Privacy Notice

on the processing of data related to participation in the exhibition

MNB-Ingatlan Kft. (hereinafter referred to as MNB-Ingatlan) hereby informs its visitors and other participants of its events (hereinafter referred to as data subjects) about its practices regarding the processing of personal data, the organizational and technical measures taken to protect the data, as well as the rights of those concerned (data subject) in this regard and the possibilities of their enforcement.

1.Actors involved in data management

1.1. Data Controller

Name: MNB-Ingatlan Kft. (MNB-INGATLAN),

Contact: info@mnbarts.hu

1.2. Data Processor

The Data Controller does not use a data processor in the course of data processing.

2. Data management activities

2.1. Registration

Purpose of data processing	If registration is required for participation in the exhibition (event), the purpose of data processing is to identify the applicants, confirm the registration, and admit the persons registered for the event.
Legal basis for data processing	Consent of the data subject (Article 6(1)(a) GDPR).
Scope of data processed	• Name • E-mail address
Duration of data processing	Until the exhibition (event) takes place.
Place of storage	MNB-INGATLAN stores the data exclusively in Hungary on its own internal server.
Scope of access	Strictly limited, designated employees of the Data Controller employed in the framework of an employment relationship or other employment relationship for whom it is strictly necessary for the achievement of the above purpose.

2.2. Admission

Purpose of data processing	Identification and entry of exhibition participants and the safe and smooth running of the event.
Legal basis for data processing	Consent of the data subject (Article 6(1)(a) GDPR).
Scope of data processed	• Name • E-mail address
Duration of data processing	Until the Data Subject requests the deletion of their data or withdraws their consent.
Place of storage	MNB-INGATLAN stores the data exclusively in Hungary on its own internal server.
Scope of access	Strictly limited, designated employees of the Data Controller employed in the framework of an employment relationship or other employment relationship for whom it is strictly necessary for the achievement of the above purpose.

2.3. Signing of the attendance sheet

Purpose of data processing	Documenting and confirming the attendance of the participants by signing the participation form.
Legal basis for data processing	Consent of the data subject (Article 6(1)(a) GDPR).
Scope of data processed	• Name • E-mail address
Duration of data processing	Until the Data Subject requests the deletion of their data or withdraws their consent.
Place of storage	MNB-INGATLAN stores the data exclusively in Hungary on its own internal server.
Scope of access	Strictly limited, designated employees of the Data Controller employed in the framework of an employment relationship or other employment relationship for whom it is strictly necessary for the achievement of the above purpose.

2.4. Data processing related to the issue of an invoice

Purpose of data processing	To invoice the fees for the services related to participation in the exhibition and to ensure financial accounting in accordance with legislation and legal obligation.
Legal basis for data processing	It processes the data pursuant to a legal obligation under Article 6(1)(c) of the GDPR.
Scope of data processed	• Name • Address • E-mail address • TAX number • Phone number
Duration of data processing	It is kept until the expiry of the eight-year retention period specified in Article 169 of Act C of 2000 on Accounting.
Place of storage	MNB-INGATLAN stores the data exclusively in Hungary on its own internal server.
Scope of access	Strictly limited, designated employees of the Data Controller employed in the framework of an employment relationship or other employment relationship for whom it is strictly necessary for the achievement of the above purpose.

2.5. Data management of contracted partners

Purpose of data processing	To fulfil the contractual obligations related to the participation in the exhibition and to ensure efficient relations with the contracted partners.
Legal basis for data processing	Legitimate interest of Data Controllers (Article 6(1)(f) GDPR).
Scope of data processed	• Contact name • Contact email address • Contact phone number
Duration of data processing	The Data Controller processes personal data for the duration of the purpose of the processing, in particular during the term of the contract between the parties or until the data subject requests the deletion of his or her data.
Place of storage	MNB-INGATLAN stores the data exclusively in Hungary on its own internal server.
Scope of access	Strictly limited, designated employees of the Data Controller employed in the framework of an employment relationship or other employment relationship for whom it is strictly necessary for the achievement of the above purpose.

2.6. Subscription to the newsletter

Purpose of data processing	An electronic newsletter will be sent from time to time about current and future exhibitions, events and other news.
Legal basis for data processing	Consent of the data subject (Article 6(1)(a) GDPR).
Scope of data processed	• Name • E-mail address
Duration of data processing	Until the Data Subject requests the deletion of their data or withdraws their consent.
Place of storage	MNB-INGATLAN stores the data exclusively in Hungary on its own internal server.
Scope of access	Strictly limited, designated employees of the Data Controller employed in the framework of an employment relationship or other employment relationship for whom it is strictly necessary for the achievement of the above purpose.

