At Közép-európai Egyetem (address: 1051 Budapest, Nádor u. 9.) hereinafter „University” or “CEU”) we place great emphasis on the protection of your personal information and compliance with the applicable data privacy requirements, including specifically the EU General Data Protection Regulation (GDPR*). This Privacy Notice relates to the collection, use, transfer, and retention of personal data related to sending regular newsletters and other, event related activities of the University.
*Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
1. Who are we and what do we do?
The Democracy Institute (DI) at the Central European University examines and seeks solutions to the challenges democracy faces across the globe today. It builds on the 30-year legacy of world-class research, teaching and outreach in the spirit of democracy and freedom achieved by Central European University, a private university that is transatlantic by nature — rooted in American and European traditions of higher learning.
The DI supports its researchers through contact with a variety of stakeholders, including CEU students, alumni, employers, partners, and supporters, as well researchers affiliated with partner institutions all over the world. We offer a range of academic and networking activities, events, and publications. We also author and share news about the DI and those affiliated with it.
2. Contact details of the Data Controller
1051 Budapest, Nádor u. 9., Hungary
+ 36 1 327-3000
3. Contact details of the Data Protection Officer
Data Protection Officer
1051 Budapest, Nádor u. 9.
Phone: + 36 1 327-3000
4. What is the purpose of processing your data?
- We process your personal data for (i) regularly sending newsletters about recent developments that occur in the field where we work on or invitations to our upcoming events, and (ii) improve the quality of our newsletter or the events organised by us.
- We might also deal with your registration for the event, online lecture, etc. organized by us.
- On some occasions we might take photos at the events that we either use for internal documentation or publishing on the social media (e.g. Facebook, Twitter, LinkedIn).
- On some occasions we might record events and publish the recorded video on social media (e.g. Facebook, YouTube).
- On some occasions we might broadcast events live on social media (e.g. Facebook, YouTube).
5. What is our legal basis for processing your data for the purposes set out in section 4?
The legal basis for data processing is the consent of the data subject (you) under Article 6 (1) (a) of the GDPR. You are not obliged to provide us your personal data, and failure to provide data, it has no adverse legal consequences for you. You are entitled to withdraw your consent at any time.
ad 4.2. - 4.5.
The legal basis for these data processing activities is the legitimate interest of the data controller (us) under Article 6 (1) (f) of the GDPR. In these cases you have the right to object to the processing if you do not agree with our use of the data. Regarding the invited speaker, the legal basis for data processing is the consent of the invited speaker under Article 6 (1) (a) of the GDPR. The speaker is not obliged to provide us his/her personal data, and failure to provide data, has no adverse legal consequences for the speaker. Speakers are entitled to withdraw their consent at any time.
6. What kind of personal data do we collect?
For the purpose of data processing activities specified in section 4 we process the following personal data:
- contact details (name, e-mail address) and some data concerning your country, organization;
- registration to the event, date and type of the event,
7. Whom do we share your personal data with?
Your personal data is only used by colleagues working within the Democracy Institute.
We will not disclose your data to third parties unless we have a legal obligation or you consent explicitly to do so.
For the proper performance of the activities set out in section 4, we may need to pass your information to our third-party service provider(s) acting as data processors, as follows:
- Microsoft Office 365: email and document management SaaS services; the University’s data stored within the EU (Amsterdam and Dublin).
- Mailchimp: email marketing service; DI’s data stored in the U.S.
- Eventbrite: event booking and registration platform, based in the U.S.
8. How long will your information be held for the purposes set out in section 4?
We process your name and e-mail address until your consent is withdrawn or we find your data inaccurate (e.g. not in use, wrong or otherwise not serving our purpose).
Your name and e-mail address provided for the registration will be deleted 5 days after the event, online lecture.
ad 4.3. – 4.5.
We store the valuable photos in our archive for 10 years. We normally keep the photos, videos and recordings of the events on our website https://democracyinstitute.ceu.edu, and on our social media platforms (Facebook, Twitter, LinkedIn, YouTube) for 3 years after the publication year.
After the period specified above, we will delete your personal data from our system. If you withdraw your consent, we will process your personal data for a maximum of 5 (five) working days for technical reasons. After this period, we delete your personal data from our system.
Where we have made the personal data public (posted it on the website https://democracyinstitute.ceu.edu or on social media) and are obliged pursuant to the GDPR to erase your personal data, we, taking account of available technology and the cost of implementation, will take reasonable steps to have your data deleted and we will also inform controllers which are processing the personal data that you have requested to be erased to do the same.
9. What are your rights?
You have a right
- to access your personal data,
- to object to the processing of your personal data,
- to rectify,
- to erase and
- to restrict processing your personal data
- to withdraw your consent at any time
- to an effective legal remedy.
If you wish to exercise any of these rights, please email to firstname.lastname@example.org or write to us at University Data Protection Officer, Nádor utca 9, 1051 Budapest, Hungary. The University will make every effort to fulfill your request to the extent allowed by law and will respond in writing within 25 days of receiving your request.
Should you wish to request help from the relevant national authority, their details are as follows:
In addition to the legal remedy, you have the right to apply to the court against the activities of data controller. In Hungary, at the data subject’s request, the action may be brought before the court that is competent based on the domicile or the place of residence of the data subject.
10. Security of your information
We are committed to holding your data securely and treating it with sensitivity. All data are held securely and in accordance with the relevant data privacy laws and our internal policies. We do not sell to or trade your data with any other organizations.