Information About Data Protection

Privacy Policy applicable to the processing of personal data associated with the use of the www.volanbusz.hu website and the services of VOLÁNBUSZ Co. Ltd. by the passengers

In accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as GDPR), VOLÁNBUSZ Co. Ltd. hereby informs the visitors of the www.volanbusz.hu website about all facts related to all data processing processes associated with the use of the website. By their involvement in the respective process, Data Subjects shall become the data subjects of data processing in accordance with the present process description.

1. The Controller

VOLÁNBUSZ Co. Ltd.

H-1091 Budapest, Üllői út 131., www.volanbusz.hu, info@volanbusz.hu, +36 219-8000, represented by the Chief Executive Officer

2. The name and contact details of the Data Protection Officer (DPO)

dr. Krisztina Adél Vajda, adatvedelem@volanbusz.hu

3. The rules of processing

The present Privacy Policy is effective as of 25th May 2018 until withdrawal.

As the operator of the www.volanbusz.hu website (hereinafter referred to as the Website), VOLÁNBUSZ Co. Ltd. (hereinafter referred to as VOLÁNBUSZ) hereby informs its visitors that the processing of personal data associated with this Website shall be solely in accordance with this Privacy Policy.

This Privacy Policy was prepared in accordance with the Regulations on Data Protection of the CEO of VOLÁNBUSZ and it shall govern any and all processes carried out in the course of operating the Website where personal data is processed in accordance with Article 4 of the GDPR.

“Personal Data” means any information relating to an identified or identifiable natural person (“Data Subject”) an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

The terms used in the present Privacy Policy shall be construed in accordance with the definitions set forth in Article 4 of the GDPR.

VOLÁNBUSZ hereby declares that its data processing activities are in compliance with the applicable laws, therefore, it shall process Personal Data solely in accordance with the legal grounds described in Article 6 of the GDPR.

In the course of data processing, the data in processed by VOLÁNBUSZ shall be treated as personal as long as the Data Subject is identified or remains identifiable through it. Data shall be considered as personal data by VOLÁNBUSZ if it has technical facilities in place enabling it to identify the Data Subject from such data.

Any processing of personal data carried out by VOLÁNBUSZ shall comply with its intended purposes in each phase of such processing.

By publishing the present Privacy Policy, VOLÁNBUSZ hereby informs you (i.e. the Data Subject) about the purposes, legal grounds of processing, as well as the facts described in Article 13 of the GDPR.

Please note that VOLÁNBUSZ has work organizational, physical, IT and access control measures in place to prevent unauthorized access to such Personal Data, and its staff members are obliged to keep confidential any Personal Data acquired by them in the course of processing.

4. The Data Subjects’ rights

VOLÁNBUSZ hereby informs you that – after verification of your identity – you shall have the following rights under the GDPR:

you may request information of the processing of your Personal Data;
you may request the rectification of your Personal Data;
you may withdraw your consent to the processing;
you may request the erasure of your Personal Data if in your opinion they have been unlawfully processed, or if they they are no longer necessary in relation to the purposes for which they were collected or otherwise processed by VOLÁNBUSZ;
you may request the restriction of the processing of your Personal Data;
you may exercise your right to data portability.

VOLÁNBUSZ shall at all times endeavour to provide you with information in as concise, transparent, intelligible and easily accessible form and using as clear and plain language as possible, while it must also observe the rules set forth by the GDPR.

You may present your claim to VOLÁNBUSZ preferably in writing, by sending it to our DPO at the contact details indicated in Clause 1 of this Privacy Policy. In the event that you request oral information, subject to verification of your identity, the authorized staff member of VOLÁNBUSZ may provide you with oral information as well, if the necessary data are available to him/her. In any other case, our colleague will record the request and you will receive our response within a month from the receipt thereof. This deadline may be extended by up to two additional months, where necessary, taking into account the complexity of the subject request and number of currently handled requests, however, we shall inform you of any such extension within one month of receipt of the request, by electronic means.

Should we fail to take action on your request or if you contest the measures taken by us, you may seek legal remedy against VOLÁNBUSZ. You may lodge your complaint against our data processing practices to the Nemzeti Adatvédelmi és Információszabadság Hatóság (National Authority for Data Protection and Freedom of Information) or the Regional Court in whose jurisdiction your home address or temporary residence is established. Please note, however, that – in accordance with the decision-making practice of the National Authority for Data Protection and Freedom of Information – your complaint will only be considered by the Authority if you contact the Controller (i.e. VOLÁNBUSZ in this case) first and we fail to take action on your request or you contest the measures taken by us. Therefore, we recommend that you contact our DPO first.

Please be informed that the detailed rules of exercising your rights and legal remedies are set forth in Chapter 8 of the CEO’s Regulations on Data Protection of VOLÁNBUSZ, available on the Website of VOLÁNBUSZ, under Clause 2.I.1 of “Data of Public Interest” [//www.volanbusz.hu/hu/volanbusz/kozerdeku-adatok] as well as at our Customer Service.

5. Processing activities carried out in the course of using the Company’s Website

General rules applicable to all processing activities

VOLÁNBUSZ does not engage processors in its data processing activities. VOLÁNBUSZ does not transfer data to third parties. Data Subjects shall at all times be entitled to exercise their rights and legal remedies detailed in Clause 4 in respect of each processing activity.

The hosting provider of the Website is Wildom Kft. (H-1134 Budapest Róbert Károly Krt. 59., titkarsag@wildom.com).

5.1. Data processing related to the Website, Cookies

The Website of VOLÁNBUSZ is available to everyone without having to disclose their identity and personal data, and information on the Website and related pages is accessible freely and without restrictions. However, the Website automatically collects visitor information not associated with individuals without restriction. Certain parts of this Website use so-called Cookies. VOLÁNBUSZ has a separate Cookie Policy in place in respect of using such Cookies, available at the following link:

//www.volanbusz.hu/hu/adatvedelem/cookie

5.2. Contact information

VOLÁNBUSZ may be contacted in person, on telephone, in writing and via the Website. If the Data Subject contacts VOLÁNBUSZ orally (in person or on telephone) and the matter in question cannot be resolved immediately, the staff member of VOLÁNBUSZ shall take notes on the information provided by the Data Subject and transmits it to the competent organizational unit for handling.

If the Data Subject contacts VOLÁNBUSZ in writing, the written request received (by mail or handed over by the Data Subject in person in hard copy format) shall be filed by the responsible staff member and transmitted to the the competent organizational unit of VOLÁNBUSZ, where examination of the merits of the case shall commence.

If the Data Subject contacts VOLÁNBUSZ by e-mail, the staff member handling the respective e-mail address shall start to examine of the merits of the case, provided that the organizational unit of such staff member is capable of handling the merits of the case, otherwise such e-mail shall be transmitted to the the competent organizational unit, so that examination of the merits of the case may commence.

In order to ensure that you contact us the most efficient manner, we suggest that you use the following e-mail addresses:

Central e-mail (if you are unable to determine which organizational unit is competent in your case)	info@volanbusz.hu
Matters falling within the competence of the Customer Service	info@volanbusz.hu
Job applications	allas@volanbusz.hu
PR and Marketing, Media and Partner enquiries, issuance of permits for photography and filming	kommunikacio@volanbusz.hu
Traffic engineering matters associated with regular services and passenger traffic	forgalomtechnika@volanbusz.hu
Renting a coach, occasional services	buszberles@volanbusz.hu

In the event that Data Subjects contact VOLÁNBUSZ via these channels, their consent to processing shall be deemed as granted by voluntarily contacting VOLÁNBUSZ, while the present published Privacy Policy was available for them and they contact VOLÁNBUSZ by acknowledging this.

