IT, Training and Service Provider Ltd.

WSH Kft. pays special attention to the protection of personal data during its activities, therefore, in accordance with the applicable laws, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR – hereinafter: Regulation), this information sets out and publishes the most important rules applied by it for the processing and protection of personal data, the rights and legal enforcement options of the data subjects, as well as practical information related to this.

First of all, we would like to briefly inform you about the most important information regarding data processing:

The name of the data controller:

WSH Számítástechnikai, Oktató és Szolgáltató Korlátolt Felelősségű Társaság (WSH Kft.)

The data controller's contact details are as follows:

Address: 1117 Budapest, Budafoki út 97.;

Telephone: +36-1-452-5050;

Fax: +36-1-452-5055;

E-mail: adatvedelem@wsh.hu;

Website: www.wsh.hu

 

Summary of the most important data processing activities:

Scope of personal data processed	Purpose of data processing	Legal basis for data processing	Duration of data processing	Recipients to who receive the data
Use of website cookies	Ensuring the proper functioning of the website and analyzing traffic	The legitimate interest of WSH Kft. in its marketing activities	Until deleted by the user, up to 7 days	Google Ireland Limited
Data provided by the applicant in his/her CV	Maintaining contact with the applicant, making a decision on establishing an employment relationship	Applicant's consent	Until the decision on the establishment of the employment relationship is announced	No data transfer
Applicant's name	Checking whether the applicant has been known as a candidate to WSH Kft. in the previous 1 year	WSH Kft.'s legitimate interest in filtering out repeated hearings	For 1 year from the date the candidate becomes known	No data transfer
Company contact information (e.g. name, telephone number, email address, fax number, postal address)	Ensuring contact between WSH Kft. and the partner in order to ensure business continuity	The legitimate interest of WSH Kft. and the partner represented by the contact person	Until the contact person status is maintained, in the case of data included in the contract, the accounting document is mandatory at the latest.	We forward the accounting documents to the accounting service provider
Data provided by the participant in the adult training contract and generated during the training, educational identifier	Conducting the training	Fulfillment of the legal obligation stipulated in Sections 16 and 21 of Act LXXVII of 2013, legitimate interest in the case of educational identifiers (Government Regulation No. 25/A.§ 11/2020)	Last day of the 8th year from the conclusion or creation of the adult training contract	Adult Education Data Provision System; Education Office (education identifier); instructor; in the case of an individual investigation, the body authorized to inspect adult education activities
Personal data appearing on social media platforms	Displaying ads and keeping in touch with interested parties	WSH Kft.'s legitimate interest in marketing activitiesFulfilment of the legal obligation provided for in Sections 16 and 21 of Act LXXVII of 2013, or in the case of the educational identifier, legitimate interest (Government decree, 11/2020., Article 25/A)	1 year	Meta Platforms Ireland Limited; LinkedIn; Google Ireland Limited
Personal data disclosed in internal whistleblowing and Anti-Corruption reports and determined as a result of the investigation	Receiving and investigating the report, terminating or remedying the conduct that is the subject of the investigation	Act XXV of 2023, Sections 18-29 and legitimate interest in compliance with internal anti-corruption regulations	30 days from the conclusion of the investigation	If relevant: external investigator, auditor, whistleblower lawyer, competent authority

 

Please note that during the implementation of manufacturer exams, WSH Ltd. is not considered a data controller, but a data processor of the exam centers, therefore you can receive information about data processing related to the exam from the exam centers

If we process your data with your consent, you may withdraw your consent at any time, but this does not affect the lawfulness of previous data processing. If the data processing is necessary for the performance of a contract or is based on a legal obligation, the provision of data is not mandatory, but in this case you will not be able to use the desired service.

In the case of data processing based on legitimate interest, you have the right to object to data processing at any time.

WSH Kft. does not currently use automated decision-making (including profiling).

Our Company may typically process personal data on the following legal grounds: (1) the consent of the Data Subject – Article 6(1)(a) of the GDPR; (2) the performance of a contract with the Data Subject – Article 6(1)(b) of the GDPR; (3) the performance of a legal obligation – Article 6(1)(c) of the GDPR; or (4) the legitimate interests of our Company as the Data Controller or of a third party – Article 6(1)(f) of the GDPR

Rights of the Data Subject:

You have the right to access your personal data processed by us, request its correction or deletion, object to data processing, in certain cases you can exercise the right to data portability, or request the restriction of data processing (until a decision is made on the fate of the data), and you can file a complaint with the competent authority (National Authority for Data Protection and Freedom of Information – (address: 1055 Budapest, Falk Miksa u. 9-11., telephone number: +36-1-391-1400, e-mail: ugyfelszolgalat@naih.hu, website: www.naih.hu). We will respond to your requests and inquiries related to data processing within 1 month. In case of a violation of rights, you can also file a claim before the competent court (tribunal).

