PRIVACY NOTICE
ON DATA PROCESSING DURING PSYCHOLOGICAL CONSULTATIONS ORGANISED BY THE FACULTY OF GENERAL MEDICINE OF THE UNIVERSITY OF PÉCS
The University of Pécs (hereinafter referred to as the University) pays particular attention to the fact that in the course of its data processing, the University of Pécs complies with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the General Data Protection Regulation), the Act on the Right to Informational Self-Determination and Freedom of Information of 2011. CXII of 2011 (hereinafter: Infotv.), other legislation and the data protection practices developed during the activities of the National Authority for Data Protection and Freedom of Information (hereinafter: NAIH).
1. NAME OF THE CONTROLLER
Name: University of Pécs
Headquarters and mailing address: 7622 Pécs, Vasvári Pál u. 4.
Rector Dr. Attila Miseta and István Decsi, Chancellor
University of Pécs, Faculty of Medicine, Psychological Counselling Service
Representative: Dr. Boróka Gács
Contact name: Dr. Gács Boróka
Phone number: 31478
E-mail address: boroka.gacs@aok.pte.hu
Name of Data Protection Officer: Dr. László Szőke Gergely Szőke, PhD
Contact: adatvedelem@pte.hu +36 (30) 179 5672
2. THE SCOPE AND SOURCE OF THE PERSONAL DATA PROCESSED
The scope of the processed data includes the data provided by you to the Data Controller during the psychological consultation, which are detailed in the table in section 3.
The source of the data is your supply of the data.
If there are any changes or modifications to the processed data subjects' data during the processing period, please notify the contact person indicated in point 1 without delay.
3. THE PURPOSE AND LEGAL BASIS OF THE PROCESSING
3.1 In order to ensure the proper functioning of the institution, [Article 18 (1) c) of the Nftv.] as a public task (Article 6 (1) e) of the General Data Protection Regulation), the University processes the personal data of the data subject indicated in the table below, provided at the time of registration, for the purpose of registration for psychological counselling, contact, identification and verification of the applicant, and ensuring participation in counselling. Data subjects can register for the consultation after filling in an online form.
3.2 The University processes the personal data provided by the data subject in the context of the consultation, as part of its public task of providing advice (pursuant to Article 6 (1) e) of the General Data Protection Regulation), for the purpose of providing an appropriate personalised service. At the choice of the data subject, the consultation may take place in person or online, on the online platform chosen by the data subject. During the counselling, the counsellor providing the service will keep a so-called consultation log of the information provided during the meetings to produce statements to make the service more efficient. The personal data recorded in the consultation log are detailed in the table below.
3.3 In exceptional cases, to protect the vital interests of the data subject and others, the University processes personal data detailed in the table below pursuant to Article 6 (1) d) of the General Data Protection Regulation and Article 9 (2) b), which may result in the Psychological Consultation Service transferring the data without the data subject's consent. Information on such possible cases can be found in the counselling information leaflet.
3.4. The University processes personal data containing the questionnaires filled in by the data subject in the context of the provision of counselling services as part of its public tasks (pursuant to Article 6(1)(e) of the General Data Protection Regulation). Completion of the questionnaires is not compulsory but may be at the discretion of the data subject, prior to the consultation, during the consultation and, exceptionally, after the consultation only in the case of foreign students, where the transfer of the data may be justified in the opinion of the consultant.
|
Purpose of data processing |
Legal basis for processing |
Scope of the data processed |
|
3.1. Registering, keeping records, providing counselling |
Article 6(1) e) |
personal data provided on the online registration form, in particular: name, gender, age, neptun code, email address, information about the faculty, department, year, problem area, personal details provided by the data subject in relation to his/her request, etc. |
|
3.2. Keeping a consultation diary during consultations |
Article 6(1) e) Article 9(2) b) |
name, age, sex, place of origin, faculty, degree course, year, mother tongue, duration of the consultation, consultant's note of the problem discussed during the consultation, other data, number of the consultation, form of the consultation, indication of the intervention, information on whether your data have been transmitted |
|
3.3. Transfer of data to the competent authority to protect its vital interests |
Article 6(1) d) Article 9(2) b) |
Name, problem area, questionnaire content |
|
3.4. Completing questionnaires with stakeholders |
Article 6(1) e) |
Name, content of questionnaire |
4. DURATION OF DATA PROCESSING
The duration of data processing is until the end of the student status of the data subject.
5. WHO HAS ACCESS TO THE DATA, PROCESSING AND TRANSFER OF DATA
Access to the data shall be restricted to the staff of the University department which needs the data to perform its tasks. Staff members are bound by confidentiality obligations in respect of the personal data they receive.
