Privacy Policy

PRIVACY NOTICE

ON THE RIGHTS OF NATURAL PERSONS

IN RELATION TO THE PROCESSING OF THEIR PERSONAL DATA

Introduction

Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “GDPR” or “Regulation”), requires the Controller to provide information about personal-data processing in a concise, transparent, intelligible and easily accessible form, using clear and plain language, and to facilitate the exercise of data-subject rights.

Hungary’s Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information also requires data subjects to be informed in advance. This notice fulfils those information obligations.

Why was this notice prepared? The Controller processes personal data for several purposes. It does so while respecting data-subject rights and complying with applicable legal obligations, and explains the main characteristics of its processing activities here.

On what basis is personal data processed? Personal data is processed only for specified purposes and on an appropriate legal basis. The purposes and legal bases are described for each processing activity below.

Who helps process personal data? The Controller generally processes data itself, but uses external processors for certain operations. The processors may vary depending on the processing activity.

Who processes your personal data? Chapter II identifies the Controller’s processors and other recipients.

What principles does the Controller follow? Processing is carried out in accordance with applicable law, in particular the GDPR. Only data specified for each processing activity is processed. Appropriate technical and organisational measures protect the confidentiality, integrity and availability of personal data. The Controller is responsible for the accuracy of data after it has been provided by the data subject. Terms used in this notice have the meanings assigned to them by the GDPR and applicable Hungarian law.

Chapter I. The Controller

The issuer of this notice and the data controller is:

• Name: Szabó Tamás E.V.
• Registered office: 6724 Szeged, Klapka tér 6., Hungary
• Registration number: 56945818
• Tax number: 55219923-1-26
• Statistical code: 55219923631023106
• Represented by: Szabó Tamás
• Email: tamas.szabo1027@gmail.com
• Telephone: +36 (30) 948 0749
• Website: http://borderwatcher.hu

(hereinafter the “Controller”)

Chapter II. Data processors and recipients

A processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the Controller (GDPR Article 4(8)). The data subject’s prior consent is not required to use a processor, but the data subject must be informed. The Controller uses the following processors and recipients:

• Hosting and related services: Google LLC, 1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA. Listed under the EU–US Data Privacy Framework (DPF).
• Payment processing: Google LLC (Google Pay), 1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA; and Apple Inc. (Apple Pay), One Apple Park Way, Cupertino, CA 95014, USA. For EEA users: Hollyhill Industrial Estate, Hollyhill, Cork, Ireland.
• Online advertising: Google LLC (AdMob), 1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA. Listed under the DPF.
• Other recipients: Google LLC, google.com, and Meta Platforms, Inc., 1601 Willow Rd, Menlo Park, CA 94025, USA, facebook.com and instagram.com. Listed under the DPF.

Where this notice generally describes transfers to the Controller’s processors, those descriptions also apply to transfers to the recipients listed above.

Chapter III. Lawfulness of processing

1. Consent

1. 1.1. If the Controller intends to process data on the basis of consent, it requests consent using a data-request form and provides the information specified in its data-processing rules.
2. 1.2. Consent may also be given by selecting a checkbox on the Controller’s website, changing technical settings when using information-society services, or making another clear statement or taking another clear action that indicates agreement to the proposed processing. Silence, pre-ticked boxes and inaction do not constitute consent.
3. 1.3. Consent covers all processing activities carried out for the same purpose or purposes. If processing has several purposes, consent must be given for all of them.
4. 1.4. If consent is included in a written statement that also concerns other matters, such as a sales or service contract, the consent request must be clearly distinguishable, easy to access and written in clear, plain language. Any part of such a statement that breaches the GDPR is not binding.
5. 1.5. The Controller may not make entering into or performing a contract conditional on consent to processing that is not necessary for that contract.
6. 1.6. Withdrawal must be as easy as giving consent. Consent may be withdrawn at any time by emailing borderwatcherapplication@gmail.com.
7. 1.7. After consent is withdrawn, the Controller must stop processing on that basis and ensure erasure, unless another legal basis permits continued processing, for example a retention obligation or the need to perform a contract. If processing has several purposes, the data may no longer be used for the purpose for which consent was withdrawn.

2. Legal obligation

1. 2.1. Where processing is based on a legal obligation, the relevant legislation governs the data that may be processed, the purpose, retention period and recipients.
2. 2.2. Processing required by law does not depend on the data subject’s consent. Before it begins, the data subject is informed that processing is mandatory and is given clear and detailed information about the purpose and legal basis, the Controller and processors, the retention period, who may access the data, the data subject’s rights and available remedies. The information may also be given by publishing a reference to the relevant legislation.