 

 

 

Below is a detailed description of the data protection and data processing rules:

Managing website cookies:

Purpose of data processing: Regarding the cookies used by the website www.wsh.hu, the purpose of data management is to ensure the proper functioning of the website and to analyze traffic anonymously. No advertisements are placed on our website, the function and purpose of cookies is solely to ensure the proper functioning and readability of the website, and to provide us with anonymous (non-personally identifiable) statistical data on how users use the website.

Legal basis for data processing: The legitimate interest of WSH Kft. in its marketing activities. Cookies are small text files that a website places on your computer or mobile device when you visit the site.

The scope of Personal Data processed: Website cookies record your browser type, IP address, the website you are visiting, your region and language settings, and the time.

Duration of data processing: Website cookies are stored on your device for a maximum of 7 days. You have the right to object to data processing at any time, which you can do by deleting cookies in your browser settings, using incognito mode for browsing, or using the full cookie blocking option available at https://tools.google.com/dlpage/gaoptout .

Data transmission: The website of WSH Kft. uses cookies operated by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), as an external service provider. You can read more about Google's use of cookies here:

https://policies.google.com/technologies/types?hl=en

 

Management of data of job applicants:

Purpose of data processing: If you apply for our job advertisement or otherwise voluntarily send us a CV or other document containing Personal Data, the purpose of data processing is to make a decision on the establishment of a contractual relationship, or to contact you regarding your contact details (e.g. telephone number, e-mail address) to request further information, arrange an interview, and communicate the decision.

Legal basis for data processing: As long as a contractual relationship is not established between you and WSH Kft., the legal basis for data processing is your consent, which you can withdraw at any time!

The scope of Personal Data processed: We only process the personal data you provide (including the email or postal address from which the shipment is received), we do not check your social media profiles.

Duration of data processing: We will only retain your data until a decision is made on whether to enter into a contractual relationship with you and you have been informed of this. If an employment relationship is established, you will receive a separate data processing notice and data sheet.

Data transmission: We will not transfer your Personal Data provided during the application process.

 

Name verification of the applicant for the job advertisement:

Purpose of data processing: Checking whether the applicant has been known as a candidate to WSH Kft. in the previous 1 year (either through direct application or through a recruitment agency).

Legal basis for data processing: WSH Kft. has a legitimate interest in avoiding unnecessary multiple interviews and in fulfilling its obligation to notify recruitment partners whether it already knows the candidate.

The scope of Personal Data processed: the name of the applicant.

Duration of data processing: for 1 year from the date the applicant becomes known as a candidate.

Data transmission: We do not transfer Personal Data.

 

Managing company contact information:

Purpose of data processing: If you act as a contact person for one of our current or future partners (or on behalf of your own individual business), the purpose of data processing is for WSH Kft. and its partner to ensure continuous business through your participation as a contact person.

Legal basis for data processing: If you act as a contact person for one of our partners, the legal basis for data processing is the legitimate interest of WSH Kft. and your employer/the partner you represent in being able to contact each other as legal entities through their natural person representatives (contact persons).

The scope of Personal Data processed: We do not process any other Personal Data other than the contact information you provide (e.g. name, position, telephone number, fax number, e-mail address, postal address).

Duration of data processing: we process the contact details you provide as long as your contact details remain valid, unless some of the data has been recorded in a contract concluded with a partner or in another document subject to retention obligations - in the latter case, we process the data included in the document until the mandatory retention period of the document as an accounting document prescribed by law (currently 8 years according to Section 169 of Act C of 2000 on Accounting).

Data transmission: If any of the contact person's Personal Data is included in an accounting document, it will be forwarded to our accounting service provider (Matolcsi és Társa Kft. – 8000 Székesfehérvár, Honvéd u. 3/A. 3rd floor 51.) as the data processor.

 

Management of course participant data:

Purpose of data processing: The purpose of data processing regarding the personal data of participants in our education and training courses is to conduct the training.

Legal basis for data processing: If you are participating in a training course organized by WSH Kft. and falling under the scope of the Adult Education Act, the legal basis for data processing is the fulfillment of the legal obligation stipulated in Sections 16 and 21 of Act LXXVII of 2013, and the legitimate interest in complying with Section 25/A of Government Decree 11/2020 (II.7.) when processing your educational ID. You have the right to object to data processing based on legitimate interest at any time.

The scope of Personal Data processed: As a participant in our course, we process your data provided in the adult training contract, your education identifier (which, if you do not know it or do not yet have one, we will obtain from the Education Office electronically, by transmitting your natural identity data), and your data generated during the training, including the data of the Certificate generated in the Adult Training Data Service System.

Duration of data processing: We will record and process your personal data as a course participant, based on Section 16 and Section 21 (6) of Act LXXVII of 2013, until the last day of the eighth year from the conclusion of the adult training contract or the creation of the data.