However, VOLÁNBUSZ offers its visitors the possibility to send their questions and comments to VOLÁNBUSZ by solely using the Website.

//www.volanbusz.hu/hu/kapcsolat/levelezes

By contacting us, Data Subjects shall disclose their name, e-mail address and message. Data Subjects, however, will be able to submit their data by accepting the Privacy Policy of VOLÁNBUSZ by ticking the relevant box, otherwise messages are prevented from being sent.

Purpose of processing: offering the possibility of contacting VOLÁNBUSZ, handling the submitted matter.

Legal grounds of processing: consent of Data Subjects in accordance with Article 6 Paragraph 1 Point (a).

Storage term: as long as the subject case is resolved.

5.3. Call for offers for occasional services

VOLÁNBUSZ offers coaches rentable for group trips, school trips, domestic trips and trips abroad, VIP business and private or custom-tailored trips.

Given that we handle each enquiry individually and consider the route, the number of participants, the requested type of coach, as well as specific requests when preparing our offer, such offers are specifically tailored for each enquiry. Therefore, in order for you to use our occasional services, first you need to request an offer.

Offers can be requested at buszberles@volanbusz.hu or by using the dedicated page of our Website (//www.volanbusz.hu/hu/volanbusz/szolgaltatasok/kulonjarat/ajanlat-keres). In order for us to provide you with a custom offer, we will need at least the following information:

identification and contact details (name, e-mail and telephone) of the person/entity requesting the offer;
travel information (destinations, number of passengers);

Optional: any other information that may help us to customize the offer.

Based on your call for offer, VOLÁNBUSZ will prepare your custom-made offer, which will be available during the term while the offer is binding in accordance with Section 6:64 of the Act V of 2013 on the Civil Code. Should you fail to accept the offer during the above-mentioned term, VOLÁNBUSZ shall erase your data, given that no conctract can be concluded on grounds of such data. In the event that you accept our offer, VOLÁNBUSZ shall prepare a contract for the rent, and request your personal data for concluding the contract. You will receive more detailed information about the foregoing upon entering into such contract.

Purpose of processing: preparing customized offers for renting coaches for occasional services, based on the call for offer submitted by the Data Subject.

Legal grounds of processing: consent of Data Subjects in accordance with Article 6 Paragraph 1 Point (a) of the GDPR.

Storage term: until the expiry of the term while the offer is binding.

5.4. Processing for occasional services of VOLÁNBUSZ

In accordance with Section 22 Paragraph (8) of the Government Decree No. 261/2011. (XII. 07.) on road transport, own-account transport and passenger transport services provided by coach subject to fees and own-account passenger transport services, as well as the modification of related laws, a passenger list shall be drawn up about the passengers travelling on the coach in case of passenger transport services offered within the scope of occasional services by economic operators established in Hungary. Such passenger list shall be attached to the journey form. VOLÁNBUSZ is an economic operator established in the territory of Hungary, therefore, occasional passenger transport services offered by it fall under the scope of the above-mentioned legal requirement.

Using the services may be subject to a prior call for offer, which is governed by Clause 5.3 in terms of data processing.

Purpose of processing: provision of occasional services and preparing related documentation.

Legal grounds of processing: VOLÁNBUSZ offers the services based on the needs of Data Subjects, however, under Article 6 Paragraph 1 Point (c) of the GDPR, it is bound by legal requirements in the course of processing, namely, Section 22 Paragraph (8) of the Government Decree No. 261/2011. (XII. 07.) on road transport, own-account transport and passenger transport services provided by coach subject to fees and own-account passenger transport services, as well as the modification of related laws (hereinafter referred to as the Government Decree).

Storage period: 8 years – in accordance with Section 22 Paragraph (4) of the Government Decree, the waybill and the journey form are documents subject to strict accounting regulations, and the passenger list shall form part of the journey form as per Section 22 Paragraph (8) of the Government Decree. In accordance with Section 169 Paragraph (2) of the Act C of 2000 on Accounting, such documents shall be retained for 8 years in a legible form.

5.5. Online ticket and pass purchase

Passengers of VOLÁNBUSZ may purchase their tickets online for any of the direct domestic lines of the Company and for certain direct domestic lines of Transport Centres (TCs) that joined the online ticket purchase system of VOLÁNBUSZ.

Tickets may be purchased online at:

https://webelin.volanbusz.hu/belfold/elovetel/xelinmain

Passes may be purchased online at:

https://webelin.volanbusz.hu/berlet/elovetel/xberletmain

For the purposes of data processing, the same rules apply to both ticket and pass purchases. For more details on Online ticket and pass purchase, please visit:

//www.volanbusz.hu/hu/jegy-es-berlet/jegyvasarlas/online-jegyvasarlas/tudnivalok-a-belfoldi-internetes-jegyvasarlasrol

The term of processing of personal data by the online sales platform shall be limited to the moment of purchase; however, data will be processed for the purposes of financial settlement within the scope of the legal relationship arising from the purchase.

If you do not request an electronic invoice of your purchase, only the confirmation of the purchase will be sent to the submitted e-mail address and the ticket(s) in pdf format, as an attachment thereof.

In the event that you request an electronic invoice, VOLÁNBUSZ will prepare it by using the disclosed invoicing data and send it to the submitted e-mail address. Given that – according to Section 165 Paragraph (1) of the Act of 2000 on Accounting – all economic transactions and events that result in any change in the inventories or composition of assets, or the sources thereof shall be documented (recorded), VOLÁNBUSZ is required by Section 169 Paragraph (1) to retain the data of the invoice issued for the customer for a period of eight years.

VOLÁNBUSZ does not process payment card information, payments are made via closed channels to which VOLÁNBUSZ does not have access. The only payment data VOLÁNBUSZ receives from the service provider CIB Bank Zrt. is whether such payment was successful.

Once the ticket or pass is produced, VOLÁNBUSZ shall process any other data regarding the purchase until the Civil Law claims arising from such legal relationship become time-barred.

For more information regarding the terms and conditions of travel, please visit:

//www.volanbusz.hu/hu/volanbusz/uzletszabalyzat/04a

Purpose of processing: offering online ticket and pass purchase services.

Legal grounds of processing: consent of Data Subjects given by using the online ticket and pass purchase platform, in accordance with Article 6 Paragraph 1 Point (a) of the GDPR.

Storage period:

from the issuance of tickets and passes, until the relevant civil law claims become time-barred
in accordance with Section 169 Paragraph (1) of the Act C of 2000 on Accounting, invoicing data shall be retained for eight years from the issuance of tickets and passes.

5.6. Processing frequent traveller data

VOLÁNBUSZ offers a FREQUENT TRAVELLER discount available throughout the year for those frequently using its services. In order for him/her to be able to use such discount, the passenger shall have a Frequent Traveller ID and a Frequent Traveller Card issued by VOLÁNBUSZ.

The Frequent Traveller ID shall be issued based on a request form completed and a "passport photo” attached by the passenger (dimensions 3.5x4.5 cm). The completed request form shall be submitted to the VOLÁNBUSZ Travel Centre in person or by mail. Address: H-1091 Budapest, Üllői út 131.