3. Legitimate interests

1. 3.1. The legitimate interests of the Controller or a third party may provide a legal basis if they are not overridden by the data subject’s interests or fundamental rights and freedoms. The Controller takes account of the data subject’s reasonable expectations arising from their relationship with the Controller. Processing for contact purposes, including direct marketing, may also be based on legitimate interests.
2. 3.2. Processing based on legitimate interests requires a balancing test. The Controller considers the current circumstances and the positions of both parties. Its tests conclude that processing is justified with the safeguards in this notice because, without it, the Controller could not operate competitively; the resulting impact on data subjects and their privacy is proportionate.

4. Vital interests

4.1. Processing may be necessary to protect the vital interests of the data subject or another natural person. The right to data protection is fundamental but not absolute; in a life-or-death situation, the right to life takes precedence.

5. Processing necessary for a contract

5.1. Processing may be necessary to perform a contract to which the data subject is a party or to take steps at the data subject’s request before entering into a contract.

6. Facilitating the exercise of rights

6.1. The Controller facilitates the exercise of data-subject rights in all its processing activities.

Chapter IV. Processing activities

1. Individual customers and other natural persons contracting with the Controller

Purpose and legal basis: preparing, entering into, performing and ending a contract, providing contractual discounts and supporting related business processes. Processing is necessary for the contract or for steps requested before entering into it (GDPR Article 6(1)(b)).

Data: name, birth name and date, mother’s name, address, tax identification number and tax number, registration number, registered-office or place-of-business address, telephone number, email address, website, bank-account number, customer/order number and online identifier, as applicable.

Retention: five years after the contract ends. Recipients: Controller personnel involved in preparing, performing and storing the contract; customer-service and sales staff; processors; and authorities authorised by law. Data may be provided to the Hungarian Post or a courier for delivery, security providers for property protection, and other processors where necessary. The Controller also informs parties to offers that personal data included in an offer may be processed on the same contractual basis.

2. Invoicing and retention of accounting records

Purpose: issuing invoices under Act CXXVII of 2007 on Value Added Tax and complying with accounting-record retention obligations. Data subjects: natural persons contracting with the Controller and representatives of contracting parties. Data: an individual’s name and address; a sole trader’s name, registered office and tax number; and a legal entity’s tax number. Legal basis: compliance with a legal obligation (GDPR Article 6(1)(c)). Data may be accessed by accounting and tax personnel and processors and by the National Tax and Customs Administration. Retention: eight years after the invoice is issued, under Section 169(2) of Act C of 2000 on Accounting.

3. Processing the personal data of a natural person signing on behalf of a contracting legal entity

Purpose: entering into a contract; exercising the rights and performing the obligations in it; pursuing civil-law claims that may arise during performance; and recording and fulfilling the Controller’s commitments. Data subjects: natural persons who sign the contract. Data: the signatory’s name, position or job title, email address, telephone number, mailing address and signature specimen.

Legal basis: the Controller’s legitimate interests under GDPR Article 6(1)(f). The Controller considers that its interest in documenting and performing the contract does not override the data subject’s interests or fundamental rights and freedoms. Receiving and documenting goods or services benefits both the Controller and the contracting party, helps the Controller perform its obligations correctly and avoid disputes, and supports a satisfactory business relationship. Processing is necessary because, without representative contact details, a legal entity and the Controller could not readily communicate or perform the contract. The Controller processes only data needed for legitimate business purposes or contact with external organisations. The data are not special-category data; access is restricted to employees who need it, and firewall and anti-virus protections are used. A representative may request deletion or object where applicable. The signature specimen is processed as necessary to comply with the Controller’s legal obligation under GDPR Article 6(1)(c) and Section 3:116(1) of Act V of 2013 on the Civil Code.

Recipients: personnel involved in preparing, performing and storing the contract, including the Controller’s executive, customer-service staff and contacts, sales staff, and authorities authorised by law. Retention: five years after the contract ends.

4. Processing the personal data of non-signatory natural persons named as contacts in contracts or the Controller’s records

Purpose: communicating about performance of a contract or document, facilitating performance and maintaining the contractual relationship. Data subjects: natural persons identified as contacts who do not sign the contract. Data: the contact’s name, position or job title, email address, telephone number and mailing address.

