Privacy Policy
Effective as of: [date to be set at launch] (effective until withdrawn)
The Data Controller
| Name | Data |
|---|---|
| Company name: | venture co scribers kft. |
| Short company name: | venture co scribers kft. |
| Corporate registration no.: | 13 09 231650 (registered by the Budapest Környéki Törvényszék Cégbírósága) |
| Registered seat: | 2162 Örbottyán, Tó utca 113., Hungary |
| EU VAT no.: | HU28973940 |
| Customer service contact information: | E-mail: hello@engh.app Address: 2162 Örbottyán, Tó utca 113., Hungary |
| Data Protection Officer (DPO) contact information: | Tamas Daniel Vezer E-mail: director@ventureco.group |
| Duly authorized representative: | Tamas Daniel Vezer, managing director, autonomously on his/her own E-mail: hello@engh.app |
and Partners as data controllers (hereinafter: Data Controller or Controller) have established the present Privacy Policy (hereinafter: Policy) to define the scope of data controlled by it as well as the method, purpose and legal basis of data processing, and to ensure the furtherance of the constitutional principles of data protection and of the requirements of data security, and to prevent unlawful access to users’ data and any change and unlawful publication or use of said data. The above are realized regarding the users of the browser-based web application engH, accessible at https://engh.app, jointly operated by Data Controller and Partners (hereinafter: engH or the Application), and the online moderated and branded communication services within engH (hereinafter jointly: Services) and other data subjects.
The present Policy applies to all data processing connected to the operation of engH.
The provisions of this Policy shall be duly applied to all employment-related privacy regulations and other policies regarding data processing that are set forth by the Data Controller in separate documents.
Personal scope
| Category | Description |
|---|---|
| Data Subjects (are those, whose personal data is processed by the Data Controller under this Policy): natural persons, who are identified or are – either directly or indirectly – identifiable through any specific personal data. | Registered users of engH – see the effective General Terms and Conditions of the Data Controller (available in the Application and at https://engh.app/en/legal/privacy) –; and those natural persons, of whom the users transmit image/video information through the Services of engH (e.g. if the User registers a fan selfie in engH displaying multiple people). Where the present Policy refers to Users, those shall be applied to all Data Subjects – unless otherwise dictated by the logic of the provision in question. |
| Data Controller and people falling under Controller’s oversight: | Members and employees of Data Controller or any other person who has been involved in any activity under this Policy. |
| Data processor(s): | See: dedicated subchapter of the present Policy. |
Users accept and expressly acknowledge that Data Controller is unable to contact unregistered data subjects, and therefore:
- By accepting the terms of the present Policy Users take full responsibility to only upload or share such personal data of third parties on the system of engH, for the use of which, the data subjects or their legal representatives – especially in the case of minors – have given express consent, in accordance with this Policy, providing authorization to upload and share that data.
- The resources of Data Controller do not make possible the control of compliance with the above. Therefore, Data Controller hereby excludes all responsibility for unlawful uploads of user content, provided that – upon becoming aware of such unlawful situation – the Data Controller shall take all immediate measures to cease and desist.
By accepting the present Policy, User hereby declares to acknowledge this provision.
Data Protection Laws
For the purposes of this Policy, the following is a non-exhaustive list of laws that are of special significance:
- Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter: GDPR);
- The Fundamental Law of Hungary;
- Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (hereinafter: Infotv.);
- Act V of 2013 on the Civil Code of Hungary (hereinafter: Ptk.);
- Act CVIII of 2001 on Electronic Commerce and on Information Society Services (especially Articles 13/A.–13/B. §);
- Act I of 2004 on Sports and its implementing decrees;
- Act CLXIV of 2005 on commerce;
- Act CXIX of 1995 on the Use of Name and Address Information Serving the Purposes of Research and Direct Marketing;
- Act XLVIII of 2008 on the Basic Conditions and Restrictions of Business Advertising Activity (Grtv.);
- Act C of 2003 on Electronic Communications;
- Act XC of 2017 on Criminal Procedure;
- Act C of 2012 on the Criminal Code;
- as well as all data protection laws applicable at the registered seat of the owner and operator of the Data Controller’s partners (hereinafter: Partners), except if contrary to Hungarian law.
Definitions
Data Subject: natural persons, who are identified or are – either directly or indirectly – identifiable through any specific personal data.
User: Data Subject, who registers on the website or in the Application of Data Controller and who contracts for data processing with Data Controller.
Consent: Voluntary and definite expression of the Data Subjects’ will, based on adequate information, giving unequivocal consent to process personal data relevant to them, be it for comprehensive processing or for certain procedures.
