Privacy Policy

Data Processing Notice

This Data Processing Notice shall govern the processing of the personal data provided by the users for the purpose of visiting the website of ÁKK (www.akk.hu), subscribing to the newsletter or contacting ÁKK through the website. 

The traders and investors of government securities are informed by ÁKK about the current government securities market news through the website and the newsletters.

1. The Controller and the Place of Processing

Controller: Government Debt Management Agency Private Company Limited by Shares 

(ÁKK)

Represented by: Károly Gergely Tardos, Chairman-CEO 

Registered seat:  1013 Budapest, Krisztina tér 2. 

Postal address:    1253 Budapest, Pf.: 85. 

Electronical contact: https://www.akk.hu/contact

Email address: adatvedelem@akk.hu

Phone:      +36 (1) 488-9488 

Fax:        +36 (1) 488-9405 

For the purposes of the services mentioned in this Data Processing Notice the following definitions shall apply:

Processor: FORUM DIGITAL Informatikai, Kereskedelmi és Szolgáltató Korlátolt Felelősségű Társaság (Forum Digital Kft.), acting as the operator of the website at www.akk.hu, 2600 Vác, Cházár András utca 17.; company registration number: 13-09-158939 (tax number: 12464230-2-13).

2. General Provisions and the Terms Used in the Data Processing Notice

2.1. ÁKK pays special attention to ensure the protection, accuracy and confidentiality of the personal data of the persons coming into contact with ÁKK and shall use its best endeavours to ensure that the personal data provided to it are processed tied to a specific purpose, in line with the principle of storage limitation, only and exclusively with the appropriate legal basis, and that if no proper legal basis exists, the personal data processed by it shall not be transferred to third parties and that once the legal basis of processing ceases to exist, the concerned personal data shall be erased.

In line with its above objectives, ÁKK shall use its best endeavours to ensure that the principles applicable in terms of the processing of personal data are met fully, without restriction and in all cases during the procedure of personal data processing, such as, in particular, the principle of legality, fair procedure and transparency; the principle of purpose limitation; the principle of data minimisation; the principle of accuracy; the principle of storage limitation; the principle of integrity and confidentiality and the principle of accountability.

2.2. The below listed terms used in this Data Processing Notice shall have the below defined meaning:

Processing: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. 

Controller: a natural person or legal entity which alone, or jointly with other entities, determines the purposes and means of the processing of personal data. For the purposes of this Notice, Controller shall mean ÁKK. 

Personal data: any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. 

Data subject’s consent: any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Legitimate interest: Processing is necessary for the purposes of the legitimate interest pursued by the controller, except where such interest is overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller; 

Data transfer shall mean the act of making available the data to certain third parties;

Personal data breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed. 

Erasure of data shall mean the act of making the data unrecognisable so that their recovery is no longer possible;

Website shall mean the Internet page at www.akk.hu ;

User (data subject) shall mean the natural person visiting the website and providing their personal data required for registration or contact purposes (as determined on the dedicated contact form) in relation to the Newsletter service; 

Newsletter shall mean the information service provided by ÁKK on the website at www.akk.hu; 

Data Processing Notice shall mean this Data Processing Notice of ÁKK. 

3. The individual data processing actions

3.1. Data logged by the system (does not entail personal data processing) 

Cookies are strings of information, information files (_ga, _gat, _gid) that service providers place on the user’s computer and thus allow a website to record information about the user’s browsing habits (for instance, to store user preferences and settings; help with signing-in, analyse website performance).

ÁKK’s website (www.akk.hu) uses cookies in certain areas to ensure the smooth operation of the website, to improve user experience, to facilitate navigation between the individual pages, to access protected content (necessary cookies), and to track and measure user activity (statistical cookies).

In addition, the website uses so-called web beacons or “tracking pixels” to track the number of visitors, whereas by using statistical cookies, the website operator examines how many unique users visit the site and how often, from what device or browser.