Based on such request form, VOLÁNBUSZ shall prepare the Frequent Traveller ID and the Frequent Traveller Card and send them to the passenger by mail or – if personal takeover was chosen – hand them over in person.

The International Pay Desk of VOLÁNBUSZ issues the fifth one-way or round-trip ticket free of charge, but, upon completing the section regarding the 5th travel, the so-used Frequent Traveller Cards shall be withdrawn.

With respect to the use of the Frequent Traveller discount, VOLÁNBUSZ will process the passenger’s personal data primarily at the time when such discount was requested, in order to issue the Frequent Traveller ID for the frequent traveller and to hand over the Frequent Traveller Card. VOLÁNBUSZ keeps a record of its frequent travellers, comprising of the data submitted on the request form and the frequent traveller number (Travel ID) generated by the system.

By using the Travel ID indicated on the so-withdrawn Frequent Traveller Card, VOLÁNBUSZ will be able to link the withdrawn Frequent Traveller Card to a specific frequent traveller, and therefore, it carries out data processing in such cases. As the Frequent Traveller Card qualifies as an accounting document used directly for accountancy within the meaning of Section 167 Paragraph (1) of Act C on 2000 on Accounting, VOLÁNBUSZ is required to retain it for a period of eight years in accordance with Section 169 Paragraph (1) of the same Act.

Frequent travellers may request at any time to be deleted from the register of frequent travellers; in such case, they will no longer be eligible for the frequent traveller discount, but their data will no longer be processed for such purposes by VOLÁNBUSZ. (If a frequent traveller is deleted from the system but, prior to the deletion, (s)he had a free travel with at least one Frequent Traveller Card, then the withdrawn Frequent Traveller Card will no longer be capable of identification, as once the data is erased, VOLÁNBUSZ will not be able to identify the data subject on the basis of the Travel ID in absence of personal data.)

For more details on the FREQUENT TRAVELLER discount, please visit:

http://nemzetkozi.volanbusz.hu/hu/jegy-es-berlet/dijszabasi-informaciok/torzsutas-program

Purpose of processing: Operating the FREQUENT TRAVELLER program and offering free trips for eligible frequent travellers.

Legal grounds of processing: consent of Data Subjects by applying for the FREQUENT TRAVELLER programme in accordance with Article 6 Paragraph 1 Point (a) of the GDPR.

Storage period:

until the erasure request of Data Subjects, that is, until their opt-out from the FREQUENT TRAVELLER program;
in accordance with Section 168 Paragraph (1) of the Act C of 2000 on Accounting, the Frequent Traveller Card used for free trips shall be retained for eight years from such free trip.

5.7. Photography and filming permits

Photography and filming on the premises and vehicles of VOLÁNBUSZ – irrespective of the intended use – is permitted exclusively on grounds of a "filming permit" issued on a case-by-case basis upon a granted request submitted to the Company's PR and Marketing Office at kommunikacio@volanbusz.hu .

The permit request shall contain at least the following data:

the applicant's data (name, address) and contact details;
the circumstances, date, purposes of filming/photography; and
in case of advertising and feature films, a brief description of the script of the film to be shot.

The decision on permitting the filming will be made by the competent organisational unit of VOLÁNBUSZ. If the permit is granted by VOLÁNBUSZ, this may be made subject to the payment of a fee. In such case, the applicant will be entitled to filming once the fee is paid, whereas, the data pertaining to the payment of the fee will be processed by VOLÁNBUSZ in accordance with the below terms and conditions. Failure by the applicant to pay the fee within the indicated deadline will result in the automatic rejection of the permit request.

According to Section 165 Paragraph (1) of the Act of 2000 on Accounting all economic transactions and events that result in any change in the inventories or composition of assets, or the sources thereof shall be documented (recorded). Data of all accounting documents reflecting such economic transactions (events) shall be entered in the accounting records. Payment of the fee by the Data Subject shall be considered as an economic transaction as detailed above.

Section 167 Paragraph (1) of the Act C of 2000 on Accounting sets forth the mandatory content of accounting documents used directly for accountancy and VOLÁNBUSZ is required to indicate such content on the proof of payment. In absence of the above, the payment may not be carried out in a lawful manner, therefore, VOLÁNBUSZ is required to retain such data for a period of eight years in accordance with Section 169 Paragraph (1) of the Act C of 2000 on Accounting.

However, VOLÁNBUSZ draws the attention of permit-holders to the fact that, even in possession of a permit, they shall comply with the applicable Hungarian laws, that is, they shall not breach the privacy rights of other individuals by such filming.

For more information on the issuance of filming permits, please visit:

//www.volanbusz.hu/hu/kapcsolat/elerhetosegek/sajtoszoba/fotozas

Purpose of processing: Permitting filming on VOLÁNBUSZ sites.

Legal grounds of processing: consent of Data Subjects by sending their request for the filming permit, in accordance with Article 6 Paragraph 1 Point (a) of the GDPR.

Storage period:

in case of refusal of requests: until such refusal;
in case of granted requests, if VOLÁNBUSZ does not require the payment of a fee by the applicant: until the rights and obligations arising from the film become time-barred;
in case of granted requests, if VOLÁNBUSZ requires the payment of a fee by the applicant and the latter failed to pay: until the subsequent working day following the expiry of the payment deadline;
in case of granted requests, if VOLÁNBUSZ requires the payment of a fee by the applicant and the latter paid: for eight years from payment in accordance with Section 168 Paragraph (1) of the Act C of 2000 on Accounting.

5.8. Processing of data of applicants

VOLÁNBUSZ will publish its job vacancies at //www.volanbusz.hu/hu/volanbusz/allasajanlatok. If you choose to send your CV to VOLÁNBUSZ, then, by way of sending your CV, you consent to the processing your personal data pertaining to your job application by VOLÁNBUSZ.

VOLÁNBUSZ will handle all job applications according to the same rules: whether you send your application via e-mail, post, or you hand it over in person at one of our Customer Service desks or stations. In the event that we receive your letter at allas@volanbusz.hu, you will be automatically sent a confirmaton. Please use this e-mail address only for matters relating to job applications.

VOLÁNBUSZ files all incoming CVs (as well as cover letters, subject to the same rules CVs). The data of applicants may be accessed within the organisation by the person responsible for the vacant position exercising employer's rights. If considered fit by the person exercising the employer's rights, the applicant will go through the recruitment process. If selected, his/her personal data will be processed by VOLÁNBUSZ for the purposes of establishing an employment relationship: further information on this will be provided to the applicant after the successful selection process.

In the event that the applicant is not selected for the given position or there is no vacant position fit for his/her qualifications, VOLÁNBUSZ will retain the CV for a maximum of one year after the subject year, for the purposes of contacting the applicant if a position opens up that is adequate for the applicant's qualifications.

VOLÁNBUSZ destroys or deletes filed CVs that are no longer processed on the last working day of each year: the period of processing is therefore the last working day of the year following the year when such CV was received.

Please note that if you wish to submit your CV via a person already employed by VOLÁNBUSZ, then you shall make a declaration confirming that you familiarized yourself these rules and the requirements related to the processing activities. The reason of the foregoing obligation is that, in principle, VOLÁNBUSZ processes personal data if it is received from the “owner” of such data (i.e. the Data Subject under the terms of law). Whenever an employee of VOLÁNBUSZ refers someone to us, the only way we can make sure that the applicant has the intention to apply to a job posted by us if this can be demonstrated in written form. Therefore, if this is the case, we kindly ask you and the referring person to complete the form on the last page of this Privacy Policy and Process Description, which can also be separately downloaded from www.volanbusz.hu. In the absence of the foregoing, VOLÁNBUSZ will not be able to accept CVs submitted by a person other than the applicant.