Personal Data: Data that can be connected to the Data Subjects – especially their names, age group, geo-location, identifiers, one or more factors characteristic to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person and all conclusions that can be drawn from these in relation to the Data Subjects.
Data Controller: means the natural or legal persons, or organizations having no legal personality, who determine – either on their own or jointly with others – the purposes of data processing, make decisions concerning data processing (including the means used) and implement such decisions or have them implemented by a data processor.
Data processing: means any operation or set of operations that is performed on data, regardless of the procedure applied; in particular collecting, recording, registering, organizing, storing, modifying, using, retrieving, transferring, disclosing, synchronizing or connecting, blocking, erasing and destroying the data, as well as preventing their further use; taking photos and making audio or visual recordings, as well as registering physical characteristics.
Data transfer: providing access to the data for a designated third party.
Technical data processing: carrying out data processing operations and technical tasks on behalf of the Data Controller, independent of the methods and tools applied to carry out the tasks and of the place of their application.
Publication: Making the data available through providing access to anyone.
Data erasure: rendering data unrecognizable in a way that it can no longer be restored.
Automated processing: includes the following tasks if these are carried out via completely or partly automated processing tools: storing data, logical or arithmetic tasks completed with the data, changing, deleting, indexing, searching and disseminating data.
System: The totality of all technical solutions that operate the Services of engH.
All other terms in this Policy shall be understood by Data Controller to have the meaning attributed to them as defined under the interpretative definitions of Article 4 GDPR, Article 3 Infotv., and under the General Terms and Conditions (GTC) of engH.
Purposes of data processing and the scope of data processed by Data Controller
Data Controller declares that it shall only process data to exercise a right or perform an obligation. Personal data processed shall not be used for personal goals and data processing shall, at all times, comply with the principle of data processing limited to the intended purpose. If the purpose of data processing no longer exists or the processing of data is otherwise unlawful, the data shall be erased and deleted.
Data Controller shall only process the personal data of Data Subjects within the scope, for the purposes and to the extent below:
| Specification of processing purpose | 1. Registration, encompassing: – Identification of Data Subjects; – Correspondence with Data Subjects, for the purpose of – among others – providing information; – Performance and certification of the requirements of Article 8 GDPR. |
|---|---|
| Describing processes and tasks: | To prevent abuse and improprieties, to secure Services and to avoid security risks, Users may only use engH after registration in accordance with the effective General Terms and Conditions of Data Controller (hereinafter: engH GTC) (hereinafter: Registration). Registration takes place via social login (Google or Facebook single sign-on, OAuth2). Users’ age range is identified at the login process which allows engH to uphold the requirements of Article 8 GDPR. See in detail in engH GTC. |
| Expected duration and deadline of data processing: | Until Registration is deleted. |
| Scope, types and categories of personal data: | Data to be provided as a precondition of Registration: based on the choice of the Data Subjects, the data received from their Google or Facebook accounts (typically name, e-mail address, age group, profile identifier). |
| Location of data processing: | Electronic processing, see: Data processors. |
| Legal basis of data processing: | Art. 6 (1) a), b) and c) of Chapter II, GDPR. |
By accepting the present Policy, User hereby declares to acknowledge this provision.
| Specification of processing purpose | 2. Taking, storing selfies/videos, gallery |
|---|---|
| Describing processes and tasks: | The Application provides a fan experience for the Data Subjects accessing and using it in a way, which enables the Data Subjects to take a photo through the Application, with a device suitable for taking digital photos/videos, and send it to the Data Controller through the Application. After this, the photo/video shall appear one or more times on several online platforms (e.g. social media surfaces, live streams and broadcast overlays of Partners and Data Controller) and on the display surfaces on the site of the events (e.g. on electronic displays in the stadium or venue during the events of Partners) one or more times. The photos/videos taken shall be stored by the Application and the Data Subject can share those on other online platforms at any time. engH provides an opportunity to attach a fan message to a given photo/video. In detail, see: engH GTC. |
| Expected duration and deadline of data processing: | Until deletion by User, but at the latest until the Registration is deleted. |
| Scope, types and categories of personal data: | The complete data content of the photo/video taken by the User, typically the facial image of the User or other natural persons; the fan message of the User attached to the photo/video. |
| Location of data processing: | Electronic processing, see: Data processors. |
| Legal basis of data processing: | Art. 6 (1) a) of Chapter II, GDPR; Art. 9 (2) a) of Chapter II, GDPR. |
By accepting the present Policy, User hereby declares to acknowledge this provision.
