PRIVACY NOTICE

18 March 2024

Contents

1. Data controller

2. Magyar Posta Zrt. as a postal operator (letters, parcels)
2.1. On what grounds is Magyar Posta Zrt. entitled to process the data?
2.2. What type of data do we process?
2.3. Why are the data processed?
2.4. How long do we process the data for?
2.5. Who do we transfer your data to? (Who are the recipients of your data?)
2.6. Who may access the data?

3. Magyar Posta as a payment service provider
3.1. On what grounds is Magyar Posta entitled to process the data?
3.2. What type of data do we process?

3.2.1. Bill payment form (“yellow form”) or postal bill payment form (“white form”)
3.2.2. Domestic postal money order (“pink form”)
3.2.3. Outpayment order
3.2.4. Pension order
3.2.5. Changing coins to other denominations, paying with coins
3.2.6. Payment service data supply
3.3. Why are the data processed?
3.4. How long do we process the data for?
3.5. Who do we transfer your data to? (Who are the recipients of your data?)
3.6. Who may access the data?

4. Magyar Posta, as the international postal money order and international express order service provider

5. Newspaper and magazine subscriptions
5.1. On what grounds is Magyar Posta entitled to process the data?
5.2. What type of data do we process?
5.3. Why are the data processed?
5.4. How long do we process the data for?
5.5. Who do we transfer your data to? (Who are the recipients of your data?)
5.6. Who may access the data?

6. Orders of stamps and philatelic products
6.1. On what grounds is Magyar Posta entitled to process the data?
6.2. What type of data do we process?
6.3. Why are the data processed?
6.4. How long do we process the data for?
6.5. Who do we transfer your data to? (Who are the recipients of your data?)
6.6. Who may access the data?

7. Telegram service

8. MyPost Loyalty Programme
8.1. On what grounds is Magyar Posta Zrt. entitled to process the data?
8.2. What type of data do we process?
8.3. Why are the data processed?
8.4. How long do we process the data for?
8.5. Who do we transfer your data to? (Who are the recipients of your data?)
8.6. Who may access the data?

9. Customs clearance and customs brokerage service
9.1. On what grounds is Magyar Posta entitled to process the data?
9.2. What type of data do we process?
9.3. Why are the data processed?
9.4. How long do we process the data for?
9.5. Who do we transfer your data to? (Who are the recipients of your data?)
9.6. Who may access the data?

10. Post Office Box rental and the list of PO Box holders
10.1. On what grounds is Magyar Posta entitled to process the data?
10.2. What type of data do we process?
10.3. Why are the data processed?
10.4. How long do we process the data for?
10.5. Who do we transfer your data to? (Who are the recipients of your data?)
10.6. Who may access the data?

11. Processing the data of contact persons and representatives
11.1. On what grounds is Magyar Posta entitled to process the data?
11.2. What type of data do we process?
11.3. Why are the data processed?
11.4. How long do we process the data for?
11.5. Who do we transfer your data to? (Who are the recipients of your data?)
11.6. Who may access the data?

12. Handling authorisations (eAuthorisation)
12.1. On what grounds is Magyar Posta Zrt. entitled to process the data?
12.2. What type of data do we process?
12.3. Why are the data processed?
12.4. How long do we process the data for?
12.5. Who do we transfer your data to? (Who are the recipients of your data?)
12.6. Who may access the data?

13. Handling of suspected counterfeit and incomplete banknotes and coins
13.1. On what grounds is Magyar Posta entitled to process the data?
13.2. What type of data do we process?
13.3. Why are the data processed?
13.4. How long do we process the data for?
13.5. Who do we transfer your data to? (Who are the recipients of your data?)
13.6. Who may access the data?

14. Data processing to prevent money laundering
14.1. On what grounds is Magyar Posta Zrt. entitled to process the data?
14.2. What type of data do we process?
14.3. Why are the data processed?
14.4. How long do we process the data for?
14.5. Who do we transfer your data to? (Who are the recipients of your data?)
14.6. Who may access the data?
14.7. Can the data subject receive information about any data, fact or circumstance arising in connection with him or her with regard to money laundering or terrorist financing?

15. Magyar Posta as the carrier
15.1. On what grounds is Magyar Posta Zrt. entitled to process the data?
15.2. What type of data do we process?
15.3. Why are the data processed?
15.4. How long do we process the data for?
15.5. Who do we transfer your data to? (Who are the recipients of your data?)
15.6. Who may access the data?

16. Processing video data
16.1. On what grounds is Magyar Posta entitled to process the data?
16.2. What type of data do we process?
16.3. Why are the data processed?
16.4. How long do we process the data for?
16.5. Who do we transfer your data to? (Who are the recipients of your data?)
16.6. Who may access the data?

17. Data processing related to entry
17.1. On what grounds is Magyar Posta entitled to process the data?
17.2. What type of data do we process?
17.2.1 What can the reception staff member or the security guard ask?
17.3. Why are the data processed?
17.4. How long do we process the data for?
17.5. Who do we transfer your data to? (Who are the recipients of your data?)
17.6. Who may access the data?

18. Magyar Posta’s data processing for direct marketing (advertising) purposes
18.1. The types of data processing this covers and the purpose of processing
18.2. On what grounds is Magyar Posta Zrt. entitled to process the data?
18.3. What type of data do we process?
18.4. How long do we process the data for?
18.5. Who do we transfer your data to? (Who are the recipients of your data?)
18.6. Who may access the data?

19. Conducting prize competitions
19.1. On what grounds is Magyar Posta entitled to process the data?
19.2. What type of data do we process?
19.3. Why are the data processed?
19.4. How long do we process the data for?
19.5. Who do we transfer your data to? (Who are the recipients of your data?)
19.6. Who may access the data?

20. Customer Service
20.1. On what grounds is Magyar Posta Zrt. entitled to process the data?
20.2. What type of data do we process?
20.3. Why are the data processed?
20.4. How long do we process the data for?
20.5. Who do we transfer your data to? (Who are the recipients of your data?)
20.6. Who may access the data?
20.7. Can I ask for a copy of the sound recording?

21. Data processing to measure the quality of service
21.1. On what grounds is Magyar Posta entitled to process the data?
21.2. What type of data do we process?
21.3. Why are the data processed?
21.4. How long do we process the data for?
21.5. Who do we transfer your data to? (Who are the recipients of your data?)
21.6. Who may access the data?

22. Job applications and labour market database
22.1. On what grounds is Magyar Posta Zrt. entitled to process the data?
22.2. What type of data do we process?
22.3. Why are the data processed?
22.4. How long do we process the data for?
22.5. Who do we transfer your data to? (Who are the recipients of your data?)
22.6. Who may access the data?

23. Magyar Posta Zrt.’s document management
23.1. On what grounds is Magyar Posta Zrt. entitled to process the data?
23.2. What type of data do we process?
23.3. Why are the data processed?
23.4. How long do we process the data for?
23.5. Who do we transfer your data to? (Who are the recipients of your data?)
24.6. Who may access the data?

24. Requests to access data of public interest and data public on grounds of public interest
24.1. On what grounds is Magyar Posta Zrt. entitled to process the data?
24.2. What type of data do we process?
24.3. Why are the data processed?
24.4. How long do we process the data for?
24.5. Who do we transfer your data to? (Who are the recipients of your data?)
24.6. Who may access the data?

25. MyPost registration
25.1.On what grounds is Magyar Posta entitled to process the data?
25.2. What type of data do we process?
25.3. Why are the data processed?
25.4. How long do we process the data for?
25.5. Who do we transfer your data to? (Who are the recipients of your data?)
25.6. Who may access the data?

26. Webshop:
26.1. On what grounds is Magyar Posta Zrt. entitled to process the data?
26.2. What type of data do we process?
26.3. Why are the data processed?
26.4. How long do we process the data for?
26.5. Who do we transfer your data to? (Who are the recipients of your data?)
26.6. Who may access the data?

27. ePosting Book
27.1. On what grounds is Magyar Posta entitled to process the data?
27.2. What type of data do we process?
27.3. Why are the data processed?
27.4. How long do we process the data for?
27.5. Who do we transfer your data to? (Who are the recipients of your data?)
27.6. Who may access the data?

28. MPL online address label and posting list application
28.1. On what grounds is Magyar Posta Zrt. entitled to process the data?
28.2. What type of data do we process?
28.3. Why are the data processed?
28.4. How long do we process the data for?
28.5. Who do we transfer your data to? (Who are the recipients of your data?)
28.6. Who may access the data?

29. Booking an appointment
29.1. On what grounds is Magyar Posta Zrt. entitled to process the data?
29.2. What type of data do we process?
29.3. Why are the data processed?
29.4. How long do we process the data for?
29.5. Who do we transfer your data to? (Who are the recipients of your data?)
29.6. Who may access the data?

30. Redirection
30.1. On what grounds is Magyar Posta Zrt. entitled to process the data?
30.2. What type of data do we process?
30.3. Why are the data processed?
30.4. How long do we process the data for?
30.5. Who do we transfer your data to? (Who are the recipients of your data?)
30.6. Who may access the data?

31. Repeated delivery
31.1. On what grounds is Magyar Posta Zrt. entitled to process the data?
31.2. What type of data do we process?
31.3. Why are the data processed?
31.4. How long do we process the data for?
31.5. Who do we transfer your data to? (Who are the recipients of your data?)
31.6. Who may access the data?

32. Post Office Box finder and list of Post Office Box holders
32.1. On what grounds is Magyar Posta Zrt. entitled to process the data?
32.2. What type of data do we process?
32.3. Why are the data processed?
32.4. How long do we process the data for?
32.5. Who do we transfer your data to? (Who are the recipients of your data?)
32.6. Who may access the data?

33. eAcceptance at premises
33.1. On what grounds is Magyar Posta Zrt. entitled to process the data?
33.2. What type of data do we process?
33.3. Why are the data processed?
33.4. How long do we process the data for?
33.5. Who do we transfer your data to? (Who are the recipients of your data?)
33.6. Who may access the data?

34. Subscription to the Procurement Newsletter
34.1. On what grounds is Magyar Posta entitled to process the data?
34.2. What type of data do we process?
34.3. Why are the data processed?
34.4. How long do we process the data for?
34.5. Who do we transfer your data to? (Who are the recipients of your data?)
34.6. Who may access the data?

35. Strong customer authentication and transaction risk analysis
35.1. On what grounds is Magyar Posta entitled to process the data?
35.2. What type of data do we process?
35.3. Why are the data processed?
35.4. How long do we process the data for?
35.5. Who do we transfer your data to? (Who are the recipients of your data?)
35.6. Who may access the data?

36. Data security
36.1. Organisational measures
36.2. Technical measures

37. What rights do I have related to my data? (Data subject’s rights)
37.1. Withdrawal of consent
37.2. Request to access (information)
37.3. Request to rectify (change) data
37.4. Request to erase data
37.5. Request to restrict processing
37.6. Objecting to data processing
37.7. Request for human intervention in automated decision-making
37.8. Request for data portability
37.9. Where can I contact Magyar Posta Zrt. in order to enforce my rights?

38. Where can I turn to protect my rights?

Magyar Posta Zrt. is committed to protecting the data of data subjects who contact Magyar Posta and to duly informing them about the processing of their personal data.

This Privacy Notice explains

• the grounds entitling Magyar Posta Zrt. to process data (the legal basis),
• the type of data we process,
• why we process data and what the data are used for (the purpose of data processing),
• how long data are processed for (the duration of data processing),
• whether we use data processors, or whether we transfer the data subject’s data,
• who may access the data,
• the rights data subjects may exercise concerning their data
• and the legal remedies they may resort to.

This information may vary dependent on the purpose the data subject gave the data for. A large organisation processes data for a variety of purposes. Some of these purposes are defined in legislation while others are needed in order to provide our services in the way our customers expect.

Because data subjects come into contact with Magyar Posta Zrt. in order to arrange specific postal affairs or use postal services, in this document the relevant information for each service or postal affair is provided under separate headings to make it easier for customers to find out which data are processed on each occasion.

We wish to inform data subjects that advice about specific data processing carried out by Magyar Posta Zrt. is given in the individual information provided when or before data are recorded (for example, on the form for recording data), in a contract, in the general terms and conditions for the service, in notices and under Related Information in the menu on the Privacy Notice page of www.posta.hu.

1. Data controller

The data controller with regard to all data processing described in this document is Magyar Posta Zrt. (registered office: 1138 Budapest, Dunavirág utca 2-6, company registration number: 01-10-042463, postal address: 1540 Budapest, website: www.posta.hu).
Contact us:

• by post: to the address of the Customer Service Directorate (Ügyfélszolgálati Igazgatóság): 3512 Miskolc,
• by faxing (+36) 46-320-136,
• by e-mail at ugyfelszolgalat@posta.hu,
• by phoning (+36) 1-767-8282,
• in person: at Magyar Posta Zrt., Budapest, District VI, Teréz krt. 51-53, and at Magyar Posta’s permanent postal outlets,
• data protection officer’s contact details: adatvedelem@posta.hu
  

The Privacy Notice is available online on the website www.posta.hu under Privacy Notice in the menu.

2. Magyar Posta Zrt. as a postal operator (letters, parcels)

2.1. On what grounds is Magyar Posta Zrt. entitled to process the data?

Magyar Posta is entitled to process data in connection with its postal services, that is to say its activities related to dispatching, collecting, sorting, transporting and delivering letters and parcels, on the following grounds:

• the processing of data is necessary for the performance of the universal postal service as a task in the public interest, for which Magyar Posta Zrt. was appointed under Act CLIX of 2012 on postal services (hereinafter referred to as the “Postal Services Act”), Sections 6 and 18. [Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the “General Data Protection Regulation”), Article 6(1)(e)]

• during the provision of postal services that fall outside the scope of universal postal services
  – the processing of the sender’s personal data is necessary for the conclusion and performance of the postal service contract, which is concluded between the sender and Magyar Posta Zrt. [General Data Protection Regulation, Article 6(1)(b)]
  – while the processing of the personal data of addressees and recipients is necessary for the assertion of the legitimate interest of the sender and Magyar Posta Zrt., which is demonstrated by the fact that without it the performance and verification of the contract would not be possible under the statutory terms and conditions for the fulfilment of postal services [General Data Protection Regulation, Article 6(1)(f)]
• the detailed rules of data processing are specified in the Postal Services Act, Section 54
• the processing of personal data for the handling of customer requests relating to postal services is necessary for the assertion of the legitimate interest of Magyar Posta Zrt., which is demonstrated by the fact that without the processing of the data customer requests could not be investigated and answers could not be provided to data subjects, and it would be impossible to process 3 the communications of data subjects, which would also infringe the legitimate economic interests of Magyar Posta Zrt. [General Data Protection Regulation, Article 6(1)(f)]
• in relation to complaints, statements to be recorded as complaints and compensation claims, Act CLIX of 2012 on postal services, Section 57, and Act CLV of 1997 on consumer protection, Sections 17/A-17/C, create the legal obligations for data processing [General Data Protection Regulation, Article 6 (1) c)]

In international mail traffic, it is necessary to transfer the personal data to the country in the address. Data transfer

• in the case of the personal data of the sender is necessary for the performance of the contract between the data subject and Magyar Posta Zrt. as the data controller, or for the implementation of pre-contractual measures taken at the data subject’s request [General Data Protection Regulation, Article 49(1)(b)]
• while, in the case of the personal data of the addressee, it is necessary for the conclusion and fulfilment of the contract serving the addressee’s interest concluded between Magyar Posta as the data controller and the sender [General Data Protection Regulation, Article 49(1)(c)]

The Universal Postal Union was established out of public interest due to international postal traffic and the need to operate the universal postal service, and its rules and regulations govern the processing of data concerning international postal traffic. Therefore, transferring personal data accordingly is necessary for important reasons of public interest [General Data Protection Regulation, Article 49(1)(d)]

• the Constitution of the Universal Postal Union in force and its Agreements (hereinafter referred to as the “UPU Convention”) – Law Decree No. 26 of 1967 on the enactment of the Constitution of the Universal Postal Union signed at Vienna on 10 July 1964 and the Additional Protocols to the Constitution; Act CXIII of 2012 on the enactment of the Seventh and Eighth Additional Protocols to the Constitution of the Universal Postal Union, the Universal Postal Convention of the Universal Postal Union consolidated with the amendments signed at the 2004 Bucharest Congress and the 2008 Geneva Congress, the Final Protocol of the Universal Postal Convention signed at the 2004 Bucharest Congress and the 2008 Geneva Congress, and the Postal Payment Services Agreement consolidated with the amendments signed at the 2004 Bucharest Congress as well as Act XIV of 2023 on the enactment of the Ninth, Tenth and Eleventh Additional Protocols to the Constitution of the Universal Postal Union, the text consolidated with the amendments and Final Protocol to the Universal Postal Convention of the Universal Postal Union signed at the 2012 Doha Congress, the text consolidated with the amendments and Final Protocol 4 signed at the 2016 Istanbul Congress, the Additional Protocol and Final Protocol signed at the 2018 Addis Ababa Congress, the Second Additional Protocol signed at the 2019 Geneva Congress, and the text consolidated with the amendments and Final Protocol signed at the 2021 Abidjan Congress.

The following documents also include provisions related to data processing:

• Government Decree 335/2012 of 4 December 2012 on the detailed rules for the provision of postal services and the postal service related to official documents, as well as on the general terms and conditions of postal service providers, and on items excluded from postal services or items that may only be carried upon certain conditions (hereinafter referred to as the “Gov. Dec.”)
• the Universal Postal Public Service Contract
  Magyar Posta Zrt. is the universal postal service provider, in other words the Hungarian State has entrusted Magyar Posta with the delivery of letters and parcels throughout the country. The contract describes the terms and conditions for this in detail.

The legal rules listed above ensure that postal services operate in a unified system throughout the world. We would not be able to send a letter or parcel to the other side of the world if this process were not regulated by the UPU Convention, and neither could Magyar Posta transfer the necessary data, either related to the performance of the service or learnt in the course of performing it, to the other side of the world.

2.2. What type of data do we process?

As of 1 June 2022, Magyar Posta Zrt. does not record such data.

Magyar Posta may acquaint itself with the contents of sealed mail items to the extent necessary to carry out the service. [Postal Services Act, Section 55]

a. the contents of an item pose a threat (for example, it contains an explosive, flammable or infectious substance) which must be eliminated
b. the packaging of an item is damaged to the extent that it is necessary to repack to prevent damage to the contents or other mail items
c. an item cannot be returned to the sender for some reason and
– the contents of the item are probably perishable or hazardous, or
– a parcel has been held by Magyar Posta for three months and during this period neither the sender nor the addressee came forward for it.

In every case Magyar Posta records the fact on the mail item’s cover that it was opened and, whenever possible, notifies the sender of the opening and the reason for it.

The Postal Services Act also allows Magyar Posta to examine unsealed mail items to the extent necessary in the interest of establishing the data needed for acceptance, collection, sorting, forwarding and delivery. Such items include postcards and picture postcards.

Under the legislation affecting companies engaged in economic activities at airports (NAVSEC programme, Regulation (EC) 300/2008, Commission Regulation (EU) 2015/1998, Government Decree 169/2010 of 11 May 2010), and thus Magyar Posta as well, in the case of transport by air the contents of export (outbound) mail are subject to aviation security controls. Magyar Posta, with the participation of its data processor, AS-SEC Kft. (registered office: 1191 Budapest, Üllői út 200, company registration number: 01-09-420378, tax number: 32366237-2-43, e-mail: iroda@as-sec.hu), uses x-ray equipment for such control. Checking the contents primarily aims to detect devices that threaten flight safety (for example, firearms, pointed weapons, articles that could be used as a weapon, explosive and inflammable devices).

Data subjects are further advised that Magyar Posta Zrt. also uses an automated data cleansing solution for the more accurate forwarding of mail items. As part of this, Magyar Posta Zrt. checks the addressee’s name and address data provided when ordering redirection to a postal address or to a rented PO Box and when making delivery notifications with regard to addressees and compares these with the name and address data provided for the specific mail item, so that any discrepancies and data errors are automatically filtered and corrected based on reference databases (e.g. list of street names of municipalities, list of names) and data cleansing rules to establish agreement. If these agree, Magyar Posta Zrt. will forward the mail item to the delivery post office in accordance with the order or addressee’s notification. If there is no agreement, Magyar Posta Zrt. will, after comparing and cleansing the address data provided electronically and the address data on the mail item, forward the mail item to the delivery post office according to the address provided for it at the time of posting. The described support procedure does not change the address data marked on the mail item, which means that during postal delivery it can be established whether the mail item has been directed through internal forwarding to a delivery post office other than the one for the address indicated in the address details or in the related order or notification. The delivery of the mail item or its return to the sender will always be at the discretion of the delivery worker, taking into account the address details on the mail item.

