(regarding the processing of personal data related to the registration of business organisations in the register of the Hungarian Chamber of Commerce and Industry, and the modification of data on the basis of a notification of change) The purpose of this information notice is to provide the data subject(s) with information on the processing of personal data in connection with the operation of the chamber register (hereinafter: CHAMREG) of economic organisations.
1. Names and contact details of the joint data controllers and their representatives:
A)
Name: Hungarian Chamber of Commerce and Industry (hereinafter: HCCI)
Registered office: 1054 Budapest, Szabadság tér 7.
Registration number: 01-03-0000006
Name of the registering court: Budapest-Capital Regional Court
Represented by: Dr. László Parragh - President; Péter Dunai - Secretary General
Taxpayer identification number: 18068265-2-41
Telephone: +36 (1) 474-5100
E-mail: mkik@mkik.hu
B)
The regional chamber of commerce and industry in accordance with the place of
business:
Name: Budapest Chamber of Commerce and Industry (hereinafter: BCCI)
Registered office: 1016 Budapest, Krisztina körút 99.
Registration number: 01-03-0000005
Name of the registering court: Budapest-Capital Regional Court
Represented by: Elek Nagy - President
Taxpayer identification number: 18067666-2-41
Telephone: +36 (1) 488-2000
E-mail: bkik@bkik.hu
2. Contact details of the Data Protection Officer:
HCCI:
- Telephone: +36-1-474-5194
- E-mail: dpo@mkik.hu
BCCI:
Name: dr. András Szilágyi
Telephone: +36 (1) 488 2041
E-mail: dpo@bkik.hu
3. The personal data processed:
a. the name, e-mail address and telephone number of the self-employed person or the legal representative [if the legal representative is a legal person, the natural person authorised to represent the legal representative];
b. the name, telephone number, mobile phone number and e-mail address of the person authorised to contact the chamber on the basis of voluntary data submission, if the business organisation so requests.
4. The purpose of processing personal data:
The aim of processing personal data is to operate the CHAMREG of business organisations in order to ensure the security of commerce, to promote economic development, and in this context, to establish and maintain contacts with business organisations.
5. The legal basis for processing personal data:
- In the case of personal data discussed under point 3. a. of this information notice:
The processing of personal data shall be lawful if the data processing is necessary for compliance with a legal obligation to which the data controller is subject [Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation); [hereinafter: GDPR], Article 6(1)(c)]
- In the case of personal data discussed under point 3. b. of this information notice:
The processing of personal data shall be lawful if the data subject has given consent to the processing of his or her personal data for one or more specific purposes [Article 6(1)(a) GDPR]. The data subject has the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of the data processing based on consent prior to its withdrawal.
6. Duration of processing personal data:
- In the case of personal data discussed under point 3. a. of this information notice:
The personal data are processed until their deletion from CHAMREG with regard to the termination of the business organisation. In addition, in the case of a business organisation other than a self-employed person, the personal data are processed until the data are modified in CHAMREG with regard to the change in the entity of the legal representative (if the legal representative is a legal person, the natural person authorised to represent the legal representative).
- In the case of personal data discussed under point 3. b. of this information notice:
If the chamber contact person is not the same person as the self-employed person or the legal representative (if the legal representative is a legal person, the natural person authorised to represent the legal representative), the personal data are processed until the data are modified in CHAMREG in respect of a change in the person of the chamber contact person, otherwise until consent to data processing is withdrawn, or until the deletion of the data from CHAMREG with regard to the termination of the business organisation.
7. Recipients of the processing of personal data:
The heads of the regional chambers of commerce and industry and of HCCI, their employees involved in the operation of CHAMREG in the course of their duties as well as data processors whose work is necessary regarding the operation of CHAMREG, are entitled to process the data to the extent necessary for the performance of their duties. It is only possible to use data processors who or which provide adequate guarantees for the implementation of appropriate technical and organisational measures to ensure compliance of the data processing with the requirements of the GDPR and the protection of the rights of data subjects. Apart from the aforementioned case, the regional chamber of commerce and industry and the HCCI shall not disclose the personal data processed to third parties, except in the case of a request by a public authority or a court in the cases provided for by law.
8. Rights of the data subject:
- In the case of personal data discussed under point 3. a. of this information notice:
The data subject may request the data controller(s) to access (Article 15 GDPR), rectify (Article 16 GDPR) or restrict the processing of (Article 18 GDPR) personal data relating to him or her, as provided for in the GDPR. The data subject should take into account the following when exercising the right to deletion of personal data (Article 17 GDPR):
If the data processing is necessary for compliance with an obligation under European Union or Member State law to which the data controller is subject to fulfil an obligation to process personal data or for the performance of a task carried out in the public
interest or in the exercise of official authority vested in the data controller, the data subject shall not be entitled to obtain from the data controller, at his or her request, the deletion of personal data relating to him or her without undue delay and the data
controller shall not be obliged to delete personal data relating to the data subject without undue delay.
- In the case of personal data discussed under point 3. b. of this information notice:
The data subject may request the data controller(s) to access (Article 15 GDPR), rectify (Article 16 GDPR), delete (Article 17 GDPR), restrict the processing of (Article 18 GDPR), and have the right to data portability regarding (Article 20 GDPR) personal
data relating to him or her, as provided for in the GDPR.
9. The right to lodge a complaint:
The data subject may lodge a complaint with the supervisory authority in the event of a breach of his or her rights regarding the processing of his or her personal data. Name and contact details of the supervisory authority:
- Name: National Authority for Data Protection and Freedom of Information
- Registered office: 1055 Budapest, Falk Miksa utca 9-11.
- Telephone: +36-1-391-1400
- E-mail: ugyfelszolgalat@naih.hu
Without prejudice to the right to lodge a complaint, the data subject may bring an action before the court if his or her rights are infringed. Adjudication of the action falls within the jurisdiction of the court. At the choice of the data subject, the action can
also be brought before the court of the domicile or residence of the data subject. However the joint data controllers ask the data subject to contact them before having recourse to legal remedies in order to negotiate and resolve the problem as quickly
as possible.
10. Possible consequences of failure to provide data:
If the data is not provided, communication among the regional chamber of commerce and industry, the HCCI and the business organisation may become difficult or impossible.
11. Transfer of data to third countries or international organisations:
Transfer of data to a third country or international organisation will not occur.
12. Information on joint data processing:
a) Joint and several liability
HCCI and the regional chamber of commerce and industry, as joint data controllers, are jointly and severally liable for the full damages in accordance with the GDPR and the joint data controller agreement established on the basis of the GDPR, in order to
ensure the effective compensation of the data subject(s).
b) Internal responsibilities
The joint liability of HCCI and the regional chamber of commerce and industry as joint data controllers towards the data subject(s) is divided between them in proportion to their liability as joint data controllers, as set out in the joint data controller agreement.
If imputability cannot be established between the joint data controllers, the liability between them shall be apportioned in proportion to their respective contribution, and if the proportion of contribution cannot be established, it shall be apportioned equally.
c) Exercise of the data subject’s rights in case of joint data processing
In accordance with Article 26(3) of the GDPR, the data subject may exercise his or her rights under the GDPR in respect of and against each of the data controllers irrespective of the terms of the joint data controller agreement.