RESEARCH PRIVACY NOTICE - For University review and publication decision -Which Clock Binds? Financing, Fulfilment and Deadline Failure in Equipment-Dependent Service SMEs
Research study
Which Clock Binds? Financing, Fulfilment and Deadline Failure in Equipment-Dependent Service SMEs
Researcher
Seyed Mehdi Alavi, PhD researcher, Doctoral School of Regional and Business Administration Sciences, Széchenyi István University, Győr
- CONTROLLER
The controller for the processing is Széchenyi István University.
The University acts as controller in respect of the further processing, within the framework of the doctoral research, of the research dataset transferred to it after prior data minimisation and pseudonymisation.
Controller: Széchenyi István University
Registered office: 9026 Győr, Egyetem tér 1. HUNGARY
E-mail: sze@sze.hu
Data Protection Officer:
Dr Péter László Pőcze
Contact: adatvedelem@sze.hu
The source companies holding the original identifiable commercial records act as independent controllers in respect of their original processing activities and their decisions concerning the authorisation of the further use and disclosure of those data for research purposes. The University receives only the research dataset that has been previously minimised and pseudonymised. The re-identification key is not transferred to or otherwise made available to the University.
- PURPOSE OF THE PROCESSING
The purpose of the processing is to conduct the scientific research entitled “Which Clock Binds? Financing, Fulfilment and Deadline Failure in Equipment-Dependent Service SMEs” within the doctoral programme of Széchenyi István University, to produce the research results, and to prepare the doctoral dissertation and scientific publications directly related to the doctoral research.
The research retrospectively analyses existing commercial records in order to reconstruct time-bounded business episodes relating to equipment acquisition, equipment renewal or associated financing decisions. The analysis examines which of the relevant processes — including financing and payment, supplier and fulfilment, logistics, and operational readiness — constituted the determining timing constraint within the documented business episode.
- LEGAL BASIS FOR UNIVERSITY-SIDE PROCESSING
The legal basis for the processing is Article 6(1)(e) GDPR, read in conjunction with Article 6(3) GDPR. The processing is necessary for the performance of the public-interest tasks in the fields of higher education and scientific research entrusted to Széchenyi István University.
The statutory basis for these public-interest tasks is provided by Section 2 of Act CCIV of 2011 on National Higher Education, and, in relation to doctoral education, by Section 53(1) of the same Act. In accordance with this statutory framework, the Founding Charter of Széchenyi István University identifies education, scientific research and artistic creative activities among the public-benefit activities of the University.
The present processing is directly connected with these tasks, as it is carried out within the University’s doctoral programme for the purposes of conducting doctoral research, producing research results, and preparing the doctoral dissertation and related scientific publications.
Scientific research processing must be subject to appropriate technical and organisational safeguards in accordance with Article 89(1) GDPR, in particular to ensure compliance with the principle of data minimisation. Such safeguards include, in particular, the minimisation and pseudonymisation of personal data before their transfer to the University and the separate retention of the re-identification key.
Under the current research framework, the research dataset transferred to Széchenyi István University must not contain special categories of personal data within the meaning of Article 9 GDPR or personal data relating to criminal convictions and offences within the meaning of Article 10 GDPR.
- SOURCE OF THE DATA
The University does not collect the personal data processed in the research directly from the individuals concerned. The data originate from pre-existing commercial and business records held by the source companies in the course of their business activities.
Before any data are transferred to the University, the relevant source company, acting within its own responsibility as controller, assesses and authorises the further use of the data for research purposes, selects the data necessary for the research, and carries out data minimisation and pseudonymisation within an environment under its control.
The re-identification key enabling the relationship between the pseudonymised data and the identity of the individuals concerned to be restored is retained separately by the relevant source company and is not transferred to the University.
- CATEGORIES OF PERSONAL DATA RECEIVED BY THE UNIVERSITY
The University may process only pseudonymised or coded information necessary for the purposes of the research, including in particular:
- coded identifiers relating to the organisation, business episode and financing route or route bundle;
- country or jurisdiction at the minimum level of granularity necessary for the research;
- dates relating to documented events and processes;
- information concerning the status and timing of financing and payment, fulfilment, logistics and operational readiness;
- information concerning financing-route category, status and, where relevant, activation conditions;
- masked, banded, indexed or relative financial and resource information where necessary for the research;
- information concerning the allocation of responsibilities;
- coded variables concerning outcomes, the determining process (binding clock), alternative explanations and evidence confidence; and
- short, non-identifying paraphrased evidence notes.
The research dataset transferred to the University must not contain names, email addresses, telephone numbers, private or home addresses, signatures, identity-document numbers, bank-account, IBAN, card or other payment credential identifiers, raw customer lists, communications unrelated to the research, or other private information that is not necessary for the purposes of the research.
- FREE TEXT AND QUOTATIONS
Original customer or business-partner correspondence and other raw free-text content, as well as verbatim quotations, do not form part of the research dataset transferred to the University.
If the use of a verbatim quotation becomes necessary at a later stage of the research, its necessity and the risk of indirect identification of the individual concerned must be assessed separately before the quotation is used or published.
