Part I
General provisions

The National Research, Development and Innovation Office as data controller (hereinafter: NRDI Office or Controller) operates a website (hereinafter: Website) called Top Research Infrastructures in Hungary (researchinfrastructures.hu). The English-language website functions as a collection portal of Hungary’s research infrastructures, which are outstanding in international comparison, and aims to promote Hungarian research capacities and potential in international scientific fora, and to increase the intensity of research cooperation. In the course of the operation of the Website, the NRDI Office intends to collect personal data from the readers of the Website who, after personal registration, wish to use certain services provided by the NRDI Office through the Website, as referred to below (hereinafter: data subjects). The personal data provided by the data subjects during registration will be processed by the Controller in accordance with the applicable data protection provisions.

The NRDI Office is committed to protecting the personal data of the data subjects concerned by its processing, and attaches the utmost importance to respecting the right to informational self-determination of the data subjects. The NRDI Office treats personal data confidentially and takes all security, technical and organisational measures to guarantee the security of the data.

This Data Protection Policy sets out the rules on the protection of natural persons with regard to the processing of personal data and on the free flow of personal data. The Data Protection Policy applies to the data processing activities described below in the operation of the Website.

In the course of any data processing activities in connection with the operation of the Website, the Controller shall treat the personal data processed in accordance with Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (hereinafter: Infotv.) and in accordance with the resolutions issued by the President of the National Authority for Data Protection and Freedom of Information, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation; hereinafter: GDPR).

The purpose of this Data Protection Policy is to facilitate the lawful and secure processing of the personal data of registered readers in connection with the operation of the Website and to protect the fundamental rights and freedoms of data subjects in this regard. 

1. CONTROLLER

National Research, Development and Innovation Office (NRDI Office)

Seat:	1077 Budapest, Kéthly Anna tér 1.
Mailing address:	1438 Budapest, POB: 438
Central phone number:	(+36 1) 795 9500
Central email addresses:	nkfihivatal@nkfih.gov.hu kommunikacio@nkfih.gov.hu
Internet:	http://www.nkfih.gov.hu
Representative:	Adam Kiss, President

The Controller acknowledges that it is bound by this Data Protection Policy. In all data processing activities related to the operation of the Website, the Controller aims to comply with the requirements set out in this Data Protection Policy, the NRDI Office’s General Data Protection Policy and internal rules, as well as the applicable legislation.

2. NAME AND CONTACT DETAILS OF THE DATA PROTECTION OFFICIER

Data protection officer of the NRDI Office: Dr. Gyula Csaba Gór
Direct contact details:
Email address: adatvedelmitisztviselo@nkfih.gov.hu
Phone number: +36 20 480 4365

3. PROCESSOR

The NRDI Office uses a data processor to operate the Website. The processor contracted by the Controller is the following:

Activity	Name/Company name	Seat
Website developer and operator	Webra International Kft.	1051 Budapest, Sas utca 10-12. B. ép. 145-146.

4. DISCLOSURE

This Data Protection Policy of the NRDI Office in relation to the operation of the Website is permanently available at https://researchinfrastructures.hu.

5. AMENDMENT AND SCOPE OF THIS PRIVACY POLICY

The NRDI Office reserves the right to unilaterally amend this Data Protection Policy without any time limitation, provided that any amendments are notified to the data subjects in due time and manner. Amendments to the Data Protection Policy may be necessary primarily to comply with the law.

This Data Protection Policy is valid until revoked and applies to all persons who browse and use the services of the Top Research Infrastructures in Hungary (researchinfrastructures.hu) website of the NRDI Office, as well as to the officers, employees and Data Protection Officer of the NRDI Office and the Processor and its officers, employees and Data Protection Officer. 

This Data Protection Policy is in force together with and supplements the General Data Protection Policy of the NRDI Office. Matters not covered herein shall be governed by the General Data Protection Policy of the NRDI Office.

Part II
Definitions

For the purposes of this Data Protection Policy:

• Research infrastructures shall mean the totality of equipment, laboratories, data banks, information systems, related human capacities (including researcher, operative, maintenance and management capacities), expertise and services supporting scientific activity which thematically match or form a single thematic unit and which are necessary for high quality, internationally competitive research work.
• Top Research Infrastructure in Hungary: a research infrastructure selected and qualified as excellent by the National Research Infrastructure Committee.
• Data Subject: a natural person visiting the Top Research Infrastructures in Hungary (researchinfrastructures.hu) website who provides the Controller with personal data for the purpose of using the services of the Website. 

