Effective from 26 May 2023.
Processing operations concerning Students 4
1/B Processing of Students' data on the basis of other legal bases 6
1/C Processing of Student data by the Student Council and the Doctoral Student Union 6
Data processing during MOME's extracurricular training courses (MOME OPEN) 7
Data processing in the framework of MOME's preparatory courses (PreMOME) 9
Processing operations concerning university employees 11
Data processing in relation to the management and use of motor-vehicles 15
Processing of data in the context of the operation of the electronic surveillance system for security purposes 18
Data processing in the context of MOME's external and internal communication activities . 20
Data processing in relation to the publication of personal data accessible on public interest grounds on the website 22
Processing of data in judicial and other official proceedings 22
Data processing in the context of workplace and fire safety activities 22
Data processing activities carried out in the framework of the Erasmus Mobility Programme 23
Data processing in connection with the use of MOME's websites and newsletters 24
General provisions
The purpose of this Data Processing Notice is to inform Data Subjects about the processing of their personal data by the Moholy-Nagy University of Art and Design Budapest (hereinafter as: “MOME”). The obligation to provide information is required by Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council and by Section 14(a) of Act CXII of 2011 on Informational Self-determination and Freedom of Information.
This Data Processing Notice is issued on the basis of the Privacy Policy of MOME dated 4 October 2022 (hereinafter: “Privacy Policy”); the provisions of the Privacy Policy shall also apply to this Data Processing Notice and the provisions of this Data Processing Notice shall be read in conjunction with the Privacy Policy.
The main legislation governing the Controller's processing activities
Act CXII of 2011 on Informational Self-determination and Freedom of Information (hereinafter: the Information Act);
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter as: GDPR);
Act CCIV of 2011 on National Higher Education (hereinafter as: the Higher Education Act);
Act LXXVII of 2013 on Adult Education (hereinafter as: the Adult Education Act);
Government Regulation no. 11/2020 (II. 7.) on the implementation of the Adult Education Act (hereinafter as: the Implementing Regulation);
Act I of 2012 on the Labour Code (hereinafter as: the Labour Code);
Act XXXIII of 1992 on the Legal Status of Public Servants (hereinafter as: the Act on the Public Servants’
Legal Status Act);
Act V of 2013 on the Civil Code (hereinafter referred to as: the Civil Code);
Act C of 2000 on Accounting;
Act CXXXIII of 2005 on Security Services and the Activities of Private Investigators.
Name and contact data of the controller:
Name: Moholy-Nagy University of Art and Design Budapest
Registered office: 1121 Budapest, Zugligeti út 9-25.
Phone: + 36 1/ 392-1100
Controller’s representative: Réka Matheidesz, CEO
Data protection officer: dr. Márk Kovács, mark.kovacs@galnet.eu
Please find below the description of the data processing actions carried out by MOME, acting as the controller in relation to Students, Employees, Contract Partners and other natural persons as Data Subjects and the main characteristics of such data processing actions (in particular the data processed, the purpose of the processing, the legal basis for the processing, the retention period of the data, the organisational unit that performs the data processing action, the information on the possible transfer of the data).
1/A Processing based on law
For the purposes of its proper functioning, to ensure the exercise of the rights and fulfilment of the obligations of applicants and students, and in connection with the organisation of training, research, the student status, the establishment and provision of benefits, allowances and obligations, for reasons of national security and for the management of records as defined by law, MOME shall, to the extent appropriate for the specific purpose and tied to the specific purpose (purpose limitation), process the following data of Students, as defined in Annex 3, Chapter I/B, point 1 of the Higher Education Act:
data relating to admission:
aa) the applicant's first name and surname, gender, first name and surname at birth, mother's maiden name and surname, place and date of birth, nationality, place of residence, habitual residence, notification address and telephone number, in case of non-Hungarian citizens, the title of residence in the territory of Hungary and the document entitling to residence - in case of persons with the right of free movement and residence, the document certifying the right of residence according to a special law - data of the Hungarian identity card, the Hungarian relative's identity card, international insurance document,
ab) data pertaining to the grammar school graduation exam, ac) data pertaining to the secondary school,
ad) data necessary for assessment of the admission application,
ae) data of the admission procedure, the admission identification number,
af) the identification number of the applicant's declaration of commitment to the conditions of the programme subsidised by a Hungarian state (partial) scholarship.
data relating to the student status:
ba) the student's name, gender, name at birth, mother's name, place and date of birth, nationality, place of residence, habitual residence, notification address and telephone number, e-mail address, in the case of non-Hungarian citizens, the title of residence in Hungary and the designation and number of the document entitling the student to stay - in the case of persons with the right of free movement and residence, the document certifying the right of residence according to a special law,
bb) the type of student (visiting student) status, the date and manner of its establishment and termination, the name of the programme to which the student is enrolled, the state funding and the work schedule, the expected date of completion of the programme, the student's academic evaluation, examination results, semesters started, the state-funded period used, the period of suspension of the student status,
bc) the place and time of higher education part-studies abroad,
bd) the credits acquired and recognised during the programme, and the studies credited,
be) details of student benefits, data necessary to assess eligibility for benefits (economic situation, data pertaining to parents, data pertaining to support),
bf) details of the student's employment,
bg) data on student disciplinary and compensation cases,
bh) information necessary for the assessment of special treatment for people with disabilities, bi) data on student accidents,
bj) the student's student card number, the student master file number,
bk) the student's education ID number, identity document number, photograph, social security number,
bl) information on the completion of the internship, the absolutorium, the final examination (defence of the doctoral dissertation), the language examination and the diploma or diploma supplement,
bm) the data necessary to fulfil the rights and obligations arising from the student status;
data relating to the student’s career tracking;
the student's tax identification number;
the identification data of the supporting documents;
details of the fees and compensations paid by the student - instalment payment allowance, deferments, exemptions related to the obligation;
in the event a student or housing allowance is provided, if it is provided on the basis of receipt of an infant care allowance, childcare allowance, child-raising allowance, child-care fee, regular child protection benefit or on the basis of disadvantage, details of such allowances, grants or payments;
details of any scholarship paid to support the student's studies on the grounds of the student status;
data on the student competency assessment and its results;
information on the existence and type of the loan granted by the Student Loan Centre.
Purpose of processing | Legal basis of processing | Retention period for processed data | ||||
1. | The processing of the data referred to in point a) for the purpose of conducting the admission procedure to MOME's higher education programmes, and for the purpose of determining the applicant's compliance with the admission requirements. | Compliance with a legal obligation [Article 6(1)(c) GDPR] | If the applicant is not admitted, until the end of the admission procedure. | |||
2. | The processing of the data referred to in points b) to j), for the purpose of establishment, maintenance and registration of the student status, the management of the Students' personal files, the establishment of benefits and obligations, the establishment and payment of benefits and grants, and the issue of the final certificate at the end of studies. | Compliance with a legal obligation [Article 6(1)(c) GDPR | Eighty years from the date notification of termination student status. | of of | ||
3. | The processing of the data referred to in point (b) by the NEPTUN electronic student registry system. | Compliance with a legal obligation [Article 6(1)(c) GDPR | Eighty years from the date notification of termination student status. | of of | ||
4. | Assessment of student applications possible appeals procedures. | and | conducting | Compliance with a legal obligation [Article 6(1)(c) GDPR | Eighty years from the date notification of termination student status. | of of |
5. | Issuing certificates of the student's status and studies. | Compliance with a legal obligation [Article 6(1)(c) GDPR] | Eighty years from the date notification of termination student status. | of of | ||
6. | Organising and providing customer service and counselling to students. | Compliance with a legal obligation [Article 6(1)(c) GDPR] | Eighty years from the date notification of termination student status. | of of | ||
7. | Assessment of applications for doctoral studies and the administration in the course of the doctoral programmes and the doctoral degree award procedures (applications, cumulative exams, defence, dissertation). | Compliance with a legal obligation [Article 6(1)(c) GDPR] | Eighty years from the date notification of termination student status. | of of | ||
8. | Keeping a record of the student's internship related data. | Compliance with a legal obligation [Article 6(1)(c) GDPR | Eighty years from the date notification of termination student status. | of of | ||
Data processing is carried out by the Centre for Studies, Information and Education (Sections 1-6), the Doctoral School (Section 7), the lecturer or instructor leading the internship or the programme (Section 8).
