Privacy Policy
Movement-Without Disabilities Foundation
Effective from: 08.11.2026
1. Introduction, Purpose and Scope
This Privacy Policy and Privacy Policy (hereinafter referred to as the Policy) regulates the basic rules of data processing involving personal data by the Foundation Without Movement Barriers (hereinafter referred to as the Foundation). The Policy applies in particular to website visitors, donors, persons requesting proof of donation, contact persons, persons exercising data subject rights, and the legal representatives of supported children as external information. As an internal rule, it is binding on the Foundation's officials, staff and contributors involved in data processing.
The scope of the Policy covers the operation of the https://mozgaskorlatoknelkul.hu website, online donations, administration related to donation certificates, support histories published on the website, electronic communication, as well as data security and incident management processes. The data processing of external service providers for their own purposes is governed by their own information; the Foundation does not control their content.
1.1. Official data of the Foundation
| Name | Data |
|---|---|
| Name of the Data Controller | Foundation Without Barriers to Movement |
| Foreign Language Name | Moving Without Limits Foundation |
| Short Name | MKN Foundation |
| Headquarters | 8200 Veszprém, Boglárka utca 2/c. |
| Court of Registry | Veszprém Regional Court |
| Registration number | 19-01-0001989 |
| Tax number | 19444082-1-19 |
| Persons entitled to represent | Bernadett Chen-Wölfinger – with independent right of representation; Judit Boda-Sipeki, Anita Csányi, Gabriella Németh and Renáta Krisztina Pekala – with joint right of representation, with a fellow member of the Board of Trustees |
| mknalapitvany@gmail.com | |
| Phone | 06 30 630 4645 |
| Website | https://mozgaskorlatoknelkul.hu |
1.2. Members of the Board of Trustees and the Representation
The members of the Foundation's Board of Trustees are: Bernadett Chen-Wölfinger, Judit Boda-Sipeki, Anita Csányi, Gabriella Németh and Renáta Krisztina Pekala. Bernadett Chen-Wölfinger has an independent right of representation. Judit Boda-Sipeki, Anita Csányi, Gabriella Németh and Renáta Krisztina Pekala exercise their right of representation jointly with a fellow member of the Board of Trustees.
The aim of the Foundation is to provide complex support to children with different developmental paths, to promote their rehabilitation and habilitation, as well as to support the financing of medical interventions, surgeries, medical treatments, rehabilitation aids and devices that help children integrate into school and society. In the course of data processing, the Foundation does not process more data than is necessary for the achievement of these purposes or the fulfilment of its legal obligations.
1.3. Concepts and principles
The terms used in the Policy shall be interpreted primarily in accordance with Article 4 of the GDPR. Data controller is the Foundation, data processor is the natural or legal person that processes personal data in the name of and on the basis of the instructions of the Foundation. Recipient is the person or organisation to whom the data is disclosed; in the case of data processing for own purposes, the recipient may act as an independent data controller.
- Lawfulness, fairness and transparency: all processing must be linked to a defined, clear purpose and an appropriate legal basis.
- Purpose limitation and data minimisation: data can only be processed for a specific purpose, to the extent and for the necessary time.
- Accuracy and limited storage: inaccurate data must be corrected, data that has become unnecessary must be deleted or anonymized.
- Integrity and confidentiality: the data must be protected by appropriate technical and organisational measures.
- Accountability: the Foundation must be able to verify the lawfulness of the processing and the measures taken.
2. Legal background
In particular, the Policy is based on the following sources of law, in accordance with the provisions governing the given data processing:
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, GDPR), in particular Articles 5 to 7, 9, 12 to 22, 24, 25, 28, 30, 32 to 34 and 44 to 49.
- Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (Privacy Act), in particular Sections 2, 5, 25/A and 25/I.
- Act C of 2003 on electronic communications, in particular Section 155 with regard to information stored on or accessed by terminal equipment.
- Act CVIII of 2001 on Electronic Commerce Services and Information Society Services, in particular Section 4.
- Act C of 2000 on Accounting, in particular Section 169 with regard to the preservation of accounting documents and the records supporting them.
- Act CLXXV of 2011 on the Right of Association, the Public Benefit Status, and the Operation and Support of Civil Society Organisations, in particular Sections 17–20 and 24–26.
- Government Decree 350/2011 (XII.30.) on certain rules on the management of civil society organisations, fundraising and donation, in particular Sections 5 and 11.
- Act CL of 2017 on the Rules of Taxation, in particular Section 202, if the data processing is related to the provision of data by the tax authority or the retention of tax documents.
- Government Decree No. 479/2016 (XII.28.) on the specifics of the reporting and bookkeeping obligations of certain other organisations under the Accounting Act, in particular Article 9. §.
