UEFA U21 EC Accreditation
Privacy Notice
The data controller of the personal data processed on the basis of this Privacy Notice - also in view of Section 8.1 - is the Hungarian Football Federation (registered office: 1112 Budapest, Kánai út 2.D., Hungary; tax number: 19020848-2-44; stat. ID: 01-99-016139; hereinafter „MLSZ” or „we”), and as such, is responsible for ensuring that the data are processed in accordance with the applicable legislation.
The purpose of this privacy notice is to provide information on the data processing carried out by MLSZ in connection with the accreditation procedure for the U21 European Championships (“Programme”) to be held in 2021 under the auspices of the Union of European Football Associations (“”).
Summary
The preparation of this Privacy Notice and the supply of information on its provisions is required by Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”).
The processing of your personal data is necessary in order for MLSZ to be able to conduct the accreditation procedure required for entering matches and related events held in Hungary within the framework of the Programme in an appropriate manner.
The purpose of this Privacy Notice is to provide a detailed and comprehensive description of the data processing activities performed in achieving the above data processing goals and their main features (especially the data processed, the purpose of the data processing, legal ground, data retention period, information on possible data transfer).
If you have any further questions regarding this Privacy Notice, in particular how MLSZ uses and protects your personal information, please contact us at one of our contact details indicated in section 1.
1. Which company is responsible for processing your personal information?
The data controller of the personal data processed on the basis of this Privacy Notice, subject to the provisions of Section 8.1, is MLSZ.
Data controller’s data:
Name: Hungarian Football Federation
Registered office: 1112 Budapest, Kánai út 2.D.
E-mail address: mlsz@mlsz.hu
Name of the data protection officer: Dr Ádám Németh
E-mail address of the data protection officer: adatvedelem@mlsz.hu
Postal address: 1386. Budapest 62. Pf. 906/1
2. What do the terms "personal data" and "processing of personal data" mean?
In this Privacy Notice, the term “personal data” means information that, alone or in combination with other information, may be used to identify a natural person, as well as any other data that, under the law applicable to MLSZ, including the GDPR, are considered personal data.
This Privacy Notice covers all personal information that is processed about you in any form under applicable law, including personal information collected, retained, stored, transferred, disclosed or otherwise used by MLSZ.
3. What personal information do we process and for what purposes?
MLSZ will only collect and process your personal data as described in this Privacy Notice and as set out in the “Data Processing Table” in Section 8.1. We do not use your personal information for profiling or automated decision making about you.
4. How do we protect your personal data?
MLSZ has put in place appropriate technical and organisational measures to protect your personal data so that only authorized individuals have access to them. MLSZ uses technical security systems such as firewalls, encryption technologies, passwords and anti-virus programs to prevent and avoid unauthorized use of personal data.
If any breach of the security systems and measures would result in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to personal data, MLSZ shall, without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. If the personal data breach is likely to involve a high risk, then MLSZ will inform you without undue delay about the Personal data breach, as well as its nature, the details and the measures taken.
5. How long do we store your personal data?
MLSZ will not store or process your personal data for longer than necessary to achieve the data processing purposes set out in this Privacy Notice or as required by any mandatory and binding law, as explained in detail in the “Data Processing Table” in Section 8.1.
Accordingly, when the purpose of data processing in relation to a certain type of personal data is achieved, MLSZ will erase or anonymise the relevant personal data as soon as possible.
6. Who do we share your personal data with?
Your personal data (with the exception of health data on the fact, suspicion and symptoms of Covid-19 coronavirus disease) will be shared with Totáljegy Kft., Heroku (https://www.heroku.com/about) and Amazon Web Service (AWS) http://aws.amazon.com/privacy/),) as data processors.
In the event of a mandatory and binding legal requirement, MLSZ will transfer your personal data to the competent authorities that have jurisdiction (e.g., police) or courts. In these cases, the legal ground for the data transfer is the fulfilment of the legal obligation of MLSZ [Article 6 (1) (c) GDPR].
