Privacy Notice

At Közép-európai Egyetem (address: 1051 Budapest, Nádor u. 9.), (hereinafter “CEU” or the “University”), we place great emphasis on the protection of your personal information and compliance with the applicable data privacy requirements, including specifically the EU General Data Protection Regulation(GDPR)[1] and Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information and the Hungarian Civil Code.

This Privacy Notice relates to the collection, use and retention of personal data managed by the Romani Studies Program at CEU.

 

1. Who are we and what do we do?

 

Central European University is a graduate-level “crossroads” university where faculty and students from more than 100 countries come to engage in interdisciplinary education, pursue advanced scholarship, and address some of society’s most vexing problems.

It is accredited both in the United States, Hungary and Austria, and offers English-language Master's and doctoral programs in the social sciences, the humanities, law, management and public policy. Located in the heart of Central Europe – Budapest, Hungary and Vienna, Austria – CEU has developed a distinct academic and intellectual focus, combining the comparative study of the region's historical, cultural, and social diversity with a global perspective on good governance, sustainable development and social transformation.

 

The Romani Studies Program  (RSP) at CEU is an independent academic unit set up by a CEU Senate decision as of August 1, 2017. The RSP aims to engage scholars, policy makers, and activists in interdisciplinary knowledge production and debate on Roma identity and movement; antigypsyism; social justice and policy making; gender politics; and structural inequality. 

 

2. Contact details of the Data Controller

 

Közép-európai Egyetem

1051 Budapest
Nádor u. 9.
Phone: + 36 1 3273000

 

3. Contact details of the Data Protection Officer

 

Irisz Szél

Data Protection Officer

1051 Budapest, Nádor u. 9.
Phone: + 36 1 327-3000
E-mail: privacy@ceu.edu

 

4. What kind of personal data do we collect? 

    What is our purpose and legal basis for processing your data?

    How long will your information be held

 

Purpose of data processing

Personal data processed

Legal basis

Retention period

Registration for events organized by the CEU 

Individual’s name, e-mail address, institution or any other personal data specified in registration form

The legal basis for data processing is the legitimate interests pursued by CEU under Article 6 (1) (f) of the GDPR

Until the end of the event and where applicable, it is stored for 8 years after the agreement/contract expired

Selecting event participants (where it is necessary)

Individual’s name, e-mail address, institution or any other personal data specified in registration form

The legal basis for data processing is the legitimate interests pursued by CEUunder Article 6 (1) (f) of the GDPR

Until the end of the event and where applicable, it is stored for 8 years after the agreement/contract expired

Contacting selected and non-selected participants

Individual’s name, e-mail address

The legal basis for data processing is the legitimate interests pursued by CEUunder Article 6 (1) (f) of the GDPR

Until the end of the event and where applicable, it is stored for 8 years after the agreement/contract expired

Preparing the

agreement/contract (where it is necessary)

Conditions, name, signature, date

Processing is necessary for the performance of a contract based on GDPR Article 6 (1) b)

For 8 years after the agreement/contract expired

Payment (where it is necessary)

Name, amount, bank account information

Processing is necessary for the performance For 8 yearsof a contract based on GDPR Article 6 (1) b)

For 8 years after the agreement/contract expired

Attandence list (where it is necessary)

Individual’s name, e-mail address, institution or any other personal data specified in attendance list

The legal basis for data processing is the legitimate interests pursued by CEUunder Article 6 (1) (f) of the GDPR

Until the end of the event and where applicable, it is stored for 8 years after the contract expired

Conducting surveys related to career development and cooperation opportunities with the students and Alumni of the Program

Individual’s name, contact details or any other personal data specified in the survey (Citizenship, Residence, Employment details)

The legal basis for data processing is the consent of the data subject under Article 6 (1) (a) of the GDPR 

 

 

 

Until the consent of the data subject has been withdrawn. 

 

 

 

Individual photo/video/voice -taking photos and making voice/video. 

 

Recordings at events organized by the units and departments of the University

Image, voice, behavior

 

 

Image, voice, behavior

 

The legal basis for data processing is the consent of the data subject under Article 6 (1) (a) of the GDPR.