2.3. Why are the data processed?

• to fulfil the postal service contract
  We process data in order to deliver letters and parcels to their addressees in compliance with the rules that apply to us set by the instruction of the sender 8 or the addressee, or defined by law. Our convenience services that adapt sending letters and parcels to individual needs may also be used. For example:
  – With the e-notification and e-arrival at a PO Box services, a notification of the delivery of an item is sent to the e-mail address or phone number given by the data subject.
  – If redirection is required, we process the new address (where it is requested that the item be redirected) on the redirection form so that mail will reach the addressee at the desired place for a temporary period.
• to account, prove and subsequently check performance
  The data are required to prove to senders that their item was delivered in accordance with their instructions and to ensure that everything occurred correctly. At the same time, it is important to be able to investigate complaints and claims for compensation, which we could not do without processing the data necessary to deliver letters and parcels.
• to supply data upon request
  – to supply data to the National Media and Infocommunications Authority
  The National Media and Infocommunications Authority supervises our Company’s postal services, thus we must supply information, in part related to complaints, to the Authority.
  – Moreover, we are obliged under Section 38 of the Postal Services Act to supply information to the organisations authorised to prevent and investigate crime (for example, the police), or to gather intelligence or obtain confidential data upon request. The specific conditions under which this may happen are laid down in Government Decree 9/2005 of 19 January 2005 on the detailed rules of cooperation between postal service providers, postal contractors, and organisations authorised to gather intelligence in secret and to obtain confidential data (such as the Special Service for National Security).

2.4. How long do we process the data for?

Personal data are processed until the end of the fifth calendar year from the date the mail item was posted, i.e. accepted for postal handling. [Postal Services Act, Section 55(7).] If, for instance, the data subject posted a letter with advice of delivery on 2 June 2022, Magyar Posta Zrt. would process the data related to its dispatch and delivery until 31 December 2027.

2.5. Who do we transfer your data to? (Who are the recipients of your data?)

Magyar Posta provides its postal services with the aid of postal contractors at many points in Hungary. Postal contractors are undertakings that are contracted by Magyar Posta to provide postal services for customers in the name of, for and at the liability of Magyar Posta applying the rules laid down by Magyar Posta. Accordingly, postal contractors are Magyar Posta Zrt.’s data processors. If you would like to view the list of postal contractors, you can access it on the www.posta.hu page under Privacy Notice in the menu.

International mail would be unable to function without the cross-border flow of the personal data of data subjects. This is ensured by the International Post Corporation SCRL (hereinafter referred to as the “IPC”) (1130 Brussels, Avenue du Bourget 44, Belgium, cape.helpdesk@ipc.be, https://www.ipc.be) and the Universal Postal Union (POB 312 3000 BERNE 15, Switzerland, ptc.support@upu.int, www.upu.int), which Magyar Posta also uses as data processors. The IPC and the Universal Postal Union provide the IT support enabling the international exchange of data and operate the IT infrastructure facilitating the data exchange between postal operators and air carriers.

As regards aviation security control, Magyar Posta Zrt. uses AS-SEC Kft. (registered office: 1191 Budapest, Üllői út 200, company registration number: 01-09-420378, tax number: 32366237-2-43, e-mail: iroda@as-sec.hu) as the data processor for the X-ray equipment control.

2.6. Who may access the data?

Magyar Posta processes personal data allowing access only to those who need them to carry out the service you require. Thus staff involved in forwarding mail (post office clerks, sorting and delivery personnel) as well as those involved in checking the performance of the service, accounting and examining complaints have access to the data of mail items. There are special units dedicated to regularly checking Magyar Posta Zrt.’s internal operations and the compliance of its activities with regulations, thus the staff engaged in such controls (operations inspectors, internal auditors, security and protection staff, data protection officers) have access to these data provided this is essential for 10 carrying out their duties. In addition, the personnel involved by Magyar Posta Zrt.’s subcontractors and postal contractors as data processors in carrying out the activity may also access the data.

It is our legal obligation to disclose or provide access to data to the National Media and Infocommunications Authority [Postal Services Act, Section 53], the court, the prosecutor’s office, the investigating authority, the offence authority, the administrative authority, the National Authority for Data Protection and Freedom of Information, and any other body authorised by law, upon their request. We are obliged to cooperate with the organisations authorised to prevent and investigate crime, and to gather intelligence in secret. [Postal Services Act, Section 38, and Government Decree 9/2005 of 19 January 2005] Magyar Posta Zrt. only provides personal data to or allows access to personal data for these organisations if the precise purpose and data range is indicated and only does so to the extent that is absolutely necessary for the purpose of the request and is suitable to achieve the objective.

If the data subject sends a mail item (letter or parcel) abroad, Magyar Posta is obliged to transfer those pieces of the data listed in point 2.2 which are necessary for the performance of the service to the postal operator in the destination country (the country which appears in the address of the item) and to the postal operator in the transit country (the country to which the item is first sent for onward shipment to the destination country) as the service could not be carried out without this.

3. Magyar Posta as a payment service provider

Magyar Posta Zrt. comes into contact with its customers not only as a postal service provider but also as a provider of payment services governed by certain rules applicable to this area. Data subjects can pay bill payment forms (“yellow form”) and postal bill payment forms (“white form”) at post offices, or using our iCsekk application or the bill payment terminals operated by Magyar Posta Zrt., and domestic postal money orders (“pink postal orders”) can also be sent from post offices. Our extensive network allows us to take cash to the door by means of the domestic postal money order, outpayment order and pension order.

3.1. On what grounds is Magyar Posta entitled to process the data?

Magyar Posta is entitled to process the data on the following grounds:

• The processing of personal data is necessary for the performance of a task in the public interest as Magyar Posta Zrt., as the universal postal service provider, was obligated by the legislator to provide
  – bill payment form (“yellow form”),
  – postal bill payment form (“white form”),
  – domestic postal money order (“pink postal order”),
  – outpayment order (and its subtypes: pension order) and
  – cash withdrawal order²
  services under the Postal Services Act, Section 26 [General Data Protection Regulation, Article 6(1)(e)]

• The conditions for the provision of services at the legislative level are specified in Act LXXXV of 2009 on the provision of payment services (hereinafter referred to as the “Payment Act”).
  Under the cited law, the following documents also include provisions related to data processing:
  – MNB Decree 35/2017 of 14 December 2017 on the execution of payment transactions (hereinafter referred to as the “MNB Decree”)
  – Government Decree 335/2012 of 4 December 2012 on the detailed rules for the provision of postal services and the postal service related to official documents, as well as on the general terms and conditions of postal service providers, and on items excluded from postal services or items that may only be carried upon certain conditions (hereinafter referred to as the “Gov. Dec.”)
  These regulations provide the framework for sending money to the payee using the bill payment form (yellow form), the postal bill payment form (white form), the domestic postal money order (pink form) and the outpayment order. Magyar Posta is obliged to process the data required by these regulations and these must be provided to enable us to perform the service.

• Regulation (EU) 2015/847 of 20 May 2015 on information accompanying transfers of funds and repealing Regulation (EC) No 1781/2006 (“Reg. (EU) 2015/847”)3, which creates a legal obligation for the processing of data [General Data Protection Regulation, Article 6(1)(c)]
  Strict rules govern service providers in the financial world in order to ensure that the flow of funds can be monitored. For this reason the European Union requires service providers, and thus Magyar Posta Zrt. as well, to be able to trace the funds flowing through their services to the person placing the order to transfer the funds. In this context data must be transmitted to the service provider receiving the funds from Magyar Posta Zrt. Magyar Posta Zrt. must process the data and these must be provided to enable us to perform the service.

• Act LIII of 2017 on the prevention and combating of money laundering and terrorist financing (hereinafter referred to as the “Anti-ML Act”) as well as Act LII of 2017 on the implementation of the financial and asset restraint measures imposed by the European Union and the UN Security Council (hereinafter referred to as the “Restraint Act”)⁴, which create a legal obligation for the processing of data [General Data Protection Regulation, Article 6(1)(c)] Information about this is given under point 14.

• concerning suspected counterfeit and incomplete banknotes and coins, Act CXXXIX of 2013 on the Magyar Nemzeti Bank (hereinafter referred to as the “MNB Act”), Section 24, which creates a legal obligation for the processing of data [General Data Protection Regulation, Article 6(1)(c)] Information about this is given under point 13.

• Act C of 2000 on accounting (hereinafter referred to as the “Accounting Act”), which creates a legal obligation for the processing of data [General Data Protection Regulation, Article 6(1)(c)]

Magyar Posta Zrt. must account for money received from customers accurately, thus it is obliged to keep documents and data proving this.

2 Magyar Posta discontinued this service on 1 January 2019.
3 For data recorded prior to 26 June 2017, Regulation (EC) No 1781/2006 of the European Parliament and of the Council of 15 November 2006 on information on the payer accompanying transfers of funds
4 For data recorded prior to 1 January 2018, Act CXXXVI of 2007 on the prevention and combating of money laundering and terrorist financing

3.2. What type of data do we process?

3.2.1. Bill payment form (“yellow form”) or postal bill payment form (“white form”)

When customers use our bill payment or postal bill payment services (yellow or white forms), we may ask for the data below or may link the following information to the payments:

3.2.2. Domestic postal money order (“pink form”)

When using our domestic postal money order service (“pink form”), we may ask for the data below or link this information to the payments:

5 As of 1 June 2022, Magyar Posta Zrt. does not record such data.

3.2.3. Outpayment order

When providing the outpayment order service, we process the following data:

6 As of 1 June 2022, Magyar Posta Zrt. does not record such data.

3.2.4. Pension order

Magyar Posta pays out pensions coming from the pension institution to those entitled in cash based on an agreement with the institution and using pension orders specifically for this purpose completed by the pension institution. Magyar Posta Zrt. only processes personal data for the purpose of delivering the pension payments and in every other case (such as accepting requests for the pension payment due for the month of death) will act as the data processor of the pension institution.

7 As of 1 June 2022, Magyar Posta Zrt. does not record such data.

3.2.5. Changing coins to other denominations, paying with coins

In the event that coins are changed to other denominations or payment is made in coins at Magyar Posta Zrt. and the coins are not counted at the time but you undertake an obligation to pay any difference found through subsequent counting, the data below are processed in connection with this obligation.

3.2.6. Payment service data supply

Magyar Posta Zrt. provides data to the users of its payment service, the payer/sender, the recipient of the order and their authorised representatives about their orders. Within the framework of supplying data, Magyar Posta Zrt. provides information on the data processed while performing the order and for the purpose of performing the order.

 

3.3. Why are the data processed?

• to perform our payment services,
  Magyar Posta Zrt. processes these data to remit the money to the intended recipient indicated by the payer, the sender or the person instructing payment. For example, for a yellow form the amount of the phone or water bill paid to the service provider and for a pink postal order the amount sent to the payee.
• to handle complaints and claims for compensation about the service,
• to fulfil payment service data supply requests related to the service,
• to fulfil accounting obligations.

3.4. How long do we process the data for?

As regards performing individual payment orders for postal payment services, Magyar Posta Zrt. processes the data from the time the payment is instructed until the expiry of the period for enforcing claims, in other words for 5 years, in view of the legal requirement stipulated in Act V of 2013 on the Civil Code.

If data processing becomes necessary due to the establishment, exercise or defence of any legal claim related to the service (e.g. court proceedings), Magyar Posta Zrt. will process the data for the period necessary for the establishment, exercise or defence of the legal claims.

In order to ensure that the flow of funds can be traced, Magyar Posta Zrt. must process the data to identify the payer for 5 years from the time the payment is instructed. [Reg. (EU) 2015/847, Article 16(1)]

Magyar Posta Zrt. must keep the accounting documents created in the course of providing the service, e.g. the main section of the yellow or white bill payment form, for 8 years. [Accounting Act, Section 169(2)] Magyar Posta digitally archives and keeps images of accounting documents and their data certified in electronic format (with an electronic signature and date and time stamp).

3.5. Who do we transfer your data to? (Who are the recipients of your data?)

Essentially, Magyar Posta Zrt. provides its payment services itself and does not involve data processors.

Magyar Posta does, however, involve data processors in certain payment solutions and to provide services in certain areas of Hungary.

For the payment of bills using the iCsekk application, Magyar Posta Zrt.’s data processor is Díjbeszedő Holding Zrt. (1117 Budapest, Budafoki út 107-109, Company registration number: 01-10-042094, Tax number: 10805246-2-43), which operates the application and transfers the data of bill payments on yellow and white forms made through the application to Magyar Posta’s accounting systems.

When paying bill payment forms and postal bill payment forms by scanning the QR code, OTP Mobil Kft. (registered office: 1143 Budapest, Hungária körút 17-19., Company registration number: 01-09-174466, Tax number: 24386106-2-42; delivery address: benyo.peter@otpmobil.hu) acts as the data processor of Magyar Posta Zrt., which uses OTP Bank Nyrt. (1051 Budapest, Nádor u. 16) as a further data processor for payments in the Simple application and in the OTP Mobilbank application.

Magyar Posta Zrt. provides its services with the aid of postal contractors at many points in Hungary. Postal contractors are undertakings that are contracted by Magyar Posta Zrt. to provide services for customers in the name of, for and at the liability of Magyar Posta Zrt. applying the rules laid down by Magyar Posta. Accordingly, postal contractors are Magyar Posta Zrt.’s data processors. If you wish to see a list of postal contractors, this is available on our website www.posta.hu under Privacy Notice in the menu.

3.6. Who may access the data?

Magyar Posta Zrt. processes personal data allowing access only to those who need them to carry out the service you require. Thus post office clerks accepting payment orders (e.g. bill payments), personnel processing these at the Postal Accounting Centre, staff making outpayments as well as those involved in checking the performance of the service, accounting and examining complaints have access to these data. There are special units dedicated to regularly checking Magyar Posta’s internal operations and the compliance of its activities with regulations, thus the staff engaged in such controls (operations inspectors, internal auditors, security and protection staff, data protection officers) have access to these data provided this is essential for carrying out their duties.

The point of the yellow and white bill payment service is that the data subject pays cash into a bank account (payment account). Thus it is an indispensable precondition of providing the service that Magyar Posta Zrt. transfers the data of the private individual as the payer to the bank where the payee holds the account for yellow bill payment forms and directly to the payee in the case of white bill payment forms so that the payment can be credited to the payee’s account and the payee can identify who made the payment. Furthermore, if the amount on a pink postal order or an outpayment order is requested to be paid to the payee’s bank account, the data of the payer must be transferred to the bank.

Magyar Posta Zrt.’s payment activity is supervised by the Magyar Nemzeti Bank (address: 1013 Budapest, Krisztina körút 55, e-mail: ugyfelszolgalat@mnb.hu) and Magyar Posta Zrt. is obliged to provide data if so required by the MNB [MNB Act, Section 48(4)]. The Magyar Nemzeti Bank, via the Financial Arbitration Board (address: 1013 Budapest, Krisztina krt. 39, Postal address: H-1525 Budapest Pf. 172. Telephone: +36-40-203-776, e-mail: ugyfelszolgalat@mnb.hu), settles disputes out of court, thus this body may also have access to the data in the event of proceedings before the Financial Arbitration Board [MNB Act, Section 108].

4. Magyar Posta, as the international postal money order and international express order service provider

Magyar Posta Zrt. discontinued the international postal money order and international express order service on 16 October 2022, thus it is no longer possible to use these services, i.e. no data will be recorded in this connection. Magyar Posta Zrt. is obliged to manage the data recorded previously until 31 December 2031 at the latest, pursuant to Act C of 2000 on accounting. Related information can be accessed on www.posta.hu under Privacy Notice under the Related information notices.

5. Newspaper and magazine subscriptions

Under this service, customers may order and subscribe to newspapers and magazines (hereinafter referred to as “newspapers”) from Magyar Posta Zrt. Magyar Posta Zrt. only processes the data of customers and subscribers if they place an order or subscribe with Magyar Posta for delivering newspapers to them.

5.1. On what grounds is Magyar Posta entitled to process the data?

• the processing of the subscriber’s personal data is necessary for the conclusion and performance of the newspaper subscription service contract, which is concluded between the subscriber and Magyar Posta Zrt. [General Data Protection Regulation, Article 6(1)(b)]
• if a subscriber subscribes to a newspaper for another person (for example as a gift), the processing of the personal data of the recipient of the subscribed newspaper is necessary to assert the legitimate interest of the subscriber and Magyar Posta Zrt., which is demonstrated by the fact that without this it would be impossible for Magyar Posta Zrt. to deliver the subscribed newspaper to the data subject [General Data Protection Regulation, Article 6(1)(f)]

and

• Act CVIII of 2001 on certain aspects of electronic commerce and information society services
  
  Magyar Posta Zrt. enables its customers to subscribe to newspapers in the webshop on the MyPost interface. By subscribing, a contract is entered into by electronic means (online contract) between Magyar Posta Zrt. and the data subject. The frameworks of this are defined by law. For instance, orders must be confirmed and thus Magyar Posta Zrt. is obliged to process e-mail addresses.
• Act C of 2000 on accounting (hereinafter referred to as the “Accounting Act”), which creates a legal obligation for the processing of data [General Data Protection Regulation, Article 6(1)(c)]
  
  Magyar Posta Zrt. must account for orders accurately, thus it is obliged to keep documents and data proving these.

5.2. What type of data do we process?

5.3. Why are the data processed?

Magyar Posta Zrt. uses the data to perform the service, that is to deliver the subscribed newspapers to the addressee. For this the person of the subscriber and the title of the subscribed newspaper are necessary and so we need to record these data to provide the service.

Part of performing the service is the collection, accounting and invoicing of the subscription fees, handling complaints, and confirming orders placed by electronic means, and thus the data are processed to this end for the reasons described in point 5.2.

5.4. How long do we process the data for?

Magyar Posta Zrt. processes subscriber data in connection with performing the subscription contract – with the exception of data processed in connection with accounting documents – until the last day of the second calendar year after the expiry of the subscription.

If data processing becomes necessary due to the establishment, exercise or defence of any legal claim related to the service (e.g. court proceedings), Magyar Posta Zrt. will process the data for the period necessary for the establishment, exercise or defence of the legal claims.

Magyar Posta Zrt. is obliged to account for the subscriptions, and therefore, in relation to accounting, we are required to keep subscription data for 8 years under the Accounting Act.

5.5. Who do we transfer your data to? (Who are the recipients of your data?)

Magyar Posta Zrt. provides its services with the aid of postal contractors at many points in Hungary. Postal contractors are undertakings that are contracted by Magyar Posta to provide postal services for customers in the name of, for and at the liability of Magyar Posta applying the rules laid down by Magyar Posta Zrt.. Accordingly, postal contractors are Magyar Posta Zrt.’s data processors. If you would like to view the list of postal contractors, you can access it on the www.posta.hu page under Privacy Notice in the menu.

To produce letters containing bills and other forms in relation to subscriptions, Magyar Posta Zrt. uses EPDB Nyomtatási Központ Zártkörűen Működő Részvénytársaság (1117 Budapest, Budafoki út 107-109, Company registration number: 01 10 048079, Tax number: 24924243-2-43) as the data processor.

5.6. Who may access the data?

The data may be accessed by the employees of Magyar Posta Zrt. and of its data processor who deal with subscription orders (post office clerks and delivery staff), record them in the IT system supporting newspaper subscription records, deliver subscribed newspapers to addressees (newspaper delivery personnel) and inspect the performance of the service.

If a customer makes a complaint, the staff dealing with complaints will also access the customer’s data.

There are special units dedicated to regularly checking Magyar Posta Zrt.’s internal operations and the compliance of its activities with regulations, thus the staff engaged in such controls (operations inspectors, internal auditors, security and protection staff, data protection officers) have access to these data provided this is essential for carrying out their duties.

If the subscriber makes a request to Magyar Posta Zrt. which Magyar Posta is unable to fulfil without the Publisher of the newspaper, the subscriber’s data will be transferred to the Publisher in these individual cases in view of the legitimate interests of the subscriber. [General Data Protection Regulation, Article 6(1)(f)]

The situation may arise when a Publisher no longer commissions Magyar Posta Zrt. to deliver subscribed newspapers to addressees or Magyar Posta Zrt. is unable to perform the service for another reason. In such circumstances Magyar Posta Zrt. would not be able to forward those newspapers to subscribers. Thus to ensure that the subscribed newspaper continues to reach addressees smoothly, and neither the subscriber nor the addressee is adversely affected, Magyar Posta will transfer the subscribers’ data to the Publisher in the following circumstances:

• the subscriber provided his or her data for the performance of the subscription and
• without transferring the data to the Publisher the service could not be performed, in other words its performance would be impossible, and
• the data will be processed for the same reason as they have been until the time of the transfer

Therefore, the data transfer is proportionate to the protection of the data subject’s personal data. [General Data Protection Regulation, Article 6(1)(f)]

Magyar Posta Zrt. informs data subjects of the data transfer in advance, allowing them sufficient time to express their objection to their data being transferred and to cancel their subscription contract.

6. Orders of stamps and philatelic products

One of Magyar Posta Zrt.’s traditional services is issuing and circulating postage stamps. Magyar Posta Zrt. only processes the data of customers purchasing stamps and philatelic products if they have placed an order for or subscribed to stamps and other philatelic products through Magyar Posta Zrt. When a purchase is made at a post office for a specific stamp available there, customer data are not recorded.