- NUMBER OF PEOPLE AND SOURCE PERIOD
The research dataset is expected to indirectly represent approximately 10–25 natural persons, primarily as business decision-makers or business-partner contacts. The number of individuals concerned must not exceed 30. If this threshold is exceeded, renewed data-protection review must be carried out before the relevant processing takes place.
The primary period for the business episodes analysed in the research is 1 January 2024 to 31 August 2026.
Documents originating between 1 September 2026 and 9 September 2026 may be used only to verify or complete business episodes that had already commenced by 31 August 2026.
- RECIPIENTS / ACCESS
Within the University, access to the research dataset is restricted to persons whose involvement is necessary for the conduct of the research. This may include, in particular, the researcher and, where required for scientific review, an authorised supervisor or second coder.
The University does not have access to the re-identification key.
Personal data originating from different source companies must not be linked, matched or compared with each other at natural-person level.
- INTERNATIONAL / TURKISH-ORIGIN RECORDS
Where source data used in the research are controlled by a company established in Türkiye, their further use for research purposes and their transfer or making available outside Türkiye may take place only after compliance with the applicable Turkish data-protection requirements, including the requirements governing international data transfers under the KVKK.
Participation in the doctoral research does not, in itself, provide a basis for transferring data originating from Türkiye to the University.
- AUTOMATED DECISION-MAKING / AI
No automated decision-making within the meaning of Article 22 GDPR or profiling is carried out in connection with the processing.
Within the approved research data-processing workflow, no AI-based tool is intended to process identified or pseudonymised personal data. Any such processing may take place only following a prior University data-protection review.
Conventional statistical, computational and qualitative analytical methods necessary for the purposes of the research may be applied to the approved structured research dataset.
- RETENTION
The pseudonymised research dataset may be processed for as long as necessary to achieve the purposes of the processing, and no later than the completion of the doctoral degree procedure and any scientific publication processes initiated within that framework and directly related to the doctoral research.
Thereafter, the research dataset containing personal data must be deleted or irreversibly anonymised.
Temporary and working copies must be deleted earlier, as soon as they are no longer necessary for the purpose for which they were created.
- PUBLICATION
Research results may be published only in anonymous or sufficiently aggregated form.
Pseudonymised data are not, in themselves, considered anonymous. Before publication, particular consideration must therefore be given to whether unusual business events, exact dates or amounts, combinations of information concerning a country and an individual’s role, or other circumstances could enable the indirect identification of an individual concerned.
Where necessary, such information must be masked, generalised or omitted from the publication.
- INFORMATION TO INDIVIDUALS UNDER ARTICLE 14
As the University does not obtain the personal data directly from the individuals concerned, the processing falls, in principle, within the scope of Article 14 GDPR.
However, the obligation to provide information individually may be omitted pursuant to Article 14(5)(b) GDPR. The University has access only to a research dataset that has been subject to prior data minimisation and pseudonymisation. It does not receive direct identifiers or the re-identification key enabling the relationship between the coded data and the identity of the individuals concerned to be restored. Consequently, the University does not know the identities of the individuals represented in the research dataset.
The purposes of the research do not require the University to establish the identities of the individuals concerned. Identifying individuals solely for the purpose of providing them with information would require access to the re-identification key or the acquisition and processing of additional personal data, which would be contrary to the objectives of data minimisation and pseudonymisation applied pursuant to Article 89(1) GDPR. In this context, Article 11(1) GDPR is also relevant, under which a controller is not required to maintain, acquire or process additional information solely in order to identify a data subject where the purposes for which the personal data are processed do not require such identification.
Accordingly, individual provision of the information may be omitted pursuant to Article 14(5)(b) GDPR. As an appropriate measure to protect the rights, freedoms and legitimate interests of the individuals concerned, the University makes the information required under Article 14 GDPR publicly available through this Research Privacy Notice.
- DATA SUBJECT RIGHTS
Subject to the conditions laid down in the GDPR, data subjects may request access to their personal data, rectification of inaccurate personal data and restriction of processing, and may object to the processing of their personal data.
As the processing is based on Article 6(1)(e) GDPR, data subjects have the right to object to the processing pursuant to Article 21(1) GDPR.
When exercising data-subject rights, it must be taken into account that the University processes only a pseudonymised dataset, does not possess the re-identification key, and the purposes of the research do not require the University to establish the identities of the individuals concerned. In accordance with Article 11 GDPR, the University is not required to acquire or process additional information solely for the purpose of identifying a data subject.
Where a data subject provides additional information enabling the University to identify the relevant data within the research dataset, the University will assess and handle the request in accordance with the GDPR.
Where the applicable legal conditions are met, limitations or derogations relating to data-subject rights in the context of scientific research may apply in accordance with Article 89 GDPR and the applicable provisions of national law.
Requests concerning the exercise of data-subject rights may be submitted to:
adatvedelem@sze.hu
- COMPLAINTS
If a data subject considers that the processing of their personal data infringes the GDPR or other applicable data-protection legislation, they have the right to lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).
Address: 1055 Budapest, Falk Miksa utca 9-11
Postal address: 1363 Budapest, Pf.: 9.
E-mail:ugyfelszolgalat@naih.hu
- DOCUMENT CONTROL
Effective date of this Privacy Notice: 2026.09.30.
Version: 1.0