Rights of the data subject and their enforcement

All natural persons whose personal data are processed by MÁV-START Zrt. are considered as data subject. The data subjects rights are described below.

Due to the personal nature of the data protection rights, the data subject may submit the application personally or through a legal representative (e.g. a parent on behalf of his or her child) or a trustee (e.g. a lawyer).

The data subject may submit the application for the enforcement of the rights at any of the contact details of MÁV-START Zrt. We recommend that the request be made primarily at the contact details indicated in point 1 of the Privacy Policy for the data processing or at any contact details of the Data Protection Officer.

Method of enforcement the rights of the data subject: the data subject may submit a request for the exercise of his or her rights in writing (e.g. by postal letter), electronically (e.g. by e-mail) or orally (e.g. by telephone). If the data subject submits his / her request orally, the Data Controller shall keep a minutes of the request. Application forms which helps to enforce the data subjects rights are available in the section ’Documents to download’ at the bottom of this page.

Contact details of the Data Protection Officer:

E-mail: adatvedelem [KUKAC] mav-start.hu

Postal adress: 1087 Budapest, Könyves Kálmán krt. 54-60. – please indicate on the envelope: "For the Data Protection Officer".

The data subject may enforce the following rights:

a) Right to be informed;

b) Right of access (right to information, right to request a copy);

c) Right to rectification;

d) Right to erasure (‘right to be forgotten’);

e) Right to restriction of processing;

f) Right to data portability;

g) Right to object;

h) Right to withdraw consent;

i) Right to complain and right of appeal.

Detailed information on each right is available below. Application forms which helps to enforce the data subjects rights are available in the section ’Documents to download’ at the bottom of this page.

How we complete the request?

MÁV-START Zrt. fulfills the application of the data subject in the manner indicated in the application. If you submit your request in writing, you may request that the Data Controller comply with it in writing by postal letter or by electronically (by e-mail). If the data subject submits his / her request orally, the Data Controller shall provide information on the fulfillment of the request in writing. The oral application of the data subject may be fullfilled orally only if the identity of the data subject can be established beyond doubt at the time the application is submitted.

What is the deadline for completing the request?

The controller shall comply with the data subject's request without delay, but no later than one month from the receipt of the request. In view of the complexity of the application and the number of applications, this deadline may be extended by a further two months. The controller shall inform the data subject of the extension of the deadline, indicating the reasons for the delay, within one month of receiving the request.

Costs of completing the request:

The Data Controller shall ensure the fulfillment of the data subject's request free of charge. If the data subject's request is manifestly unfounded or – in particular due to its repetitive nature – excessive, the controller may charge a reasonable fee or refuse to act on the request, taking into account the administrative costs of providing the requested information or action or taking the requested action. If the Data Controller charges a fee in accordance with this rule or refuses to comply with the request, it shall notify the data subject thereof no later than within one month from the receipt of the request. If the Data Controller charges a fee for the fulfillment of the data subject's request, the Data Controller shall not comply with the data subject's request until the data subject pays the established fee.

If the Data Controller collects personal data from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information. The data controller fulfills this obligation differently depending on the nature of the data processing, however, information on some of the data processings performed by MÁV-START Zrt. is available under the menu „Privacy Policy”.

The Data Controller shall provide the data subject with at least the following information:

(a) the identity and the contact details of the controller and, where applicable, of the controller's representative;

(b) the contact details of the data protection officer, where applicable;

(c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;

(d) where the processing is based on the legitimate interest, the legitimate interests pursued by the controller or by a third party;

(e) if personal data are transferred, the recipient(s) or categories of recipients of the personal data;

(f) where personal data are transferred to a third country or to an international organization, information about that;

(g) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;

(h) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability, and where the processing is based on the data subjects consent, the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;

(i) the right to submit a complaint with the supervisory authority;

(j) whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data;

(k) if the Data Controller intends to perform further data processing for a purpose other than the original purpose of the data processing, the relevant information about that.

If the Data Controller does not obtain the personal data directly from the data subject, the Data Controller shall provide the information in points (a) to (k) above, indicating the source of the personal data, within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circumstances in which the personal data are processed. If the Data Controller uses personal data for the purpose of contacting the data subject, the information shall be provided at the time of the first contact with the data subject. If the Data Controller is expected to transfer the data to another data controller (recipient), the information shall be provided to the data subject at the latest when the personal data is disclosed for the first time.

