DATA MANAGEMENT AND DATA PROTECTION INFORMATION Budapest Artisan Alapítvány1013 Budapest, Pauler utca 11.Budapest, 23 June 2022 I. INTRODUCTION OF THE DATA PROTECTION INFORMATION The purpose of this data protection and data management information is to define the rules and conditions under which the Budapest Artisan Foundation (hereinafter Foundation) protects and manages the data of visitors to this website in order to ensure the legitimacy of its internal data management processes and the rights of data subjects. We would like to inform you that our Foundation is responsible for the processing of personal data in accordance with the relevant legislation, in particular Act CXII of 2011 on the right to information self-determination and freedom of information. Act (hereinafter: Infotv.), and 2016/679 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Regulation GDPR 95/46 / EC. (hereinafter referred to as the GDPR Regulation). Our Foundation fulfills its information obligations under the GDPR Regulation through this data protection and data management information. Our foundation treats personal data confidentially, and in order to preserve the data, it takes all technical and organizational measures related to data storage and data management to promote secure data management. We will inform you about the relevant provisions of the processing of your personal data through this information. The individual data management purposes and their characteristics are defined as follows: II. DEFINITIONS Definitions are given in accordance with the GDPR Regulation: 1. “personal data” means any information relating to an identified or identifiable natural person (“data subject”); identify a natural person who, directly or indirectly, in particular by reference to one or more factors such as name, number, location, online identifier or physical, physiological, genetic, mental, economic, cultural or social identity of the natural person identifiable; 2. “data processing” shall mean any set of operations or operations carried out in an automated or non-automated manner on personal data or files, such as collection, recording, systematisation, sorting, storage, modifying or altering, querying, viewing, using, transmitting, distributing or otherwise making available, coordinating or linking, restricting, deleting or destroying; 3. “controller” means the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data, where the purposes and means of processing are defined by Union or Member State law; 4. “processor” means any natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller; 5. ” “consent of the data subject” means a voluntary, specific and well-informed statement of the will of the data subject indicating, by means of a statement or unambiguous statement of consent, his or her consent to the processing of personal data concerning him or her; 6. “data protection incident” means a security breach resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, personal data which have been transmitted, stored or otherwise handled; personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and genetic and biometric data for the unique identification of natural persons, health data and personal data concerning the sexual life or sexual orientation of natural persons; 8. “recipient” shall mean a natural or legal person, public authority, agency or any other body to whom personal data are disclosed, whether a third party or not. or have access to personal data in accordance with the law of a Member State shall not be deemed to be the recipient, and the processing of such data by those public authorities shall comply with the applicable data protection rules in accordance with the purposes of the processing; public authority, an agency or any other body other than the data subject, the controller, the processor or persons who have been authorized to process personal data under the direct control of the controller or processor; 10. When this information provides for data or data processing, it is to be understood as personal data and their processing. III. CHARACTERISTICS OF EACH DATA MANAGEMENT PURPOSE 1. Processing of personal data of grant applicants If you apply for one of our announced grants, the application material you submit will be handled by our Foundation as a data controller during the grant process. If you provide your Foundation with your application material (CV, motivation letter and any additional personal data sent by the applicant) for the purpose of applying for support, our Foundation will process the information contained therein for the purpose of providing the advertised support and assessing your application. The data management lasts for 1 year from the end of the grant application procedure. The fact that you send us your application after reading this brochure constitutes a clear, active consent to the processing of your personal data for the purposes described in this brochure. Please note that personal data will only be processed for the purpose of selecting the appropriate applicant, and your personal data will not be processed for any other purpose. Our foundation treats personal data confidentially, in order to preserve the data, take all technical and organizational measures related to the storage and data management of IT and other secure data management. Purpose of data management During the selection process