In addition to the above, this Data Protection Policy uses the terms defined and used in the Infotv., the GDPR and the NRDI Office’s General Data Protection Policy

Part III
Data processing related to the operation of the Website

1. COOKIE MANAGEMENT

Since natural persons can be associated with online identifiers provided by the devices, applications, tools and protocols they use, this data, combined with other information, can be used to profile and identify natural persons.  

The websites operated by the NRDI Office, including the Top Research Infrastructures in Hungary website, use cookies to ensure proper operation and enhance the user experience. When visiting the Website, a small block of data (a cookie) is automatically placed on the computer, notebook or other mobile device (hereinafter: device) of the user

There are two types of cookies: session cookies and persistent cookies.

• A session cookie is stored only temporarily on the device of the data subject to prevent data loss. This cookie helps the system to remember information so that users do not have to enter or fill in the information again. The session cookie’s validity is limited to the user’s current session only, and this type of cookie is automatically deleted from the user’s device when the session ends or the browser is closed.
• Persistent cookies are stored on the user’s device even after leaving the Website. These cookies allow the Website to recognise users as a returning visitors. Persistent cookies can be used to identify the data subject by associating the server-side identifier with the data subject (user), so in all cases where the authentication of the data subject is essential, this is a necessary condition for correct operation. Persistent cookies do not carry any personal data on their own and can only be used to identify the data subject (user) in combination with the assemblage stored in the server’s database. The risk of such cookies is that they do not actually identify the user, but the browser.

The NRDI Office’s servers automatically register (log) the IP address of users, the type of operating system and browser program used, the URL of the pages visited and the time of the visit at each access level of the Website. These data are processed by the NRDI Office only in aggregated, anonymised and processed form in order to improve the quality of the Website, to correct possible errors and for statistical purposes.

2. DIRECT CONTACT VIA THE CONTACT FORM ON THE RESEARCHINFRASTRUCTURES.HU WEBSITE

Visitors to the Website can use the form in the “Contact” menu to contact us directly in order to receive feedback and answers to their questions about the Top Research Infrastructures (researchinfrastructures.hu) in the shortest possible time. To this end, their names and email addresses are recorded.

Scope of personal data processed	Legal basis	Purpose	Duration of data processing
Name, email address	Consent of the data subject (Article 6(1)(a) of the GDPR)	Provision of a direct inquiry service to the data subject	Until 30 days after answering the question

The data processing requires the provision of the name and email address. If these data are not provided, the data subject cannot use the direct inquiry service.

By submitting a contact form, users of the direct inquiry service accept the terms of this Data Protection Policy.

3. NEWSLETTER SERVICE

In the “Contact” menu of the Website users can subscribe to thematic newsletters on Top Research Infrastructures to keep updated on the relevant news and events. To this end, their names and email addresses are recorded.

Scope of personal data processed	Legal basis	Purpose	Duration of data processing
Name, email address	Consent of the data subject (Article 6(1)(a) of the GDPR)	Provision of a newsletter service to the data subject	Until the data subject unsubscribes from the newsletter service

For data processing, the name and email address of the indicated personal data must be provided; in case of failure to provide the data, the newsletter service cannot be used.

Subscribers to the newsletter service accept the terms of this Data Protection Policy by checking the box upon registration. After submitting the registration request, the data subject receives a confirmation email to the email address provided by them, which will activate the registration. If confirmation is not received within 24 hours, the registration process will be restarted.

To unsubscribe from the newsletter service send an email to any of the email addresses indicated in this Data Protection Policy (kommunikacio@nkfih.gov.hu, nkfihivatal@nkfih.gov.hu) or by post to the headquarters of the NRDI Office (1077 Budapest, Kéthly Anna tér 1.). Upon receipt of the confirmation message, the Controller promptly takes measures to delete the personal data processed on the basis of the data subject’s consent and to terminate the processing.

4. ORGANISATION AND DOCUMENTATION OF EVENTS RELATED TO TOP RESEARCH INFRASTRUCTURES

4.1. Registration for an event

The NRDI Office organises events to showcase and promote the activities and results of the Top Research Infrastructures. In order to organise the events, the NRDI Office collects and manages data on the applicants for the events through its registration service, available in the “Contact” menu of the Website, at intervals adapted to the date of the event. Events are subject to pre-registration on the website.

