Privacy Notice for the Abuse Report Form
PRIVACY NOTICE
regarding
the operation of the whistleblowing system operated by Kodolányi János University as an employer Kodolányi János University (hereinafter: the University) has adopted Act XXV of 2023 on complaints, reports in the public interest, and the rules governing the reporting of misconduct, pursuant to Act XXV of 2023 (hereinafter: the “Complaints Act”), operates an internal whistleblowing system (hereinafter: the “System”) for its employees and other partners entitled to file reports.
The University, as the data controller (hereinafter: Data Controller), provides information to data subjects in this privacy notice (hereinafter: Notice) regarding the data processing activities it carries out in connection with the operation of the System, in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: GDPR).
This Notice uses the terms defined in the GDPR and the Complaints Act.
Personal data: any information relating to an identified or identifiable natural person (“data subject”); “identifiable” means a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person;
Data processing: any operation or set of operations performed on personal data or data files, whether automated or not, including collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction;
Data Controller: a natural or legal person, public authority, agency, or any other body that, alone or jointly with others, determines the purposes and means of the processing of personal data; if the purposes and means of data processing are determined by Union or Member State law, Union or Member State law may also specify the controller or the specific criteria for designating the controller.
Data Processor: a natural or legal person, public authority, agency, or any other body that processes personal data on behalf of the data controller;
Reporter: a person who files a report.
Employer: a person who employs a natural person under an employment relationship.
1. Name of the Data Controller
: Kodolányi János University
Representative: Prof. Dr. Csilla Zsuzsanna Obádovics – Rector
Registered office: 8000 Székesfehérvár, Rákóczi Ferenc Street 25, Hungary
Phone number: info@kodolanyi.hu
Email address: +36 20 521 4870
Data Protection Officer and contact information: BMA Consulting Kft. – Dr. Adél Molnár, email: dpo@kodolanyi.hu, mailing address: 8000 Székesfehérvár, 25 Rákóczi Ferenc Street, phone: +36 20 521 4870
2. Principles
Governing the Processing of Personal Data The processing of personal data
a) must be carried out lawfully, fairly, and in a manner that is transparent to the data subject (“lawfulness, fairness, and transparency”);
b) collected only for specified, explicit, and legitimate purposes and not processed in a manner incompatible with those purposes (“purpose limitation”);
c) adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed (“data minimization”);
d) they must be accurate and, where necessary, kept up to date; all reasonable measures must be taken to ensure that personal data that are inaccurate in light of the purposes of the processing are erased or rectified without delay (“accuracy”);
e) they must be stored in a form that allows for the identification of data subjects only for as long as is necessary to achieve the purposes of the processing; personal data may be stored for a longer period only if appropriate technical and organizational measures are implemented to ensure the processing of personal data for archiving purposes in the public interest, for scientific or historical research purposes, or for statistical purposes (“limited storage”);
f) Processing must be carried out in a manner that ensures the appropriate security of personal data through the application of appropriate technical or organizational measures, including protection against unauthorized or unlawful processing, accidental loss, destruction, or damage (“integrity and confidentiality”).
The data controller is responsible for compliance with the above principles and must be able to demonstrate such compliance (“accountability”).
3. Purpose and Legal Basis of Data Processing, as well as the Data Processed and the Scope
of Data Subjects The Data Controller processes data to the extent necessary to perform its duties related to the operation of the System—
regarding the reporting party, as well as
—the person whose conduct or omission gave rise to the report, as well as
—the personal data of the person who may have relevant information regarding the contents of the report,
to the extent strictly necessary for investigating the report.
Purpose of data processing:
To perform tasks related to the operation of the System in accordance with the provisions of the Complaints Act.
Information regarding acts or omissions that are unlawful or suspected of being unlawful, or other forms of abuse, may be reported through the System. Please do not use the System for other reports or complaints.
