Data processing notice
For clients, suppliers, service providers and subcontractors
Valid from: 16 February 2023
The purpose of this notice is to provide information on the data processing practices followed and applied by BlackBelt Technology Zrt. (BlackBelt or Data Controller) in connection with the management of its client, supplier, service provider and subcontractor contracts.
This notice refers to BlackBelt's Data Protection and Data Security Policy. The current version of the policy is available in printed form at the reception of the Budapest office, and is also available electronically to our subcontractors on the “Sanctuary” internal portal.
Data Controller's details and contact information
BlackBelt Technology Zrt.
Registered office: 1027 Budapest Ganz utca 16. Residence office building 3rd floor
Central telephone number: +36 1 611 0462
E-mail address: info@blackbelt.hu; dataprotection@blackbelt.hu
Website: www.blackbelt.hu
The Data Controller designates Róbert Sövegjártó as the contact person for data subjects.
What personal data do we process?
The Data Controller collects data primarily from the data subject. Data may be collected in person or by telephone contact by an employee of the Data Controller, or may be transferred to us by your employer, contractual partner or advisor (by third parties).
Such personal data include, for example:
• surname and first name
• mother's name
• place and date of birth
• tax identification number
• occupation (position), general contact details (work or home address, personal or work e-mail address and telephone number);
• bank account number (if the client/contracting party/subcontractor/supplier is a natural person);
• taking, storing and using photo and audio recordings at events / trainings related to BlackBelt for the purpose of developing BlackBelt's employer brand and for marketing purposes
• taking, storing and using photo and audio recordings of those attending the events (and, where applicable, family members not in a legal relationship with BlackBelt), with due regard to the personality rights of the data subjects, for the purpose of developing BlackBelt's employer brand and for marketing purposes.
We do not process your personal data for marketing purposes without your explicit consent; however, in the course of processing personal data for the Purposes, we may ask for such consent.
Purpose and duration of data processing
• conclusion of contracts; (for the administration of a contract concluded with you personally or for the purpose of concluding a contract with you)
• compliance with applicable legal and regulatory requirements;
• fulfilment of the requirements and information requests of the competent authorities;
• general contract administration, financial accounting activities (invoicing) and statistics;
• internal compliance and risk analysis (e.g. investigation or prevention of security incidents);
• protection of our rights and legitimate interests.
• general client, supplier or subcontractor contractual relationship purposes (e.g. feedback and complaints, as well as assessing and developing business opportunities);
• protection of our business interests (e.g. carrying out our risk assessment and quality assurance processes),
• use of internal or hosted (cloud-based) IT systems, services and applications (for communication, data sharing and archiving purposes).
We retain your personal data for 10 years following the provision of services to our clients or the termination of contracts concluded with our suppliers, service providers or subcontractors, or for the period specified in the relevant laws and regulations, or for the period required by BlackBelt's legitimate interest.
Legal basis for data processing
We process your data on the legal basis of the conclusion, performance and possible termination of a contract, and in order to comply with the relevant statutory provisions. (Laws relating to accounting and taxation.)
Data processing is necessary for the performance of the contract and for payment (including any other contract relating to the performance of work).
In addition to the above, during the existence of the contractual relationship and following its termination:
• the processing of personal data relating to contact is based on the legitimate interest of the Data Controller,
• taking, storing and using photo and audio material during participation in events / trainings organised by BlackBelt on the website and social media platforms managed by BlackBelt is based on the legitimate interest of the Data Controller.
• taking, storing and using photo and audio material during participation in non-mandatory events / trainings on the website and social media platforms managed by BlackBelt is based on consent given on the basis of prior information.
The data subject has the right to object to data processing based on the legitimate interest of the Data Controller.
In the case of data processing based on consent, the data subject is entitled to withdraw their consent at any time; however, the withdrawal of consent does not affect the lawfulness of data processing prior to the withdrawal.
Possible consequences of failure to provide data
The provision of data is required by law for the conclusion and performance of the contract and by contract for payment. If you do not provide the data, the conclusion and performance of the contract is not possible.
Data transfer
• When preparing tenders: in order to demonstrate compliance with the tender conditions, the Data Controller transfers the following data of yours: CV, exam identifiers, numbers of documents certifying qualifications. (In the case of subcontractors)
• When applying for positions advertised by clients, your data is transferred on the basis of your consent given following prior information (in the case of subcontractors).
• Basis for data provision to the tax authority: Act CL of 2017 on the Rules of Taxation.