 

The legal basis for data processing is the consent of the data subject under Article 6 (1) (a) of the GDPR.

Until the consent of the data subject has been withdrawn. 

 

 

Until the consent of the data subject has been withdrawn. 

 

Small group photo/video/group voice- taking photos and making voice/video recordings at events organized by the units and departments of the University

Image, voice, behavior

The legal basis for data processing is the consent of the data subject under Article 6 (1) (a) of the GDPR.

Until the consent of the data subject has been withdrawn. 

 

 

Photo/video of public figures- taking photos and making voice/video recordings at events organized by the units and departments of the University

Image, voice, behaviour of public figures

The legal basis for data processing is the consent of the data subject under Article 6 (1) (a) of the GDPR. Consent of a public figure is automatically considered to have been given regarding his/her public activity.

Until the consent of the data subject has been withdrawn. 

 

 

Individual photo/video/voice- publishing photos/voice/video recordings on CEU’s webpage and social media pages 

Image, voice, behavior

The legal basis for data processing is the consent of the data subject under Article 6 (1) (a) of the GDPR.

Until the consent of the data subject has been withdrawn. 

 

 

Small group photo/video/group voice- publishing photos/voice/video recordings on CEU’s webpage and social media pages 

Image, voice, behavior

The legal basis for data processing is the consent of the data subject under Article 6 (1) (a) of the GDPR.

Until the consent of the data subject has been withdrawn. 

 

 

Photo/video of public figures- publishing photos/voice/video recordings on CEU’s webpage and social media pages

Image, voice, behaviour of public figures

The legal basis for data processing is the consent of the data subject under Article 6 (1) (a) of the GDPR. Consent of a public figure is automatically considered to have been given regarding his/her public activity.

Until the consent of the data subject has been withdrawn. 

 

 

Publishing a note, comment to the photo/voice/video including personal data (name, position, university, etc. of individuals

Name, profession, position etc. of individuals to be published on publicly available platforms or in print

The legal basis for data processing is the legitimate interests pursued by CEUunder Article 6 (1) (f) of the GDPR

Until the consent of the data subject has been withdrawn. 

 

 

Contacting you, as well as sending invitations and newsletters regularly about our upcoming events.

Individual’s name, e-mail address to send newsletters, invitations

The legal basis for data processing is the consent of the data subject under Article 6 (1) (a) of the GDPR.

Until the consent of the data subject has been withdrawn. In the absence thereof, we send newsletters for 5 years. 

 

Retaining the signed consent forms

Individual’s name and signature on the consent form 

Processing is necessary for compliance with a legal obligation to which CEU is subjectunderArticle 6 (1) (c) of the GDPR

For 5 years after the purpose of processing has been achieved

Concluding a data processing agreement with the service provider(s)

 

Contractual data of data processors

The processing is necessary for the performance of a contract to which the data subject is a party under Article 6 (1) (b) of the GDPR

Where applicable, the data processing agreement is stored for 8 years after the service frame contract expired

 

The data subject is entitled to withdraw his/her consent at any time.

Where individuals are not the focus, and/or they are incidentally included in an image as part of a crowd, we talk about a crowd image (e.g. individuals at a conference or a busy open day). The same applies for voices, where individual voices can be heard as one (e.g. in a choir). 

If there are not any identified or identifiable persons on the photo, no processing of personal data takes place, therefore the GDPR is not applicable. 

Based on case law, a photo taken at a public event or on a street (landscape and street view/scene) is considered to be a crowd image.

Public event shall mean an event, with the exception of assembly, that is open to the general public without discrimination. It shall also mean any political, social, artistic activity, manifestation based on the individual’s voluntary determination, autonomous decision that affects the narrower or broader life of society, the local or national relations, the lives of smaller or larger communities, their interests and habits.

 

We use the following social media pages:

 

 

5. Whom do we share your personal data with?

 

Your data will be processed by the University. 

Specific third parties acting as data processors based on a data processor agreement we work with include: 

  • Office 365: Based in the US, with University’s data stored within EU in datacenters located in Amsterdam and Dublin. Software as a Service which provides University’s email and document management
  • Survey Monkey: The surveys are administered through this platform. For more information see: https://www.surveymonkey.co.uk

 

In case there are other data processors involved in the data process (e.g. photographer, video maker as indicated above), we will provide you with information about them in due time. 

