Privacy Policy
Manitox Kft. Data Protection Policy
Legal framework, statutory requirements:
REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (27 April 2016)
The protection of natural persons in relation to the processing of their personal data is a fundamental right.
The Charter of Fundamental Rights of the European Union (the Charter) and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU) stipulate that everyone has the right to the protection of personal data concerning them.
The GDPR (General Data Protection Regulation) – the European Union’s data protection regulation – comes into force on 25 May 2018!
Manitox Ltd.
Application of the General Data Protection Regulation
Purpose of the Data Protection Notice
Manitox Kft. (registered office: 3580, Kesznyéten, Móricz Zsigmond utca 2/A, plot nos. 076/27, 076/6) – hereinafter referred to as the data controller – acknowledges the content of this notice as binding. It undertakes to ensure that all data processing relating to its activities complies with the requirements set out in this policy, in the applicable legislation and in the legal acts of the European Union.
The purpose of data processing must be clearly and unambiguously defined.
Manitox Kft. processes personal data only in accordance with the law, stores data as securely as possible, and only discloses personal data to third parties with the data subject’s consent.
The purpose of data processing:
The establishment, amendment or termination of an employment relationship, for which the data processed include the details of the employment contract concluded between the parties. Name, birth name, mother’s maiden name, permanent address, telephone number, National Insurance number, and other data required by law, as well as copies of certificates relating to the post.
Payroll calculation and payment, payment of social security contributions, regulatory filings, and record-keeping (payment of employees’ wages, annual leave, sick leave, payment for unpaid leave as specified by law, as well as wage deductions, cafeteria benefits, employee expense claims and the administration of business trips, constitute the legal basis for data processing.)
A significant proportion of data processing in the workplace is based on statutory provisions.
The provisions of the relevant legislation impose data processing obligations on employers and employees that are effectively binding.
Manitox Kft. is committed to protecting the personal data of its employees and partners; it treats personal data as confidential and takes all necessary
security and organisational measures to ensure the security of the data.
Details of the data controller:
Name: Manitox Ltd.
Registered office: 3580, Kesznyéten, Móricz Zsigmond utca 2/A, plot numbers 076/27 and 076/6 –
Company registration number: 05-09-004507
Tax number: 11385019-2-05
Telephone number: +36 49 540 738, +36 30 685 41 80
Email address: manitox@manitox.hu, adatvedelem@manitox.hu
Data Protection Officer:
Name: Zsolt Vasvenszki
Telephone number: +36 30 685 41 80
Email address: adatvedelem@manitox.hu
The scope of personal data processed:
The employer is obliged to specify in advance the scope of the data requested from employees in such a way that the data relates solely to the establishment, continuation and termination of the employment relationship. Employees must be informed as to how the data requested from them and the checks carried out on them may be used by the employer. Any request for data that does not provide essential information for the purposes of establishing, maintaining or terminating the employment relationship constitutes an unjustified restriction on employees’ right to privacy and their right to control their personal data.
Furthermore, data processing must be consistent with the specific purpose of the data processing at every stage, e.g. employment contract, suitability, etc…
Number of employees on the date of registration of the document: 71
Employees must give their consent to the processing of their personal data; this consent must be free from any form of external influence.
Consent may only be considered if the data subject has a genuine choice and there is no risk of deception, intimidation, coercion or other significant adverse consequences should they refuse to give consent. In the absence of voluntary consent, the data controller – that is, the employer – does not have a valid legal basis for processing the data.
This type of consent also applies to situations not relating to an employment relationship, such as team-building training or other programmes organised by the employer.
In the case of Manitox Kft., the employer sets out in its internal regulations the data processing activities carried out on this legal basis. The employer must set out in writing the circumstances of data processing carried out under this legal basis, as this enables employees to satisfy themselves that the workplace data processing in question does indeed impose a proportionate restriction on their rights. Furthermore, this enables the supervisory authority or the court to verify and examine whether the employer’s data processing complied with data protection requirements. When applying this legal basis, the employer must take into account the provisions of Hungarian and EU legislation!