Scope of personal data processed	Legal basis	Purpose	Duration of data processing
Name, email address	Consent of the data subject (Article 6(1)(a) of the GDPR)	Checking eligibility to participate in the event, pre-assessing the number of participants, preparing to meet demand	Within 30 days of the end of the event, the personal data provided will be deleted.

4.2. Taking photos at events and using them

The NRDI Office may take photographs of the speakers, the venue and the participants of the events it organises, which will be published on the Website and on the NRDI Office’s official website (www.nkfih.gov.hu) and occasionally in its publications and reference materials.

The processing is necessary for the performance of a public task carried out by the NRDI Office. The NRDI Office also seeks to improve the efficiency of R&D, to support the innovation activities of micro, small and medium-sized enterprises, to promote R&D and innovation and the environment in which they take place, and to raise awareness of their importance by publicising the results of its events. 

The NRDI Office will draw your attention in advance to the fact that photographs will be taken at the event and such photographs will be used in accordance with the provisions of this Data Protection Policy.

Scope of personal data processed	Legal basis	Purpose	Duration of data processing
Image of the person concerned	Performance of a task carried out by the Controller in the public interest (Article 6(1)(e) of the GDPR)	Publication of event news on the Website and on the official website of the NRDI Office (www.nkfih.gov.hu).	After the event, the photos will be published on the Website and on the official website of the NRDI Office (www.nkfih.gov.hu). The Controller will delete the photographs of the events from the Website or the official website of the NRDI Office (www.nkfih.gov.hu) only upon the express request of the data subject or in case of objection to the processing, if the Controller considers the data subject’s request to be reasonable on the basis of a balancing test.

4.3. Capturing audio recordings at events and using such recordings

The NRDI Office may make audio recordings of the events organised by the NRDI Office, which will be transcribed after the event and made available on the www.researchinfrastructures.hu and on the www.nkfih.gov.hu websites). Participants may ask questions from the speakers during the event and these questions will be recorded.

The processing is necessary for the performance of a public task carried out by the NRDI Office. The NRDI Office also seeks to improve the efficiency of R&D, to support the innovation activities of micro, small and medium-sized enterprises, to promote R&D and innovation and the environment in which they take place, and to raise awareness of their importance by publicising the results of its events. 

The NRDI Office will draw your attention in advance to the fact that audio recordings will be captured at the event and such recordings will be used in accordance with the provisions of this Data Protection Policy.

Scope of personal data processed	Legal basis	Purpose	Duration of data processing
Voice recording of the data subject	Performance of a task carried out by the Controller in the public interest (Article 6(1)(e) of the GDPR)	Recording of the event, transcription of the audio recording and publication on the website and the official website of the NRDI Office (www.nkfih.gov.hu).	The audio material will be transcribed within 30 days of the event, after which the NRDI Office will delete the audio recording and publish only the written transcript on the Website and on the NRDI Office’s official website (www.nkfih.gov.hu).

4.4. Recording and use of video recordings, and on-line broadcasting

The events of the NRDI Office are video recorded. The video recording may be published on the website and on the official website of the NRDI Office (www.nkfih.gov.hu), where it may also be broadcast live.

The processing is necessary for the performance of a public task carried out by the NRDI Office. The NRDI Office also seeks to improve the efficiency of R&D, to support the innovation activities of micro, small and medium-sized enterprises, to promote R&D and innovation and the environment in which they take place, and to raise awareness of their importance by publicising the results of its events. 

The NRDI Office will draw your attention in advance to the fact that video recordings will be captured at the event and such recordings will be used in accordance with the provisions of this Data Protection Policy.

Scope of personal data processed	Legal basis	Purpose	Duration of data processing
Video recorded image and voice	Performance of a task carried out by the Controller in the public interest (Article 6(1)(e) of the GDPR)	Publication on the Website and on the official website of the NRDI Office (www.nkfih.gov.hu), production of short videos for the purpose of informing the public.	The video recording is available to the public on the Website and on the official website of the NRDI Office (www.nkfih.gov.hu) until it is removed. The Controller will delete the video recordings of events or the part of them relating to the data subject from the Website or the official website of the NRDI Office (www.nkfih.gov.hu) only upon the express request of the data subject or in the event of an objection to the processing, if the Controller considers the data subject’s request to be reasonable. In the case of an event supported by a grant, the Controller shall process the personal data after the event until the end of the retention period applicable to the grant.