6.1. On what grounds is Magyar Posta entitled to process the data?

• the processing of the subscriber’s/customer’s personal data is necessary for the conclusion and performance of the stamp order as a contract, which is concluded between the subscriber and Magyar Posta Zrt. [General Data Protection Regulation, Article 6(1)(b)]

and

• Act CVIII of 2001 on certain aspects of electronic commerce and information society services
  
  Magyar Posta Zrt. enables its customers to order stamps in the webshop on the MyPost interface. By placing an order, a contract is entered into by electronic means (online contract) between Magyar Posta Zrt. and the data subject. The framework of this is defined by law. For instance, orders must be confirmed and thus Magyar Posta Zrt. is obliged to process e-mail addresses.
• Act C of 2000 on accounting (hereinafter referred to as the “Accounting Act”), which creates a legal obligation for the processing of data [General Data Protection Regulation, Article 6(1)(c)]
  
  Magyar Posta Zrt. must account for orders accurately, thus it is obliged to keep documents and data proving these.

6.2. What type of data do we process?

6.3. Why are the data processed?

Magyar Posta Zrt. uses the data to perform the order, that is to deliver the ordered stamps to the addressee. For this the person of the subscriber and the delivery address for the ordered stamps are necessary and so we need to record these data to provide the service.

Part of performing the service is the collection, accounting and invoicing of the fees for ordering, handling complaints, and confirming orders placed by electronic means, thus the data are processed to this end for the reasons described in point 6.2.

If the data subject wishes to place an order for the Your Own Stamp service, a photo uploaded or sent by the customer is required for Magyar Posta to print on the stamp.

6.4. How long do we process the data for?

Magyar Posta Zrt. processes customer data for five (5) years after the placement of an order or, in the case of subscriptions, after the expiry of the subscription, and, in the case of the cancellation of the contract, from the date of the cancellation because within this period the data subject may enforce any legal dispute that may arise between Magyar Posta Zrt. and the data subject in court.

If data processing becomes necessary due to the establishment, exercise or defence of any legal claim related to the service (e.g. court proceedings), Magyar Posta Zrt. will process the data for the period necessary for the establishment, exercise or defence of the legal claims.

Magyar Posta Zrt. must account for orders, thus it is obliged to keep documents related to placing the order for 8 years as stipulated in the Accounting Act.

6.5. Who do we transfer your data to? (Who are the recipients of your data?)

Magyar Posta Zrt. does not use data processors.

6.6. Who may access the data?

The data may be accessed by the employees of Magyar Posta Zrt. who deal with accepting orders, recording orders (philately sales staff), accounting (accounting staff), produce Your Own Stamps, package and address compiled stamp packages (stamp storage staff), take part in delivering the stamps to the addressees (mail processing and delivery personnel), and inspect the performance of the service.

If a customer makes a complaint, the staff dealing with complaints will also access the customer’s data.

There are special units dedicated to regularly checking Magyar Posta Zrt.’s internal operations and the compliance of its activities with regulations, thus the staff engaged in such controls (operations inspectors, internal auditors, security and protection staff, data protection officers) have access to these data provided this is essential for carrying out their duties.

7. Telegram service

Data processing ceased as the service was terminated on 30 April 2021 having regard to the 18-month data retention period provided for under Section 18(3) of Government Decree 236/2004 of 13 August 2004 on the detailed rules for the provision of telegram services.

8. MyPost Loyalty Programme

8.1. On what grounds is Magyar Posta Zrt. entitled to process the data?

Magyar Posta Zrt. is entitled to process the data on the following grounds:

• The data subject claimed a MyPost (ÉnPostám) Card and made a declaration to enter into a contract with Magyar Posta Zrt. for the MyPost Loyalty Programme service. As a result of this, a contract comes into being if Magyar Posta Zrt. accepts the request. Data processing is necessary in order to enter into and perform the contract [General Data Protection Regulation, Article 6(1)(b)], under which
  – the data of the data subject are processed by Magyar Posta Zrt. for the purpose of issuing a card in the data subject’s name, ensuring the customer identification function of the MyPost Card, crediting points and accounting points as part of the service, providing discounts, and handling customer requests and complaints related to the service.
  – the Service Provider of the product or service involved in the MyPost Loyalty Programme and used by the data subject – as defined in the General Terms and Conditions of the MyPost Loyalty Programme – processes the identification and transaction data necessary for customer identification, and collecting and accounting points, and Magyar Posta Zrt. and the Service Provider transfer these between each other.
  – for the purpose of providing group accident insurance, Magyar Posta Zrt. processes the data subject’s identification data and contact details and transfers them to Magyar Posta Biztosító Zrt. (Company registration number: 01-10-044751; Registered office: 1022 Budapest, Bég utca 3-5).
• the data subject has a separate option to grant voluntary consent on the application form and
  – at the same time to request that Magyar Posta Zrt. notifies the data subject of its offers and advertisements and those of its partners, and
  – to authorise Magyar Posta to analyse his or her shopping habits for this purpose (profiling)
  [General Data Protection Regulation, Article 6(1)(a), and Act XLVIII of 2008 on the basic requirements of and certain restrictions on commercial advertising activity, Section 6 (1)]

8.2. What type of data do we process?

Magyar Posta Zrt. processes the following personal data under the MyPost Loyalty Programme service:

8.3. Why are the data processed?

• to perform the MyPost Loyalty Programme service
  – to issue a card in the individual’s name,
  – to identify the customer,
  The MyPost Card also serves to identify the person using certain services available at the post office and on the internet. If the data subject registers the MyPost Card in his or her online account (MyPost), the services for which Magyar Posta Zrt. uses a higher level identification in order to protect data also become accessible. The data entered for the MyPost Card are recorded in the data subject’s account and they can be replaced or deleted except for the most important personal information for identification, which was checked by Magyar Posta when meeting in person.
  – to collect and account points,
  – to handle customer requests and complaints about the service,
• to provide group accident insurance related to the MyPost Card
• in the event of the data subject’s separate consent irrespective of the use of the MyPost Card
  
  – to enable Magyar Posta Zrt. to contact the data subject with its own advertisements and offers as well as those of its contractual partners by e-mail, telephone, text message or post;
  – to analyse the services used by the data subject in order to develop Magyar Posta’s services and research its markets, and to use the results of this research to send its own advertisements and offers and those of its contractual partners as well as to define the relevant target groups (profiling).

8.4. How long do we process the data for?

Magyar Posta Zrt. processes the data subject’s data processed for the purposes of issuing a card in the individual’s name, identifying the customer, collecting and accounting points, and handling customer requests and complaints related to the service for five (5) years after the termination of the MyPost Card contract because within this period the data subject may enforce any legal dispute that may arise between Magyar Posta Zrt. and the data subject in court.

If data processing becomes necessary due to the establishment, exercise or defence of any legal claim related to the service (e.g. court proceedings), Magyar Posta will process the data for the period necessary for the establishment, exercise or defence of the legal claims.

Magyar Posta Zrt. processes data processed for the purposes of analysing shopping habits and for contacting the data subject with advertisements and offers until the data subject’s consent is withdrawn but no later than 2 years after the last card activity.

The data subject may withdraw consent at any time via the contact options described in point 37.9. Withdrawal of consent, however, does not affect the lawfulness of processing carried out based on consent before its withdrawal.

8.5. Who do we transfer your data to? (Who are the recipients of your data?)

In the course of providing the MyPost Card service, Magyar Posta Zrt. uses Posta InIT Zrt. (address: 1138 Budapest, Dunavirág utca 2-6, Company registration number: 01 10 047115, Tax number: 23448577-2-41) as the data processor, which, as a further data processor, uses Díjbeszedő Holding Zrt. (address: 1117 Budapest, Budafoki út 107-109, Company registration number: 01-10-042094, Tax number: 10805246-2-43), which operates the system that records the point collection and accounting.

In connection with the online application for a MyPost Card and registering the MyPost Card on the MyPost interface, Magyar Posta Zrt. uses the data processors participating in the operation of the MyPost interface and specified in point 25.5.

For data processing for the purpose of forwarding information about its own and its contracted partners’ offers and advertisements by post, e-mail, phone or text message, Magyar Posta Zrt. uses the printing and e-mailing services of EPDB Nyomtatási Központ Zártkörűen Működő Részvénytársaság (1117 Budapest, Budafoki út 107-109, Company registration number: 01 10 048079, Tax number: 24924243-2-43) as well as the e-mailing services of Magyar Posta Zrt.’s currently engaged creative agency. The details of Magyar Posta Zrt.’s currently engaged creative agency are given on the website www.posta.hu under Privacy Notice in the menu.

8.6. Who may access the data?

Magyar Posta Zrt. processes personal data allowing access only to those who need them to carry out the service you require. Thus post office clerks registering your request to receive a MyPost Card, personnel processing the request at the Postal Accounting Centre, staff responsible for market analysis and defining target groups for advertisements and offers, as well as those involved in checking the performance of the service, accounting and examining complaints have access to these data. There are special units dedicated to regularly checking Magyar Posta’s internal operations and the compliance of its activities with regulations, thus the staff engaged in such controls (operations inspectors, internal auditors, security and protection staff, data protection officers) have access to these data provided this is essential for carrying out their duties.

In view of the fact that Magyar Posta provides group accident insurance to all MyPost Card holders, the data are also accessible to the staff of Magyar Posta Biztosító Zrt. (Company registration number: 01-10-044751; Registered office: 1022 Budapest, Bég utca 3-5; Postal address: Posta Biztosító 1535, Budapest, Pf. 952, https://www.postabiztosito.hu/, info@mpb.hu) handling group accident insurance; Magyar Posta Zrt. transmits the data of the insured persons to Magyar Posta Biztosító Zrt. for the purpose of identification, and Magyar Posta Biztosító Zrt. processes these data while the group accident insurance is valid.

9. Customs clearance and customs brokerage service

The goods sent in international mail shall be subjected to customs clearance- in accordance to the relevant legislation. To this end, Magyar Posta Zrt., as a postal service provider, is obliged to handle the data of senders and addressees of the items it handles for presentation to customs clearance. The addressee – if regulation permits – may instruct either Magyar Posta Zrt. or any other customs agent to act as a custom broker, or state that he or she wishes to do the customs clearance of the mail item themselves. In order to provide the missing data required for either the customs clearance or the fulfilment of the addressee’s mandate, Magyar Posta Zrt processes the data of the addressee and notifies them that a postal item in need of customs clearance has arrived. Therefore the addressee may present the needed data or documents.

9.1. On what grounds is Magyar Posta entitled to process the data?

Magyar Posta Zrt. is entitled to process the data on the following grounds:

• In case of a customs clearance mandate the processing of the personal data is necessary for the conclusion and performance of the customs clearance order as a contract, which is concluded between the person submitting a mandate and Magyar Posta Zrt. [General Data Protection Regulation, Article 6(1)(b), Regulation (EU) No 952/2013 of the European Parliament and of the Council (hereinafter UCC) Articles 18 and 19]
• in order to fulfil the obligations arising from the customs supervision of a postal item involved in customs clearance procedure but handled by another customs broker, data processing is required under Article 134 of the UCC.

Furthermore the procession of the data is required for fulfilling legal obligations laid forth in the following regulations:

• Regulation (EU) No 952/2013 of the European Parliament and of the Council of 9 October 2013 laying down the Union Customs Code
• Commission Delegated Regulation (EU) 2015/2446 of 28 July 2015 supplementing Regulation (EU) No 952/2013 of the European Parliament and of the Council as regards detailed rules concerning certain provisions of the Union Customs Code
• Commission Implementing Regulation (EU) 2015/2447 of 24 November 2015 laying down detailed rules for implementing certain provisions of Regulation (EU) No 952/2013 of the European Parliament and of the Council
• Council Regulation (EC) No 1186/2009 setting up a community system of reliefs from customs duty
• Act CLII of 2017 on the implementation of the Union Customs Law in regards to customs clearance procedure, customs valuation, supplying of data and keeping of data
• To determine the amount of tax payable and to fulfil the registry requirements in case of application of a special procedure for a product imported from a third country not exceeding an internal value of EUR 150, based on ph. 253 X-253 ZA of the Act 137 of 2007 of Hungary
• For tax settlement and retention of tax warrants based on Act 150 of 2017 (hereinafter Tax Act)
• For the retention of all relevant accounting documents based on the Act 100 of 200 of Hungary
• Magyar Posta Zrt. also processes the e-mail address and telephone number of the addressee, as it is necessary for the legitimate interest of the data subject and Magyar Posta Zrt.: to establish an efficient and effective procedure of collecting missing data and information and to implement such conduct quickly, flexibly and efficiently, thus increasing customer satisfaction.

9.2. What type of data do we process?

 

9.3. Why are the data processed?

• to enable us to conclude the customs clearance mandate given by the data subject
• to enable us to act on behalf of the data subject in matters related to the mail item before the customs authority – as defined in the relevant legislation
• to submit a customs declaration form in case of application of a special procedure for a product imported from a third country not exceeding an internal value of EUR 150, as well as to determine the amount of tax payable and to fulfil the registry requirements based on ph. 253 X-253 ZA of the Act 137 of 2007 of Hungary
• to fulfil requirements set out in the Act 100 of 2000 of Hungary and to obtain verification of tax paid to the National Tax and Customs Administration
• for the fulfilment of beforementioned purposes, contacting the relevant party and providing information and pass information and/or requests for information on the conditions required for the procedure

9.4. How long do we process the data for?

Under Act CLII of 2017 on the implementation of the Union Customs Law, Section 33, Magyar Posta Zrt. is obliged to process the data subject’s data for 10 years.

In case of application of a special procedure for a product imported from a third country not exceeding an internal value of EUR 150, Magyar Posta is obliged to process data for 5 years from the year in which the tax was due, based on ph. 77,78 and 202-205 of the Tax Act and -for the purpose of retention of accounting documents-for 8 years based on ph.166 (1) and 169 (2) of the Act 100 of 2000.

9.5. Who do we transfer your data to? (Who are the recipients of your data?)

As a procedure involving the National Tax and Customs Administration is an essential characteristic of any customs clearance process, Magyar Posta Zrt. transfers the data subject ‘s personal data needed for the procedure to the National Tax and Customs Administration.

Magyar Posta Zrt. does not use a data processor.

9.6. Who may access the data?

Magyar Posta Zrt. processes personal data allowing access only to those who need them to carry out the service the data subject requires. Personal data may be accessed by staff recording the data, customs administration employees, application operators handling the IT system storing the data as well as the National Tax and Customs Administration’s employees conducting the customs procedure to the extent and for the purpose necessary for carrying out their duties.

There are special units dedicated to regularly checking Magyar Posta Zrt.’s internal operations and the compliance of its activities with regulations, thus the staff engaged in such controls (operations inspectors, internal auditors, security and protection staff, data protection officers) have access to these data provided this is essential for carrying out their duties.

10. Post Office Box rental and the list of PO Box holders

PO Box rental is Magyar Posta Zrt.’s service whereby a post office box is provided at a postal outlet into which mail items are delivered to be collected by the customer. A PO Box has its own address, allowing letters to be addressed directly to it. This is facilitated by Magyar Posta Zrt. by making publicly available the list of PO Box holders, where holders can choose to appear voluntarily.

10.1. On what grounds is Magyar Posta entitled to process the data?

• The processing of the data of data subjects who have entered into a Post Office Box rental contract is necessary for the conclusion and performance of the contract, which is concluded between the customer and Magyar Posta Zrt. [General Data Protection Regulation, Article 6(1)(b)]
• It is not compulsory for the PO Box holder to appear in the list of PO Box holders and the holder can decide about this at his or her discretion. Thus Magyar Posta Zrt. includes the PO Box holder’s data in the list of PO Box holders based on the data subject’s voluntary consent. [General Data Protection Regulation, Article 6(1)(a)]

10.2. What type of data do we process?

10.3. Why are the data processed?

• to create the contract for the Post Office Box rental,
  A contract is created between Magyar Posta Zrt. and the data subject, and for this the person renting the box as the contracted customer of Magyar Posta Zrt. must be specified.
• to define and amend the contents of the contract,
• to monitor the performance of the contract,
  Both the person placing the order and Magyar Posta Zrt. have obligations under the contract. The person placing the order is obliged to pay the fee and Magyar Posta is obliged to make the rented PO Box available.
• to bill the fees charged under the contract,
• in the list of Post Office Box holders, we process the data of the PO Box holder to be able to publish, based on the holder’s consent and instruction, the holder’s name, address, and PO Box number and postcode in the list of Post Office Box holders, thus making the data public in order to enable senders to send mail items to the data subject’s rented Post Office Box.

10.4. How long do we process the data for?

Magyar Posta processes the data related to the performance of the Post Office Box rental contract for 5 years after the termination of the contract because within this period the data subject may enforce any legal dispute that may arise between Magyar Posta Zrt. and the data subject in court.

If data processing becomes necessary due to the establishment, exercise or defence of any legal claim related to the service (e.g. court proceedings), Magyar Posta Zrt. will process the data for the period necessary for the establishment, exercise or defence of the legal claims.

Magyar Posta Zrt. must account for the fees specified by contract, thus it is obliged to keep the contract as an accounting document for 8 years as stipulated in the Accounting Act.

Magyar Posta Zrt. processes the data subject’s data in the list of Post Office Box holders until withdrawal of consent or, in the lack of this, while the Post Office Box rental contract remains effective.

The data subject may withdraw consent given to be included on the list of Post Office Box holders at any time via the contact options described in point 37.9. Withdrawal of consent, however, does not affect the lawfulness of processing carried out based on consent before its withdrawal.

10.5. Who do we transfer your data to? (Who are the recipients of your data?)

Magyar Posta Zrt. provides its Post Office Box rental service with the aid of postal contractors at many points in Hungary. Postal contractors are undertakings that are contracted by Magyar Posta to provide Post Office Box rental services for customers in the name of, for and at the liability of Magyar Posta applying the rules laid down by Magyar Posta. Accordingly, postal contractors are Magyar Posta Zrt.’s data processors. If you would like to view the list of postal contractors, you can access it on the www.posta.hu page under Privacy Notice in the menu.

10.6. Who may access the data?

Magyar Posta Zrt. processes personal data allowing access only to those who need them to carry out the service you require. Thus the data of the Post Office Box rental contract may be accessed by persons recording the data, those responsible for concluding the Post Office Box rental contract, postal product managers handling the Post Office Box rental contracts, as well as application operators managing the IT system storing the data, the employees involved in forwarding mail (sorting and delivery personnel) and those involved in checking the performance of the service, accounting and examining complaints. There are special units dedicated to regularly checking Magyar Posta Zrt.’s internal operations and the compliance of its activities with regulations, thus the staff engaged in such controls (operations inspectors, internal auditors, security and protection staff, data protection officers) have access to these data provided this is essential for carrying out their duties. In addition, the personnel involved by Magyar Posta Zrt.’s subcontractors and postal contractors as data processors in carrying out the activity may also access data.

We are obliged to cooperate with the organisations authorised to prevent and investigate crime, and to gather intelligence in secret. [Postal Services Act, Section 38, and Government Decree 9/2005 of 19 January 2005] Magyar Posta Zrt. only provides personal data to or allows access to personal data for these organisations if the precise purpose and data range is indicated and only does so to the extent that is absolutely necessary for the purpose of the request and is suitable to achieve the objective.

Furthermore, the specific purpose of the list of Post Office Box holders is to make public and accessible to everyone searching in it the data of holders wishing to be included in it. Thus the data are accessible to everyone.

11. Processing the data of contact persons and representatives

11.1. On what grounds is Magyar Posta entitled to process the data?

Magyar Posta Zrt. processes the data based on the General Data Protection Regulation, Article 6(1)(f), as the data are necessary to assert its legitimate interest as follows:

• in order to ensure the contractual performance of the contract, the Parties need to keep in contact with each other and hold the consultations necessary for the performance of the contract, and
• to prove that the contractual commitment was made by the person authorised to act and make declarations on behalf of the parties, which is legally acknowledged for those holding the right to sign for their company by Act V of 2006 on public company information, company registration and winding up procedure (hereinafter referred to as the “Company Act”), Section 22

Furthermore, Act C of 2000 on accounting creates a legal obligation to process data appearing in accounting documents. [General Data Protection Regulation, Article 6(1)(c)]

If an individual entrepreneur acts as a contractor for or makes other legal declarations to Magyar Posta Zrt. on his/her own behalf, Magyar Posta Zrt. will process the data of the natural person, as the data subject, acting as an individual entrepreneur in the course of his/her economic activity in order to prepare and conclude the contract and then perform it [General Data Protection Regulation, Article 6(b)] in accordance with Act CXV of 2009 on individual entrepreneurs and sole traders (hereinafter referred to as the “Individual Entrepreneur Act”).

If a natural person acting as an individual entrepreneur or on behalf of or representing a legal entity connected with Magyar Posta Zrt. performs his/her activities through an IT application provided by Magyar Posta Zrt., Magyar Posta Zrt. will process the data necessary for accessing the application on the ground of its legally recognised legitimate interest in ensuring an adequate level of security for the IT systems and the data processed through them. [General Data Protection Regulation, Article 6(1)(f)]

11.2. What type of data do we process?

Magyar Posta Zrt. informs data subjects that their data, with the exception of natural persons acting as individual entrepreneurs, have been provided to Magyar Posta Zrt. by the legal entity employing them.

