CAMPAIGN TERMS, DATA PROCESSING GUIDE AND STATEMENT OF CONSENT
for the processing and sharing of personal data, audiovisual recordings and special data within the campaign
Nyitottak Vagyunk Nonprofit Korlátolt Felelősségű Társaság (seat: 1056 Budapest, Belgrád rakpart 26.; email: firstname.lastname@example.org; represented by: Melinda Miklós, Managing Director; hereinafter: “Company” or “Controller”) hereby announces a campaign entitled #yourstorycounts to share the personal or business success stories, with photos, of members of minority groups (e.g. Roma, LGBT) and individuals with special backgrounds (e.g. physically disabled) (“Campaign”). To register, please use the Company’s campaign website at https://nyitottakvagyunk.hu/en/yourstorycounts/, stating your name, (work) email address, the type of success (art, sports, business or scientific) and submitting your story and photo. You must sign and attach the statement of consent, an annex to these Campaign Terms. By submitting your application you accept the provisions of these Campaign Terms.
The Company’s staff shall select the stories to be shared in the Company’s Gallery of Stories at https://nyitottakvagyunk.hu/en/yourstorycounts-stories/ (“Website”). The Company shall notify by email both those selected and those whose stories will not be shared of the results. The Company may ask selected participants to provide further information about their stories to be shared, may initiate a video conference with them to learn about their stories in greater detail, and may ask them for the names and contact information of reference persons [telephone number, (work) email address] for the purpose of contacting them to confirm the authenticity of the story. The Company shall use only its own selection criteria and disclaims any liability for the sharing of the story.
The Company shall share the selected stories and the photos of those submitting them on both the Website and its social media platforms, and shall not remove them until the applicant requests this or the Company itself decides to terminate the Campaign.
The applicants acknowledge that the Campaign may involve sponsors whose names and logos may also appear on the Website and in the Campaign.
The Campaign is only available for persons over the age of 18 years. The Company shall deny registration to minors.
Applicants may only submit their own personal stories to the Campaign. The Company shall not accept third party stories or recommendations or contact data of third parties.
The Company shall take all reasonable efforts to share only personal stories that are real and submitted by the applicants, and to eliminate false or unlawful applications but disclaiming any liability for them. Furthermore, the Company reserves the right to reject any application that is contrary to these Campaign Terms, violates any third party personal rights or copyrights, contains any business secret or is unlawful in any other way, and to remove with immediate effect any stories already shared.
The Company shall not pay or provide any compensation for applications.
In the Campaign, the Controller shall process certain personal data of the applicants as data subjects related to their stories, laid down in Article 4.1 of General Data Protection Regulation 2016/679 of the EU (“GDPR”), specifically certain special categories of personal data depending on the stories laid down in GDPR Article 9(1) (e.g. racial or ethnic origin, political opinion, sexual orientation, medical data). The Controller shall present the characteristics of data processing and the data protection rights and redress options of data subjects as described below, provided that they shall be interpreted in conjunction and harmony with the Company’s Data Protection Guide at https://nyitottakvagyunk.hu/en/privacy-policy/:
3.1 Scope of personal data processed:
The data subjects’ given names and surnames, (work) email addresses, type of success, stories containing special personal data and photos, the audiovisual recording of the video conference held for the selection, and any other data supplied by the reference person with respect to the story.
3.2 Purposes of data processing:
3.3 Legal basis of data processing:
The data subject’s consent laid down in GDPR Article 6(1)a) and Section 2:48(1) of Act V of 2013 on the Civil Code (“CC”), with the data subject’s consent laid down in GDPR Article 9(2)a) with respect to the special personal data included in the stories.
Data subjects may withdraw their consent by making a relevant statement at any time. Such withdrawal shall not affect the lawfulness of any prior data processing based on the consent. The lack of such consent shall not adversely affect the data subject, but his or her story shall not be shared and any data submitted by him or her shall be deleted without such consent.
3.4 Recipients of personal data:
Data processors involved:
FleishmanHillard Café, H-1037 Budapest, Seregély street 3-5.
PUBLICIS BUDAPEST, 1037 Budapest, Montevideo u. 10.
3.5 Term of data processing:
The Controller shall process the applications, the data supplied in them, the audiovisual recording of the video conference held for the selection, and the data supplied by the reference person with respect to the story until the selection of the stories to be shared or until the withdrawal of the data subject’s consent.
The stories in the applications selected for sharing, including the given names and surnames, shall be shared until withdrawal of the consent and shall be deleted afterwards. The applications, the data supplied in them, the audiovisual recording of the video conference held for the selection, and the data supplied by the reference person with respect to the story shall be kept as background documentation for the period of sharing of the story.
The complete deletion or destruction of any story submitted with a given name and a surname may only be possible until it is shared. Third parties may make copies of the stories shared, and this cannot be checked by the Controller. It may not be possible to fully withdraw the already released copies not subject to the Controller’s supervision.
3.6 Data subjects’ data protection rights and redress options
Data subjects may ask for information about the processing of their foregoing personal data and access to the same at any time (including requests for copies) and may also ask for the rectification or deletion of their data and for the restriction of data processing. To contact the Controller about such matters, please email email@example.com or write to 1056 Budapest, Belgrád rakpart 26. The Controller is required to comply with such requests within one month. This deadline may be extended by an additional two months as required by the complexity of the request and the number of requests. The Controller shall notify the data subject of the extension of the deadline, stating the reasons for the delay, within one month of receipt of the request. Where the data subject submitted the request by electronic means, the response shall preferably be given electronically unless otherwise requested by the data subject.