Part IV
Data Subjects’ rights and legal remedies

Data Subjects may exercise their rights under this Data Protection Policy and the law by using any of the contact details of the NRDI Office indicated herein.

1. DATA SUBJECTS' RIGHTS:

Right to withdraw consent:
In the case of processing based on consent, data subjects have the right to withdraw their consent at any time, free of charge. The terms of withdrawing consent are set out in Paragraph 2 of Part III (‘Processing of personal data’) of the NRDI Office’s General Privacy Policy.

Right to request information (right of access):
Any data subject may request information from the NRDI Office as to whether or not their personal data are being processed, what data are being processed, on what legal basis, for what purpose, from what source, for how long; and what personal data have been disclosed or transferred to whom, when and on the basis of which law.
At the data subject’s request, we will send information to the contact details provided without delay, but within a maximum of 25 days.

Right to rectification:
Any data subject may request that any of their data be amended or supplemented.
The NRDI Office will do so promptly upon the data subject’s request, but within 25 days at the latest, and will send information to the contact details provided.

Right to erasure (forgetting):
Any data subject may request the erasure of their data if
a) such personal data are no longer necessary for the purposes for which they were processed by the NRDI Office;
(b) the data subject withdraws the consent on which the processing is based and there is no other legal basis for the processing;
(c) the data subject objects to the processing and there are no other legitimate grounds for the processing;
d) such personal data have been unlawfully processed by the NRDI Office;
(e) such personal data must be erased in order to comply with a legal obligation applicable to the NRDI Office;
f) the personal data were collected in connection with the provision of information society services to children.
At the request of the data subject, the NRDI Office will do so promptly, but within a maximum of 25 days, and will send information to the contact details provided.

At the request of the data subject, the NRDI Office will do so promptly, but within a maximum of 25 days, and will send information to the contact details provided.

Right to blocking and restriction:
Any data subject may request the blocking of their data if
a) the data subject contests the accuracy of the personal data, in which case the blocking/restriction shall apply for the period of time necessary to allow the NRDI Office to verify the accuracy of the personal data;
b) the processing is unlawful and the data subject opposes the erasure of the data and requests instead the restriction of their use;
c) the NRDI Office no longer needs the personal data for the purposes of the processing, but the data subject requires them for the establishment, exercise or defence of legal claims; or
d) the data subject has objected to the processing; in this case, the restriction shall apply for the period until it is established whether the legitimate grounds of the NRDI Office prevail over the legitimate grounds of the data subject.

The blocking lasts as long as the reason stated makes it necessary to store the data.
Upon request, the NRDI Office will do so without delay, but within 25 days at the latest, and will send information to the contact details provided by the data subject.

Right to protest:
Any person may object to the processing based on the performance of a task carried out in the public interest or on the basis of a legitimate interest, using the contact details provided. In such a case, the NRDI Office may no longer process the personal data unless it can demonstrate legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
The objection will be examined within the shortest possible time from the date of the request, but no later than 15 days, a decision will be taken on the merits of the objection and the decision will be communicated to the contact details provided.

Right to data portability:
The data subject may request from the NRDI Office to receive personal data concerning them, which the data subject has provided to the NRDI Office, in a structured, commonly used, machine-readable format, and may also have the right to transmit such data to another controller, where the processing is based on the data subject’s consent or on a contract and the processing is carried out by automated means. In exercising their right to data portability, the data subject has the right to request, where technically feasible, the direct transfer of personal data between controllers.
The NRDI Office shall comply with the data subject’s request within a maximum of 25 days and shall notify the data subject by letter to the contact details provided by the data subject.

2. POSSIBILITIES TO ENFORCE RIGHTS IN RELATION TO DATA PROCESSING:

If the processing of personal data of the data subject is in breach of the GDPR or other data protection law, the data subject has the right to lodge a complaint with the National Authority for Data Protection and Freedom of Information (NAIH), which is the supervisory authority for data protection.

Contact details of the supervisory authority:
National Authority for Data Protection and Freedom of Information
Mailing address: 1363 Budapest, Pf. 9
Address: 1055 Budapest, Falk Miksa utca 9-11.
Phone: +36 (1) 391-1400
Fax: +36 (1) 391-1410
Email: ugyfelszolgalat@naih.hu
URL: https://naih.hu

If their rights are infringed, data subjects can take legal action. The court shall conduct a fast-track proceeding in the case. The data subject can, at their choice, bring the case before the court having competence over their place of residence or place of staying.