| Specification of processing purpose | 3. Sending selfies/videos to an event, publication following prior moderation |
|---|---|
| Describing processes and tasks: | A service of engH allowing fan selfies/videos to be forwarded to selected events of Partners. Data Controller shall – before forwarding it – put a hold on the photo/video taken and sent to it until the necessary checks are conducted. Moderation is carried out in a two-step process: (i) an automated pre-screening supported by artificial intelligence, followed by (ii) a review by the Data Controller’s designated personnel (human moderation). No photo/video is refused solely on the basis of the automated pre-screening: the final moderation decision is always made or confirmed by a human reviewer. The purpose of the check is to avoid publication of unlawful content or content that offends others or is otherwise objectionable. Photos approved also by the Data Controller will appear in public on the surfaces dedicated to this purpose at the venue of the event selected. In detail, see: engH GTC, Provisions on Prohibited Content. |
| Expected duration and deadline of data processing: | In the case of objectionable content, until deletion by Data Controller, otherwise until the Registration is deleted. |
| Scope, types and categories of personal data: | The complete data content of the photo/video taken by the User, typically the facial image of the User or other natural persons; the fan message of the User attached to the photo/video. |
| Location of data processing: | Electronic processing, see: Data processors. Photos/videos approved also by the Data Controller will appear in public on the surfaces dedicated to this purpose at the venue of the event selected. |
| Legal basis of data processing: | Art. 6 (1) a) of Chapter II, GDPR; Art. 9 (2) a), e) of Chapter II, GDPR. |
By accepting the present Policy, User hereby declares to acknowledge this provision.
| Specification of processing purpose | 4. Publicly displaying selfie(s)/video(s) on promotional surfaces and in social media content of the Partners or in other professional content |
|---|---|
| Describing processes and tasks: | By accepting this Policy, the Users expressly consent (until consent is withdrawn) for their selfies or photos/videos to be publicly displayed (upon their request) in a manner not violating the personality rights of Data Subjects on events of Partners, or on promotional surfaces promoting Partners, on the Partner’s website, on their social media, live streams and broadcast overlays or on other professional and promotional surfaces. In detail, see: engH GTC. |
| Expected duration and deadline of data processing: | Until consent is withdrawn. |
| Scope, types and categories of personal data: | The complete data content of the photo/video taken by the User, typically the facial image of the User or other natural persons; the fan message of the User attached to the photo/video. |
| Location of data processing: | Electronic processing, see: Data processors. Data Controller separately also calls the attention of all Data Subjects that the above selfies and photos/videos may be uploaded onto sites maintained by Partners, where Data Controller has no influence whatsoever over the practice of personal data processing. In such cases the Data Controller suggests reading the effective privacy or data protection policies and data protection regulations that apply to the use of these sites. If any of the Data Subjects’ data is modified or deleted on an external website, this does not affect data processing done by the Data Controller; such modifications also need to be carried out in the engH Application. |
| Legal basis of data processing: | Art. 6 (1) a) of Chapter II, GDPR; Art. 9 (2) a) of Chapter II, GDPR. |
By accepting the present Policy, User hereby declares to acknowledge this provision.
| Specification of processing purpose | 5. Subscription to newsletters, subscription to Direct Marketing Materials |
|---|---|
| Describing processes and tasks: | Through a surface specifically designated for this purpose, registered Users have the opportunity to subscribe exclusively to the newsletter of Data Controller (under Art. 6 Grtv.), on its website or in its Application (hereinafter: Newsletter Subscription). Data Controller may send all Users subscribed to newsletters online information and direct marketing messages containing novelties, news and offers. |
| Expected duration and deadline of data processing: | Until deletion by User, but at the latest until the Registration is deleted or User’s unsubscription. |
| Scope, types and categories of personal data: | Data to be provided as a precondition of newsletter and direct marketing subscription, if not provided at Registration or if the Data Subject intends to provide other data: e-mail address and social media profile(s) of the User subscribing to a newsletter. The possibility to unsubscribe shall be provided in each newsletter by a direct link. |
| Location of data processing: | Electronic processing, see: Data processors. |
| Legal basis of data processing: | Art. 6 (1) a) of Chapter II, GDPR. |
By accepting the present Policy, User hereby declares to acknowledge this provision.
| Specification of processing purpose | 6. Feedback, reporting offensive content |
|---|---|
| Describing processes and tasks: | In order to develop the system and Services of engH, Data Controller is open to any User feedback. For this purpose, there is a separate messaging tool in the Application enabling Users to share their opinions with the Data Controller via short text messages, and Users may also contact the Data Controller via e-mail at hello@engh.app. |
| Expected duration and deadline of data processing: | Until Registration is deleted. |
| Scope, types and categories of personal data: | Personal opinion tied to registration data, and all personal data disclosed by the User in this regard. |
| Location of data processing: | Electronic processing, see: Data processors. |
| Legal basis of data processing: | Art. 6 (1) a) of Chapter II, GDPR. |
By accepting the present Policy, User hereby declares to acknowledge this provision.