The legal basis and retention period of the specific data processing are set out in the process descriptions below. If a discrepancy arises due to a change in the law, the modification of the service provider contract or a change in technical operation, a more favourable data protection solution in accordance with the law and the actual data processing shall be applied, and the Policy shall be updated.
3. Informing the controller and the data subjects
The data controller is the Foundation; the current chairman of the Board of Trustees acts on its behalf. Requests and comments related to data processing can be submitted at the mknalapitvany@gmail.com e-mail address or by post at the address of the registered office.
The data subject receives the information in a concise, understandable, easily accessible and clear form. This document is continuously available on the website; when using the individual forms and consents, brief information related to the given data processing must also be provided.
4. Data processing operations
The tables below set out the Foundation's main data processing operations, the scope of the data subjects, the data groups, the purposes, the legal bases, the recipients and the retention periods. The processing of sensitive data may only take place if its legal basis and necessity are documented.
4.1. Online donation by credit card
The donation is voluntary. The Foundation provides information on the purpose of fundraising and the basic framework of the use of donations on the website. The Foundation does not request, see or store bank card data; card data are provided on the payment interface of SimplePay.
| Aspect | Content |
|---|---|
| Stakeholders | Donors and contact persons of the donor organization. |
| Data Groups | Name, e-mail address, donation amount, own reference number, SimplePay transaction ID, payment status and time; billing or accounting data required for settlement. Bank card number, CVC/CVV code and full card data will not be sent to the Foundation. |
| Purpose | Receipt of the donation, technical closure of the payment process, confirmation, contact, registration and accounting accounting. |
| GDPR legal basis | Article 6(1)(b) GDPR for the fulfilment of the payment/donation process, insofar as the processing is necessary for the performance of a contractual relationship; for accounting and tax obligations, Article 6(1)(c) GDPR. The voluntary nature of the donation is not affected. |
| GDPR Article 9 | We do not process sensitive data. If the donor voluntarily provides sensitive data in the message, it will not be used beyond the purpose of the donation; unnecessary data will be deleted. |
| Recipients/Data Processors | SimplePay is an independent data controller/recipient with regard to its own data processing for payment and fraud prevention purposes; the Foundation only forwards the data necessary for the launch of the service and the identification of the donation. Rackhost may participate as a storage and e-mail data processor. |
| Retention period | The donation and transaction documents supporting the accounting settlement shall be kept for 8 years following the reference year, or until the end of the year in the case of a longer legal obligation. Technical data for non-accounting purposes shall be deleted upon termination of the purpose. |
4.2. Request a donation certificate or related tax certificate
| Aspect | Content |
|---|---|
| Stakeholders | The donor, in the case of a legal entity donor, is the contact person. |
| Data Groups | Company name or name, tax number, registered office or address only if required for the issuance of the certificate, contact name and email address, optional telephone number, donation amount, date, transaction ID, verification note and submission technical details. |
| Purpose | Issuance and forwarding of donation certificates, accounting documents or related tax certificates and related contact management. |
| GDPR Legal Basis | Article 6(1)(c) of the GDPR for the fulfilment of legal, accounting and tax obligations; the processing of contact data for the purpose of responding and administering may also be based on Article 6(1)(f) of the GDPR. An optional telephone number can only be managed by providing it. |
| GDPR Article 9 | No special data is required. No special data is requested in the form; unnecessary sensitive data provided in the free text field must be deleted. |
| Recipients/Data Processors | Accountant or tax contributor only within the framework of documented task performance; Rackhost as a data processor, as well as an authority defined by law if data transfer is mandatory. |
| Retention period | The issued certificate and the supporting documents must be kept for 8 years after the current year, or until the end of a longer statutory or tax retention period. |
4.3. General email contact
| Aspect | Content |
|---|---|
| Stakeholders | Website visitors, interested parties, volunteers, donors, grant applicants and other contact persons. |
| Data groups | Name, e-mail address, phone number, the content of the inquiry and any additional data necessary for the administration of the case. The Foundation does not ask for special data. |
| Purpose | Answering questions, keeping in touch, managing volunteer or support cases, handling complaints. |
| GDPR legal basis | legitimate interest pursuant to Article 6(1)(f) of the GDPR for general information and administration; if it is necessary for the performance of a contract or request, Article 6(1)(b) of the GDPR; (c) in the case of a legal obligation. |
| Article 9 of the GDPR | The processing of sensitive data is not a purpose. If the data subject sends such data, it can only be processed if there is an absolutely necessary and appropriate legal basis for the handling of the case; otherwise, it must be deleted or returned. |
| Recipients/Data Processors | Foundation Persons designated in the case, Rackhost as email data processor, legal, accounting or regulatory recipient if necessary. |