required to provide the grants announced by our Foundation, we get to know the professional and human values, education and previous work experience of the applicants, such as you, in order to find the most suitable person for the grant. Personal data processed The personal data contained in the application material sent by you, in particular: CV, motivation letter, other application documentation. If you send additional personal data to our Foundation, we will also process it as described in this prospectus. If we do not need any documents or data submitted by you to process your application, or if their processing is contrary to the purpose limitation, we will delete or destroy them immediately. Legal basis for data processing Article 6 (1) (a) of the GDPR Regulation, ie your consent, is the legal basis for the processing of your personal data. By applying for our Foundation Scholarship and therefore sending us the necessary application material, you clearly and actively indicate your consent to the processing of your personal data submitted during the application process as described in this guide. Recipients of personal data provided Only the members of the Board of Trustees and other persons of our Foundation who have the right to make proposals or make decisions regarding the filling of the advertised position are entitled to process the personal data provided by you. Our Foundation does not use a data processor for data management. Transfer of personal data to a third country or international organization Our Foundation does not transfer your above personal data to any third country or international organization. Duration of processing of personal data Only until the grant is awarded, but not more than 1 year. Neither automated decision making nor profiling takes place during data management. Provision of personal data The processing of personal data is an essential condition for the assessment of the application and the selection process. 2. Newsletter (marketing letter) If you subscribe to our newsletter on the interfaces provided or made available by us, we will provide you with news, information and marketing materials concerning the Foundation at the contact details provided. Newsletters may only be sent in accordance with the GDPR Decree and current Hungarian legislation with your prior consent. Subscribing to the newsletter constitutes a clear, active consent to the processing of your personal data for the purposes described in this prospectus. You can unsubscribe from the newsletter at any time by clicking on the link in the newsletter, so you have the right to withdraw your consent. Purpose of data management The subscription to the newsletter is made by sending a direct e-mail. The information you provide during subscription will only be used to send you the newsletter. Personal data managed Name and e-mail address provided during registration. Legal basis for data processing Article 6 (1) (a) of the GDPR Regulation is therefore the legal basis for data processing as your consent. Our foundation considers that the processing of the data provided by subscribing to the newsletter is based on the express consent of the data subject. Recipients of personal data provided The personal data provided by you are only available to the members and employees of the Board of Trustees of our Foundation who are responsible for the message you send. or have the right to propose or decide on the administration required under it. For data management, we use the data processor (IT) specified in the annex to our data protection regulations. Our data processor (s) may process your personal data only for the purposes specified by us and stipulated in the contract, in accordance with our instructions, they have no independent decision-making right with regard to data processing. Our data processors have undertaken confidentiality and contractual guarantees regarding the protection of personal data obtained in the performance of their duties. Transfer of personal data to a third country or international organization Our Foundation does not transfer your above personal data to any third country or international organization. Duration of processing of personal data Until the withdrawal of consent (until the date of unsubscribing from the newsletter). Neither automated decision making nor profiling takes place during data management. Provision of personal data The processing of personal data is a condition for sending the newsletter, which can only be based on your prior, voluntary consent. You can unsubscribe from the newsletter at any time via the link at the bottom of the letter and the menu item on our website. 