National Research, Development and Innovation Office Data Protection Policy of the National Laboratories Programme website

Part I – General provisions

The National Research, Development and Innovation Office as controller (hereinafter referred to as “NRDI Office” or “Controller”) launches and introduces new website (hereinafter referred to as “Website”) under the name National Laboratories Programme to provide information and information services on the National Laboratories Programme, the National Laboratories established and ran under the Programme and on the information, events and activities related to the Programme and current calls for proposals under the programme. While operating the Website, the NRDI office intends to collect personal data from the readers of the Website who, after personal registration, wish to use certain services––referred to below––provided by the NRDI Office through the Website (hereinafter referred to as “data subjects”). The personal data provided by data subjects upon registration will be processed by the Controller in accordance with the applicable data protection provisions.

The NRDI Office is committed to the protection of the data subjects’ personal data, and attaches utmost importance to respecting the data subjects’ right to informational self-determination. Furthermore, the NRDI Office is committed to protect the data subjects’ personal data, and highlights the importance of respecting the data subjects’ right to informational self-determination.

This Data Protection Policy lays down the rules relating to the protection of natural persons with regard to the processing of personal data and the rules relating to the free movement of personal data. The provisions of the Data Protection Policy shall apply, in the course of the operation of the Website, for the processing activities set out below.

In the course of its data processing in connection with the operation of the Website, the Controller shall process the personal data processed in accordance with Act CXII of 2011 on informational self-determination and the freedom of information (hereinafter referred to as “Information Act”) and the positions issued by the President of the Hungarian National Authority for Data Protection and Freedom of Information, in line with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation - hereinafter referred to as “GDPR”).

The purpose of this Data Protection Policy is to facilitate the lawful and secure processing of the personal data of data subjects in connection with the operation of the Website and to protect the fundamental rights and freedoms of data subjects in this regard. 

The Controller acknowledges to be bound by the contents of this Data Protection Policy. In all data processing related to the operation of the Website, the Controller shall endeavour to ensure that its activities comply with the requirements set out in this Data Protection Policy, the General Data Protection Policy of the NRDI Office, as well as the applicable legislation.

1. Controller:

National Research, Development and Innovation Office

Registered office: 1077 Budapest, Kéthly Anna tér 1.
Mailing address: 1438 Budapest, Pf.: 438.
Central telephone number: (+36 1) 795 9500
Central emails: nkfihivatal@nkfih.gov.hu, kommunikacio@nkfih.gov.hu
Internet: http://www.nkfih.gov.hu
Representative Dr Zoltán Birkner, President
Data Protection Officer: Dr Gyula Fonyó
Data Protection Officer phone number: +36 20 932 9144
Data Protection Officer emails: adatvedelmitisztviselo@nkfih.gov.hu, gyula.fonyo@nkfih.gov.hu

2. The Processor:

The NRDI Office shall engage a processor for the operation of the Website. Controller has a contractual relationship with the following processor:

Activity Name / Company name Registered office
Website developer and operator Webra International Kft. 1051 Budapest, Sas utca 10-12. B. ép. 145-146.

3. Publication:

The Data Protection Policy of the NRDI Office related to the operation of the Website shall be permanently available on http://nemzetilaborok.nkfih.gov.hu.

4. Amendment and scope of this Data Protection Policy:

The NRDI Office reserves its right to change this Data Protection Policy unilaterally, without limitation in time, and binds itself to give notice to the data subjects in due time, in the appropriate manner. Amendment of the Data Protection Policy may become necessary primarily to ensure compliance with legislation.

This Data Protection Policy shall be valid until withdrawn and applies to all visitors to the NRDI Office’s National Laboratories Programme who browse the Website and use its information services.

This Data Protection Policy is effective together with and supplements the General Data Protection Policy of the NRDI Office. Matters not covered by this Policy shall be governed by the General Data Protection Policy of the NRDI Office.