Data transmission: We record the data of our training courses and participants as specified in Section 15 of Act LXXVII of 2013 in the Adult Education Data Provision System; if we need to request your educational ID, we forward your personal identification data to the Education Office; and bodies authorized to inspect adult education activities are entitled to access your personal data during their individual inspections. You have the right to prohibit the transmission of certain of your data, which you will be given the opportunity to do at the beginning of the training. If the training is held with the participation of an external instructor, the training documentation will be prepared with your participation.

 

Data processing related to the use of social media platforms and advertisements:

Purpose of data processing: promoting our products and services (displaying our online advertisements, public announcements), operating social media platforms, maintaining contact with users.

Legal basis for data processing: WSH Kft.'s legitimate interest in marketing activities.

The scope of Personal Data processed: on our social media platforms, we can learn the personal data appearing in the public profile of followers, likers, commenters, other users who interact with the profile, and if users interact with WSH Kft. through these platforms, the content of the message. In the case of online advertisements, WSH Kft. does not perform profiling, does not use the personal data of the followers, but rather instructs social media service providers and Google to deliver the advertisements to the target group it has previously determined, which act as independent data controllers and do not provide WSH Kft. with personally identifiable information about the viewers of the advertisements.

Duration of data processing: We store messages sent by users for a maximum of 1 year.

Data transmission: WSH Kft. transfers data to Meta Platforms Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) for Facebook and Instagram accounts, to LinkedIn Ireland Unlimited Company (Wilton Plaza, Wilton Place, Dublin 2, Ireland) for LinkedIn accounts, and to Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) for Google ads. These service providers operate as independent data controllers, according to their own data management rules.

 

Data processing related to the application of an anti-corruption management system:

Purpose of data processing: receiving the report, investigating it (documenting it, maintaining contact with the reporter and the person affected by the report), and as a result of the investigation, remedying or terminating the conduct that is the subject of the report (taking necessary measures).

Legal basis for data processing: Article 6(1)(f) of the GDPR, WSH Kft's legitimate interest in complying with Sections 18-29 of Act XXV of 2023 on the internal whistleblowing system operated by the employer, in operating in accordance with the anti-corruption regulations adopted on the basis thereof.

The scope of Personal Data processed: additional personal data provided by the reporting party in the report and revealed during the investigation (in particular: personal identification and contact details of the reporting party and the person concerned by the report).

Duration of data processing: WSH Kft. will delete the personal data provided in the report and revealed during the investigation (both regarding the reporter and the natural persons affected by the report) 30 days after the completion of the investigation of the report.

Data transmission: The personal data of the reporting party and those affected by the report may only be accessed by the investigator during the investigation, subject to an obligation of confidentiality. The person affected by the report may not access the reporting party's personal data if the reporting party has requested that they be treated confidentially. If the company entrusts a data processor with the data processing (external, impartial investigator, whistleblower protection lawyer), it shall provide prior information about their identity and shall also impose a confidentiality obligation on these persons. If an official procedure is initiated as a result of the investigation, the data processed during the investigation will be forwarded to the authority. Within this, data relating to the reporting party shall be transmitted with the express consent of the reporting party, unless the authority is otherwise entitled to process these data under Act XXV of 2023.

 

Definitions

 

The terms used in this Notice shall be understood in accordance with the relevant legislation, primarily as defined in the Regulation. In particular:

 

Affected: an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, a number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

 

Personal Data: any information concerning the Data Subject.

 

Data management: any operation or set of operations which is performed on Personal Data or data files, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, destruction.

 

Data controller: who determines the purpose of the Data Management – independently or together with others. For the purposes of this Notice, the Data Controller is WSH Computer, Educational and Service Limited Liability Company (registered office: 1117 Budapest, Budafoki út 97., company registration number: 01-09-461038)

 

Data processor: the natural or legal person, public authority, agency or any other body which processes personal data on behalf of the Data Controller.

 

The Data Subject's consent: a voluntary, specific, adequately informed and unambiguous indication of the Data Subject's wishes by which the Data Subject, by a statement or by a clear affirmative action, signifies agreement to the processing of Personal Data concerning him or her.

 

Consignee: The natural or legal person, public authority, agency or any other body to which the Personal Data are disclosed. Public authorities that have access to the Personal Data in the context of a specific investigation, pursuant to law, are not considered Recipients.

 

Profile creation: Any form of automated processing of personal data consisting of the use of Personal Data to evaluate certain personal characteristics relating to a natural person, in particular to analyse or predict characteristics relating to performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.

 

General principles of data processing

 

When processing personal data, our company always acts in accordance with the principles set out in the Regulation, such as lawfulness, purpose limitation, data economy, accuracy, limited storage, integrity and confidentiality, and the principle of accountability, and enforces these during each step of Data Processing.