Magyar Posta Zrt. informs data subjects that, with the exception of natural persons acting as individual entrepreneurs, the appropriate legal basis for providing their data to Magyar Posta Zrt. must be ensured by the legal entity providing the data in the legal relationship between the representative as the data subject and the legal entity. Consequently, data subjects are to submit any requests with regard to data processing primarily to the legal entity providing their data. Inasmuch as the data subject indicates any objection to data processing or request for the erasure, restriction (blocking) or rectification of data to Magyar Posta via the given contact details, Magyar Posta will notify the legal entity providing the data of the request in view of the above.

11.3. Why are the data processed?

Purpose of data processing

• to identify the representative and the person authorising the representative, including the grantor, as well as the data subject acting as an individual entrepreneur
• to establish and check the right of representation of the representative and the right to make a declaration of the data subject acting as an individual entrepreneur
• to ensure contact between the organisations
• to ensure contact with the data subject acting as an individual entrepreneur
• to prove the existence of the commitment and declaration made by the representative, contact person and the data subject acting as an individual entrepreneur and that these originate from the person having the right of representation
• to prepare, conclude and perform a contract with the data subject acting as an individual entrepreneur and the legal person represented, and to check and verify the conformity of the performance of the contract

to ensure access rights to IT applications made available by Magyar Posta Zrt. to the legal person or the person acting on behalf of the organisation or the person acting as an individual entrepreneur.

Magyar Posta Zrt. informs data subjects that it monitors its internal operation, the employee’s work and the regularity of work in accordance with the provisions of Section 11/A of Act I of 2012 on the Labour Code, thus, in cases where the monitoring covers work involving keeping in contact with the data subject, the data subject’s data will be processed for the purpose of inspecting the employee’s work activities, including events of keeping in contact with the data subject, related documents, and data recorded by e-mail or other electronic means during communication in connection with work.

11.4. How long do we process the data for?

If the representative’s and contact person’s data do not appear in the contract or other accounting document, the duration of data processing is 3 years from the discontinuation of the right of representation or the right to act as a contact person.

In view of the fact that the underlying rule for concluding and performing the contract or for making other declarations under civil law is Act V of 2013 on the Civil Code, Magyar Posta Zrt. processes the data of natural persons, as data subjects, acting as an individual entrepreneur for 5 years as the data subject can initiate a dispute before a court in a legally enforceable manner during this period [Civil Code, Section 6:22].

If the representative’s and contact person’s data appear in the contract or other accounting document, the duration of data processing, in view of the fact that the integrity of accounting documents must be ensured under legislation on accounting, is the deadline laid down to keep the contract as an accounting document, that is 8 years calculated from the year following the year in which the contract terminated. [Accounting Act, Section 169(2)]

In cases where, in accordance with Section 11/A of Act I of 2012 on the Labour Code (hereinafter referred to as the “Labour Code”), the data of the data subject are also processed for the purpose of monitoring employees’ work involving contact with the data subject, Magyar Posta Zrt. will process the data for 3 years having regard to Section 286 of the Labour Code as, without the evidence provided by these data, the findings of monitoring the work of the employee cannot be proven.

11.5. Who do we transfer your data to? (Who are the recipients of your data?)

Magyar Posta Zrt. does not use a data processor for processing the data.

Based on a statutory obligation, Magyar Posta may forward the data to persons, organisations and authorities specified by law upon their request.

11.6. Who may access the data?

The data may be accessed by the contact persons specified in the contract and employees drafting the contract and preparing the declaration on behalf of the organisation. The data may also be accessed by staff operating the contract register.

Moreover, in view of the fact that the data of persons authorised to represent a company recorded in the company register and those of individual entrepreneurs recorded in the register of individual entrepreneurs are public for reasons of public interest, they can be accessed by anyone.

There are special units dedicated to regularly checking Magyar Posta Zrt.’s internal operations and the compliance of its activities with regulations, thus the staff engaged in such controls (operations inspectors, internal auditors, security and protection staff, data protection officers) have access to these data provided this is essential for carrying out their duties.

The data may also be accessed in a specific procedure by organisations and authorities authorised to do so by law to the extent that is absolutely necessary for the purpose of realising the objective of their request or obligation prescribed by law and is suitable to achieve this objective.

12. Handling authorisations (eAuthorisation)

12.1. On what grounds is Magyar Posta Zrt. entitled to process the data?

Magyar Posta Zrt. processes the data in compliance with the General Data Protection Regulation, Section 6(1)(f), as they are necessary for the assertion of Magyar Posta’s legitimate interests. Magyar Posta’s legitimate interests are:

• to ensure the handover of mail items to the person specified by the addressee,
• to check the entitlement to receive mail items,
• to ensure that the entitlement of the authorised person is easy to check on the spot when delivering mail items by the use of a standard format authorisation document and to ensure the preliminary examination of the compliance of authorisations in various forms in the interest of the safety of mail traffic and in order to prevent the unauthorised receipt of mail,
• to ensure the receipt of mail items by the authorised person in accordance with Act CLIX of 2012 on postal services, Section 41 (7), pursuant to the provisions of Government Decree 335/2012 of 4 December 2012 on the detailed rules for the provision of postal services and the postal service related to official documents, as well as on the general terms and conditions of postal service providers, and on items excluded from postal services or items that may only be carried upon certain conditions (hereinafter referred to as the “Gov. Dec.”) and
• to fulfil the obligation to accept the authorisation described in the Gov. Dec., Section 19(9),
• to ensure the integrity, unchanged content and completeness of the submitted documents containing the authorisation, in other words that they are preserved in the form and with the content as submitted by the person granting authorisation, in order to prove the right of representation − ensuring the evidential force of the authorisation pursuant to Act CXXX of 2016 on the Code of Civil Procedure, Sections 323 to 327.

12.2. What type of data do we process?

* Magyar Posta Zrt. does not record the data marked by an asterisk in the postal system for authorisations accepted from 1 February 2019 but stores the data given on the submitted authorisation only on paper in order to be able to provide evidence, ensuring the integrity, unchanged content and completeness of the documents, in other words that they are preserved in the form and with the content as submitted by the person granting authorisation.

Please note that your personal details will be recorded directly from you (or with regard to an authorised person from the authorising person) in the following way. When you make your instruction of authorisation, you provide us with your data on the postal form used specifically for this purpose, in a public document or in a private document of full probative value, or through the eAuthorisation business application as part of the MyPost service on Magyar Posta Zrt.’s website ( www.posta.hu).

We point out to data subjects that Magyar Posta makes available the eAuthorisation application for them on its online interface called MyPost. Access to the site is subject to registration and, in order to ensure the protection and security of data and to ensure and check the right to grant authorisation, Magyar Posta Zrt. only allows the use of the eAuthorisation service after a higher level of identification for the registered person in which the person’s real personal data are checked. The rules of using the MyPost interface are given in the “GTC for Certain Electronic Services and Business Applications” accessible on www.posta.hu under General Terms and Conditions in the menu. ( https://www.posta.hu/ugyfelszolgalat/aszf/egyeb_aszf_2)

12.3. Why are the data processed?

Magyar Posta processes the data of authorisations granted by its customers in order to

• check and establish the authority of the person(s) authorised by the authorising person to receive mail in the course of delivery,
• prove and verify the entitlement to receive mail,
• issue the authorisation document,
• fulfil the obligation to accept the authorisation.

12.4. How long do we process the data for?

Magyar Posta Zrt. processes the data of authorisations for 5 years calculated from the date when the authorisation ceases to be valid. Thereafter, the data will be irrevocably erased, and paper-based documents will be treated in the manner identical to waste from discarded archives in accordance with Magyar Posta Zrt.’s Environmental Protection Regulations and centrally destroyed observing data and confidentiality rules except for cases where retaining the data is justified in order to fulfil Magyar Posta Zrt.’s legal obligation or by legal proceedings. In such cases the data will be retained until the legal obligation is fulfilled or until the final outcome of the proceedings.

12.5. Who do we transfer your data to? (Who are the recipients of your data?)

Magyar Posta Zrt. provides its postal services with the aid of postal contractors at many points in Hungary. Postal contractors are undertakings that are contracted by Magyar Posta Zrt. to provide postal services for customers in the name of, for and at the liability of Magyar Posta Zrt. applying the rules laid down by Magyar Posta Zrt. Accordingly, postal contractors are Magyar Posta Zrt.’s data processors, who process the data specified in point 12.2 both when recording the authorisations and in the course of delivery. If you would like to view the list of postal contractors, you can access it on the www.posta.hu page under Privacy Notice in the menu.

In order to operate the MyPost interface and thus the eAuthorisation application, Magyar Posta Zrt. uses the data processors specified in point 25.5.

12.6. Who may access the data?

The data may be accessed by Magyar Posta Zrt.’s employees involved in recording and processing authorisations, delivering mail items and responsible for their management.

Furthermore, the data may be accessed by the employees of Magyar Posta Zrt.’s designated organisational units responsible for checking Magyar Posta Zrt.’s internal operations and the compliance of work with the regulations, acting in their area of competence, (operations inspectors, internal auditors, security and protection staff, data protection officers) provided this is essential for carrying out such controls. The personnel of Magyar Posta Zrt.’s subcontractors participating in the performance of a postal service contract and postal contractors involved in carrying out the activity may also access the data.

It is our legal obligation to disclose or provide access to data to the National Media and Infocommunications Authority [Postal Services Act, Section 53], the court, the prosecutor’s office, the investigating authority, the offence authority, the administrative authority, the National Authority for Data Protection and Freedom of Information, and any other body authorised by law, upon their request. We are obliged to cooperate with the organisations authorised to prevent and investigate crime, and to gather intelligence in secret. [Postal Services Act, Section 38, and Government Decree 9/2005 of 19 January 2005]

Magyar Posta Zrt. only provides personal data to or allows access for these organisations if the precise purpose and data range is indicated and only does so to the extent that is absolutely necessary for the purpose of the request and is suitable to achieve the objective.

13. Handling of suspected counterfeit and incomplete banknotes and coins

Magyar Posta has a legal obligation to accept suspected counterfeit banknotes, banknotes whose completeness does not, or does not obviously, exceed 50% of the original and suspected counterfeit coins, and to withdraw and send them to the Magyar Nemzeti Bank for technical examination together with the personal data of the payer or the owner of the money.

13.1. On what grounds is Magyar Posta entitled to process the data?

• Act CXXXIX of 2013 on the Magyar Nemzeti Bank (hereinafter referred to as the “MNB Act”), Section 24, which creates a legal obligation for the processing of the data [General Data Protection Regulation, Article 6(1)(c)]
• Under the cited law, the following documents also include provisions related to data processing:
  – MNB Decree 1/2023 of 17 January 2023 on the processing and distribution of banknotes and on technical tasks relating to the protection of banknotes against counterfeiting, Sections 22 to 24, 29(5) and (6), and Annex 4
  – MNB Decree 20/2019 of 13 May 2019 on the processing and distribution of coins and on technical tasks relating to the protection of coins against counterfeiting, Sections 7 to 9, and Annex 2

These rules are intended to detect counterfeiters and to enable the Magyar Nemzeti Bank to withdraw counterfeit money and incomplete banknotes from circulation. However, clearly identifying counterfeit money and accurately determining the size of the incomplete banknotes is an expert task, thus sometimes money that is genuine may appear to be counterfeit or money whose size exceeds 50% of the original banknote is withdrawn. In order to refund the value of the money thus withdrawn to the rightful owner after the Magyar Nemzeti Bank’s technical examination, it is necessary to record who the person intending to pay with that money is. Magyar Posta Zrt. has to record these data and transmit them to the Magyar Nemzeti Bank.

13.2. What type of data do we process?

13.3. Why are the data processed?

The data are processed for the purpose of transferring the suspected counterfeit or incomplete money to the Magyar Nemzeti Bank for technical examination by the Bank.

If the money is not counterfeit or the size of the banknote is more than 50%, we also process the data in order to refund its value to the payer or the owner of the money.

13.4. How long do we process the data for?

Magyar Posta is obliged to keep the data for 8 weeks from the date of payment. [MNB Decree 1/2023 of 17 January 2023, Section 22(4)]

13.5. Who do we transfer your data to? (Who are the recipients of your data?)

Magyar Posta Zrt. uses CIVIL Értéklogisztika Zrt. (Company registration number: 01-10-048525; Registered office: 1152 Budapest, Telek utca 5) for processing suspected counterfeit or incomplete banknotes. Suspected counterfeit and incomplete banknotes together with the record made of them are sent by CIVIL Értéklogisztika Zrt. to the Magyar Nemzeti Bank’s National Counterfeit Centre of the Cash Logistics Directorate (Address: 1013 Budapest Krisztina körút 55).

13.6. Who may access the data?

Magyar Posta Zrt.’s staff who handle the inpayment or accept the suspected counterfeit banknotes or coins (post office clerks) have access to the data. A report of the suspected counterfeit banknotes or coins is drawn up by the staff upon receipt of which the customer receives one copy. After this, the data may be accessed by personnel involved in checking the accounts, who transfer the data to CIVIL Értéklogisztika Zrt. for preliminary examination and through their participation transmit them to the Magyar Nemzeti Bank. Thus the staff of CIVIL Értéklogisztika Zrt. involved in the preliminary examination have access to the data. If the technical examination shows that the money is not counterfeit or its size is over 50% of the original banknote, the money is sent to the payer on a domestic postal order by the staff checking the accounts.

The data of the data subject noted in the report are accessed by the Magyar Nemzeti Bank’s National Counterfeit Centre of the Cash Logistics Directorate (Address: 1013 Budapest, Krisztina körút 55), as this is where Magyar Posta Zrt. must transfer the data.

There are special units dedicated to regularly checking Magyar Posta’s internal operations and the compliance of its activities with regulations, thus the staff engaged in such controls (operations inspectors, internal auditors, security and protection staff, data protection officers) have access to these data provided this is essential for carrying out their duties.

14. Data processing to prevent money laundering

In order to prevent money laundering and terrorist financing, Hungary, too, requires the recording of data which enable the transfer of funds to be traced so that persons laundering money and financing terrorism can be identified. Magyar Posta must record such data and in certain cases transmit them to the authorities. If the data subject does not give the data, Magyar Posta must refuse to provide the service. Magyar Posta informs data subjects that, for services where Magyar Posta acts as an intermediary for a financial body, the data processing to prevent money laundering is governed by the privacy policy of the principal financial body instead of Magyar Posta’s privacy policy.

14.1. On what grounds is Magyar Posta Zrt. entitled to process the data?

A legal obligation [General Data Protection Regulation, Article 6(1)(c)] to process data is created by the following laws:

• Act LIII of 2017 on the prevention and combating of money laundering and terrorist financing (hereinafter referred to as the “Anti-ML Act”) and
• Act LII of 2017 on the implementation of the financial asset restraint measures imposed by the European Union and the UN Security Council (hereinafter referred to as the “Restraint Act”)⁸ and
• Act XLIII of 2021 on the establishment and operation of the data reporting background for the identification tasks of financial and other service providers (hereinafter referred to as the “ID Tasks Act”).

The Anti-ML Act defines the detailed rules of the measures and data records necessary in order to prevent money laundering and terrorist financing that Magyar Posta is obliged to abide by. These are required by both the National Tax and Customs Administration and the Magyar Nemzeti Bank as supervisory bodies, and are interpreted in model regulations and recommendations, expressing the general provisions of the law as specific requirements.

8 For data recorded prior to 1 January 2018, Act CXXXVI of 2007 on the prevention and combating of money laundering and terrorist financing.

14.2. What type of data do we process?

14.3. Why are the data processed?

Magyar Posta Zrt. processes the data based on its legal obligation for the following purposes:

• to identify data subjects using financial services and the international postal order⁹ service
• to identify beneficial owners and fulfil the relevant reporting obligations
• to monitor and filter transactions that pose a risk from the aspect of preventing money laundering or terrorist financing,
• to report to the Anti-Money Laundering and Terrorist Financing Office of the Central Office of the National Tax and Customs Administration in the event of suspicion,
• to examine transactions and payments that are connected in cases defined by law,
• to monitor the flow of funds in business relations with the data subject.

9 Data subjects should note that Magyar Posta Zrt. discontinued the international postal money order and international express order service on 16 October 2022, thus it is no longer possible to use these services, i.e. no data will be recorded in this connection. Pursuant to Section 56 of the Anti-ML Act, Magyar Posta Zrt. is obliged to manage for 8 years from the date of performing the transaction the data recorded previously.

14.4. How long do we process the data for?

Magyar Posta Zrt. is obliged to process the data for 8 years. [Anti-ML Act, Section 56]

Certain data may have to be kept by Magyar Posta Zrt. for longer but a maximum of 10 years. This situation arises if the Magyar Nemzeti Bank, the Anti-Money Laundering and Terrorist Financing Office of the Central Office of the National Tax and Customs Administration, the investigating authority, the public prosecutor’s office or the court requests Magyar Posta to retain the data for a specified period longer than 8 years, which may not be more than 10 years.

14.5. Who do we transfer your data to? (Who are the recipients of your data?)

Upon request, Magyar Posta Zrt. is obliged to send the data to the Magyar Nemzeti Bank [address: 1013 Budapest, Krisztina körút 55], the Anti-Money Laundering and Counter-Terrorist Financing Office of the Central Office of the National Tax and Customs Administration [Nemzeti Adó- és Vámhivatal Központi Hivatala Pénzmosás és Terrorizmusfinanszírozás Elleni Irodája, address: 1033 Budapest, Huszti út 42. PO Box: 1300 Budapest, Pf.: 307.] or to the investigating authority, the prosecutor’s office or the court. Thus these entities may also access the data. [Anti-ML Act, Sections 31 and 58(1)]

In the event of a discrepancy, compared to the register of beneficial owners, detected in the beneficial owner’s data when the data of the beneficial owner are recorded, Magyar Posta Zrt. will also forward those data to the National Tax and Customs Administration. [ID Tasks Act, Section 11]

Magyar Posta Zrt. does not use data processors for processing these data.

14.6. Who may access the data?

Magyar Posta Zrt. requires strict authorisation for allowing access to such data. The data subject’s data are accessible to the employee accepting the money or the sales representative concluding a contract when recording the transaction. In addition to this, staff responsible for analysis and data supply required to prevent money laundering and terrorist financing, and designated employees forwarding reports to the Anti-Money Laundering and Terrorist Financing Office of the Central Office of the National Tax and Customs Administration have access to the data. Magyar Posta Zrt. inspects the fulfilment of measures and tasks in order to prevent money laundering and terrorist financing every year. Thus the data of data subjects are also accessible to employees engaged in such controls (internal auditors, security and protection staff, data protection officers) inasmuch as this is essential to carry out the controls (for example, inspecting the proper completion of identification data sheets).

14.7. Can the data subject receive information about any data, fact or circumstance arising in connection with him or her with regard to money laundering or terrorist financing?

Magyar Posta Zrt. must refuse providing any information if the data subject requests information about a report made in the event of any piece of data, fact or circumstance arising that indicates money laundering or terrorist financing, or about the suspension of the transaction or whether criminal proceedings have been instituted against the data subject. [Anti-ML Act, Section 54]

15. Magyar Posta as the carrier

One of Magyar Posta’s basic activities is to transport mail items from senders to addressees, which it also performs as a carrier.

15.1. On what grounds is Magyar Posta Zrt. entitled to process the data?

During its activities related to carriage, i.e. forwarding and delivering mail items to addressees, Magyar Posta Zrt. is entitled to process data on the following grounds:

• the processing of the sender’s personal data is necessary for the conclusion and performance of the contract for carriage, which is concluded between the sender and Magyar Posta Zrt. [General Data Protection Regulation, Article 6(1)b)]
• while the processing of the addressee’s and the recipient’s personal data is necessary for the assertion of the legitimate interest of the sender and Magyar Posta Zrt., which is demonstrated by the fact that without it the performance and verification of the contract would not be possible under the statutory terms and conditions for the fulfilment of the contract for carriage [General Data Protection Regulation, Article 6(1)(f)]

Furthermore, the contract for carriage is regulated under

• Act V of 2013 on the Civil Code (hereinafter referred to as the “Civil Code”), Sections 6:257 to 6:271
  Magyar Posta Zrt., as the carrier, processes the sender’s and the addressee’s data as well as information on the documents required for handling the mail item during carriage necessary for providing the service pursuant to the rules of the cited law.

15.2. What type of data do we process?

15.3. Why are the data processed?

We process the data in order to deliver mail items to their addressees in compliance with the instructions that apply to us made by the sender or the addressee, and the rules defined by law.

The data are required to confirm to senders that their mail item was delivered in accordance with their instructions and to ensure that everything occurred correctly. At the same time, it is important to be able to investigate complaints and claims for compensation, which we could not do without processing the data necessary to deliver the mail items.

15.4. How long do we process the data for?

Magyar Posta Zrt. processes personal data for five (5) years after fulfilling the carriage contract, i.e. handing over the mail item to the recipient, in view of the fact that within this period the data subject may enforce any legal dispute that may arise between Magyar Posta Zrt. and the data subject in court.

Magyar Posta Zrt. is accountable for the contract, thus it is obliged to keep the data of the contract for 8 years as stipulated in the Accounting Act.

If data processing becomes necessary due to the establishment, exercise or defence of any legal claim related to the service (e.g. court proceedings), Magyar Posta will process the data for the period necessary for the establishment, exercise or defence of the legal claims.