3. Communication by e-mail In today’s fast-paced world, our foundation keeps in touch electronically with its partners, customers, supporters and fellows. As part of this, you can send us an email directly to info@artisanfoundation.org. In the course of electronic communication with you in connection with any matter, we will process your personal data as described in this section. Purpose of data management Contact can be made by sending a direct e-mail to the above e-mail address. We will only use the information you provide during your contact to communicate with you and to deal with the contents of this message. Personal data processed Name, e-mail address and any other information you consider relevant to the case you have initiated. Legal basis for data processing Article 6 (1) (b) of the GDPR Regulation, ie data processing is necessary for the performance of a contract in which you are a party or to take steps at your request before concluding the contract. Our foundation considers that communication with consumers is a preliminary data management related to a contract (agreement) to be concluded later, or a data management related to an already concluded contract. Recipients of personal data provided The personal data provided by you are only available to our employees who have the right to make suggestions or make decisions in connection with the message sent by you or the administration required by it. We do not use data processor (s) for data management. Transfer of personal data to a third country or international organization Our Foundation does not transfer your above personal data to any third country or international organization. Duration of the processing of personal data If any kind of contract or agreement is concluded between our Foundation and you, we will process the personal data that came to our knowledge in connection with the given contract, at the latest until the expiry of the limitation period. If no contract or agreement is reached between our Foundation and you after the pre-contractual data processing, the message (s) will be deleted after the communication is closed. Automated decision making and profiling None of this happens during data management. Provision of personal data The processing of personal data is a condition for replying to the message and thus for communication between you and our Foundation. 4. Handling of personal data that comes to our knowledge in the course of our contacts Our partners come into contact with other civil and economic actors in the course of their day-to-day operations. When working with partners, it is necessary that the natural persons involved in the performance maintain contact with each other. Purpose of data management The purpose of business and other relations is to promote the fulfillment of the contract concluded between you and the company and other legal entity you represent, as well as our Foundation, and to cooperate as closely and efficiently as possible. Personal data processed Name, e-mail address, telephone number. Legal basis for data management The legal basis for data management in accordance with Article 6 (1) (f) of the GDPR Regulation is the legitimate interest of our Foundation. It is in the legitimate interest of our foundation to maintain contact with you or with the company (s) and other legal entity you represent. Direct contact is needed for the most efficient activity possible. Source of personal data Your personal data has been provided to our Foundation by you or your employer on the basis of a legal authorization. Recipients of personal data provided Our Foundation will only make your personal data available to employees who participate in the performance of a given legal relationship. We do not use data processor (s) for data management. Our data processor (s) may process your personal data only for the purposes specified by us and stipulated in the contract, in accordance with our instructions, they do not have independent decision-making power over data management. Our data processors have undertaken confidentiality and contractual guarantees regarding the protection of personal data obtained in the performance of their duties. Transfer of personal data to a third country or international organization Our Foundation does not transfer your above personal data to any third country or international organization. Duration of the processing of personal data Your personal data will be deleted by our Foundation after the expiry of the contract. Neither automated decision making nor profiling takes place during data management. Provision of personal data The processing of personal data is necessary for the performance of the contract. 6. Enforcement Our Foundation complies with Article 6 of the GDPR Data Protection Regulation. Pursuant to Article 1 (1) (f), you have the right to process your personal data to the extent necessary to safeguard your legitimate interests in order to resolve disputes and in administrative and judicial proceedings. During the enforcement, our foundation may use additional experts (claims manager, legal representative, forensic expert, etc.) as data processors at its own discretion. In order to enforce your rights, our Foundation handles your personal data in accordance with the legislation on the protection of personal data and the provisions of the current Privacy Policy. ARC. RIGHTS REGARDING DATA PROCESSING In the case of joint data management, you are entitled to enforce your rights under this section against any data controller. Right to information You have the right to information about data processing, which the Foundation will fulfill by making this prospectus available. Consent-based data processing If the legal basis for a data processing is the GDPR Regulation. Pursuant to Article 6 (1) (a) with your consent, you have the right to withdraw your consent to the processing at any time. However, it is important to know that the withdrawal of consent only applies to data for which there is no other legal basis for processing. Unless there is another legal basis for the processing of the personal data concerned, the