The strings of information stored in the cookie itself are only capable of recognizing the user’s computer, but they are not able to uniquely identify the user. ÁKK shall not use the statistical data – which do not identify visitors – collected by cookies for profiling, and ÁKK shall not use behavioural advertising using the collected statistical data.

a) Data subjects: All the users visiting the www.akk.hu website.

b) Legal basis of data processing: 

In terms of the cookies essential for the use of the website, the legitimate interest of the controller [Article 6(1)(f) of the GDPR] 

c) Persons entitled to access the data: 

ÁKK and the processors do not process any personal data through the use of cookies.

d) Rights of the data subjects (users): 

Data subjects have the option to regulate the use of cookies through the settings provided on the website. 

e) Purpose of data processing, data retention time, time limit for erasure of the data:

An itemized overview of the cookies used on the site and their settings are made available in a separate menu titled “Cookie Information” which can be accessed from the bottom navigation bar of the browser window displayed prior to accepting the cookie settings, and later from the website footer under “Disclaimer”.

3.2.   Data processing related to the personal data provided in the course of registration to the Newsletter

a)   Scope of processed data and the purpose of data processing 

E-mail: The e-mail address is essential to identify the User registering for the Newsletter in the database. In addition, it also serves contact purposes between ÁKK and the registrant.

Declaration on accepting the Data Processing Notice: check-box, check mark box.

ÁKK draws your attention to the fact that it is not necessary for the e-mail address to contain personal data. For example, it is not necessary for the e-mail address to contain the data subject’s name suitable to identify the data subject. The data subject is free to choose whether or not to provide an existing e-mail address that contains information about his or her identity.  

 

ÁKK does not use the personal data (e-mail address) provided during registration for purposes other than those described in these sections. The scope of processed personal data is proportionate to the purpose of data processing and may not extend beyond it. In all cases where ÁKK wishes to use personal data for a purpose other than the purpose of the original data collection, it shall inform the User thereof and obtain their express prior consent or provide them with an opportunity to prohibit such use.

b)   Legal basis for data processing 

The legal basis for the processing is the consent of the data subject with regard to the above data provided during registration for the Newsletter [Article 6(1)(a) of GDPR].  

 

c)   Duration of data processing 

ÁKK shall process the data provided during registration for the Newsletter until the withdrawal of the User's consent. 

The processing of the personal data provided by the User will continue until the User unsubscribes from the Newsletter, requests the erasure of the personal data in any other way, withdraws the consent given or until ÁKK terminates the provision of the Newsletter service. In such a case, the personal data will be erased from the controller's systems in a final and non-recoverable way. 

The owner of the personal data can unsubscribe from the Newsletter at any time, without any limitation or reasoning, free of charge and may request the erasure of their data at the above contact details of ÁKK, which at the same time shall also mean the termination of the service. 

3.3.   Processing of personal data provided through the contact form 

The www.akk.hu website contains a form suitable for contacting ÁKK through its e-mail address. On this form, the user can ask questions and make inquiries directly to the designated employees of ÁKK. 

a)   Scope and purpose of personal data processed for contacting purposes:

- name: for identification purposes

- e-mail address: liaising, sending of reply messages

During the contact, any other personal data that the user may have voluntarily provided on the form will also be stored in the mail system. 

b)   Scope of data subjects: the users sending a message through the contact form.

c)   Purpose of data processing: Responding to inquiries and requests received from natural    persons.

d)   Legal basis of data processing: 

Designated legitimate interest of ÁKK [Article 6(1)(f) of the GDPR].

