the User and serve solely to recognize the User's computer or mobile device.

The provision of personal information (e.g. name or email address) is not required, as the User does not directly provide personal data to the Data Controller through the use of this technology; data are exchanged exclusively between devices.

The Data Controller uses cookies to gain a better understanding of Users' information consumption habits, thereby improving the quality of its services, and to display personalized content and marketing (advertising) materials during visits to the Website.

Users may configure their browser settings to prevent cookies from being stored on their computers or mobile devices. Users acknowledge that disabling cookies may result in certain services not functioning properly.

Data processing operations carried out through cookies are based on the User's voluntary consent, which is provided by accepting the cookie notice displayed when visiting the Website.

The Service Provider uses Google Analytics software to obtain independent website traffic statistics and other web analytics data. Accordingly, Google Inc. acts as a Data Processor in relation to such data.

The Privacy Policy of Google Inc. is available at:

https://policies.google.com/privacy?hl=hu

By using the services provided through the Website, the User acknowledges that they consent to the processing of their data by Google through their use of the Website.

The Service Provider uses Google AdWords and Facebook remarketing codes on the Website.

Remarketing codes use cookies to tag visitors to the Website. These cookies enable advertisements relating to the Service Provider's services to be displayed on other websites within the Google Display Network and on Facebook when Users subsequently visit those platforms.

Users may disable cookies at any time and customize the advertisements displayed to them through Google's advertising settings.

By using the services, the User consents to the Company transferring their personal data to partners directly involved in the performance of contractual obligations. Such data shall be transferred only to the extent necessary for the performance of the relevant contracts.

Legal Basis for Data Transfer: Performance of a contract.

Name: Hrenko Kft.
Registered Office: 4461 Nyírtelek, Petőfi Sándor utca 4., Hungary
Email Address: info@hrenko.hu
Represented by: András Hrenkó
Company Registration Number: 15 09 075268
Tax Identification Number: 11695985-2-15

The personal data provided by Users are stored on servers operated by the web hosting service provider for the purpose of ensuring the operation of the Website.

Access to such data is restricted to the employees of the Data Controller and the personnel responsible for operating the servers, all of whom are responsible for ensuring the secure processing of the data.

Duration of Processing: Personal data shall be processed until the Website ceases to operate or in accordance with the contractual agreement between the Website operator and the web hosting service provider.

Where necessary, Users may also contact the web hosting service provider directly to request the erasure of their personal data.

The Data Controller shall be entitled and obliged to transfer to the competent authorities any personal data lawfully stored and available to it where such transfer is required by applicable law or a final and binding decision of a competent authority.

The Data Controller shall not be held liable for such transfers of personal data or for any consequences arising therefrom.

The Data Controller shall transfer personal data to parties other than those specified above only with the User's prior consent.

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.

The Service Provider shall notify the competent data protection supervisory authority of a personal data breach without undue delay and, where feasible, no later than 72 hours after becoming aware of it.

Where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the Data Controller shall inform the User of the personal data breach without undue delay.

For any questions or concerns relating to data protection, Users may contact the Hungarian National Authority for Data Protection and Freedom of Information (hereinafter referred to as the “NAIH”).

Contact Details of the NAIH:

Registered Office: 1055 Budapest, Falk Miksa utca 9–11., Hungary
Postal Address: 1363 Budapest, P.O. Box 9, Hungary
Telephone: +36 1 391 1400
Email Address: ugyfelszolgalat@naih.hu
Website: https://www.naih.hu

Users shall have the following rights in relation to the processing of their personal data.

Where the processing of personal data is based on consent, the User shall have the right to withdraw their consent at any time.

The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

The User shall have the right to obtain confirmation from the Data Controller as to whether or not personal data concerning them are being processed and, where that is the case, to obtain access to the personal data and the following information:

• The purposes of the processing;
• The categories of personal data concerning the User;
• The recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;
• Where possible, the envisaged period for which the personal data will be stored or, if this is not possible, the criteria used to determine that period;
• The existence of the User's right to request from the Data Controller the rectification or erasure of personal data, or restriction of processing of personal data concerning them, or to object to such processing;
• The right to lodge a complaint with a supervisory authority;
• The existence of automated decision-making, including profiling, and, at least in such cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the User;
• Where the personal data are not collected from the User, any available information as to their source;
• Where personal data are transferred to a third country or an international organization, information concerning the appropriate safeguards relating to the transfer.

The Data Controller shall provide the User with the above information in writing, in a concise, transparent and intelligible form, as soon as possible and in any event no later than 30 days following receipt of the request.