| Retention period | 1 year from the closing of the case. If a legal dispute is expected from the request or the enforcement of a legal claim is required, the data may be processed until the statute of limitations of the civil claim or the final closure of the legal dispute. |
4.4. Website Security and Server Logs
| Aspect | Content |
|---|---|
| Data subjects | Website visitors, administrators and persons using the Foundation's IT systems. |
| Data Groups | IP address, timestamp, requested URL, status code, browser and device specifications, error and security events, login log data. |
| Purpose | To operate the website, to debug, detect, prove and remediate unauthorized access and attacks. |
| GDPR legal basis | legitimate interest pursuant to Article 6 (1) (f) of the GDPR, with documented balancing of interests; ensuring the security of the system and the provision of information society services in accordance with Section 4 of the Eker. Act. |
| GDPR Article 9 | No purpose is to process sensitive data. |
| Recipients/Data Processors | Rackhost as a hosting service provider and data processor; IT security contributor only on the basis of a documented task; authority in case of a legal obligation. |
| Retention period | As a general rule, the server log is 30 days. In the event of a security incident or the enforcement of rights, the affected part of the log may be kept until the case is closed or until the legal claim expires. |
4.5. Strictly necessary cookies
The Foundation provides clear information in advance about the cookies necessary for the basic operation of the website, but does not ask for consent to them, because they are absolutely necessary for the provision of the service expressly requested by the user. In the assessment of the legal basis and storage on the terminal device, Article 6(1)(f) of the GDPR and Section 155 of Act C of 2003 on Electronic Communications shall be applied together.
| Cookie Name | Purpose | Lifespan | Consent |
|---|---|---|---|
| Theme | Comment on the light or dark appearance. | 1 year | Not required. |
| mkn_consent | Storing the cookie and video embedding decision. | 1 year | Not required as a setup for operation. |
| mkn_session | Session of entering the administration interface. | 7 days | Not required. |
The website does not use advertising or tracking cookies. If video embedding is enabled, the third-party video provider may place its own cookies; these can only be loaded after prior consent. The consent setting can be changed at any time by clicking on the "Cookie settings" link in the footer of the website.
4.6. Umami web analytics
| Aspect | Content |
|---|---|
| Stakeholders | Visitors to the website. |
| Data Groups | Page views, referring page, browser and device type, country, region, and system technical data. Umami does not use cookies, create an individual user profile, or store an IP address; it aggregates visits with a daily, undecryptable identifier. |
| Purpose | To measure the use of the website in an aggregated or pseudonymized way, to improve the content and functionality. |
| GDPR legal basis | Legitimate interest pursuant to Article 6(1)(f) of the GDPR, with an appropriate balancing of interests. The data subject has the right to object. |
| GDPR Article 9 | No purpose is to process sensitive data. |
| Recipients/Data Processors | Umami runs on the same server as the website, operated by Debora Stark e.v.; no data is transmitted to an external analytics provider. Rackhost, which provides the hosting, may participate as a data processor. |
| Retention period | The stored analytical data does not allow the visitor to be identified; aggregated statistics are stored during the operation of the website. |
4.7. Embedded videos: YouTube and TikTok
The external video will only be loaded after the prior express consent of the data subject. In the absence of consent, the website will not send requests to the video provider's servers, including the download of the preview image.
| Aspect | Content |
|---|---|
| Affected | Website visitors who allow video playback. |
| Data Groups | The fact and time of consent, IP address, device and browser information, the ID of the video viewed, and the cookie and log data placed by the service provider. |
| Purpose | Display and play video content. |
| GDPR Legal Basis | Embedding operation by the Foundation: prior consent pursuant to Article 6(1)(a) of the GDPR. Consent may be withdrawn; this does not affect the lawfulness of the processing prior to its withdrawal. |
| GDPR Article 9 | The processing of sensitive data is not a purpose; the Foundation does not control the further data processing of the service provider. |
| Recipients/Data Processors | Google Ireland Limited (YouTube) and TikTok Technology Limited may act as recipients or independent data controllers with regard to the processing of data for their own purposes. The Foundation will only transmit the data necessary for the launch of the service. |
| Retention period | Proof of consent for 5 years from the date of withdrawal or termination of data processing, or until the conclusion of a legal dispute. The retention periods of service providers are governed by their own notice. |
Service providers may also transfer data outside the European Economic Area, in particular IP addresses and device or browser information. The Foundation does not control this further data processing. The data subject can obtain information from Google and TikTok's own data processing policy. For European users, the service provider of YouTube is Google Ireland Limited, and TikTok is the provider of TikTok Technology Limited. Both service providers may transfer data outside the European Economic Area. Google LLC (USA) participates in the EU-US Data Privacy Framework; TikTok refers to the European Commission's General Terms and Conditions. The website loads videos only with the explicit consent of the visitor, YouTube videos in the extended data protection mode (youtube-nocookie.com).