personal data will be permanently and irrevocably deleted after the withdrawal of consent. Withdrawal of consent shall not affect the lawfulness of the data processing carried out prior to the withdrawal. Right of access Upon request, the Foundation will inform you at any time thereafter whether your personal data is being processed and, if so, we will provide access to your personal data and the following information: for the purposes of data processing; the categories of personal data concerned; the recipients or categories of recipients to whom our Foundation has communicated or will communicate personal data, including in particular third country recipients or international organizations; the intended period for which the personal data will be stored or, if that is not possible, the criteria for determining that period; we also inform you of your right to request from our Foundation the rectification, erasure or restriction of the processing of personal data concerning you, and may object to the processing of such personal data; the right to lodge a complaint with a supervisory authority or to institute legal proceedings; if the data was not collected directly from you, all available information about its source; if automated decision-making takes place, the fact of this, including profiling, and at least the logic used in these cases, ie the significance of such data processing and the expected consequences for the data subject. Right to rectify personal data You have the right at any time to rectify inaccurate personal data concerning you without undue delay. Taking into account the purpose of the data processing, you are also entitled to to request that incomplete personal data be supplemented, inter alia, by means of a supplementary declaration. Please report any changes to your personal information to our Foundation as soon as possible to facilitate lawful data processing and the exercise of your rights. Right to delete You have the right, at our request, to delete personal data about you without undue delay from our Foundation if any of the following reasons exist: the personal data are no longer needed for the purpose for which they were collected or otherwise processed; in the case of consent-based data processing, you withdraw your consent on which the data processing is based and there is no other legal basis for the data processing; You object to the processing and there is no overriding legitimate reason for the processing, or you object to the processing of data for the purpose of direct business acquisition; personal data has been processed unlawfully; personal data must be deleted in order to comply with a legal obligation under EU or national law applicable to our Foundation; personal data were collected in connection with the provision of information society services. Our Foundation will not comply with your request for cancellation if further processing is required for one of the following reasons: in order to exercise the right to freedom of expression and information; to fulfill an obligation under EU or national law applicable to our Foundation to process personal data or to perform a task in the public interest; on grounds of public interest in the field of public health; for the purpose of archiving in the public interest, for scientific and historical research purposes or for statistical purposes, where erasure would be likely to make this processing impossible or seriously jeopardize it; or to bring, assert or defend legal claims. Data will be deleted permanently and irrevocably. Right to restrict data processing You have the right, at the request of the Foundation, to restrict data processing if any of the following is met: You dispute the accuracy of your personal data; in this case, the restriction applies to the period of time that allows us to check the accuracy of the personal data; the processing is unlawful and you oppose the deletion of the data, instead requesting a restriction on its use; Our Foundation no longer needs personal information for data processing purposes, but you do so to submit, enforce or protect legal claims; or you have objected to the processing; in this case, the restriction shall apply for as long as it is determined whether the legitimate reasons of our Foundation take precedence over the legitimate reasons of the person concerned. If the processing is restricted, we may only process such personal data with your consent, for the purpose of making, enforcing or protecting legal claims, protecting the rights of another natural or legal person, or in the important public interest of the Union or a Member State. Right to protest If the legitimate interest of our Foundation in the processing of your personal data is the legal basis, you have the right to object at any time to the processing of your personal data, including profiling based on these provisions, for reasons related to your own situation. In this case, our Foundation may not further process your personal data unless we prove that the processing is justified by overriding legitimate reasons which take precedence over your interests, rights and freedoms or which relate to the submission, enforcement or protection of legal claims. If your personal data is processed by our Foundation for the purpose of direct business acquisition, you have the right to object at any time to the processing of your personal