The University uses Microsoft Forms for registration and is therefore a data processor. Data processor details:
Microsoft Corporation One Microsoft Way Redmond, WA 98052 United States
Privacy Policy: https://privacy.microsoft.com/hu-hu/privacystatement
The University uses Teams, Google meet, Skype, Zoom to conduct the online consultation at the choice of the data subject and is therefore a data processor:
-Microsoft Corporation, 1 Microsoft Way, Redmond WA
https://privacy.microsoft.com/hu-hu/privacystatement
-Google Ireland Limited,Gordon House, Barrow Street, Dublin 4 Ireland.
https://privacy.google.com/?hl=en#
-Zoom Video Communications, Inc, 55 Almaden Blvd, San Jose, CA
https://explore.zoom.us/en/privacy/
The University may transfer personal data to the PTE KK Emergency Department, PTE KK Psychiatric and Psychotherapy Clinic, the Police, and the University Security Department in case of public danger in the course of the processing of personal data as explained in section 3.4.
6. DATA SECURITY
The University shall ensure adequate security of personal data of the data subject, including protection against unauthorised or unlawful processing, accidental loss, destruction, or damage, by implementing appropriate technical and organisational measures. Further information on the data security measures applied by the University can be found in §§ 20-22 of the University of Pécs Data Protection Regulations and in the IT Security Regulations.
7. RIGHTS OF DATA SUBJECTS AND THEIR EXERCISE
7.1. The data subject shall have the right to access the information specified in Article 15 of the General Data Protection Regulation (right of access) in relation to the processing of personal data concerning him or her, including in particular the right to be informed by the University that
which personal data,
for what purpose and on what legal basis,
and from what source it is collected,
what is the intended duration of the storage or what are the criteria for determining the duration,
to whom, when and to which of your personal data the University has given access or transferred your personal data; and
what rights, complaints and remedies the data subject has in relation to the processing.
7.2 The data subject has the right to have inaccurate (incorrect or incomplete) personal data relating to him or her corrected or rectified pursuant to Article 16 of the General Data Protection Regulation (right of rectification).
7.3 The data subject has the right to erasure of his or her personal data pursuant to Article 17 of the GDPR (right to erasure) where
- the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
- where processing is based on consent, the data subject withdraws his or her consent and there is no other legal basis for the processing;
- the data subject has effectively objected to the processing based on 7.7.
- the personal data have been unlawfully processed;
- the personal data must be erased in order to comply with a legal obligation.
The data will not be erased if the processing is necessary,
- for the performance of a legal obligation or in the exercise of a public task or authority;
- for the establishment, exercise or defence of legal claims;
- for archiving purposes in the public interest, scientific and historical research, or statistical purposes, or
7.4 The data subject has the right to request the restriction of the processing of his or her personal data (right to restriction), as set out in Article 18 of the General Data Protection Regulation, if:
- the data subject contests the accuracy of the personal data; in which case the restriction shall apply for the period necessary to allow the University to verify the accuracy of the personal data;
- the processing is unlawful, and the data subject opposes the erasure of the data and instead requests the restriction of their use;
- the University no longer needs the personal data for the purposes of the processing, but the data subject requires them for the establishment, exercise, or defence of legal claims; or
- the data subject has objected to the processing pursuant to Clause 7.7, in which case the restriction shall apply for a period until it is determined whether the University will uphold the objection.
The personal data subject to the restriction may be processed, except for storage, only with the consent of the data subject or for the establishment, exercise, or defence of legal claims or for the protection of the rights of another natural or legal person or of an important public interest of the Union or of a Member State.
7.5 In the case of processing based on consent, the data subject shall have the right to withdraw his or her consent at any time without giving reasons based on Article 7(3) of the General Data Protection Regulation (right to withdraw consent).
7.6 In the case of automated (electronic) processing based on consent or for the performance of a contract, the data subject has the right to receive personal data relating to him or her in a commonly used electronic format or to request the University to transfer the data to another controller, as defined in Article 20 of the General Data Protection Regulation (right to data portability).
7.7 Where processing is carried out for the exercise of a public task or authority or is based on a balancing of interests, the data subject has the right to object to the processing on grounds relating to his or her situation (right to object). the University may no longer process the personal data unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject or for the establishment, exercise, or defence of legal claims.
7.8 The data subject may exercise his or her rights free of charge by contacting the contact person indicated in point 1 or the Data Protection Officer. The exercise of the data subject's rights may in most cases require the identification of the data subject, and in some cases (e.g. exercise of the right to rectification) the verification of some additional data. The University will decide on the request to exercise the right of access within one month at the latest. Where necessary, considering the complexity of the request and the number of requests, this time limit may be extended by a further two months, the extension being notified to the data subject within one month.
8. COMPLAINTS AND REDRESS PROCEDURES
Any complaints regarding the processing of data may be made to the contact details indicated in point 1 or to the University's Data Protection Officer (adatvedelem@pte.hu). If you wish to lodge a complaint by post, you may do so to the address at Vasvári Pál u. 4, 7622 Pécs, to the contact person indicated in point 1 or to the Data Protection Officer.
If you consider that you have suffered or are at imminent risk of suffering a legal damage in connection with the processing of your personal data, you may contact the National Authority for Data Protection and Freedom of Information (postal address: 1363 Budapest, Pf. 9. phone: +36 (1) 391-1400, email: ugyfelszolgalat@naih.hu website: https://naih.hu).
In the event of a breach of your data protection rights, you may also take legal action in the courts of your place of residence or domicile, at your choice.