Privacy notice on the Processing of Personal Data in Connection with the SportKredit System

We would like to inform you that Uni Pro Sport Kft. attaches great importance to the protection of personal data. This Privacy Notice describes the processing of personal data in connection with the use of the Széchenyi SportKredit System, the purchase and management of eligibility under the SportKredit System, the recording of sports sessions, the certificates that may be issued on the basis of these records, and invoicing.

1. Name of the Data Controller:

Uni Pro Sport Kft. (Data Controller or UPS)

Address: 9026 Győr, Egyetem tér 1.

E-mail: penzugy@uniprosport.hu

2. Applicable Data Protection Legislation:

- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR);

- Act CXII of 2011 on Informational Self-Determination and Freedom of Information.;

- Act C of 2000 on Accounting

3. Subject Matter of the Processing and Data Subjects:

Subject Matter of the Processing: The purchase and management of eligibility under the SportKredit System, the recording of the use of sports opportunities and sports facilities available through the programme, the issue of certificates to data subjects, and invoicing related to the service.

Data Subjects: Natural persons who purchase eligibility under the SportKredit System and use the sports opportunities or sports facilities available through the programme.

4. Categories of Personal Data Processed, Purposes of the Processing, Retention Periods, Legal Bases for the Processing, and Sources of the Data

4.1. Purchase and Management of Eligibility under the SportKredit System

Categories of Data Processed

Categories of Personal Data Processed: Name, Neptun code, UserID and email address.

Purpose of the Processing: To enable the purchase, registration and verification of eligibility under the SportKredit System, and to allow data subjects to use the sports opportunities and sports facilities available through the SportKredit System.

Legal Basis for the Processing: Article 6(1)(b) of the GDPR, as the processing is necessary for the performance of the contract for the SportKredit System service requested by the data subject and provided for a fee.

Retention Period: For the duration of the eligibility under the SportKredit System and for two months after it expires.

Source of the Data: The data subject provides the data when purchasing eligibility under the SportKredit System.

4.2. Recording Sports Sessions and the Use of Sports Facilities, and Issuing Certificates

Categories of Personal Data Processed: UserID, and the location and time of use of the sports opportunity or sports facility.

Purpose of the Processing: To record the use of sports opportunities and sports facilities available through the SportKredit System, and to enable the issue of a certificate to the data subject, which they may present to Széchenyi István University to have the physical education requirement for the semester recognised

Legal Basis for the Processing: Article 6(1)(b) of the GDPR, where the recording of sports sessions and the option to obtain a certificate form part of the SportKredit System service and are necessary for its performance.

Retention Period: For the period necessary to record sports sessions and ensure that certificates can be issued.

Source of the Data: System data generated automatically through the use of the SportKredit System.

Presentation of the Certificate to the University: The Data Controller makes the certificate available to the data subject. The data subject decides whether to present it to Széchenyi István University to have the physical education requirement for the semester recognised. For this purpose, UPS does not automatically transfer detailed sports activity data to the University.

4.3. Data Processing for Invoicing

Categories of Personal Data Processed: Name, billing address and email address.

Purpose of the Processing: To invoice the fee for the service provided through the SportKredit System, issue invoices and fulfil related accounting obligations.

Legal Basis for the Processing: Article 6(1)(c) of the GDPR, as necessary to comply with the Data Controller’s legal obligations relating to invoicing and accounting under Act C of 2000 on Accounting.

Retention Period: For the statutory retention period prescribed by the applicable invoicing and accounting legislation.

Source of the Data: The data subject.

4.4. Data Management Process

The data subject may purchase eligibility under the SportKredit System. To manage this eligibility, UPS processes the identification and contact details specified in this Privacy Notice. Once eligibility has been obtained, data subjects may use the sports opportunities and sports facilities available through the programme. The system logs the location and time of each sports session in association with the user’s UserID. On the basis of these data, a certificate may be issued to the data subject, who may choose to present it to Széchenyi István University to have the physical education requirement for the semester recognised. UPS processes the invoicing data associated with the service fee in order to fulfil its statutory obligations.

