BFO
Budapest Festival Orchestra

Data Privacy Statement

Information and Policy - Data processing related to Budapest Festival Orchestra Customers

The Budapest Festival Orchestra (registered office: H-1033 Budapest, Polgár utca 8–10, Flórián Udvar Building B, Hungary; “BFO”) is taking this opportunity to provide information concerning the processing of your personal data by BFO pursuant to the provisions of Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (“GDPR”).

1. The Purpose and Legal Basis for the Data Processing, Scope of Processed Data, the Duration of Data Processing, the Scope of Those Who Have Access to Data, Data Transfers:

1.1 Website registration

If you register on BFO’s website, BFO will process the following data in the context of using the website:

Name; home address; phone number; email address; password; scope of interest

In this case, GDPR Article 6(1)(b) (“performance of a contract”) will be the legal basis for processing, having regard to the fact whereby a contract is established by and between you and BFO upon your registration on the website. The terms of use applicable to the website can be accessed at www.bfz.hu/en/documents.

Your data within the meaning of this clause will be processed until the registration is cancelled.

BFO’s appointed employees and legal entities providing IT back-office services to BFO will have access to your data under this clause.

1.2 Direct Marketing

Subject to your consent, BFO will process your following data in the context of direct marketing activities, based on your freely given consent:

Name; home address; phone number; email address; scopes of interest

In this case, your given consent will be the legal basis of processing based on GDPR Article 6(1)(a). Your consent to direct marketing will not be a condition for you conclusion of contracts with BFO. You have the option to withdraw consent under this clause at any time, free of charge, through any of our contact details below:

Website: www.bfz.hu/en
Email: info@bfz.hu
Phone: +36 1 489 4330

In person: Offices of the Budapest Festival Orchestra Foundation (H-1033 Budapest, Polgár utca 8–10/B, Hungary, mezzanine floor)

Your data under this clause will be processed until you withdraw your consent related to the sending of direct marketing materials.

BFO’s appointed employees, legal entities providing IT back-office services to BFO and legal entities that engage in sending BFO’s direct marketing materials will have access to your data under this clause.

You are furthermore kindly informed that data you provide, along with any data generated on the basis of tickets previously purchased from BFO or the use of its services, will also be used for the purpose of sending you marketing materials that correspond to your personal preferences. No automated decision-making will take place during the above activity.

You are kindly informed, furthermore, that if you have consented to this, your email address will be transferred to the firm that displays online advertising (Facebook, Google) for the purpose of sending you marketing materials that correspond to your personal preferences. No automated decision-making will take place during this activity.

1.3 Arranging Sweepstakes

If you take part in a promotion or sweepstakes that BFO organises from time to time, BFO will process your following data in this context:

Name; home address; phone number; email address

In this case, GDPR Article 6(1)(b) (“performance of a contract”) and (c) (“compliance with a legal obligation”) will be the legal basis of processing, having regard to the fact that a contract is established by and between you and BFO upon your participation in a sweepstakes, and BFO is subject to taxation and accounting liability in relation to handing over the respective prize.

BFO will process your data under to this clause until the end of the respective sweepstakes. If you win any kind of prize during the sweepstakes, the processing required by BFO for compliance with its tax liability will last until the statutory limitation under tax law (for 5 (five) years from the last day of the calendar year in which a tax return should have been filed or, in the absence of such a tax return, the tax should have been paid), i.e. for up to a maximum of seven years. Data required for BFO to comply with its accounting liability will be processed for up to a maximum of eight years.

BFO’s appointed employees, legal entities providing IT back-office services to BFO, legal entities that engage in the delivery, in print and online, of BFO’s marketing materials (including Facebook and Google as service providers), and legal entities participating in the respective sweepstakes will have access to your data under this clause.

1.4 Data Processing Related to Ticket and Season Ticket Purchases

If you purchase tickets or season tickets directly from BFO on its website or otherwise, BFO processes your following data in this context:

Name; home address; phone number; email address; tax ID; bank account number; information about previous purchases and their performance; scopes of interest

In this case, GDPR Article 6(1)(b) (“performance of a contract”) and (c) (“compliance with a legal obligation”) will be the legal basis of processing, having regard to the fact that a contract is established by and between you and BFO upon ordering tickets or season tickets, and BFO is subject to taxation and accounting liability in relation to the performance of that contract.