The scope of data subjects includes
: - the reporter;
- the person whose conduct or omission gave rise to the report;
- the person who may have relevant information regarding the contents of the report.
Scope of Processed Data:
Within the framework of the System, the personal data of all data subjects that is strictly necessary for investigating the report may be processed.
Personal data related to the investigation of a report made in bad faith and to taking the necessary steps may also be processed. If it becomes apparent that the reporter provided false data or information in bad faith, thereby giving rise to circumstances indicating the commission of a crime or an administrative offense, their personal data must be transferred to the authority or person authorized to conduct the proceedings. If there are reasonable grounds to believe that the individual has caused unlawful harm or other legal injury to another person, their personal data must be transferred, upon request, to the authority or person authorized to initiate or conduct the proceedings.
Legal basis for data processing:
The legal basis for the processing of personal data is Article 6(1)(c) of the GDPR (the processing is necessary for compliance with a legal obligation to which the data controller is subject; the legal obligation is based on Section 18(1) of the Complaints Act).
Duration of data processing:
The Data Controller shall immediately delete any personal data not necessary for conducting the investigation.
Unless further proceedings are initiated based on the investigation, the Data Controller shall delete personal data from the investigation documentation immediately upon completion of the investigation, but no later than 30 days thereafter.
4. Recipients of Personal Data, Recipients
in Third Countries The Data Controller’s managers and its officers, employees, and contractors (hereinafter collectively referred to as “contractors”) who are involved in their respective areas of responsibility and are therefore authorized to do so have access to your personal data.
The personal data contained in the report may be accessed exclusively by the Data Controller and the Data Controller’s contributors, provided that access to such data is necessary for the performance of their duties. The Data Controller will transfer the reporter’s personal data to the Employer only if the reporter has given written consent to such transfer.
The Data Controller’s data processors:
“The Data Controller’s data processors are:
a) with regard to electronic correspondence: Kodolányi János University (headquarters: 8000 Székesfehérvár, Rákóczi u. 25; company registration number: FI 29432; website: www.kodolanyi.hu),
b) the website operator: János Kodolányi University (headquarters: 8000 Székesfehérvár, Rákóczi u. 25., company registration number: FI 29432, email address: info@kodolanyi.hu),
c) the hosting provider: DATATRANS INTERNET Kft. (registered office: 8000 Székesfehérvár, Budai út 9-11, 2nd floor, apt. 24, company registration number: 07 09 006932, email address: ugyfelszolgalat@datatrans.hu).”
As a general rule, the Data Controller does not transfer data to a third country or to an international organization. Such data transfers may take place with respect to data processed within the framework of the internal whistleblowing system only in exceptional cases, provided that the recipient of the transfer makes a legal commitment to comply with the rules set forth in the Complaints Act regarding the report, and subject to the provisions governing the protection of personal data.
5. Technical and Organizational Measures
Taken to Ensure the Security of Data Processing When determining the methods of data processing and during the course of data processing, the Data Controller shall implement appropriate technical and organizational measures that are suitable for the effective implementation of data protection principles, compliance with the requirements set forth in the law, protect the rights of data subjects, and ensure that only personal data necessary for the specific purpose of data processing is processed.
To this end, the Data Controller provides appropriate legal, administrative, physical, and IT security measures (for example: the use of a separate filing location identifier).
The Data Controller guarantees that its employees who have access to personal data are bound by a duty of confidentiality.
The Data Controller ensures data security through the following IT security measures: antivirus protection, a firewall, and password protection.
6. Rights
of Data Subjects You may exercise your rights as a data subject regarding data processing through the following contact methods:
- in person during office hours, by prior appointment, at the University’s headquarters;
- by phone: +36 20 521 4870,
- by mail at P.O. Box 374, 8002 Székesfehérvár,
- by email at dpo@kodolanyi.hu.
The rights of the data subject—provided the data subject can be identified—may be exercised in the manner specified in this Notice for submitting requests. Upon receipt of a request, the Data Controller will respond without delay, but no later than within one month.