Pursuant to Section 4 of Chapter I/B of Annex 3 to the Higher Education Act, the data listed in Section 1 of Chapter I/B of Annex 3 to the Higher Education Act may be transmitted, with the exception provided for by law, as follows:
all data necessary for the maintainer to carry out the tasks related to management carried out by the maintainer;
to the court, the police, the public prosecutor's office, the bailiff, the public administration bodies, all data necessary to decide on a specific case;
to the National Security Service, all data necessary for performance of its tasks as defined in Act CXXV of 1995 on National Security Services (hereinafter as: the National Security Services Act);
all data to the body responsible for the operation of the higher education information system;
to the body responsible for registering the fulfilment of the conditions for the Hungarian state scholarship, in terms of the programme and the student status.
In other respects, no data is automatically transferred to third parties outside MOME in terms of the processing carried out in the context of the Admission procedure (Section 1), student counselling and customer service (Section 6).
The data recorded in connection with the student status (Section 2) and the NEPTUN system (Section 3), the assessment of student applications and the conducting of any appeals procedures (Section 4), the certificates issued (Section 5), and the participation in doctoral programmes (Section 7) and internships (Section 8) are transmitted to the bodies specified in Annex 3, Chapter 1/B, Section 4 of the Higher Education Act, typically primarily to the higher education information system and the Education Authority, under the conditions and for the purposes specified by law.
1/B Processing of Students' data on the basis of other legal bases
MOME processes the following personal data of Students in connection with the monitoring of student attendance and access to the storage facilities provided to Students and in connection with contracts with Students:
name, phone number, e-mail address, Neptun code, ID card number;
place and date of birth, marking of the provided storage facility.
Purpose of processing | Legal basis of processing | Retention period for processed data | |
1. | Renting and provision of MOME premises and facilities to students, as well as providing internal services to them. | Performance of a contract [Article 6(1)(b) GDPR] | According to Section 169 of Act C of 2000 on Accounting, 8 years. |
2. | Keeping student attendance sheets (catalogues) to check attendance at classes. | The Data Subject's consent [Article 6(1)(a) GDPR | Until the data subject's consent is withdrawn, but not longer than the duration of the student status. |
3. | Keeping a record of keys to storage containers to manage access rights and prevent misuse. | The processing is based on the legitimate interest of MOME pursuant to Article 6(1)(f) of the GDPR. | The processing of personal data shall cease at the same time as the termination of the student status. |
Data processing is carried out by TechPark (Section 1), the instructor (Section 2) and the Campus Management (Section 3).
No data is transferred outside the MOME in terms of the data processing carried out for the purposes of renting or leasing of premises, equipment, the provision of internal services (Section 1), the keeping of attendance sheets (Section 2) and the provision of keys (Section 2).
1/C Processing of Student data by the Student Council and the Doctoral Student Union
MOME has a Student Council and a Doctoral Student Union, which are self-governing organisational units with registered members, and which carry out their activities in the interests of their members. In connection with their activities, they process the following personal data of the Students:
name;
place and date of birth;
mother’s name;
address;
image;
information on family situation;
health condition;
annual income of supporters;
e-mail address, phone number;
research topic title.
Purpose of processing | Legal basis of processing | Retention period for processed data | |
1. | Processing of the data of students involved in the activities of the Student Council and data generated in connection with the performance of the matters within the competence of the Student Council - points a) - h). | The Data Subject's consent [Article 6(1)(a) GDPR | Until the data subject's consent is withdrawn, but no longer than the duration of the Student Council membership. |
2. | Processing of data in the context of the operation of the Doctoral Student Union in relation to points a), i) and j) | The Data Subject's consent [Article 6(1)(a) GDPR | Until the data subject's consent is withdrawn, but no longer than the duration of the Doctoral Student Union membership. |
Data processing is carried out by the Student Council (Section 1) and the Doctoral Student Union (Section 2).
In the context of Student Council (Section 1) and Doctoral Student Union (Section 2) membership, no data is transferred outside MOME.
In addition to the data processing set out in this Section, further data processing is/may be carried out in relation to Students in the following processing activities as set out in this Data Processing Notice:
Data processing for access to MOME premises (Section 6)
Data processing concerning events (Section 8)
Processing of data in the context of the operation of the electronic surveillance system for security purposes (Section 9)
Postal data processing (Section 10)
Data processing in the context of MOME's external and internal communication activities (Section 12)
Processing by the MOME University Library (Section 13)
Processing by the MOME University Dormitory (Section 14)
Data processing in the context of workplace and fire safety activities (Section 17)
Data processing activities carried out in the framework of the Erasmus Mobility Programme (Section 18)
Data processing in connection with the use of MOME's websites and newsletters (Section 19)
Further details concerning the above processing operations, in particular the scope of the data processed, are set out in the sections dealing with the individual processing operations.
As an adult education provider, MOME processes the following personal data of persons interested in, applying for and participating in courses, programmes, further education and workshops (hereinafter: programmes) offered in the framework of its extracurricular adult education activities:
name, name at birth;
e-mail;
phone;
place and date of birth, mother's name, address, tax identification number;
citizenship, non-Hungarian citizen's legal title for residence in Hungary and the name and number of the document or deed entitling him/her to reside in Hungary;
social security number;
gender;
data relating to education, professional qualifications, vocational training and foreign languages skills;
data relating to entry into and completion of the programme or, if the programme has not been completed, the exit from the programme;
data relating to the assessment and qualification made during the programme;
details of payment obligations in relation to the programme (bank account number, details of the person paying: if the programme fee is paid by an individual, name, name at birth, address, mother's name, place and date of birth, tax identification number, bank account number);
labour market status;
recordings (photo, video and audio).
Purpose of processing | Legal basis of processing | Retention period for processed data | |
1. | Use of contact details - points a) and b) - to answer questions from interested parties. | The processing is based on the voluntary consent of the data subject, pursuant to Article 6(1)(a) of the GDPR and Section 5(b) of the Information Act. | Until consent is withdrawn, but no later than 72 hours after the information is given. |
2. | Use of contact details - points a) and b) - to send programme-related information (start, scheduling). | The processing is based on the voluntary consent of the data subject, pursuant to Article 6(1)(a) of the GDPR and Section 5(b) of the Information Act. | Until the consent is withdrawn. |
3. | Acceptance and management of applications for the different programmes, and provision of contact details for the purposes of concluding contracts - points a), b) and c). | The processing is based on the voluntary consent of the data subject, pursuant to Article 6(1)(a) of the GDPR and Section 5(b) of the Information Act. | Until the consent is withdrawn. |
4. | Conclusion of a contract with the applicant for the programme - on the basis of the data recorded in points a), b), d), and the data necessary to fulfil other (registration) obligations as referred to in point (a). | Performance of a contract [Article 6(1)(b) GDPR] | Pursuant to Section 169 of Act C of 2000 on Accounting and Section 16 of the Adult Education Act, until the last day of the eighth year following the conclusion of the adult education contract. |
5. | In order to conduct the programme, the Adult Education Provider processes the data referred to in points a), b), d), e), f), g), h), j), k) and l) pursuant to Section 21 of the Adult Education Act. | Compliance with a legal obligation [Article 6(1)(c) GDPR] and pursuant to Section 21 of the Adult Education Act. | The last day of the eighth year following the conclusion of the adult education contract. |
6. | Provision of adult education related data into the adult education data reporting system (FAR) according to Section 15 of the Adult Education Act - personal identification data (name, mother's name, place and date of birth), e-mail address and tax identification number. | Compliance with a legal obligation [Article 6(1)(c) GDPR] and pursuant to Section 15 of the Adult Education Act. | The last day of the eighth year following the conclusion of the adult education contract. |
7. | In the Adult Education Data Reporting System, the Certificate is issued on the basis of the personal data (except address) recorded in points (a) and (d), at the request of the person participating in the programme (on paper or electronically). | Compliance with a legal obligation [Article 6(1)(c) GDPR] pursuant to Section 13/B (1) of the Adult Education Act. | The data required for the issue of the Certificate is obtained by the adult education provider by concluding an adult education contract, which contract is kept for eight years from the date of conclusion of the contract, pursuant to Section 16 of the Adult Education Act. |
8. | The adult education provider is obliged to provide data for statistical purposes on its adult education activities according to the National Statistical Data Collection Programme (OSAP), which it provides through the Adult Education Data Reporting System, regarding the following data: date of birth (year), highest level of education, gender, address (postal code), employment status, fact of completion of the programme. | Compliance with a legal obligation [Article 6(1)(c) GDPR], Section 21(4) of the Adult Education Act. | The adult education provider will process the data until the last day of the eighth year following the conclusion of the adult education contract. |
9. | The purpose of the production and use of images that are suitable to uniquely identify a person (photo, video) and which do not qualify as an image of a crowd of people and audio recordings at the programme and its closing event, is to record and document the programme, to inform those interested in the programme, and to use the recordings on MOME's communication channels (website, Facebook, Flickr, Instagram, etc..) for information, advertising and documentation purposes. | Voluntary consent of the data subject [Article 6(1)(a) GDPR], which is given by the participant (and the instructor) by duly completing the consent or non- consent (to processing) section of the (Adult Education) contract and by signing the contract. | Until the consent is withdrawn |
10. | The purpose of the production and use of images of crowds of people at the programme and its closing event, is to record and document the programme, to inform those interested in the programme, and to use the recordings on MOME's communication channels (website, Facebook, Instagram, Youtube, etc.) for information, advertising and documentation purposes. | Based on the legitimate interest of the controller [Article 6(1)(f) GDPR]. | For the duration of existence of the legitimate interest. The period of publication of the article informing the public, and in the case of its archiving, the storage time. Criterion for determining the storage time (retention period): possible use of the image/recording for future articles, publications of the university |
The data processing is carried out by the Adult Education Project Manager (Innovation Centre).
