Notice on the processing of personal data

I. Please be informed that HungaroControl Hungarian Air Navigation Services Private Limited Company (seat: 1185 Budapest, Igló u. 33-35, Website: www.hungarocontrol.hu, E-mail: ais@hungarocontrol.hu, hereinafter as: HungaroControl Pte. Ltd. Co.) shall process your personal data in relation to the provision of the flight information service as follows:

1. In terms of the reporting of deviations experienced in the publications (AIP, NOTAM, Aeronautical Chart) of the Aeronautical Information Service Provider and in terms of the personal data provided upon requesting aeronautical information

Processed data: name, e-mail, phone number, the personal data provided electronically or in the postal letter, or in the “message” submitted on the sites at www.hungarocontrol.hu and ais.hungarocontrol.hu;

Legal basis of data processing:

a) in terms of recording, systematization and usage of the data: fulfilment of the legal obligation specified under AIS.OR.235 Point and AIS.TR.235 Point of Annex VI of Commission Implementing Regulation (EU) No 2017/373 laying down common requirements for providers of air traffic management/air navigation services and other air traffic management network functions and their oversight, repealing Regulation (EC) No 482/2008, Implementing Regulations (EU) No 1034/2011, (EU) No 1035/2011 and (EU) 2016/1377 and amending Regulation (EU) No 677/2011, pursuant to Article 6(1)(c) of the GDPR;
b) in terms of storage and erasure of the data: fulfilment of the legal obligation specified under AIS.OR.235 Point and AIS.TR.235 Point of Annex VI of Commission Implementing Regulation (EU) No 2017/373, pursuant to Article 6(1)(c) of the GDPR;

Source of data: letter, e-mail sent by the notifier, and the “message” submitted on the websites at www.hungarocontrol.hu and ais.hungarocontrol.hu;

Purpose of data processing:

a) to identify the sender, liaising, later identification of the origin of data,
b) fulfilment of the retaining obligation specified under AIS.OR.235 Point and AIS.TR.235 Point of Annex VI of Commission Implementing Regulation (EU) No 2017/373;

Processing method: electronic recording, systematization, storage, usage, erasure;

Data retention time: For five years following the end of the period of validity of the data provided in the notice.

Processor: in terms of the data provided under the websites at www.hungarocontrol.hu and ais.hungarocontrol.hu: BigFish Internet-technológiai Kft. (registered office: 1066 Budapest, Nyugati tér 1-2., e-mail: cafe@bigfish.hu), i.e. the entity operating the website of HungaroControl Pte. Ltd. Co.

2. In terms of the data submitted – with a purpose other than reporting deviations or requesting aeronautical information – through the website of HungaroControl Pte. Ltd. Co. (www.hungarocontrol.hu) or its subsite (ais.hungarocontrol.hu) or in e-mail:

Processed data: name, e-mail address, phone number (optional), and further personal data possibly provided in the text of the “message” (optional);

Legal basis of processing: the visitor’s consent granted by providing the data under the “Contact” menu or by sending such data in an e-mail.

Purpose of data processing: to identify the sender, liaising;

Processing method: electronic storage, systematization, use, erasure, processing actions are carried out electronically.

Data retention time: until the withdrawal of the consent but not later than for 1 year following the provision of the respective data.

Processor: in terms of the data provided under the websites at www.hungarocontrol.hu and ais.hungarocontrol.hu: BigFish Internet-technológiai Kft. (registered office: 1066 Budapest, Nyugati tér 1-2., e-mail: cafe@bigfish.hu), i.e. the entity operating the website of HungaroControl Pte. Ltd. Co.

3. In terms of the data provided upon ordering the publications of HungaroControl AIS:

Processed data: name, address, e-mail address, phone number, and further personal data possibly provided in the text of the purchase order;

Legal basis of data processing:

- a) performance of the contract established as of ordering of the publications of AIS, pursuant to Article 6(1)(b) of the GDPR;
- b) in case of further measures required due to non-performance, and other events arising upon execution of the contract, in terms of the use of the data: the legitimate interest of HungaroControl Pte. Ltd. Co. to ensure that its contractual rights are respected, pursuant to Article 6(1)(f) of the GDPR;
- c) in terms of storage of the data: fulfilment of the legal obligation of HungaroControl Pte. Ltd. Co. as per Articles 166(1) and 169(1) of Act C of 2000 on Accounting, pursuant to Article 6(1)(c) of the GDPR;

Source of data: the order submitted by the customer in e-mail or through the website at ais.hungarocontrol.hu;

Purpose of data processing:

a) fulfilment of the order,
b) in case of further measures required due to non-performance, and other events arising upon execution of the contract, in terms of the use of the data: to ensure that contractual rights of HungaroControl Pte. Ltd. Co. are respected;
c) fulfilment of the obligation to retain as per Articles 166(1) and 169(1) of Act C of 2000 on Accounting;

Processing method: electronic storage, usage, erasure;

Data retention time: nine years (pursuant to Article 169(1) of Act C of 2000 on Accounting);

4. In terms of the data provided upon subscribing to the NOTAM publications notification list through the subsite of HungaroControl at ais.hungarocontrol.hu:

Processed data: e-mail, signature;

Legal basis of data processing: the data subject’s consent granted upon subscribing to the notification list;

Purpose of data processing: to send notifications about NOTAM publications and the option of downloading documents;

Source of data: the notification list available at ais.hungarocontrol.hu;

Processing method: electronic storage, usage, erasure;

Data retention time: until the withdrawal of the consent but not later than 31 December of each year;

Processor: BigFish Internet-technológiai Kft. (registered office: 1066 Budapest, Nyugati tér 1- 2., e-mail: cafe@bigfish.hu), i.e. the entity operating the website of HungaroControl Pte. Ltd. Co.

