on the processing of data relating to the sending of business enquiries to individuals
1. Name of Data Controller
The name of the Data Controller is White Hat IT Security Service and Trade Ltd. (hereinafter referred to as White Hat or the Organisation)
Head office: 1021 Budapest, Ötvös János u. 3;
Location / mailing address: 1021 Budapest, Ötvös János u. 3;
Tax number: 26373643-2-41;
Representative: Sándor Fehér Managing Director
Contact details of the Data Protection Officer:
Name: Alexandra Enyedi
Contact: privacy@whitehat.eu; ++36 20 346 9646.
2. Purpose and legal basis for processing
The purpose of the processing is the transfer and processing of personal data necessary for the provision of the offer in the case of requests from individuals to White Hat, and other personal data necessary for the investigation of an order, which are contained on the transferred device.
Scope of personal data processed
The name, e-mail address and telephone number of the natural person and any other personal data necessary for the purposes of the offer and, in the case of an order, for the purposes of the investigation, which are contained in the device provided.
Purpose of data processing
The purpose of data processing is to maintain contact, to recover data in the event of the transfer of the means necessary to resolve the incident.
The processing is based on the voluntary and explicit consent of the individuals sending the request, based on prior informed consent, pursuant to Article 6(1)(a) of Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: GDPR). By submitting a request, the data subject confirms that he or she has read and understood this Privacy Notice in full and that he or she accepts the provisions contained herein as binding on him or her, and voluntarily and explicitly consents to the processing of personal data provided by White Hat to for the purposes set out in this Privacy Notice.
3. The source of the personal data and the scope of the data processed, if not provided by the data subject
The Organization does not process personal data that it does not collect from the data subject.
4. Recipients and categories of recipients of personal data
The Organization will not transfer personal data processed under this Notice to any other recipient. Personal data may be disclosed to White Hat’s incident management staff.
5. How, when and by whom the personal data are stored
The personal data set out in this Notice will be kept for 15 days after the incident has been resolved. Registrants may delete themselves at any time, thereby withdrawing their consent to the processing. As a result of a request for deletion, the Controller will delete the personal data of the data subject within a maximum of 72 hours after the relevant request. You can withdraw your consent to the processing of your data by sending an e-mail to the address provided. In the event of withdrawal of consent, White Hat will immediately delete your application from the selection database.
White Hat does not perform any automated decision making or profiling by or in relation to the data covered by this notice.
White Hat does not use a data processor to carry out certain technical (IT) operations relating to personal data.
6. Access to and transfer of data
Access to the data is restricted to authorised employees of the controller. The data may be transferred to third parties only with the consent of the data subject or by law.
7. Data subject’s rights in relation to data processing
The GDPR gives data subjects certain rights as data subjects, which are set out below. These rights are complementary, i.e. supplementary, and accordingly the Data Subject may, for example, request the rectification or integration of his or her data or the erasure of his or her data.
7.1. Withdrawal of consent
If the controller stores and processes the personal data of the data subject on the basis of the consent given by the data subject to the register, the data subject has the right to withdraw that consent at any time. However, the withdrawal of consent shall not affect the lawfulness of the processing prior to the date of withdrawal . As a consequence of the withdrawal, the controller may no longer process the data concerned for the purposes indicated in the consent form as from the date on which the controller became aware of the withdrawal. In this case, the data subject shall be excluded from the register of candidates for future vacancies.
7.2 Right of access, rectification and erasure
Data subjects have the right to.
- obtain confirmation from the controller as to whether the controller is processing personal data concerning them and, if so, to be informed of that processing;
- request the correction of inaccurate personal data concerning them; and
- request the erasure of personal data concerning them under certain conditions.
7.3. Right to restriction of processing
Data subjects also have the right to request the controller to restrict processing,
- if they contest the accuracy of the data concerning them, in which case the restriction may be requested for a period of time which allows the controller to verify the accuracy of the data;
- if the processing is unlawful but the data subjects refuse the erasure of their data and instead request the restriction of processing;
- where the controller no longer needs the personal data of the data subjects for the purposes of processing them, but the data subjects need those data for the establishment, exercise or defence of legal claims; or
- data subjects have objected to the processing, but a decision on the fundamental aspects of the processing has not yet been taken.
7.4. Right to object
Data subjects also have the right to object to the processing of their personal data. In the event of such an objection, the controller shall cease processing the data unless
- can demonstrate that there are legitimate grounds for the processing which override the interests, rights and freedoms of the data subject; or
- processing is necessary for the establishment, exercise or defence of legal claims.
7.5 Right to data portability
Our Data Subjects have the option to receive the personal data that we have provided to us and that we process in a machine-readable format specified by us or to instruct us to transfer this data directly to a third party of their choice, provided that the recipient of the transfer makes this technically feasible for us and the transfer is not prevented by an unreasonable amount of effort, legal or other confidentiality obligations or confidentiality considerations on our part or on the part of a third party.
7.6. Right to complain
Please contact the controller in writing (by post or e-mail) to exercise your rights as set out above. The Data Controller is of course also at your disposal at any time for any other requests concerning the use and security of your data. If you believe that the controller is using your data in an unauthorised way, you can also lodge a complaint with the data protection authority using one of the contact details below:
National Authority for Data Protection and Freedom of Information
1055 Budapest, Falk Miksa utca 9-11.
7.7. Deadline
The Organization shall comply with the data subject’s request to exercise his or her rights within a maximum of 15 days of receipt of the request. The date of receipt of the request shall not count towards the time limit. The Organization may, if necessary, and taking into account the complexity of the request and the number of requests, extend this time limit by an additional two months. White Hat shall inform the person concerned of the extension of the time limit, stating the reasons for the delay, within 15 days of receipt of the request.
7.8. Right to legal redress
Any person who has suffered pecuniary or non-pecuniary damage as a result of a breach of the GDPR is entitled to compensation from the controller. The court shall rule on the case out of turn. The tribunal shall have jurisdiction to hear the case. The lawsuit may also be brought before the court of the place of residence or domicile of the data subject.
7.9. Data protection authority procedure
The data subject may lodge a complaint with the National Authority for Data Protection and Freedom of Information (1125 Budapest, Szilágyi Erzsébet fasor 22/c, phone: +36 (1) 391-1400, email: ugyfelszolgalat@naih.hu, website: www.naih.hu)