 

Part II – Definitions

In this Data Protection Policy:

  • National Laboratory: is a collaborative, institutionalised and dynamic platform for the social, economic and environmental exploitation of research results, opening up a new international dimension to exploratory and experimental research.
    The main objectives of the National Laboratory:
    • concentrate domestic professional workshops in specific research fields;
    • develop competencies necessary for addressing major global issues at the international level;
    • utilise research results for social, economic and environmental purposes (knowledge transfer).
  • National Laboratories Programme: The National Laboratories Programme, launched in 2020 by the NRDI Office with the policy support of the Ministry for Innovation and Technology, is a multi-year government flagship initiative that also aims to achieve international research results supporting the establishment and operation of knowledge centres and National Laboratories in areas of particular perspective for the national economy.
  • Data subject: any natural person who visits the National Laboratories Programme website and provides personal data to the Controller in order to use the services of the Website.

In addition to the above, the NRDI Office applies the terms used in the Information Act, the GDPR and the NRDI Office’s General Data Protection Policy for data processing on the National Laboratories Programme website.

 

Part III – Data processing related to the operation of the Website

1. Cookies:

Since natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as cookie identifiers, therefore these data, when combined with other information are suitable and may be used to create profiles of the natural persons and to identify them.

The websites run by the NRDI Office, including the National Laboratories Programme website, use cookies to enhance user experience. When visiting the Website, visitors receive an anonymous session ID, through which the start and end times of the visit, as well as the visited pages are recorded for statistical purposes. Each new visitor is notified about this practice upon downloading of the first page. Cookies are used for statistical purposes.

The servers of the NRDI Office automatically log the IP addresses of the users at each access level of the website, and also the type of the operating system and browser program used, the URL address of the visited pages, as well as the time of the visit. These data are processed by the NRDI Office only in aggregated, anonymous and processed form, for the purposes of eliminating any possible errors in the Website, and to improve the quality of service and for statistical purposes.

The data subject has to be notified in advance about the cookies storing the data recorded by the user, the authentication session cookies, the user-centric cookies, the multimedia session cookies, the load balancing session cookies, and the session cookies facilitating the customisation of the user interface, however, the data subject’s consent is not required for their application.

2. Direct enquiries:

Visitors to the Website can subscribe to the NRDI Office’s direct enquiry service to receive emails and/or telephone calls, the shortest way possible, from the NRDI Office staff about news and events related to the National Laboratories Programme, the NRDI Office’s activities, the latest national and international research, development and innovation calls and events. For that purpose, the name and e-mail address and where necessary, telephone numbers of the data subjects are recorded.

Scope of processed personal data Legal Basis (legal title) Purpose Data retention time
Name, e-mail, phone number* Consent of the data subject To provide data subjects with direct information services Until the data subject unsubscribes from the direct enquiry services
*Not compulsory.

Data processing requires the provision of the name and email (providing a telephone number is optional for the data subject), in case of non-supply of the data, the data subject cannot use the direct enquiries service.

The data subjects subscribing to the direct enquiries service accept the terms and conditions of this Data Protection Policy by starting the registration process. After the registration request is sent, the data subject receives a confirmation e-mail to the e-mail provided by them, and by clicking on this message, the registration becomes active. In the event the confirmation is not made within 24 hours, the registration process must be started again.

Subscribers may unsubscribe from the direct enquiry service by sending a request to any of the email addresses (kommunikacio@nkfih.gov.hu, nkfihivatal@nkfih.gov.hu) included in this Data Protection Policy or by post to the NRDI Office’s registered office (1077 Budapest, Kéthly anna tér 1.). Upon receipt of the unsubscribe message, the Controller shall promptly take measures to delete the personal data processed on the basis of the data subject’s consent and to terminate the processing.

3. Sending of newsletters:

Visitors of the National Laboratories Programme website run by the NRDI Office can subscribe to the NRDI Office’ National Laboratories Programme newsletter service to receive up-to-date news and information on news, events and achievements related to the National Laboratories Programme, as well as on the latest research, development and innovation proposals, news and events. For that purpose, the name and e-mail address of the data subjects are recorded.

Scope of processed personal data Legal Basis (legal title) Purpose Data retention time
Name Consent of the data subject Information about the latest research, development and invitation calls, news and events. Until requesting the unsubscription from the newsletter service
E-mail Consent of the data subject Information about the latest research, development and invitation calls, news and events. Until requesting the unsubscription from the newsletter service

The data subjects subscribing to the newsletter service accept the terms and conditions of this Data Protection Policy by starting the registration process. After the registration request is sent, the data subject receives a confirmation e-mail to the e-mail provided by them, and by clicking on this message, the registration becomes active. In the event the confirmation is not made within 24 hours, the registration process must be started again.