Legal basis: the Controller’s legitimate interests under GDPR Article 6(1)(f). The Controller’s legitimate interest is to communicate with contractual partners and facilitate performance, and to retain contact details of potential business partners or external organisations for future official contact or possible contracts in connection with its activities and business-development purposes. Processing is necessary because without contact details communication with partners and performance of contracts would be significantly more difficult. Only data necessary for those business-contact purposes is processed. The data are not special-category data; the Controller restricts access to employees who need it, applies firewall and anti-virus protection and provides the contact with the right to request deletion or object where applicable.

Recipients: personnel involved in preparing, performing and storing the contract, including the Controller’s executive, customer-service staff and contacts, sales staff, and authorities authorised by law.

5. Registration in the BorderWatcher Android and iOS applications

When registering for the service, a user may consent to processing by selecting the relevant checkbox; the checkbox must not be pre-selected. Purpose: providing access to the service. Data: the username, profile picture and email address associated with the user’s Google, Apple or Facebook account. Legal basis: consent (GDPR Article 6(1)(a)), which may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing before withdrawal; a deletion request should include the user’s name and email address so the account can be identified. Consent is required to provide the service, so refusing or withdrawing it makes the service unavailable. Data may be accessed by personnel operating the application and customer-service or marketing functions, and by hosting, IT, marketing and communications processors as necessary. Retention: until consent is withdrawn, the profile is deleted or a deletion request is received.

6. Use of the BorderWatcher application

The application lets users report current border-crossing conditions to help other travellers. A report may include a predefined waiting time, the number of cars, GPS coordinates at the end of a queue, the user’s current GPS position, text, photographs or videos. Users may also rate crossings; the rating may show the user’s name and profile picture. Each crossing may have a chat room where users can send text messages, questions and replies with their profile name and picture.

Purpose: providing the service. Data: the user’s name and profile picture and their reports, posts, photographs, videos and chat messages. Users may enable anonymous mode so their name and profile picture are not displayed with reports. Legal basis: the user’s explicit consent (GDPR Article 6(1)(a)); consent may be withdrawn at any time without affecting prior lawful processing. A deletion request should include the user’s name and email address for identification. Data may be accessed by application-operating personnel, customer-service and marketing staff, and hosting, IT, marketing and communications processors where required to provide the service. Retention: uploaded photographs, videos and GPS data are automatically deleted no later than 24 hours after upload; chat messages are retained for seven days.

7. Online advertising

Purpose: displaying, serving and measuring advertisements in the free application and online, analysing their performance, supporting the application’s operating costs and, where permitted, displaying more relevant advertisements. Data: depending on the advertising service and the user’s privacy settings, device technical data, IP address, advertising or other online identifiers, application and website usage, ad impressions and interactions, ad-performance data, and approximate location where supported. Legal basis: explicit consent (GDPR Article 6(1)(a)); it may be withdrawn or advertising/privacy preferences changed at any time. Withdrawal does not affect prior lawful processing. If the user does not consent to personalised advertising, only an appropriately configured advertising option that does not use the user’s personal data may be used, and non-personalised ads may be shown. Users may purchase BorderWatcher Plus for a one-time fee to use an ad-free interface; purchasing Plus is not required to refuse or withdraw advertising consent. Advertising and technology providers and personnel who need access to perform their duties may receive the data. Retention: depends on the service, data type, privacy settings and applicable provider or legal retention rules, and lasts no longer than until consent is withdrawn, the profile is deleted or a deletion request is received.

8. User activity analysis and rankings

Purpose: statistical analysis of use, improving the application and user experience, operating community features, encouraging participation, and displaying rankings, results and activity metrics to users. Rankings may be based on activity criteria, performance indicators or other usage metrics. Data: profile information, application usage, actions and activity, frequency, volume and timing of activity, data used to calculate rankings, rank position and other in-app interactions. Only data needed for these purposes is processed. Depending on application features and settings, ranking information may be visible to other users.

Legal basis: the Controller’s legitimate interest (GDPR Article 6(1)(f)) in operating and improving the application, understanding usage, and providing ranking and community features. The Controller limits the data to what is necessary, does not use it for unrelated purposes and restricts access to personnel and IT, hosting, operational and technology processors who need it. Retention: while the user profile exists. When an account is closed or the user objects, data is deleted or anonymised unless further processing is required on another legal basis. Previously created anonymised and aggregated statistics may continue to be used to analyse and improve the application.

9. Facebook and Instagram

The Controller has limited influence over the processing carried out by social-media platform operators and generally does not receive personal data from Facebook. Facebook’s privacy information is at facebook.com/privacy/explanation; Instagram’s is at help.instagram.com/519522125107875.

