This notice provides information about how your personal data shared with the specialist is processed during consultations held within the framework of Bástya Terápiás Műhely (Bástya), about the organisational and technical measures taken to protect your data, and about your remedies and rights.

During consultation or therapy – in accordance with the professional and ethical rules governing the consultation or therapeutic process, as well as applicable law – providing personal data is always voluntary. The only exception to this voluntariness concerns the data required for invoicing (name and place of residence or stay), because the processing of this data in connection with invoicing is required by law.

 

The data controller

Within the Bástya organisation, personal data is processed exclusively by the specialist concerned, who is the so-called data controller. The rights listed below, which you may exercise (the so-called data subject rights), can be exercised with, and requested from, that data controller.

 

Scope of data processed

In connection with invoicing:

  • name
  • place of residence or stay.

In connection with consent to data processing:

  • place and date of birth
  • mother's name

In connection with the consultation, all data and information that you, as a client, share with the specialist providing the consultation or therapy.

 

Legal basis for the data processing

The legal basis for the processing of personal data is, in every case, your consent. You give your consent by signing the data processing consent form, or, in electronic form, by ticking the appropriate box on the online platform.

 

Purpose of the data processing

The data controller uses personal data exclusively to carry out the consultation; it does not share this data with any other person, nor does it transfer or disclose it.

During case discussions, consultations between specialists and supervision sessions held within Bástya, the specialist does not disclose personal data to others; professional discussion relating to clients takes place anonymously.

 

Duration of the data processing

The specialist processes personal data until consent is withdrawn.

 

Persons with access to the data, data processor, and data storage

Only the specialist or specialists you have consulted have access to your personal data.

The specialist records the data technically either on paper or in electronic form. Paper records are stored in a lockable cabinet on Bástya's premises; electronic records are stored on the specialist's computer and on Google's servers. The specialist uses Google as a data processor. The exact name of the data processor is: Google Ireland Limited, registered office: Gordon House, Barrow Street, Dublin 4, Ireland. You can read Google's privacy notice here: https://policies.google.com/privacy?hl=hu.

 

Rights relating to the processing of personal data (data subject rights)

1. Access

You may find out at any time whether the data controller is processing your personal data, and if so, you may access the personal data processed by the data controller, and receive information about the data processed, the purpose, legal basis and duration of the processing, the name and address (registered office) of the data processor, and the activities related to the data processing, as well as who has received or will receive your data and for what purpose.

2. Rectification and erasure

You may request the modification and erasure of your personal data (or part of it). Rectification is possible if the data is inaccurate. Erasure is possible if you withdraw the consent that forms the legal basis for the data processing, and there is no other legal basis for the processing (for example, if the law does not require the processing). The data controller will respond to a data erasure request sent by email as soon as possible after receiving it, but no later than within 21 days.

3. Objection

You may object to the processing of your personal data, and, in this context, you may also request the rectification and erasure of your personal data.

4. Data portability

You may request that the personal data you have provided to the data controllers be made available to you in a widely used, machine-readable (electronic) format.

 

How can you exercise the data subject rights listed above?

Please send any requests relating to the exercise of your rights in connection with data processing to the data controller, at the email address indicated in point 1. To exercise the right of access to personal data and the right of rectification, you will need to verify your identity, so that the data controller can be sure that it is providing the data to you.

 

Data security measures

In order to prevent unauthorised use of the personal data processed, and any related misuse, Bástya, which provides the framework for the data controller's activities, applies extensive technical and operational security measures. Bástya's security procedures are regularly reviewed and developed in line with technological progress. The data controller makes every effort to ensure that your personal data is protected with the highest possible level of security.

 

Enforcement of rights

If you feel that we have infringed your rights relating to the protection of personal data, please contact us so that we can remedy any potential harm.

You may also enforce your claim before a civil court, or request the assistance of the data protection authority. Detailed legal provisions relating to this, and to the obligations of the data controller, are contained in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, and in Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (Hungary).

The data controller processes your personal data exclusively in accordance with this notice and the applicable data protection legislation. If you nevertheless wish to lodge a complaint regarding the processing of your personal data, or are otherwise dissatisfied with how we handle your data, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH). NAIH's contact details: ugyfelszolgalat@naih.hu, 1363 Budapest, P.O. Box 9, Hungary, phone: +36 (1) 391 1400, fax: +36 (1) 391-1410.

If you choose to pursue the matter in court, please note that data protection lawsuits fall within the jurisdiction of the regional court (törvényszék). The lawsuit may also be brought before the regional court of your place of residence or stay.

If you have any further questions regarding the protection of personal data, please send them to the data controller's email address indicated above.