After the completion of the Group Matches of the Programme, MLSZ may transfer to UEFA your personal data, with the exception of health data on the fact, suspicion and symptoms of Covid-19 coronavirus disease, to conduct the direct knockout phase of the Programme (expected to take place between 24 May and 6 June 2021, when UEFA will be the Data Controller for accreditation) under conditions appropriate for UEFA in order to ensure that already registered data subjects do not have to re-register and that the Programme is implemented smoothly. In this case, the legal ground of data transfer is the legitimate interest of MLSZ [Article 6 (1) (f) of the GDPR]. Following the data transfer, UEFA becomes the Data Controller of your personal data. If the data are transferred, UEFA, as the data controller, will inform you about the Privacy Notice on the processing of your personal data by UEFA
7. To which countries will we transfer your personal data?
We do not transfer your personal data to any country outside Hungary, except if MLSZ decides that it transfers your personal data to UEFA under appropriate conditions. In this case, your personal data are transferred to Switzerland where UEFA’s registered office is located. The data transfer is based on Article 45 of the GDPR, on the basis of a Commission conformity decision.
8. Data processing table
The Data processing table under Section 8.1 provides an overview of the categories of your personal data collected and processed by MLSZ and the data processing purposes of such data categories.
The following terms, which may need explanation, are listed in the table:
- Purpose: In all cases, the processing must be for a specific, clear and legitimate purpose. So the purpose of the data processing indicates the exact purpose in the interest of which MLSZ conducts its data processing activity.
- Legal ground: The data processing specified in this Privacy Notice must take place on an appropriate legal ground as defined in the GDPR. The legal ground is therefore the legal ground set out in the GDPR on which lawful data processing is based.
- Retention period or criteria: In this column, MLSZ determines the time frame of storing your data.
8.1 Data processing for the purpose of accreditation enabling access to matches and related events held in Hungary within the framework of the Programme.
Applicants for accreditation (data subjects):
|
Category |
Data subject group |
|
Organisers |
UEFA, UEFA Events S.A., MLSZ, partner agencies, observers and members of staff of other organisations |
|
Teams |
Players and officials of the participating teams |
| Security services |
Organisers, police, firefighters, first aid service and members of the security service |
| Media service providers |
Staff members of the host media service providers and UEFA’s television and radio partner organisations |
| Press organisations that do not qualify as media service providers |
Press officers, video journalists, photographers, photo editors and technicians, social media reporters |
| Subcontractors |
Radio and TV reporters, cameramen, other radio and television staff |
|
Trading partners |
Staff of trading partners, youth programmes and sales people |
|
Service providers |
Employees of service providers and suppliers |
Processed data:
|
Details of the natural person requesting accreditation |
A) point
|
|
Type and source of personal data |
Purpose | Legal ground | Retention period or criteria |
|
8.1. Data specified in paragraph A) Source: The personal data of the individual requesting accreditation are recorded by you or your employer/principal at the https://accesscontroll.com website. |
The purpose of the accreditation process and the creation of the user account is to provide MLSZ with information on the natural persons requesting accreditation in connection with the sports events to be held in Hungary in connection with the Programme, to make the process of applying for, issuing and storing accreditation traceable and to increase the safety of events. | The legitimate interest of MLSZ (Article 6 (1) (f) of the GDPR) | Data used during accreditation will be erased 60 days after the match. |
|
Data specified in paragraph 8.1 B) i.e., health data on the fact, suspicion and symptoms of Covid-19 coronavirus disease Source: The epidemiological statement is completed by you or, in the case of a data subject under the age of 18, their legal representative, on behalf of the person requesting accreditation, when entering the Programme sites. In case of confirmed a confirmed coronavirus infection caused by Covid-19 or its suspicion, you or, in the case of a user under the age of 18, their legal representative, notify the Chief Physician of the MLSZ of the fact or suspicion of the infection by e-mail.
|
The completion of the epidemiological statement, the fact of confirmed or suspected coronavirus infection caused by Covid-19 is necessary for the safe and epidemiological implementation of the Programme in order to minimise the possibility of a viral infection during matches. | The legitimate interest of the MLSZ [Article 6 (1) f) of the GDPR; Article 9 (2) f) and i) of the GDPR]. | The epidemiological data used during accreditation are erased 28 days after conducting the Programme. |
8.2 Special provisions relating to the COVID 19 pandemic
In order to prevent the spread of the COVID-19 virus, the UEFA set out in a document called ‘Return to Play Protocol’ the control measures to be followed at international events.
In accordance with the Protocol, it is not mandatory for a SARS-CoV-2-RNA test to be performed prior to a match for persons attending the match but not authorised to enter the team zone.
However, these persons must complete the epidemiological statement provided for in the Protocol and be subjected to a body temperature measurement at the time of entry. No identification takes place during body temperature measurement, only statistical data are collected (e.g.: how many people are not admitted to the event). The data subjects with access to the team zone are subjected to a SARS-CoV-2 RNA test.
