PRIVACY NOTICE on the processing of personal data in connection with the use of the UniBonus system

The University places great importance on the protection of personal data and is committed to safeguarding individuals’ right to informational self-determination under all circumstances.

Széchenyi István University processes all personal data that comes to its knowledge in the course of processing in accordance with Act CXII of 2011 on Informational Self-Determination and Freedom of Information and REGULATION (EU) 2016/679 of the EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

1. Name of the Data Controller:

Széchenyi István University (hereinafter: the University)

Address: 9026 Győr, Egyetem tér 1.

E-mail: sze@sze.hu

Phone: +36(96) 503-400

Website: uni.sze.hu

2. Applicable Data Protection Legislation:

- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR);

- Act CXII of 2011 on Informational Self-Determination and Freedom of Information;

3. Subject Matter of the Processing and Data Subjects:

The subject matter of the processing is the management of personal data necessary for the operation of the UniBonus digital university service, verification of university eligibility, use of the digital university card, access to partner discounts, and management of sports supporter eligibility associated with the system.

The data subjects are students, staff and alumni users of the UniBonus service, as well as designated contacts at partner organisations and persons authorised to represent them. The data subjects for each individual processing activity are also specified below.

4. Categories of Personal Data Processed, Purpose, Retention Period, Legal Basis and Source of the Data

4.1 Data Processing

4.1. User Account, Identification and Verification of University Eligibility

Data Subjects: Students, staff and alumni

Categories of Personal Data Processed: EduID/directory username; user category and eligibility status; an internal identifier required for the operation of the system; and the photograph appearing on the student, staff or alumni card. For students, the EduID is typically linked to the Neptun code; for alumni users, the previous Neptun code or a directory username provided by the user may also be used. For staff, processing the employee identification number may also be necessary for identification purposes.

Purpose of the Processing: to identify the user, provide access to the UniBonus service, and verify the university eligibility associated with the user’s account.

Legal Basis for the Processing: for services provided by the University in the performance of its public tasks, Article 6(1)(e) of the GDPR; for contractual services used by the data subject, Article 6(1)(b) of the GDPR, as applicable to the service concerned.

Retention Period: until the user’s eligibility remains valid or for as long as necessary for the relevant processing purpose. A user account remains active until the data subject requests its deletion or, at the latest, until the active status of the student card or staff card ends, in the case of students and staff respectively, while for alumni users it remains active for no more than three years from the date of their last login. After these dates, the user account will be deleted.

Source of the Data: the University’s directory and the Card Management System (KMR); the eligibility status is updated through a daily automated query.

4.2. Digital University Card

Data Subjects: students, staff and alumni users who use the UniBonus digital card.

Categories of Personal Data Processed: identification and eligibility data required to display the digital card, the card number, the employee identification number for staff, where necessary, and a photograph, as provided by the design of the digital card.

Purpose of the Processing: to display the digital university card and verify the user’s identity and university eligibility.

Legal Basis for the Processing: Article 6(1)(e) of the GDPR where the digital card serves an identification and eligibility-verification function related to the University’s public tasks; otherwise, Article 6(1)(b) of the GDPR.

Retention Period: for as long as the user remains eligible to use the digital card.

Source of the Data: the University’s relevant records and directory systems.

4.3. Redeeming Partner Discounts and Statistical Records of Discount Usage

Data Subjects: UniBonus users who redeem partner discounts.

Categories of Data Processed: the time when the QR code is scanned, the identification of the partner providing the discount, and, where the technical solution ensures that the data subject cannot be identified from it, the user category (student, staff or alumni).

Purpose of the Processing: to enable the technical processing of discount redemptions, to facilitate the settlement required for the partner relationship, and to produce anonymous or appropriately aggregated statistics on usage.

Legal Basis for the Processing: Article 6(1)(b) of the GDPR where the processing is associated with a service involving the redemption of discounts; genuinely anonymous statistical data do not constitute personal data.

Retention Period: for as long as necessary for partner settlement and the handling of any potential legal claims; the specific retention period will be determined when the partner agreements and the system’s data retention arrangements are finalised.

Source of the Data: system data generated in the UniBonus system when a discount is redeemed.

Note: The partner is not provided with the user’s name, email address, university ID or any other data that would enable the user to be directly identified.

4.4. Processing of Data Relating to Partner Contacts

Data Subjects: Persons authorised to represent UniBonus partner organisations and their designated contacts

Categories of Personal Data Processed: Name, title/position, email address, telephone number, and information relating to the organisation represented

Purpose of the Processing: To establish and maintain contractual relationships with partners, liaise with them, and handle related administrative matters

Legal Basis for the Processing: The University’s legitimate interest in maintaining a business or institutional relationship with the partner, pursuant to Article 6(1)(f) of the GDPR; where the contracting party is a natural person, Article 6(1)(b) of the GDPR

Retention Period: For the duration of the partner relationship and thereafter for as long as necessary to pursue any related legal claims

Source of the Data: The partner organisation and/or the data subject acting as its contact

4.5. Technical and Operational Notifications

Data Subjects: UniBonus users

Categories of Personal Data Processed: User or device identifiers technically required to deliver notifications, and system data necessary to send them

Purpose of the Processing: To inform users about system operation, technical issues or scheduled maintenance

Legal Basis for the Processing: The legal basis applicable to the operation of the underlying UniBonus service, pursuant to Article 6(1)(b) of the GDPR. No marketing notifications are currently sent.

