Regarding the data processing by Semmelweis University's Department of Biostatistics and Network Science related to the Biomedical Data Science Summer School and Conference (July 28 - August 8, 2025).

Pursuant to Sections 16 and 17 of Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (hereinafter: Info Act), as well as Article 12(1) and Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: GDPR), the data controller hereby informs the data subjects about the aforementioned data processing as follows:   

1. DATA CONTROLLER'S DETAILS

1.1. Name and contact details of the data controller:

Semmelweis University, Registered office: 1085 Budapest, Üllői út 26. Postal address: 1428 Budapest Pf.: 2. Telephone: +36-1-459-1500 Website: https://semmelweis.hu/english/

1.2. Name and contact details of the head of the data controller:

Prof. Dr. Béla Merkely, Rector, Registered office: Semmelweis University 1085 Budapest, Üllői út 26. Postal address: 1428 Budapest Pf.: 2. Telephone: +36-1-459-1500 Website: https://semmelweis.hu/english/

1.3. Details of the organizational unit directly performing the data processing:

Department of Biostatistics and Network Science Head: Dr. Roland Molontay, Director Registered office: 1085 Budapest, Baross utca 22. 2nd floor BC22 office building E-mail: biostat@semmelweis.hu

1.4. Name and contact details of the Data Protection Officer:

Dr. Sára Trócsányi, Registered office: 1085 Budapest, Üllői út 26. Postal address: 1428 Budapest Pf.: 2. Telephone: +36-1/224-1547 https://semmelweis.hu/jogigfoig/adatvedelem-betegjog/ E-mail: adatvedelem@semmelweis.hu

https://semmelweis.hu/english/data-protection/

3. PURPOSE OF THE DATA PROCESSING:

3.1. Maintaining contact related to the event

3.2. Providing services at the event

3.3. Marketing of the event

3.4. Invoicing for services provided at the event

4. CATEGORIES OF DATA PROCESSED AND LEGAL BASIS FOR THEIR PROCESSING:

4.1. Data necessary for contact: 

Legitimate interest: based on Article 6(1)(f) of the GDPR, data processed: email address, title, surname, first name, Primary affiliation (department/institute and university/institution), Additional affiliation (if any) (department/institute and university/institution), Telephone/mobile number

4.2. Data necessary for service provision: 

Necessary for the performance of a contract based on Article 6(1)(b) of the GDPR, data processed: registered event and additional information (e.g., special dietary needs)

4.3. Data necessary for marketing: 

Legitimate interest: based on Article 6(1)(f) of the GDPR, data processed: curriculum vitae (CV), source of information about the event, creation and publication of photographic and video material taken at the event (on the data controller's media platforms)

4.4. Data necessary for invoicing: 

Compliance with a legal obligation based on Act CXXVII of 2007 on Value Added Tax: based on Article 6(1)(f) [Note: Legal obligation is typically Article 6(1)(c) of GDPR, but the original text states (f)] of the GDPR, data processed: full name, nationality, e-mail address, full address: country, city, street name, house number, postal code

5. CATEGORIES OF PERSONAL DATA (AND SPECIAL CATEGORIES OF PERSONAL DATA, IF ANY) PROCESSED:

None.

6. SCOPE OF DATA SUBJECTS CONCERNED:

Natural persons applying for the event.

7. GENERAL PROCESSING PERIOD FOR THE DATA HANDLED:

From the opening of applications on March 4, 2025, until the conclusion of the event on August 8, 2025.

8. DATA RETENTION PERIOD:

For 5 years from the end of the event, to verify lawful processing, and invoicing data for 8 years to demonstrate compliance with accounting regulations.

9. NAME AND ADDRESS OF THE DATA PROCESSOR: 

https://policies.google.com/?hl=en-US The data processor performs data storage and transmission via Google Forms.

10. LEGAL BASIS FOR DATA TRANSFER, IF DATA IS TRANSFERRED TO A THIRD COUNTRY OR INTERNATIONAL ORGANIZATION:

Data is transferred via Google Forms to the United States. https://policies.google.com/?hl=en-US

11. INFORMATION FOR DATA SUBJECTS ON THEIR FUNDAMENTAL RIGHTS

11.1. Right to Information

Data subjects have the right to information provided in a concise, transparent, intelligible, and easily accessible form. Upon the data subject's request in writing or by other suitable means, following verification of the data subject's identity, the Data Controller shall comply without undue delay, but within 1 month at the latest. The Data Controller provides such information free of charge, except where the request is manifestly unfounded, excessive, or repetitive.

11.2. Right of Access by the Data Subject

The data subject is entitled to obtain access to their personal data and the following information: A copy of the personal data (further copies may be subject to a fee).

11.3. Right to Rectification

The data subject is entitled to have inaccurate personal data concerning them rectified without undue delay, and to have incomplete personal data completed.

11.4. Right to Erasure ('Right to be Forgotten')

Upon the data subject's request, the Data Controller is obliged to erase personal data concerning the data subject without undue delay where one of the following grounds applies:   

• The purpose has ceased or become redundant, the data is no longer necessary

• The data subject withdraws consent, thus, the legal basis for processing ceases

• The data subject objects to the processing

• Unlawful data processing

For compliance with a legal obligation. Within the scope of the data subject's right to be forgotten, if the Data Controller has made the personal data public and is obliged to erase it – taking account of available technology and the cost of implementation – it shall take reasonable steps to inform other controllers processing the personal data to erase any links to, or copy or replication of, those personal data. An exception to the exercise of the data subject's right under points 3 and 4 applies if the processing is necessary. Processing is necessary if it is essential for one of the following cases:

• For exercising the right of freedom of expression

• For compliance with a legal obligation or the exercise of official authority

• For reasons of public interest in the area of public health

• For archiving purposes in the public interest, scientific or historical research purposes   

• For the establishment, exercise, or defence of legal claims.   

11.5. Right to Restriction of Processing

The Data Controller shall restrict processing upon the data subject's request if:

• The accuracy of the personal data is contested by the data subject

• The processing is unlawful, and the data subject opposes the erasure of the data   

• The Data Controller no longer needs the personal data, but they are required by the data subject for the establishment, exercise, or defence of legal claims   

• The data subject has objected to processing, pending verification by the data controller.   

12. LEGAL REMEDIES

12.1. Right to lodge a complaint with a supervisory authority

Supervisory authority: National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság), 1055 Budapest, Falk Miksa utca 9-11., website: www.naih.hu   

12.2. Right to an effective judicial remedy against a controller or processor

Without prejudice to any administrative or other remedies, the data subject may institute legal proceedings against the data controller and the data processor before the court competent according to the place of activity of the data controller/processor. The action may also be brought before the courts of the Member State where the data subject has their habitual residence.