Fundamental principles of the internal regulations:
Manitox Kft. selects and operates IT systems for the processing of personal data in such a way that the data processed:
it must be accessible to authorised persons (availability)
authenticity is guaranteed (authenticity of data processing)
its integrity can be verified (data integrity)
be protected against unauthorised access (data confidentiality and security).
Manitox Kft. protects data by taking appropriate measures against unauthorised access, alteration, disclosure, transmission, deletion or destruction, as well as against accidental loss.
Manitox Kft. ensures the security of data by implementing technical, organisational and administrative measures that provide a level of protection appropriate to the risks associated with data processing.
Manitox Kft. retains the following during data processing:
confidentiality: it safeguards information so that only those authorised to do so can access it,
integrity: safeguards the accuracy and completeness of the information and the processing method,
availability: ensures that, when an authorised user needs it, they can actually access the required information and that the relevant tools are available.
Cookies:
The purpose of cookies is:
they collect information about visitors and their devices
they note down visitors’ individual preferences
make it easier to use the current website
They ensure a high-quality user experience.
The purpose of session cookies is to enable visitors to browse the Manitox Kft. website fully and seamlessly, and to use its features and the services available there. These types of cookies remain valid until the end of the session and are automatically deleted from your computer or other device used for browsing when you close your browser.
Data processed, the data processing procedure, persons authorised to process data, the duration of data processing, restrictions and measures:
Processing of data relating to the employees concerned:
Before commencing the planned data processing, the employer must assess whether the processing of personal data is strictly necessary to achieve the intended purpose: are there any alternative solutions available which would enable the intended purpose to be achieved without processing personal data?.
the most precise possible definition of the employer’s legitimate interest (in particular, taking into account Section 10(1) of the Labour Code).
determining the purpose of the data processing, the type of personal data involved, and the duration of the data processing required by the legitimate interest.
to determine what interests employees may have in relation to the data processing in question (for example, the grounds on which employees might object to the data processing).
When monitoring employees’ conduct in connection with their employment, the employer should, where possible, choose a method that does not involve the processing of personal data. If no such method is available, the employer must apply the method that least infringes on privacy, whereby personal data is only obtained to a limited extent.
Ensuring the employee’s presence. This guarantee also plays a role in the context of employer inspections. Provided that the circumstances of the monitoring do not preclude this possibility, it must be ensured that the employee is present during the monitoring (for example, when reviewing recordings or reading emails).
Processing of employees’ data:
The legal basis for data processing:
The employer stores and processes the employee’s personal data on the basis of voluntary, explicit and unambiguous consent, following prior notification.
The data processed includes details of the employment contract entered into by the parties: name, birth name, mother’s maiden name, permanent address, telephone number, social security number and other data required by law, as well as copies of certificates relating to the role, a professional CV and, where applicable, a covering letter.
For the purposes of data processing, this information is recorded by taking photocopies of the employee’s various documents.
The data collection process:
The employer accesses the employee’s details either on paper or electronically.
It collects and stores data that is essential for employment.
The employee consents to the collection and processing of their personal data and to the photocopying of their personal documents. The employer shall store one copy of the personal data relating to the employment contract, labelled with the employee’s name, in a locked cabinet to which others have no access.
The data is also recorded digitally; this data must be managed using a password and made accessible only to authorised personnel.
No other operations may be carried out on the data collected, and if the data is no longer required for the purposes of the employment relationship, or if the employee has withdrawn their consent, the data must be deleted!
The purpose of data processing:
The processing and secure storage of data are necessary to maintain an employee’s employment relationship. Employment and compliance with the relevant legislation.
The following persons are authorised to access the personal data collected during data processing:
Only those persons previously designated as authorised may access data that has been set aside and stored on paper, and only where absolutely necessary.
