Accreditation for MLSZ events

Privacy Policyin connection with the accreditation procedure for international events organized by the Hungarian Football Federation 

1. Where can you find information on data processing?

MLSZ has prepared this policy in accordance with the provisions of the General Data Protection Regulation of the European Union 2016/679 (hereinafter: GDPR or Regulation) with the specific purpose of making the data processing operations transparent in an easily understandable way. This privacy policy is available on the Internet at https://dataprivacy.mlsz.hu/dokumentumtar/data-management-guides/data-processing-for-other-persons-relating-to-football-e.g.-security-stewards/accreditation-for-mlsz-events and at the accreditation site.

Data of the Data Controller:

Name: Hungarian Football Federation (MLSZ)

e-mail address: mlsz@mlsz.hu

name of data protection officer: dr. András Bári

e-mail address of data protection officer: adatvedelem@mlsz.hu

mailing address: 1386 Budapest 62. Pf. 906/1

2. Presentation of processing cases and the scope of processed data

At international events organized by the MLSZ, including friendly matches, for those professionals who wish to attend the events, entry is subject to accreditation.

You can perform accreditation on the accesscontroll.com web interface, during which the person requesting for accreditation shall create a user account. 

The IT system for the management, issuance and registration of accreditations is developed and operated by Totáljegy Kft., however, MLSZ has full access to the personal data that appear during the accreditation process.

The IT system processes the following personal data of the applicant for accreditation in order to carry out the accreditation procedure:

• for the user and the person requesting accreditation:
• surname and first name,
• e-mail address,
• place and date of birth,
• nationality,
• person's image,
• for users under the age of 18, the name of the legal representative.
• type and number of identity document (identity card or passport)
• the signature of the data subject confirming the receipt of the accreditation device (badge) or, if the MLSZ has given its prior written consent, the signature of the employer/principal or field leader of the data subject instead.

3. Duration of data processing 

Except in the case of an official request of the authority, the MLSZ will not delete the processed data until 1 month after the event, from there it can be deleted by the data subject or the MLSZ. After one month, the system restricts the processing of personal data, to which the MLSZ or its data processor can only access in order to perform a lawful and specific task, except in the case of erasure or transfer of data at the request of the authority, MLSZ does not perform any operation.

In order to simplify the accreditation process, the processed data is stored by the MLSZ for 180 days after the event (if the data is not deleted in the meantime by the data subject), however, thereafter it will be deleted due to the longer period between events.

Except in the case of a police request for further storage, the current data in the form for the receipt of accreditation devices (badge) will be deleted 1 month after the date of the event.

4. Purpose of data processing

The purpose of completing the accreditation process and creating a user account is to have information on the identity of the persons requesting accreditation in connection with sports events in Hungary, make the process of applying for, issuing and storing accreditation traceable, if such takes place, the police background of the persons requesting accreditation should be checked, thus increasing the security of the events by the MLSZ.

5. Recipients of data, categories of recipients

The data are recorded by the data subjects through the IT system developed and operated by Totáljegy Kft.

Totáljegy Kft. uses cloud-based backup during its IT systems for the accreditation procedure, it stores the data locally on Heroku’s (https://www.heroku.com/about) servers and the images required for accreditation on the Amazon Web Service (AWS) http://aws.amazon.com/privacy/) servers.

The two service providers (Heroku and AWS) process the data on the basis of a data processing contract drawn up by the Commission of the European Union.

The MLSZ provides the data to the law enforcement agencies (in some necessary cases to its other partners, for example its security provider), if necessary.

6. Source of personal data

The personal data of the person requesting accreditation are received by the MLSZ from Totáljegy Kft., these are recorded in the system either by the data subject himself or by his/her employer/principal.

7. Legal basis for data processing

The legal basis for data processing, in case of major international sporting events, is Article 6 (1) (e) of the Regulation, given that it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. In the case of accreditation, the MLSZ acts in accordance with Section 22 (1) (j) of Act I of 2004 on Sport, which states that the task of the trade union, so the MLSZ, is to participate in the performance of state tasks related to the organization of major international sports events in Hungary in the case of the winning tender.