Retention Period: For as long as necessary to deliver the notification and, where applicable, to maintain technical logs. The precise retention period will be determined when the technical solution is finalised.

Source of the Data: The UniBonus system

4.6. System and Security Logging

Data Subjects: UniBonus users and, where a log entry can be linked to an individual, administrative users

Categories of Personal Data Processed: Event and log data necessary for the secure operation of the system, troubleshooting and auditing. The precise categories of data will be specified in the final technical logging specification.

Purpose of the Processing: To ensure the security and integrity of the system and its accountable operation, and to investigate errors and unauthorised access.

Legal Basis for the Processing: Article 6(1)(e) of the GDPR, or the legal basis applicable to the processing associated with the relevant system function. Article 32 of the GDPR provides the framework for determining appropriate security measures.

Retention Period: For as long as necessary for security and operational purposes. The precise retention period will be specified in the final logging policy.

Source of the Data: System data generated automatically through the use of the UniBonus system

4.7. Data Management Process

Users log in to the UniBonus system using their university directory credentials (EduID). The system verifies their university eligibility status against the Card Management System (KMR) and stores the eligibility data on a University server. The system makes the functions available to each user according to their eligibility. When a user redeems a partner discount, the system processes the minimum event data necessary for the redemption of the discount, and the partner is not provided with any data that would enable the user to be directly identified. Technical and security events necessary for the operation of the system may also be logged. The flow of payment and invoicing data associated with eligibility in the SportKredit system forms a separate service-provider process.

5. Data Transfers and Data Processing

The University transfers personal data to third parties only in exceptional cases, where authorised by law or with the data subject’s consent. For this data processing the University engages the following data processor:

UNINET Stúdió Kft. – system operator

9026 Győr, Egyetem tér 1.

6. Data Security Measures:

The University ensures the appropriate security of personal data by implementing suitable technical and organisational measures. These measures include protection against unauthorised or unlawful processing, accidental loss, destruction or damage.

7. Your Data Protection Rights:

Your data protection rights, remedies and the limitations applicable to them are set out in detail in the GDPR (in particular, Articles 15, 16, 17, 18, 19, 21, 22, 77, 78, 79 and 82). You may request information about your personal data at any time, request the rectification or erasure of your data or the restriction of its processing, and object to processing based on legitimate interests.

You may exercise your rights using the following contact details:

In person: 9026 Győr, Egyetem tér 1.

By telephone: +36 96 503 400

By e-mail: adatvedelem@sze.hu

Data Protection Officer: Dr Péter Pőcze

Telephone: +36 96 503 400, extension 3173

Right to Information:

You may request written information at any time about the processing of your personal data, including:

• what personal data we process about you;
• the legal basis on which we process your personal data;
• the purposes for which we process your personal data;
• the source of your personal data;
• how long we process your personal data for;
• what data protection rights you are entitled to exercise; and
• whether we transfer your personal data and, if so, to whom.

Right to Rectification

You have the right to request that the University rectify inaccurate personal data concerning you.

Right to Erasure:

You may request in writing that the University erase your personal data. This right does not apply where the processing is necessary to comply with a legal obligation under EU or Member State law applicable to the University that requires the processing of personal data, or for the establishment, exercise or defence of legal claims.

Right to Restriction of Processing:

The data controller shall restrict the processing of personal data at the data subject’s written request where one of the following conditions applies:

1. a) the data subject contests the accuracy of the personal data, in which case the processing shall be restricted for a period enabling the data controller to verify the accuracy of the personal data;
2. b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
3. c) the data controller no longer needs the personal data for the purposes of processing, but the data subject requires them for the establishment, exercise or defence of legal claims.

The request for restriction of processing must also specify the grounds on which the data subject seeks the restriction.

Right to Object:

You have the right to object, on grounds relating to your particular situation, to the processing of your personal data based on legitimate interests. In such cases, the University will review the processing of your personal data carried out on the basis of legitimate interests. If your objection is found to be justified, your personal data will be erased. You will be informed of the outcome of the review in all cases.

Right to Withdraw Consent:

Consent to the processing of personal data may be withdrawn at any time. If you withdraw your consent, you may also request the erasure of the data you have uploaded. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

General Rules for Exercising Your Rights:

The University shall provide, without undue delay and within one month of receiving the request, a written response in an intelligible and accessible form, informing you of any action taken in response to your request or of the reasons for refusing to act. Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months.

8. Your Right to Seek Redress

If you consider the processing of your personal data to be unlawful, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) or bring the matter before a court, as set out below:

Complaint to the Supervisory Authority

If you believe that your rights have been infringed in connection with the processing of your personal data, or with the exercise of your rights of access to public interest data or data accessible on public interest grounds, or that there is an imminent risk of such an infringement, you may request an investigation by the supervisory authority:

Contact Details of the Hungarian National Authority for Data Protection and Freedom of Information (NAIH)

Bringing Legal Proceedings

If you find that the processing of your personal data is unlawful, you may bring civil proceedings against the data controller. In Hungary, such proceedings fall within the jurisdiction of the regional courts (törvényszék). Information about the jurisdiction and contact details of the courts is available at: www.birosag.hu.