| Specification of processing purpose | 7. Performance and certification of the requirements of Article 8 GDPR – parental consent to the processing of a minor’s data |
|---|---|
| Describing processes and tasks: | To process the data of a minor person, the consent of their legal representatives exercising custody rights over them (hereinafter: parents) becomes necessary. To provide adequate information and to enable giving consent, the Data Controller – upon receiving the electronic mailing address of the parents from the minor intending to register – shall inform the parent(s) via a template of a Parental Permission containing electronic link(s) to the GTC (and to the present Privacy Policy) as well as to a surface suitable to accept their provisions. This shall serve as a precondition for the authorization of the minor’s registration. If the parents consent and declare to have read and accepted the present Policy and consent to the data of the minor person represented by them to be processed by the Data Controller in accordance with the present Privacy Policy, then the Registration of the minor becomes effective. In the absence of consent, User registration is invalid and the Data Controller erases and deletes all data already provided to it. |
| Expected duration and deadline of data processing: | Until the registration of the minor user is deleted. In the case of an invalid registration, on the 30th day following the dispatch of the Parental Permission template. |
| Scope, types and categories of personal data: | E-mail address, type of parental connection with a minor user. |
| Location of data processing: | Electronic processing, see: Data processors. |
| Legal basis of data processing: | Art. 6 (1) a) of Chapter II, GDPR. |
By accepting the present Policy, User hereby declares to acknowledge this provision.
| Specification of processing purpose | 8. Analytics, measurement and service improvement (consent-based) |
|---|---|
| Describing processes and tasks: | In order to measure the use of the Application and to improve the Services, the Data Controller uses Google Analytics 4 and Google Tag Manager. These tools are only activated if the Data Subject gives prior consent thereto via the consent management surface (cookie/consent banner) of the Application. In the absence of consent, no analytics identifiers are set and no analytics data is collected. |
| Expected duration and deadline of data processing: | Until consent is withdrawn, but at the latest until the expiry of the retention period set in the analytics tool (maximum 14 months). |
| Scope, types and categories of personal data: | Online identifiers (cookie/device identifiers), truncated IP address, approximate location, device and browser characteristics, usage and interaction data. |
| Location of data processing: | Electronic processing, see: Data processors. |
| Legal basis of data processing: | Art. 6 (1) a) of Chapter II, GDPR. |
By accepting the present Policy, User hereby declares to acknowledge this provision.
Summary of the legal bases of data processing
The Data Controller (or Controller) lawfully processes personal data based on the following points of Art. 6 (1) of Chapter II, GDPR:
- a) – „the data subject has given consent to the processing of his or her personal data for one or more specific purposes” – YES (processing purposes 1–8);
- b) – „processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract” – YES (processing purpose 1, and In-App Purchases);
- c) – „processing is necessary for compliance with a legal obligation to which the controller is subject” – YES (processing purpose 1, statutory retention obligations, e.g. accounting);
- d) – „processing is necessary in order to protect the vital interests of the data subject or of another natural person” – NO;
- e) – „processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller” – NO;
- f) – „processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child” – NO.
And, for special categories of personal data, based on the following points of Article 9 (2) of Chapter II, GDPR:
- a) – „the data subject has given explicit consent to the processing of those personal data for one or more specified purposes” – YES (processing purposes 2–4, to the extent a facial image or other content of the photo/video may reveal special categories of data);
- e) – „processing relates to personal data which are manifestly made public by the data subject” – YES (processing purpose 3).
The Data Controller does not rely on the other legal bases listed in Article 9 (2) GDPR (points b), c), d), f), g), h), i), j)).
Method of recording data
Data Controller receives or acquires all data of Data Subjects indicated in this Policy in every case through the engH Application, based on the voluntary consent of the registering or already registered Data Subjects. Registering or already registered Data Subjects shall always warrant for the authenticity of personal data provided. Data Controller does not authenticate the personal data provided to it.
By accepting the present Policy, Data Subjects shall accept all provisions of this Policy and give consent to the Data Controller to process their personal data.
By using the engH Application and the Services, or by entering into a contract for the provision of Services, Data Subjects expressly accept this Policy as well.
Principles of data processing
- Personal data shall only be acquired and processed fairly and lawfully.
- Personal data shall only be stored for a definite, intended and lawful purpose, and it shall not be used for a purpose different from this.
- The scope and extent of the personal data processed shall be in proportion to the purpose of their storage, and they shall correspond to the purpose, they shall not extend beyond it.