Data transfer to our contracted partners
• Recruitee BV (Keizersgracht 313 1016 EE Amsterdam, the Netherlands) data processor
• Accounting: Memolux Kft. (Registered office: 1113 Budapest, Karolina út 65 II.) data processor
• English language training – Élő Nyelvek Szemináriuma Kft. (1053 Budapest, Fejér György u.8) independent data controller
• Perbit HR Magyarország Kft. (Registered office: 1116 Budapest, Alabástrom u. 43.) independent data controller
• TPAX Kft. (1119 Budapest, Allende park 10.1em.6) (data processor) IT services (setting up access to systems) data processor
• Google WorksPlace service provider – FOTC, authorised sales intermediary of Google Ireland Limited, Gordon House Barrow Street, Dublin 4, Ireland (hereinafter: Google), data processor
• HubSpot CRM system
https://www.privacyshield.gov/participant?id=a2zt0000000TN8pAAG&status=Active
on the basis of (Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC)
Automated decision-making
Please note that the Data Controller does not carry out automated decision-making.
Use of a CCTV system
BlackBelt operates an electronic surveillance system (area monitoring) in its offices at its registered office (1027 Budapest, Ganz utca 16 3rd floor) and at its site (8000 Székesfehérvár, Had utca 1-3. 2nd floor 209). The location, purpose, field of view and operating time of the cameras are set out in its Data Protection and Data Security Policy. The information relating to data processing is summarised below.
Purpose and duration of data processing
The purpose of data processing is to ensure the effective protection of persons, property, business secrets and data, and to enable or facilitate the detection and proof of infringements.
Duration of data processing
Recordings made by the cameras are stored and retained for 30 calendar days from the date of recording, after which they are automatically deleted. Except where requested for official use, in which case the retention period is extended to 60 days.
Legal basis for data processing
It is based on the legitimate interest of the Data Controller.
Scope of data processed
The facial image and conduct of persons moving in the area monitored by the surveillance system.
Place of storage of the recordings
BlackBelt's office at 1027 Budapest, Ganz utca 16., closed server room.
Persons authorised to access the data
The representative of the Data Controller and the person authorised by them may view the recordings in the event of an extraordinary event or suspicion of a criminal offence.
Data transfer
In the event of a criminal offence, at the request of the authorities, to the Police or the Public Prosecutor's Office.
Data security measures
• The recording unit is located in a closed server room on a separate device.
• Recordings are automatically deleted after 30 days, and in the event of use we ensure their deletion manually.
Rights and remedies of persons recorded by the cameras
A) Rights: The person appearing in the recording may request in writing from BlackBelt's representative information on the processing of their personal data, and may request the deletion or blocking of their data and the viewing of the recordings.
• Requesting information on data processing:
They may request information on the purpose, legal basis and duration of data processing, other circumstances of data processing, and what can be seen in the recording in connection with them.
BlackBelt is obliged to provide the information in writing within the shortest possible time from the submission of the request, but no later than within 25 days.
• Deletion and blocking of data:
Within 25 days of the recording, the requester may request that the recordings not be deleted and that the Data Controller block the recordings.
• Viewing the recordings:
Only the recording covering the period during which the requester was in the area monitored by the camera and their image and actions were recorded may be viewed.
B) Enforcement of rights
• Complaint:
If the person appearing in the recording considers that BlackBelt has violated any statutory provision relating to data processing, in order to terminate the allegedly unlawful data processing they may
• lodge a complaint addressed to BlackBelt's representative, or
• turn to the NAIH (as the authority).
• Court:
In the event of a violation of their right to informational self-determination, the data subject may turn to the regional court competent according to BlackBelt's registered office or, at their choice, according to their place of residence or stay.
Rights of data subjects and conditions for exercising them
The data subject may request information on the processing of their personal data, and may request the rectification of their personal data or – with the exception of data processing ordered by law – their deletion in the manner indicated at the time of data collection, or electronically by sending a message to the e-mail address info@blackbelt.hu.
Right to information
At the request of the data subject, the Data Controller provides information on the data of the data subject processed by it or by the data processor engaged by it, their source, the purpose, legal basis and duration of data processing, the name and address of the data processor and its activities related to data processing, and – in the case of transfer of the data subject's personal data – the legal basis and recipient of the data transfer.
The Data Controller shall provide the information in writing, in an intelligible form, within the shortest possible time from the submission of the request, but no later than within 30 days. The information is free of charge if the person requesting the information has not yet submitted a request for information to the Data Controller for the same data set in the current year. In other cases, reimbursement of costs may be charged. The Data Controller may refuse to provide information to the data subject only in the cases specified by law.
