PRIVACY POLICY - Regarding applications for dormitory housing

We inform you that Széchenyi István University attaches great importance to the protection of personal data and wishes to ensure the right of individuals to self-determination in all circumstances.

Széchenyi István University manages any data – that came to our attention in the context of the Alumni Portrait programme and the International Alumni of the Year Award – in accordance with the provisions of Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Privacy Act), Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

1. Name of the Data Controller

Széchenyi István University (hereinafter: the University)

address: 9026 Győr, Egyetem square 1.

email: sze@sze.hu

phone number: +36(96) 503-400

website: uni.sze.hu

2. Applicable legislation of data processing:

Sector-specific and data protection laws

• GDPR: Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);
• Infotv.: Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Privacy Act);
• Act CCIV of 2011 on National Higher Education (Nftv.);
• Government Decree 87/2015. (IV. 9.) on the implementation of certain provisions of Act CCIV of 2011 on National Higher Education;
• Government Decree 51/2007. (III. 26.) on benefits available to students enrolled in higher education and certain fees payable by them.

University regulations:

• Organizational and Operational Regulations of the Halls of Residence of Széchenyi István University.

3. Subject Matter and Data Subjects of the Data Processing:

• Subject matter of the data processing: Applications for accommodation in the Halls of Residence of Széchenyi István University, the scoring and assessment of applications, the organization and administration of accommodation and communication with applicants and residents.
• Data Subjects of the data processing: Hungarian and international students of Széchenyi István University (both first-year and continuing students) who apply for and are admitted to accommodation in the University’s Halls of Residence.

4. The scope of the processed data, the purpose, duration, legal basis and source of the data processing:

4.1. Mandatory Data Processing (for dormitory applications and assessment)

4.2 Data provided on a voluntary basis

4.3 Processing of Special Categories of Personal Data and Other (view-only) Data

These data are not stored in the dormitory administration system; they are inspected solely for the purpose of verifying eligibility or the justification of a request.

• Health data (special category of personal data):

• Categories of data: Health information provided by the student, provided that it affects their dormitory housing situation (e.g., request for an accessible room).

• Purpose: Assessment of the justification for special accommodation needs.

• Legal basis: Explicit consent of the data subject (Article 9(2)(a) of the GDPR).

• Method of processing: View-only; not recorded in the database, and no copies of documents are made.

• Relationship data:

• Categories of data: In the case of requesting a co-educational (mixed) room, the fact that the students are a couple (no other additional data is requested).

• Purpose: Allocation of co-educational rooms.

• Legal basis: Consent of the data subject (Article 6(1)(a) of the GDPR).

• Method of processing: View-only; no such relationship or status is recorded in the system

4.1.1 Data Processing Procedure:

1. Data transfer from Neptun: During the application process, the student's basic data, academic, or admission results are automatically retrieved from the Neptun system into the dormitory administration system.
2. Integration of scores: The scores determined by the Student Union (social and student activities) and the House Rules Supervisory Committee (disciplinary scores) are aggregated by the system with the academic scores coming from Neptun to establish the ranking.
3. Decision-making and placement: The Halls of Residence Committee and the staff of the Halls of Residence and University Housing Centre decide on admission based on the scores received. The placement and room allocation of admitted students are organized by the Halls of Residence and University Housing Centre and Uni-Famulus Kft., the company responsible for operations.
4. Contact: During the period of housing, information and official communication are conducted via the provided email address and phone number.

5. Data transfer, data processing

The University does not transfer personal data to third countries or unauthorized third parties. The dormitory administration system does not transfer any data. In order to support the application procedure and the operation of the dormitory, the University engages the following data processor:

• Name of the data processor: UNINET Stúdió Kft.

• Registered office: H-9026 Győr, Egyetem tér 1.
• Tax number: 14523748-4-08
• Website: https://uninet.hu/
• Activity performed: operation of the dormitory administration system, provision of its IT background, and its maintenance.

• Name of the data processor: Uni-Famulus Kft.

• Registered office: 9026 Győr, Egyetem tér 1.
• Tax number: 25807622-4-08
• Website: https://uni-famulus.hu/
• Activity performed: operation of reception and security services

6. Data Security Measures:

By implementing appropriate technical and organizational measures, the University ensures the appropriate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage. Access to the dormitory administration system and Neptun data is restricted exclusively to university staff acting within their scope of duties and bound by confidentiality obligations (members of the Halls of Residence and University Housing Centre, the Halls of Residence Committee, and designated staff of Uni-Famulus Kft.) on an interface protected by a unique identifier and password.

7. Your right regarding data management:

Your data protection rights and remedies, and their limitations are set out in detail in the GDPR (In particular Articles 15, 16, 17, 18, 19, 21, 22, 77, 78, 79 and 82). At any time, you may request information about your data, request the rectification, erasure or restriction of your personal data, or object to the processing of data based on a legitimate interest.

You may exercise your rights through the following contact details:

in person: 9026 Győr, Egyetem square 1.

by phone: +3696 503 400

on e-mail: adatvedelem@sze.hu

DPO: dr. Pőcze Péter

Right to request information:

You may request information about the processing of your personal information at any time in written form, such as:

-what personal information is being processed

-the legal basis on which we process your personal data

-the purpose for which we process your personal data

-the source from which we process your personal data

-how long we process your personal data

-what data management rights apply to you

-whether we will pass on your personal data and to whom

Right to rectification:

You have the right to have inaccurate personal data about you rectified by the University upon request.

Right to erasure:

You may request the University in writing to erase your personal data. This provision shall not apply to the extent that the data processing is necessary: for compliance with a legal obligation which requires processing of personal data by Union or Member State law to which the University is subject, or for the establishment, exercise, or defense of legal claims.

Right to restriction of processing:

At the written request of the data subject, the data controller shall restrict data processing where one of the following applies:
a) the accuracy of the personal data is contested by the data subject, in which case the restriction applies for a period enabling the data controller to verify the accuracy of the personal data;
b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
c) the data controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims.
In the request for the restriction of data processing, the specific reason for requesting the restriction must also be indicated.

Right to object:

You shall have the right to object, on grounds relating to your particular situation, to the processing of your personal data based on the balancing of legitimate interests. In this case, the University shall review the processing of your data carried out under the legal basis of legitimate interest, and if your request is found to be justified, your personal data will be erased. You will be informed of the outcome of the review in all cases

Right to withdraw voluntary consent:

Consent given for data processing may be withdrawn at any time. In the event of the withdrawal of your consent, you may also request the erasure of your uploaded data. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Common rules of practice:

The University shall, without undie delay, provide information in written form, in an accessible format, within one month of the reception of the application, on the measure taken in response to the application, or on its rejection and reason.If necessary, taking into account the complexity of the application and the number of applications, this period may be enxtended by a further two months.

8. Your law enforcement options:

If you consider that the data processing is unlawful, you can apply to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) or a court as follows:

Notification of the competent authority

If you consider that the processing of your personal data – or the exercise of your rights to access public data or data of public interest – has been infringed or is in danger, you may initiate an investigation with the supervisory authority:

Contact information of NAIH:

-Initiation of an official procedure

If you find the processing of your personal data illegal, you can initiate a civil lawsuit against the Data Controller. In Hungary, such a lawsuit falls within the the jurisdiction of the regional courts. You can find out about the jurisdiction and contact information of the courts on the following website: www.birosag.hu