- All appropriate security measures shall be taken to protect personal data stored in automated datasets to prevent accidental or unlawful destruction, accidental loss, unlawful access, alteration or dissemination.
Register of data processing activities
Because Data Controller employs fewer than 250 people, it shall not keep a dedicated register regarding its data processing activities, except where record-keeping is required under Article 30 (5) GDPR. Taking paragraph (13) of the preamble of the GDPR into consideration, the Regulation includes a derogation for organizations with fewer than 250 employees with regard to record-keeping.
Data Protection Officer (DPO)
If, pursuant to Article 37, Chapter IV GDPR – processing of special categories of data, regular and systematic monitoring of data subjects on a large scale – the designation of a DPO is mandatory, the Data Controller shall appoint a DPO. The name and contact details of the DPO are indicated in the Data Controller identification table at the top of this Policy: Tamas Daniel Vezer.
Data Controller hereby informs Data Subjects that if – in connection with the Service and regarding data protection – they notice problematic procedures, incidents or other such circumstances, the legality or the technical and/or organizational aspects of which are objectionable or at least should justifiably be investigated, they may report these via the contact information above to the DPO, with simultaneously informing the responsible employee or executive of Data Controller.
Data transfer
Data Controller is entitled and shall be obliged to transfer all such data to the competent authorities, which are at its disposal and lawfully stored by it and for the transfer of which it is obliged by law or by a final decision of an authority. Data Controller cannot be held liable for transferring such data or for any consequences thereof.
In addition to the above, Data Controller transfers data to its Partners, in connection to whom it is bound by an obligation to render Services to the Users. Accordingly, Data Controller shall exclusively transfer data to its Partners in order to perform the Service and to the extent necessary for this performance, in accordance with the data processing purposes specified above. The Partner(s) concerned by a given event are indicated in the Application at the time of use; the current list of Partners is available at [link to be added].
Data Controller transfers data, in addition to the above, exclusively to its contracted data processors, including exclusively those, who are under contractual obligations regarding the engH Application, the Services and the support systems. Accordingly, Data Controller shall only transfer data to third parties exclusively for the purpose of achieving the intended data processing purposes specified herein. Such data transfer may not cause the Data Subject to end up in a more disadvantageous situation than prescribed by the data processing and data security provisions in the effective text of the present Policy.
Responsibility of the Data Controller
The User assumes full responsibility for any damage or additional costs caused to the Data Controllers or third parties by the User by making the content of the photo/video public, in any form whatsoever, to these parties. The User shall be liable for all damages. The fact that the Data Controllers have previously examined the photo/video and have not prevented its disclosure for whatever reason shall not in any way relieve the User of liability.
In accordance with the above, the User also assumes full responsibility for any infringements or criminal offences (e.g. use of prohibited authoritarian symbols or other illegal content, etc.) resulting from the publication of the content of the photo/video. In such a case, the Data Controller shall fully cooperate with the competent authorities and provide them with all the necessary data. The fact that the Data Controller has previously examined the photo/video and has not prevented its publication for whatever reason shall not in any way relieve the User of any liability.
The Data Controller shall not assume any liability in connection with the content of the photo/video and other materials transmitted by Users to the Data Controller and their disclosure, and the User, by using the Service, assumes full responsibility for the content and disclosure of such photo/video and other materials.
Data processors and recipients
| Recipient / Data processor | Role and activity | Scope of data and processing purposes concerned | Physical location(s) of data processing |
|---|---|---|---|
| Hosting provider: [to be completed before launch] | Hosting of the engH Application; servicing the automated cloud of the engH System; executing backup tasks for the engH System. | All data; data processing purposes 1–8. | [to be completed before launch] (within the EU/EEA, unless otherwise indicated) |
| Google Ireland Limited Gordon House, Barrow Street, Dublin 4, Ireland |
„Sign in with Google” login (OAuth2) service provider; Google Analytics 4 and Google Tag Manager consent-based analytics services. | Login: account data listed under processing purpose 1. Analytics: data listed under processing purpose 8, only in case of consent. | EU/EEA; data may be transferred to Google LLC (USA) under the safeguards described in the chapter on third-country transfers. For more information see the official website of the company. |
| Meta Platforms Ireland Limited Merrion Road, Dublin 4, D04 X2K5, Ireland |
„Log in with Facebook” login (OAuth2) service provider. | Account data listed under processing purpose 1. | EU/EEA; data may be transferred to Meta Platforms, Inc. (USA) under the safeguards described in the chapter on third-country transfers. For more information see the official website of the company. |
| E-mail / SMTP service provider: [to be completed before launch] | Sending of transactional e-mails (registration confirmation, system messages, parental permission templates) and newsletters. | E-mail address, name; data processing purposes 1, 5, 6, 7. | [to be completed before launch] |
| Payment service providers indicated in the Application at the time of purchase (e.g. PayPal or a licensed Hungarian payment service provider) | Processing of payments related to In-App Purchases. The payment service provider acts under its own terms and privacy policy, available on its website. | Billing information, contact e-mail address, payment data; In-App Purchases (see engH GTC, Chapter IV). | See the official website of the payment service provider indicated in the Application. |
| Partners (event organizers, sports clubs, federations, creators and other entities cooperating with the Data Controller) | Display of approved photos/videos on venue screens, broadcast overlays, live streams, websites and social media surfaces of the Partner; Partner Check (moderation). | Approved photos/videos and attached fan messages; data processing purposes 3–5. | The Partner(s) concerned by a given event are indicated in the Application; the current list of Partners is available at [link to be added]. For more information see the official websites of the respective Partners. |
Data Controller undertakes to be bound by the general obligation that no data transfers executed by Data Controller shall cause the Data Subject to end up in a more disadvantageous situation than the one prescribed by the data processing and data security provisions in the effective text of the present Policy.