 

Third parties acting as separate data controllers we work with include:

  • Open Society Foundation (OSF) and Roma Initiative Office (RIO): OSF and RIO as donors of the RSP programs are entitled to control the use of the grant supporting the development of Romani youth. Personal data managed during the programs will be transferred to the donors when they conduct the grant evaluations and audits, and also in the form of financial reports. The legal basis for the data transfer is our obligation to perform the contract with the donors. 

 

We require all third parties and data processors to respect the security of your personal data and to treat it in accordance with the law and CEU’s data privacy policies, as determined in the respective Data Processing Agreements. 

 

6. How long will your information be held for the purposes set out in section 4?

 

After you withdraw your consent, object to data processing we will process your personal data for a maximum of 25 (twenty-five) days for technical reasons.In the absence of withdrawal or objection and after data processing periods mentioned above, we shall delete your personal data from our system, unless data processing has a further legal basis.

 

Where we have made the personal data public and are obliged pursuant to the GDPR to erase your personal data, we, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform the data controller which is processing the personal data that you have requested to be erased by such data controller of any links to, or copy or replication of, those personal data.

 

7. What are your rights?

 

You have a right

 

  • to access your personal information – you can obtain a confirmation that we are processing your data and information how we process it. We suggest that you make a request in writing. 
  • to object to the processing of your personal information – this allows you to ask us to stop processing your data at any time. Where we rely on legitimate interest, you must give specific reasons why you are objecting the processing of your data. In this case this is not an absolute right, we can demonstrate compelling legitimate grounds for processing, which override your interests, rights and freedoms. Where we are processing personal data for scientific or historical research, or statistical purposes, you only have a right to object if our lawful basis for processing is legitimate interest. 
  • to rectify – you have a right to have your personal information corrected if it is inaccurate and to have incomplete personal information completed
  • to erase (also known as the right to be forgotten) – in certain circumstances you can ask for the data we hold about you to be erased from our records. Your personal data will be erased where the data are no longer needed for their original processing purpose, or you have withdrawn your consent and there is no other legal ground for processing, or you have objected and there are no overriding legitimate grounds for the processing, or erasure is required to fulfill a statutory obligation under the EU law or the right of the national law. 
  • to request data portability – you can ask to have the data we hold about you transferred to another organization.
  • to restrict processing your personal information – where certain conditions apply, you have a right to restrict the processing of your personal information. 
  • to withdraw your consent at any time – without affecting the lawfulness of processing based on consent before its withdrawal.

 

If you wish to exercise any of these rights, please email privacy@ceu.edu or write to us at 1051 Budapest, Nádor u. 9. 

 

We will make every effort to fulfill your request to the extent allowed by law and will respond in writing within 25 days of receiving your request.

 

Should you wish to request help from the relevant national authority, the details are as follows:

 

National Authority for Data Protection and Freedom of Information 

Postal address: 1530 Budapest, Pf.: 5.

Address: 1125 Budapest, SzilágyiErzsébetfasor 22/c.)

Phone: +36 (1) 391-1400

Fax: +36 (1) 391-1410

E-mail: privacy@naih.hu

Web: http://naih.hu/general-information.html

 

In addition to the legal remedy, you have the right to apply to the court against the activities of the Joint Data Controller. 

 

8. Security of your Information 

 

We are committed to holding your data securely and treating it with sensitivity. All data are held securely and in accordance with the relevant data privacy laws and our internal policies. We do not sell to or trade your data with any other organizations. For further details please see our Data Protection Policy: https://documents.ceu.edu/documents/p-1805

 

Although most of the information we store and process stays within Austria and Hungary, some information may be transferred to countries outside the European Economic Area (EEA). This may occur if, for example, one of our trusted partners’ servers are located in a country outside the EEA (see above: data processors). Where these countries do not have similar data protection laws to the European Union, we will take steps to make sure they provide an adequate level of protection in accordance with EU data protection law.