II. Data security measures

Please be informed that the provided personal data shall be handled confidentially by the data controller and the data processor, and these personal data shall not be transferred by the data controller and the data processor to third parties without your consent and without providing prior notice thereof to you, except for the statutory data provision to authorities and other bodies based on legislation.
Please be informed that HungaroControl shall store your personal data electronically, on the servers located in its registered seat (1185 Budapest, Igló utca 33-35) and on the servers of the processor. The Company shall not use the services of other companies for storing the personal data, except the processor. In the course of processing of personal data – in line with the applicable legislation – it takes such risk proportionate administrative and technical measures that prevent unauthorized and unlawful access to and modification of the personal data and also ensure verifiability throughout the data processing actions, both in terms of the manual and the automated data processing procedures. The Company also ensures that the data stored in the different records shall not be matched in a direct manner, or identified with the individual data subjects.

III. Rights and Legal Remedies

Please be informed that you have the right to object to the processing of your personal data, if:
- a) processing of the personal data is necessary for the performance of a task carried out in the public interest or in the exercise of an official authority or processing is necessary for the enforcement of the legitimate interests of the data controllers or any third parties.
- b) processing of the personal data is carried out for direct marketing purposes or profiling with a direct marketing purpose;
- c) processing of the personal data is carried out for scientific or historical research purposes or statistical purposes, which are necessary for execution of a task not in the public interest.
  
  If the data controller finds that the objection is well-founded, it shall terminate the processing, including further data collection and data transfer, and block the data, and shall inform about the objection and the measures taken based on the objection all the entities to whom it previously transferred the personal data subjected by the objection, and these entities, in turn, shall be obliged to take the necessary measures to enforce the right to objection.
Please be informed that you have the right to ask the data controller to provide your personal data and the information related to processing thereof to you. You may ask for copies of the personal data as long as requesting such copies does not adversely affect the rights and freedoms of others. Requesting of copies shall be free of charge on the first occasion, whereas the data controller may charge a fee based on administrative costs for every further copy.
Please be informed that you have the right to request the clarification, correction or supplementation of your personal data by sending a declaration, as long as the data are inaccurate, incorrect or incomplete.
Please be informed that the data controller shall restrict processing upon your request, if you contest the accuracy of data, if processing is unlawful, but instead of deletion, you request the restriction of processing, if the purpose of processing has been terminated, but you claim the data for the establishment, exercise or defence of legal claims, and if you filed an objection against the processing and the assessment of such objection is currently in progress. In the event the data controllers lift the restriction of processing, they shall provide information thereof in advance.
Please be informed that the data controller or the processor shall erase the processed personal data upon your request, if:
- a) processing is unlawful;
- b) the purpose of processing has been terminated or no further processing of data is required for attainment of the purpose;
- c) you withdraw your consent and there is no other legal basis for the processing;
- d) the statutory data retention period has expired;
- e) the erasure of data was ordered by law, authority or court.
Please be informed that upon your request, the data controller will transfer your personal data to you in a structured, commonly used and machine-readable format, or – if it is technically feasible – will transmit these data to another data controller or ensure to you the option of transmission. Please be informed that the transfer or transmission of data cannot be ensured if the data needs to be deleted or if the processing is necessary for the performance of a task carried out in the public interest or in the exercise of an official authority.
Please be informed that if processing is made based on your consent, you have the right to withdraw your consent. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
Please be informed that you may claim damages or aggravated damages (compensation for injury to feelings) for the damages incurred as a result of unlawful processing or for personality right related damages.
HungaroControl shall assess the request submitted by you for enforcement of your rights, as soon as possible, but within 1 month the latest, and shall inform you about its decision in writing or – if you submitted your request electronically – in an electronic way.
If a repeated request is submitted in the same year for the same scope of data, and the underlying reason is not that the data are required to be corrected, deleted or restricted due to the omission or failure of the data controller, then the data controller may ask for reimbursement of its costs incurred in relation to the fulfilment of the request.
If you are of the opinion that your rights have been violated in connection with the processing of your personal data, you may initiate an investigation at the Hungarian National Authority for Data Protection and Freedom of Information (1055 Budapest, Falk Miksa utca 9-11., 1363 Budapest, Pf. 9., ugyfelszolgalat@naih.hu, +36-1-3911400, www.naih.hu), or you may turn to the court of competent jurisdiction. The regional court having competence according to the registered office of the data controller shall conduct the legal action, with the provision that at your discretion, the legal action can also be started at the regional court having competence according to your domicile or habitual residence as well.

IV. Please be informed that the following person acts as the Data Protection Officer of HungaroControl: dr. Anikó Fazekas (+36-30-851-2515, dpo@hungarocontrol.hu).