Privacy Policy and Information

Budapest Transport Closely Held Corporation (official seat: 1980 Budapest, Akácfa u. 15, company register number: 01-10-043037, hereinafter referred to: Data Controller) in connection with the management and evaluation of bids submitted on its auction platform, shall process the personal data provided by the Bidder on the basis of this information:

1. Contact details of the Data Controller and the tact details of the Data Protection Officer:

1.1. Data Controller

Address: 1980 Budapest, Pf. 11; phone: +36-1/461-6500; e-mail: bkv@bkv.hu; website: www.bkv.hu

1.2. Data Protection Officer:

dr. László Anga; phone: +36-(1)461-6500/11802;e-amil:angal@bkv.hu

2. Purpose of the intended data management:

2.1) Assessment of the bids submitted on the auction platform, if the data subject, whose personal data is processed, is the bidding partner;

2.2) Assessment of the bids submitted on the auction platform, if the data subject, whose data is processed, is the person acting on behalf the bidding partner

3. Legal basis for data processing:

-       in case the purpose of data processing is as set out in 2.1., the data subject is the bidding partner: processing is necessary for the performance of a contract in which the data subject is one of the parties, or it is necessary for steps to be taken at the request of the data subject prior to the conclusion of the contract

-       where the purpose of the processing is as set out in point 2.2, the data subject is a person acting on behalf of the bidding partner: the processing is carried out in the legitimate interest of the Controller or of a third party.

3.1. In the case of processing based on legitimate interests, the legitimate interest of the Controller or a third party:

• processing based on legitimate interests as set out in point 2.2., in order to achieve the purpose of processing, is necessary for keeping contact through a contact person designated by the bidder.

4. Categories of personal data:

-       where the purpose of data processing is as set out in 2.1.: basic personal identification data (name), contact details, other data (bank account number)

-       where the purpose of the processing is as set out in point 2.2, basic personal identification data (name), contact details.

5. If applicable, the recipients of personal data and the categories of recipients:

-       the different organizational units of the Data Controller who cooperate in the handling the bids;

-       where the purpose of the processing is as set out in point 2.2, the person acting on behalf of the bidder and beyond the previously mentioned ones.

6.  Duration of the storage of personal data, if it is not possible to determine this, criteria for determining that period:

-       until the purpose of the processing is fulfilled, or, in the case of a contract has been concluded, 10 years after performance of the contract

7. The provision of personal data is based on a legal or contractual obligation, or a precondition for entering into a contract, and whether the data subject is under an obligation to provide personal data, and, furthermore, what are the possible consequences of not providing the information:

-       in case the purpose of data processing is as set out in 2.1.: providing personal data is the precondition of entering into contract, to identify the contracting party, to keep contact with him, and without data concerning performance the contract cannot be concluded; the provision of the data is not mandatory, but in its absence no contract can be concluded.

8. Data subjects' rights and how to enforce them:

The Data Controller shall, without unjustifiable delay, but within one month of receipt of the request inform the data subject about the measures taken in response to the request as follows.  Where necessary, considering the complexity of the request and the number of requests, this period may be extended by further two months. The controller shall inform the applicant of the extension, stating the reasons for the delay, within one month of receipt of the request.

9.1. Access to data

The data subject is entitled to receive information if his or her personal data is being processed and if so, to be informed of his personal data and the information according to points 2, 5, 6, 7, 9.2 to 9.4, 9.6 and 10 of this Notice.

The Data Controller shall provide a copy of the personal data under processing to the data subject. For any additional copies requested by the data subject, a reasonable fee can be charged based on the administrative costs. If the data subject has the information has submitted his request electronically, the information shall be provided in a commonly used electronic format unless the data subject requests otherwise.

9.2. Correction of personal data

The data subject has the right to obtain from the controller, for his or her request, to correct inaccurate personal data relating to him or her without undue delay. Considering the purpose of the processing, the data subject shall have the right to obtain the rectification of incomplete personal data.

9.3. Erasure of personal data

The data subject shall have the right to obtain, at his or her request and without undue delay, the erasure of personal data concerning him or her without undue delay where one of the following grounds applies:

- the personal data are no longer necessary for the purposes for which they were collected or otherwise processed

- the data subject objects to the processing and there is no overriding legitimate ground for the processing

- the personal data have been unlawfully processed;

- the personal data have been processed in breach of an EU or Member State law applicable to the controller and have to be deleted in order to comply with a legal obligation under EU or Union law.

The Data Controller will not delete personal data if the processing is necessary:

- to exercise the right to freedom of expression and information

Member State law; in the public interest or in the exercise of official authority

- to fulfil an obligation of data procession emerging out of community law or member state law concerning Controller carried out in the exercise of a public authority;

- on grounds of public interest in the field of public health;

- for archiving purposes in the public interest, scientific and historical research purposes, or- for statistical purposes, where the data subject's right to erasure is unlikely to be fulfilled or seriously jeopardize the processing;

- for the establishment, exercise or defence of legal claims.

9.4. Restrictions on processing personal data

The data subject shall have the right to obtain from the controller, at his or her request, restriction of processing if one of the following conditions is met:

- If the data subject contests the accuracy of the personal data, in which case the restriction shall be limited to the period of time necessary to allow the controller to verify the accuracy of the data

- the processing is unlawful and the data subject opposes the erasure of the personal data, and requests instead the restriction of their use;

- the Controller no longer needs the personal data for the purposes of the processing, but the data subject needs them for the establishment or exercise of a legal claim or protection of his rights;

- the data subject has objected to the processing; in this case, the restriction is limited to the period until it is established that the Controller has legitimate grounds for overriding the legitimate grounds of the data subject.

- The Controller shall inform preliminarily the data subject at whose request the processing has been restricted of the resolving the restriction of processing.

9.5. Notification obligation relating to correction, erasure, and restriction of personal data

The Controller shall inform all recipients of the rectification or erasure or restriction of processing of the personal data to whom or with which the personal data has been disclosed, unless this proves impossible or involves a disproportionate effort. For request, the Controller shall inform the data subject of the identity of those recipients.

9.6. Objection to the processing of personal data

The data subject shall have the right to object, on grounds relating to his or her particular situation, to the processing of personal data

(processing for the purposes of point 2.2) on the basis of legitimate interest.

In such cases, the Data Controller may no longer process the personal data unless it can prove that it has done so,

that the processing is justified by compelling legitimate grounds which override legitimate interests or rights of the data subject, or which are related to the establishment, exercise or defence of legal claims.

.

9.7 Data portability

The data subject is entitled to receive his or her personal information, which he or she has provided from the Data Controller in a structured, commonly used, machine-readable format, and he or she has the right to transmit these data to another controller without further processing,

to another data controller without hindrance by the controller, if the processing is based on the data subject's consent or contract; or the processing is carried out by automated means.

In exercising the right to data portability, the data subject shall have the right, where it is technically feasible, to request the direct transfer of personal data between data controllers.

10. Legal remedies

The data subject may take legal action in the event of a breach of his or her rights. The person concerned may bring the action, at his or her choice, before the courts of the place of residence or domicile.

The data subject may lodge a complaint with the National Authority for Data Protection and Freedom of Information (hereinafter referred to as "the Authority") in relation to the processing of his or her personal data. At the

Authority, any person may lodge a complaint with the Authority on the grounds that a violation of rights in connection with the processing of personal data has occurred or there is imminent risk of such a situation. The contact details of the Authority are: www.naih.hu; ugyfelszolgalat@naih.hu