Only the managing directors, the head of human resources and the managing director’s assistant have access to the digitised data stored on the computer.
Duration of data processing:
The employer is obliged to ensure the security of the stored data for the duration of the employment relationship; thereafter, these paper-based and electronic documents must be destroyed or deleted from the system!
Data processed on the basis of consent shall be retained until such consent is withdrawn; data processed in accordance with a legal obligation shall be retained for the period specified by law – that is, for 50 years in the case of the employment contract, any amendments thereto and its termination, as well as payslips, and in other cases for as long as is strictly necessary for the purposes of the employment relationship.
The obligation to delete data applies to data stored both in the database and in emails.
Data protection measures:
Personal data is stored in a single copy in a locked cabinet in the offices at Manitox Kft.’s Tiszaújváros site; these offices are accessible via a separate lockable door.
With regard to measures taken for digital storage, the computers are equipped with a firewall and antivirus software. Access is protected by a password, which we change at regular intervals. Upon logging in, no personal data is visible on the computer desktop. Access to email accounts is only possible via a passcode from a computer that meets the criteria mentioned above.
Fitness-for-purpose tests:
In the case of Manitox Kft., employees must undergo a medical fitness assessment for their role. This is a mandatory procedure for all employees. Employees must be provided with detailed information, including the purpose of the medical fitness assessment and the nature of the tests involved. The examinations are carried out by the company doctor at his or her private practice.
The law requires this examination to be carried out for those working in an industrial environment.
The employees under review, as well as the professional conducting the review, may become aware of the
results. It is important to emphasise this because the examination may even lead to conclusions which were not known even to the individuals concerned, namely the employees. The employer may only be provided with information as to whether the person examined is fit for work or not, and what conditions must be provided to ensure this. However, the employer may not be made aware of the details of the examination or its full documentation.
Data protection requirements for workplace training undertaken during the course of employment:
Generally speaking, the tests carried out as part of training programmes and various aptitude assessments provide a detailed insight into employees’ personalities; however, it is not acceptable for employers to access, store or keep records of this information. Completing these tests provides the trainer (specialist) with guidance on the employees taking part in the training: which skills need to be developed in each individual, and what methods can be used to achieve more effective work performance. In other words, the test results are handled by the expert during the training, and their disclosure to the employer is not acceptable.
Monitoring employees’ conduct in relation to their employment:
CCTV surveillance in the workplace:
A CCTV system is in operation at Manitox Kft.’s premises.
The legal basis and purpose of data processing:
The legal basis for data processing is the data subject’s consent, in accordance with Section 5(1)(a) of the Information Act, subject to Section 26(1)(e) of Act CXXXIII of 2005 on the rules governing the protection of persons and property and private investigation activities. The purpose of data processing is the protection of persons and property. In accordance with the above, on the basis of conduct indicating the operation of the electronic surveillance system (entry into a building), and in the interests of protecting human life, physical integrity and property, the processing is carried out for the purposes of preventing, detecting and to catch the perpetrator in the act, and to provide evidence of offences. As the use of the electronic surveillance system also involves data processing, such activities are subject to the supervision of the National Authority for Data Protection and Freedom of Information (NAIH).
Persons authorised to process data: the recordings are managed by the managing directors of Manitox Kft., its data protection officer and the managers of its sites.
The parties concerned:
The data subjects are the employees, business partners and visitors to the Ltd’s premises. Any person entering the company’s premises acknowledges, upon entry, that CCTV surveillance is in operation and consents to being filmed. A notice displayed at the main entrance to the company’s premises informs visitors of the operation of the CCTV surveillance system. An information leaflet is available to the company’s employees regarding the use of technical equipment designed to monitor staff.
Scope of data processed: The data processed consists of video recordings captured by cameras at the building’s entrances, in certain sections of the corridors, and during internal operational and technical processes. The CCTV surveillance system in the buildings processes, records and stores, as personal data, video recordings of employees and partners entering the monitored areas 24 hours a day.