15.5. Who do we transfer your data to? (Who are the recipients of your data?)

Magyar Posta Zrt. uses subcontractors for its carriage activity, who take part in the forwarding and delivery of mail to the addressees, and, to do this, process data that are essential for this. If you would like to view the list of subcontractors used, you can access it on the www.posta.hu page under Privacy Notice in the menu.

15.6. Who may access the data?

Magyar Posta Zrt. processes personal data allowing access only to those who need them to carry out the service you require. Thus staff involved in forwarding mail (post office clerks, sorting and delivery personnel) as well as those involved in checking the performance of the service, accounting and examining complaints have access to the data of mail items. There are special units dedicated to regularly checking Magyar Posta’s internal operations and the compliance of its activities with regulations, thus the staff engaged in such controls (operations inspectors, internal auditors, security and protection staff, data protection officers) have access to these data provided this is essential for carrying out their duties. In addition, the personnel involved by Magyar Posta’s subcontractors, as data processors, in carrying out the activity may also access data.

16. Processing video data

Magyar Posta Zrt. operates video cameras in its properties. Information on each camera is available at the location where each camera operates. Here only the general rules which govern the operation of Magyar Posta’s cameras are summarised.

16.1. On what grounds is Magyar Posta entitled to process the data?

Magyar Posta Zrt.’s processing of personal data during camera surveillance is based on its legally and socially recognised legitimate interest to protect the lives, physical integrity and property of people in postal buildings and facilities, and the property of Magyar Posta Zrt. as well as the data and valuables managed by and entrusted to it, for which it is necessary to monitor the processes taking place in the building by means of image recording equipment. [General Data Protection Regulation, Article 6(1)(f)]

16.2. What type of data do we process?

16.3. Why are the data processed?

Magyar Posta Zrt. processes video footage in order to prevent crimes being committed, and to protect the life, physical integrity and property of people entering or working at the postal facilities together with their business, payment, bank, insurance, securities, cash-desk and correspondence secrets, including those handled by Magyar Posta Zrt., as well as Magyar Posta Zrt.’s property, and to ensure that any potential event threatening these can be detected and evidenced.

16.4. How long do we process the data for?

The recordings are kept for 30 days at most unless a request is received for them not to be destroyed, in which case they are kept for 30 days of the receipt of the request that they not to be destroyed.

16.5. Who do we transfer your data to? (Who are the recipients of your data?)

In general, Magyar Posta Zrt. does not use data processors for operating cameras, but performs the operation itself. In certain key postal facilities, live video images are monitored by the security guards in the reception service. As regards the security service, Magyar Posta uses the services of CIVIL Értéklogisztika Zrt. (Registered office: 1152 Budapest, Telek utca 5, Company registration number: 01-10-048525, Tax number: 25332519-2-42) and another processor, CIVIL Biztonsági Szolgálat Zártkörűen Működő Részvénytársaság (Company registration number: 01-10-044642, Registered office: 1149 Budapest, Angol utca 77). Magyar Posta displays information about this in the guarded buildings.

Magyar Posta usually stores video recordings on devices it owns but in some buildings they are stored on hired equipment operated by Magyar Posta which, when necessary, is repaired and maintained by the lessor based on Magyar Posta’s instructions.

16.6. Who may access the data?

Video footage is only accessed in justified cases and only by colleagues with duties involving the protection of life and property.

Under the powers granted by law, the recorded images may be viewed by the court, the authorities, and persons whose right or legitimate interest is affected by recording the images.

In the period of retaining the data kept in storage, persons whose right or legitimate interest is affected by the images recorded by the camera or by recording someone else’s personal data may request, by providing proof of their right or legitimate interest, that the recording not be destroyed or erased by Magyar Posta Zrt. (omitting erasure).

Magyar Posta Zrt. may only release the recordings at the request of the court or other authority to the requesting court or authority. If no request is made by the court or other authority within 30 days of the request not to destroy the recordings, Magyar Posta will erase or destroy the recorded images.

17. Data processing related to entry

Magyar Posta Zrt. protects many of its buildings and the lives of people in postal buildings and facilities, the assets kept in the buildings and the data stored there by an access control system and reception service in order to prevent unauthorised entry.

17.1. On what grounds is Magyar Posta entitled to process the data?

Magyar Posta Zrt.’s processing of personal data is based on its legally and socially recognised legitimate interest to protect the lives and property of people in postal buildings and facilities, and the property of Magyar Posta Zrt. as well as the data managed by it, for which it is necessary to be able to establish the identity of people entering the buildings and their right of access. [General Data Protection Regulation, Article 6(1)(f)]

17.2. What type of data do we process?

The personal data are collected directly from the data subject unless the entry is justified by work to be performed on behalf of an organisation employing the data subject, in which case the data are transferred by the employer to Magyar Posta Zrt.

17.2.1. What can the reception staff member or the security guard ask?

Data subjects should be aware that employees and security guards working at the reception in postal buildings are entitled to ask them when entering the building and while staying in the building:

• to identify themselves by presenting their documents and
• to explain the purpose of their stay in the building used by Magyar Posta Zrt.
• to show their bags and their delivery documents.

Furthermore, they may ask data subjects to show the contents of their bags, vehicle and consignment if it is likely that these contain an article that is prohibited from entering or leaving (presumably originating from a crime or offence) and the data subject fails to comply when instructed and a measure needs to be taken to prevent or hinder an infringement of the law. For example, if suspicion arises that the data subject intends to remove a stolen laptop or mobile phone from the building in his or her bag, an employee working at the reception or the security guard may ask the data subject to open his or her bag to show the contents.

17.3. Why are the data processed?

Magyar Posta Zrt. processes the data for the purpose of identifying the persons entering its buildings, checking whether or not they are authorised to enter the building and protecting Magyar Posta Zrt.’s property and the data managed by it.

17.4. How long do we process the data for?

Magyar Posta Zrt. processes the data of persons entering on an occasional basis for 30 calendar days at most and the data of persons having a permanent right of entry until their authorisation expires but at most for 6 months. For electronic access control systems, the card identifier creating the link between the issued entry card and the person authorised to enter, and the photo are recorded until the entry card’s withdrawal.

17.5. Who do we transfer your data to? (Who are the recipients of your data?)

Magyar Posta Zrt. operates its electronic access control systems itself and does not use data processors for this. At some premises, entry data are stored on hired equipment operated by Magyar Posta Zrt. which, when necessary, is repaired and maintained by the lessor.

However, entry is recorded not only by electronic systems but also manually by the reception services. In this case the security guards performing the reception service record the data and check authorisation to enter the building. As regards the security service, Magyar Posta uses the services of CIVIL Értéklogisztika Zrt. (Registered office: 1152 Budapest, Telek utca 5, Company registration number: 01-10-048525, Tax number: 25332519-2-42) and another processor, CIVIL Biztonsági Szolgálat Zártkörűen Működő Részvénytársaság (Company registration number: 01-10-044642, Registered office: 1149 Budapest, Angol utca 77). Magyar Posta displays information about this in the guarded buildings.

Magyar Posta Zrt. does not transfer the data unless transmission is necessary to an authority or court for a specific purpose in the conduct of legal proceedings provided the legal requirements for data transfer are complied with.

17.6. Who may access the data?

Data from the electronic access control system may be accessed by the postal workers designated to operate it, and data originating from the paper-based access control are accessed by the security guards and postal employees manning the reception, as well as the security employees issuing the entry permits, and the postal employees assigned as the contact persons for the contract that makes the entry necessary.

Security guards and postal personnel performing the reception service may access the data while checking bags, delivery documents, vehicles and consignments.

Magyar Posta Zrt.’s security staff check that entry procedures are followed correctly and inspect records related to entry, thus the personnel involved in this may have access to the data of data subjects insofar as this is essential to carry out their activities.

18. Magyar Posta’s data processing for direct marketing (advertising) purposes

Magyar Posta Zrt. processes data in several ways for the purpose of forwarding advertising, offers and newsletters to data subjects and to expand the range of its customers, bearing in mind the needs of data subjects and the services they use at Magyar Posta Zrt. Data subjects may receive advertisements about Magyar Posta Zrt.’s products and services provided they explicitly consent to this, but Magyar Posta Zrt. may also contact them with the offers of its contractual partners.

18.1. The types of data processing this covers and the purpose of processing

Magyar Posta Zrt. advises data subjects of such data processing before they give their consent. Information about all forms of data processing is given together in this section in a transparent manner.

18.2. On what grounds is Magyar Posta Zrt. entitled to process the data?

For all forms of data processing

• the data subject’s voluntary consent [General Data Protection Regulation, Article 6(1)(a)]
  Magyar Posta Zrt. ensures that data subjects can make specific and explicit declarations about whether or not they wish Magyar Posta to send them advertisements, offers and newsletters, and whether or not Magyar Posta may use the data they give for this.

When processing data, Magyar Posta Zrt. considers the provisions of

• Act CVIII of 2001 on certain aspects of electronic commerce and information society services, Section 13/A,
• Act XLVIII of 2008 on the basic requirements of and certain restrictions on commercial advertising activity, Section 6.

18.3. What type of data do we process?

18.4. How long do we process the data for?

The data subject may withdraw consent at any time via the contact options described in point 37.9. Withdrawal of consent, however, does not affect the lawfulness of processing carried out based on consent before its withdrawal.

18.5. Who do we transfer your data to? (Who are the recipients of your data?)

Magyar Posta Zrt. uses the printing and e-mail sending services of EPDB Nyomtatási Központ Zártkörűen Működő Részvénytársaság (1117 Budapest, Budafoki út 107-109, Company registration number: 01 10 048079, Tax number: 24924243-2-43) as well as the e-mail sending services of Magyar Posta Zrt.’s currently engaged creative agency for producing leaflets, newsletters, informative materials and forms in order to contact individuals in a personalised way by e-mail or post. The details of Magyar Posta Zrt.’s currently engaged creative agency are given on the website www.posta.hu under Privacy Notice in the menu.

The declaration of consent to processing data for MyPost marketing and the MyPost Card marketing is made on Magyar Posta Zrt.’s MyPost online interface. To operate this interface, Magyar Posta Zrt. uses the services of the data processors specified in point 25.5.

18.6. Who may access the data?

Magyar Posta Zrt. stores and processes the data of the presented forms of data processing in separate databases. In order to protect and safeguard data, the persons authorised to access them are appointed in different departments. There are no persons who have access to all data. The data stored in the separate databases may only be accessed by the appointed employees who have the task of analysing the data in order to define the target group of the advertisement to be sent. Apart from these, the contact data (postal address or e-mail address or telephone number) of addressees selected based on the analysis of the database according to name and the means of sending the advertisement are only accessed by persons who address the advertisements to be sent or establish contact with the addressees of the advertisement and staff dealing with complaints received from the recipients of the advertisements.

There are special units dedicated to regularly checking Magyar Posta Zrt.’s internal operations and the compliance of its activities with regulations, thus the staff engaged in such controls (operations inspectors, internal auditors, security and protection staff, data protection officers) have access to these data provided this is essential for carrying out their duties.

19. Conducting prize competitions

As part of promoting its products and services, Magyar Posta organises prize competitions and draws, during which the data of the entrants are processed in order to select the winners and give the winners their prizes.

19.1. On what grounds is Magyar Posta entitled to process the data?

Magyar Posta processes the data of the entrants based on their voluntary consent, which is evident in that the data subjects give their data voluntarily in the knowledge of the contents of the privacy notice featured in the competition rules in order to participate in Magyar Posta Zrt.’s current prize competition. [General Data Protection Regulation, Article 6(1)(a)]

19.2. What type of data do we process?

Depending on the conditions of the prize competition, Magyar Posta only asks for some of the data listed here, only requesting those which are essential for conducting the competition as and when necessary. The rules of the current competition contain information about this. For example, due to assuming payment of the tax obligation on the prize, Magyar Posta only asks those winners who accept the prizes for the relevant data.

19.3. Why are the data processed?

Magyar Posta only processes the data for the purpose of

• being able to conduct prize competitions and draw winners of the prizes from the entrants,
• contacting winners and giving them their prizes,
• paying the tax obligation on the prize if Magyar Posta assumes this instead of the winner,
• taking a photograph of the prize being awarded and featuring this in information about the prize competition provided the winner consents to having a photograph taken when accepting the prize.

19.4. How long do we process the data for?

Magyar Posta Zrt. processes the data of the entrants until the draw and then deletes them. Thereafter, Magyar Posta Zrt. only processes the data of the winners until the prizes are awarded and, if Magyar Posta Zrt. has assumed payment of the tax obligation, it processes the data in connection with taxation listed under point 19.2 for 5 years after the year of the tax return [Act CXVII of 1995 on personal income tax and Act CL of 2017 on the rules of taxation, Sections 77, 78 and 202 to 205]. In connection with fulfilling accounting obligations, the data are processed for 8 years. [Accounting Act, Section 169] Naturally, the data subject may withdraw consent to his or her data being processed via the contact options given in point 37.9 at any time during the prize competition, in which case Magyar Posta Zrt. will delete the data. The entrant whose data Magyar Posta Zrt. deleted at his or her request before the draw cannot take part in the prize draw and consequently cannot be a winner, and, if the winner requests his or her data to be deleted before receiving the prize, that person cannot then accept the prize. Withdrawal of consent does not affect the lawfulness of processing carried out based on consent before its withdrawal.

19.5. Who do we transfer your data to? (Who are the recipients of your data?)

Magyar Posta Zrt. uses a data processor to conduct some prize competitions. Preliminary information is provided about this in every case in the rules for the competition.

19.6. Who may access the data?

The data may be accessed by Magyar Posta Zrt.’s communication staff appointed to conduct the competition and the prize draw (campaign managers and communication staff) and, if the prize is awarded at a post office, by the postal employees working at the post office in question. If Magyar Posta Zrt. assumes paying the tax obligation on the prize instead of the winner, the data related to the fulfilment of the tax obligation may also be accessed by staff involved in tasks connected with tax returns.

The data of winners which are necessary to advise the winners will be published by Magyar Posta Zrt. in accordance with the competition rules and thus they may be accessed by anyone.

If the winner agrees to Magyar Posta Zrt. taking a photograph of the prize being awarded and this being used for information about the prize competition, the photograph(s) will be published.

There are special units dedicated to regularly checking Magyar Posta Zrt.’s internal operations and the compliance of its activities with regulations, thus the staff engaged in such controls (operations inspectors, internal auditors, security and protection staff, data protection officers) have access to these data provided this is essential for carrying out their duties.

20. Customer Service

Magyar Posta Zrt. is obliged to operate a customer service to enable its customers to make complaints and submit claims for compensation verbally, in writing and through the internet at a central customer service point as well as at post offices. [Postal Services Act, Section 57 (3), and Act CLV of 1997 on consumer protection, Section 17/B (1)]

Magyar Posta Zrt. has organised its customer service to ensure that all data subjects who wish to contact Magyar Posta to make a complaint, enquire about a service or exercise a right related to their personal data (request the erasure, restriction or correction of data, request access or data portability, raise an objection, or withdraw consent) can contact Magyar Posta Zrt. through it.

20.1. On what grounds is Magyar Posta Zrt. entitled to process the data?

• In order to handle customer requests related to Magyar Posta Zrt.’s services, in particular postal services and payment services, the processing of personal data is necessary for the assertion of the legitimate interest of Magyar Posta Zrt., which is demonstrated by the fact that without the processing of the data the customer requests could not be investigated, answers could not be provided to data subjects and it would be impossible to process the communications of data subjects. This would not only infringe the interests of the data subject but also the legitimate economic interests of Magyar Posta Zrt. as this would lead to customer complaints, and it is Magyar Posta Zrt.’s socially recognised interest to protect and increase its good reputation and the satisfaction of its customers. [General Data Protection Regulation, Article 6(1)(f)]

and

• Act CLIX of 2012 on postal services, Section 57, which creates a legal obligation for the processing of data in relation to complaints, statements to be recorded as complaints and compensation claims [General Data Protection Regulation, Article 6(1)(c)]
  
  This provision requires Magyar Posta Zrt. to deal with complaints both at postal outlets and at a central customer service point, stipulating the period of time these can be made and the time-limit for replying to them.
  
  If the consumer initiates a supervisory authority procedure against the reply to a postal complaint, the data transmission obligation under Section 53 of Act CLIX of 2012 on postal services will apply in the procedure before the National Media and Infocommunications Authority. [General Data Protection Regulation, Article 6(1)(c)]
• Act CLV of 1997 on consumer protection (hereinafter referred to as the “Consumer Act”), Sections 17/A to 17/C, which creates a legal obligation for the processing of data related to complaints [General Data Protection Regulation, Article 6(1)(c)]
  
  This statute, in harmony with the Postal Services Act, also requires Magyar Posta Zrt. to operate a customer service, stipulating the type of data Magyar Posta Zrt. has to record about complaints, and the obligation that a sound recording of complaints reported over the phone must be made, stating the deadline for storing these.
• Article 12 of the General Data Protection Regulation creates a legal obligation to process and respond to data subjects’ requests [General Data Protection Regulation, Article 6(1)(c)].
• Under the General Data Protection Regulation, everyone has the right to contact Magyar Posta Zrt. to find out whether or not it processes their personal data and, if it does, to submit a request for access, rectification, erasure or restriction of processing, to object to the processing and to exercise their right to portability.

20.2. What type of data do we process?

20.3. Why are the data processed?

Magyar Posta Zrt. processes consumers’/the data subjects’ data for the purpose of

• fulfilling their requests,
• checking the contents of their queries and complaints,
• responding to them,
• keeping a record of them for the period of time specified by law,
• credibly proving their contents,
• meeting its obligation to make a declaration in the course of the supervisory authority’s procedure and for the purposes of effectively conducting the official investigation and establishing the facts of the case under investigation.

20.4. How long do we process the data for?

Magyar Posta Zrt. processes data related to the consumer’s/the data subject’s requests for five (5) years from the submission of the request because within this period the data subject may enforce any legal dispute that may arise between Magyar Posta Zrt. and the data subject in court.

Magyar Posta Zrt. must keep records of complaints and responses to them for 3 years. [Consumer Act, Section 17/A (7)]

Magyar Posta Zrt. must keep audio recordings for 5 years. [Consumer Act, Section 17/B (3)]

If data processing becomes necessary due to the establishment, exercise or defence of any legal claim related to the consumer’s/the data subject’s request (e.g. court proceedings), Magyar Posta Zrt. will process the data for the period necessary for the establishment, exercise or defence of the legal claims.

20.5. Who do we transfer your data to? (Who are the recipients of your data?)

For performing its customer service activity, inasmuch as this is essential, Magyar Posta Zrt. uses its contractors and agents in providing the service. Such a case is when, for example, a complaint or customer request is received by Magyar Posta related to a service which Magyar Posta Zrt. performed through a contractor, or when a contractor or agent registers a data subject’s request on behalf of Magyar Posta Zrt. Magyar Posta Zrt.’s contractors and agents are listed in the information for each service and on the www.posta.hu website under Privacy Notice in the menu.

20.6. Who may access the data?

The data may be accessed by Magyar Posta’s employees involved in providing the customer service activity and dealing with the investigation of complaints, thus staff receiving phone calls and e-mails (e.g. contact centre operators) and colleagues responsible for keeping in contact with consumers (e.g. customer complaints handling staff). It should be noted that, when the justification for the complaint or request cannot be investigated without Magyar Posta Zrt. requesting a declaration from the employee involved in the request or complaint with regard to the circumstances of the incident, the employee who acted on behalf of Magyar Posta Zrt. in the incident which is the subject of the complaint or request will also be able to access the data.

There are special units dedicated to regularly checking Magyar Posta Zrt.’s internal operations and the compliance of its activities with regulations, thus the staff engaged in such controls (operations inspectors, internal auditors, security and protection staff, data protection officers) have access to these data provided this is essential for carrying out their duties.

Dependent on the nature of each service, more than one authority may exercise control over Magyar Posta’s customer service activity: for postal services, the National Media and Infocommunications Authority (Address: 1015 Budapest, Ostrom u. 23-25, Postal address: 1525 Budapest, Pf. 75, Telephone: (+361) 457 7100 Fax: (+36 1) 356 5520 E-mail: info@nmhh.hu Website: www.nmhh.hu), for payment activities, the Magyar Nemzeti Bank (Address: 1013 Budapest, Krisztina körút 55. E-mail: ugyfelszolgalat@mnb.hu). Furthermore, the Magyar Nemzeti Bank settles disputed matters out of court through the Financial Arbitration Board (Address: 1013 Budapest, Krisztina krt. 39, Postal address: H-1525 Budapest Pf. 172. Telephone: +36-40-203-776 E-mail: ugyfelszolgalat@mnb.hu).

Magyar Posta Zrt. is obliged to forward the data to the National Media and Infocommunications Authority if the complainant does not accept Magyar Posta’s response to the complaint and initiates proceedings before the authority [Postal Services Act, Sections 57 (11) and 53].