The data subject has three rights under the right of access:

a) Right to get information – the data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

(a) the purposes of the processing;

(b) the categories of personal data concerned;

(c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

(d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

(e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;

(f) the right to lodge a complaint with a supervisory authority;

(g) where the personal data are not collected from the data subject, any available information as to their source;

(h) the existence of automated decision-making, including profiling, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

b) Right to request a copy – the controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form. Please note that the right to request a copy does not apply to the document containing the data, but only to the data.

c) Right of access - if the circumstances of the data processing allow it, the data subject may request that the Data Controller allow access to the personal data processed about him / her (eg a database or a camera image). The Data Controller is obliged to ensure this right in such a way that the rights of another person cannot be violated. If the Data Controller is unable to provide this due to the circumstances of the data processing, it shall not allow the data subject to access the personal data.

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her (right to rectification). Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement (right to supplement personal data). If the data subject requests the supplementation of his / her personal data, but the purpose of the processing of personal data does not justify the processing of such data, the Data Controller shall refuse to comply with the request for the supplementation of personal data. The Data Controller shall inform the data subject of the modification or supplementation after the fulfillment of the request.

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

(a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

(b) the data subject withdraws consent on which the processing is based and where there is no other legal ground for the processing;

(c) the data subject objects to the processing and there are no overriding legitimate grounds for the processing;

(d) the personal data have been unlawfully processed;

(e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;

We would like to inform you that if you submit a request for deletion of data during the period when the Data Controller is obliged to process personal data, the Data Controller will refuse to comply with the request for deletion in accordance with Article 17 (3) (b) of the GDPR. If the processing of personal data is necessary for the for the establishment, exercise or defence of legal claims, the Data Controller shall refuse the request in accordance with Article 17 (3) (e) of the GDPR. We would like to inform you that the Data Controller will assess your request for the deletion of personal data on a case-by-case basis, examining whether the request can be complied with or whether there are any circumstances to refuse the request.

The Data Controller shall notify the data subject in writing, in a documented manner, of the assessment of the application and the measures taken as a result thereof, as well as to all persons to whom the data have previously been transmitted for the purpose of data processing.

The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies

(a) the accuracy of the personal data is contested by the data subject. In this case, the restriction applies to the period of time that allows the controller to verify the accuracy of the personal data;

(b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;

(c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; or

(d) the data subject has objected to the processing (see the information on the right to object in point 7 below). In that case, the restriction shall apply for as long as it is established whether the legitimate reasons of the controller take precedence over the legitimate reasons of the data subject.

Where data processing has been restricted, such personal data shall, with the exception of storage, only be processed with the data subject's consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where the data processing is based on consent of the data subject [point (a) of Article 6 (1) or point (a) of Article 9(2)] or on a contract [point (b) of Article 6(1)] and the processing is carried out by automated means.

Within the framework of the right to data portability, the data subject also has the right to request the transfer of his or her personal data to another data controller. The Data Controller shall comply with the data subject's request only if he or she identifies the recipient in an identifiable manner and also indicates the contact details to which he or she requests the transfer of personal data. The Data Controller is not responsible for the data processing performed by the Recipient after the transfer of personal data.

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. Information on the legal basis of data processing is contained in the individual Privacy Policy for the given data processing. If the data processing is not based on point (e) or (f) of Article 6(1) GDPR, the data subject does not have the right to object. The request submitted in such a case shall not be complied with by the Data Controller.

If the data subject has lawfully exercised his or her right to object, the controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. In each case, the Data Controller shall individually examine the request submitted by the data subject and whether the continuation of data processing is justified or the deletion of personal data is necessary.

If the data processing is based on the data subject's consent [in accordance with Article 6 (1) (a) GDPR or, in the case of special data, Article 9 (2) (a) GDPR], the data subject has the right to withdraw it at any time without restriction. The data subject may not dispute the lawfulness of the data processing carried out by the Data Controller before the withdrawal of the consent. In the event of the withdrawal of consent, the Data Controller shall delete the personal data of the data subject, unless the data controller ensures the lawfulness of the data processing on another legal basis and informs the data subject thereof.

The data subject may submit a complaint against any decision of the Data Controller or, if the data subject experiences an infringement, with the Hungarian National Authority for Data Protection and Freedom of Information at any of the following contact details:

In case of violation of the rights of the data subject, or if he / she does not agree with the decision of the Data Controller he / she may appeal directly to the court.

However, we recommend to submit your request to the Data Protection Officer of the Data Controller at the e-mail address adatvedelem [KUKAC] mav-start.hu, if you have any comments or objections regarding the processing of your personal data.