This is a translation of the Hungarian-language privacy notice (Adatkezelési tájékoztató). In the event of any discrepancy, the Hungarian version prevails.

Privacy and Data Processing Notice

1. Purpose of this Notice

1.1. This privacy and data processing notice (hereinafter: Notice) sets out the most important data protection rules and principles applying to the records kept by Digitális Turizmus Zrt. (hereinafter: Service Provider), with particular regard to the requirements relating to data processing, data transfer, data protection and disclosure. The purpose of the Notice is to define, in accordance with the applicable Hungarian and EU legislation and the interests of the data subjects, the data protection and data processing principles and rules applied by the Service Provider and the conditions and manner of data processing.

1.2. The Service Provider operates the website https://turizmusallas.hu/ (hereinafter: Website), in connection with which it processes the data of users looking for work on the Website (hereinafter collectively: Users) and of businesses offering work (hereinafter collectively: Advertisers).

1.3. This Notice has been drawn up in accordance with Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (hereinafter: Infotv.), Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services (Ekertv.), Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities, and Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: GDPR).

1.4. The Service Provider reserves the right to inform the User by email about changes to its services or its general terms and conditions. The Service Provider does not use such information for advertising purposes.

2. Service Provider details

Company name: Digitális Turizmus Zrt.
Registered office: 1068 Budapest, Városligeti fasor 24, ground floor 1, Hungary
Company registration number: 01-10-049670
Tax number: 26224491-2-42
Email: info@digitalisturizmus.hu
CEO: Dávid Rasztovits

Cloud service providers:
Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109-5210, USA
Cloudinary, 3400 Central Expressway, Suite 110, Santa Clara, CA 95051, USA

Newsletter delivery: MailChimp, USA

3. Data processing carried out by the Service Provider

3.1. Registration

After registration, the User is entitled to use the services provided on the Website. During registration, the following personal data of the User is recorded:

• surname and first name
• email address
• telephone number
• position / “what type of job are you looking for?”

Before registering, the User gives consent to data processing by ticking a checkbox, as a precondition of which the User declares acceptance of the data processing and of the General Terms and Conditions, which include the controller’s privacy notice. Data processing by the Service Provider is based on the User’s consent.

The registration process is governed by Section III of the General Terms and Conditions.
Purpose of processing: identification of the contracting party on the website
Legal basis: necessary for the performance of a contract (Article 6(1)(b) GDPR)
Duration of processing: the User may delete their data from the Service Provider’s records free of charge at any time, or request the Service Provider to delete it; the Service Provider is obliged to fulfil such a request free of charge within 30 days.
Method of storage: the Service Provider stores the User’s registered data with its cloud service provider (DigitalOcean, LLC).

3.2. Applying for a job

After registration, the User is entitled to use the service; the process is governed by Section IV of the General Terms and Conditions.
Purpose of processing: contacting the employer offering the job
Data processed: data optionally provided by the User (name, email address and other data)
Legal basis: use of the service provided by the Service Provider (Article 6(1)(b) GDPR)
Duration of processing: the User may delete their data from the Service Provider’s records free of charge at any time, or request the Service Provider to delete it; the Service Provider is obliged to fulfil such a request free of charge within 30 days.
Method of storage: the Service Provider stores the User’s registered data with its cloud service provider (DigitalOcean, LLC).

3.3. Newsletter subscription

Purpose of processing: providing information in the form of a newsletter, presenting the services sold by the Service Provider
Data processed: email address
Legal basis: the User’s voluntary subscription (Article 6(1)(a) GDPR)
Duration of processing: the User may delete their data from the Service Provider’s newsletter list free of charge at any time, or request the Service Provider to delete it; the Service Provider is obliged to fulfil such a request free of charge within 30 days.
Method of storage: the Service Provider stores the User’s registered data with the hosting provider operated by the newsletter service provider.

3.4. Creating a self-branding profile

After registration, the User is entitled to use the service; the process is governed by Section IV of the General Terms and Conditions.

Data recorded:

• type of job sought
• level of job of interest
• type of employment
• preferred place of work
• working hours
• salary expectation
• education
• language skills
• professional experience
• known technologies and tools
• introduction (text)
• photo
• competencies / characteristics
• what matters in a workplace
• “This is me”
• favourite pastimes
• superpower
• two-word answers (optional questions and answers)
• other optional content (texts, images, quotes, press articles, IT-Quiz badge)

Purpose of processing: creating the job seeker’s profile page
Legal basis: use of the service provided by the Service Provider (Article 6(1)(b) GDPR)
Duration of processing: the User may delete their data from the Service Provider’s records free of charge at any time, or request the Service Provider to delete it; the Service Provider is obliged to fulfil such a request free of charge within 30 days.
Method of storage: the Service Provider stores the User’s registered data with its cloud service providers (DigitalOcean and Cloudinary).

