UEFA EURO 2020 Rendezői Város Önkéntes Program BUDAPEST

UEFA EURO 2020 Rendezői Város Önkéntes Program BUDAPEST

Privacy Policy

Privacy Policy, Letter of Consent regarding the UEFA EURO 2020 Volunteers Program.

In this Policy provides detailed notification to data subjects on the processing of personal data by the Budapest Metropolitan Municipality in the course of the recruitment for, establishment and maintenance of relationship aimed to perform public interest activity regarding the voluntary activity related to the UEFA EURO 2020 event.

Submittal of the privacy statement on the last page of the Privacy Policy is required to participate to the volunteers program and to arrange the contract on public interest voluntary activity. Failure to provide the personal data leads to the failure of the conclusion of the contract.

1. Controller

Budapest Metropolitan Municipality (hereinafter: Controller)

Head Office: 1052 Budapest, Városház utca 9-11.

Represented by: Gergely Szilveszter Karácsony, Lord Mayor

Mailing address: 1052 Budapest, Városház utca 9-11

E-mail address: hentz.zsuzsanna@budapest.hu

Data Protection Officer, contact details: Dr. Katalin Molnár, +36 1 327-1454, molnarkatalin@budapest.hu

2. Purpose of Processing

The purpose of processing of personal data is to enable Controller to enforce and perform the rights & obligations arising from the relationship between the persons performing voluntary work in the so-called Fans’ Zone operated by Controller, and at the information desks placed in Budapest Capital, and Controller, in the course of the matches organized in the area of Budapest Capital within the European Football Championship between 2020 and 2021.

3. Categories of personal data subject to processing, legal basis of processing, duration of each processing.

Controller requests the personal data from Data Subjects.

In case of volunteer under 16, the consent is deemed provided when such consent is permitted by the person exercising the parental control rights over the child. Such person shall note his/her permit in the written consent statement. In case of a person with limited capabilities or adult having limited capability, the processing is lawful if the contract on the relationship was arranged with the consent of the respective adult legal representative.

3.1. During recruitment, prior to the conclusion of a contract on public interest voluntary activity, the legal basis of processing of personal data stated herein is the Data Subject’s consent [GDPR Art. 6. (1) a)]:

a) the natural person’s ID data (name, mother’s name, place & date of birth, address)
b) contact details, eg. e-mail address, phone No.,
c) workdays, fields undertaken,
d) data on the performance of previous voluntary activity,
e) language skills.

The purpose of the processing of personal data, in case of Sub-section a), is maintaining contact with Data Subject, in regards b)-e), conducting the recruitment selection.

If the recruitment proves to be ineffective, Controller shall stop the processing of personal data within two months from closing the process.

3.2. Upon the arrangement of the contract on public interest voluntary activity, Controller processes the following personal data regarding Data Subject, in accordance with the following legal grounds:

a)  natural personal ID data (name, mother’s name, place & date of birth, Volunteer’s address, or, if there is not any, temporary or accommodation address), and nationality, phone and electronic contact details provided,

Fulfilment of legal obligation [GDPR Art. 6 (1) c)]

Performance of contract [Art. 6 (1) b)]

b) Data on school attainment and language skills,

Fulfilment of legal obligation [GDPR Art. 6 (1) c)]

Performance of contract [Art. 6 (1) b)]

c) in case of minor volunteer and volunteer with partially limited capability, in case of volunteer with partially limited capabilities, the personal ID data and address of legal representative, or, if there is not any, temporary or accommodation address,

Fulfilment of legal obligation [GDPR Art. 6 (1) c)]

Performance of contract [Art. 6 (1) b)]

d) the content of public interest voluntary activity,

Fulfilment of legal obligation [GDPR Art. 6 (1) c)]

Performance of contract [Art. 6 (1) b)]

e) place of performance of public interest voluntary activity,

Fulfilment of legal obligation [GDPR Art. 6 (1) c)]

Performance of contract [Art. 6 (1) b)]

f) the time and free-time to be spent on public interest voluntary activity, and

Fulfilment of legal obligation [GDPR Art. 6 (1) c)]

Performance of contract [Art. 6 (1) b)]

g) allowances provided for public interest voluntary activity,

Fulfilment of legal obligation [GDPR Art. 6 (1) c)]

h) tax ID No. and SSN No.,

Fulfilment of legal obligation [GDPR Art. 6 (1) c)]

i) bank account No.,

Performance of contract [Art. 6 (1) b)]

j) data of beginning the public interest voluntary activity, and

Fulfilment of legal obligation [GDPR Art. 6 (1) c)]

Performance of contract [Art. 6 (1) b)]

k) the date when the term of the relationship ceases.

Fulfilment of legal obligation [GDPR Art. 6 (1) c)]

Performance of contract [Art. 6 (1) b)]

If the contract on public interest voluntary activity is arranged, Controller shall retain the personal data for limited term. The limited term expires by the end of the 5th year following that calendar year, when Volunteer performed voluntary work for Controller.