Number and location of cameras: There are 16 cameras per site, positioned at the entrances to buildings, in key areas of the manufacturing processes, in the corridors and near the warehouses and storage areas. The cameras’ field of view is directed only at those areas necessary for security purposes.
Duration of data processing: Unless the recordings are required for use, the Ltd. will retain them for 3 calendar days. (‘Use’ refers to their use in court proceedings or other official proceedings.)
Viewing recordings (preview)
The recorded footage from the CCTV surveillance and recording system installed on the plant’s premises may be accessed solely for the purposes of investigating offences committed against human life, physical integrity or property, to identify the perpetrator or to investigate other incidents affecting life, physical integrity or data security. Any access to the recorded footage must be documented in a report, stating the name of the person accessing it, the reason for accessing the data and the time of access. To ensure the secure handling of personal data, the data stored on the limited liability company’s servers is protected by a personal username and password, which make it possible to determine which authorised persons accessed the data and when.
Data transfer:
Data may only be transferred to the authorities or courts conducting proceedings in respect of unlawful conduct or a breach of obligations. The data transferred may include recordings made by the CCTV system containing relevant information, as well as the names of any individuals appearing in the recordings.
Your rights as a data subject:
Data subjects whose rights or legitimate interests are affected by the recording of CCTV footage may request a copy of the footage recorded by the electronic surveillance system, and may request the deletion of the footage in accordance with the relevant legal provisions. Furthermore, any person whose rights or legitimate interests are affected by the recording of the footage may, within 3 working days of the recording, request – by providing evidence of their rights or legitimate interests – that the limited liability company does not destroy or delete the data.
Legal remedy:
In the event of a breach of their rights, data subjects may contact the company’s internal data protection officer, the court with territorial jurisdiction, or initiate an investigation with the National Authority for Data Protection and Freedom of Information (NAIH, 1125 Budapest, 22/C Szilágyi Erzsébet fasor, ugyfelszolgalat@naih.hu).
There are 16 cameras in operation at each of Manitox Kft.’s sites, with their fields of view directed towards various work processes and equipment. Employees acknowledge the legitimacy of this in a declaration, which is based entirely on the monitoring of technological processes, whilst taking the utmost account of personal rights. The declaration sets out in detail the exact locations of the cameras and the work processes they monitor.
Monitoring the use of the email account provided to the employee by the employer:
Nowadays, in most workplaces, employers provide their staff with a „company email account” (most commonly email addresses in the format név@cégnév.hu) so that employees can use them to keep in touch with one another or to correspond with customers, other individuals and organisations on behalf of the employer.
A common problem regarding the use of „company email accounts” is that employees also use the email system for their own personal purposes. This can create a problematic situation should the employer – exercising its right as set out in Section 11 of the Labour Code – wish to monitor the contents of the „company email account” and the correspondence conducted by employees.
To prevent this problem, the employer must, first and foremost, draw up an internal policy setting out the rules governing the use and monitoring of „company email accounts”. This will effectively prevent the employer from processing the personal data of employees (and, where applicable, other parties involved in private correspondence).
In the case of Manitox Kft., the internal regulations cover, amongst other things, the following:
A „work email account” is used for business correspondence,
creating and retaining a backup copy of the email account and any data flowing through this email system,
emails are usually permanently deleted after a year (?), ,
Use of the email account is permitted for staff members who have a company email account.
employees shall use their email accounts in accordance with the rules and procedures governing their roles
The employer may check compliance with the relevant rules at regular intervals.
It is also the employer’s responsibility to remind employees at regular intervals of the rules governing the use of „company email accounts”.
One possible solution to this, for example, would be to issue a notice via the email system every six months reminding employees not to send emails for private purposes when using their work email account. This would ensure that employees pay particular attention to using their „work email account” in accordance with the employer’s guidelines.