The legal basis for data processing in the case of friendly, or not major matches according to Article 6 (1) (f) of the Regulation the MLSZ has a legitimate interest in having information on the identity of persons applying for accreditation in such matches as well, thereby the MLSZ increases the security of matches.

8. Your rights in relation to processing

8.1 Processing concerning handling of complaints

We will answer to the complaints in relation to the processing not later than within a month, which may be extended by further 2 months, where appropriate.

If you want to exercise your rights, we will need you to be identified and we will have to necessarily communicate with you.

MLSZ (Hungarian Football Federation) ensures the identification of the applicant in the following ways:

• personal identification: you can do it at any County Directorate you choose or at the centre of MLSZ, in this case we will carry out your identification personally by using your identity document; and this is the only form of identification which does not involve the recording of your personal data.
• identification by verifying data: if you cannot appear in person for a personal identification, you are required to provide us with any of your identity document’s number (this document can be: identity card, passport or driving licence), your mother's maiden name, your place and date of birth and your name. On the basis of the data, by using the document’s identifier, we will check in the Personal Data and Address Register if the provided data are real. If they are real, it is verified that you possess an identity document which has the data provided.
• Please note that if you choose to be identified by this or any other method - without personal appearance - we offer during this procedure, MLSZ excludes its responsibilities if any damage and/or other disadvantage will be caused to you or any legal entity or natural person by fulfilling your request.

In case of a legal representative - if the statement of the right to representation is not available in our system - we will also need the applicant to make a statement on the legal representation by a form provided by MLSZ, which also includes the processing of the name, ID number and address of the declarant and the witnesses verifying the statement.

During the identification and/or the statement, the data provided by the data subject and/or the legal representative and the witnesses as well as the request will be retained for 5 years. The request and the related correspondence will also be available in our email account.

In the event of any doubt, we can call the applicant for the carrying out of further identification processes; we will need this if the execution of the request has a legal effect on the applicant or the data subject on the basis of the request. This may be the case if, for example, a person requests the erasure of his data but he is an active football player, and the erasure of the data would mean that we should withdraw his football licence.

On the basis of point f) of paragraph (1) of Article 6 of the Regulation, the legal ground of the processing is the legitimate interest of MLSZ in order to handle the complaints and be able to verify how it acted and what measures it took in respect of the individual complaints.

The processor related to the processing of the request is the operator of mlsz.hu, RelativeGROUP Kft. (Registered seat: 2000 Szentendre, Tölgy utca 12.).

The hosting and organisation of our documents is performed by PRIV-DAT Dokumentum Archiváló és Tároló Kft. (registered seat: 1211 Budapest, Weiss Manfréd út 5-7.).

8.2 Request for information and request for a copy (right of access)

You shall have the right to obtain confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, you are entitled:

• to gain access to the data processed (namely request a copy) and
• to be informed about the following:
• the purposes of the processing;
• the categories of your personal data processed;
• the recipients or categories of recipient to whom the personal data have been or will be disclosed;
• the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
• the existence of the right to request rectification or erasure of personal data or restriction of processing of personal data concerning you, and in case of a processing based on legitimate interest, you have the right to object to such processing;
• the right to lodge a complaint with the supervisory authority;
• where the personal data are not collected from the data subject, any available information as to their source;
• the existence of automated decision-making (if any), including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.

The purpose of the exercise of right may aim to assess and check the lawfulness of processing; therefore, in case of multiple requests for information, we may charge a reasonable fee for the fulfilment of the information requests.

We will provide you with an access to personal data in a form you ask which can be via email, by post or personal information.

The form is available here.

8.3 Right to rectification

You shall have the right to obtain from us without delay the rectification of inaccurate personal data concerning you.

The form is available here.

8.4 Right to restriction of processing

You shall have the right to obtain from us restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of the personal data (if there is no need for verification, we will not apply any restriction either);
• if the processing is unlawful but you oppose the erasure of the personal data and request the restriction of their use instead;
• we no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims; 
• you have objected to processing but it is based on our legitimate grounds (in this case, until the verification whether our legitimate grounds override yours, the processing must be restricted).

Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

We will inform you about the lifting of restriction of processing in advance (at least 3 working days before the restriction of processing is lifted).

Please note that in some cases the restriction of processing might have other consequences and thus you might lose some benefits going with processing (e.g. purchasing tickets on the Internet, obtaining discounts for fans or even losing the right to enter the pitch as a player). We will inform you about these contingencies during the exercise of this right.

The form is available here.

8.5 Right to erasure – right to be forgotten

You shall have the right to obtain from us the erasure of personal data concerning you without undue delay where one of the following grounds applies:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• you withdraw your consent, and there is no other legal ground for the processing;
• you object to the processing based on legitimate interest, and there are no overriding legitimate grounds (namely legitimate interests) for the processing;
• the personal data have been unlawfully processed, and it has been established on the basis of the complaint;
• the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which we are subject.

If, for any legitimate ground, we have made your personal data public and we are obliged to erase them for any reason listed above, and by taking account of available technology and the cost of implementation, we shall take reasonable steps, including technical measures, to inform other controllers which are processing the personal data that you have requested the erasure of any links to, or copy or replication of, those personal data (right to be forgotten). As a rule, we will not make your personal data public. The disclosure only concerns the registered and former registered football players’ data specified in the information notice on the public data bank of MLSZ. (You can find our information notice on the public data bank of MLSZ here)

The erasure shall not apply to the extent that processing is necessary:

• for exercising the right of freedom of expression and information;
• for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject (such case is, for example, the processing carried out during invoicing, since the storage of the invoice is required by law, or the compulsory registration of the sportsman, registration of the license);
• for the establishment, exercise or defence of legal claims (e.g. if we have a claim you have not fulfilled, or if the processing of a consumer complaint or a complaint against data processing is in progress).The form is available here.

8.6 Remedies

If you think we have breached a legislative provision relating to the processing of personal data, or we have not executed your request for the termination of alleged unlawful processing of personal data, you may request an investigation procedure from the Hungarian National Authority for Data Protection and Freedom of Information (mailing address: 1363 Budapest, Pf.: 9., email: ugyfelszolgalat@naih.hu).

Furthermore, please note that you also have the right to bring a civil action in a court. 

9. Security of personal data

By using necessary access managing, internal organisational and technical solutions during the operation of IT systems, we ensure that unauthorised persons cannot take possession of your data, unauthorised persons cannot erase, save the data from the system or modify them. We also enforce the privacy and data security requirements against our processor.

We keep records of the personal data breaches; according to our procedure for managing breaches, if a breach under the Regulation happens, we will inform you (if possible) and the supervisory authority.

10. Miscellaneous provisions

MLSZ reserves the right to modify its privacy policies in a way that has no effect on the purpose of the processing and its legal ground.

However, if we intend to carry out further processing of the data collected but for a different purpose than the purpose of collection, before the further processing, we will notify you about the purpose of the processing and the following information:

• the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
• your existence of the right to request rectification or erasure of personal data or restriction of processing of personal data concerning you, and in case of a processing based on legitimate interest, you have the right to object to the processing of personal data, and in case of processing based on consent or contractual relationship, you may request your right to data portability to be guaranteed;
• in case of processing based on consent, you may withdraw your consent at any time;
• your right to lodge a complaint with the supervisory authority;
• whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether you are obliged to provide the personal data and of the possible consequences of failure to provide such data;
• the existence of automated decision-making (if any), including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.

The processing can only begin after this. If the legal ground of the new processing is consent, your consent is required for the processing in addition to notification.

In other cases, we will inform you about the modification by notice placed on https://dataprivacy.mlsz.hu 

This Privacy Policy shall be valid from 28.07.2021.; its archived version - if available - can be found under the policy, among the downloadable documents.

Downloads

• MLSZ privacy policy for accreditation_20210728_.pdf
• MLSZ privacy policy for accreditation_12022021_REV_.pdf
• MLSZ privacy policy for electronic accreditation_31082020.pdf