Privacy Policy

1. Data Controller

The controller is not required to appoint a data protection officer and has not appointed one. Enquiries about data processing can be sent to the email address above.

2. Purpose of Data Processing

Personal data is processed for the following purposes:

• enabling contact and enquiries;
• handling proposal requests;
• responding to messages;
• discussing and coordinating services.

3. Categories of Data Processed

Through the contact and proposal request forms, the following data may be collected:

• name;
• email address;
• organisation name (if provided);
• job title / role (if provided);
• message content.

4. Legal Basis for Processing

The legal basis is the data subject’s freely given consent, provided by completing and submitting the form, under Article 6(1)(a) of Regulation (EU) 2016/679 (GDPR).

5. Retention Period

Contact and proposal data is retained for the duration of the exchange and the related discussions, at most until the purpose of processing ceases or until the data subject requests deletion.

Longer retention periods apply to event registrations and invoicing; these are set out in section 10.

6. Data Transfers and Processors

Personal data is not disclosed to third parties for their own purposes, and is not sold.

Processors are, however, used in the course of operations. A processor acts on behalf of and on the instructions of the controller, and may not use the data for its own purposes:

• Netlify, Inc. (101 2nd Street, San Francisco, CA 94105, USA) — website hosting and operation of the forms;
• Google LLC (Google Forms, Google Workspace) — form handling and email;
• email service provider — receiving and answering enquiries;
• invoicing service provider (e.g. Számlázz.hu) — invoicing in the case of paid events.

Netlify, Inc. and Google LLC are providers established in the United States. The transfer is based on the European Commission’s adequacy decision concerning the EU–US Data Privacy Framework, or, in its absence, on standard contractual clauses.

The controller implements all necessary technical and organisational measures to ensure the security of personal data.

7. Cookies and Website Measurement

This website does not use cookies and does not measure visits with any third-party service.

For the secure operation of the website, the hosting provider keeps server logs (for example the visitor’s IP address and the time of the visit). The legal basis is the controller’s legitimate interest (GDPR Article 6(1)(f)).

8. Rights of Data Subjects

Data subjects have the right to:

• obtain information about the processing of their personal data (access);
• request rectification of their personal data;
• request erasure of their personal data;
• request restriction of processing;
• exercise the right to data portability;
• object to processing;
• withdraw consent at any time — this does not affect the lawfulness of processing before withdrawal;
• lodge a complaint with the supervisory authority.

Requests can be sent to hello@etikusmunkahely.hu and are answered within one month, as required by the GDPR.

9. Right to Redress

Data subjects may lodge a complaint with the National Authority for Data Protection and Freedom of Information (NAIH), or bring proceedings before a court.

• Website: www.naih.hu
• Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary
• Postal address: 1363 Budapest, Pf. 9., Hungary

10. Data Processing in Connection with Event Registrations

Personal data provided when registering for workshops, training sessions, webinars and other professional events organised by the Ethical Workplace Program is processed for the purposes of managing registrations, communicating about the programme, organising participation, and — in the case of paid events — invoicing and related administration.

Purpose of Processing

• receiving and recording registrations;
• communicating with participants;
• providing information about event details;
• organising and delivering the event;
• invoicing and meeting accounting obligations in the case of paid events.

Categories of Data Processed

• name;
• email address;
• phone number (where required);
• organisation name;
• job title (optional);
• billing details (where the event is subject to a fee).

Legal Basis for Processing

• GDPR Article 6(1)(b) — steps taken at the data subject’s request prior to entering into a contract, or performance of a service;
• GDPR Article 6(1)(c) — compliance with a legal obligation (invoicing and accounting);
• GDPR Article 6(1)(a) — consent, where optional data is provided.

Retention Period

Registration data is retained for a maximum of 12 months following the conclusion of the event. Data associated with issued invoices is retained for 8 years under Act C of 2000 on Accounting.

Consequences of Not Providing Data

Without the mandatory fields, a registration cannot be processed and participation cannot be confirmed.

11. Other Provisions

The controller reserves the right to amend this Privacy Policy. Any amendment takes effect upon publication on the website.