This privacy notice (hereinafter: Notice) provides information regarding the processing of personal data carried out by Mito Group Zrt. as data controller (hereinafter: Data Controller or Mito), in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: GDPR), as well as Act CXII of 2011 on the right to informational self-determination and on the freedom of information.

This Notice applies to the processing of personal data of the Mito Weekly newsletter subscribers and respondents  during the feedback process related to the Mito Weekly (hereinafter: Data Subjects).

1. Who is the data controller?

Name of Data Controller: Mito Group Zrt.

Registered seat: 1053 Budapest, Károlyi utca 9.

Company registration number: 01-10-140905

Tax number: 27989485-2-41

If you would like to contact us related to data protection questions, please contact us at dpo@mito.hu 

2. Principles

• Mito is committed to protecting your personal data and processing it lawfully.
• We process your data fairly and lawfully, to the extent and for the time strictly necessary to achieve the purpose.
• Where the nature of the processing allows, we provide you with simple and effective choices about your data.
• We carefully select our partners and suppliers who are involved in the personal data processing and we only transfer personal data to our partners in accordance with the content of this privacy policy, applying legal and technical safeguards.
• We apply appropriate technical and organizational measures to protect your personal data from unauthorized access, use, modification or deletion.
• Data protection aspects are always taken into account when planning our processes (data protection by design).
• We also aim to ensure that our measures protect data as much as possible when we have to balance data protection with other obligations.

3. Purpose, legal basis, duration of processing, and the scope of processed data

We process the following personal data of contact persons for the purposes, on the legal bases, and for the retention periods specified below:

1. Newsletter Subscription

Processed data:

Full name, e-mail address,

Purpose of processing:

Newsletter sending

Legal basis:

Article 6(1)(a) of the GDPR: the consent of the data subject.

Where processing is necessary for the establishment, exercise or defence of legal claims, the legal basis is the legitimate interest of the Data Controller pursuant to Article 6(1)(f) of the GDPR

Duration of processing:

Until the withdrawal of consent or the period needed to exercise legal claims or defence.

2. Newsletter feedback

Processed data:

Content of feedback

Purpose of processing:

Based on the feedback, we prepare statistical analyses regarding the newsletter's readership and the popularity of topics to ensure we send content that meets the majority of needs in the future.

Legal basis:

Article 6(1)(a) of the GDPR: the consent of the data subject.

Duration of processing:

Until the withdrawal of consent.

The questionnaire is anonymous: the Data Controller does not request the respondent’s name, e-mail address or any other identifying information, and responses cannot be linked to individual subscribers. Responses are analysed exclusively in an aggregated, statistical form, and no conclusions concerning identifiable individuals are drawn from them. The Data Controller does not carry out automated decision-making or profiling in connection with the questionnaire.

The questionnaire contains free-text fields. Respondents are kindly asked not to enter any personal data (their own or anyone else’s) in these fields. If personal data is nevertheless provided, the Data Controller will delete it without undue delay upon becoming aware of it, without analysing or otherwise using it. The legal basis for this limited processing (i.e. deletion of incidentally provided personal data) is the legitimate interest of the Data Controller in enforcing the principle of data minimisation, pursuant to Article 6(1)(f) of the GDPR.

The questionnaire is hosted by Google Forms, a service provided by Google Ireland Limited. Google may independently collect technical data (such as cookie data) in connection with the use of the form, as a separate data controller. For information on Google’s own data processing, please refer to Google’s privacy policy at https://policies.google.com/privacy 

Providing data for the subscription or feedback is entirely voluntary. Should you choose not to complete the questionnaire, it will have no adverse consequences for you.

Furthermore, you may withdraw your consent for data processing at any time by sending a declaration to the dpo@mito.hu email address.

Please be informed that during the management of feedback, Mito does not apply automated decision-making based solely on automated data processing under Article 22 of the GDPR, nor does it conduct profiling. Responses are analyzed in an aggregated manner for the purpose of assessing reader needs, and no personal or behavioral conclusions regarding the Data Subjects are drawn from them.

4. Data Processors

Name of company:

Sinch AB

Registered office:

Lindhagensgatan 112, 112 51 Stockholm, Sweden

Privacy policy:

https://www.mailjet.com/legal/privacy-policy/ 

Activity:

data storage, compilation of newsletters, monitoring, compilation of statistics

Name of company:

Google Ireland Limited

Registered office:

Gordon House, Barrow Street, Dublin 4, Ireland

Privacy policy:

https://policies.google.com/privacy 

Activity:

hosting of the subscriber questionnaire (Google Forms), data storage

5. Data transmission

In order to carry out certain activities and data processing purposes, or to comply with our legal obligations, in some cases it is necessary to transfer your personal data to third parties.

These can be:

• State or municipal bodies, courts or other authorities,
• Our payroll and accounting partners,
• Our law firm partners within the framework of legal services,
• If necessary, our partners who provide services to Mito (e.g. post or courier services),
• IT service providers (e.g. Google, service providers who store our data),
• At your request, other third parties.

If the data transfer is not necessary for the fulfilment of a legal obligation or a court/authority decision, we will always transfer your data on the basis of a data processor or joint controller contract in accordance with the law. These contracts ensure that your data is safe even in the event of a transfer.

Where we transfer your personal data to a country outside the European Economic Area (e.g. the data is stored on servers and data centres outside the EEA), we ensure an adequate level of data protection in accordance with the applicable laws. Unless the country in question is subject to an adequacy decision by the European Commission (such as the EU-U.S. Data Privacy Framework), we ensure the appropriate level of security, among other measures, through the application of Standard Contractual Clauses (SCCs) approved by the competent authorities, and by prescribing appropriate technical and organizational measures.

6. Your rights in relation to your data

You have several rights in relation to your personal data, which you can exercise by sending an inquiry to dpo@mito.hu email address.

Your rights are:

• Right of access: you can request information about the data we process about you and we will provide you with a copy of it upon your request.
• Right to correct or update your data: you have the right to request the correction of your personal data held by us if they are inaccurately recorded in our systems.
• Right to object: you have the right to object to the processing of your personal data in cases where the processing is based on Mito's legitimate interest.
• Right to erasure: in some cases, you have the right to request that we erase the personal data we hold about you.
• Right to the restriction of data processing: subject to the conditions set out in the applicable legislation, you may request the restriction of the processing of your personal data.
• Right to data portability: in certain cases, you have the right to carry the personal data you have provided to us, in which case we will provide it to you in electronic form.

If you request to exercise your rights, we will investigate it without delay and comply with it or inform you of the reason for any rejection within one month.

7. Legal remedy

Should you have any questions, complaints, or concerns regarding the processing of personal data, it is advisable to consult with us before initiating any administrative or judicial proceedings, as all information related to the data processing is fully available at Mito.

If you consider that the processing of your personal data has violated the applicable data protection requirements, you may initiate proceedings with the Hungarian data protection authority, whose contact details are as follows:

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)

Address: 1055 Budapest, Falk Miksa utca 9-11.

Postal address: 1363 Budapest, Pf. 9.

Phone: + 36 (1) 391 1400

E-mail: ugyfelszolgalat@naih.hu 

Website: www.naih.hu

Furthermore – independently of your right to lodge a complaint as indicated above – you may also seek a judicial remedy; the adjudication of such lawsuits falls within the competence of the regional courts (törvényszék). At your discretion, the statement of claim may also be filed before the competent regional court of your domicile or place of residence.