The Controller operates a Facebook page. Users may follow it or its posts by selecting “Like” or “Follow”; logging in to contact the Controller through Facebook is subject to Facebook’s own processing. The Controller processes followers’ data based on their voluntary interaction with the page, including following, liking or commenting. Users requesting services through the page represent that they are at least 16 years old. Under GDPR Article 8(1), a child under 16 requires permission from a legal representative to give valid consent. The Controller cannot verify age or authority, and users are responsible for the accuracy of the data they provide.

Purpose: sharing current information and news, advertising on social media, presenting and promoting services, and enabling interested users to contact the Controller. Data and data subjects: the name of the data subject and social-media platform users. Legal basis: the data subject’s voluntary consent, in accordance with Facebook’s and Instagram’s privacy terms. Users can stop following the Controller’s Facebook page by selecting “Unlike” or “Unfollow”, or remove unwanted content through the page settings. Retention: while the service is active. Recipients: employees responsible for customer service and marketing and the Controller’s processors, particularly its IT service provider.

10. Tax and accounting obligations

The Controller processes data required by law to meet tax and accounting obligations, including bookkeeping and taxation. Depending on the applicable law, this may include a tax number, name, address, tax status, details identifying the person or organisation ordering a transaction, and the signatures required on accounting or payment documents, as well as a personal tax identification number. Retention: eight years after the legal relationship giving rise to the obligation ends. Access is limited to tax, accounting, payroll and social-security personnel and processors.

11. Payer obligations

To meet statutory tax and contribution obligations, including tax and advance-tax calculations, payroll, social-security and pension administration, the Controller processes data about employees, their family members, contractors and other benefit recipients with whom it has a payer relationship. Data may include natural-person identification details, former name and title, sex, citizenship, tax identification number and social-security number (TAJ). Where tax law provides for the relevant consequences, health or trade-union membership data may also be processed for payroll and social-security purposes. Retention: eight years after the underlying legal relationship ends. Access is limited to tax, payroll and social-security personnel and processors.

12. Records of enduring value under archival law

The Controller retains records classified as having enduring value under Act LXVI of 1995 on Public Records, Public Archives and the Protection of Private Archives, so that enduring records remain intact and usable for future generations. Retention: until transfer to the public archives. Recipients are the Controller, staff responsible for records management and archiving, and public-archive staff.

Chapter V. Website visitors and cookies

1. Use of cookies

Website visitors are informed about cookies and, except for technically essential session cookies, asked for consent before cookies are used. A cookie is a small text file stored on a computer or mobile device for a period set by the cookie and may be read again on a later visit. Cookies can remember settings and usage information, support a user-friendly website and improve the online experience. Visitors who do not agree to non-essential cookies may reject them or stop using the relevant features.

Purposes: making navigation easier by remembering settings and usage preferences; improving the user experience by understanding which pages are used most often; compiling statistics to understand use of the website and other online services and improve them; adapting the website to visitors’ needs; and identifying potentially malicious IT activity.

Legal basis: the Controller’s legitimate interest under GDPR Article 6(1)(f) for cookies essential to the secure and correct operation of the website. Visitors may object to processing based on legitimate interests; the Controller will assess the objection and decide whether processing should continue, be restricted or stop. Other cookies are used on the basis of the visitor’s consent under GDPR Article 6(1)(a). Consent may be withdrawn at any time without affecting the lawfulness of prior processing. A deletion request should identify the data subject by name and email address.

Data and retention: cookie-related browsing and website-usage information is processed for the purposes above. Some cookies last only for a session; others remain for a specified longer period. Visitors can delete stored cookies at any time in their browser settings.

2. Cookie details

A cookie is data sent by a website to a visitor’s browser, generally as a name-value pair, so that the browser can store it and return it to the same website later. It may expire when the browser closes or remain for a defined period. Browsers send applicable cookies with subsequent HTTP(S) requests. Cookies can identify a session or remember a user, but third-party content may also use them to track activity and create a profile; in that case, cookie information may constitute personal data.