Purpose of processing: selecting an appropriate candidate for the positions open at VOLÁNBUSZ.

Legal grounds of processing: consent of Data Subjects by sending their CV, in accordance with Article 6 Paragraph 1 Point (a) of the GDPR.

Storage period: the last day of the sixth month from the receipt of the CV.

5.9. Operating of a security camera network

Please note that VOLÁNBUSZ operates an image-recording electronic surveillance system for the purposes of protecting the equipment located in public traffic areas and bus stations, buses used for passenger transport, ticket and pass vending machines, as well as the life, integrity, health and the property of passengers and the employees and agents of VOLÁNBUSZ, on the basis of the authorisation granted by Section 8 of the Act XLI of 2012 on the Services of Passenger Transport (hereinafter referred to as the Passenger Transport Services Act), and – in respect of private areas owned or used by VOLÁNBUSZ closed from public traffic – on the basis of the authorisation granted by Section 30 Paragraph (1) of the Act CXXXIII of 2005 on Security Services and the Activities of Private Investigators (hereinafter referred to as the Security Services Act). VOLÁNBUSZ will notify Data Subjects about the operation of such security camera network at each relevant location as well. This is a general information intended to facilitate awareness of passengers about the operation of security camera systems on the bus stations of VOLÁNBUSZ upon their arrival at such locations.

How and when recordings of the electronic surveillance system are erased and used

On the station:

Recordings – if not used – shall be erased on the 16th, that is the sixteenth day from recording (Section 31 Paragraph (2) of the Passenger Transport Services Act). Use shall mean the intended use of the recordings in judicial or other authority proceedings as evidence.

Any individual, whose rights or legitimate interests are affected by the image and sound recordings or the recording of his/her other personal data, shall be entitled to request VOLÁNBUSZ to destroy or refrain from destroying such data by demonstrating his/her legitimate interests. Upon the request of the court or any other authority, the image and sound recordings, as well as any other personal data shall be forthwith presented. In the event that the request of the court or any other authority is not made within 72 hours from the time when refraining from the destruction was requested, the image and sound recordings, as well as any other personal data shall be destroyed or erased by VOLÁNBUSZ, unless the storage period has not expired yet.

VOLÁNBUSZ may use the recordings to investigate the circumstances of accidents and damages of individuals using the services, users of equipment operated by VOLÁNBUSZ, its employees, agents and any person visiting the areas under its control, and luggage, vehicles, machinery and equipment, as well as any complaints submitted to VOLÁNBUSZ.

VOLÁNBUSZ shall be exempted from its erasure obligation for the period of such investigation but for a maximum of 30 days from the time when the event was recorded, provided that it was notified or otherwise gained knowledge of such event within 16 days from the recording thereof. VOLÁNBUSZ shall erase image recordings used for such investigation on the 15th day from the date when the investigation and the measures taken as a result thereof, or – in case of procedures granted by further legal remedies (including court procedures as well) – the decisions closing such procedures have become final and binding.

General information of processing:

Purpose of processing: camera surveillance for the purposes of protecting property, life and health.

Scope of data processed: the image of the Data Subject, other information available through images recorded by camera.

Legal grounds of processing: the legitimate interests of VOLÁNBUSZ and others visiting its areas in accordance with the authorization granted by Section 8 Paragraph (1) of the Passenger Transport Services Act (Article 6 Paragraph 1 Point (f) of the GDPR).

Storage period: 16/30 days as detailed above.

In private areas closed from public traffic:

Recordings – if not used – shall be erased 3, that is the three working days from recording (Section 31 Paragraph (2) of the Security Services Act). Use shall mean the intended use of the recordings in judicial or other authority proceedings as evidence.

Any individual, whose rights or legitimate interests are affected by the image and sound recordings or the recording of his/her other personal data, shall be entitled to request VOLÁNBUSZ to destroy or refrain from destroying such data by demonstrating his/her legitimate interests. Upon the request of the court or any other authority, the image and sound recordings, as well as any other personal data shall be forthwith presented. In the event that the request of the court or any other authority is not made within thirty days from the time when refraining from the destruction was requested, the image and sound recordings, as well as any other personal data shall be destroyed or erased by VOLÁNBUSZ, unless the storage period has not expired yet.

General information of processing:

Purpose of processing: camera surveillance for the purposes of protecting property, life and health.

Scope of data processed: the image of the Data Subject, other information available through images recorded by camera.

Legal grounds of processing: the legitimate interests of VOLÁNBUSZ and others visiting its areas in accordance with the authorization granted by Section 30 Paragraph (1) of the Security Services Act (Article 6 Paragraph 1 Point (f) of the GDPR).

Storage period: 3/30 days as detailed above.

Using of images recorded by the camera

In order for VOLÁNBUSZ to interfere with the privacy of Data Subject as little as possible, it shall draw up a protocol about each instance when images recorded by cameras are blocked. Images may be accessed only by staff members appointed by the CEO of VOLÁNBUSZ.

5.10. Processing associated with financial settlement and invoicing

According to Section 165 Paragraph (1) of the Act of 2000 on Accounting all economic transactions and events that result in any change in the inventories or composition of assets, or the sources thereof shall be documented (recorded). Data of all accounting documents reflecting such economic transactions (events) shall be entered in the accounting records. Using the services of VOLÁNBUSZ shall be considered as such economic transaction, provided that the customer of the services receives an invoice of such services.

Section 167 Paragraph (1) of the Act on Accounting sets forth the mandatory content of accounting documents used directly for accountancy and VOLÁNBUSZ is required to indicate such content on the proof of payment. In the absence of the foregoing, invoices are prevented from being lawfully issued. Furthermore, according to Section 167 Paragraph (1) Clause j), additional data may be prescribed by the relevant legislation, therefore, VOLÁNBUSZ shall also observe the provisions of Section 169 of the Act CXXVII of 2007 on Value Added Tax when issuing an invoice. Thus, according to Section 169 Clause e) of the same Act, the full name and address, as well as the VAT ID under Clause dc) of the customer of the services are mandatory information, but only if the amount of VAT charged is at least HUF 100,000.00

Therefore, if you request VOLÁNBUSZ to issue an invoice on any of its services for a natural person, private entrepreneur or small-scale agricultural producer, VOLÁNBUSZ shall process the data of these persons for such purposes under the mandatory requirements of the laws.

Access to invoices shall be granted to authorized personnel only.

On the other hand, VOLÁNBUSZ also receives invoices in connection with contractual relationships established with natural persons authorized to issue invoices. In the event that the issuer of an invoice is a natural person, then such invoice contains personal data. (In practice, this may be the case with individuals and private entrepreneurs whose VAT ID starts with 7.) Rules applicable to receipted invoices (content, retention method and period) are identical with those applicable to issued invoices.

Purpose of processing: carrying out and documenting financial settlement and invoicing in accordance with the legal provisions.

Scope of data processed: as per Section 169 Clause e) of the Act CXXVII of 2007 on Value Added Tax.

Legal grounds of processing: processing is started on grounds of the Data Subject’s consent (i.e. the Data Subject requests or issues the invoice) but it is also mandatory under the applicable legislation, therefore, compliance with the obligation set forth in Article 5 Paragraph 1 Point (c) of the GDPR, the legal grounds of processing shall be as per Sections 165 to 169 of the Act C of 2000 on Accounting and Section 169 of the Act CXXVII of 2007 on Value Added Tax.