The legal basis of data processing is based on the fulfilment of the legal obligation of ÁKK, which requires organizations performing public tasks to respond to inquiries. The obligation to respond is governed by Act CLXV of 2013 on Complaints and Public Interest Disclosures.

e)   Duration of data processing: 

ÁKK shall process the personal data related to inquiries for the period of 5 (five) years (including the claim enforcement period), in line with its Records Management Policy. The e-mails displaying personal data shall be archived by ÁKK in accordance with the applicable records management legislation (in particular Act LXVI of 1995 on Public records, public archives, and the protection of private archives; hereinafter as: “Ltv.”) and these shall be handled among the archived records until the expiry of the disposal period specified in its currently effective archival plan – taking into account the aforementioned retention periods – or if no such disposal period is defined, until the concerned e-mail is placed into the official public archives. Subsequently, ÁKK shall erase the data (discards the records) – with the exception of the data to be submitted to the official public archives pursuant to the Ltv. and the personal data to be processed in the records management system pursuant to the legal provisions – and as of submission to the official public archives, the processing at ÁKK shall be terminated. 

Description of legitimate interests related to data processing based on the declared legitimate interest of the controller:

The GDPR enables ÁKK, acting as a controller, to base its data processing on any of its legitimate interests. An exception to this may be where the interests, fundamental rights and freedoms of the data subject take precedence. 

ÁKK is required by law to respond to requests sent to it voluntarily in connection with the issuance or trading of government securities. To this end, the data subjects (senders of the requests) send the personal data to ÁKK and ÁKK takes over these data. We weighed this legitimate interest within the framework of an interest balancing test against the possible violation of the rights of the data subject. Since the data subject’s personality rights are always respected by ÁKK in the course of performance of ÁKK’s tasks required by law and the provision of the responses to the requests submitted to ÁKK, therefore the data subject suffers a lesser restriction of their rights in the course of the responses than the legitimate interest, given that there is an overriding interest and a legal obligation on both sides to have access to these data. The purpose of processing of these personal data is to allow the request to be answered, therefore if the proper legal basis exists, these personal data can be processed to the extent and for the duration required for that purpose.

4. Access to data and data security measures 

 

4.1. Access to data and data transfer 

The personal data can be accessed by the employees of the IT Department of ÁKK, the employees responsible for the operation of the newsletters, as well as the designated employees of Forum Digital Kft operating the website, for the sake of performance of their tasks. 

Transfers to third parties that may be necessary to respond in the course of the contact process may be made without the data subject's separate, one-off consent, since the data subject gives his or her express and unambiguous consent to such data transfer already in the course of the voluntary contact process made through the contact form after reading and accepting this Data Processing Notice.

The personal data processed by ÁKK shall be transferred by ÁKK to other state agencies only in the manner and for the purpose specified by law. For example, when the police or the Public Prosecutor's Office contact ÁKK and request the provision of documents containing specific personal data necessary for a particular investigation.

When the form is completed and submitted, an entry is created in an automated form in a so-called “log file” that records the system logs of the server serving the website. This file contains the name and e-mail address data provided by the user on the website, as well as the time of data recording, however, the processors do not monitor the files containing these data, they are created only during server operation for security reasons and the data contained in them are automatically and irreversibly deleted from the server after 7 (seven) calendar days.

4.2. Data security measures 

ÁKK stores the personal data (e-mail address) provided during the registration for the Newsletter on the Amazon Web Services (AWS) server, while the personal data contained in the e-mail generated on the basis of the data provided on the Contacts page are stored on ÁKK’s mail server. ÁKK shall not use the services of other entities for purpose of storage of the personal data and no further processors shall be engaged either. 

ÁKK undertakes the obligation to ensure data security, and take all technical and organisational measures and establish such procedural rules that guarantee that the recorded, stored and processed data are protected to the extent necessary to enforce the relevant legislation, and also to prevent any damage to them, or destruction, erasure, unauthorized use, disclosure and unauthorized alteration of the data.

Only technical actions/operations shall be carried out by ÁKK regarding the data delivered to it (such as storage or retention in computer systems). By creating the appropriate access and authorization levels, it shall ensure that the data subject’s personal data are safe and secure. 

5. Rights of the Data Subjects regarding the Processing

5.1. Right to request information 

Data subjects can request information from ÁKK in writing, through the contact channels specified in Section 1, about the following: 

- which personal data are processed,

- what is the legal basis, 

- what is the purpose of processing, 

- what is the source of data, 

- for how long are the data processed, 

- to whom, when, under what legislation was access provided by ÁKK to data subject’s personal data, which personal data were involved, to whom were these transferred by ÁKK. 