Accordingly, the employer must determine in advance, whilst drafting the policy, the purposes and interests that may justify the monitoring of email accounts. These interests must be genuine and legitimate, and must be consistent with the employer’s business activities, market position and the employees’ job roles. Furthermore, before monitoring the use of email accounts, the employer must inform employees of the legitimate interest underlying the employer’s action.
Monitoring internet use:
If the employer specifies in advance which websites are to be blocked by the employer’s IT system, this can significantly reduce the likelihood of any monitoring of internet use taking place at all.
Rules regarding the use of mobile phones:
Both landline and mobile telephones are available at the company’s premises. Detailed regulations governing the use of company mobile telephones have been set out in the internal regulations!
GPS navigation system:
Specialist garages carry out inspections and maintenance of the GPS navigation system as required during servicing.
Biometric system:
There are no biometric systems in operation at any of Manitox Kft.’s sites!
Processing the personal data of job applicants:
The legal basis for data processing:
The employer stores and processes the personal data of job applicants on the basis of their voluntary, explicit and unambiguous consent, following the provision of prior information.
The scope of personal data collected:
CV, name, address, telephone number.
The data collection process:
Manitox Kft. obtains the personal data, CV, any cover letter and copies of certificates of job applicants either electronically or in paper form.
If the applicant is not employed by the limited liability company, their personal data must be erased or destroyed, unless the applicant gives their consent to the retention of their personal data.
The purpose of data processing:
Temporary employment and compliance with the relevant legislation.
The following persons are authorised to access the personal data collected during data processing:
Data stored separately on paper may only be accessed by authorised persons, as previously designated, where absolutely necessary. .
Only the managing directors, the head of human resources and the executive assistant are authorised to access the digitised data stored on the computer.
Duration of data processing:
In the case of CVs and job applications, the purpose of data processing is to fill the advertised vacancy. Accordingly, if the employer has selected one person from among the applicants for the advertised post, the purpose of data processing ceases to apply, and the personal data of the unsuccessful applicants must be erased. At the same time, the obligation to erase data also applies if the data subject changes their mind during the application process and withdraws their application.
In principle, an employer may only retain job applications on the basis of the data subject’s explicit, unambiguous and voluntary consent.
The personal data of job applicants who were not recruited must also be erased, unless the applicant has given their voluntary and explicit consent, based on prior information, to the continued storage of their data, with a view to possible future employment. In this case, the consent remains valid until it is withdrawn, but the data may be stored for a maximum of 8 years.
The obligation to delete data applies to data stored both in the database and in emails.
Data protection measures:
Personal data is stored in a single copy in a locked cabinet at the Tiszaújváros office of Manitox Kft., which is accessible via a separate lockable door.
With regard to measures taken for digital storage, the computers are equipped with a firewall and antivirus software. Access is password-protected, and the password is changed at regular intervals. When logged in, no personal data is visible on the computer desktop. Access to email accounts is only possible via a password from a computer that meets the criteria mentioned above.
Viewing a profile on social media:
An employer tries to find out as much as possible about applicants for a job vacancy and wants to gather information about them from every possible source in order to select the most suitable candidate on that basis. One obvious way to do this is for the employer to look at the applicant’s profile page on a social media site.
On social media sites, everyone sets their own preferences regarding who can see and access the content they share. The individual concerned can control what publicly available information about them is accessible via the social media site. The employer may view this publicly available information, accessible to anyone, which the job applicant has shared about themselves.
However, when it comes to viewing social media sites, the employer must take the following data protection requirements into account:
Applicants must be provided with advance information. For example, applicants must be informed that the recruitment process includes the employer reviewing information posted by the applicant on social media that is publicly available to anyone. In other words, the employer cannot „conceal” this practice from applicants; they must disclose every relevant aspect of the selection process.
It is also important that – in accordance with Section 10(1) of the Labour Code – an employer may only access information that is relevant to the job application or the post in question.
For the purposes of establishing an employment relationship, therefore, data relating to private life, romantic relationships, family life or religion is, for example, not relevant.