 



[1]Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

At Közép-európai Egyetem (address: 1051 Budapest, Nádor u. 9.), (hereinafter “CEU” or the “University”), we place great emphasis on the protection of your personal information and compliance with the applicable data privacy requirements, including specifically the EU General Data Protection Regulation(GDPR)[1] and Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information and the Hungarian Civil Code.

This Privacy Notice relates to the collection, use and retention of personal data managed by the Romani Studies Program at CEU.

 

1. Who are we and what do we do?

 

Central European University is a graduate-level “crossroads” university where faculty and students from more than 100 countries come to engage in interdisciplinary education, pursue advanced scholarship, and address some of society’s most vexing problems.

It is accredited both in the United States, Hungary and Austria, and offers English-language Master's and doctoral programs in the social sciences, the humanities, law, management and public policy. Located in the heart of Central Europe – Budapest, Hungary and Vienna, Austria – CEU has developed a distinct academic and intellectual focus, combining the comparative study of the region's historical, cultural, and social diversity with a global perspective on good governance, sustainable development and social transformation.

 

The Romani Studies Program  (RSP) at CEU is an independent academic unit set up by a CEU Senate decision as of August 1, 2017. The RSP aims to engage scholars, policy makers, and activists in interdisciplinary knowledge production and debate on Roma identity and movement; antigypsyism; social justice and policy making; gender politics; and structural inequality. 

 

2. Contact details of the Data Controller

 

Közép-európai Egyetem

1051 Budapest
Nádor u. 9.
Phone: + 36 1 3273000

 

3. Contact details of the Data Protection Officer

 

Irisz Szél

Data Protection Officer

1051 Budapest, Nádor u. 9.
Phone: + 36 1 327-3000
E-mail: privacy@ceu.edu

 

4. What kind of personal data do we collect? 

    What is our purpose and legal basis for processing your data?

    How long will your information be held

 

Purpose of data processing

Personal data processed

Legal basis

Retention period

Registration for events organized by the CEU 

Individual’s name, e-mail address, institution or any other personal data specified in registration form

The legal basis for data processing is the legitimate interests pursued by CEU under Article 6 (1) (f) of the GDPR

Until the end of the event and where applicable, it is stored for 8 years after the agreement/contract expired

Selecting event participants (where it is necessary)

Individual’s name, e-mail address, institution or any other personal data specified in registration form

The legal basis for data processing is the legitimate interests pursued by CEUunder Article 6 (1) (f) of the GDPR

Until the end of the event and where applicable, it is stored for 8 years after the agreement/contract expired

Contacting selected and non-selected participants

Individual’s name, e-mail address

The legal basis for data processing is the legitimate interests pursued by CEUunder Article 6 (1) (f) of the GDPR

Until the end of the event and where applicable, it is stored for 8 years after the agreement/contract expired

Preparing the

agreement/contract (where it is necessary)

Conditions, name, signature, date

Processing is necessary for the performance of a contract based on GDPR Article 6 (1) b)

For 8 years after the agreement/contract expired

Payment (where it is necessary)

Name, amount, bank account information

Processing is necessary for the performance For 8 yearsof a contract based on GDPR Article 6 (1) b)

For 8 years after the agreement/contract expired

Attandence list (where it is necessary)

Individual’s name, e-mail address, institution or any other personal data specified in attendance list

The legal basis for data processing is the legitimate interests pursued by CEUunder Article 6 (1) (f) of the GDPR

Until the end of the event and where applicable, it is stored for 8 years after the contract expired

Conducting surveys related to career development and cooperation opportunities with the students and Alumni of the Program

Individual’s name, contact details or any other personal data specified in the survey (Citizenship, Residence, Employment details)

The legal basis for data processing is the consent of the data subject under Article 6 (1) (a) of the GDPR 

 

 

 

Until the consent of the data subject has been withdrawn. 

 

 

 

Individual photo/video/voice -taking photos and making voice/video. 

 

Recordings at events organized by the units and departments of the University

Image, voice, behavior

 

 

Image, voice, behavior

 

The legal basis for data processing is the consent of the data subject under Article 6 (1) (a) of the GDPR.