Data will be transferred to the adult education data reporting system only in accordance with Sections 6, 7 and 8.
In addition to the data processing set out in this Section, further data processing is/may be carried out in relation to the persons participating in adult education in the following processing activities as set out in this Data Processing Notice:
Data processing for access to MOME premises (Section 6)
Data processing concerning contractual partners (Section 7)
Data processing concerning events (Section 8)
Processing of data in the context of the operation of the electronic surveillance system for security purposes (Section 9)
Postal data processing (Section 10)
Data processing in the context of MOME's external and internal communication activities (Section 12)
Processing by the MOME University Library (Section 13)
Data processing in connection with the use of MOME's websites and newsletters (Section 19)
Further details concerning the above processing operations, in particular the scope of the data processed, are set out in the sections dealing with the individual processing operations.
MOME offers admission preparation courses to develop basic artistic skills and design thinking, introducing participants to the theoretical and practical foundations of design and visual culture in order to successfully participate in the admission process. The following personal data of the participants are processed in the context of these courses, programmes, workshops (hereinafter as: programme):
name, name at birth;
mother's name, address, place and date of birth;
tax ID number;
ID card number;
e-mail;
phone;
details of payment obligations in relation to the programme: bank account number, details of the person paying the fees (if the programme fee is paid by an individual, name, name at birth, address, mother's name, place and date of birth, tax identification number, bank account number);
social security number;
gender;
citizenship, non-Hungarian citizen's legal title for residence in Hungary and the name and number of the document or deed entitling him/her to reside in Hungary;
data relating to education, professional qualifications, vocational training and foreign languages skills;
data relating to entry into and completion of the programme or, if the programme has not been completed, the exit from the programme;
data relating to the assessment and qualification made during the programme;
if the participant is under 18 years of age, the details of the legal representative (name, name at birth, date and place of birth, mother's name, address) ;
labour market status;
recordings (photo, video and audio).
Purpose of processing | Legal basis of processing | Retention period for processed data | |
1. | Use of contact details - points a) and e) - to answer questions from interested parties. | The processing is based on the voluntary consent of the data subject, pursuant to Article 6(1)(a) of the GDPR and Section 5(b) of the Information Act. | Until consent is withdrawn, but no later than 72 hours after the information is given. |
2. | Use of contact details - points a) and e) - to send programme-related information (start, scheduling). | The processing is based on the voluntary consent of the data subject, pursuant to Article 6(1)(a) of the GDPR and Section 5(b) of the Information Act. | Until the consent is withdrawn. |
3. | Acceptance and management of applications for the different programmes, and provision of contact details for the purposes of concluding contracts - points a), b), e), f) and g). | The processing is based on the voluntary consent of the data subject, pursuant to Article 6(1)(a) of the GDPR and Section 5(b) of the Information Act. | Until the consent is withdrawn. |
4. | Conclusion of a contract with the applicant for the programme - on the basis of the data recorded in points a), b), c) and e), and the data necessary to fulfil other (registration) obligations. | Performance of a contract [Article 6(1)(b) GDPR] | Pursuant to Section 169 of Act C of 2000 on Accounting and Section 16 of the Adult Education Act, until the last day of the eighth year following the conclusion of the adult education contract. |
5. | In order to conduct the programme, the adult education provider processes the data referred to in points a), b), c), e), f), g), h), i), j), k, l), m) pursuant to Section 21 of the Adult Education Act. | Compliance with a legal obligation [Article 6(1)(c) GDPR] and pursuant to Section 21 of the Adult Education Act. | The last day of the eighth year following the conclusion of the adult education contract. |
6. | Provision of adult education related data into the adult education data reporting system (FAR) according to Section 15 of the Adult Education Act - personal identification data (name, mother's name, place and date of birth), e-mail address and tax identification number. | Compliance with a legal obligation [Article 6(1)(c) GDPR] and pursuant to Section 15 of the Adult Education Act. | The last day of the eighth year following the conclusion of the adult education contract. |
7. | In the Adult Education Data Reporting System, the Certificate is issued on the basis of the personal data (except address) recorded in points (a) and (d), at the request of the person participating in the programme (on paper or electronically). | Compliance with a legal obligation [Article 6(1)(c) GDPR] pursuant to Section 13/B (1) of the Adult Education Act. | The data required for the issue of the Certificate is obtained by the adult education provider by concluding an adult education contract, which contract is kept for eight years from the date of conclusion of the contract, pursuant to Section 16 of the Adult Education Act. |
8. | The adult education provider is obliged to provide data for statistical purposes on its adult education activities according to the National Statistical Data Collection Programme (OSAP), which it provides through the Adult Education Data Reporting System, regarding the following data: date of birth (year), highest level of education, gender, address (postal code), employment status, fact of completion of the programme. | Compliance with a legal obligation [Article 6(1)(c) GDPR], pursuant to Section 21(4) of the Adult Education Act. | The adult education provider will process the data until the last day of the eighth year following the conclusion of the adult education contract. |
9. | The purpose of the production and use of images that are suitable to uniquely identify a person (photo, video) and which do not qualify as an image of a crowd of people and audio recordings at the programme and its opening event, is to record and document the programme, to inform those interested in the programme, and to use the recordings on MOME's communication channels (website, Facebook, Flickr, Instagram, etc..) for information, advertising and documentation purposes. | Voluntary consent of the data subject [Article 6(1)(a) GDPR], which is given by the participant (and the instructor) by duly completing the consent or non- consent (to processing) section of the (Adult Education) contract and by signing the contract. | Until the consent is withdrawn |
10. | The purpose of the production and use of images of crowds of people at the programme and its opening event, is to record and document the programme, to inform those interested in the programme, and to use the recordings on MOME's communication channels (website, Facebook, Instagram, Youtube, etc.) for information, advertising and documentation purposes. | Based on the legitimate interest of the controller [Article 6(1)(f) GDPR]. | For the duration of existence of the legitimate interest. The period of publication of the article informing the public, and in the case of its archiving, the storage time. Criterion for determining the storage time (retention period): possible use of the image/recording for future articles, publications of the university |
The data processing is carried out by the PreMOME coordinator (Innovation Centre).
Data will be transferred to the adult education data reporting system only in accordance with Sections 6, 7 and 8.