Right of Access: You may request information from the Data Controller regarding which of your personal data we process, for what purposes, and in what manner, as well as to whom we may disclose such data; you may also request a copy of the data stored by the Data Controller. We will fulfill these requests free of charge—for the first time for each piece of data. To ensure the protection of your data, we can only grant your rights of control and access after verifying your identity.
Please note that, under the Complaints Act, when exercising the right to information and access, the personal data of the complainant—as the data subject—may not be disclosed to the person requesting the information.
Right to Rectification: As a data subject, you have the right to request that the data controller rectify inaccurate personal data concerning you without undue delay; you may also request that incomplete personal data be supplemented. It is in the best interest of the data controller and data processors to maintain accurate and up-to-date information about you; therefore, please notify the data controller immediately of any changes to your information or if your data is being processed inaccurately or incorrectly.
Right to Erasure: You may request that the data controller erase your personal data if the personal data is no longer necessary for the purpose for which it was collected or otherwise processed; if you have withdrawn your consent and there is no other legal basis for the processing; if you have objected to the processing and there are no overriding legitimate grounds for the processing; or if you believe the personal data is being processed unlawfully; or if the personal data must be erased to comply with a legal obligation under Union or Member State law to which the data controller is subject.
The right to restriction of processing: You may request the restriction of processing if you contest the accuracy of the personal data being processed (in this case, the restriction applies for the period necessary to allow the data controller to verify the accuracy of the personal data); if you believe the personal data is being processed unlawfully but oppose its erasure and instead request that the use of the data be restricted; if you believe the personal data is no longer necessary for the purpose for which it was collected or otherwise processed, but you require it to assert, exercise, or defend legal claims; or if you have objected to the processing (in which case the restriction applies for as long as it remains to be determined whether the data controller’s legitimate grounds override those of the data subject). In the event of a restriction on data processing, personal data may be processed—other than for storage—only with the data subject’s consent, or for the purpose of asserting, exercising, or defending legal claims, or to protect the rights of another natural or legal person, or for reasons of substantial public interest of the European Union or of a Member State.
Right to Object: You may object at any time, on grounds relating to your particular situation, to the processing of personal data based on the data controller’s legitimate interests. In the event of an objection, the data controller may no longer process the personal data unless it demonstrates that the processing is justified by compelling legitimate grounds that override the data subject’s interests, rights, and freedoms, or that are related to the establishment, exercise, or defense of legal claims.
The right to lodge a complaint with the supervisory authority: If the data subject believes that the processing of personal data concerning him or her violates the provisions of the GDPR or the data protection laws in force at any given time, he or she may lodge a complaint with the competent supervisory authority in the Member State of his or her habitual residence, place of work, or the place where the alleged infringement occurred; in Hungary, this is the National Authority for Data Protection and Freedom of Information.
Contact information for the National Authority for Data Protection and Freedom of Information
: - mailing address: P.O. Box 9
, 1363 Budapest - street address
: 9-11 Falk Miksa Street, 1055 Budapest - phone: +36 (1)
391-1400 - fax: +36 (1) 391-1410 -
Email:
ugyfelszolgalat@naih.hu- Website: www.naih.hu
Irrespective of the right to file a complaint, you may also turn to the competent court regarding the unlawful processing of your personal data or any infringement of your rights related to the right to informational self-determination. In Hungary, legal proceedings may be initiated before the court with jurisdiction based on the data subject’s place of residence or habitual residence, or—based on the data controller’s registered office—before the Székesfehérvár Regional Court (registered office: 8000 Székesfehérvár, Dózsa György út 1; mailing address: 8002 Székesfehérvár, P.O. Box 251).
If the data subject’s habitual residence is in another Member State of the European Union, the proceedings may also be brought before the court of the Member State where the data subject has their habitual residence.
Budapest, March 18, 2026.
János Kodolányi University