 

The legal basis for data processing is the consent of the data subject under Article 6 (1) (a) of the GDPR.

Until the consent of the data subject has been withdrawn. 

 

 

Until the consent of the data subject has been withdrawn. 

 

Small group photo/video/group voice- taking photos and making voice/video recordings at events organized by the units and departments of the University

Image, voice, behavior

The legal basis for data processing is the consent of the data subject under Article 6 (1) (a) of the GDPR.

Until the consent of the data subject has been withdrawn. 

 

 

Photo/video of public figures- taking photos and making voice/video recordings at events organized by the units and departments of the University

Image, voice, behaviour of public figures

The legal basis for data processing is the consent of the data subject under Article 6 (1) (a) of the GDPR. Consent of a public figure is automatically considered to have been given regarding his/her public activity.

Until the consent of the data subject has been withdrawn. 

 

 

Individual photo/video/voice- publishing photos/voice/video recordings on CEU’s webpage and social media pages 

Image, voice, behavior

The legal basis for data processing is the consent of the data subject under Article 6 (1) (a) of the GDPR.

Until the consent of the data subject has been withdrawn. 

 

 

Small group photo/video/group voice- publishing photos/voice/video recordings on CEU’s webpage and social media pages 

Image, voice, behavior

The legal basis for data processing is the consent of the data subject under Article 6 (1) (a) of the GDPR.

Until the consent of the data subject has been withdrawn. 

 

 

Photo/video of public figures- publishing photos/voice/video recordings on CEU’s webpage and social media pages

Image, voice, behaviour of public figures

The legal basis for data processing is the consent of the data subject under Article 6 (1) (a) of the GDPR. Consent of a public figure is automatically considered to have been given regarding his/her public activity.

Until the consent of the data subject has been withdrawn. 

 

 

Publishing a note, comment to the photo/voice/video including personal data (name, position, university, etc. of individuals

Name, profession, position etc. of individuals to be published on publicly available platforms or in print

The legal basis for data processing is the legitimate interests pursued by CEUunder Article 6 (1) (f) of the GDPR

Until the consent of the data subject has been withdrawn. 

 

 

Contacting you, as well as sending invitations and newsletters regularly about our upcoming events.

Individual’s name, e-mail address to send newsletters, invitations

The legal basis for data processing is the consent of the data subject under Article 6 (1) (a) of the GDPR.

Until the consent of the data subject has been withdrawn. In the absence thereof, we send newsletters for 5 years. 

 

Retaining the signed consent forms

Individual’s name and signature on the consent form 

Processing is necessary for compliance with a legal obligation to which CEU is subjectunderArticle 6 (1) (c) of the GDPR

For 5 years after the purpose of processing has been achieved

Concluding a data processing agreement with the service provider(s)

 

Contractual data of data processors

The processing is necessary for the performance of a contract to which the data subject is a party under Article 6 (1) (b) of the GDPR

Where applicable, the data processing agreement is stored for 8 years after the service frame contract expired

 

The data subject is entitled to withdraw his/her consent at any time.

Where individuals are not the focus, and/or they are incidentally included in an image as part of a crowd, we talk about a crowd image (e.g. individuals at a conference or a busy open day). The same applies for voices, where individual voices can be heard as one (e.g. in a choir). 

If there are not any identified or identifiable persons on the photo, no processing of personal data takes place, therefore the GDPR is not applicable. 

Based on case law, a photo taken at a public event or on a street (landscape and street view/scene) is considered to be a crowd image.

Public event shall mean an event, with the exception of assembly, that is open to the general public without discrimination. It shall also mean any political, social, artistic activity, manifestation based on the individual’s voluntary determination, autonomous decision that affects the narrower or broader life of society, the local or national relations, the lives of smaller or larger communities, their interests and habits.

 

We use the following social media pages:

 

 

5. Whom do we share your personal data with?

 

Your data will be processed by the University. 

Specific third parties acting as data processors based on a data processor agreement we work with include: 

  • Office 365: Based in the US, with University’s data stored within EU in datacenters located in Amsterdam and Dublin. Software as a Service which provides University’s email and document management
  • Survey Monkey: The surveys are administered through this platform. For more information see: https://www.surveymonkey.co.uk

 

In case there are other data processors involved in the data process (e.g. photographer, video maker as indicated above), we will provide you with information about them in due time. 