• Technically essential session cookies: required for the site to function, such as identifying a session and remembering actions during a visit. Session values must be generated securely to reduce the risk of session hijacking. These cookies are normally deleted when the browser is closed. Their legal basis is Section 13/A(3) of Hungarian Act CVIII of 2001 on Electronic Commerce and Information Society Services: only data technically essential to providing the service may be processed, and only to the necessary extent and for the necessary period.
• Preference cookies: remember choices such as how the visitor wants the website displayed. Their legal basis is the visitor’s consent; their purpose is to improve service efficiency, user experience and ease of use. These settings are generally stored on the visitor’s device and may allow the website to recognise the visitor.
• Performance cookies: collect information about behaviour on the website, time spent and clicks to support improvements. Their legal basis is the visitor’s consent. Information about Google Analytics cookies is available at Google Analytics cookie usage. Information about Google Ads cookies is available at Google Ads.
• Marketing cookies: Google AdWords, AdMob and Facebook advertising services may use cookies to collect information about online activity and display personalised advertisements on other websites. These cookies must be enabled by the visitor and are based on consent. Google advertising settings are available at myaccount.google.com/privacy. Further information: Google Ads and Google AdMob. The cookies do not send personal data to the advertising provider unless the visitor provides personal data while using the website; they can help show advertisements for the Controller’s products and services on Google or Facebook websites.

Accepting or enabling cookies is not mandatory. Most browsers accept cookies by default, but settings can be changed to reject all cookies or notify the user when a cookie is sent. Browser instructions include Chrome, Firefox, Microsoft Edge, Internet Explorer and Safari. Some website functions may not work correctly without cookies. The rules above also apply to cookies used by the application, subject to technical differences.

3. Website visit data

During a visit, the website may process the visitor’s IP address, browser type, device operating-system characteristics (including language), visit time, pages or functions visited, and clicks. These data are retained for no more than 90 days and may be used primarily to investigate security incidents.

Chapter VI. Data-subject rights

You may ask the Controller for: information about processing before it begins and while it is ongoing; access to your personal data and a copy of it; rectification or completion; erasure or restriction of processing, except where processing is mandatory; data portability; and the right to object. You also have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects you, and the right to seek a remedy. Submit a written request as described in Chapter VII. The Controller will fulfil a lawful request within no more than 30 days and notify you at the contact address you provide.

Right to information

You may submit a written request asking: which personal data is processed; on what legal basis and for what purpose; from what source and for how long; whether a processor is used and, if so, its name, address and processing activities; to whom, when and under what legal provision the Controller gave access to your personal data or transferred it; and the circumstances and effects of any personal-data breach and the measures taken to address it. This notice and its publication provide the information owed to you before processing and during processing.

Right of access

Under GDPR Article 15, you may obtain confirmation as to whether your personal data is being processed and, if so, access to that data by making a written request as described in Chapter VII. The Controller will provide a copy of the personal data being processed unless this is prevented by another legal requirement. If the request is made electronically, information will be provided in a commonly used electronic format unless you ask otherwise.

Right to rectification and completion

You may ask the Controller to correct inaccurate personal data and, taking account of the purposes of processing, to complete incomplete data.

Right to erasure

Under GDPR Article 17, you may request erasure, in particular where processing is based on your voluntary consent, for example consent to process your telephone number or email address. In such a case, your personal data will be erased. Consent may be withdrawn at any time; withdrawal does not affect the lawfulness of processing before withdrawal. Include your name and email address in a deletion request so the Controller can identify you. Erasure may be restricted where processing is mandatory or another legal basis applies.

Right to restriction

You may ask the Controller to restrict processing, with the data marked and stored separately, where the circumstances give you a right to restriction. For example, data may be retained rather than erased while a complaint or court case about allegedly unlawful processing is pending. The Controller will retain the data only as long as the reason for restriction requires and will erase it when that reason ends, unless another legal basis applies.

Right to data portability

Where processing is automated and based on consent (GDPR Article 6(1)(a) or Article 9(2)(a)) or a contract (Article 6(1)(b)), you may receive the personal data you provided in a structured, commonly used, machine-readable format and transmit it to another controller without hindrance from the Controller.

Right to object

You may object in writing, on grounds relating to your particular situation, to processing based on the Controller’s or a third party’s legitimate interests, including profiling based on that legal basis. The Controller will stop processing unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.

Automated decisions and profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you. This right does not apply where the decision is necessary to enter into or perform a contract, is authorised by applicable EU or Member State law that provides appropriate safeguards, or is based on your explicit consent. Where a decision is based on a contract or explicit consent, the Controller will provide safeguards that include the right to obtain human intervention, express your point of view and contest the decision.