In addition to the data processing set out in this Section, further data processing is/may be carried out in relation to the persons participating in PreMOME in the following processing activities as set out in this Data Processing Notice:
Data processing for access to MOME premises (Section 6)
Data processing concerning contractual partners (Section 7)
Data processing concerning events (Section 8)
Processing of data in the context of the operation of the electronic surveillance system for security purposes (Section 9)
Postal data processing (Section 10)
Data processing in the context of MOME's external and internal communication activities (Section 12)
Processing by the MOME University Library (Section 13)
Data processing in connection with the use of MOME's websites and newsletters (Section 19)
Further details concerning the above processing operations, in particular the scope of the data processed, are set out in the sections dealing with the individual processing operations.
4/A Processing based on law
MOME processes the following personal data of University employees - as defined in Section 1 of Chapter 1/A of Annex 3 of the Higher Education Act and in Annex 5 of the Public Servants’ Legal Status Act - in connection with employment, the establishment and fulfilment/provision of benefits, allowances and obligations, for reasons of national security, for the
purpose of managing the records specified by law, to the extent appropriate for the specific purpose and tied to the specific purpose (purpose limitation):
Data processed pursuant to Section 1 of Chapter 1/A of Annex 3 of the Higher Education Act:
first name and surname, gender, first name and surname at birth, place and date of birth, mother's first name and surname at birth, nationality, education identification number, identity document number, tax identification number;
place of residence, habitual residence, address for notification;
data pertaining to employment, civil servant status, fixed-term employment under a contract of engagement:
ca) the name of the employer, or all employers if there is more than one, indicating with which employer the other employment-related legal relationship has been established,
cb) level of qualification, professional qualifications, vocational qualifications, foreign language skills, academic degree,
cc) time spent in employment, the time that can be counted towards the period of employment as a civil servant, data pertaining to payroll status,
cd) medals, awards and other distinctions, titles,
ce) post of employment, executive assignment, assignment for tasks not included in the post of employment, additional work-related relationships, disciplinary sanctions, orders to pay damages,
cf) hours of work, hours of overtime, wage, salary, and any related dues and its beneficiary, cg) leaves (paid time-off days), leaves taken,
ch) payments to the employee and their titles,
ci) the benefits granted to the employee and their titles,
cj) the employee's debts owed to the employer and their titles,
ck) research activities, academic work, creative artistic activity and their results, data on participation in doctoral programmes and doctoral degree award procedures, in a lecturer or researcher capacity,
cl) a written declaration by the lecturer indicating the higher education institution for which he or she may be considered,
cm) in the case of employment by the higher education institution, acting as the principal, under a contract of engagement - the chairperson and member of the financial board - information certifying that he or she has no criminal record and is not subject to a disqualification from the activity for which the contract of engagement is intended;
the results of the students’ evaluation of the teaching work;
the result of the habilitation procedure;
the identification data of the supporting documents.
Data processed pursuant to Annex 5 of the Public Servants’ Legal Status Act:
name of the public servant (née)
place and date of birth
mother’s name
Social security number, tax identification number
address, habitual residence, telephone number
marital status
date of birth of his or her children, number of other dependants, start of dependency
highest level of education (all qualifications, if there are more than one)
professional qualification(s), extracurricular education qualification(s) and the details of the diplomas required for the specific post of employment
academic degree
foreign language skills
the previous periods of employment as per paragraphs (1) and (3) of Section 87/A of the Public Servants’
Legal Status Act, the name of the place of employment, the method and date of termination
the start date of employment as a public servant
nationality
the number and date of the official certificate issued by the criminal records service
the periods on the basis of which the anniversary bonus and severance pay are calculated
the name, registered office and statistical number of the body employing the public servant, and the start date of employment with that body
the public servant's current classification, date of classification, managerial title, FEOR number
details of titles, awards, honours
the date and content of the qualifications
personal (staff) benefits
the title and duration of the public servant’s absence from work
the date and method of termination of employment as a public servant, permanent and temporary transfer, details of severance pay
Data relating to the public servant's other employment relationship.
Purpose of processing | Legal basis of processing | Retention period for processed data | |
1. | Establishment of the public servant status, including the preparation of the appointment proposal, the drafting of the appointment letter, the classification and registration of the public servant, the signing of the appointment letter and the maintenance (including termination) of the status. | Compliance with a legal obligation [Article 6(1)(c) GDPR] | The period of processing is five years from the termination of employment, with the proviso that employment records containing data on the length of service or earnings taken into account in the determination of pension benefits are kept for five years after the insured person or former insured person reaches the retirement age. |
2. | Keeping the Public Servant Register. | Compliance with a legal obligation [Article 6(1)(c) GDPR] | The period of processing is five years from the termination of employment, with the proviso that employment records containing data on the length of service or earnings taken into account in the determination of pension benefits are kept for five years after the insured person or former insured person reaches the retirement age. |
3. | Processing in relation to the management of personal (staff) benefits | Compliance with a legal obligation [Article 6(1)(c) GDPR] | The period of processing is five years from the termination of employment, with the proviso that employment records containing data on the length of service or earnings taken into account in the determination of pension benefits are kept for five years after the insured person or former insured person reaches the retirement age. |
Data processing is carried out by the Chancellor’s Office and the Directorate of Finance and the Human Resources Officer.
Pursuant to Section 4 of Chapter I/A of Annex 3 to the Higher Education Act, the data listed in Section 1 of Chapter I/A of Annex 3 to the Higher Education Act may be transmitted, with the exception provided for by law, as follows:
to the maintainer, all data necessary for the maintainer to exercise its rights;
to the paying agent that is paying the social security, salary and wage or other benefit, all data required to establish and use the salary, wage or other benefit or entitlement;
to the body responsible for the operation of the higher education information system, all data that may be processed by the higher education information system pursuant to the Higher Education Act;
to the Hungarian Accreditation Committee, any information necessary to enable it to determine whether the conditions for the operation of the higher education institution are met;
to the court, the police, the public prosecutor's office, the bailiff or the public administration body, all data necessary to decide on a specific case;
all data related to employment to the persons entitled to monitor employment related provisions, and all data necessary for the National Security Service to perform the tasks defined in the National Security Services Act;
the results of the students’ evaluation of the teaching work to students and staff members of the higher education
institution in the manner specified in the institutional regulations; and
to the applicant, data which, for the purpose of fulfilling the applicant’s request for access to data addressed to an institution of higher education pursuant to Section 28 of the Information Act, are considered to be data accessible on public interest grounds pursuant to Paragraph (3) of Section 26 of the Information Act.
Pursuant to Section 83/D of the Public Servants’ Legal Status Act, the following persons – in addition to the data subject – are entitled to access the basic register of public servants and to receive data from it for the purpose of performing their duties as defined by the applicable legislation:
the public servant's superior;
the manager performing the qualification;
the body which, within the scope of its functions, carries out the legal control or legal oversight;
the court in connection with labour law actions, civil law actions or administrative proceedings;
the investigating authority, the public prosecutor and the court in criminal proceedings against a public servant;
the member of staff of the body responsible for personnel, labour and payroll issues, within their remit;
the tax authority, the pension insurance administration and the health insurance body, the body that investigates workplace accidents and the occupational health and safety inspectorate.
Among the data in the basic register of public servants, the name of the employer, the name of the public servant and the data concerning his/her position are in the public interest and may be disclosed without the prior knowledge and consent of the public servant.
Payroll support (transfer of wages and salaries to the accounting system) is provided by HASZNOS-ADATOK Kft. (2161 Csomád,
Levente u. 14/a).
4/B Processing based on other legal bases
MOME processes the following personal data in connection with its operations, in addition to the mandatory data processing based on law in relation to University employees:
name;
e-mail;
organisational unit;
position;
phone.