BFO will process your data under this clause for five years after performance of the contract, and processing required by BFO for compliance with its tax liability will last until the statutory limitation under tax law (for 5 (five) years from the last day of the calendar year in which a tax return should have been filed or, in the absence of such a tax return, the tax should have been paid), i.e. for up to a maximum of seven years. Data required for BFO to comply with its accounting liability will be processed for up to a maximum of eight years.

BFO’s appointed employees, legal entities providing IT back-office services to BFO, partners participating in ticket sales, and BFO’s online payment services provider will have access to your data under this clause.

1.5 Patrons’ Club

If you are a BFO Patrons’ Club member, BFO will process your following data in the context of your membership:

Name; address; email address; phone number; amount of support/patronage category; ticket purchase history; date of entry; scopes of interest; expiry of club membership; nickname (if you specified one); name of partner (if you or your partner has specified it to us)

In this case, GDPR Article 6(1)(b) (“performance of a contract”) and (c) (“compliance with a legal obligation”) will be the legal basis for the processing, having regard to the fact that a contract is established by and between you and BFO upon your joining the Patrons’ Club, and BFO is subject to taxation and accounting liability in relation to the performance of that contract.

BFO will process your data under this clause for five years after performance of the contract, and processing required by BFO for compliance with its tax liability will last until the statutory limitation under tax law (for 5 (five) years from the last day of the calendar year in which a tax return should have been filed or, in the absence of such a tax return, the tax should have been paid), i.e. for up to a maximum of seven years. Data required for BFO to comply with its accounting liability will be processed for up to a maximum of eight years.

BFO’s appointed employees, legal entities providing IT back-office services to BFO and BFO’s online payment services provider will have access to your data under this clause.

1.6 Data Processing Related to the Loyalty Program

If you are a BFO Loyalty Program member, BFO will process your following data in the context of your membership:

Name; address; email address; ticket purchase history; Loyalty Program card number; date of entry; number of points earned; scopes of interest

In this case, GDPR Article 6(1)(b) (“performance of a contract”) and (c) (“compliance with a legal obligation”) will be the legal basis for the processing, having regard to the fact that a contract is established by and between you and BFO upon your joining the Patrons’ Club, and BFO is subject to taxation and accounting liability in relation to the performance of that contract.

BFO will process your data under this clause for five years after performance of the contract, and processing required by BFO for compliance with its tax liability will last until the statutory limitation under tax law (for 5 (five) years from the last day of the calendar year in which a tax return should have been filed or, in the absence of such a tax return, the tax should have been paid), i.e. for up to a maximum of seven years. Data required for BFO to comply with its accounting liability will be processed for up to a maximum of eight years.

BFO’s appointed employees, legal entities providing IT back-office services to BFO and BFO’s online payment services provider will have access to your data under this clause.

2. Data Controller:

The data controller of your personal data specified above (controller) will be BFO.

BFO’s Data Protection Officer and contact details:

Name: Dr. Gábor Pataki, lawyer specialising in privacy and data protection
Email: adatvedelem@bfz.hu

The list of our processors is available at www.bfz.hu/en/documents.

3. Description of Technical and Organisational Measures Applied in the Interest of the Data Storage and Data Security

Your personal data will be stored at BFO’s registered office (H-H-1033 Budapest, Polgár utca 8–10, Flórián Udvar Building B) and in the IT systems used by BFO (e.g. CRM system), which are located at BFO’s registered office and on cloud storage drives.

BFO will take every technical precaution that may be reasonably expected in the interest of the secure storage of stored data that is free of access by third parties.

IT security description of the storage of the personal data, technical and organisational measures taken for data security:

BFO ensures security of the personal data by protecting its electronic equipment with passwords and by only allowing access to the personal data for the employees and processors who need such access in order to conduct the relevant activity.