 

ÁKK shall fulfil the data subject’s request within one month at the latest, in a letter sent to the contact address or e-mail address provided by the data subject. 

5.2. Right to rectification 

Data subjects can request ÁKK in writing, through the contact channels specified in Section 1, to change any of their personal data (for instance they can change their e-mail address at any time). ÁKK shall fulfil the request within one month at the latest and shall notify the data subject thereof in a letter sent to the contact address or e-mail address provided by the data subject. 

5.3. Right to restriction of processing 

Data subjects can request ÁKK in writing, through the contact channels specified in Section 1, to restrict the processing of their personal data, in the event the data subject contests the accuracy of the processed personal data. In this case the restriction shall be valid for the period enabling ÁKK to check the accuracy of the personal data. ÁKK shall mark the personal data processed by it, if the data subject contests the correctness or accuracy of such data, but the incorrectness or inaccuracy of the personal data cannot be determined without doubt.

The data subject may request ÁKK to restrict the processing of their personal data, even if the processing is unlawful but the data subject opposes the erasure of the processed personal data and requests the restriction of their use instead.

Furthermore, the data subject may also request ÁKK to restrict the processing of their personal data, even if the purpose of data processing has been fulfilled, but the data subject requests the processing of such data by the controller for the establishment, exercise or defence of legal claims.

5.4. The right to object 

Data subjects can object to the processing in writing, through the contact channels specified in Section 1. ÁKK shall fulfil the request within one month at the latest and shall notify the data subject thereof in a letter sent to the contact address or e-mail address provided by the data subject. 

5.5. Right to erasure

The data subject shall have the right to obtain from ÁKK the erasure of personal data concerning him or her without undue delay and ÁKK shall have the obligation to erase personal data without undue delay where any of the grounds stipulated by law applies.

Please note that the data subject’s above mentioned right may not be exercised if processing is required for the establishment, exercise or defence of legal claims.

If erasure of a particular data is not possible, the controller shall block the concerned data.

5.6. Right to data portability

The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to ÁKK, in a structured, commonly used and machine-readable format and also to transfer those data to another controller, without hindrance from ÁKK.

6. The activities performed by the Processor

6.1. ÁKK employs the Processor specified above in this Data Processing Notice in order to perform its newsletter sending activities. 

6.2. The Processor may not make decisions independently, and it shall act in compliance with its contract concluded with and the instructions received from ÁKK.

 

6.3. The Processor may only employ further processors subject to the Controller’s consent.

7. Applicable Legislation

The following legislation shall be applied in terms of the processing actions related to the visit to ÁKK’s website and the terms and definitions used in this Data Processing Notice: 

- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“General Data Protection Regulation” or “GDPR”) and 

- Act CXII of 2011 on informational self-determination and the freedom of information (the “Information Act”).

- Act CVIII of 2001 on certain issues of electronic commerce services and information society services

8. Legal Remedy

Data subjects can contact the Controller with any of their questions or remarks related to the processing via www.akk.hu/contact; adatvedelem@akk.hu or by mail H-1253 Budapest, P.O. 85. (DPO: Judit Járai)

Data subjects may also turn directly to the Hungarian National Authority for Data Protection and Freedom of Information (address: 1055 Budapest, Falk Miksa u. 9-11.; phone: +36-1-391-1400; e-mail: ugyfelszolgalat@naih.hu; website: www.naih.hu) regarding any of their complaints related to processing. 

Furthermore, data subjects may initiate civil action against ÁKK in the event they experience unlawful processing of their personal data. Such lawsuits shall fall within the competence of regional courts. The lawsuit may be initiated – at the data subject’s discretion – at the regional court having competence according to the data subject’s domicile as well. (the list and contact details of the regional courts are provided at the following link: http://birosag.hu/torvenyszekek).