Purpose of processing | Legal basis of processing | Retention period for processed data | |
1. | Processing of data in the context of the establishment of the public servant relationship based on a job application procedure | The processing is based on the voluntary consent of the data subject, pursuant to Article 6(1)(a) of the GDPR and Section 5(b) of the Information Act | In the case of an unsuccessful application, the application file will be returned to the applicant and, if such return is unsuccessful, will be deleted after ninety days from the deadline for the evaluation of the application. |
2. | Managing attendance sheets and keeping the register on annual leaves (paid time-off days). | The processing is based on the legitimate interest of MOME, pursuant to Article 6(1)(f) of the GDPR | For the duration of existence of the legitimate interest, but not later than the end of the legal relationship. |
3. | Operation of the mailing system. | The processing is based on the legitimate interest of MOME, pursuant to Article 6(1)(f) of the GDPR | For the duration of existence of the legitimate interest, but not later than the end of the legal relationship. |
4. | Creating and managing mailing lists and tutor groups. | The processing is based on the voluntary consent of the data subject, pursuant to Article 6(1)(a) of the GDPR and Section 5(b) of the Information Act | Until the consent is withdrawn, but not later than the end of the legal relationship. |
5. | Preparing timetables and maintaining a teaching timesheet. | The processing is based on the legitimate interest of MOME, pursuant to Article 6(1)(f) of the GDPR | For the duration of existence of the legitimate interest, but not later than the end of the legal relationship. |
6. | Data processing in the context of quality assurance (collecting student opinions about lecturers/teachers). | The processing is based on the legitimate interest of MOME, pursuant to Article 6(1)(f) of the GDPR | For the duration of existence of the legitimate interest, but not later than the end of the legal relationship. |
7. | Nomination of lecturers/teachers for an arts award | The processing is based on the legitimate interest of MOME, pursuant to Article 6(1)(f) of the GDPR | For the duration of existence of the legitimate interest. |
8. | Carrying out the inventory (preparing and keeping records of the letters of assignment, | The processing is based on the legitimate interest of MOME, | For the duration of existence of the legitimate interest. |
inventory reports and inventory sheets). | pursuant to Article 6(1)(f) of the GDPR | ||
9. | Managing the data needed to maintain the competence map. | The processing is based on the voluntary consent of the data subject, pursuant to Article 6(1)(a) of the GDPR and Section 5(b) of the Information Act | Until the consent is withdrawn. |
10. | Filing intellectual property notifications. | The processing is based on the legitimate interest of MOME, pursuant to Article 6(1)(f) of the GDPR | For the duration of existence of the legitimate interest. |
Data processing is carried out by the Chancellor’s Office and the Directorate of Finance, the Institutes and other relevant departments concerned by the work of the staff member.
The data under Section 9 may be transferred to the National Research, Development and Innovation Office, whereas data under Section 10 may be transferred to the Hungarian Intellectual Property Office.
In addition to the data processing set out in this Section, further data processing is/may be carried out in relation to University employees in the following processing activities as set out in this Data Processing Notice:
Data processing in relation to the management and use of motor-vehicles (Section 5)
Data processing for access to MOME premises (Section 6)
Data processing concerning events (Section 8)
Processing of data in the context of the operation of the electronic surveillance system for security purposes (Section 9)
Postal data processing (Section 10)
Data processing in the context of MOME's external and internal communication activities (Section 12)
Processing by the MOME University Library (Section 13)
Data processing in the context of workplace and fire safety activities (Section 17)
Data processing activities carried out in the framework of the Erasmus Mobility Programme (Section 18)
Data processing in connection with the use of MOME's websites and newsletters (Section 19)
Further details concerning the above processing operations, in particular the scope of the data processed, are set out in the sections dealing with the individual processing operations.
MOME processes the following personal data in connection with the use of motor-vehicles owned or used by MOME for official purposes, the private use of such vehicles by University staff, the use of cars privately owned by University staff for MOME’s purposes (secondment) and the use of private cars by staff for their own commuting to work:
Surname and first name of the university employee, surname and first name at birth;
place and date of birth, mother's maiden surname and first name at birth, nationality;
place of residence, habitual residence, address for notification;
identity document number, driving licence number.
Purpose of processing | Legal basis of processing | Retention period for processed data | |
1. | Provision of the necessary documents for the use of motor- vehicles owned by the University for official and private purposes (registration certificate and journey log form). | Legitimate interest of the controller [Article 6(1)(f) GDPR] | Up to the end of the legitimate interest, but not more than 3 years from the end of the civil servant's employment relationship, and maximum 5 years. |
2. | Issuing a permit to commute to work in one’s own motor- vehicle. | Legitimate interest of the controller [Article 6(1)(f) GDPR] | Up to the end of the legitimate interest, but not more than 3 years from the end of the civil servant's employment relationship, and maximum 5 years. |
3. | Authorisation and payroll accounting of commuting to work in one’s own motor-vehicle as a fringe benefit. | Compliance with a legal obligation [Article 6(1)(c) GDPR] | According to Section 169 of Act C of 2000 on Accounting, 8 years. |
4. | Providing a fuel card, fuel accounting. | Compliance with a legal obligation [Article 6(1)(c) GDPR] | According to Section 169 of Act C of 2000 on Accounting, 8 years. |
5. | Permission to use a company car for private purposes. | Legitimate interest of the controller [Article 6(1)(f) GDPR] | Up to the end of the legitimate interest, but not more than 3 years from the end of the civil servant's employment relationship, and maximum 5 years. |
6. | Invoicing for private use of a company car. | Compliance with a legal obligation [Article 6(1)(c) GDPR] | According to Section 169 of Act C of 2000 on Accounting, 8 years. |
7. | Issuing a permit for taking the motor-vehicle abroad. | Legitimate interest of the controller [Article 6(1)(f) GDPR] | Up to the end of the legitimate interest, but not more than 3 years from the end of the civil servant's employment relationship, and maximum 5 years. |
8. | Processing of data relating to the use of a private car in the context of a secondment (posting). | Legitimate interest of the controller [Article 6(1)(f) GDPR] | Up to the end of the legitimate interest, but not more than 3 years from the end of the civil servant's employment relationship, and maximum 5 years. |
9. | In the event of an accident or insurance event, provision of information to investigating authorities and insurance companies. | Compliance with a legal obligation [Article 6(1)(c) GDPR] | 3 years, up to a maximum of 5 years, from the date of termination of the public servant employment. |
10. | Issuing a permit for taking the motor-vehicle abroad. | Legitimate interest of the controller [Article 6(1)(f) GDPR] | Up to the end of the legitimate interest, but not more than 3 years from the end of the civil servant's employment relationship, and maximum 5 years. |
Data processing is carried out by the Campus Directorate (Sections 1 and 9), the Chancellor’s Office (Sections 2, 5 and 10) and the Directorate of Finance (Sections 3, 4, 6-8).
Data processed in connection with the management and use of the Motor-Vehicle may be transferred to the State Audit Office and the Ministry for Innovation and Technology in the context of their audits.
In order to ensure that only authorised persons have access to its buildings, MOME operates a card-based access control system, in connection with which the following data is processed:
Student’s name, Neptun ID;
The number of the entry card issued to the student;
Details of the student's card usage, i.e. where and when the card was used;
Name of university employee;
Details of the card usage by the university employee, i.e. where and when the card was used.
Purpose of processing | Legal basis of processing | Retention period for processed data | ||||
1. | Manufacturing of the card ensuring access to the MOME premises. | Legitimate controller GDPR] | interest [Article | of the 6(1)(f) | For the duration relationship. | of the legal |
2. | Ensuring access to the MOME premises for authorised persons and monitoring entry and exit. | Legitimate controller GDPR] | interest [Article | of the 6(1)(f) | 3 days after the data on card usage is generated. | |
Data processing is carried out by the Campus Directorate.
No automatic data transfer outside MOME takes place during the processing of data for access to MOME premises, but the recorded card usage data may be used as evidence in criminal proceedings, misdemeanour proceedings or other judicial or other official proceedings by the competent authorities or courts.
The access control system is operated by NEVADASEC Prémium Szolgáltató Kft. (2724 Újlengyel, Nyári Pál utca 15.).
In the course of concluding, maintaining and terminating contracts to ensure the proper functioning of the university, the performance of its tasks, as well as its operation and the management of the purchases necessary for its operation, in particular in connection with investments, renovations, building maintenance, contracts of engagement and works contracts, and contracts for the rental of its assets, MOME processes the following data of the private individual contractual partners concluding contracts with it/submitting price quotes to it:
the name, place of residence, habitual residence or registered office of the Contractual Partner;
mother’s name;
place and date of birth;
billing address, account number, tax identification number, identity card number, registration number;
contact details (in particular, telephone number, e-mail address; name, telephone number, e-mail address of the contact person).