If the data subject takes the view that the processing of his or her personal data is contrary to any law, he or she may submit a complaint to the competent data protection authority (list: https://edpb.europa.eu/about-edpb/board/members_en, in Hungary: National Data Protection and Freedom of Information Authority, address: 1125 Budapest, Szilágyi Erzsébet fasor 22/c, postal address: 1530 Budapest, POB 5, email: firstname.lastname@example.org, website: www.naih.hu, phone +36 (1) 391-1400), or may seek judicial redress (filing the action with the regional court with competence at the Controller’s seat or at the data subject’s permanent or temporary residence, depending on the data subject’s choice). For the competence and contact data of courts (regional courts), please visit www.birosag.hu.
The data protection rights and redress options related to personal data are set out in the relevant provisions and limitations of the GDPR (especially Articles 12-20, 77-79 and 82) and in the following provisions.
3.7 Right to information
Where the Controller processes personal data related to the data subject, the Controller shall provide the data subject with information, even without the data subject’s request, about the key parameters of data processing, including its purposes, legal basis and term, the name and contact data of the Controller and its representative, the contact data of the Data Protection Officer, the recipients of the personal data, and the data subject’s rights and redress options related to the data processing (including the right to submit a complaint to the supervisory authority) and, if the source of data is not the data subject, the source of such personal data and the categories of the personal data concerned, unless such information is already available to the data subject.
No data processing shall be carried out by automatic decision-making or profiling.
3.8 Right to access
The data subject shall have the right to obtain from the Controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and certain data processing information, including the purposes of data processing, the categories of personal data concerned, the recipients of the personal data, the (envisaged) period of data processing, the data subject’s rights and redress options (including the right to lodge a complaint with the supervisory authority), and information about the source of data where the personal data are not collected from the data subject.
Upon the request of the data subject, the Controller shall provide him or her with a copy of the personal data being processed (including but not limited to the Recordings). For any further copies requested by the data subject, the Controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form. The right to obtain a copy shall not adversely affect the rights and freedoms of others.
The Controller shall inform the data subject about the option to issue copies, its manner and potential costs, and any other detail as requested.
3.9 Right to rectification
The data subject shall have the right to obtain from the Controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
3.10 Right to erasure
The data subject shall have the right to obtain from the Controller the erasure of personal data concerning him or her without undue delay, and the Controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
3.11 Right to restriction of processing
The data subject shall have the right to obtain from the Controller restriction of processing where one of the following applies:
A data subject who has obtained restriction of processing shall be informed by the controller before the restriction of processing is lifted.
3.12 Right to data portability
Where the processing is carried out by automated means with the data subject’s consent, the data subject shall have the right to receive the personal data concerning him or her in a commonly used and machine-readable format and have the right to transmit those data directly to another controller designated by the data subject if the technological conditions are met.
To give your consent as a data subject to the processing of your personal data for the purposes of the Campaign and to the management of your story with your given name and photo, please fill and sign the following statements.
[I, the undersigned …………………………………. [Data Subject’s name] (address: [*], email: [*]) hereby state that ] I have become familiar with and accept the Guide (“Guide”) of Nyitottak Vagyunk Nonprofit Korlátolt Felelősségű Társaság (seat: 1056 Budapest, Belgrád rakpart 26.; hereinafter “Company” or “Controller”) concerning its campaign entitled #yourstorycounts (“Campaign”), and by virtue of its terms, hereby sign this document
I hereby give the Controller my consent to alter and edit my photos submitted by me for sharing in the Controller’s public gallery at https://nyitottakvagyunk.hu/en/yourstorycounts-stories/ and to display them or any part thereof on such website.
I have no special financial claim or demand for the foregoing use of my photos submitted by me or for the relevant processing of my personal data and I shall not enforce or submit any such claim or demand in the future.
I hereby state that I am aware of my rights and redress options related to the data processing. I hereby confirm that I had the opportunity to ask my questions and have received appropriate answers.
Furthermore, I hereby accept that the Controller shall not use my photos submitted by me without my consent.
I hereby accept that I may withdraw my consent by a statement using any of the Controller’s foregoing contact data. Furthermore, I hereby accept that the potential withdrawal of my consent to the processing of my personal data shall not affect the lawfulness of any prior data processing based on my consent.
I hereby assign the Company a non-exclusive, transferable right to use any textual content or contents and photo(s) sent or delivered to the Company within the Campaign (hereinafter jointly : “Content”) without any limitation in terms of time, geography or manner of use, thereby authorising the Company to make any use of the Content (including but not limited to sharing and re-sharing with the public and to adaptation), but only within and related to the Campaign. I hereby state that I have no claim for and explicitly waive any financial compensation for the rights of use assigned above.
I hereby represent and warrant that I have the exclusive right to make juridical acts with respect to the Content and that no third party holds any right to the Content which may prevent the acquisition of rights by virtue of this statement. I also warrant that the Content does not violate the copyrights or neighbouring rights or personal rights of any third party and does not include any business secret. I hereby represent and warrant that I have obtained the reference person’s consent or any other valid legal authorisation to supply his or her data to the Company for contact purposes. I hereby represent and warrant that the statements made in the Content are genuine.
Data subject’s signature
Data subject’s name]