2.7. Management of event performers’ data

Purpose of data processing	Maintaining contact with the event’s speakers, organising and delivering the presentations and documenting the speakers’ activities.
Legal basis for data processing	Pursuant to Article 6(1)(b) of the GDPR, it processes data for the purpose of the performance of rights and obligations under a contract.
Scope of data processed	• Name • E-mail address • TAX number • Phone number • Bank account detalis
Duration of data processing	The Data Controller processes personal data for the duration of the purpose of the processing, in particular during the term of the contract between the parties or until the Data Subject requests the erasure of his or her data.
Place of storage	MNB-INGATLAN stores the data exclusively in Hungary on its own internal server.
Scope of access	Strictly limited, designated employees of the Data Controller employed in the framework of an employment relationship or other employment relationship for whom it is strictly necessary for the achievement of the above purpose.

2.8. Handling of complaints

Purpose of data processing	To effectively handle and investigate complaints about the exhibition and take the necessary measures to remedy the problems, and to liaise effectively with the complainant.
Legal basis for data processing	Consent of the data subject (Article 6(1)(a) GDPR).
Scope of data processed	• Name • E-mail address • Phone number
Duration of data processing	Until the Data Subject requests the deletion of their data or withdraws their consent.
Place of storage	MNB-INGATLAN stores the data exclusively in Hungary on its own internal server.
Scope of access	Strictly limited, designated employees of the Data Controller employed in the framework of an employment relationship or other employment relationship for whom it is strictly necessary for the achievement of the above purpose.

2.9. Giveaway contest

Purpose of data processing	Running the giveaway contest, identifying and notifying the winners and distributing/sending out the prizes.
Legal basis for data processing	Consent of the data subject (Article 6(1)(a) GDPR).
Scope of data processed	• Name • E-mail address • Phone number
Duration of data processing	Until the Data Subject requests the deletion of their data or withdraws their consent.
Place of storage	MNB-INGATLAN stores the data exclusively in Hungary on its own internal server.
Scope of access	Strictly limited, designated employees of the Data Controller employed in the framework of an employment relationship or other employment relationship for whom it is strictly necessary for the achievement of the above purpose.

2.10. Photography and video recording

Purpose of data processing	Taking pictures, recording the proceedings of the event, promoting future events on the website of the Data Controller and its media partners, on social media platforms and for the purpose of documenting the event, for which the processing and use of images of the Event is necessary.
Legal basis for data processing	Legitimate interest of Data Controllers (Article 6(1)(f) GDPR).
Scope of data processed	• Images of persons captured on film • Recorded events: behaviour of the persons concerned • Recorded sound (video recording only) • Place and time of recording (video recording only)
Duration of data processing	Until the Data Subject requests the deletion of their data or withdraws their consent.
Place of storage	MNB-INGATLAN stores the data exclusively in Hungary on its own internal server.
Scope of access	Strictly limited, designated employees of the Data Controller employed in the framework of an employment relationship or other employment relationship for whom it is strictly necessary for the achievement of the above purpose.

2.11. Security camera footage

Purpose of data processing	Ensuring security and order at the exhibition, and documenting incidents on the scene and using them for investigative purposes.
Legal basis for data processing	Legitimate interest of Data Controllers (Article 6(1)(f) GDPR)
Scope of data processed	• Images of persons captured on film • Recorded events: behaviour of the persons concerned • Recorded sound (video recording only) • Place and time of recording (video recording only)
Duration of data processing	For a maximum of 30 days from the date of the recording, or 3 days for cameras that also view public areas, unless an infringement is recorded, in which case until the infringement is investigated.
Place of storage	MNB-INGATLAN stores the data exclusively in Hungary on its own internal server.
Scope of access	Strictly limited, designated employees of the Data Controller employed in the framework of an employment relationship or other employment relationship for whom it is strictly necessary for the achievement of the above purpose.

3. Transmission of data:

3.1 Transmission of data inland

The personal data provided in section 2.10 will be transmitted by our Company to the founder of the Company (Magyar Nemzeti Bank, 1013 Budapest, Krisztina körút 55., info@mnb.hu) on a case-by-case basis, in order to enable the founder to control the organisation of exhibitions and events of the Company and to enable the Magyar Nemzeti Bank to use it for illustration purposes for its publications.

Our Company discloses personal data to courts, public prosecutors, other authorities and official bodies in the context of the performance of our statutory obligations or in the case of enforcement of claims, to the extent and in the manner appropriate.