Transfer of personal data
Transfer of personal data happens within the organization and partner network of the Data Controller. The data may also be transferred to external service providers if they process personal data on behalf of the Data Controller. All data transfers are based on agreements in accordance with legal requirements.
Transfer of personal data to a third country or an international organization
The Data Controller may also provide services in other countries, in which case personal data will be transferred strictly to the extent strictly necessary.
Outside the European Union (EU) or the European Economic Area (EEA) the transfer of personal data takes place only:
- to countries or organizations in relation to which an adequacy decision of the European Commission pursuant to Article 45 GDPR applies (including, where applicable, certified recipients under the EU–US Data Privacy Framework); or
- to organizations with which the Data Controller (or its data processor) has concluded an agreement containing the standard contractual clauses adopted by the European Commission pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 (hereinafter: SCCs), supplemented where necessary by additional safeguards.
The Data Controller ensures the secure international transfer of personal data using the standard contractual clauses adopted by the European Commission as described above.
The security of data processing
In compliance with the requirements set forth under Article 32 GDPR, keeping it in mind as its obligation, the Data Controller shall take all measures to ensure the safety and security of Data Subjects’ data and shall take all those technical and organizational measures and create such procedural rules, which are necessary to enforce the GDPR and other data- and classified data protection rules.
Data Controller primarily processes data through automated means – the engH Application, the Services and the systems supporting these – provided that with regard to data processing purpose 3, preliminary moderation of the selfie photos/videos indexed for sending is carried out in a two-step process: an automated pre-screening supported by artificial intelligence, followed by review by the personnel of Data Controller designated for this purpose. The final moderation decision is always made or confirmed by a human reviewer.
In all their activities, Data Controller and the data processors engaged by it comply with all requirements of:
- organizational safety and security;
- employee safety and security;
- security relevant to third parties and external environment;
- classifying and controlling assets and equipment ensuring data security (especially during risk assessment);
- communication and operations management;
- controlling access;
- managing continuous operation and workflow;
- systems development and maintenance.
Cloud applications are also part of the support System (see: currently effective General Terms and Conditions of Data Controller) behind the engH Application and the Services. Data Controller shall exercise utmost care in selecting its partners supplying cloud services – see: among indicated data processors – and shall take all reasonable measures as to be expected to contract them with an eye on safeguarding the data security interests of Data Subjects. This extends, moreover, to measures that ensure that the data processing principles of the partners be transparent and that data security be regularly checked. The data of Data Subjects is physically stored in the cloud. By accepting the present Privacy Policy, Data Subjects expressly consent to any data transfers necessary to use cloud services.
Partners may process personal data exclusively for the purpose of exercising a right and/or performing a statutory obligation – e.g. keeping records of accounts – and the present Policy shall apply to this data processing as well. Otherwise, Partners may only engage in data processing as processors in connection with the provision of the Service.
Data Controller shall protect the data, in particular, against unlawful access, alteration, transfer, publication or disclosure, deletion, erasure or destruction and accidental destruction or corruption.
Data recorded automatically for technical purposes in the course of the operation of Data Controller’s system(s) will be stored on the System from the time they were generated until such storage is justified to ensure the operation of the System. Data Controller ensures that such automatically recorded data may not be linked with other personal data – unless otherwise prescribed by law as mandatory exceptions. If Data Subjects withdrew their consent to the processing of their personal data or have initiated the erasure of their data from both the engH website and application, then after this their person will not be identifiable based on this technical data – except by investigative authorities and their experts.