In the event of refusal to provide information, the Data Controller shall inform the data subject in writing of the provision of the Info Act on the basis of which the information was refused. In the event of refusal, the Data Controller shall inform the data subject of the possibility of judicial remedy and of turning to the Hungarian National Authority for Data Protection and Freedom of Information (hereinafter: Authority).
Right to rectification
If the personal data does not correspond to reality and the personal data corresponding to reality is available to the Data Controller, the Data Controller shall rectify the personal data.
Right to erasure
Personal data must be erased if its processing is unlawful; if the data subject requests it (with the exception of mandatory data processing); if it is incomplete or incorrect – and this cannot be lawfully remedied – provided that erasure is not excluded by law; if the purpose of data processing has ceased or the statutory period for storing the data has expired; or if it has been ordered by a court or the Authority.
Right to restriction of processing
Instead of erasure, the Data Controller shall block the personal data if the data subject so requests, or if, on the basis of the information available to it, it can be assumed that erasure would harm the legitimate interests of the data subject. Personal data blocked in this way may be processed only as long as the purpose of data processing that excluded the erasure of the personal data exists.
The Data Controller shall mark the personal data it processes if the data subject disputes its correctness or accuracy, but the incorrectness or inaccuracy of the disputed personal data cannot be clearly established.
Notification obligation regarding rectification or erasure of personal data or restriction of processing
The Data Controller shall notify the data subject of the rectification, restriction and erasure. Notification may be omitted if, in view of the purpose of data processing, it does not harm the legitimate interests of the data subject.
If the Data Controller does not comply with the data subject's request for rectification, restriction or erasure, it shall communicate in writing, within 30 days of receipt of the request, the factual and legal reasons for rejecting the request for rectification, restriction or erasure. In the event of rejection of the request for rectification, erasure or restriction, the Data Controller shall inform the data subject of the possibility of judicial remedy and of turning to the Authority.
Right to object
The data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of their personal data where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller, or for the purposes of the legitimate interests pursued by the Data Controller or a third party.
In the event of an objection, the Data Controller shall no longer process the personal data unless it is justified by compelling legitimate grounds which override the interests, rights and freedoms of the data subject, or which relate to the establishment, exercise or defence of legal claims.
The Data Controller shall examine the objection within the shortest possible time from the submission of the request, but no later than within 15 days, make a decision on its merits, and inform the requester of its decision in writing.
If the Data Controller establishes that the data subject's objection is well-founded, it shall terminate the data processing – including further data collection and data transfer – and block the data, and shall notify of the objection and the measures taken on its basis all those to whom it previously transferred the personal data concerned by the objection and who are obliged to take measures to enforce the right to object.
If the data subject does not agree with the decision taken by the Data Controller, or if the Data Controller fails to meet the deadline prescribed by law, the data subject may – within 30 days of the communication of the decision or of the last day of the deadline – turn to the court. The Data Controller may also summon the data subject to the proceedings. The Data Controller may not erase the data subject's data if the data processing was ordered by law.
However, the data may not be transferred to the data recipient if the Data Controller agreed with the objection or the court established the justification of the objection.
Right to data portability
The data subject has the right to receive the personal data concerning them, which they have provided to the Data Controller, in a structured, commonly used and machine-readable format, and to transmit those data to another data controller.
Right to legal remedy
In the event of a violation of their rights, the data subject, and in the cases specified by law the data recipient, may take legal action against the Data Controller. The court shall handle the case as a matter of priority.
If the data subject has suffered material or non-material damage as a result of a breach of the data protection regulation, they are entitled to compensation from the Data Controller or the data processor for the damage suffered. The Data Controller or the data processor shall be exempt from liability if it proves that the damage was caused by an unavoidable cause outside the scope of data processing. The damage need not be compensated to the extent that it resulted from the intentional or grossly negligent conduct of the injured party.
Submitting an objection or complaint does not affect the data subject's other rights regulated by data protection legislation. The data subject may lodge a complaint:
• by letter addressed to BlackBelt's representative (Address: 1027 Budapest Ganz utca 16, e-mail: info@blackbelt.hu or dataprotection@blackbelt.hu) (We would appreciate it if you contacted us first to clarify your matter)
• with the Hungarian National Authority for Data Protection and Freedom of Information (Address: 1055 Budapest, Falk Miksa utca 9-11, tel.: 06-1/391-1400, e-mail: ugyfelszolgalat@naih.hu, website: www.naih.hu),
• or may turn to the court.