Storage period: in accordance with Section 169 Paragraph (1) of the Act C of 2000 on Accounting, documents related to financial settlement shall be retained for 8 years.

5.11. Calls for offers submitted to VOLÁNBUSZ

If permitted by the nature of the subject service, using the services of VOLÁNBUSZ may be subject to a prior call for offers.

Given that we handle each enquiry individually and consider any specific requests when preparing our offer, such offers are specifically tailored for each enquiry.

In order for us to provide you with a custom offer, we will need at least the following information: identification and contact details (name, e-mail and telephone) of the person/entity requesting the offer; information related to the service(s) included in the call for offer (any data relevant to such service(s)).

Optional: any other information that may help us to customize the offer.

Based on your call for offer, VOLÁNBUSZ will prepare your custom-made offer, which will be available during the term while the offer is binding in accordance with Section 6:64 of the Act V of 2013 on the Civil Code. Should you fail to accept the offer during the above-mentioned term, VOLÁNBUSZ shall erase your data, given that no contract can be concluded on grounds of such data. In the event that you accept the offer, your personal data will be further processed by VOLÁNBUSZ in the course of processing associated with using the services, and you shall be informed about such processing upon establishing the relevant legal relationship.

Purpose of processing: preparing customized offers based on the call for offer submitted by the Data Subject.

Legal grounds of processing: consent of Data Subjects in accordance with Article 6 Paragraph 1 Point (a) of the GDPR.

Storage term: until the expiry of the term while the offer is binding.

5.12. Verification of passengers’ individual right to travel in relation to the fulfilment of a contract on passenger transport

In accordance with Section 7 Paragraph (1) of the Act XLI of 2012 on the Services of Passenger Transport (hereinafter referred to as the Passenger Transport Services Act) VOLÁNBUSZ – in its capacity as a transport provider carrying out public passenger transport services – shall be entitled to verify the data specified in Section 7 Paragraph (4) of the Passenger Transport Services Act of passengers using such services. The purpose of processing is the verification by VOLÁNBUSZ of travellers’ individual right to travel in relation to the fulfilment of a contract on passenger transport. It is also regulated in Section 7 Paragraph 1 of the Passenger Transport Services Act that VOLÁNBUSZ is entitled to delegate such rights to an agent, namely the member of VB Kontroll Consortium, DAKÖRT Kft. – while acting on behalf of VOLÁNBUSZ – will therefore have access to such data.

Given that accessing such data qualifies as a processing operation under Article 4 (2) of the GDPR, VOLÁNBUSZ and its processor are considered to carry out processing operations when accessing such data.

In accordance with Section 7 Paragraph (4) of the Passenger Transport Services Act, the right to access personal data by VOLÁNBUSZ – and therefore, DAKÖRT Kft. as well – shall cover the following scope of data:

personal identification data of the passenger (surname and first name(s), surname and given name(s) at birth, place and date of birth, mother’s maiden name), address, the type and number of the Data Subject’s official ID document, and – if (s)he is at least 14 years old – his/her signature as well;
in case of travel discounts, the legal title of such discount, the ID No., type, validity, issuer of the document serving as grounds for such entitlement, as well as the tax ID and social security number of the passenger;
in case of discounts applicable to specific destinations, the subject destinations; in case of discounts granted until a specific date or for a specific period, the term or expiry of validity.

VOLÁNBUSZ, however, shall have the right to access such data and not to store these. In the event that in the course of verifying a passenger’s right it is discovered that (s)he breached the General Terms of Business of VOLÁNBUSZ, the latter may record his/her personal data for the purposes of identifying such passenger failing to pay the fares or otherwise breaching the terms and conditions applicable to travelling. This, however, shall be deemed as processing for different purposes, which have a relevant individual Privacy Policy and Process Description in place.

Purpose of processing: verification of passengers’ individual right to travel in relation to the fulfilment of a contract on passenger transport.

Legal grounds of processing: conclusion or performance of a contract as per Article 6 Paragraph 1 Point (b) of the GDPR, where one of the parties is the Data Subject, and the contract shall qualify as a contract for the provision of passenger transport services established in accordance with the General Terms of Business of VOLÁNBUSZ and the Act XLI of 2012 on the Services of Passenger Transport.

Storage period: the data shall not be stored either by VOLÁNBUSZ or its processor for the purposes specified herein.

Processor engaged in the processing, the processing operations: DAKÖRT Kft. (H-6724 Szeged, Bakay Nándor u. 48.) – verification of travellers’ individual right to travel.

5.13. Verification of passengers’ rights to discounts granted by public service in relation to the fulfilment of a contract on passenger transport

In accordance with Section 7 Paragraph (1) of the Act XLI of 2012 on the Services of Passenger Transport (hereinafter referred to as the Passenger Transport Services Act) VOLÁNBUSZ – in its capacity as a transport provider carrying out public passenger transport services – shall be entitled to verify the data specified in Section 7 Paragraph (4) of the Passenger Transport Services Act of passengers using such services. The purpose of processing is the verification of travellers’ right to discounts granted by public service in relation to the fulfilment of a contract on passenger transport. It is also regulated in Section 7 Paragraph 1 of the Passenger Transport Services Act that VOLÁNBUSZ is entitled to delegate such rights to an agent, namely the member of VB Kontroll Consortium, DAKÖRT Kft. – while acting on behalf of VOLÁNBUSZ – will therefore have access to such data.

In accordance with Section 7 Paragraph (4) of the Passenger Transport Services Act, the right to access personal data by VOLÁNBUSZ –and therefore, DAKÖRT Kft. as well – shall cover the following scope of data:

personal identification data of the passenger (surname and first name(s), surname and given name(s) at birth, place and date of birth, mother’s maiden name), address, the type and number of the Data Subject’s official ID document, and – if (s)he is at least 14 years old – his/her signature as well;
in case of travel discounts, the legal title of such discount, the ID No., type, validity, issuer of the document serving as grounds for such entitlement, as well as the tax ID and social security number of the passenger;
in case of discounts applicable to specific destinations, the subject destinations; in case of discounts granted until a specific date or for a specific period, the term or expiry of validity.

VOLÁNBUSZ, however, shall have the right to access such data and not to store these. In the event that in the course of verifying a passenger’s rights to a discount granted by public service it is discovered that (s)he breached the General Terms of Business of VOLÁNBUSZ, the latter may record his/her personal data for the purposes of identifying such passenger failing to pay the fares or otherwise breaching the terms and conditions applicable to travelling. This, however, shall be deemed as processing for different purposes, which have a relevant individual Privacy Policy and Process Description in place.

Purpose of processing: verification of passengers’ rights to discounts granted by public service in relation to the fulfilment of a contract on passenger transport.

Storage period: the data shall not be stored either by VOLÁNBUSZ or its processor for the purposes specified herein.

Processor engaged in the processing, the processing operations: DAKÖRT Kft. (H-6724 Szeged, Bakay Nándor u. 48.) – verification of travellers’ individual right to travel.