Duration of data processing
For Registered Users, until Registration is deleted.
Data of Non-Registered Users are deleted from the system of Data Controller by closing the relevant Service.
Data given for the purpose of newsletter or direct marketing subscription are deleted without delay when Data Subjects unsubscribe or the Registration terminates.
Otherwise, Data Controller deletes the data upon the request of Data Subjects to that effect, except such data that needs to be further processed due to an accounting or other dispute between the Parties – until it is concluded – and/or due to a statutory requirement. As for the latter, this means without limitation:
- Data pursuant to Article 78 (3) of the Act on the order of taxation for 5 years;
- Data pursuant to Article 169 (1)–(2) of the Act on accounting for 8 years;
- or for a longer period, if prescribed by law.
Data Controller reserves the right to process relevant data to the extent necessary and in excess of the above deadlines until a deadline is open to enforce any claims justified by rights and obligations arising out of the activity giving rise to data processing.
Sources of data processing
Data processed is recorded directly from registered Users, with regard to which Data Controller only begins processing data provided to it – i.e. those will exclusively only be recorded in its systems at that time – if and when registered Users using the service declare, fully aware of their liability, that data has been provided, for the purposes of identification and using the Service, with the knowledge and express consent of the Data Subject indicated as the person entitled to use the given Service.
Possibility to amend the Privacy Policy
Data Controller reserves the right to unilaterally amend the present Policy for the future. The new Policy shall be made public via the engH Application.
Information, right to object, data erasure, restriction of data processing
Data Subjects may request information about the processing of their personal data, and may request their correction and – except for data processing made mandatory by law – their deletion based on the present Policy, particularly via the contact information provided above (hello@engh.app).
Upon the request of the Data Subjects submitted via e-mail, Data Controller provides information on the data processed by it, on the purpose of data processing, its legal basis and duration, on the name, address (registered seat) and the relevant activities of the data processor, and on who and for what purpose will be provided with Data Subjects’ data. Data Controller shall provide information within the shortest possible time following the submission of the request, but at most within fifteen (15) days in writing, in an intelligible, plain and simple-language format and free of charge.
If information cannot be denied from the Data Subject by law, Data Controller shall provide the Data Subjects information on the following: their data processed by Controller or those processed by a data processor contracted by it or based on its instructions; the source of that data; the purpose of data processing, its legal basis, duration; the name and address of the data processor and its activity relevant to data processing; on the circumstances and effects of and measures taken to prevent the personal data breach; and – in case the Data Subjects’ data has been transferred – on the legal basis and addressee of the data transfer. Otherwise, information covers all information under Articles 13–14, Section 2, Chapter III of GDPR.
False personal data not corresponding to reality shall be rectified by the Data Controller. Data Controller erases the personal data if: its processing is unlawful; the Data Subjects so request – in this case, at most, within five (5) days; it is incorrect or incomplete and this state cannot be lawfully rectified, provided that erasure is not prohibited by law; if the intended purpose of data processing ceased or was achieved; the statutory deadline for storing said data expired; or it has been so ordered by a court of law or by the National Authority for Data Protection and Freedom of Information (hereinafter: Authority). Data Controller shall notify Data Subjects and all others, to whom it has previously transferred data for the purpose of processing, about any rectification and erasure. Such notification can be omitted if in view of the purpose of data processing it would not violate the legitimate interests of Data Subjects.
If Data Subjects use personal data unlawfully or in a deceitful manner or they commit a crime, then Data Controller reserves the right to retain relevant data used in such a manner for purposes of evidence in any eventual (non-)litigious proceedings, until these shall be concluded. This latter shall also apply in the case if Data Subjects request the erasure of personal data from Data Controller to foil but at least hinder the enforcement of any legitimate claims of Data Controller.
Data Subjects may object against the processing of their personal data, in particular:
- if processing or transferring personal data is necessary for the sole purpose of performing the legal or statutory obligations of Data Controller or enforcing the legitimate interests of Data Controller, data processor or a third party, except for cases of mandatory processing;
- if the use or transfer of personal data takes place for the purpose of direct marketing, taking a survey or poll or for scientific research; and
- if prescribed by law.
Data Controller shall examine the objection within the shortest possible time, but at most within fifteen (15) days of its submission and shall decide whether it is well-founded and shall inform the objector about its decision in writing. Data processing shall be suspended for the duration of the examination of the objection, but at most for five (5) days. If the objection is well-founded, the head of the department processing the data shall act based on the provisions of the GDPR.
Moreover, Data Subjects may exercise their right to object via automated means based on technological specifications by selecting (i) the relevant option set forth in the engH GTC provided for the cancellation of Service or for the deletion of registration, and/or (ii) any relevant other option available in the System (Article 21 (5) GDPR).