Magyar Posta Zrt.’s activity related to consumers within its payment activity is supervised by the Magyar Nemzeti Bank (the “MNB”) and Magyar Posta Zrt. is obliged to supply data to the MNB if so required [MNB Act, Section 48 (4)]. Furthermore, the Magyar Nemzeti Bank settles disputed matters out of court via the Financial Arbitration Board, so in the event of proceedings before the Financial Arbitration Board the data may also be accessed by the Board [MNB Act, Section 108].

The National Authority for Data Protection and Freedom of Information exercises supervision over Magyar Posta Zrt. as data controller, thus, if the data subject initiates a procedure at the National Authority for Data Protection and Freedom of Information, in order to conduct the investigation, the data controller under investigation is obliged to provide the National Authority for Data Protection and Freedom of Information with all the data related to the case under investigation under Section 54 of Act CXII of 2011 on the right to informational self-determination and freedom of information.

20.7. Can I ask for a copy of the sound recording?

Yes. The consumer may be given a copy of the sound recording upon request, which Magyar Posta Zrt. will provide free of charge. [Consumer Act, Section 17/A (7)] In order to protect the data, Magyar Posta Zrt. will save the sound recording onto a data carrier and hand it over to the data subject in person or send it in a way that only the addressee or an authorised representative may accept it. Magyar Posta Zrt. will only forward a sound recording by e-mail at the consumer’s explicit request made in the knowledge of the risks of sending material by e-mail.

21. Data processing to measure the quality of service

Magyar Posta is committed to providing high-standard services. To this end, Magyar Posta Zrt. regularly measures compliance with predetermined requirements and service levels by, for instance, sending test mail.

21.1. On what grounds is Magyar Posta entitled to process the data?

Magyar Posta Zrt. processes the data based on the data subjects’ prior and voluntary consent. [General Data Protection Regulation, Article 6(1)(a)].
Customers who give their data to Magyar Posta Zrt. for the purpose of, for instance, sending test mail assist the Company in these quality measurements.

21.2. What type of data do we process?

21.3. Why are the data processed?

Magyar Posta processes the data to be able to check and measure whether the performance of its services meets the relevant quality requirements, whether performance exceeds them and, if so, to what extent.

21.4. How long do we process the data for?

Magyar Posta Zrt. processes data for 12 months after they have been recorded. Naturally, the data subject may withdraw consent at any time within this period via the contact options given in point 37.9, in which case Magyar Posta Zrt. will delete the data.

Withdrawal of consent, however, does not affect the lawfulness of processing carried out based on consent before its withdrawal.

21.5. Who do we transfer your data to? (Who are the recipients of your data?)

Magyar Posta does not use data processors.

21.6. Who may access the data?

The data may be accessed by Magyar Posta Zrt.’s staff involved in measuring quality (quality measurement and analysis staff, and quality assurance officers). If quality is measured by sending test mail, staff involved in performing the postal service (post office clerks, sorting and delivery personnel) have access to the name and address of the addressee of the test mail as the letter or parcel reaches the addressee as a result of their work.

22. Job applications and labour market database

Magyar Posta Zrt. processes the data of applicants for jobs through job advertisements or, in the absence of advertisements, when there is a vacancy to be filled that can be offered in accordance with the contents of this point.

Furthermore, Magyar Posta Zrt. offers the opportunity to people seeking employment at the Company of asking Magyar Posta Zrt. to retain their application even if there is no post that can currently be offered to them or they were not accepted for the advertised post. Through the application, the data subject can be entered in a database created for this purpose, allowing Magyar Posta Zrt. to make contact if a post that the data subject is qualified for and has the experience to fill becomes vacant.

Magyar Posta Zrt. also operates an online careers site (Karrier Portal) for job applicants.

22.1. On what grounds is Magyar Posta Zrt. entitled to process the data?

Magyar Posta Zrt. processes the data based on the voluntary consent of the data subjects, which is evident in the fact that people interested in vacancies apply to Magyar Posta by forwarding their data. [General Data Protection Regulation, Article 6(1)(a)]

If there is no vacancy to be filled which can be offered, the data subjects’ voluntary consent is evident in the fact that they specifically ask to be entered in the labour market database containing people interested in job vacancies. [General Data Protection Regulation, Article 6(1)(a)]

If the data subject sends a curriculum vitae or an enquiry only, Magyar Posta Zrt. draws attention to the opportunity of being entered in the labour market database and completing the necessary declaration for this database. If the data subject wishes to take advantage of this opportunity, Magyar Posta Zrt. will record the sent data in the database. Otherwise, Magyar Posta Zrt. returns the data or, if the data subject so requests, destroys and deletes them.

The processing of the name and e-mail address of persons recommended by Magyar Posta Zrt.’s employees is necessary for Magyar Posta Zrt. to assert its own legitimate interests and those of the recommending employees. [General Data Protection Regulation, Article 6(1)(f)] Magyar Posta Zrt. has a legitimate interest in selecting from the widest possible range of applicants for the vacant post, in particular from among persons who, in the opinion of an employee of Magyar Posta Zrt., are suitable for the post, thereby increasing the success rate of filling the post and keeping the selected persons in employment in the long term. The processing of data is also in the interest of the recommending employee as the employee recommendation programme of Magyar Posta Zrt. recognises the contribution to the human resources management of employees who have successfully made a recommendation of Magyar Posta Zrt.

22.2. What type of data do we process?

We point out to data subjects that, if they ask for their reduced capacity to work to be considered in seeking a vacancy and during employment in a job and for this they send a copy of the medical opinion issued by a specialist body, they should only leave data related to their identity and their reduced capacity to work, state of health, degree of health impairment and disability status in the medical opinion and delete all other information such as information relating to the nature of their health impairment, medical treatment and illness.

22.3. Why are the data processed?

Magyar Posta Zrt. processes the data to select suitable applicants for jobs that become vacant from people who themselves wish to find a post at Magyar Posta Zrt.

22.4. How long do we process the data for?

Magyar Posta Zrt. processes the data until the withdrawal of the data subject’s consent. The data subject can also initiate withdrawal directly on the online interface provided the data subject has finalised his or her registration.

If the data subject has started his/her registration but has not confirmed it, he or she may do so for 7 days from the date of registration. If registration is not completed, the data provided during registration will be deleted.

If Magyar Posta Zrt. has started processing the data of the data subject based on a recommendation, but the data subject does not respond to the notification to this effect, and does not give further details and consent, Magyar Posta Zrt. will delete the data 7 days after the notification.

In the absence of the withdrawal of consent, Magyar Posta Zrt. will process the data in order to select applicants for the advertised vacancy or, in the absence of an advertisement, for a vacancy that is currently to be filled for 30 days after the selection has ended or for at most 365 days if the selection is not concluded within 365 days.

Magyar Posta Zrt. processes the data of applicants to the labour market database for 1 year from the date of application and then deletes the data without notifying the applicant and destroys documents submitted or returns them to the applicant.

Naturally, the data subject may withdraw his or her application (consent to data processing) within this period, in which case Magyar Posta Zrt. will delete the data after the withdrawal of consent and destroy documents submitted or return them to the applicant.

The applicant may request data to be deleted and his or her consent to be withdrawn by writing to Magyar Posta Zrt. at 1540 Budapest or by sending an e-mail to toborzas@posta.hu.

Withdrawal of consent does not affect the lawfulness of processing carried out based on consent before its withdrawal.

22.5. Who do we transfer your data to? (Who are the recipients of your data?)

For the operation of Magyar Posta Zrt.’s Karrier Portal, Magyar Posta Zrt. uses Nexum Magyarország Internetszolgáltató és Kereskedelmi Korlátolt Felelősségű Társaság (registered office: 6726 Szeged, Temesvári körút 15, company registration number: 06 09 004861, tax number: 11398822-2-06, website: www.nexum.hu, delivery address of the company: info@nexum.hu) as a data processor to provide the IT infrastructure, to perform tasks related to its operation, to transfer data files between the IT infrastructure of Magyar Posta Zrt. and the infrastructure operated by Nexum Magyarország Kft., to maintain data connections and, when necessary, to repair and restore the operation of the IT infrastructure in case of malfunction.

22.6. Who may access the data?

The data may be accessed by personnel at Magyar Posta Zrt. involved in the recruitment and selection of labour, and the manager deciding about employing the data subject for the vacancy (exercising employer’s rights). The staff of Magyar Posta Zrt. and the staff of its data processor involved in operating the IT infrastructure may also have access to the data if this is essential to perform their tasks in the course of operation.

23. Magyar Posta Zrt.’s document management

Magyar Posta Zrt., as a body performing public duties, is obliged to apply strict document management rules. Consequently, it has to record incoming and outgoing documents and all documents generated in the course of its operation. During this, personal data are also processed.

23.1. On what grounds is Magyar Posta Zrt. entitled to process the data?

Magyar Posta Zrt. processes personal data

• based on the obligation stipulated in Act LXVI of 1995 on public records, public archives and the protection of private archival materials, Sections 4, 9 and 12, which creates a legal obligation for the processing of data [General Data Protection Regulation, Article 6(1)(c)]

Detailed rules related to data processing are laid down in the following legislation:

• Government Decree 335/2005 on the general requirements for document management by organs performing public duties, Sections 14, 39, and
• Interior Ministry Decree 3/2018 of 21 February 2018 on the requirements of data management software for public-sector bodies.

23.2. What type of data do we process?

23.3. Why are the data processed?

Magyar Posta Zrt. processes the data in order to record the documents and their senders, and to fulfil the obligations stipulated for bodies performing public functions, i.e. ensuring the transparency of the operations and activities of public-sector bodies and keeping documents of lasting value for the purposes of archiving in the public interest.

23.4. How long do we process the data for?

Data related to documents generated in the course of document management are processed for the period of time specified in the archiving plan for each document approved by the National Archives of Hungary. Magyar Posta Zrt. hands over documents of lasting value to the competent public archives by the end of the 15th year calculated from the calendar year when they were created. [Act LXVI of 1995, Section 12]

23.5. Who do we transfer your data to? (Who are the recipients of your data?)

Magyar Posta Zrt. uses a data processor for the purpose of archival data processing (recording, storing, data processing). The data processor is DocuTár Iratrendező és Tároló Szolgáltató Korlátolt Felelősségű Társaság (1093 Budapest, Czuczor utca 10. IV-V, Company registration number: 01 09 703896, Tax number: 12797138-2-43 docutar@docutar.hu), which performs the recording, storage and processing of the compulsory data content for archival purposes from paper-based documents in the course of data processing.

23.6. Who may access the data?

The data may be accessed by persons whose duties include performing administrative obligations related to documents, and handling, forwarding and filing paper-based documents, and also have access to Magyar Posta Zrt.’s Electronic Filing System.

There are special units dedicated to regularly checking Magyar Posta’s internal operations and the compliance of its activities with regulations, thus the staff engaged in such controls (operations inspectors, internal auditors, security and protection staff, data protection officers) have access to these data provided this is essential for carrying out their duties.

The rules of accessing personal data appearing in documents forwarded to the National Archives of Hungary are stipulated in Act LXVI of 1995 on public records, public archives and the protection of private archival materials, Sections 24 to 29.

24. Requests to access data of public interest and data public on grounds of public interest

24.1. On what grounds is Magyar Posta Zrt. entitled to process the data?

Magyar Posta Zrt. processes the personal data of data subjects requesting data of public interest because this is required to make such data accessible based on a request to access data of public interest and data that are public for reasons of public interest specified in Act CXII of 2011 on informational self-determination and freedom of information (hereinafter referred to as the “Info Act”), Section 26(1). [Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as “GDPR”), Article 6(1)(e)].

24.2. What type of data do we process?

24.3. Why are the data processed?

Magyar Posta Zrt. processes the data to fulfil requests for data of public interest and to send notifications about the charges established for making a copy provided this is necessary to achieve these objectives.

24.4. How long do we process the data for?

Magyar Posta Zrt. processes personal data for 1 year after the fulfilment of the request for data of public interest.

24.5. Who do we transfer your data to? (Who are the recipients of your data?)

Magyar Posta Zrt. does not use data processors for fulfilling requests for data of public interest and does not transmit the data of persons requesting such data.

24.6. Who may access the data?

The data may be accessed by the person responsible for public data at Magyar Posta Zrt. and the head of the Ownership and Official Relations Department.

25. MyPost registration

Magyar Posta Zrt. set up the MyPost registration interface in a way that its use by natural persons for private purposes and its use by natural persons representing an organisation are separate from each other, while the same natural person could use the services provided by Magyar Posta’s online interface both for private purposes and as the representative of an organisation if obliged to do so by his or her employer. Accordingly, both private and organisational registration is possible on the online platform.

A further distinction is made between simple registration, where the user does not need to be clearly identified, and verified registration, where the registering individual is identified precisely using an identification procedure based on appearance in person and identification with an identity document (customer portal (Ügyfélkapu) or MyPost Card application). This higher level registration is needed for the user to be able to arrange affairs remotely from a computer where otherwise documents clearly identifying the user would be required for that purpose, such as granting an authorisation electronically from home.

25.1. On what grounds is Magyar Posta entitled to process the data?

While ensuring the MyPost registration and access to the MyPost interface, and thereby the use of electronic services and business applications, Magyar Posta Zrt. may process data as follows:

• The personal data of natural persons, in view of the registration on the person’s own initiative, are necessary to enter into and perform the contract between the natural person and Magyar Posta that will be created through the registration [General Data Protection Regulation, Article 6(1)(b), and Act CVIII of 2001 on certain aspects of electronic commerce and information society services, Section 13/A];
• The personal data of a person representing an organisation are necessary for asserting the legitimate interests of both the organisation represented and Magyar Posta Zrt. The legitimate interest is demonstrated by the fact that in the online space, in the absence of linking the transactions to be performed on behalf of the organisation to an individual, it cannot be controlled whether the online activity and the use of any eService or business application was initiated by a person who is entitled to act on behalf of the organisation. A further legitimate interest of organisations is to be able to specify the data the person designated for representation should be able to access, which protects their business data as well. [General Data Protection Regulation, Article 6(1)(f), and Act CVIII of 2001 on certain aspects of electronic commerce and information society services, Section 13/A].

Magyar Posta Zrt. informs the persons representing an organisation that their data have been transferred to Magyar Posta Zrt. by their organisation (which is confirmed by the data subject by approving the activation e-mail) and that it is the obligation of the organisation providing the data to ensure the appropriate legal basis for the transfer of their data to Magyar Posta Zrt. in the legal relationship between the organisation providing the data and the representative concerned.

25.2. What type of data do we process?

We inform data subjects that they can change their data on the MyPost interface in Change Profile.

25.3. Why are the data processed?

Magyar Posta Zrt. processes the data of natural persons to perform the registration and administration related to registration, to communicate in connection with this as need be, and, based on registration, to ensure continuous right of access to the eServices and business applications provided by Magyar Posta, and the performance of the eServices and business applications used by accessing them.

Furthermore, Magyar Posta Zrt. processes the personal data of the representative of an organisation to identify the person authorised to represent the organisation, to attribute the eServices and business applications used by the organisation to the representative acting on behalf of the organisation, and thus to perform the eServices or business applications used by the organisation, and to communicate with the organisation.

25.4. How long do we process the data for?

Magyar Posta Zrt. processes the data from the time of the confirmation of registration until five years after the termination of registration in view of the fact that a contract is concluded by registering and by accepting Magyar Posta’s General Terms and Conditions for Certain Electronic Services and Business Applications during registration, the underlying law of which is Act V of 2013 on the Civil Code.

If data processing becomes necessary due to the establishment, exercise or defence of any legal claim related to the service (e.g. court proceedings), Magyar Posta will process the data for the period necessary for the establishment, exercise or defence of the legal claims.

25.5. Who do we transfer your data to? (Who are the recipients of your data?)

To operate the MyPost interface, Magyar Posta Zrt. uses the services of the following companies as data processors:

• Posta InIT Informatikai Infrastruktúra Szolgáltató Zrt. (Registered office: 1138 Budapest, Dunavirág utca 2-6, Company registration number: 01-10-047115, Tax number: 23448577-2-41) to perform tasks related to the operation of the IT infrastructure,
• Dorsum Informatikai Fejlesztő és Szolgáltató Zrt. (Company registration number: 01-10-044594, Tax number: 12657496-2-41, Registered office: 1012 Budapest, Logodi utca 5-7. 3. em. 18; www.dorsum.eu) to operate the online interface and provide IT support for the process of purchasing by bank card,
• Microsoft Ireland Operations Limited (Customer Care Centre, Atrium Building Block B, Carmanhall Road, Sandyford Industrial Estate, Dublin 18, Ireland) for providing the Azure service, which ensures the servers and storage space required for operating the online interface.

The data reach Magyar Posta Zrt.’s systems automatically through the data processor’s system and will be stored on the data processor’s servers to the extent and for the period of time that is technically essential for the automatic transmission of the data.

Magyar Posta Zrt. does not transfer data outside the EEA member states (European Union member states and Norway, Lichtenstein and Iceland) even when using data processors. In the event that personal data are transferred outside the EEA member states (European Union member states and Norway, Lichtenstein and Iceland) for any reason, Microsoft Ireland Operations Limited undertakes to guarantee the appropriate level of protection of personal data applying the contractual conditions stipulated in the annex to Commission Decision 2021/914/EU of 4 June 2021 on standard contractual clauses for the transfer of personal data to processors established in third countries under Regulation 2016/679 EU of the European Parliament and of the Council.

Data related to the payment transaction will be transferred to the data controllers specified in point 35.5.

25.6. Who may access the data?

Magyar Posta Zrt. processes personal data allowing access only to those who need them to carry out the service you require. Data may only be accessed by Magyar Posta’s sales support and IT operations staff who operate the registration process and maintain registrations (deletion, solving entry problems, etc.). Personnel managing complaints related to registration and the services available through this as well as those checking the performance of the service also have access to these data.

There are special units dedicated to regularly checking Magyar Posta Zrt.’s internal operations and the compliance of its activities with regulations, thus the staff engaged in such controls (operations inspectors, internal auditors, security and protection staff, data protection officers) have access to these data provided this is essential for carrying out their duties.

Data subjects are advised that, in the event that Magyar Posta Zrt. has a legal obligation to do so, it will disclose data or provide access to data to a body authorised by law upon request, and thus in particular to the court, the prosecutor’s office, the investigating authority, the authority dealing with offences, the administrative authority, and the National Authority for Data Protection and Freedom of Information. Magyar Posta Zrt. only provides personal data to or allows access for these organisations if the precise purpose and data range is indicated and only does so to the extent that is absolutely necessary for the purpose of the request and is suitable to achieve the objective.

26. Webshop

Magyar Posta Zrt. provides certain services not only at post offices but also via an online interface. For this Magyar Posta set up its own webshop, which can be accessed from its website. To place orders from the webshop, the MyPost interface needs to be entered.

26.1. On what grounds is Magyar Posta Zrt. entitled to process the data?

The processing of personal data is necessary for the conclusion and performance of the order as a contract, which is concluded between the customer and Magyar Posta Zrt. [General Data Protection Regulation, Article 6(1)(b)],

and

• Act CVIII of 2001 on certain aspects of electronic commerce and information society services
  By placing an order, a contract is entered into between Magyar Posta Zrt. and the data subject by electronic means (online contract). The framework of this is defined by law. For instance, orders must be confirmed and thus Magyar Posta is obliged to process e-mail addresses.
• Act C of 2000 on accounting (hereinafter referred to as the “Accounting Act”), which creates a legal obligation for the processing of the data [General Data Protection Regulation, Article 6(1)(c)] Magyar Posta must account for orders accurately, thus it is obliged to keep documents and data proving these.

The customer may place an order for items to be addressed to other people, including minors, living at the same address as a person entitled to represent the data subjects.

26.2. What type of data do we process?

26.3. Why are the data processed?

Magyar Posta Zrt. processes the data

• to create the contract for fulfilling the order,
  A contract is created between Magyar Posta Zrt. and the data subject as a result of the order and for this the person placing the order as the contracted customer of Magyar Posta Zrt. must be specified.
• to define and amend the contents of the contract,
  The data of the order placed define the content of the contract, and for whom and what Magyar Posta Zrt. must perform.
• to monitor the performance of the contract,
  Both the person placing the order and Magyar Posta Zrt. have obligations under the contract. The person placing the order is obliged to pay the price of the product, and Magyar Posta Zrt. is obliged to supply (in certain cases prepare) the product.
• to bill the prices or fees charged under the contract,
• to send a notice if the payment obligation arising from the order is not met.

26.4. How long do we process the data for?

Magyar Posta Zrt. processes customer data for five (5) years after the placement of an order or, in the case of subscriptions, after the expiry of the subscription, and, in the case of the cancellation of the contract, from the date of the cancellation because within this period the data subject may enforce any legal dispute that may arise between Magyar Posta Zrt. and the data subject in court.

If data processing becomes necessary due to the establishment, exercise or defence of any legal claim related to the service (e.g. court proceedings), Magyar Posta Zrt. will process the data for the period necessary for the establishment, exercise or defence of the legal claims.

Magyar Posta Zrt. must account for orders, thus it is obliged to keep documents related to them for 8 years as stipulated in the Accounting Act.