3.3. Photo and video footages taken at the UEFA EURO 2020 events

Controller may take photo and video footages at the UEFA EURO 2020 events. The purpose of taking the footages is to promote the events. For this reason, Controller may publish the footages. The legal basis of processing is Data Subject’s consent [GDPR Art. 6 (1) a)]

4. Name of Data Processors participating in the processing of personal data

a) On Controller’s assignment, as Data Processor, Budapesti Sportszolgáltató Központ Közhasznú Nonprofit Kft. (1146 Budapest, Olof Palme sétány 5., Phone No.: +36 1 363 2673 E-mail: iroda@mujegpalya.hu), and as the Data Processor of the above Data Processor, Bowman and Becker Kft. (2462 Martonvásár, Dózsa György út 2., company reg. No.: 07-09-027428, Phone No..: +36-20-801-2083 E-mail address: info@euro2020hostcitybp.hu) performs the selection of persons into the volunteers program.

b) On Controller’s assignment, as Data Processor, the accounting and payroll duties are fulfilled by the Budapest Sportszolgáltató Központ (1146 Budapest, Olof Palme sétány 5., Tel.: +36 1 363 2673, E-mail: iroda@mujegpalya.hu, VAT: 25352050-2-41).

5. Transfer of data to third parties

In the event Controller transfers the personal data to third persons, the legal grounds to such transfer are as follows:

a) Union of European Football Associations, (hereinafter: UEFA)). Data Protection representative within the European Union: Union des Associations Européennes de Football (UEFA), Data Protection, c/o Teneo Cabinet DN, Rue d’Arlon 25, BE-1050 Brussels, Email:privacy@uefa.ch. Grounds for transfer of personal data: Data Subject’s consent provided in the form stated in Section 2 [GDPR Art. 6. (1) a)]. Purpose of transfer: performance of tasks related to the organization of the event. Scope of personal data transferred: Data Subject’s personal ID data.

Switzerland is deemed a third country pursuant to the provisions of the GDPR, such countries are practically the countries beside the member states of the European Economic Area. Switzerland, according to its data protection laws, has the European Union’s compliance statement, therefore personal data may be transferred on this basis. If You would like to get further information about this, You may ask for information from Controller’s Data Protection Officer.

b) Hungarian Football League. Address: 1112 Budapest, Kánai út 2.D., E-mail:mlsz@mlsz.hu Mailing address: 1386 Budapest 62. Pf. 906/1. Electronic contact details related to data protection matters: adatvedelem@mlsz.hu. Legal basis of transfer of personal data: Data Subject’s consent provided in the form specified in Section 2 [GDPR Art. 6 (1) a)]. Purpose of transfer: performance of tasks related to the organization of the event. Scope of personal data transferred: Data Subject’s personal ID data.

c) Kiemelt Kormányzati Beruházások Központja Nonprofit Kft. Legal basis of transfer of personal data: Data Subject’s consent provided in the form specified in Section 2 [GDPR Art. 6 (1) a)]. Purpose of transfer: performance of tasks related to the organization of the event. Scope of personal data transferred: Data Subject’s personal ID data.

d) to sponsors designated by UEFA. Legal basis of transfer of personal data: Data Subject’s consent provided in the form specified in Section 2 [GDPR Art. 6 (1) a)]. Controller shall notify Data Subject on the name of the sponsors latest prior to transfer of personal data. Purpose of transfer: ensuring the allowances provided by such bodies. Scope of personal data transferred: Data Subject’s personal ID data.

f) In events provided by the laws, to the public authorities provided therein. In case of labour safety authority, tax authority, the supervisory bodies performing the professional or legal supervision and control of the host organization. Legal basis and purpose of transfer of personal data: transfer of personal data is required to fulfil the legal obligation related to Controller [GDPR Art. 6 (1) c)]. Scope of personal data transferred: in the actual investigation, based on legal authorization, taking targeted processing into consideration, the personal data requested in Section 6 of this Policy.

6. Notification on rights

If the grounds to processing, Data Subject’s consent, processing of personal data is no longer necessary in the later data of the relationship to enforce the obligation related to Controller, Data Subject may request the erasure of his/her personal data.

Data Subject has the following rights in regards processing of personal data:

a) may request information from Controller on the scope of his/her personal data processed (GDPR Art. 14),
b) may request access to personal data (GDPR Art. 15),
c) may request the rectification (GDPR Art. 16),
d) or the erasure of his/her personal data (GDPR Art. 17),
e) restriction of processing of his/her personal data (GDPR Art. 18),
f) shall have the right to portability (GDPR Art. 20), and
g) may object against the processing of his/her personal data (GDPR Art. 21).

If You would like to get more information on the above rights, please read through the referred articles of the GDPR, and if You have any question, please contact Controller’s Data Protection Officer.

7. Enforcement options regarding processing of personal data

If You would like to submit a claim regarding the processing of personal data, You may do so at Controller’s Data Protection Officer stated in Section 1.

Upon your decision, You may also turn to the National Authority for Data Protection and Freedom of Information. Postal address: 1530 Budapest, Pf.: 5. Address: 1125 Budapest, Szilágyi Erzsébet fasor 22/c Phone No.: +36 (1) 391-1400 Fax: +36 (1) 391-1410 E-mail: ugyfelszolgalat@naih.hu