5.14. Identifying passengers failing to pay the fares or otherwise breaching the terms and conditions applicable to travelling

In accordance with Section 7 Paragraph (1) of the Act XLI of 2012 on the Services of Passenger Transport (hereinafter referred to as the Passenger Transport Services Act) VOLÁNBUSZ – in its capacity of a transport provider carrying out public passenger transport services – shall be entitled to verify the data specified in Section 7 Paragraph (4) of the Passenger Transport Services Act of passengers using such services and process these to the extent necessary for fulfilling the contract as per Section 7 Paragraph (3). The purpose of processing is to enable VOLÁNBUSZ – in relation to fulfilling its services under the contract on passenger transport – to identify passengers failing to pay the fares or otherwise breaching the terms and conditions applicable to travelling, and to enforce the terms and conditions of the legal relationship between VOLÁNBUSZ and such passenger. Similarly, Section 7 Paragraph 1 of the Passenger Transport Services Act sets forth that VOLÁNBUSZ is entitled to delegate such rights to an agent, namely the member of VB Kontroll Consortium, DAKÖRT Kft. – while acting on behalf of VOLÁNBUSZ – will therefore have access to such data.

Through its agent, VOLÁNBUSZ – in relation to fulfilling its services under the contract on passenger transport – shall in principle and on grounds of Section 7 Paragraph (1) of the Passenger Transport Services Act, verify the passenger’s individual right to travel and the legitimacy of using certain discounts granted by public services. If in the opinion established by the agent of VOLÁNBUSZ in the course of such verification the passenger failed to pay the fare or otherwise breached the terms and conditions applicable to travelling, a processing activity with the purposes defined herein shall be carried out.

personal identification data of the passenger (surname and first name(s), surname and given name(s) at birth, place and date of birth, mother’s maiden name), address, the type and number of the Data Subject’s official ID document, and – if (s)he is at least 14 years old – his/her signature as well;
in case of travel discounts, the legal title of such discount, the ID No., type, validity, issuer of the document serving as grounds for such entitlement, as well as the tax ID and social security number of the passenger;
in case of discounts applicable to specific destinations, the subject destinations; in case of discounts granted until a specific date or for a specific period, the term or expiry of validity.

In accordance with the applicable General Terms of Business of VOLÁNBUSZ, each passenger shall enter into a contract for passenger transport services with VOLÁNBUSZ, thus establishing a legal relationship. This contractual relationship regulates the sanctions applicable to any breach, such as failing to pay the fare or otherwise breaching the terms and conditions applicable to travelling.

Therefore, the agent of VOLÁNBUSZ will record the personal data of the passenger in accordance with Section 7 Paragraph (3) of the Act XLI of 2012 on the Services of Passenger Transport, so that it may subsequently enforce its claims for breach against the passenger under the Civil Law, or process such data before the competent body for the purposes of criminal conviction in case of suspicion of a crime (such as forgery of pass).

As the legal basis of processing is the contract established by VOLÁNBUSZ and the passenger on the provision of passenger transport services and not the Data Subject’s consent, VOLÁNBUSZ hereby draws the attention of its passengers to the fact that the consent of the legal representative of individuals under the age of 16 shall not be required for the processing of the personal data of such individuals in accordance with this Process Description.

A contract for the provision of passenger transport services may also be concluded by incompetent minors as per Section 2:14 Paragraph (1) of the Act V of 2013 on the Civil Code, as such contracts are generally concluded in large numbers and do not require special consideration, therefore, they shall not be deemed as null and void and such Data Subjects may be subject to any verification thereunder or a claim asserted under Civil Law as detailed in Clause 5.15.

Purpose of processing: in relation to the fulfilment of a contract for the provision of passenger transport services, the identification of passengers failing to pay the fare or otherwise breaching the terms and conditions of travelling.

Storage period: until the time when the Civil Law claims become time-barred, as per Act XLI of 2012 on the Services of Passenger Transport 7. § (5).

Processor engaged in the processing, the processing operations: DAKÖRT Kft. (H-6724 Szeged, Bakay Nándor u. 48.) – identification of passengers failing to pay the fare or otherwise breaching the terms and conditions of travelling.

5.15. Asserting Civil Law claims against passengers failing to pay the fares or otherwise breaching the terms and conditions applicable to travelling

VOLÁNBUSZ assigned its right to assert Civil Law claims to its subsidiary indicated in this Privacy Policy, namely, DAKÖRT Kft. shall therefore be entitled to assert any such Civil Law claims and carry out the associated processing activities, while acting on behalf of VOLÁNBUSZ. Notwithstanding the foregoing, asserting of such claims shall not be the exclusive right of DAKÖRT Kft.; VOLÁNBUSZ may decide to directly enforce its Civil Law claims at any time during the procedure.

If –in relation to the contract for the provision of passenger transport services concluded by VOLÁNBUSZ and the passenger – it is discovered that the passenger failed to pay the fares or otherwise breached the terms and conditions applicable to travelling, and his/her behaviour was in breach of the General Terms of Business of VOLÁNBUSZ, then the latter may assert Civil Law claims against such passenger in accordance with Chapter XII of such General Terms of Business.

The procedure applicable to Civil Law claims shall be governed by Chapter IV Parts A/ to C/ Section 9 (“Control, payment of penalty”) of the General Terms of Business of VOLÁNBUSZ.

In accordance with Section 7. Paragraph (4). Act XLI of 2012 on the Services of Passenger Transport, VOLÁNBUSZ shall be entitled to process the following personal data in relation to the enforcement of Civil Law claims:

personal identification data of the passenger (surname and first name(s), surname and given name(s) at birth, place and date of birth, mother’s maiden name), address, the type and number of the Data Subject’s official ID document, and – if (s)he is at least 14 years old – his/her signature as well;
in case of travel discounts, the legal title of such discount, the ID No., type, validity, issuer of the document serving as grounds for such entitlement, as well as the tax ID and social security number of the passenger;
in case of discounts applicable to specific destinations, the subject destinations; in case of discounts granted until a specific date or for a specific period, the term or expiry of validity.

VOLÁNBUSZ shall retain and process such data in accordance with the principle of data minimisation, to the extent necessary, until the time when such Civil Law claims become time-barred, the latest. Given that Section 3 Paragraph (2) of the Government Decree No. 213/2012. (VII. 30.) on the detailed conditions of passenger transport services by bus, not regulated in the 181/2011/EU Regulation, the applicable exemptions, the conditions of passenger services by bus and the rules pertaining to the business regulations on passenger transport by road specifies that the claims under contracts for the provision of passenger transport services become time-barred after a year, this shall be the period of processing as well.

Purpose of processing: asserting Civil Law claims against passengers failing to pay the fares or otherwise breaching the terms and conditions applicable to travelling (imposing and the collection of penalties).

Storage period: until the time when the Civil Law claims become time-barred, as per Act XLI of 2012 on the Services of Passenger Transport 7. § (5).

Processor engaged in the processing, the processing operations: DAKÖRT Kft. (H-6724 Szeged, Bakay Nándor u. 48.) – asserting of Civil Law claims.

5.16. Processing in the course of complaint handling

In accordance with Section 18 Paragraph (1) of the Act XLI of 2012 on the Services of Passenger Transport, any individual using or intending to use bus and coach transport services (hereinafter referred to as the Complainant) shall be entitled to lodge a complaint with the authority having jurisdiction for bus and coach transport services, if (s)he can demonstrate using the complaint handling procedure of VOLÁNBUSZ but the outcomings thereof were not satisfactory to him/her.