 

Rights of the Data Subject

 

1. Right of access

You have the right to receive feedback from WSH Kft. on whether we are processing your personal data and, if so, you have the right to receive the following information related to your personal data and the information required by law:

• purpose of data processing
• what type of personal data we process
• who are the recipients to whom we have disclosed or will disclose the personal data
• the planned period of storage of personal data
• your rights to rectification, erasure, restriction, objection, complaint
• if the data was not collected from you, information about the source of the data.

 

2. Right to rectification

You have the right to request that our Company correct inaccurate personal data concerning you (e.g. in the event of a change in data or a typo), or request that incomplete personal data be completed.

 

3. Right to erasure

In the event that

• the personal data are no longer necessary for the purpose for which they were collected or processed, or
• the data processing was based solely on your consent and you withdraw it, or
• you legitimately object to the data processing, or 
• the personal data were processed unlawfully, or 
• the personal data must be deleted due to a legal requirement, or 
• the data was collected for commercial purposes, 

you have the right to request the deletion of your personal data.

Please note that the right to deletion cannot be enforced if the data processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, in the public interest concerning public health, in connection with data processing for archiving in the public interest, scientific and historical research or statistical purposes, and, in the event of the enforcement of legal claims. Deletion is not automatic; upon your request for deletion, our Company will examine whether the conditions for its deletion are met and will notify you thereof. We also draw your attention to the fact that in certain cases you have the right to object to data processing instead of erasure (see below, 6. Right to object).

 

4. Right to restriction of processing

In the following cases, you have the right to request that our Company restrict data processing:

• for the time while our Company checks the accuracy of your personal data because you dispute it;
• in the case of unlawful data processing, if you request restriction of use instead of deletion;
• our Company no longer needs to process the personal data, but you require them to enforce your legal claims;
• you have objected to data processing, data processing will be restricted until our Company examines your objection request.

The restriction is a temporary measure while your data is subject to restriction, we do not perform any data processing operations on the personal data other than storage. We will inform you in advance about the lifting of the restriction.

 

5. Right to data portability

If the data processing is based on your consent or in connection with the performance of a contract and is carried out by automated means, you have the right to request that your personal data be received in a structured, commonly used and machine-readable format and transmitted to another data controller, or, if technically possible, directly transmitted by our Company to another data controller.

 

6. Right to object

If the data processing is carried out for direct marketing purposes, you have the right to object to the data processing. In this case, we will no longer process your personal data for this purpose.

If the data processing is carried out on the basis of other legitimate interests of WSH Kft. or a third party, you have the right to object to the data processing. In this case, we will no longer process your personal data, unless we prove that the data processing is justified by legitimate reasons that override your interests and rights, or are necessary for the enforcement of legal claims of WSH Kft..

 

7. Right to lodge a complaint

You may file a complaint regarding our company's data processing with the National Data Protection and Freedom of Information Authority (address: 1055 Budapest, Falk Miksa u. 9-11., telephone number: +36-1-391-1400, e-mail: website: ugyfelszolgalat@naih.hu, www.naih.hu). In addition, if you find the data processing to be harmful, you may file a civil lawsuit before the competent court

 

Enforcement of the Data Subject's rights

 

You can request information about the processing of your personal data, or exercise your rights, either in writing (by e-mail or letter) or orally, via the contact details above. We only ask for proof of your identity in case of doubt.

We will primarily provide information in writing (if possible, by e-mail), and at your request, we will also respond orally, as soon as possible, but no later than 1 month from the date of receipt of the request.

Depending on the complexity of the application and the number of applications, this deadline may be extended by a maximum of 2 months, but we will inform you about this within 1 month of receipt of the application, stating the reasons.

If no action is taken on your request, we will inform you of this and the reasons for this no later than 1 month from the date of receipt of your request.

Our Company provides information on data processing and the fulfillment of requests related to the exercise of the rights listed above and the response to them free of charge. However, if the request is clearly unfounded or, in particular, excessive due to its repetitive nature, we are entitled to charge a reasonable fee or refuse to take action on the request.

In the event of a data breach that is likely to pose a high risk to the rights of Data Subjects, we will immediately provide information about the incident in person or through a public notice.

 

Security of data processing

 

Our company is ISO 27001 certified, which is an information security standard that WSH Kft. actively manages its data security in accordance with international best practice. By implementing ISO 27001, our company has developed an information security management system that is able to ensure the confidentiality, integrity and availability of its information, including the Personal Data it manages, in line with changes in the organization's external and internal environment, and also guarantees that only authorized persons can access the data.

 

Entry into force

 

This Notice shall enter into force on January 1, 2024.

 

This Policy may be amended by the Data Controller at any time by its unilateral decision and the change shall become effective upon its publication.