Whilst it is possible to view the applicant’s public activity on the relevant social media site and draw conclusions from it, any further data processing operations would be deemed unlawful. In other words, it is not permissible for an employer to download, store or forward a job applicant’s profile page to a third party.
Handling customer data:
The legal basis for data processing:
In accordance with the Accounting Act, Manitox Kft. records the customer’s details when a purchase intention is indicated. These include the customer’s name, registered office, tax number, telephone number and email address.
The data collection process:
Data is collected for the purposes of maintaining contact with customers, invoicing and, where applicable, entering into contracts. As this data relates to the fulfilment of a purchase intention, it is processed electronically and accessed only by the relevant contact persons.
Duration of data processing:
Data will be processed for the duration of the partnership; thereafter, the data will be deleted or destroyed, unless the partner consents to their data being retained so that they may be notified of any future promotions and offers.
Otherwise, the obligation to delete data applies to data stored both in the database and in emails.
The data subject may also request the erasure of their personal data via the following contact details:
By post:
Manitox Ltd.
3579, Kesznyéten, 2/A Móricz Zsigmond Street, plot numbers 076/27 and 076/6 –
By email: adatvedelem@manitox.hu
By telephone: +36 30 685 41 80
Data protection measures:
Personal data is stored in a single copy in a locked cabinet at the Tiszaújváros office of Manitox Kft., which is accessible via a separate lockable door.
This data must be stored separately from partner contracts and is accessible only to authorised personnel.
With regard to measures taken for digital storage, the computers are equipped with a firewall and antivirus software. Access is protected by a password, which we change at regular intervals. Upon logging in, no personal data is visible on the computer desktop. Access to email accounts is only possible via a passcode from a computer that meets the criteria mentioned above.
Rules regarding data collected on the website:
The legal basis for data processing:
Manitox Kft. collects the data necessary for maintaining contact with the registrant on its website on the basis of voluntary, explicit and unambiguous consent, following the provision of prior information.
The scope of personal data collected:
Name, telephone number, email address.
The data collection process:
The system records the personal data required for communication with users who register on the website; by submitting this data, the registrant consents to the collection and processing of their personal data for the purposes of communication.
The prior information must include the fact that, by giving their consent, users registering on the website agree to receive personalised offers at the contact details they have provided, or, if requested, to be contacted via one of the contact details they have provided.
The purpose of data processing:
Sending quotations, maintaining contact, making contact.
Duration of data processing:
Manitox Kft. stores personal data until consent is withdrawn and ensures that unauthorised persons cannot access the data. Only authorised personnel may access data stored electronically for the purpose of maintaining contact.
Data protection measures:
With regard to measures relating to digital storage, computers are equipped with firewalls and antivirus software. Access is password-protected, and only authorised personnel may access the system. Upon login, no personal data is displayed on the computer desktop. Email correspondence is also password-protected and can only be accessed from a computer that meets the above criteria. The obligation to delete data applies to data stored in both the database and in emails.
The data subject may request the erasure of their personal data via the following contact details:
By post: Manitox Ltd.
3579, Kesznyéten, 2/A Móricz Zsigmond Street, plot nos. 076/27, 076/6 –
By email: adatvedlem@manitox.hu
By telephone: +36 30 685 41 80
Cookies, Google AdWords, Google Analytics
The legal basis for data processing:
Consent from the data subject is not required where the sole purpose of using cookies is the transmission of communications via an electronic communications network, or where they are strictly necessary for the provider to supply a service relating to the information content expressly requested by the user.
The scope of the personal data concerned:
The unique identification numbers, dates and times of all website visitors.
The purpose of data processing:
Identifying users and tracking visitors.
Duration of data processing:
In the case of session cookies, the data retention period lasts until the end of the visit to the website.
The following persons are authorised to access the personal data collected during data processing:
The data controller does not process personal data through the use of cookies. Data subjects can delete cookies via the Tools/Settings menu in their browser, usually under the ‘Privacy’ section.