26.5. Who do we transfer your data to? (Who are the recipients of your data?)

In the webshop, Magyar Posta Zrt. uses the following companies as data processors:

• Posta InIT Informatikai Infrastruktúra Szolgáltató Zrt. (Registered office: 1138 Budapest, Dunavirág utca 2-6, Company registration number: 01-10-047115, Tax number: 23448577-2-41) to perform tasks related to the operation of the IT infrastructure,
• Dorsum Informatikai Fejlesztő és Szolgáltató Zrt. (Company registration number: 01-10-044594, Tax number: 12657496-2-41, Registered office: 1012 Budapest, Logodi utca 5-7. 3. em. 18; www.dorsum.eu) to operate the interface and provide IT support for the process of purchasing by bank card.

Data related to the payment transaction will be transferred to the data controllers specified in point 35.5.

26.6. Who may access the data?

Magyar Posta’s personnel who are involved in recording and billing orders, and packing, addressing, dispatching and delivering the products ordered have access to the data. Staff managing complaints related to orders as well as those checking the performance of the service also have access to these data. There are special units dedicated to regularly checking Magyar Posta Zrt.’s internal operations and the compliance of its activities with regulations, thus the staff engaged in such controls (operations inspectors, internal auditors, security and protection staff, data protection officers) have access to these data provided this is essential for carrying out their duties.

27. ePosting Book

Magyar Posta set up an electronic interface for its customers where the procedures required for posting mail items, in particular compiling the posting list, can be done quickly and easily.

27.1. On what grounds is Magyar Posta entitled to process the data?

Magyar Posta Zrt. processes the data while providing the service because

• the processing of the personal data of the sender using the ePosting Book application is necessary for the conclusion and performance of the contract for the electronic posting list service, which is concluded between the sender and Magyar Posta Zrt. [General Data Protection Regulation, Article 6(1)(b)]
• the processing of the personal data of the addressees and senders other than the users of the ePosting Book application is necessary to assert the legitimate interests of the sender, the ePosting Book application user and Magyar Posta Zrt., which is demonstrated by the fact that without such processing the data transfer to Magyar Posta Zrt. of posting lists in the format and with the data content required for the performance of the postal service contract and the use of the postal service together with the posting list data would not be possible or only at considerable expense, major human resources input and manual administration. Posting lists facilitate the posting and acceptance of mail items for both the sender and Magyar Posta Zrt., and help ensure that mail items are suitable for delivery to addressees. [General Data Protection Regulation, Article 6(1)(f)]

27.2. What type of data do we process?

27.3. Why are the data processed?

Magyar Posta Zrt. processes the data in order to

• produce the mail item’s address for the sender in accordance with the conditions necessary for the use of the postal service and the related additional services required by the sender,
• provide the interface necessary and suitable for compiling and sending posting lists for the dispatch of the items,
• send notifications to the sender and the addressee about the use of the ePosting Book service and the fulfilment of the postal service contract related to the posted items,
• support the compliant and full production of a document containing the correct data for the customs declaration used in international postal traffic of items containing dutiable goods,
• support the dispatch of the items with the data of the submitted posting list and to send confirmation to the sender of mail items actually accepted for posting,
• ensure the contractual fulfilment of the addressee’s instructions, in particular for redirection, by comparing the duly structured electronic data of the posting list with the electronic data of the addressee’s instructions for the item.

27.4. How long do we process the data for?

Magyar Posta Zrt. ensures customers access to the closed posting lists for 90 days after their closure. Based on the data of the posting lists sent to Magyar Posta Zrt., Magyar Posta Zrt. prepares an acceptance list of the dispatched items and processes this until the end of the fifth calendar year after the dispatch of the items in accordance with Act CLIX of 2012 on postal services, Section 55(7). The sender can access the data of posting lists that are not closed by the sender for editing for 10 days, after which Magyar Posta Zrt. erases the data.

27.5. Who do we transfer your data to? (Who are the recipients of your data?)

Magyar Posta Zrt. uses the data processors participating in the operation of the MyPost interface and specified in point 25.5 for the provision of the electronic posting list service.

27.6. Who may access the data?

Only the sender can access the data recorded in the ePosting Book until the finalised posting list is sent by the sender to Magyar Posta Zrt. After submission, employees who accept the mail items for dispatch and who operate the electronic posting list store have access to the data. The data of the accepted mail items can be accessed by the persons specified in point 2.6 of Magyar Posta Zrt.’s Privacy Notice.

28. MPL online address label and posting list application

Magyar Posta Zrt. has made available electronic applications for parcel senders which make it easier for the sender to address parcels in the way necessary to meet the conditions of using the postal service and to produce the posting list for the parcels (the list of items to be sent), thereby saving time, money and human resources. The applications include ones that can be downloaded and installed on the sender’s own computer. During its use, Magyar Posta Zrt. does not process the recorded data, only after the sender sends the posting list to Magyar Posta Zrt. or actually posts the parcels. Besides the downloadable application, Magyar Posta Zrt. also provides an online application that can be used from a device that has an internet connection. Without having to install a separate application, by entering the MyPost interface, the sender can produce the posting list and the address labels for the parcels (a sheet containing the details of the parcels and the address to be affixed to the parcel).

28.1. On what grounds is Magyar Posta Zrt. entitled to process the data?

Magyar Posta Zrt. processes the data while providing the service because

• processing the personal data of the sender using the address label completion application is necessary to perform the MPL online address label completion service and to produce address labels and posting lists [General Data Protection Regulation, Article 6(1)(b)]
• the processing of the personal data of the addressees and senders other than the users of the address label completion application is necessary to assert the legitimate interests of the sender, the user of the address label completion application and Magyar Posta Zrt., which is demonstrated by the fact that without such processing the data transfer to Magyar Posta of an address label in the format and with the data content required for the performance of the postal service contract and the use of the postal service together with the address label data would not be possible or only at considerable expense, major human resources input and manual administration. The MPL online address label completion application facilitates the posting and acceptance of mail items for both the sender and Magyar Posta Zrt., and helps ensure that mail items are suitable for delivery to addressees. [General Data Protection Regulation, Article 6(1)(f)]

28.2. What type of data do we process?

28.3. Why are the data processed?

Magyar Posta Zrt. processes the data in order to

• produce the mail item’s address for the sender in accordance with the conditions necessary for the use of the postal service and the related additional services required by the sender,
• provide the interface necessary and suitable for compiling and sending posting lists for the dispatch of the items,
• send notifications to the sender and the addressee about the use of the MPL online address label completion service and the fulfilment of the postal service contract related to the posted items,
• support the compliant and full production of a document containing the correct data for the customs declaration used in international postal traffic of items containing dutiable goods,
• support the dispatch of the items with the data of the submitted posting list and to send confirmation to the sender of mail items actually accepted for posting,
• ensure the contractual fulfilment of the addressee’s instructions, in particular for redirection, by comparing the duly structured electronic data of the posting list with the electronic data of the addressee’s instructions for the item.

28.4. How long do we process the data for?

Magyar Posta Zrt. processes address label data for 30 days and the data necessary for the production of address labels for the Inverz service in order to return mail items to the sender for 90 days and then erases them if the parcel has not been posted. Based on the data of the posting lists sent to Magyar Posta, Magyar Posta prepares an acceptance list of the dispatched items and processes this until the end of the fifth calendar year after the dispatch of the items in accordance with Act CLIX of 2012 on postal services, Section 55(7). Closed posting lists are not accessible on the online interface after they have been submitted and the data of posting lists that are not closed by the sender are automatically deleted after the online interface is left. Magyar Posta’s online address label completion application allows users to maintain their own address database. Magyar Posta Zrt. processes the data recorded in the address database until the user deletes them, but at the latest until the user’s registration is cancelled. Magyar Posta Zrt. reminds users every six months during this period to review their address database and delete unnecessary addresses from their address database.

28.5. Who do we transfer your data to? (Who are the recipients of your data?)

Magyar Posta Zrt. uses the data processors participating in the operation of the MyPost interface and specified in point 25.5 for the provision of the MPL online address label and posting list service.

28.6. Who may access the data?

Only the sender can access the data recorded in the MPL online address label and posting list application until the finalised address label and posting list is sent by the sender to Magyar Posta Zrt. After submission, employees who accept the mail items for dispatch and who operate the electronic posting list store have access to the data. The data of the accepted mail items can be accessed by the persons specified in point 2.6 of Magyar Posta Zrt.’s Privacy Notice.

29. Booking an appointment

Magyar Posta Zrt. enables customers to book an appointment online to arrange their affairs at postal outlets equipped with a customer queueing system, where the postal operator calls customers based on their individual serial number at the booked time.

29.1. On what grounds is Magyar Posta Zrt. entitled to process the data?

Magyar Posta Zrt. is entitled to process the data of users who access the MyPost interface and book an appointment based on the following:

• The personal data of natural persons, in view of booking an appointment on the person’s own initiative, are necessary to enter into and perform the contract between the natural person and Magyar Posta that will be created through booking an appointment [General Data Protection Regulation, Article 6(1)(b), and Act CVIII of 2001 on certain aspects of electronic commerce and information society services, Section 13/A];
• The personal data of a person representing an organisation are necessary for asserting the legitimate interests of both the organisation represented and Magyar Posta Zrt. The legitimate interests are demonstrated by Magyar Posta Zrt. performing the service used by the organisation in the online space on the agreed conditions and giving information related to the organisation, an appointment and an individual customer queueing number to the person acting on behalf of the organisation. [General Data Protection Regulation, Article 6(1)(f), and Act CVIII of 2001 on certain aspects of electronic commerce and information society services, Section 13/A].

29.2. What type of data do we process?

29.3. Why are the data processed?

Magyar Posta Zrt. processes the data so that confirmation of the booked time can be sent by e-mail to the user booking the appointment. Magyar Posta Zrt. only stores the serial number, the postal outlet and the service range about the appointment in order to make the serial number appear in the postal outlet’s queueing system at the chosen time and to attribute to it the appropriate customer window dealing with the given service range. The person who booked the serial number is not stored.

29.4. How long do we process the data for?

Magyar Posta Zrt. processes the data until the day of the booked appointment or, if cancelled, not later than the cancellation of the previously booked time.

29.5. Who do we transfer your data to? (Who are the recipients of your data?)

Magyar Posta Zrt. uses the data processors specified in point 25.5 to provide the services available on the MyPost interface.

29.6. Who may access the data?

After the booking is confirmed, the e-mail is sent automatically to the e-mail address of the user initiating the booking. The data may only be accessed by IT operations staff who are responsible for detecting and repairing any potential IT faults in the e-mail sending process.

30. Redirection

30.1. On what grounds is Magyar Posta Zrt. entitled to process the data?

• On ordering redirection, a contract is created between Magyar Posta Zrt. and the data subject, and the data of the customer are required for the performance of this contract. [General Data Protection Regulation, Article 6(1)(b)].
• Magyar Posta Zrt. processes the data of relatives based on its own legitimate interest and that of the customer and data subject as the order extends to redirecting to a new address the mail, subscribed periodicals and newspapers, and pension payments of the relatives as well. Thus Magyar Posta Zrt. meeting the conditions specified in the order is in their joint interest. The data recorded about the relatives are thus necessary for the performance of the service contract, which is a legitimate, legally and socially recognised interest. [General Data Protection Regulation, Article 6(1)(f)]

30.2. What type of data do we process?

30.3. Why are the data processed?

Magyar Posta processes the personal data

• to accept and create an order,
• to perform the order,
• to account for performance and collect the fee for the service,
• to maintain contact and deliver notifications related to the performance of the contract (prior notification about expiry) and
• to enforce claims arising from non-contractual performance

30.4. How long do we process the data for?

Magyar Posta Zrt. processes the data of the order for five (5) years after the termination of the order because within this period the data subject may enforce any legal dispute that may arise between Magyar Posta Zrt. and the data subject in court.

Magyar Posta Zrt. must account for orders, thus it is obliged to keep the data of the orders for 8 years as stipulated in the Accounting Act.

If data processing becomes necessary due to the establishment, exercise or defence of any legal claim related to the service (e.g. court proceedings), Magyar Posta Zrt. will process the data for the period necessary for the establishment, exercise or defence of the legal claims.

30.5. Who do we transfer your data to? (Who are the recipients of your data?)

Magyar Posta Zrt. provides its services with the aid of postal contractors at many points in Hungary. Postal contractors are undertakings that are contracted by Magyar Posta Zrt. to provide services for customers in the name of, for and at the liability of Magyar Posta Zrt. applying the rules laid down by Magyar Posta Zrt. Accordingly, postal contractors are Magyar Posta Zrt.’s data processors, who process the data specified in point 30.2 both when recording the orders and in the course of delivery. If you would like to view the list of postal contractors, you can access it on the www.posta.hu page under Privacy Notice in the menu.

Magyar Posta Zrt. uses the data processors specified in point 25.5 to operate the MyPost interface.

30.6. Who may access the data?

The staff receiving the orders and managing the data in the records as well as employees involved in delivery in accordance with the order have access to the data.

There are special units dedicated to regularly checking Magyar Posta Zrt.’s internal operations and the compliance of its activities with regulations, thus the staff engaged in such controls (operations inspectors, internal auditors, security and protection staff, data protection officers) have access to these data provided this is essential for carrying out their duties.

31. Repeated delivery

31.1. On what grounds is Magyar Posta Zrt. entitled to process the data?

On ordering repeated delivery, a contract is created between Magyar Posta Zrt. and the data subject, and the data of the customer are required for the performance of this. [General Data Protection Regulation, Article 6(1)(b)].

31.2. What type of data do we process?

31.3. Why are the data processed?

Magyar Posta processes the personal data

• to accept and create an order,
• to perform the order,
• to account for performance and collect the fee for the service,
• to maintain contact and deliver notifications related to the performance of the contract (prior notification about expiry) and
• to enforce claims arising from non-contractual performance

31.4. How long do we process the data for?

Magyar Posta Zrt. processes the data of the order for five (5) years after the termination of the order because within this period the data subject may enforce any legal dispute that may arise between Magyar Posta Zrt. and the data subject in court.

Magyar Posta Zrt. must account for orders, thus it is obliged to keep the data of the orders for 8 years as stipulated in the Accounting Act.

If data processing becomes necessary due to the establishment, exercise or defence of any legal claim related to the service (e.g. court proceedings), Magyar Posta will process the data for the period necessary for the establishment, exercise or defence of the legal claims.

31.5. Who do we transfer your data to? (Who are the recipients of your data?)

Magyar Posta Zrt. provides its services with the aid of postal contractors at many points in Hungary. Postal contractors are undertakings that are contracted by Magyar Posta Zrt. to provide services for customers in the name of, for and at the liability of Magyar Posta Zrt. applying the rules laid down by Magyar Posta Zrt.. Accordingly, postal contractors are Magyar Posta Zrt.’s data processors, who process the data specified in point 31.2 both when recording the orders and in the course of delivery. If you would like to view the list of postal contractors, you can access it on the www.posta.hu page under Privacy Notice in the menu.

Magyar Posta Zrt. uses the data processors specified in point 25.5 to operate the MyPost interface.

31.6. Who may access the data?

The staff receiving the orders and managing the data in the records as well as employees involved in delivery in accordance with the order have access to the data.

There are special units dedicated to regularly checking Magyar Posta Zrt.’s internal operations and the compliance of its activities with regulations, thus the staff engaged in such controls (operations inspectors, internal auditors, security and protection staff, data protection officers) have access to these data provided this is essential for carrying out their duties.

32. Post Office Box finder and list of Post Office Box holders

PO Box rental is Magyar Posta Zrt.’s service whereby a post office box is provided at a postal outlet into which mail items are delivered to be collected by the customer. A PO box has its own address, allowing letters to be addressed directly to it. This is facilitated by Magyar Posta Zrt. by making publicly available the list of PO Box holders, where holders can choose to appear voluntarily, on the Post Office Box finder interface.

32.1. On what grounds is Magyar Posta Zrt. entitled to process the data?

All Post Office Box holders decide voluntarily whether or not they wish to appear in the list of Post Office Box holders. Thus Magyar Posta Zrt. includes the PO Box holder’s data in the list of PO Box holders based on the data subject’s voluntary consent. [General Data Protection Regulation, Article 6(1)(a)]

32.2. What type of data do we process?

32.3. Why are the data processed?

In the list of Post Office Box holders, we process the data of the PO Box holder to be able to publish, based on the holder’s consent and instruction, the holder’s name, address, and PO Box number and postcode in a way that can be searched with the help of the Post Office Box finder, thus making the data public in order to enable senders to send mail items to the data subject’s rented Post Office Box.

32.4. How long do we process the data for?

Magyar Posta Zrt. processes the data subject’s data in the list of Post Office Box holders until withdrawal of consent or, in the lack of this, while the Post Office Box rental contract remains effective.

The data subject may withdraw consent given to be included on the list of Post Office Box holders at any time via the contact options described in point 37.9. Withdrawal of consent, however, does not affect the lawfulness of processing carried out based on consent before its withdrawal.

32.5. Who do we transfer your data to? (Who are the recipients of your data?)

In order to operate the MyPost interface and thus the Post Office Box finder, Magyar Posta Zrt. uses the data processors specified in point 25.5.

32.6. Who may access the data?

The specific purpose of the list of Post Office Box holders is to make public and accessible to everyone searching in it the data of holders wishing to be included in it. Thus the data are accessible to everyone.

33. eAcceptance at premises

For those customers who use the pick up and delivery service and request their letter mail to be delivered to their premises, Magyar Posta Zrt. created an electronic interface where the acceptance of their mail can be easily and flexibly administered, and a list of the items accepted by them can be accessed and downloaded. The aim of this is to ensure the performance and verification of the postal service also through an electronic channel bearing in mind customers’ convenience. In order to use the application, registering on MyPost is necessary. Information on data processing in this regard can be found under My Post Registration in the menu.

33.1. On what grounds is Magyar Posta Zrt. entitled to process the data?

As the eAcceptance service offers merely a new channel to the acceptance of mail, data processing is necessary for the performance of a universal postal service as a task in the public interest, for which Magyar Posta was appointed under Act CLIX of 2012 on postal services (hereinafter referred to as the “Postal Services Act”), Sections 6 and 18. [Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the “General Data Protection Regulation”), Article 6(1)(e)]

during the provision of postal services that fall outside the scope of universal postal services

• the processing of the sender’s personal data is necessary for the conclusion and performance of the postal service contract, which is concluded between the sender and Magyar Posta Zrt. [General Data Protection Regulation, Article 6(1)(b)]
• while the processing of the personal data of addressees and recipients is necessary for the assertion of the legitimate interest of the sender and Magyar Posta Zrt., which is demonstrated by the fact that without it the performance and verification of the contract would not be possible under the statutory terms and conditions for the fulfilment of postal services [General Data Protection Regulation, Article 6(1)(f)]

33.2. What type of data do we process?

33.3. Why are the data processed?

• to fulfil the postal service contract
  We process data in order to deliver letters to their addressees in compliance with the rules that apply to us – set by the sender or the addressee, or defined by law.
• to account, prove and subsequently check performance
  The data are required to prove to senders that their item was delivered in accordance with their instructions and to ensure that everything occurred correctly. At the same time, it is important to be able to investigate complaints and claims for compensation, which we could not do without processing the data necessary for delivery. The eAcceptance service also allows the addressee to have direct access to the acceptance list for 90 days after acceptance is completed.
• to fulfil data supply requests
  – to supply data to the National Media and Infocommunications Authority
  The National Media and Infocommunications Authority supervises our Company’s postal services, thus we must supply information, in part related to complaints, to the Authority.
  – Moreover, we are obliged under Section 38 of the Postal Services Act to supply information to the organisations authorised to prevent and investigate crime (for example, the police), or to gather intelligence or obtain confidential data upon request. The specific conditions under which this may happen are laid down in Government Decree 9/2005 of 19 January 2005 on the detailed rules of cooperation between postal service providers, postal contractors, and organisations authorised to gather intelligence in secret and to obtain confidential data (such as the Special Service for National Security).

33.4. How long do we process the data for?

Personal data are processed until the end of the calendar year after the date of acceptance of a mail item for postal handling, i.e. the date of posting. In the online application the list of accepted items is directly accessible to the addressee for 90 days after the completion of acceptance, during which time it can be downloaded.

33.5. Who do we transfer your data to? (Who are the recipients of your data?)

It is our legal obligation to disclose or provide access to data to the National Media and Infocommunications Authority [Postal Services Act, Section 53], the court, the prosecutor’s office, the investigating authority, the offence authority, the administrative authority, the National Authority for Data Protection and Freedom of Information, and any other body authorised by law, upon their request. We are obliged to cooperate with the organisations authorised to prevent and investigate crime, and to gather intelligence in secret. [Postal Services Act, Section 38, and Government Decree 9/2005 of 19 January 2005]

Magyar Posta Zrt. only provides personal data to or allows access for these organs if the precise purpose and data range is indicated and only does so to the extent that is absolutely necessary for the purpose of the request and is suitable to achieve the objective.

Magyar Posta Zrt. uses the data processors participating in the operation of the MyPost interface and specified in point 25.5 for the provision of the eAcceptance service.

33.6. Who may access the data?

Magyar Posta Zrt. processes personal data allowing access only to those who need them to carry out the service you require. As the eAcceptance service offers merely a new channel to the acceptance of mail, the data may be accessed by those described in the chapter on the postal service as having access.