5. Data Transfers and Data Processing

The Uni Pro Sport Kft. transfers personal data to third parties only in exceptional cases, where permitted by law or with the data subject’s consent. The Uni Pro Sport Kft. uses the following data processor for the processing activity below.

UNINET Stúdió Kft. – as the system operator

9026 Győr, Egyetem tér 1.

6. Data Security Measures:

The Uni Pro Sport Kft. ensures the appropriate security of personal data by implementing suitable technical and organisational measures. These measures include protection against unauthorised or unlawful processing, accidental loss, destruction or damage.

7. Your Data Protection Rights:

Your data protection rights, remedies and the limitations applicable to them are set out in detail in the GDPR (in particular, Articles 15, 16, 17, 18, 19, 21, 22, 77, 78, 79 and 82). You may request information about your personal data at any time, request the rectification or erasure of your data or the restriction of its processing, and object to processing based on legitimate interests.

You may exercise your rights using the following contact details:

n person: 9026 Győr, Egyetem tér 1.

by e-mail: penzugy@uniprosport.hu

Right to Information:

You may request written information at any time about the processing of your personal data, including:

• what personal data we process about you;
• the legal basis on which we process your personal data;
• the purposes for which we process your personal data;
• the source of your personal data;
• how long we process your personal data for;
• what data protection rights you are entitled to exercise; and
• whether we transfer your personal data and, if so, to whom.

Right to Rectification

You have the right to request that the Uni Pro Sport Kft. rectify inaccurate personal data concerning you.

Right to Erasure:

You may request in writing that the Uni Pro Sport Kft. erase your personal data. This right does not apply where the processing is necessary to comply with a legal obligation under EU or Member State law applicable to the Uni Pro Sport Kft. that requires the processing of personal data, or for the establishment, exercise or defence of legal claims.

Right to Restriction of Processing:

The data controller shall restrict the processing of personal data at the data subject’s written request where one of the following conditions applies:

1. a) the data subject contests the accuracy of the personal data, in which case the processing shall be restricted for a period enabling the data controller to verify the accuracy of the personal data;
2. b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
3. c) the data controller no longer needs the personal data for the purposes of processing, but the data subject requires them for the establishment, exercise or defence of legal claims.

The request for restriction of processing must also specify the grounds on which the data subject seeks the restriction.

Right to Object:

You have the right to object, on grounds relating to your particular situation, to the processing of your personal data based on legitimate interests. In such cases, the Uni Pro Sport Kft. will review the processing of your personal data carried out on the basis of legitimate interests. If your objection is found to be justified, your personal data will be erased. You will be informed of the outcome of the review in all cases.

Right to Withdraw Consent:

Consent to the processing of personal data may be withdrawn at any time. If you withdraw your consent, you may also request the erasure of the data you have uploaded. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

General Rules for Exercising Your Rights:

The Uni Pro Sport Kft. shall provide, without undue delay and within one month of receiving the request, a written response in an intelligible and accessible form, informing you of any action taken in response to your request or of the reasons for refusing to act. Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months.

General Rules for Exercising Your Rights:

The Uni Pro Sport Kft. shall provide, without undue delay and within one month of receiving the request, a written response in an intelligible and accessible form, informing you of any action taken in response to your request or of the reasons for refusing to act. Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months.

8. Your Right to Seek Redress

If you consider the processing of your personal data to be unlawful, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) or bring the matter before a court, as set out below:

Complaint to the Supervisory Authority

If you believe that your rights have been infringed in connection with the processing of your personal data, or with the exercise of your rights of access to public interest data or data accessible on public interest grounds, or that there is an imminent risk of such an infringement, you may request an investigation by the supervisory authority:

Contact Details of the Hungarian National Authority for Data Protection and Freedom of Information (NAIH)

Bringing Legal Proceedings

If you find that the processing of your personal data is unlawful, you may bring civil proceedings against the data controller. In Hungary, such proceedings fall within the jurisdiction of the regional courts (törvényszék). Information about the jurisdiction and contact details of the courts is available at: www.birosag.hu.