Further information:
Using Google AdWords conversion tracking:
The data controller does not currently use the online advertising programme called Google AdWords!
If you start using Google’s conversion tracking service, you will apply the following guidelines and record this date!
Google Conversion Tracking is an analytics service provided by Google Inc. (1600 Amhitheatre Parkway, Mountain View, CA 94043, USA: „Google”).
When a user accesses a website via a Google advert, a cookie required for conversion tracking is placed on their computer. These cookies have a limited validity period and do not contain any personal data, so the user cannot be identified through them.
When a user browses certain data on a website and a cookie has not yet expired, both Google and the data controller can see that the user has clicked on the website.
Each Google AdWords client is assigned a different cookie, so they cannot be tracked via AdWords clients’ websites.
The information collected via cookies is used to provide statistical data to those who opt in to AdWords conversion tracking. This enables website owners to find out how many users click on their links and are redirected to a page tagged for conversion tracking; however, they do not receive any information that could be used to identify individual users.
If you do not wish to take part in conversion tracking, you can opt out by disabling cookies in your browser.
The use of Google Analytics:
The company’s website does not yet use Google Analytics – Google Inc.’s web analytics service – but plans to do so as part of future developments!
Google Analytics uses „cookies” – text files – which are stored on your computer to help analyse the websites you visit. On behalf of the operator of this website, Google will use this information to evaluate how you have used the website, as well as to compile reports for the website operator on website activity and to provide other services relating to website and internet usage.
Within the Google Analytics framework, the IP address transmitted by the user’s browser is not linked to any other data held by Google. Users can prevent the storage of cookies by adjusting their browser settings accordingly; however, in this case, not all features of this website may be fully accessible. You can also prevent Google from collecting and processing data relating to your use of the website via cookies.
Transfer of data abroad:
Pursuant to Section 10(2) of the Labour Code, an employer may only disclose data relating to an employee to a third party in cases specified by law or with the employee’s consent.
In the context of an employment relationship, the data subject is the employee; the data controller is the employer; and any person other than these is classified as a third party. For example, other companies within the same group as the employer are also classified as third parties.
Consequently, it may also be regarded as a transfer of data when an employer uploads employees’ personal data to a shared database, to which
Other data controllers (other subsidiaries, the parent company) may also have access to the data. Manitox Kft. does not transfer data abroad, as the company has no foreign subsidiaries.
The obligation to register with the data protection register
The Authority does not keep a data protection register concerning the processing of data relating to persons in an employment relationship with the data controller. This exemption also applies to any other legal relationship of an employment nature. The exemption from registration extends to all data processing carried out by the employer; consequently, the Authority does not keep a register of the data processing activities carried out by the employer. Only those data processing activities which the employer is required by law to carry out need not be notified to the register. The purpose of these data processing activities (such as the transfer of data to the competent authorities in connection with social security and personal income tax) is known to employees as well, and therefore no notification is required. It should be emphasised that records relating to data processing carried out by the employer as required by law (for example, the civil service register or a database created in connection with payroll processing within the employer’s organisation), nor does data processing relating to the monitoring of employees, need to be reported to the data protection register.
National Authority for Data Protection and Freedom of Information (NAIH)
22/c Szilágyi Erzsébet fasor, Budapest 1125.
Fax: 06/1-3911410
Email: ugyfelszolgalat@naih.hu
Website: www.naih.hu
Location of data storage:
Personal data may be processed by us in the following ways: firstly, in connection with maintaining an internet connection, through the automatic generation of technical data relating to the computer used, the web browser, the IP address and the pages visited.
Manitok Kft. records the data in its computerised database and stores it in a lockable office at its registered office; in printed form, it is stored in a locked cupboard.
Web hosting provider:
Netteszt IT Ltd.
1037, Budapest, 19–21 Csillaghegyi út, 4th floor.
The data controller and its IT system are protected against, amongst other things:
computer fraud
espionage
computer viruses
spam emails
the hacks
and against other attacks.