The passenger or any individual using any other services of VOLÁNBUSZ offered in relation to passenger transport may submit his/her proposals, comments, prejudices or complaints, as well as any damages suffered by him/her to VOLÁNBUSZ, and request the investigation of the matter or behaviour at issue, as well as assessment of his/her proposals. Complaint handling involves the processing of personal data as well, given that the Complainant shall provide certain information in order for VOLÁNBUSZ to be able to examine of the merits of the case.

VOLÁNBUSZ has a complaint handling procedure in place; the regulations and procedures whereof are governed by Chapter III Section 5.7 (“Complaint Handling Platforms”).

VOLÁNBUSZ hereby draws the attention of Complainants that if VOLÁNBUSZ is not competent in a specific case od complaint due to the fact that it can be established from the facts presented in such complaint that it is not relevant to the services offered by VOLÁNBUSZ, the latter shall refuse such complaint without examining the merits of the case.

However, given that determining whether VOLÁNBUSZ is not competent in the case of a specific complaint requires official investigation of such complaint, therefore, VOLÁNBUSZ will close such case by informing the Complainant at the same time.

Due to the fact that the Complainant is not obliged to accept the opinion of VOLÁNBUSZ on the lack of its competence, in accordance with Section 18 Paragraph (1) of the Act XLI of 2012 on the Services of Passenger Transport, (s)he may lodge a complaint with the competent authority, and VOLÁNBUSZ – as the first instance legal entity investigating the complaint – shall file the case, even if the case is referred.

Purpose of processing: investigation of the complaint.

Legal grounds of processing: consent of Data Subjects by submitting the complaint, in accordance with Article 6 Paragraph 1 Point (a).

Storage period: VOLÁNBUSZ shall retain the protocol drawn up on the complaint and a copy of the response for five years, in accordance with Sections 17/A and 17/B Paragraphs (3) and (5) of the Act CLV of 1997 on Consumer Protection.

5.17. Processing associated with the investigation of passenger accidents on buses and the notification of the insurer

All information related to the insurance taken out by VOLÁNBUSZ in favour of passengers are detailed in Chapter IX of the General Terms of Business of VOLÁNBUSZ. In accordance with Section 2 Clause 2.1, passengers shall notify the driver about the insured event still during travelling, thus making it possible to clarify the causes and accurate circumstances of the occurrence.

The driver shall record the harmful event on a Passenger Statement Form and an Accident Protocol. The driver shall not refuse to draw up such protocol. If the insured party is unable to notify the driver about the accident (harmful event) due to his/her injuries, VOLÁNBUSZ shall draw up the protocol on its own initiative. The protocol shall also indicate the claims for damages, if any. The notification by the passenger about an accident or damaged luggage shall be made as soon as reasonable at the locations indicated in Annex 1 of the General Terms of Business of VOLÁNBUSZ. The representative of the Service Provider shall draw up a protocol about the insured event, which shall serve as grounds for the further handling of the case for insurance purposes. The same rules shall apply to accidents that occurred from entering until leaving passenger areas other than the bus, in such cases, however, VOLÁNBUSZ shall draw up a different protocol.

VOLÁNBUSZ draws the attention of Data Subjects to the fact that passengers shall submit their claims for damages covered by the insurance to UNIQA Biztosító Zrt. themselves, with the support by VOLÁNBUSZ. For such purposes, VOLÁNBUSZ shall provide passengers with Accident Insurance Claim Forms. In order for the passengers to be able to receive the benefits offered under the insurance services, all documents shall be submitted to the insurer that are required for establishing the insured event, the entitlement, as well as the amount of benefits. In addition to documents required for evidencing the claim for the insurer’s benefits (such as death certificate, certificate or final and binding decision issued by an authority, medical documents, the hospital’s final report) a photocopy of the ticket or pass valid for the day of travel or any other document authorizing to travel, as well as the protocol drawn up by the Service Provider. The Service Provider shall cooperate with the passenger or its authorized representative during the entire course of handling the case and provide them with all reasonable assistance for the procedure of the insurer. VOLÁNBUSZ hereby draws the attention of the Data Subjects to the fact that it shall not process any additional personal data other than those recorded in the protocol without legal requirements, therefore, any additional document required during the process shall be submitted to UNIQA Biztosító Zrt. and not VOLÁNBUSZ.

An additional reason why VOLÁNBUSZ requests the foregoing is that it is subject to the Government Decree No. 335/2005 (XII. 29.) on the common provisions of the document management in public administrative bodies. According to Section 14 of the said Decree, all documents received by VOLÁNBUSZ shall be filed and stored in accordance with its Document Management Regulations. Therefore, if the Data Subject submits documents to VOLÁNBUSZ, the latter shall handle them due to its legal obligations, even if such documents were irrelevant or excessive. Therefore, VOLÁNBUSZ hereby asks the Data Subjects to adhere to the principle of data minimisation and send information to VOLÁNBUSZ to the extent it is indispensable for the case in question. Otherwise, VOLÁNBUSZ shall process such data based on the consent of the Data Subject, but in accordance with its legal obligations.

Purpose of processing: notifying VOLÁNBUSZ about the insured event, the investigation and notification thereof to the insurer.

Legal grounds of processing: In accordance with Article 6 Paragraph 1 Point (b) of the GDPR, the fulfilment of rights and obligations under the contract for the provision of passenger transport services concluded by the passenger and VOLÁNBUSZ.

Storage period: VOLÁNBUSZ shall retain such data until the time when the liability for damages becomes time-barred.

In the course of processing, data shall be transferred to the following third parties under the indicated legal grounds: VOLÁNBUSZ may transfer the data to the Sickness Insurance and Claims Settlement Team of UNIQA BIZTOSÍTÓ Zrt. (H-1097 Budapest, Könyves Kálmán krt. 11. C épület 7. emelet – Népliget Center).

5.18. Processing related to requests for data of public interest and data public on grounds of public interest

VOLÁNBUSZ processes data of public interest and data public on grounds of public interest, therefore – in accordance with the rules applicable to “Access to public information upon request” under the Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information – it shall be considered as the “owner” of such data.

According to the Act, data of public interest shall be made available to anyone upon a request presented verbally, in writing or by electronic means.

In accordance with Section 30 Paragraph (3) of the Act, VOLÁNBUSZ shall keep records on the requests refused, including the reasons, and shall inform the National Authority for Data Protection and Freedom of Information thereof each year, by 31st January.

However, due to the following requirements, VOLÁNBUSZ shall keep records of all requests.

VOLÁNBUSZ shall not be obliged to fulfil such requests if the scope of the data included therein is identical to a prior request submitted by the same party within the same year; and storing of such data for a year is the only means available to VOLÁNBUSZ to comply with this requirement;
VOLÁNBUSZ shall erase such data after the expiry of the one-year term from the request; and in case of payment of the relevant costs, the personal data of the requesting party shall be forthwith erased;

Therefore, VOLÁNBUSZ shall retain the data of the requesting party for one year from the date of such request or until the payment of costs, whichever is longer.

Purpose of processing: keeping records of requests for data of public interest and data public on grounds of public interest.

Legal grounds of processing: compliance with the obligations set forth in Article 6 Paragraph 1 Point (c) of the GDPR, in accordance with the provisions set forth in Section 28 Paragraph (2) and Section 30 Paragraph (3) of the Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information.

Storage period: VOLÁNBUSZ shall forthwith erase the data upon the expiry of the term described in Section 29 Paragraph (1a) of the Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information or upon the payment of costs.