Chapter VII. Exercising rights and remedies

Contacting the Controller

Please contact the Controller before starting court or authority proceedings so the matter can be investigated and, where appropriate, resolved. The Controller will handle requests, objections and complaints without undue delay and within the applicable legal time limit. If a request is complex or numerous requests have been received, the time limit may be extended as permitted by law. Where a request was made electronically, the response will normally be provided electronically unless you ask otherwise. If the Controller does not act, it will explain why and inform you of your right to lodge a complaint or seek a judicial remedy.

Requests and questions about personal data may be sent by post or email:

Szabó Tamás E.V.
Registered office: 6724 Szeged, Klapka tér 6., Hungary
Telephone: +36 (30) 948 0749
Email: tamas.szabo1027@gmail.com

Complaint to a supervisory authority

You may lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or the alleged infringement. Contact details for EU data-protection authorities are available at the European Data Protection Board website. In Hungary, you may contact the National Authority for Data Protection and Freedom of Information (NAIH): 1055 Budapest, Falk Miksa u. 9-11; postal address: 1363 Budapest, Pf. 9; website: naih.hu; telephone: +36-1-391-1400; fax: +36-1-391-1410; email: ugyfelszolgalat@naih.hu. You may request an investigation or authority procedure if you believe your rights have been infringed or are at imminent risk, including where the Controller restricts or refuses a rights request or processing breaches applicable data-protection law.

Legal proceedings

You may bring proceedings before a court if you believe the Controller has processed personal data in breach of applicable law. Proceedings may also be brought before the courts of the EU Member State where you have your habitual residence. In Hungary, the competent court is a regional court (törvényszék); you may bring the case before the court with jurisdiction over your residence or place of stay. Court details are available at birosag.hu.

Chapter VIII. Data security

The Controller undertakes to ensure the security of personal data. Taking account of the state of the art, implementation costs, the nature, scope, context and purposes of processing, and the likelihood and severity of risks to natural persons’ rights and freedoms, it implements technical and organisational measures and procedures to protect data collected, stored and processed and prevent destruction, unauthorised use or alteration, accidental destruction or damage, and loss of availability caused by changes in technology. The Controller requires third parties receiving data on a lawful basis to meet data-security requirements and prevents unauthorised access, disclosure, transmission, alteration or erasure.

Access is limited, according to role and authorisation level, to the Controller, its staff and its processors or recipients who need the data. The Controller protects its IT systems with firewalls and anti-virus software and monitors incoming and outgoing communications to help prevent misuse. The Controller and its processors treat personal data as confidential. Where legally permitted, separate electronic records are protected against being directly linked to or attributed to a data subject.

The security level is determined by considering risks arising particularly from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal data transmitted, stored or otherwise processed. Depending on the risk, safeguards include pseudonymisation and encryption; ongoing confidentiality, integrity, availability and resilience of processing systems and services, including operational and development security, intrusion prevention and detection, and prevention of unauthorised access; timely restoration of access and availability after a physical or technical incident, including prevention of data leakage and vulnerability and incident management; and regular testing, assessment and evaluation of security measures. Safeguards also include business continuity, protection against malicious code, secure storage, transmission and processing, and staff security training.

For health data, the Controller states that it applies additional organisational and technical safeguards, including restricted access to backups stored in multiple locations, regular review and updating of security measures, limiting processing to necessary data, and continuous monitoring by developers for security risks and incidents. Further information about data security may be requested at borderwatcherapplication@gmail.com.

Chapter IX. Transfers to third countries or international organisations

1. Transfers based on an adequacy decision (GDPR Article 45)

Personal data may be transferred to a third country or international organisation where the European Commission has decided that the country, territory, sector or organisation ensures an adequate level of protection. The Commission monitors adequacy decisions and may repeal, amend or suspend one if the required level of protection is no longer ensured.

2. EU–US Data Privacy Framework

On 10 July 2023, the European Commission adopted an adequacy decision for the EU–US Data Privacy Framework. It permits personal data to be transferred from the EU to participating US organisations that undertake to comply with the Framework’s data-protection requirements.

3. Appropriate safeguards (GDPR Article 46)

Where there is no adequacy decision under Article 45, a transfer may take place if the Controller or processor provides appropriate safeguards and enforceable data-subject rights and effective legal remedies are available. The Controller informs you that personal data provided during processing activities may be transferred to a third country.

Chapter X. Other provisions

No decisions producing legal effects or similarly significant effects are made solely by automated means in the processing activities described in this notice.

The Controller may amend this notice unilaterally with effect for the future. The current version is available on the Controller’s website; data subjects will be informed of changes through the website.

Issued in Szeged on 12 October 2026.

Szabó Tamás E.V.