The data subject’s rights and the means available to them for enforcing those rights:
The data subject may request information regarding the processing of their personal data, as well as request the rectification, erasure or withdrawal of their personal data; they may also exercise their rights to data portability and to object, in the manner indicated at the time of data collection or via the data controller’s contact details.
By post: Manitox Ltd.
3579, Kesznyéten, 2/A Móricz Zsigmond Street, plot numbers 076/27 and 076/6 –
By email: adatvedelem@manitox.hu
By telephone: +36 30 685 41 80
Right to information: the data controller shall take appropriate measures to ensure that, as referred to in all articles of the GDPR, all information and details regarding the processing of personal data to data subjects in a concise, transparent, intelligible and easily accessible form, expressed clearly and in plain language.
The data subject’s right of access: the data subject is entitled to receive confirmation from the data controller as to whether their personal data is being processed and, if so, is entitled to access their personal data and the following information: the purpose of the processing, the envisaged period for which the personal data will be stored, the categories of personal data concerned, and the recipients to whom the personal data will be disclosed; the right to rectification, the right to erasure, or the right to restriction of processing or to object, the right to lodge a complaint, information regarding the sources of the data, and the consequences of such data processing for the data subjects. The data controller is obliged to provide the requested information within one month of the submission of the request
The right to rectification: the data subject may request the data controller to rectify any inaccurate personal data concerning them and to complete any incomplete data.
Right to erasure: the data subject may request that the data controller erase their data without undue delay where any of the following grounds apply:
personal data is no longer required for the purpose for which it was collected
the data subject withdraws their consent, which forms the basis for the data processing, and therefore there is no legal basis for the data processing
the data subject objects to the processing of their data, and there are no legitimate grounds for the processing that take precedence
personal data was processed unlawfully
The erasure of data may not be requested if the processing is necessary: for the purpose of exercising the freedom of expression and the right to information; to comply with a legal obligation under Union or Member State law to which the data controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.
The right to restriction of processing: the data controller shall restrict processing if any of the following conditions are met:
if the data subject disputes the accuracy of the personal data, in which case the restriction applies for the duration of the review of the personal data
the processing is unlawful, and the data subject objects to the erasure of the data, requesting instead that its use be restricted.
the data controller no longer needs the personal data for the purposes of data processing, but the data subject requires it for the purpose of establishing, exercising or defending legal claims
the data subject objects to the processing of their data; this applies for as long as it takes to determine whose legitimate grounds take precedence.
Where data processing is subject to restrictions, personal data may be processed, with the exception of storage, only with the data subject’s consent, or for the purpose of establishing, exercising or defending legal claims, or for the protection of the rights of another natural or legal person, or for reasons of substantial public interest of the Union or of a Member State.
The right to data portability: the data subject has the right to receive the personal data concerning them, which they have provided to the data controller, in a structured, commonly used and machine-readable format, and to transmit those data to another data controller.
The right to object: the data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of their personal data carried out in the public interest or on the basis of a lawful authorisation granted to the data controller. In the event of an objection, the data controller may no longer process the data, unless there are compelling legitimate grounds for doing so which take precedence over the data subject’s interests.
The right to withdraw consent: the data subject has the right to withdraw their consent at any time.
Right to bring a claim before a court: the data subject may bring a claim before a court in the event of a breach of their rights or in the event of the improper processing of their personal data. The court shall deal with the case as a matter of priority. It is for the data controller to prove that the processing of data complies with the requirements laid down by law. The proceedings may be brought before the competent court in the data subject’s place of residence.
Data Protection Authority proceedings: complaints can be lodged here:
National Authority for Data Protection and Freedom of Information (NAIH)
22/c Szilágyi Erzsébet fasor, Budapest 1125.
Fax: 06/1-3911410
Email: ugyfelszolgalat@naih.hu
Website: www.naih.hu
These regulations come into force today and remain in force until further notice.