data for this purpose, including profiling, insofar as it relates to direct business acquisition. If you object to the processing of your personal data for the purpose of direct business acquisition, your personal data may no longer be processed for this purpose. The right to data portability You have the right to receive personal data about you provided by you to the Foundation in a structured, widely used, machine-readable format, and you have the right to request that this data be transferred to another data controller. You are therefore entitled to request that the Foundation send your personal data directly to another data controller. Procedure for enforcing your rights You have sent the above rights by e-mail to info@artisanfoundation.org, by post to the headquarters of the Foundation (1113 Pauler Street, Budapest), or to practice in person at the seat of the Foundation. Our foundation will start examining and fulfilling your application without undue delay upon receipt. We will inform you of the action we have taken on your request within 30 days of receiving it. If we are unable to process your request, we will notify you within 30 days of the reasons for your refusal and your remedies. V. RIGHT OF APPEAL IN RESPECT OF DATA PROCESSING If you consider that the processing of personal data concerning you violates the GDPR Regulation, you have the right to lodge a complaint with a supervisory authority, without prejudice to other administrative or judicial remedies. The authority will then have to investigate your complaint and notify you of the outcome of the investigation. You have the right to lodge a complaint with any authority in a Member State of the European Union, in particular the Member State in which you have your habitual residence, place of employment or the place where the alleged infringement took place. You can read the contact details of the Hungarian data protection authority below. In order to enforce your right to legal redress, you may take legal action against our Foundation if, in its sole discretion, our Foundation or a data controller entrusted or acting by us violates your personal data processing laws or binding acts of the European Union. handles. The court is acting out of turn in the case. The court has jurisdiction to hear the case. The lawsuit is, at your option, your place of residence or stay, or before the court of the seat of our Foundation (Metropolitan Court). By filing a complaint with the National Data Protection and Freedom of Information Authority (NAIH), anyone may initiate an investigation against the Foundation on the grounds that a personal data breach has occurred or is imminent, or that the Foundation restricts the exercise of its data processing rights. rejects his application. The report can be made at one of the following addresses: National Data Protection and Freedom of Information Authority (NAIH) Postal address: 1530 Budapest, Pf .: 5.Address: 1125 Budapest, Szilágyi Erzsébet fasor 22 / cPhone: +36 (1) 391-1400Fax: + 36 (1) 391-1410E-mail: ugyfelszolgalat@naih.huURL: http://naih.hu By filing a complaint with the National Data Protection and Freedom of Information Authority (NAIH), anyone may initiate an investigation against the Foundation on the grounds that a personal data breach has occurred or is imminent, or that the Foundation restricts the exercise of its data processing rights. rejects his application. The report can be made at one of the following addresses: National Data Protection and Freedom of Information Authority (NAIH) Postal address: 1530 Budapest, Pf .: 5.Address: 1125 Budapest, Szilágyi Erzsébet fasor 22 / cPhone: +36 (1) 391-1400Fax: + 36 (1) 391-1410E-mail: ugyfelszolgalat@naih.huURL: http://naih.hu By filing a complaint with the National Data Protection and Freedom of Information Authority (NAIH), anyone may initiate an investigation against the Foundation on the grounds that a personal data breach has occurred or is imminent, or that the Foundation restricts the exercise of its data processing rights. rejects his application. The report can be made at one of the following addresses: National Data Protection and Freedom of Information Authority (NAIH) Postal address: 1530 Budapest, Pf .: 5.Address: 1125 Budapest, Szilágyi Erzsébet fasor 22 / cPhone: +36 (1) 391-1400Fax: + 36 (1) 391-1410E-mail: ugyfelszolgalat@naih.huURL: http://naih.hu or there is an imminent threat thereof, or that the exercise of its rights related to data processing is restricted by the Foundation or its application for the exercise of these rights is rejected. The report can be made at one of the following addresses: National Data Protection and Freedom of Information Authority (NAIH) Postal address: 1530 Budapest, Pf .: 5.Address: 1125 Budapest, Szilágyi Erzsébet fasor 22 / cPhone: +36 (1) 391-1400Fax: + 36 (1) 391-1410E-mail: ugyfelszolgalat@naih.huURL: http://naih.hu or there is an imminent threat thereof, or that the exercise of its rights related to data processing is restricted by the Foundation or its application for the exercise of these rights is rejected. The report can be made at one of the following addresses: National Data Protection and Freedom of Information Authority (NAIH) Postal address: 1530 Budapest, Pf .: 5.Address: 1125 Budapest, Szilágyi Erzsébet fasor 22 / cPhone: +36 (1) 391-1400Fax: + 36 (1) 391-1410E-mail: ugyfelszolgalat@naih.huURL: http://naih.hu