[DRAFT – not to be published before legal review and resolving the [to verify] markers]
Last updated: [date]
1. Data controller
This notice is for visitors to the rozsaktere.hu website (the “website”) and for anyone who contacts the parish, in accordance with Regulation (EU) 2016/679 (GDPR).
- Controller: Budapest-Erzsébetvárosi Árpád-házi Szent Erzsébet Plébánia (Parish of Saint Elizabeth of Hungary, Budapest)
- Address: 1074 Budapest, Rózsák tere 8., Hungary
- Represented by: Fr. Sándor Kampfmüller, Parish Administrator
- E-mail: plebania@rozsaktere.hu
- Phone: +36 1 322 4117
- Data protection officer: [to verify: whether one is appointed; if so, name and contact, otherwise delete this line]
Church data processing is also governed by the data protection rules of the Archdiocese of Esztergom-Budapest and the Catholic Church. [to verify: exact reference to the archdiocese’s data protection policy]
2. What data we process, why, and on what legal basis
- Visiting the website (server logs). Data: IP address, time of the request, page viewed, browser and operating system type. Purpose: secure operation of the website, preventing errors and abuse. Legal basis: legitimate interest (GDPR Art. 6(1)(f)). Retention: according to the hosting provider’s logging policy, [to verify: duration].
- Contacting us by e-mail or phone. Data: name, e-mail address, phone number, content of your message. Purpose: answering your inquiry and arranging matters such as baptisms, weddings, funerals or Mass intentions. Legal basis: steps taken at your request, or your consent (GDPR Art. 6(1)(a) and (b)). Retention: until the matter is closed, but no longer than [to verify: e.g. 2] years, unless law or church rules require longer retention (for example, sacramental registers).
- Website forms. There is currently no live form on the website. If one is introduced later (for example a baptism or wedding request), this notice will be updated before launch with the purpose, the data collected and the retention period. [to verify: update when introduced]
- Announcements and events. Names of people (for example award recipients or performers) appear in announcements and event descriptions only with their consent or on another appropriate legal basis. Consent can be withdrawn at any time, and the name will then be removed.
- Editors’ and administrators’ logins. The username, e-mail address and login log of staff who edit the website. Purpose: protecting the website and checking editor access. Legal basis: legitimate interest. This does not affect visitors.
- Cookies. See the Cookie Notice for details.
3. Who receives the data
We do not sell your data and do not use it for marketing. The following providers may access data to the extent necessary to run the website (processors):
- Hosting and e-mail provider: [to verify: exact company name and registered office of the hosting provider] (tarhely.eu). The website and the plebania@rozsaktere.hu mailbox run there.
- Backups: [to verify: if UpdraftPlus backups are stored off-site (for example Google Drive), name the provider here and state the transfer basis]
4. Third-party services on the website
- Google Fonts. The website’s fonts are currently loaded from Google’s servers, so your browser’s IP address may be sent to Google when you view a page. [to verify: self-hosting the fonts is recommended; if done, this item can be deleted]
- Social and map links. Links to our Facebook page and to Google Maps directions pass data only if you click them. From then on, the respective provider’s privacy rules apply.
- Daily Gospel. The website’s server fetches the daily Gospel from evangelium.katolikus.hu. No visitor data is passed on in this process.
5. Data security
The website is served over an encrypted (HTTPS) connection. Editor accounts are protected (login attempt limiting, two-factor authentication), and the system is updated and backed up regularly. Only authorised staff have access to the data.
6. Your rights
You may request:
- access to your personal data and a copy of it;
- correction of inaccurate data;
- erasure of your data (for example, if you withdraw consent);
- restriction of processing;
- data portability, where applicable;
and you may object to processing based on legitimate interest. You may withdraw consent at any time, without affecting the lawfulness of earlier processing. You can submit your request by e-mail or by post to our address. We will respond within one month.
7. Complaints and remedies
If you believe your personal data is being processed in breach of the law, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):
- Address: 1055 Budapest, Falk Miksa utca 9–11. (postal address: 1363 Budapest, Pf. 9.)
- E-mail: ugyfelszolgalat@naih.hu
- Website: www.naih.hu
You may also go to court if your rights have been infringed.
8. Changes to this notice
We may amend this notice. The current version is always available on this page.