The method of unsubscription from the newsletter service is notified by the NRDI Office to the data subjects in an easily accessible and clear manner. One can unsubscribe by clicking on the “Leiratkozás” (unsubscribe) link displayed at the bottom of the newsletters, or by sending a request to the address of the NRDI Office indicated in this Data Protection Policy (kommunikacio@nkfih.gov.hu, 1077 Budapest, Kéthly Anna tér 1.).
One can also unsubscribe by clicking on the “Unsubscribe” button placed at the bottom of the NRDI Office website, and then the data subject is required to enter the e-mail regarding which they intend to unsubscribe. In this latter case, the data subject receives a confirmation message to the e-mail provided by them.

It is necessary to provide the indicated personal data for the purpose of data processing specified in this subsection; if these data are not provided, the data subject will not be allowed to use the service.

4. Organisation and documentation of events related to the National Laboratories Programme:

4.1. Registering to the event

The NRDI Office organises events related to the National Laboratories Programme, informing participants about the National Laboratories Programme, the results and experiences of the National Laboratories and other calls managed by the NRDI Office. For the purpose of organising events, the NRDI Office collects and manages data on those registering for the events through the information services of the Website. Those data subjects can participate at the events who have registered in advance on the Website.

Scope of processed personal data Legal Basis (legal title) Purpose Data retention time
Name, email Consent of the data subject Verifying the right to participate at the event, preliminary calculation concerning the number of participants, preparations for satisfying the needs The personal data provided will be deleted within 30 days of the end of the event.

4.2. Photo materials made at the events

The NRDI Office may take pictures of the lecturers, the venue, and also the participating data subjects at the events organised by it, and may publish these photos on its website and possibly in its publications. Pursuant to Article 2:48 (1) of Act V of 2013 on the Civil Code, the data subjects, by participating at the event, give their consent so that the NRDI Office may take photos of them and publish these on its website or possibly in its publications. No publication is allowed outside the Website, except if the explicit consent of the data subjects has been obtained by the NRDI Office prior to the publication.

Scope of processed personal data Legal Basis (legal title) Purpose Data retention time
The data subject’s image Consent of the data subject Publication on the Website of the things happening at the event. The photo material will be made public to the visitors of the Website after the event until the withdrawal of the data subject’s consent. If the data subject so requests, the Controller shall distort or pixelate (mask) the concerned data subject on the objected picture, thereby disguising the identity of the concerned data subject, or shall delete the objected picture from the Website.

4.3. Audio recordings made at the events

The NRDI Office may make audio recordings of the words spoken at the events organised by it, and may transcribe these audio recordings into a written form after the event and may publish such written documents on its website. Data subjects may ask questions from the lecturers during the events and hence these questions are recorded as well.

Pursuant to Article 2:48(1) of Act V of 2013 on the Civil Code, the data subjects, by participating at the event, give their consent so that the NRDI Office may make audio recordings at its events and publish the transcripts on its website. No publication is allowed outside the website of the NRDI Office, except if the explicit consent of the data subjects has been obtained by the Controller prior to the publication.

Scope of processed personal data Legal Basis (legal title) Purpose Data retention time
Audio recordings from the data subject Consent of the data subject Audio recording at the events, making a transcript about the audio recordings and publication thereof on the Website. The transcript about the audio recording will be made within 30 days following the event, and afterwards the NRDI Office shall delete the audio recording and shall publish only and exclusively the written documentation on its Website.

4. Video footage and online broadcasting

The NRDI Office shall use technical (video) solutions – recording images and sounds simultaneously – about the events organised by it, and in the course of this, video recordings shall be made of the events. Video recordings may be published on the Website.

Pursuant to Article 2:48(1) of Act V of 2013 on the Civil Code, the data subjects, by participating at the event, give their consent so that the NRDI Office may make simultaneous image and audio recordings at its events, and publish it on its Website, either in full, or in an edited form.

Scope of processed personal data Legal Basis (legal title) Purpose Data retention time
Images and audio contained in the video recording Consent of the data subject Publication on the website, production of short videos to provide posterior information to the general public.

The video recording, as well as all of its versions, will be made public to the visitors of the website, right until these are withdrawn.
Prior to this, if the data subject so requests, the NRDI Office shall distort and/ or pixelate the concerned data subject in the objected video sections, thereby disguising the identity of the concerned data subject, or shall alter (edit) the objected video so that the images and audio about the data subject shall not be accessible.

