Data Privacy Notice

DATA PROCESSING NOTICE FOR PHOTO AND VIDEO RECORDING AT EVENTS

This notice aims to inform individuals participating in events organized by the Játékmesterek Egyesülete (hereinafter: Data Controller) about the processing of their personal data. By attending an event organized by the Data Controller or entering the event venue, you (hereinafter: Data Subject) explicitly consent to the processing of your personal data as outlined below.

The Data Controller fulfills its information obligation under the GDPR with this Data Processing Notice. The information obligation is regulated by Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, GDPR) concerning the protection of natural persons regarding the processing of personal data and the free movement of such data, and repealing Directive 95/46/EC.

As a data controller, the Data Controller processes the personal data of the data subject for the purposes specified in this notice and to the extent necessary for achieving these purposes. Regarding the data processing, the personal data of the Data Subject may be accessed by the Data Controller’s authorized employees. Only those employees responsible for organizing the events have the right to access personal data. The Data Controller does not make decisions based on automated data processing and does not perform profiling.

Name of the Data Controller: Játékmesterek Egyesülete
Registration Number of the Data Controller: 01-02-0017759
Registered Office (and mailing address) of the Data Controller: 1084 Budapest, Bérkocsis utca 25. I/4
Website of the Data Controller: https://jatszohazprojekt.hu
Representative of the Data Controller: Balázs Munkácsy
Person responsible for data protection: Balázs Munkácsy
Contact information of the person responsible for data protection: jatszohazprojekt@gmail.com

The Data Controller specifies the purposes and characteristics of individual data processing activities, the details of data transfers, and your rights in connection with these as follows:

I. Specific Data Processing Activities

Photography, Audio, and Video Recording

Employees of the Data Controller may take photographs, audio, and video recordings (hereinafter: Images) at Events, where the participants' likenesses and voices may appear.

In the case of press-public Events, members of the press may also take recordings, and such press organizations are considered independent data controllers. Their data processing activities are not covered by this notice. The resulting recordings may be published on the Data Controller’s websites and social media pages (Facebook, Instagram, TikTok, Twitter, LinkedIn), as well as in printed media, magazines, reports, and advertising spaces. The Data Controller processes certain personal data based on the provisions of Act V of 2013 on the Civil Code (hereinafter: Civil Code), specifically Section 2:48 (2), and also on the voluntary consent of the participants regarding the photography, audio, and video recordings.

Scope of Processed Personal Data: Likeness
Purpose of Data Processing: Broad presentation and promotion of the Data Controller’s activities; documentation and promotion of the event
Legal Basis for Data Processing: Your consent as per Article 6(1)(a) of the GDPR, and Section 2:48 (2) of the Civil Code
Data Processing Retention Period: 20 years
Automated Decision-Making, Profiling: -
Recipients of Data Transfers: -

By giving your consent, you acknowledge that the producer and owner of the photographs, audio, and video recordings is the Data Controller. The purpose of the Events is to widely present and promote the activities of the Data Controller.

By giving your consent, you further agree that the photographs, audio, and video recordings created may be made available to the public by the Data Controller, distributed without geographical and temporal limitations, and modified afterward. This consent extends to the products resulting from any subsequent editing.

By giving your consent, you agree to the Data Controller creating and publishing Images of you in connection with its activities in accordance with Article 6(1)(a) of the GDPR and Section 2:48 of the Civil Code. By giving your consent, you explicitly waive any claims for remuneration related to the use of your likeness, as well as any compensation or damages arising from the use of your likeness to the extent permitted by applicable law.

You may withdraw your consent at any time voluntarily, but withdrawing consent does not affect the lawfulness of the data processing carried out before the withdrawal.

In the case of a child under 16 years of age, the processing of the child's personal data is only lawful to the extent that the consent was given or authorized by the person exercising parental control over the child.

II. Circumstances of Data Processing

Data processing based on the Civil Code is grounded in statutory provisions according to Article 6(1)(e) of the GDPR. Section 2:48 (2) of the Civil Code stipulates that no consent is required for the creation and use of images or sound recordings in the case of crowd images and recordings made of public appearances in the public interest. In crowd images, a multitude of people can be seen, with the depicted persons not appearing as individuals but as part of the crowd. If the individuals do not attract attention separately, but as a crowd, it is a crowd image.

For recordings of specific individuals, their consent is required for creation and use. The same applies if individuals are singled out from the crowd using any recording technology (e.g., telephoto lens, zoom), as this re-individualizes the likeness, and consent is needed for both the creation and use of such images.

If individualization occurs through subsequent editing of a crowd image, consent is also required. Data processing based on consent – as per Article 6(1)(a) of the GDPR – relies on the voluntary consent of the data subject, which is given by attending the event or entering the event venue, with awareness of this notice and the Data Controller's Privacy Policy available on its online platforms.

If the Data Controller wishes to use a photograph, audio, or video recording of the data subject for a purpose different from that specified in this notice, the Data Subject will be informed, and their prior, explicit consent will be obtained, or the option to prohibit the use will be provided.

III. Your Rights as a Data Subject

As a data subject, you may at any time request detailed information about the processing of your personal data, access your personal data, request its rectification, and in cases defined by the GDPR, request its deletion or the restriction of processing, object to the processing of your personal data, and exercise your right to data portability.

You are also entitled to lodge a complaint with any supervisory authority if you believe that the Data Controller violates the GDPR during the processing of your personal data. You may exercise certain rights as follows:

(i) Right to Information and Access (Article 15 GDPR)

You have the right to obtain confirmation from the Data Controller as to whether your personal data is being processed and, if so, access the personal data and the following information:

The purposes of the processing;
The categories of personal data concerned;
The recipients or categories of recipients to whom the personal data has been or will be disclosed (including, in particular, processors and recipients in third countries);
The intended storage period for the personal data or the criteria used to determine that period;
Your rights regarding the processing of personal data;
The source of the data, if it was not collected directly from you;
Information on automated decision-making, if applicable;
The safeguards applied in the case of data transfers to a third country.

We provide you with information about your personal data free of charge as required by law. We will respond to your request in writing within one month. However, if the request is clearly unfounded or excessive (especially due to its repetitive nature), the Data Controller may charge a reasonable fee based on the administrative costs of providing the information or refuse to act on the request.

If you have already paid a fee, but the processing of your data was unlawful or the request results in the correction of your data, we will refund this fee.

If, despite our efforts to ensure the protection of your personal data through advanced security measures, unauthorized access, alteration, transmission, disclosure, deletion, or destruction occurs, or any other unauthorized processing happens, we will inform you of the circumstances of such an incident, including when it occurred, its possible effects, and what we have done to prevent or mitigate the consequences.

The Data Subject is also entitled to request information from the Data Controller via the contact details provided in this notice about whether their personal data is being processed. If so, they have the right to know:

What personal data;
On what legal basis;
For what purpose;
For how long it is processed by the Data Controller; and
To whom, when, on what legal basis, and which personal data were granted access or to whom the personal data was transferred;
The source of the personal data;
Whether the Data Controller applies automated decision-making, and the logic behind it, including profiling.

(ii) Right to Rectification (Article 16 GDPR)

If the personal data we process is inaccurate, we will correct it without undue delay at your request. You also have the right to request the completion of incomplete personal data via a statement.

(iii) Right to Erasure (Article 17 GDPR)

The Data Controller will delete your personal data without delay if:

The personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
The processing of the personal data is unlawful;
Deletion is necessary to comply with a legal obligation to which the Data Controller is subject;
If the personal data of a child under the age of 16 was processed in relation to the offer of information society services without the consent of the person exercising parental