The information shall be provided free of charge, provided that the User has not submitted a request concerning the same subject matter to the Data Controller during the current calendar year. In other cases, the Data Controller may charge a fee to cover the associated costs.

The User shall have the right to obtain from the Data Controller, without undue delay and in any event within 15 days of the request, the rectification of inaccurate personal data concerning them.

Taking into account the purposes of the processing, the User shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

The User shall have the right to obtain from the Data Controller the erasure of personal data concerning them without undue delay, and in any event within 15 days of the request, where one of the following grounds applies:

• The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• The User withdraws the consent on which the processing is based, and there is no other legal ground for the processing;
• The User objects to the processing, and there are no overriding legitimate grounds for the processing;
• The personal data have been unlawfully processed;
• The personal data must be erased to comply with a legal obligation under Union or Member State law to which the Data Controller is subject;
• The personal data have been collected in relation to the offer of information society services.

Personal data shall not be erased where processing is necessary:

• For exercising the right to freedom of expression and information;
• For compliance with a legal obligation requiring processing under Union or Member State law to which the Data Controller is subject (e.g. the retention of invoicing data), or for reasons of public interest;
• For the establishment, exercise or defense of legal claims.

The User shall have the right to obtain from the Data Controller restriction of processing where one of the following conditions applies:

• The User contests the accuracy of the personal data, in which case processing shall be restricted for a period enabling the Data Controller to verify the accuracy of the personal data;
• The processing is unlawful, and the User opposes the erasure of the personal data and requests the restriction of their use instead;
• The Data Controller no longer needs the personal data for the purposes of processing, but they are required by the User for the establishment, exercise or defense of legal claims; or
• The User has objected to processing, in which case the restriction shall apply pending verification of whether the legitimate grounds of the Data Controller override those of the User.

Where processing has been restricted in accordance with the above provisions, such personal data shall, with the exception of storage, only be processed with the User's consent, or for the establishment, exercise or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.

The Data Controller shall inform the User who has requested the restriction of processing before the restriction is lifted.

The Data Controller shall communicate any rectification or erasure of personal data or restriction of processing referred to above to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.

The User shall have the right to receive the personal data concerning them which they have provided to the Data Controller in a structured, commonly used and machine-readable format.

The User shall also have the right to transmit those data to another Data Controller where both of the following conditions are met:

• The processing is based on the User's consent or on a contract; and
• The processing is carried out by automated means.

The User shall have the right to object, on grounds relating to their particular situation, at any time to the processing of personal data concerning them in the following circumstances:

• Processing based on legitimate interests: Where the processing is based solely on the legitimate interests pursued by the Data Controller or a third party, except in cases of mandatory processing required by law. In such cases, the Data Controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the User, or grounds relating to the establishment, exercise or defense of legal claims.
• Processing for direct marketing purposes: Where personal data are processed for direct marketing purposes without the User's consent. Where the User objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
• Processing for scientific or historical research or statistical purposes: Where personal data are processed for scientific or historical research purposes or statistical purposes, the User shall have the right to object, on grounds relating to their particular situation, to the processing of personal data concerning them, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

The Data Controller shall examine the objection as soon as possible and in any event within 15 days following receipt of the request, determine whether the objection is justified, and notify the User of its decision in writing.

The rights of Users set out in this Section may be restricted by law for the purposes of safeguarding national and public security, including national defense, state security, the prevention, investigation or prosecution of criminal offenses, and the security of the enforcement of criminal penalties.

Such restrictions may also be imposed to protect important economic or financial interests of the state, local authorities or the European Union; to prevent and investigate disciplinary or ethical misconduct relating to professional activities, or breaches of employment and occupational health and safety obligations, including related monitoring and supervisory activities; and to protect the rights of the User or of other persons.

Users may lodge complaints concerning the processing of their personal data with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) (address: 1055 Budapest, Falk Miksa utca 9-11., Hungary; telephone: +36 1 391 1400; email: ugyfelszolgalat@naih.hu; website: https://www.naih.hu).

In the event of an infringement of their rights, Users shall have the right to seek judicial remedies.

Legal proceedings concerning such infringements shall fall within the jurisdiction of the regional courts. At the User's discretion, proceedings may also be initiated before the regional court having territorial jurisdiction over the User's place of residence or habitual residence.

Upon request, the Data Controller shall inform the User of the available legal remedies and the procedures for exercising them.

Effective Date: 19 September 2023, until revoked

Dated: Budapest, 19 September 2023