34. Subscription to the Procurement Newsletter

Magyar Posta Zrt. devised the Procurement Newsletter to enable businesses, including individual entrepreneurs, to receive information about Magyar Posta’s procurements by registering their contact details for this purpose.

34.1. On what grounds is Magyar Posta entitled to process the data?

Magyar Posta Zrt. processes the data of individual entrepreneurs, smallholders and individuals with a tax number as natural person data subjects based on voluntary consent, which is demonstrated by the fact that data subjects give their data to Magyar Posta Zrt. on the interface. [General Data Protection Regulation, Article 6(1)(a)]

Magyar Posta Zrt. has a legitimate business interest in processing the data of individuals registering as contact persons for legal persons, which is demonstrated by the fact that communicating with organisations requesting the newsletter would be impossible without processing the data of their contact persons. [General Data Protection Regulation, Article 6(1)(f)] The appropriate legal basis for giving the data of the contact person to Magyar Posta Zrt. must be ensured by the company in the legal relationship between the company and the contact person.

34.2. What type of data do we process?

34.3. Why are the data processed?

Magyar Posta Zrt. processes the data for the purpose of delivering Magyar Posta Zrt.’s procurement news and newsletters of interest to the registered persons by e-mail.

34.4. How long do we process the data for?

Magyar Posta Zrt. processes the data of sole traders, small holders and individuals with a tax number as natural persons until withdrawal of consent. Withdrawal of consent, however, does not affect the lawfulness of processing carried out before its withdrawal.

Magyar Posta Zrt. processes the data of contact persons until the registration of the legal person is deleted. If the legal person notifies a change of contact person, the registration of the old contact person will be deleted and, at the same time, the registration of a new contact person can be made.

34.5. Who do we transfer your data to? (Who are the recipients of your data?)

Magyar Posta Zrt. does not use data processors to send the newsletter, and does not transfer the data to third parties.

34.6. Who may access the data?

Data may be accessed by Magyar Posta Zrt.’s procurement and IT operations staff who operate the registration process, maintain registrations (deletion, solving entry problems, etc.) and send out procurement newsletters.

There are special units dedicated to regularly checking Magyar Posta Zrt.’s internal operations and the compliance of its activities with regulations, thus the staff engaged in such controls (operations inspectors, internal auditors, security and protection staff, data protection officers) have access to these data provided this is essential for carrying out their duties.

35. Strong customer authentication and transaction risk analysis

35.1. On what grounds is Magyar Posta entitled to process the data?

Data processing is necessary for the assertion of the legally recognised legitimate interest of Magyar Posta Zrt. and payment service providers affected by bank card purchase transactions to comply with the rules of strong customer authentication. [General Data Protection Regulation, Article 6(1)(f)]

Data processing is also necessary for the assertion of Magyar Posta Zrt.’s legitimate interest to operate its services available through online channels in accordance with customer needs by ensuring the security of the payers’ transactions and the profitable operation of the services available on the online channel. [General Data Protection Regulation, Article 6(1)(f)]

This legitimate interest is founded on

• Act LXXXV of 2009 on the provision of payment services, Section 55/C, which creates an obligation to perform strong customer authentication; and
• Commission Delegated Regulation (EU) 2018/389 supplementing Directive (EU) 2015/2366 of the European Parliament and of the Council with regard to regulatory technical standards for strong customer authentication and common and secure open standards of communication, which, inter alia, regulates the risk analysis of transactions.

35.2. What type of data do we process?

35.3. Why are the data processed?

Magyar Posta Zrt. processes the data to increase the security of payment by bank card, to ensure multiple factor identification, and to ensure that the transaction risk analysis by the card issuing bank establishing exemption from strong customer authentication is carried out.

35.4. How long do we process the data for?

Magyar Posta Zrt. processes the data from the start of the payment order until the expiry of the period for lodging claims, which is 5 years.

35.5. Who do we transfer your data to? (Who are the recipients of your data?)

Magyar Posta Zrt. transfers data about payment transactions to OTP Mobil Szolgáltató Korlátolt Felelősségű Társaság (Registered office: 1143 Budapest, Hungária körút 17-19. Company registration number: 01 09 174466, Tax number: 24386106-2-42; the company’s address for service: benyo.peter@otpmobil.hu) for the purpose of carrying out the assessment of the transaction necessary for strong customer authentication and the transaction risk analysis to establish exemption, forwarding to the financial institutions performing authorisation tasks [OTP Bank Nyrt. (1051 Budapest, Nádor u. 16) and to Borgun hf. (Ármúli 30, 108 Reykjavik, Iceland)], and the performance of the payment transaction authorisation by the financial institutions carrying out the authorisation, fraud monitoring and fraud prevention (transaction risk analysis), and arranging the bank card acceptance and the transaction risk analysis by the card issuing bank.

For the payment of bills using the iCsekk application, Magyar Posta Zrt.’s data processor is Díjbeszedő Holding Zrt. (1117 Budapest, Budafoki út 107-109, Company registration number: 01-10-042094, Tax number: 10805246-2-43), which operates the application and, through the application, transfers the data necessary for conducting the payment transactions to the systems of OTP Mobil Kft. and Magyar Posta Zrt.

Magyar Posta Zrt. uses the data processors specified in point 25.5 to provide the services on the MyPost interface.

35.6. Who may access the data?

Magyar Posta Zrt. processes personal data allowing access only to those who need them to carry out the service the data subject requires. The data can be accessed by those employees of Magyar Posta and its data processor who fulfil system administration tasks related to performing payment transactions and only if an error occurs during the performance of the payment transaction in order to eliminate it. The data may also be accessed by employees who are involved in the administration of accounting payment transactions.

There are special units dedicated to regularly checking Magyar Posta Zrt.’s internal operations and the compliance of its activities with regulations, thus the staff engaged in such controls (operations inspectors, internal auditors, security and protection staff, data protection officers) have access to these data provided this is essential for carrying out their duties.

36. Data security

Magyar Posta takes all the security, technical and organisational measures required to guarantee the security of data through its organisational units.

36.1. Organisational measures

Within Magyar Posta Zrt. the functions of operating and developing data protection, IT security, security and confidentiality, and information technology systems are organised separately and independently of each other.

In implementing Magyar Posta Zrt.’s IT developments, the opinion of the data protection officer and the information technology security department must be obtained in the planning stage to ensure that IT security and data protection aspects are taken into consideration. Magyar Posta classifies all its IT systems into security classes and assesses the security risks of the information technology. The risk assessment and the risk management measures devised based on this comply with the criticality of the processes and system elements, and IT security requirements.

Magyar Posta Zrt. allows access to its IT systems through personal authorisation. In allocating authorisations the principle of necessary and sufficient rights is applied, i.e. Magyar Posta Zrt.’s IT systems and services can only be used by all users to the extent necessary to fulfil their duties, with due authorisation and for the period of time required. Authorisation to use the IT systems and services is only given to persons who are not subject to restriction for security or other reasons (e.g. conflict of interests) and have the necessary professional, business and information security skills required for their safe use.

In operating our information technology systems, in particular during breach management and change management, and developing these, internationally accepted methods and recommendations (e.g. ITIL) are taken into account.

Magyar Posta Zrt. organises its internal operations through internal regulations as well. The prior opinion of the data protection officer must be sought about the internal regulation of processes affecting personal data both when devising and when amending these.

All Magyar Posta Zrt. employees make a written declaration undertaking to fulfil strict confidentiality rules upon entering into employment and must act in accordance with these confidentiality rules in the performance of their duties.

A requirement is not to leave documents containing personal data on the desks after finishing work; these must be locked away by employees in order to prevent unauthorised access (clean desk policy).

36.2. Technical measures

Magyar Posta Zrt. protects the buildings it operates or uses, the rooms within these buildings and thus the data handled, processed and stored there through various means of mechanical and electronic protection (e.g. alarm, CCTV, grills, entry systems requiring authorisation, fire protection systems, etc.). Furthermore, Magyar Posta Zrt. uses time-lock safes as well.

Except for data stored by its data processors, Magyar Posta Zrt. stores data on its own equipment in data centres. Magyar Posta keeps the IT devices storing data in a separate, locked server room protected by a multi-level entry system linked to authorisation checks.

Magyar Posta Zrt. protects its internal network with multi-layer firewall protection. A hardware firewall (border protection device) is installed everywhere at the entry points of public networks used in every case.

Magyar Posta Zrt. uses redundancy to store data, i.e. stores data at several places, to protect them from destruction, loss or damage due to a IT device error, or illegal destruction.

Our internal networks are protected from external attacks through multi-level, active, complex protection against malicious codes (e.g. virus protection).

The indispensable external access to the IT systems and databases operated by Magyar Posta Zrt. is realised through encrypted data connection (VPN).

We do our utmost to ensure that our information technology devices and software continuously comply with the generally accepted technological solutions used in market operation.

During developments we create systems which can be controlled through logging and where transactions can be traced and the occurrence of privacy incidents, such as unauthorised access, can be detected.

Magyar Posta Zrt. destroys paper-based data upon the expiry of the retention period in compliance with the prescribed data protection requirements. Data are destroyed by Magyar Posta Zrt.’s data processors by using a shredder and compactor complying with strict security requirements, regularly inspected by Magyar Posta Zrt. A current list of data processors is available on the www.posta.hu website under Privacy Notice in the menu.

37. What rights do I have related to my data? (Data subject’s rights)

The data subject’s rights:

• withdrawal of consent
• request to access (information)
• request to rectify data
• request to erase data
• request to restrict processing
• object to data processing
• request for human intervention in automated decision-making
• request for data portability

37.1. Withdrawal of consent

Where Magyar Posta Zrt. processes personal data based on consent, data subjects have the right to withdraw their consent at any time without restriction. By this the data subjects express that they no longer want their data to be processed by Magyar Posta Zrt. This, however, does not affect the legality of data processing conducted prior to such withdrawal. As a result of the withdrawal of consent, Magyar Posta Zrt. erases the personal data processed based on consent. Data will not be erased if processing of the data is required

• for the performance of a contract to which the data subject is a party or in order to take action requested by the data subject prior to entering into the contract,
• for compliance with a legal obligation or the performance of a task carried out in the public interest, or
• to protect the vital interests of the data subject or others, or
• for the purposes of the legitimate interests pursued by Magyar Posta Zrt. or a third party.

Data subjects may withdraw consent via the contact options given in point 37.9.

37.2. Request to access (information)

Data subjects may request information at any time regarding whether Magyar Posta Zrt. is processing their data, and if so, they may be granted access to these.

In the absence of an exact requirement in the data subjects’ request of what in particular they are interested in with regard to their data being processed, in addition to their data, we will provide information about the following:

• what data Magyar Posta Zrt. processes,
• where these were obtained from (source of the data),
• why Magyar Posta Zrt. processes the data (purpose of data processing),
• the grounds entitling Magyar Posta Zrt. to process the data (the legal basis),
• from when until when Magyar Posta Zrt. processes the data (duration),
• whether Magyar Posta Zrt. involves a data processor in processing the data,
• if a data processor is involved,
  – who it is (the name of the data processor),
  – what its address is (the address of the data processor),
  – what it does with the data (its activity related to data processing),
• whether Magyar Posta has transferred the data to anyone and, if yes, to whom (recipient of data transfer)
• what rights the data subjects have in relation to processing their data
• if Magyar Posta Zrt. processes the data subjects’ data in a way that, based on their data, a consequence arises or a decision is made without human intervention that affects data subjects, a description of such an occurrence, the means by which it happened and its impact on data subjects
• if Magyar Posta Zrt. transfers the data subjects’ data outside the EGT member states (European Union member states and Norway, Lichtenstein and Iceland) or to an international organisation, the guarantee of appropriate data processing in such cases.

In certain cases, such as the prevention of crime or for national security interests, Magyar Posta Zrt. must refuse to provide information based on the provisions of the law.

37.3. Request to rectify (change) data

Data subjects may request that their data be rectified. If the data subject’s data that Magyar Posta Zrt. processes are erroneous or untrue, the data subject may request that they are changed for the correct, true data. For example, if a customer requesting the MyPost Card wishes to give a new telephone number or postal address, he or she may request Magyar Posta Zrt. to change the old one for the new.

The data subject must support the authenticity of the new data and verify that he or she is entitled to request the change. Only in this way can Magyar Posta Zrt. assess whether the new data are true and, if they are, whether the old data can be amended.

If it is unclear whether the data processed are correct or accurate, Magyar Posta Zrt. will not rectify the data, only restrict them until the correctness of the data has been checked.

37.4. Request to erase data

Data subjects may request that their data be erased.

For data processing based on the data subject’s consent, Magyar Posta Zrt. will regard a request for erasure as the withdrawal of consent and thus will erase the personal data. Data will not be erased if processing of the data is required

• for the performance of a contract to which the data subject is a party or in order to take action requested by the data subject prior to entering into the contract,
• for compliance with a legal obligation or the performance of a task carried out in the public interest, or
• to protect the vital interests of the data subject or others, or
• for the purposes of the legitimate interests pursued by Magyar Posta Zrt. or a third party.

With data processing based on consent, however, data will certainly be erased if the data of children are collected by Magyar Posta Zrt. in relation to online services offered to children. However, Magyar Posta Zrt. does not offer such a service.

If the data subject requested the erasure of his or her data from processing which is necessary for Magyar Posta Zrt. to perform a task in the public interest [General Data Protection Regulation, Article 6(1)(e)], or which is based on the legitimate interest of Magyar Posta Zrt. or a third party [General Data Protection Regulation, Article 6(1)(f)], Magyar Posta Zrt. will regard such a request for erasure as an objection to the processing. If the objection is well-founded (i.e. there is no reason why the data must be processed), Magyar Posta Zrt. will erase the data.

If data processing is required in order to perform a contract or take action at the data subject’s request prior to entering into the contract, or to comply with a legal obligation or for the protection of the vital interests (e.g. life) of the data subject or a third party, regardless of the request for erasure, Magyar Posta Zrt. will only erase the data if the personal data are no longer required.

In other cases, Magyar Posta Zrt. will erase the data if it is established that they have been processed unlawfully, or a Hungarian or European Union legal obligation stipulates their erasure.

Magyar Posta Zrt. cannot erase data which must be processed by Magyar Posta Zrt. as a legal obligation or due to a public duty or based on public interest in the field of public health (e.g. the prevention of an epidemic situation). Data that are processed for scientific research, archiving or statistical purposes, or are required for the establishment, exercise or defence of legal claims must also be kept.

37.5. Request to restrict processing

Data subjects may request Magyar Posta to restrict the processing of their data. In this case Magyar Posta Zrt. will not use the data subject’s data, only store them. Magyar Posta Zrt. will restrict the processing of a data subject’s data if the data subject

• contests the accuracy of the data processed by Magyar Posta Zrt. but the accuracy of the data subject’s data still needs to be verified,
• opposes the erasure of the data by Magyar Posta Zrt. and ask for them to be kept,
• requests Magyar Posta Zrt. to keep his or her data in order to exercise a legal claim (e.g. to bring legal action) using them,
• objected to the processing of the data and it still needs to be examined whether the data subject’s objection is well-grounded.

Magyar Posta will inform data subjects of the lifting of the restriction in advance.

37.6. Objecting to data processing

The data subject may object to data processing related to him or her. If this objection is well-founded, i.e. there are no compelling reasons for the processing of the data, Magyar Posta Zrt. will stop processing the data and erase the data.

The data subject may object if data processing is necessary for Magyar Posta Zrt. to perform a task in the public interest [General Data Protection Regulation, Article 6(1)(e)], or is based on the legitimate interest of Magyar Posta or a third party [General Data Protection Regulation, Article 6(1)(f)].

In many cases, for instance when Magyar Posta Zrt. has recorded the data with the data subject’s voluntary consent, the data subject’s objection is really a request for deletion expressed as an objection. For example, when a MyPost Card holder objects to his or her data being processed, by doing so he or she requests the deletion of the data, and the data must be deleted.

An objection is when a data subject expresses disapproval of data processing in the event that Magyar Posta Zrt. asks by e-mail for the recipient’s opinion on parcel delivery, but the data subject does not want to receive opinion-requesting e-mails. In this event the data subject expresses his or her objection and Magyar Posta Zrt. puts the e-mail address onto a black list in order not to send such requests asking for opinion to that address again.

If data processing is required in order to perform a contract or take action at the data subject’s request prior to entering into the contract, or to comply with a legal obligation or for the protection of the vital interests (e.g. life) of the data subject or a third party, regardless of the objection, Magyar Posta Zrt. will only erase the data if the personal data are no longer required.

Magyar Posta Zrt. cannot erase data which must be processed by Magyar Posta Zrt. as a legal obligation or due to a public duty or based on public interest in the field of public health (an epidemic situation) or that are necessary for the establishment, exercise or defence of legal claims.

For instance, when a customer needs to be screened from the aspect of the prevention of money laundering and terrorist financing, no declaration of consent is requested for completing the screening data sheet but data are recorded based on the legal requirement and, upon request from the National Tax and Customs Administration or if the suspicion of money laundering arises, the data will be transferred to the tax authority. If the customer subsequently objects to Magyar Posta Zrt. transferring his or her data to the tax authority, this has no bearing on the data transfer as it is a legal obligation.

37.7. Request for human intervention in automated decision-making

Data processing by automated decision-making is when an automated means reaches a result, based on available data, about the data subject without human intervention determining in any part in the process what will happen to the data subject based on that data. For example, in the event that a job application is assessed automatically based on the data subject’s data and the data subject does not meet certain criteria specified in advance, a rejection message is sent automatically to the data subject.

In this type of data processing, the data subject may request human intervention to review the decision where

• automated decision-making is based on consent, or
• this is necessary for concluding a contract with the data subject or for taking steps prior to entering into the contract (e.g. assessing a request to conclude a contract).

If processing by automated decision-making is required by law, the data subject may not request human intervention.

37.8. Request for data portability

The data subject may request Magyar Posta Zrt. to issue in an electronic format the data given by the data subject to Magyar Posta Zrt. and processed in an IT system in order to be able to transfer them to another data controller.

The data subject may request data portability where processing is based on consent [General Data Protection Regulation, Article 6(1)(a)], or processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract [General Data Protection Regulation, Article 6(1)(b)].

In response to the request, Magyar Posta Zrt. will issue the data in .xml or .csv format dependent on the functionality of the data processing system.

If the data subject requests Magyar Posta Zrt. to transfer his or her data directly to another data controller, Magyar Posta Zrt. will examine whether or not it has a suitable data connection which allows the safe and lawful transmission of the data and, provided it does, it will transfer the data directly.

37.9. Where can I contact Magyar Posta Zrt. in order to enforce my rights?

Requests concerning personal data (withdrawal of consent, access (information), rectification, restriction (blocking), erasure, objection or data portability) may be submitted at any time using the contact details below:

• by post: to the address of the Customer Service Directorate (Ügyfélszolgálati Igazgatóság): 3512 Miskolc,
• by faxing (+36) 46-320-136,
• by e-mail to ugyfelszolgalat@posta.hu,
• by phoning (+36) 1-767-8282,
• in person at Magyar Posta Zrt. Budapest, District VI, Teréz körút 51-53, and at Magyar Posta’s permanent postal outlets.

Magyar Posta Zrt. may provide different contact details in its previously issued separate information on data processing for different purposes but, irrespective of this, the Customer Service Directorate can be contacted by the above means with data subjects’ requests and complaints for all data processing.

Magyar Posta Zrt. must reply to the data subject’s request without unjustified delay but within 1 month of the submission of the request at the latest. If the request is very complex or a large number of requests are submitted, Magyar Posta Zrt. is entitled to extend this deadline by 2 months but the data subject will be informed of this within 1 month.

If for any reason we are unable to fulfil the data subject’s request, we will likewise inform the data subject of the reasons for this within 1 month of the submission of the request.

Data subjects should note that, in the event of unjustified requests or regularly repeated, excessive requests for the same data, a fee for fulfilling their request may be charged or the request may be refused.

Magyar Posta Zrt. informs data subjects that, if they indicate in their request for erasure, correction or restriction of data processing their wish for Magyar Posta Zrt. to inform them of the persons who processed their data or to whom their data have been transferred, Magyar Posta Zrt. will inform data subjects of these persons in its reply to their request.

38. Where can I turn to protect my rights?

If you think that the way Magyar Posta Zrt. processes your personal data infringes your rights, we suggest you first contact Magyar Posta Zrt. with your complaint. Your complaint will be investigated in every case and we will do our utmost to address it.

If, despite having made a complaint, you continue to find that the way Magyar Posta Zrt. processes your data is injurious, or you do not wish to make a complaint but wish to turn to the authorities directly, you can make a report to the Hungarian National Authority for Data Protection and Freedom of Information (address: 1055 Budapest, Falk Miksa utca 9-11, postal address: 1363 Budapest, Pf. 9, E-mail: ugyfelszolgalat@naih.hu, website: www.naih.hu).

You also have the option of taking legal action in order to protect your data. In this case you may decide whether to bring an action before the court based on your place of residence (permanent address) or temporary residence (temporary address) ( http://birosag.hu/torvenyszekek).

You can find the court based on your permanent or temporary place of residence on the website h ttp://birosag.hu/ugyfelkapcsolati-portal/birosag-kereso.