 

Third parties acting as separate data controllers we work with include:

  • Open Society Foundation (OSF) and Roma Initiative Office (RIO): OSF and RIO as donors of the RSP programs are entitled to control the use of the grant supporting the development of Romani youth. Personal data managed during the programs will be transferred to the donors when they conduct the grant evaluations and audits, and also in the form of financial reports. The legal basis for the data transfer is our obligation to perform the contract with the donors. 

 

We require all third parties and data processors to respect the security of your personal data and to treat it in accordance with the law and CEU’s data privacy policies, as determined in the respective Data Processing Agreements. 

 

6. How long will your information be held for the purposes set out in section 4?

 

After you withdraw your consent, object to data processing we will process your personal data for a maximum of 25 (twenty-five) days for technical reasons.In the absence of withdrawal or objection and after data processing periods mentioned above, we shall delete your personal data from our system, unless data processing has a further legal basis.

 

Where we have made the personal data public and are obliged pursuant to the GDPR to erase your personal data, we, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform the data controller which is processing the personal data that you have requested to be erased by such data controller of any links to, or copy or replication of, those personal data.

 

7. What are your rights?

 

You have a right

 

  • to access your personal information – you can obtain a confirmation that we are processing your data and information how we process it. We suggest that you make a request in writing. 
  • to object to the processing of your personal information – this allows you to ask us to stop processing your data at any time. Where we rely on legitimate interest, you must give specific reasons why you are objecting the processing of your data. In this case this is not an absolute right, we can demonstrate compelling legitimate grounds for processing, which override your interests, rights and freedoms. Where we are processing personal data for scientific or historical research, or statistical purposes, you only have a right to object if our lawful basis for processing is legitimate interest. 
  • to rectify – you have a right to have your personal information corrected if it is inaccurate and to have incomplete personal information completed
  • to erase (also known as the right to be forgotten) – in certain circumstances you can ask for the data we hold about you to be erased from our records. Your personal data will be erased where the data are no longer needed for their original processing purpose, or you have withdrawn your consent and there is no other legal ground for processing, or you have objected and there are no overriding legitimate grounds for the processing, or erasure is required to fulfill a statutory obligation under the EU law or the right of the national law. 
  • to request data portability – you can ask to have the data we hold about you transferred to another organization.
  • to restrict processing your personal information – where certain conditions apply, you have a right to restrict the processing of your personal information. 
  • to withdraw your consent at any time – without affecting the lawfulness of processing based on consent before its withdrawal.

 

If you wish to exercise any of these rights, please email privacy@ceu.edu or write to us at 1051 Budapest, Nádor u. 9. 

 

We will make every effort to fulfill your request to the extent allowed by law and will respond in writing within 25 days of receiving your request.

 

Should you wish to request help from the relevant national authority, the details are as follows:

 

National Authority for Data Protection and Freedom of Information 

Postal address: 1530 Budapest, Pf.: 5.

Address: 1125 Budapest, SzilágyiErzsébetfasor 22/c.)

Phone: +36 (1) 391-1400

Fax: +36 (1) 391-1410

E-mail: privacy@naih.hu

Web: http://naih.hu/general-information.html

 

In addition to the legal remedy, you have the right to apply to the court against the activities of the Joint Data Controller. 

 

8. Security of your Information 

 

We are committed to holding your data securely and treating it with sensitivity. All data are held securely and in accordance with the relevant data privacy laws and our internal policies. We do not sell to or trade your data with any other organizations. For further details please see our Data Protection Policy: https://documents.ceu.edu/documents/p-1805

 

Although most of the information we store and process stays within Austria and Hungary, some information may be transferred to countries outside the European Economic Area (EEA). This may occur if, for example, one of our trusted partners’ servers are located in a country outside the EEA (see above: data processors). Where these countries do not have similar data protection laws to the European Union, we will take steps to make sure they provide an adequate level of protection in accordance with EU data protection law.

 



[1]Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.