3.5. IT-Quiz

After registration, the User is entitled to complete the IT-Quiz; the process is governed by Section IV of the General Terms and Conditions.

Data processed: the User’s name and photo, IT-Quiz result and badge
Purpose of processing: presenting and recording the User’s IT-Quiz result, based on points, on the Website in weekly and overall rankings, showing the User’s name and photo
Legal basis: use of the service provided by the Service Provider (Article 6(1)(b) GDPR)
Duration of processing: the User may delete their data from the Service Provider’s records free of charge at any time, or request the Service Provider to delete it; the Service Provider is obliged to fulfil such a request free of charge within 30 days.
Method of storage: the Service Provider stores the User’s registered data with its cloud service provider (DigitalOcean, LLC).

3.6. Error correction

If the User finds an error in the questions or answers while completing the IT-Quiz, they may report it to the Service Provider in a private message.

Data processed: data optionally provided by the User, but necessarily the User’s name and email address and the reasons for the request
Purpose of processing: correcting the error indicated by the User
Legal basis: use of the service provided by the Service Provider (Article 6(1)(b) GDPR)
Duration of processing: the Service Provider stores the User’s name, email address and the reasons given until the error has been examined or corrected. The User may delete their data from the Service Provider’s records free of charge at any time, or request the Service Provider to delete it; the Service Provider is obliged to fulfil such a request free of charge within 30 days.
Method of storage: the Service Provider stores the User’s registered data with its cloud service provider (DigitalOcean, LLC).

4. Verification of data

The Service Provider does not verify the personal data registered by the User. The User is solely responsible for the accuracy of the registered data. The User is responsible for the accessibility and use of the data sent by the Service Provider to the email address registered by the User.

5. Handling of registered data

The data registered by the User may be accessed by the Service Provider, its employees designated for data processing and the person(s) carrying out data processing. Access rights to the Service Provider’s data processing are determined by the Service Provider’s executive officer. At a data processor engaged by the Service Provider, access rights to the data processing are determined by the executive officer of that processor. The Service Provider is entitled and obliged to transfer data to third parties in order to fulfil its legal obligations.

6. Rights of the User

6.1. The User may remove themselves from the system by deleting their profile; their orders, however, remain in the system without personal data.

6.2. The User is entitled to request, free of charge, information about the personal data processed, the purpose, legal basis and duration of processing, the name and address (registered office) of those entitled to process the data and their activities related to the processing, as well as who receives the data and for what purpose, and about the data subject’s rights and remedies relating to the processing. In the cases specified by law, the User is entitled to request, free of charge, the rectification, erasure or blocking of their data or the restriction of its processing, and may object to the processing of their personal data.

6.3. The Service Provider is obliged to examine the User’s request as soon as possible, but no later than within 30 days of its submission – or within 15 days in the case of an objection – and to decide whether it is well founded, informing the applicant in writing. If the Service Provider does not fulfil the User’s request, it shall state the factual and legal reasons for the rejection in its decision.

6.4. The User may enforce their rights before a court under Act V of 2013 on the Civil Code, and may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, 1125 Budapest, Szilágyi Erzsébet fasor 22/c; https://www.naih.hu/panaszuegyintezes-rendje.html) in accordance with the Infotv.

7. Other information

7.1. The Service Provider collects data on visitors’ activity in a way that does not make visitors identifiable and cannot be linked to the personal data provided by the User during registration or when using other websites or services.

7.2. The Service Provider is obliged to inform the User in advance and to request their prior, express consent if it intends to use the User’s personal data for a purpose other than the one specified.

7.3. The Service Provider is obliged to ensure the security of data processing and to take all necessary technical measures to protect the recorded, stored and processed data and to prevent its unauthorised use, alteration or destruction.

7.4. The Service Provider keeps the records of its data processing activities required by law (record of processing activities).

7.5. A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data processed. In the event of a personal data breach, the Service Provider shall act in accordance with Articles 33 and 34 GDPR. The Service Provider keeps a record of personal data breaches, including the facts relating to the breach, its effects and the remedial action taken.

7.6. The Service Provider is entitled to amend this Notice unilaterally at any time. The Service Provider publishes any amendment of the Notice on its website. The User is entitled to continue using the website’s services after accepting the amended Notice.

7.7. I acknowledge that the following personal data stored by the controller Digitális Turizmus Zrt. (1068 Budapest, Városligeti fasor 24, ground floor 1) in the user database of the website turizmusallas.hu will be transferred to OTP Mobil Kft. (1093 Budapest, Közraktár u. 30–32) as data processor. The data transferred by the controller: bank card number, bank card expiry date, bank card CVC code.

Effective from 16 April 2021 until revoked.