Purpose of processing | Legal basis of processing | Retention period for processed data | |||||
1. | Conducting a public procurement procedure. | Compliance with a legal obligation [Article 6(1)(c) GDPR] | At least five years from the date of performance of the contract. | ||||
2. | Processing for the purposes of the establishment and performance of the contract, including the request for quotations (call for bids). | Performance contract 6(1)(b) GDPR] | of a [Article | Pursuant to Section 169 of Act C of 2000 on Accounting, 8 years, or, if the investment is financed by a subsidy, a maximum of 20 years after the use of public funds. | |||
3. | Keeping records of contact details recorded in the contract to ensure contact is maintained. | Legitimate interest of the controller [Article 6(1)(f) GDPR] | For the duration of existence of the legitimate interest, but not more than 8 years pursuant to Section 169 of Act C of 2000 on Accounting. | ||||
4. | Establishing, maintaining and terminating contracts with external lecturers, instructors and examination board members. | Performance contract 6(1)(b) GDPR] | of a [Article | Until the 5-year limitation period under the Civil Code. | |||
5. | Issuing certificates of receiving and paying them. | completion, | issuing | invoices, | Performance contract 6(1)(b) GDPR] | of a [Article | According to Section 169 of Act C of 2000 on Accounting, 8 years. |
The data processing activities concerning the contractual partners are mainly carried out by the Directorate of Finance and the Campus Directorate, but some sub-tasks - selection, tendering, contract negotiation - are also carried out by the individual departments/project managers of MOME
In accordance with its Procurement Policy, MOME regularly provides the Minister responsible for public procurement with information on its procurements below the public procurement threshold, including the names and addresses of the partners invited to tender and the name of the contracting party. In addition, data may be transmitted to the State Audit Office and the Ministry of Innovation and Technology as part of their audits.
Saldo Informatikai Zrt. (1135 Budapest, Mór u. 2-4.) supports the performance of the tasks set out in this section.
MOME processes the personal data of the persons invited to and attending events, meetings, gatherings (hereinafter referred to as: events) organised and conducted by MOME, for the purposes of organising, inviting to and conducting events, in particular for the purposes of admission to and documentation of events, as set out in this section. MOME may take pictures, audio and video recordings of the event for the purpose of documenting the event, making and publishing reports about the event and thus promoting MOME and its activities. In these images, persons attending the event may appear both in an individually indistinguishable way (as part of the crowd) and in a uniquely identifiable way (as a separate, stand-alone image of the person). MOME processes the following personal data in connection with the events:
name, address, e-mail address, telephone number of the invited person;
the image and voice of the participant.
Purpose of processing | Legal basis of processing | Retention period for processed data | |
1. | Invitation to the Event. | Legitimate interest of the controller [Article 6(1)(f) GDPR] | For the duration of existence of the legitimate interest, but no later than 5 years after the event. |
2. | Admission (entry) to the Event. | Legitimate interest of the controller [Article 6(1)(f) GDPR] | Until the 24th hour of the day following the event |
3. | Taking images, audio and video recordings of the Event and using them in case of the photo or video images of a crowd of people. | Legitimate interest of the controller [Article 6(1)(f) GDPR] | For the duration of existence of the legitimate interest, but no later than 5 years after the event. |
4. | The taking of images, audio and video recordings of the Event and their use in the case of an image that is suitable to uniquely identify the person, where it is technically impracticable to obtain or give consent. | Legitimate interest of the controller [Article 6(1)(f) GDPR] | For the duration of existence of the legitimate interest. |
5. | The taking of images, audio and video recordings of the Event and their use in the case of an image that is suitable to uniquely identify the person, where it is technically feasible to obtain the consent. | The Data Subject's consent [Article 6(1)(a) GDPR] | Until the consent is withdrawn (for processing after withdrawal). |
The data is processed by the MOME Brand Communication Office and the IK Communication team.
MOME will not disclose the data processed in connection with the events it organises and conducts to third parties outside MOME in the cases referred to in Sections 1 and 2. In the case of Sections 3, 4 and 5 the name, image and voice of the data subject may be used in connection with the processing of data in the context of MOME's external and internal communication activities (Section 12).
In connection with the organisation of events, in particular for the purpose of access control of participants and the taking of pictures and video recordings, MOME may occasionally use the services of event management companies.
In order to protect the life and safety of people in public areas of MOME premises and the property owned or used by MOME, an electronic surveillance system (security cameras) is operated to detect and prevent offences and prosecute the perpetrator of the offence. In the course of this, the following personal data shall be processed:
the image of natural persons (including Students, University employees) staying on the MOME premises.
Purpose of processing | Legal basis of processing | Retention period for processed data |
For the protection of persons and property, to detect and | Legitimate interest of | If not used, 30 days from the date |
prevent offences, to catch the perpetrator in the act of committing the crime or offence, and to prosecute the perpetrator or the person causing the damage. | the controller [Article 6(1)(f) GDPR] | of the recording. |
Data processing is carried out by the Campus Directorate.
No automatic data transfer to third parties is carried out in the course of the data processing in the context of the operation of the electronic surveillance system, but the recorded images may be used as evidence in criminal proceedings, misdemeanour proceedings or other judicial or other official proceedings by the competent authorities or courts.
The electronic surveillance system is operated by NEVADASEC Prémium Szolgáltató Kft. (2724 Újlengyel, Nyári Pál utca 15.).
MOME processes the following personal data of Students and Employees, as well as of its contractual partners, in the course of receiving and mailing items sent to or by it and in the course of internal mailing activities:
the name, place of residence and postal address of the natural person addressee and sender;
the name, place of residence and postal address of the addressee's contact person;
Purpose of processing | Legal basis of processing | Retention period for processed data | |
1. | Receiving, scanning, filing and delivering incoming mail, invoices and other items to the addressee. | Legitimate interest of the controller [Article 6(1)(f) GDPR]. | For the duration of existence of the legitimate interest, but not longer than the time necessary to achieve the purpose of the processing. |
2. | Filing and posting outgoing letters, invoices and other mail. | Legitimate interest of the controller [Article 6(1)(f) GDPR]. | For the duration of existence of the legitimate interest, but not longer than the time necessary to achieve the purpose of the processing. |
Data processing is carried out by the Chancellor’s Office.
With regard to postal data processing, data is transferred to Magyar Posta Zrt. and other courier and parcel delivery companies when the parcel is posted.
MOME has a trade union for University employees. The trade union keeps the following personal data on its members:
name of trade union member;
place and date of birth;
mother’s name;
place of residence, habitual residence, address for notification;
tax number;
e-mail;
position.
Purpose of processing | Legal basis of processing | Retention period for processed data |
Registration of trade union members for the purpose of exercising membership rights. | Legitimate interest of the controller [Article | Until the termination of the trade union membership. |
6(1)(f) GDPR] |
The data processing is carried out by the designated employee of the Doctoral School.
No data is transferred outside MOME during the processing of data in relation to the MOME Trade Union.
MOME processes the following personal data of Students and University staff, as well as of third parties and their contact persons, in the course of its external and internal communication activities for the purpose of operating effective external and internal communication channels, building relationships, promoting MOME and increasing its visibility:
Name, place of birth, place of residence, postal address, image and voice of the Student and University staff;
Name, telephone number, e-mail address of the contact person of the third party or partner institution providing the media contact;
name, e-mail address, image, voice of the person attending an event.
Purpose of processing | Legal basis of processing | Retention period for processed data | |
1. | Relationship building, communication activities to maintain existing relationships and build new ones. | Legitimate interest of the controller [Article 6(1)(f) GDPR]. | For the duration of existence of the legitimate interest. |
2. | Media relations management. | The Data Subject's consent [Article 6(1)(a) GDPR. | Until the consent is withdrawn (for processing after withdrawal). |
3. | Maintenance and development of online platforms | Legitimate interest of the controller [Article 6(1)(f) GDPR]. | For the duration of existence of the legitimate interest. |
4. | Publication of bulletins, news, other electronic communications. | Legitimate interest of the controller [Article 6(1)(f) GDPR]. | For the duration of existence of the legitimate interest. |
5. | Communicating the professional achievements of students and teachers | The Data Subject's consent [Article 6(1)(a) GDPR. | Until the consent is withdrawn (for processing after withdrawal). |
The Brand Communication Office is responsible for the data processing.