 

Part IV – Rights of the data subjects, legal remedies

The data subject can exercise any of his/her rights guaranteed under this Policy and/or under law via any of the contact channels of the NRDI Office specified in this Policy.

1. Rights of the data subject:

Withdrawal of consent:
The data subject has the right to withdraw his/her consent at any time, free of charge, if the processing was based on consent. For more details on the terms and conditions of withdrawal of consent, see the last Section (J. “The data subject’s consent, conditions”) of Part III. Processing of personal data in the General Data Protection Policy of the NRDI Office.

Right to request information (right to access):
Any data subject may request information from the NRDI Office whether any processing of their personal data is underway, and also concerning which personal data the NRDI Office processes regarding him or her, the legal basis and purpose of processing, the source of the data, and the period of processing; to whom, when, under what legislation was access provided regarding their personal data, which personal data were involved, to whom these data were transmitted.
At the data subject’s request, will send information to the contact details provided without undue delay, but no later than within 25 days.

Right to rectification:
Any data subject may request the modification or supplementation of any of their data.
At the data subject’s request, we will take action without undue delay, but not later than within 25 days, and will send a notice to the contact details provided.

Right to erasure (right to be forgotten):
Any data subject can request the erasure of their data if
a) their personal data are no longer necessary in relation to the purposes for which the NRDI Office processed them;
b) the data subject withdraws consent on which the processing is based, and where there is no other legal ground for the processing;
c) the data subject objected to the processing and there is no other legitimate reason for the processing;
d) their personal data were processed by the NRDI Office unlawfully;
e) their personal data have to be erased for compliance with a legal obligation to which the NRDI Office is subject;
f) the personal data have been collected in relation to the offer of information society services to children.
At the data subject’s request, we will do so without undue delay, but not later than within 25 days, and will send a notice to the contact details provided.

Right to blocking, restriction:
a) the accuracy of the personal data is contested by the data subject, in which case the restriction/blocking shall be for a period enabling the verification of the accuracy of the personal data by the NRDI Office;
b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
c) the NRDI Office no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
d) the data subject has objected to processing; in this event the restriction is pending the verification whether the legitimate grounds of the NRDI Office override those of the data subject.
The data shall be blocked as long as necessitated by the reasons stated.
Upon request, we will do so without undue delay, but not later than within 25 days, and will send a notice to the contact details provided.

Right to object:
Any person can object to the processing based on legitimate interest through the specified contact channels. In this case, the NRDI Office shall no longer process the personal data unless it demonstrates legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
The objection will be reviewed and a decision about its justification will be made as soon as possible, but not later than within 15 days, and a notice will be sent about the decision to the contact details provided.

Right to data portability:
The data subject shall have the right to request from the NRDI Office to receive the personal data concerning him or her, which he or she has provided to the NRDI Office, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller, if processing is based on the data subject’s consent or a contract and the processing is carried out by automated means. In exercising his or her right to data portability, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
The NRDI Office shall fulfil the data subject’s request within 25 days at the latest, and shall notify the data subject in a letter sent to the contact channel provided by the data subject.

2. Legal remedies related to the data processing:

If the processing of personal data relating to the data subject is in breach of the provisions of the GDPR or other legislation on data protection, the data subject has the right to lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), which is the supervisory authority for data protection.

Contact details of the supervisory authority:

Hungarian National Authority for Data Protection and Freedom of Information
Mailing address: 1363 Budapest, Pf. 9.
Address: 1055 Budapest, Falk Miksa utca 9-11.
Phone: +36 1 391 1400
Fax: +36 1 391 1410
E-mail: ugyfelszolgalat@naih.hu
URL: https://naih.hu

Data subjects may take legal action, if their rights are violated. The court shall hear the case in an accelerated procedure. At the data subject’s discretion, the legal action can also be started at the regional court having competence according to the data subject’s domicile or habitual residence as well.

The NRDI Office shall provide information to the data subject without undue delay and within 25 days of receipt of the request at the latest. The information obligation is fulfilled by operating a secure online system through which the data subject can easily and quickly access the necessary information.

Matters not covered by this Policy shall be governed by the General Data Protection Policy of the NRDI Office.

Utolsó módosítás: 16 May 2022