BFO only authorises the transmission of personal data in encrypted form, and it regularly informs its employees regarding this both in writing and in the scope of training.

4. Your rights in relation to the processing (data subject’s rights):

You have the following rights in relation to the processing of your personal data:

a) right to access (Article 15 of the GDPR): You are entitled to receive information from BFO regarding whether your personal data are being processed, and if they are, you are entitled to access the personal data and the information set out in this notice.

BFO will provide you with a copy of the personal data that are being processed. BFO may charge a reasonable fee for further copies your request based on the administrative costs. If you submit your request by electronic means, we will provide the information in a widely used electronic format, unless you request otherwise.

b) right to rectification (Article 16 of the GDPR): You are entitled to have BFO rectify any inaccurate personal data concerning you without undue delay upon your request. You are also entitled to request completion of your personal data.

c) right to erasure (Article 17 of the GDPR): You are entitled to have BFZ erase personal data concerning you without undue delay upon your request, and BFO is obliged to delete personal data concerning you without undue delay if any of the following grounds applies:

The provisions of this point (c) are not applicable where (i) processing of the personal data is required in order for fulfilment of an obligation arising from EU or Member State legislation applicable to BFO, or (ii) processing is required in order for posing, enforcing or protecting legal claims.

d) right to restriction of processing (Article 18 of the GDPR): You are entitled to have BFO restrict processing upon your request where one of the following applies:

e) right to object (Article 21 of the GDPR): You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you. In this case, BFO may no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims. Where processing takes place in order for fulfilment of a legal obligation, exercising of the right to objection will not result in termination of the processing specified in this notice.

f) right to information regarding the foregoing rights (Article 12 of the GDPR): BFO will inform you promptly, but at the latest within one month of receipt of your request specified in points (a)-(e) regarding the circumstances of the processing in a concise, transparent and clear form. When necessary, having regard to the complexity of the request and number of requests, this deadline may be extended by a further two months. BFO will inform you regarding extension of the deadline within one month after receipt of the request, also indicating the reasons of the delay.

Information is free of charge. If your request is clearly unfounded or excessive, in particular because of their repetitive character, BFO may (i) charge a reasonable fee taking into account the administrative costs of providing the information or taking the action requested or (ii) refuse to act on the request. BFO bears the burden of demonstrating the manifestly unfounded or excessive character of the request.

BFO will inform regarding those set out in points (b)-(d) above (i.e. all rectifications, erasures and restrictions of processing) all recipients to whom the personal data has been disclosed, unless this proves to be impossible or would require disproportionate effort. BFO will inform you regarding these recipients upon your request.

g) right to lodge a complaint (Article 77 of the GDPR): You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR. You may lodge a complaint with the National Authority for Data Protection and Freedom of Information (address: H-1125 Budapest, Szilágyi Erzsébet fasor 22/C.; phone: +36 1 391 1400; fax: +36 1 391 1410 naih.hu; ugyfelszolgalat@naih.hu).

h) right to judicial remedy (Article 79 of the GDPR): You have the right to judicial remedy where you consider that your rights under the GDPR have been infringed as a result of the processing of your personal data in non-compliance with the GDPR. Proceedings against BFO must be brought before the courts of the Member State where BFO has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where you have your habitual residence.

i) right to data portability (Article 20 of the GDPR): you have the right to data portability where the processing is based on Article 6(1)(a) or (b) of the GDPR, i.e. your consent or the fulfilment of a contract concluded with you. In this case, you have the right to receive the personal data concerning you, which you have provided to BFO, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from BFO. You also have the right to have the personal data transmitted directly from BFO to another controller, where technically feasible.

5. You may request information regarding the processing of your personal data in the following manners and from the following persons:

You may request further information regarding the processing of your personal data from Simona Máthé Kiss by postal mail (H-1033 Budapest, Polgár utca 8–10., Flórián udvar B ép.) or email (info@bfz.hu). Upon your request, you may also be given verbal information, which must be recorded. If you request verbal information (e.g. via phone), you will need to certify your identity to BFO. In order to exercise your rights specified above, you will also have to contact Simona Máthé Kiss.

Effective from: 25 May 2018