In the course of its external and internal communication activities, MOME may publish the name, image and voice of the Data Subject in printed form in its own or third party publications and articles, or in electronic form on its own communication channels (website, facebook, instagram, youtube, etc.) or on third party electronic platforms, and may share them with others in the form of photographs or video recordings.
In connection with the use of the MOME University Library and library system, the following personal data of registered users are processed:
name;
place and date of birth;
mother’s name,
address;
ID card number;
e-mail;
For students, the student card number.
Purpose of processing | Legal basis of processing | Retention period for processed data |
Keeping records of registered members, monitoring rented books, settling any delays and debts. | The processing is based on the voluntary consent of the data subject, pursuant to Article 6(1)(a) of the GDPR and Section 5(b) of the Information Act. | Until the consent is withdrawn, but not longer than 5 years after the termination of the library membership or until the completion of all library or financial transactions. |
The data is processed by the MOME University Library.
No data will be transferred outside the MOME in the course of processing data related to the use of the MOME University Library and the library system.
A separate data processing notice has been issued for the data processing activities of the MOME Archives.
In the course of its operation, the MOME University Dormitory processes the following personal data of Students applying for admission and Students who have been admitted to the dormitory:
name;
date and place of birth;
mother’s name;
place of residence and mailing address;
nationality;
e-mail, phone number;
Neptune code.
Purpose of processing | Legal basis of processing | Retention period for processed data | ||||
1. | Assessment of applications dormitory. | for | admission to | the | The processing is based on the voluntary consent of the data subject, pursuant to Article 6(1)(a) of the GDPR and Section 5(b) of the Information Act | Until the decision on the admission application has been taken, but at the latest until the end of any appeal procedure following the rejection. |
2. | Signing contracts with students who have been admitted to the dormitory and invoicing them for dormitory residence. | Performance of a contract [Article 6(1)(b) GDPR] | For 8 years after the termination of the dormitory placement, in accordance with Section 169 of Act C of 2000 on Accounting. | |||
3. | Recording and handling errors/defects reported. | of | complaints | and | Performance of a contract [Article 6(1)(b) GDPR] | Until the settlement of the complaint or error/defect, but no later than the expiry of the 5-year limitation period under the Civil Code. |
Data processing is carried out by the MOME University Dormitory.
No data is transferred outside MOME in connection with the operation of MOME University Dormitory.
The building of the Dormitory is operated by ATQ Property Zrt. (1117 Budapest, Budafoki út 187-189.).
MOME publishes on its website the names of the persons acting in the performance of the powers and responsibilities of bodies entrusted with public tasks, their other personal data related to the performance of public interest duties and personal data the disclosure of which is required by law as data accessible on public interest grounds pursuant to the Information Act. Personal data processed in this context:
the names, telephone and fax numbers and e-mail addresses of the heads of MOME and the heads of each department;
the name of the person responsible for information rights;
the name, telephone and fax number, e-mail address of the competent customer relation manager of MOME;
the name of the contractual partner involved in data provision.
Purpose of processing | Legal basis of processing | Retention period for processed data |
Compliance with the mandatory obligation of disclosure | Compliance with a legal obligation [Article 6(1)(c) GDPR] | With the previous status archived for 1 year |
Data processing is carried out by the Chancellor’s Office.
The data subjects’ data are published on MOME’s website and are shared with third parties pursuant to the law.
MOME processes the following personal data in order to represent and enforce its rights and legitimate interests and to fulfil its legal obligations in the course of official and judicial proceedings arising during its operations:
The name of the legal representative, his/her registered office, chamber identification number, e-mail address and telephone number;
Name, e-mail address, telephone number of the official administrator/legal adviser;
The name, date and place of birth, mother's name, registered office, place of residence, e-mail address, telephone number of the adverse party.
Purpose of processing | Legal basis of processing | Retention period for processed data | |
1. | Compliance with legal obligations and enforcing rights and legitimate interests in judicial and administrative proceedings. | Legitimate interests of the controller [Article 6(1)(f) GDPR] and compliance with a legal obligation [Article 6(1)(c) GDPR] | Until the 5-year limitation period under the Civil Code, or the period necessary for the establishment, exercise or defence of legal claims. |
Data processing is carried out by the Chancellor’s Office.
In the course of data processing in judicial and other official proceedings, the data processed will be disclosed to the courts, authorities, the adverse party and legal representatives.
In the course of its workplace and fire safety activities, MOME processes the following personal data of students and employees of the University and of contractors working for the University under a contract of engagement or works contract:
name, mother's name, programme, degree;
organisational unit, position.
Purpose of processing | Legal basis of | Retention period for processed data |
processing | ||
Conducting and documenting workplace and fire safety and | Compliance | Until the end of the student, employment |
civil defence training, keeping records of participants. | with a legal | or contractual relationship. |
obligation | ||
[Article 6(1)(c) | ||
GDPR] |
Data processing is carried out by the Campus Directorate.
No data is transferred outside MOME during the processing of data in relation to MOME’s workplace and fire safety activities.
In order to ensure the successful operation of the Erasmus Mobility Programme, MOME strives to establish and maintain successful cooperation with as many partner institutions as possible, in order to ensure that its students, lecturers and administrative staff can make the most of the opportunities offered by the programme. MOME processes the following data when establishing contacts, accepting and assessing applications for the programme, and entering into and fulfilling contracts with students, lecturers and staff admitted to the programme:
Student's name, place and date of birth, mother's name, place of residence, habitual residence, telephone number, e-mail address, image, passport number, bank account number;
data in the copy of the academic transcript;
details of the state language examination certificate or equivalent document;
credits earned and recognised, studies credited, data on the completion of internship;
Name, place and date of birth, mother's name, address and habitual residence of the lecturer and staff member; telephone number, e-mail address, image, passport number; bank account number;
Name and e-mail address of the contact person at the partner institution.
Purpose of processing | Legal basis of processing | Retention period for processed data | |
1. | Finding partner institutions, handling incoming partner institution enquiries, maintaining contacts. | Legitimate interest of the controller [Article 6(1)(f) GDPR] | For the duration of existence of the legitimate interest. |
2. | Contracting with partner institutions. | Performance of a contract [Article 6(1)(b) GDPR] | Pursuant to Section 169 of Act C of 2000 on Accounting, 8 years. |
3. | Receipt and evaluation of applications. | Compliance with a legal obligation [Article 6(1)(c) GDPR] | Until the call for applications is completed. |
4. | Conclusion and performance of the contract under the mobility programme, allocation of scholarships. | Performance of a contract [Article 6(1)(b) GDPR] | According to Section 169 of Act C of 2000 on Accounting, 8 years. |
5. | Recognition of credits successfully obtained. | Compliance with a legal obligation [Article 6(1)(c) GDPR] | Data retention time is eighty years from the date of notification of termination of student status. |
6. | Student counselling and customer service. | Compliance with a legal obligation [Article 6(1)(c) GDPR] | Data retention time is eighty years from the date of notification of termination of student status. |
Data processing operations are shared between the Centre for Studies, Information and Education, the Global International Office and the Directorate of Finance.
In the framework of the data processing activities carried out under the Erasmus Mobility Programme, data are provided to the Tempus Public Foundation.
MOME does not collect and does not process any personal data of the users of the websites it operates (mome.hu; premome.hu, mome open.hu). However, the website user data – such as the data of the User's log-in computer that are generated during the use of the website – are recorded by the MOME system as an automatic result of technical processes, and the data that are automatically recorded are automatically logged by the system – without any special declaration or action by the User – when visiting or leaving the website. However, this data is not linked to other personal user data, i.e. the user cannot be identified on the basis of this data. Only the Controller can access such data. Occasionally, statistical data may be collected in a way that does not allow the identification of individual users – using Google Analytics software – in order to measure and monitor the number of visits to the website in order to operate the website properly.
If the user explicitly provides or makes available their personal data when using any of the services of the website – e.g. newsletter – MOME will process such personal data provided for the duration of the purpose of the processing or until the consent is withdrawn, on the basis of the voluntary consent of the data subject pursuant to Article 6(1)(a) of the GDPR and Section 5(b) of the Information Act.