Access to data, data security measures and incident management
Access to data and data transfer
BlackBelt employees may access the personal data provided by the data subject in order to perform their duties. In particular, in the Human Resources area, the HR Specialist and the HR Manager for case management purposes; sales and marketing colleagues for organising and delivering the service; the finance officer for performing the necessary administrative activities; and, in addition, the legal representative, where necessary and indispensable in the given case.
The Data Controller may transfer personal data to state bodies only in exceptional cases. This is the case, for example, if court proceedings are initiated in a matter concerning the data subject and the court needs the documents containing the data subject's personal data, or if the police contact the Data Controller and request the transfer of documents containing the data subject's personal data for an investigation.
BlackBelt's managing director determines the organisation of data protection, the tasks and powers relating to data protection and related activities, and designates the person responsible for supervising data processing.
In the course of their work, BlackBelt employees ensure that personal data is stored and kept in such a way that it cannot be accessed, altered or destroyed by unauthorised persons.
Data security measures
The Data Controller takes the necessary technical and organisational measures and has established appropriate procedural rules to ensure the security of personal data throughout the entire data processing process.
For the processing of personal data, the Data Controller selects and operates the IT tools used in such a way that the processed data:
• is accessible only to those authorised to access it (availability);
• its authenticity and authentication are ensured (authenticity of data processing);
• its integrity can be verified (data integrity);
• is protected against unauthorised access (data confidentiality).
The Data Controller:
• protects the data with appropriate measures against accidental or unlawful destruction, loss, alteration, damage, unauthorised disclosure or unauthorised access,
• restricts access to personal data by granting authorisation levels,
• protects its IT systems with a firewall and provides them with virus protection,
• in electronic data processing, ensures that the data can be accessed only for a specific purpose, under controlled circumstances, and only by those persons who need it to perform their duties,
• in order to protect the data files processed electronically in its various records, ensures by appropriate technical solutions that the stored data – unless permitted by law – cannot be directly linked and assigned to the data subject.
Taking into account the state of the art, the Data Controller ensures the security of data processing through technical, organisational and structural measures that provide a level of protection appropriate to the risks associated with data processing.
The Data Controller keeps a record of any personal data breaches, indicating the facts relating to the personal data breach, its effects and the measures taken to remedy it.
The Data Controller shall notify any personal data breach to the Hungarian National Authority for Data Protection and Freedom of Information without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.
Personal data breach
An incident is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.
What may constitute a personal data breach? For example, the loss of a technical device, e.g. a laptop or mobile phone, containing personal data, but also the mistaken sending of a letter containing personal data to an unauthorised person, placing documents containing personal data in the bin without shredding, a ransomware attack, data loss or unauthorised access to stored personal data, etc.
In the absence of appropriate and timely measures, a personal data breach may cause physical, material or non-material damage to natural persons, including loss of control over their personal data or limitation of their rights, identity theft, identity fraud, financial loss, damage to reputation, loss of confidentiality of data, etc.
If you detect an incident, please report it as soon as possible to the data protection coordinator and/or the representative of the Data Controller so that we can take the necessary steps as soon as possible!
Confidentiality and data protection in contracts
• In the course of the legal relationship established between BlackBelt and the Contractor, BlackBelt obliges the Contractor to handle certain information disclosed to it and to be disclosed in the future, in particular business plans, trade secrets, client data and other proprietary information, as well as personal data falling under the scope of the Infotv. (collectively: information), in accordance with BlackBelt's Data Protection and Data Security Policy.
• The Contractor declares that it has read BlackBelt's Data Protection and Data Security Policy.
• The Contractor undertakes to comply with the principles set out in BlackBelt's Data Protection and Data Security Policy in force from time to time, to ensure their compliance by its employees and/or agents and subcontractors working on the project, and, upon BlackBelt's request to this effect, to make the undertaking under this point in a separate declaration as well.
If the Contractor does not handle the information in accordance with the Data Protection and Data Security Policy, it shall become an independent data controller under the GDPR and the Infotv.; in fulfilling the rights and obligations relating to data processing, the Contractor shall take the place of BlackBelt as data controller, and at the same time the Company shall become entitled to terminate its legal relationship with the Contractor with immediate effect.
If you have any questions, please feel free to contact
our data protection coordinator (dataprotection@blackbelt.hu) or
our contact person designated for data subjects. (info@blackbelt.hu)