3.2 Transmission of data to a third country

The data will not be transferred outside Hungary.

4. How data is processed, data security

MNB-Ingatlan, as the Data Controller, will take all reasonable steps to ensure that the personal data collected, stored or processed by it are accurate and, where necessary, kept up to date, and to delete or correct inaccurate personal data.

We use appropriate technical and organisational measures to ensure adequate security of personal data against unauthorised or unlawful processing, accidental loss, destruction, alteration or damage. Please note, however, that data transmission via the Internet cannot be considered a fully secure data transmission. The Data Controller makes every effort to ensure that processes are as secure as possible, but we cannot accept full responsibility for the transmission of data via our websites, although we do maintain strict standards for the security of data received by the Data Controller and to prevent unlawful access.

The Data Controller shall ensure that the processed data cannot be accessed, disclosed, transmitted, modified or deleted by unauthorised persons. Only the Data Controller, its employees and its data processors shall have access to the processed data.

The Data Controller uses a data processor in connection with offers sent by e-mail and other mass e-mail inquiries, information and data cleansing. The Data Controller and the data processors it uses are entitled to access personal data in accordance with the legislation in force.

A personal data breach is any event that results in the unlawful processing or treatment of personal data processed, transmitted, stored or handled by the Data Controller, in particular unauthorised or accidental access, alteration, disclosure, deletion, loss or destruction, accidental destruction or accidental damage to personal data. The Data Controller shall notify the National Authority for Data Protection and Freedom of Information of the personal data breach without undue delay and no later than 72 hours after becoming aware of the personal data breach, unless the Data Controller can demonstrate that the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. The Data Controller shall keep records of data protection incidents for the purpose of monitoring the measures taken in relation to the data protection incident and informing the data subjects.

5.Affected Rights

5.1. Right to information

You have the right to request information on whether MNB-INGATLAN processes your personal data and, if so, on the material circumstances of the processing (e.g. the purpose of the processing, the legal basis of the processing, etc.).

5.2. Right of access

You have the right to access, obtain or request a copy of your personal data.

5.3. Right to rectification

Under the right to rectification, you have the right to request:

to correct inaccurate data
to complete incomplete data

5.4. Right to erasure

You have the right to have your personal data deleted by MNB-INGATLAN upon your request if one of the conditions is met:

The personal data is no longer necessary for the purposes for which it was originally collected or processed by MNB-INGATLAN.
You object to the processing and MNB-INGATLAN does not have a compelling legitimate interest to continue processing the data.
In case of unlawful processing.
You need to delete the data to comply with a legal obligation.

In exceptional cases, your data may not be deleted even if the conditions are met. For example, if you need to retain it for the establishment, exercise or defence of legal claims.

5.5. Right to restriction of processing

If you dispute the accuracy of your personal data, you have the right to request MNBINGATLAN to restrict the processing of your personal data until it has been verified.

If the data processing is unlawful or the storage period has expired, but you request it in order to enforce your legal rights, you may also request the restriction of processing instead of the deletion of the data.

Restriction of processing means that MNB-INGATLAN will only store your data. It does not change the data or perform any other operations on it.

MNB-INGATLAN may use your restricted data if you have given your consent, or:

for the establishment, exercise or defence of legal claims
to protect the rights of another person.

5.6. Right to object

You have the right to object to the processing of your personal data at any time on grounds relating to your particular situation.

MNB-INGATLAN may still process your personal data if:

there is a compelling legitimate interest, or
compelling legitimate grounds.

5.7 Complying with data subjects’ requests

If you consider that your personal data is not being processed in accordance with the applicable data protection requirements, you may request a remedy. We will respond within a maximum of 25 days of receiving your request. If we are unable to comply with your request, or if we need more time because of its complexity or, in the case of multiple requests, its volume, you will be informed within the same 25 days. In such cases, the time limit may be extended up to a maximum of another 25 days.

5.8 Right to legal redress

You have the right to lodge a complaint with the National Authority for Data Protection and Freedom of Information (NAIH). The NAIH website is https://naih.hu /.

Address

E-mail / Mailing address

Phone number

1055 Budapest,

Falk Miksa utca 9-11

ugyfelszolgalat@naih.hu 1363 Budapest, Pf.: 9.

+36 (30) 683-

5969

+36 (30) 549-

6838

You have the right to go to court. In the event of unlawful processing, you may bring a civil action, which will be heard by a court of law. The action may also be brought before the court of your place of residence. More information is available at http://birosag.hu/torvenyszeke k .