MOME uses so-called cookies on its websites. Cookies are small blocks of data that the browser saves on the user's device at the request of the web servers of websites. Websites temporarily store information that is important to them in these small blocks of data, to provide services through the websites, to improve the user’s browsing experience and to analyse the data on the number of visits to the websites.
Purpose of processing | Legal basis of processing | Retention period for processed data | |
1. | Ensuring the proper functioning and functionality of the MOME websites, customising the content available on the website, providing community features. | The processing is based on the voluntary consent of the data subject, pursuant to Article 6(1)(a) of the GDPR and Section 5(b) of the Information Act. | The User can delete his/her own cookie at any time, otherwise cookies are deleted automatically depending on the browser setting. |
2. | Use of the e-mail address for processing the registration for newsletters and sending newsletters (including sending advertising). | The processing is based on the voluntary consent of the data subject, pursuant to Article 6(1)(a) of the GDPR and Section 5(b) of the Information Act. | Until the consent is withdrawn. |
Data processing is carried out by the MOME servers.
No data is transferred outside MOME when using the MOME website.
The operation and IT support of the websites is provided by 2 sole proprietors (private entrepreneurs) contracted for this purpose. MOME uses the services of Mailchimp (The Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308 USA), as the technical service provider for the registration of the data provided by subscribers and for the sending of the newsletter. Mailchimp service provider The Rocket Science Group LLC is a registered company under the EU-US Privacy Shield framework and is therefore GDPR compliant. Mailchimp's Privacy Notice is available at the following link: https://mailchimp.com/legal/privacy/
MOME uses contracted contributors as data processors to support the following activities, on an ad hoc or longer-term basis (data processors used on a permanent basis are indicated in the relevant data processing activity):
accounting, finance;
administrative;
computer system operation;
building management;
personal and property protection;
event management.
The data subjects' data are transferred to these data processors for the purpose of processing personal data on behalf of MOME, in the manner and for the purposes specified by MOME. In the course of their activities, processors are required to ensure that the personal data transferred are only accessed by persons authorised to process them and to implement technical and organisational measures ensuring a level of protection appropriate to the risks presented by the processing. The legal relationship between MOME and its processors is governed by the data processing agreements between the parties.
MOME stores the personal data recorded in written declarations and contracts in the original written form or in the form of an electronic copy of the original document for the duration of the data retention period specified for each processing operation, and stores the data that are not based on written declarations and contracts in electronic form.
MOME takes appropriate measures to protect personal data against, inter alia, unauthorised access or unauthorised alteration. This is done by storing the data on paper in a locked location and, in the case of data stored in digital format, by protecting the data in accordance with the MOME Policy on the Secure Management, Operation and Use of Information Systems and Data, which classifies data to the security levels of "Open", "Basic", "Enhanced" and "Advanced" and by taking the security measures set for each level.
When the data is stored on paper, the paper documents are kept at the registered office of MOME at 1121
Budapest, Zugligeti út 9-25.
If the data is stored digitally, it is stored digitally on the servers located at the headquarters of MOME at 1121
Budapest, Zugligeti út 9-25.
The Data Subjects may at any time contact MOME at the contact details set out in Section II and
may request that MOME provide information about the processing of their personal data;
may request the rectification of their personal data processed by MOME;
may request the erasure of their personal data processed by MOME and the restriction of processing;
may request to receive the personal data and to have it transferred by MOME to another controller, provided that the legal preconditions for this are met;
may object, on grounds relating to their particular situation, to the processing of their personal data based on the legitimate interests of MOME;
may withdraw their consent to the processing of personal data where the processing is based on consent, with the provision that the withdrawal does not affect the lawfulness of the processing carried out prior to the withdrawal.
The Data Subject shall have the right to obtain from MOME confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and receive information about the circumstances of their processing. If the Data Subject's request is manifestly unfounded or if he or she is not entitled to receive the information, or if MOME can prove that the Data Subject has the requested information, MOME shall reject the request for information.
The Data Subject may, at the time of recording or later, decide who is excluded or authorised to access his or her data and to whom information about his or her data may be disclosed. In the absence of a declaration, only and exclusively close relatives may receive information and access the data, provided they have identified themselves in an appropriate manner.
The Data Subject shall have the right to obtain from MOME, upon his or her request, the rectification of inaccurate personal data processed by the Controller without undue delay and the completion of incomplete personal data.
The Data Subject shall have the right to obtain from MOME, upon his or her request, the erasure of personal data without undue delay where one of the following grounds applies:
the personal data are no longer needed;
if the consent underlying the processing is withdrawn and there is no other legal basis for the processing;
the Data Subject objects to the processing and there are no overriding legitimate grounds for the processing;
if the personal data was unlawfully processed by MOME;
if the personal data must be erased by law.
MOME shall not erase the data if the processing is necessary (i) for the exercise of the right to freedom of expression and information; or (ii) for compliance with an obligation under a law that requires the processing of personal data; or (iii) or for the establishment, exercise or defence of legal claims.
The Data Subject shall have the right to obtain from MOME, upon his or her request, the restriction of processing where one of the following applies:
the accuracy of the personal data is contested by the Data Subject, for a period enabling MOME to verify the accuracy of the personal data;
the processing is unlawful and the Data Subject opposes the erasure of the personal data and requests the restriction of their use instead;
MOME no longer needs the personal data for the purposes of the processing, but they are required by the Data Subject for the establishment, exercise or defence of legal claims; or
the Data Subject has objected to processing; in this event the restriction is pending the verification whether the legitimate grounds of the controller override those of the Data Subject.
Where processing has been restricted, the personal data subjected by the restriction shall, with the exception of storage, only be processed with the Data Subject's consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. MOME will inform the Data Subject in advance of the lifting of the restriction. If MOME establishes that the objection is justified, it shall terminate the processing as soon as possible and notify the objection to all those to whom it has previously disclosed the Data Subject's data.
The Data Subject shall have the right to object, on grounds relating to his or her particular situation, at any time to the processing of his or her personal data processed on the basis of MOME’s legitimate interest. In this case MOME shall no longer process the personal data unless MOME demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject or for the establishment, exercise or defence of legal claims.
Where it does not infringe the rights and freedoms of others, the Data Subject is entitled to receive his or her personal data in a structured, commonly used, machine-readable format. He or she also has the right to have these data transmitted by MOME directly to another controller if
processing is based on the Data Subject’s consent, or is necessary for the performance of a contract to which the Data Subject is party or in order to take steps at the request of the Data Subject prior to entering into a contract; and
processing is automated, i.e. personal data are processed in an IT system and not on paper.
The Data Subject may send his/her request to exercise the above rights to the contact details of MOME as set out in Section II. MOME shall provide information on the measures and actions taken on the request no later than 30 days from the date of receipt of the request or, if no action is taken, it shall provide information about the reasons for the lack of action no later than 30 days from the date of receipt of the request. At that time, MOME will also inform the Data Subject of his or her rights of redress.
The Data Subject may request information on processing once a year free of charge. If the Data Subject requests further information regarding the same set of data in a given year, MOME shall be entitled to claim reimbursement of costs, the amount and the due date of which shall be determined on the basis of the specific circumstances of the case.
If MOME rejects the Data Subject's request, the Data Subject may lodge an objection to the rejection with the National Authority for Data Protection and Freedom of Information (address: 1125 Budapest, Szilágyi Erzsébet fasor 22/c.; phone: +36- 1-391-1400; e-mail ugyfelszolgalat@naih.hu) or may bring the case to the court having competence according to his/her place of residence or domicile.
This Data Processing Notice may be unilaterally amended and/or withdrawn by MOME at any time, by informing the Data Subjects at the same time. Such information shall be provided by publication on the website or, depending on the nature of the change, by direct notification to the Data Subjects.
If you believe that MOME is not acting lawfully in the processing of your personal data, please first communicate your observations or requests to MOME, acting as the controller, using one of the contact details listed above, in order to enable us to process and handle your observation as quickly and efficiently as possible.
Policies containing additional procedural rules relevant for the application of this Data Processing Notice:
Privacy Policy
Policy on the handling and use of motor vehicles
Instruction on the electronic surveillance system on the territory of the Moholy-Nagy University of Art and Design Budapest
Policy on the secure management, operation and use of IT systems and data
MOME Erasmus Compass-Erasmus Mobility Programme Operational Rules