8.3 With regard to the processing included in Section 8.1.A), Totáljegy Kft. qualifies as a processor, which develops and operates the IT system for the management, issuance and registration of accreditations. Totáljegy Kft. uses cloud-based backup during the operation of its IT systems used for the accreditation process, storing the data locally on the servers of Heroku (https://www.heroku.com/about), with the images required for accreditation stored on the servers of Amazon Web Service (AWS) (http://aws.amazon.com/privacy/). The two service providers (Heroku and AWS) process the data on the basis of a data processing contract drawn up by the Commission of the European Union.
8.4 We have a legitimate interest in the processing of your personal data
The above-mentioned data processing is based on a legitimate interest of the MLSZ in the field of data processing, i.e. for the MLSZ to have information on the identity of natural persons applying for accreditation in relation to sports events to be held in Hungary in connection with the Programme and expected to be of significant public interest, to make the process of applying for, issuing and storing accreditation traceable, to increase the security of events and for the MLSZ to conduct the Programme in a safe way, in accordance with the epidemiological regulations, thereby helping to reduce the potential for viral infections caused by Covid-19 to a minimum. In this context, it is in the MLSZ's legitimate interest to be able to demonstrate the implementation of UEFA's Return to Play Protocol.
The requirement is for your interests, fundamental rights or freedoms not to take precedence over a legitimate interest, and for you to have the right to object. Subject to the restrictions related to data processing, in connection with the security measures implemented by MLSZ, as well as the technical and organizational measures, MLSZ stated that where the processing of your personal data is based on the legitimate interests of MLSZ, your interests, fundamental rights or freedom of data protection shall not take precedence over such interests. You may contact us at any time to request further information on how we came to this conclusion.
9. What are your rights regarding your personal information?
Right to access and rectification
You have the right to receive information about the personal data processed about you by MLSZ, the source of the data, the purpose of the use of the data and the identity of the parties to whom the data were transferred by MLSZ. You also have the right to request the rectification of any inaccurate or incomplete personal data at any time. However, if your request is clearly unfounded or, in particular because of its repetitive nature, excessive, MLSZ may charge a reasonable fee or refuse to act on the request.
Right to erasure (‘right to be forgotten’)
You have the right to request the erasure of your personal data in certain circumstances if, e.g., (i) your personal data are no longer necessary for the purposes for which they were collected and (ii) there is no legitimate reason to continue processing the data, or the data processing is illegal or the personal data must be deleted in order to comply with the legal obligation applicable to MLSZ. This list is not exhaustive. Please contact MLSZ for more information on the erasure of your personal data.
Right to protest
You have the right to object to certain data processing or to request a restriction on the processing of your personal data if (i) your personal data may be inaccurate, or (ii) you consider the data processing to be unlawful, or (iii) you believe that MLSZ you no longer need your personal data for the purposes specified in the “Data Management Table” under Section 8.1.
How to exercise rights
You can find out what rights you have for the individual legal grounds and what rights you can exercise at the following link: https://adatvedelem.mlsz.hu/altalanos-adatkezelesi-tajekoztato
If you wish to exercise any of your rights, you may do so as set out in the prospectus at the following link: https://adatvedelem.mlsz.hu/adatbejelento-urlap
10. What should you do if you have a complaint?
If you have any complaints about how we use your personal information or need more information, please contact us first. However, you may at any time lodge a complaint against the processing of your personal data by us with the competent national supervisory authority, i.e., the Hungarian National Authority for Data Protection and Freedom of Information (address: 1055 Budapest, Falk Miksa utca 9-11., Postal address: 1363 Budapest, PO Box: 9., phone number: +36 (1) 391-1400, E-mail: ugyfelszolgalat@naih.hu).
Without prejudice to your rights to enforce your complaint, if you consider that your rights under this Privacy Notice have been infringed as a result of your personal data not being processed in accordance with applicable law, you may bring legal proceedings before the competent courts.
However, in all cases, in order to resolve the problem more quickly and efficiently, you should first send your complaints or questions to MLSZ before contacting the authorities.
Complaints related to data processing will be answered within 1 month at the latest, which we have the right to extend for another 2 months, if necessary, taking into account the complexity of the request and the number of requests.
11. Updates
MLSZ is authorised to amend this Privacy Notice at any time.
This present Privacy Notice is effective from 16 March 2021. Its saved version is available among the downloadable documents below the Notice.