Should the Data Controller find Data Subjects’ objection well-founded, it shall terminate data processing – including any further recording of data as well as data transfers –, block access to the data and inform anyone – regarding the objection and the measures taken based thereon – to whom Data Controller has earlier transferred the personal data subject to objection, and who are obliged to act in the interest of enforcing the right to object. Should Data Subjects disagree with Data Controller’s decision, and if Data Controller omits the deadline, Data Subjects then shall have the right to turn to a court within thirty (30) days from communicating the decision or the last day of the deadline.
Data Controller shall cover the damages caused to others by the unlawful processing of the personal data of Data Subjects or by violating requirements of technical data protection. Data Controller shall be exempted from liability if it proves that the damage occurred due to a reason beyond the scope of data processing that was unavoidable. No such damages shall be compensated, which were incurred as a result of the deliberate or negligent conduct attributable to the one incurring the damages.
Information of Data Subjects can be refused/rejected or restricted in accordance with the provisions of Articles 13 (4) and 14 (5) GDPR, based on the reasons set forth therein, with a detailed justification, if:
- the Data Subject already has the information;
- the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89 (1) or in so far as the obligation is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the Data Controller shall take appropriate measures to protect Data Subjects’ rights and freedoms and legitimate interests, including making the information publicly available;
- obtaining or disclosure is expressly laid down by Union or Member State law to which the controller is subject and which provides appropriate measures to protect the data subject’s legitimate interests;
- personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or Member State law, including a statutory obligation of secrecy.
Otherwise, Data Subjects shall be entitled to get access to personal data relevant to them and to the following information:
- a copy of the personal data (fees can be set for additional copies);
- purposes of data processing;
- categories of data processed;
- data regarding automated decision-making and profiling;
- if data was received/transferred from somewhere, information regarding their source;
- names of addressees who have been or will be provided with the data;
- information and warranties regarding data transfer to a third country;
- the conditions and duration of storage;
- the rights of Data Subjects;
- the right of turning to the Authority.
Complying with its obligation under Article 14 (3), Section 2, Chapter III GDPR, the Data Controller – if it did not acquire the personal data from the Data Subject, in particular if the data has been provided by a registered User regarding the Data Subject entitled to use the Service – shall, via the contact information known to Data Controller, preferably via e-mail, inform the Data Subject without delay, but at most within one month on any such information, knowledge of which is regulated by the present Policy.
The manner of exercising the right to access: If Data Subjects have filed their requests electronically, then information should be provided to them in a widely used electronic format, except if otherwise requested by Data Subjects.
The right to request copies might not affect the rights and freedoms of others detrimentally.
If the Data Controller made the data public, it shall be obliged to erase it by taking account of the costs of its feasibility and of the available technology and taking reasonable measures as can be expected to inform other data controllers regarding the erasure of links, copies, second copies.
Data Subjects may not exercise their right to erasure and to be forgotten if data processing is necessary: for the freedom of expression; for the performance of legal obligations, for the enforcement of legitimate claims or the exercise of official authority; in the field of popular healthcare in the public interest; for public-interest archiving or scientific or historic research.
Data Controller shall restrict data processing upon the request of Data Subjects, if:
- Data Subjects contest the accuracy of personal data;
- data processing is unlawful but the Data Subjects object to the erasure of data;
- Data Controller no longer needs the personal data, but the Data Subjects require them to file, enforce or defend against legitimate claims;
- Data Subjects have objected to data processing and Data Controller is in the process of examining such objections.
Obligation to notify
Data Controller shall notify all such addressees regarding rectification, erasure or restriction, who have been provided with the data – except if this proves impossible or would require disproportionately huge efforts.
Data portability
Regarding their data provided to the Data Controller, Data Subjects shall be entitled:
- to receive this data in an articulate, widely used and machine-readable format;
- to transfer this data to other data controllers;
- to request the direct transfer of said data to another data controller – if it is technologically feasible;
except for data processing carried out in the public interest or for the purpose of exercising official authority.
Possibilities of enforcing rights
In case their rights are violated, Data Subjects may exercise or enforce their rights against Data Controller in front of a court – the lawsuit may, at the choice of the Data Subject, also be initiated before the tribunal (törvényszék) competent for the Data Subject’s place of residence or stay – and, based on the provisions of the GDPR, the Infotv. and relevant other laws, can turn to the National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH):
- Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary
- E-mail: ugyfelszolgalat@naih.hu
- Website: www.naih.hu
Date: Örbottyán, Hungary, [date to be set at launch]
venture co scribers kft.
Represented by: Tamas Daniel Vezer, managing director
Data Controller