In the course of processing, data shall be transferred to the following third parties under the indicated legal grounds: VOLÁNBUSZ shall transfer such data – in the event of refused requests – to the National Authority for Data Protection and Freedom of Information thereof each year, by 31st January in accordance with Section 30 Paragraph (3) of the Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information.

5.19. Processing related to lost and found items

In accordance with Section 5:59 Paragraph (1) of the Act V of 2013 on the Civil Code (hereinafter referred to as the Civil Code), the finder shall relinquish possession of items found in publicly accessible buildings and areas or on the vehicles of a public transportation companies, such as VOLÁNBUSZ, to an employee of the operator of such buildings or means of transportation without delay. The finder may not lay claims to such items.

Chapter XV of the General Terms of Business of VOLÁNBUSZ. Section 1, Clauses 1.1 and 1.2 set forth the rules of handing over ad taking over of lost and found items.

VOLÁNBUSZ is specifically identified in the Civil Code in connection with the handling of lost and found items, therefore, in accordance with Clause 1.4, by exercising its powers of public interest, VOLÁNBUSZ shall enter into its records any lost and found items when handed over to it. A copy of such records shall be signed by the person handing over such items, confirming the accuracy of the entries related to the item, as well as the circumstances of finding it; whereby a processing activity is commenced in respect of the finder and the “employee of the operator” under the Civil Code.

Safeguarding of lost and found items shall be governed by Section 2 of the relevant part of the General Terms of Business.

In the event that the rightful holder does not show up, VOLÁNBUSZ shall sell the lost and found item, except for the cases when it is perishable or cannot be safeguarded, where VOLÁNBUSZ shall provide for its sale without delay upon the handing over thereof. An additional protocol shall be drawn up on the sale of such items, and – the sale being an economic transaction – a documentation in accordance with the relevant accounting rules.

If the rightful holder shows up prior to the sale, the item shall be delivered to him/her; in case such person shows up after the sale, the proceeds thereof shall be delivered to him/her. In case the rightful holder fails to show up within one year from the finding of the item, (s)he will use the title to claim for the item or the proceeds from its sale.

In accordance with Clause 3.4 of the General Terms of Business, VOLÁNBUSZ shall hand over lost items against a confirmation of receipt, which shall indicate the details of the recipient (name, address, ID Card No.), the place where and the time when the item was found, the specifications, content and condition of the lost and found item, which shall qualify as further processing activities by VOLÁNBUSZ.

However, the legal basis of processing is not consent of Data Subjects but the exercise of official authority in accordance with Article 6 Paragraph 1 Point (e). The purpose of ensuring that property is held by the owner and no items of value become res nullis shall justify the exercise of official authority. Therefore, the Civil Code specifically mentions public transportation companies in the procedure applicable to the returning of lost and found items to their owner (or to the selling thereof, and as such, to the overall social benefit, as the State will benefit either from the found item or the proceeds from its sale). In the course of exercising its official authority, VOLÁNBUSZ carries out processing activities in order for the lost and found items to be documented and trackable from the moment of finding them.

Purpose of processing: compliance with the legal requirements applicable to lost and found items, in accordance with Chapter XVII of the Civil Code.

Legal grounds of processing: exercise of official authority vested in the Company by the Civil Code in accordance with Article 6 Paragraph 1 Point (e) of the GDPR; safeguarding and returning of lost and found items to their owner or selling them in the capacity of a public transportation company shall qualify as the exercise of official authority (Section 5:59 of the Civil Code).

Storage period: in accordance with Section 61 Paragraph (4) of the Government Decree No. 335/2005 (XII. 29.) on the common provisions of the document management in public administrative bodies, VOLÁNBUSZ – in its capacity of public administrative body – shall store both hard copy and electronic case files in compliance with the Document Management Regulation, therefore, it shall draw up a protocol about the handing-over, sale, destruction, as well as the returning of the lost and found item to the owner and handle such protocol in accordance with the CEO’s Regulation on Document Management.

5.20. Processing associated with Call Centres

In accordance with the provisions of Section 17/B of the Act CLV of 1997 on Consumer Protection (hereinafter referred to as the Consumer Protection Act), VOLÁNBUSZ – in its capacity of public service provider – operates a Call Centre, therefore – in line with the requirements set forth in Section 17/B Paragraph (3) of the Consumer Protection Act, it shall record all oral complaints lodged on the phone, as well as all telephone communications between the Call Centre and the consumer.

The sound recordings shall be provided with unique identifiers and retained for five years.

The individual calling the Call Centre shall be informed about the foregoing prior to commencing the conversation.

In accordance with Section 17/B Paragraphs (3a) and (3b), the consumer – in the case of VOLÁNBUSZ, the passenger – shall have the right to listen to the sound recording free of charge within 30 days from the receipt of the passenger’s subject request, and receive one copy from each sound recording, and – upon the consumer’s request – such copy shall be made available to him/her in electronic format as well.

As the so-recorded sound is the personal data of the caller and given that certain personal data may also be mentioned during the conversation, and as such, processed by VOLÁNBUSZ, the foregoing shall qualify as processing in accordance with the legal requirements.

Purpose of processing: granting the rights of consumer (passenger) specified in Section 17/B of the Act CLV of 1997 on Consumer Protection (hereinafter referred to as the Consumer Protection Act) in the course of operating a Call Centre.

Legal grounds of processing: compliance with the obligations set forth in Article 6 Paragraph 1 Point (c) of the GDPR by fulfilling the mandatory sound recording obligations as per Section 17/B Paragraph (3) of the Consumer Protection Act.

Storage period: five years from the date of recording (According to Section 17/B Paragraph (3) of the Consumer Protection Act, “sound recordings (…) shall be retained for five years”).

5.21. Processing associated with international passenger transport

In addition to domestic lines, VOLÁNBUSZ also operates international lines in accordance with international timetables. VOLÁNBUSZ shall carry out these activities by using buses owned by it or its subcontractors, with a significant cooperation with foreign partners.

Bus and/or coach undertakings operating other international lines engaged VOLÁNBUSZ to carry out certain specific tasks locally, such as the distribution of tickets.

Tickets for international lines may be purchased both online and in person (directly at the Népliget Coach Station or travel agencies), and the operator shall receive a passenger list for the respective line(s) (indicating the name, ticket number, destinations).

In the course of international passenger transport, the provider shall make sure prior to commencing the services that the passenger has in his/her possession the travel documents required for entering or travelling through specific destinations. In the event that the passenger fails to present such travel documents, boarding the vehicle shall be refused, even if such passenger has a valid ticket. In the course of purchasing a ticket online, the name, date of birth of the passenger, as well as the number of the travel document (s)he will carry shall be submitted. Such data shall be stored within the computerized ticket vending system for 8 years, as the ticket qualifies as a proof of receipt as well, therefore, it shall be retained in accordance with the relevant financial requirements.

In case of lines operated by other bus and/or coach undertakings, the purchase of tickets is covered by the protection of personal data. In the course of carrying out its ticket-selling tasks on behalf of other providers, VOLÁNBUSZ shall also qualify as controller.

Purpose of processing: selling of tickets by VOLÁNBUSZ on its own account and on behalf of others.

Legal grounds of processing: performance of a contract in accordance with Article 6 Paragraph 1 Point (b) of the GDPR.

Storage period: until the time when the rights and obligations arising from the provision of international passenger transport services become time-barred.

6. Matters not regulated in this Privacy Policy

Any matters not regulated in this Privacy Policy shall be governed by the provisions of the GDPR.