4.8. Publish the supported child's history, picture and health information
The Foundation is not a health care provider. In order to present a support or story, you may not request or keep records of any detailed diagnosis, medical history, or medical document that is not necessary for publication. Only content that is strictly necessary for the specific purpose of publication, preferably summary and gentle, may be used.
| Aspect | Content |
|---|---|
| Affected | The supported child, his/her legal representative, and any other person recognizable in the published photo or story. |
| Data Groups | The child's name or chosen designation, likeness, history, age or other identifying information, as well as the minimum information about the child's health condition that is necessary for specific disclosure. Medical records may only be handled in exceptional isolation, and to the extent necessary for publication. |
| Purpose | To present the purpose of the support, to describe the mission and achievements of the Foundation, and to inform the public. |
| GDPR Legal Basis | The publication of the name, likeness and story is based on the free, specific, informed and documented consent of the legal representative: Article 6(1)(a) of the GDPR. Health data is sensitive data; its public disclosure requires explicit consent in accordance with Article 9(2)(a) of the GDPR. |
| GDPR Article 9 | The consent must specify separately the data concerned, the interfaces, the purpose and the duration. The child's opinion appropriate to his or her age and maturity must be taken into account. The consent may be withdrawn and must not be conditional on the provision of support. |
| Recipients/Data Processors | Website visitors and the publicity of the Internet. In the case of hosting and e-mail services, Rackhost as data processor. Microsoft (Azure Translator) for the English and German translation of texts, Cloudflare (R2) as data processor for storing encrypted backups. Forwarding to a social or video interface only with a separate, explicit permission and the specific interface is indicated. |
| Retention Period | Publication consent and non-public documentation for the duration of publication and then for 5 years after revocation; in the event of a dispute, until the conclusion of the dispute. Public content must be removed immediately upon revocation. The Foundation does not have control over search engine caches, but initiates a reasonable removal request. |
A prior, written declaration of consent is required for each published content. The statement must specify the scope of the data published, the interfaces, the purpose, the duration, the method of withdrawal and that the withdrawal does not affect the lawfulness of the previous data processing. Refusal or withdrawal of consent must not result in a refusal of support or discrimination.
4.9. Data Subject Requests, Complaints and Incident Records
| Aspect | Content |
|---|---|
| Data Subjects | A person exercising a right under the GDPR, filing a complaint or whose data may be affected by a data breach. |
| Data groups | Identification and contact data, the content of the request or complaint, the minimum data necessary to verify the identity of the data subject, deadlines, measures, incident description and risk assessment. |
| Purpose | Fulfilment of data subject rights, investigation of complaints, documentation of incidents, fulfilment of reporting and proof obligations. |
| GDPR Legal Basis | Article 6(1)(c) of the GDPR for the fulfilment of obligations arising from the GDPR and the Privacy Act; Article 6(1)(f) of the GDPR to ensure legal claims and accountability. |
| Article 9 of the GDPR | Sensitive data may only be recorded if it is necessary for the investigation of the data subject's request or incident; in this case, the condition in accordance with Article 9 of the GDPR must be documented. |
| Recipients/Data Processors | The Foundation's designated data protection officer and decision-makers, if necessary, a data protection expert, authority, court or insurance company; Rackhost as a data processor. |
| Retention period | Documentation of the data subject's request and performance for 5 years. Proof of consent for 5 years from the date of withdrawal or termination of data processing. Incident record for 5 years from the closure of the case, or in the case of a legal dispute, until its closure. |
5. Data processors, recipients and data transfer
The Foundation qualifies the service provider roles based on the actual goals and means of the given process. SimplePay, YouTube and TikTok do not automatically qualify as data processors with regard to their own data processing. Rackhost is a data processor when it provides hosting or e-mail services on behalf of the Foundation on the basis of its documented instructions; this requires a written data processing contract in accordance with Article 28 of the GDPR.
The development and operation of the website is carried out by Debora Stark e.v. free of charge, as a donation. The server serving the website (Rackhost), the external storage of backups (Cloudflare R2) and machine translation (Microsoft Azure Translator) are used by Debora Stark e.v. on the basis of a contract in its own name; these service providers act as additional data processors of Debora Stark e.v., for which the Foundation grants general written authorization in accordance with Article 28 (2) of the GDPR. Debora Stark e.v. informs the Foundation in advance of any planned change in the person of the additional data processors. The data processors involved in the operation (Debora Stark e.v., Rackhost, Cloudflare) may affect all data processed through the website; the tables in Section 4 contain the specific recipients of each process.
| Service Provider | Role & Task | Contact / Comment |
|---|---|---|
| SimplePay Zrt. | With regard to the payment service provider's own data processing, it is an independent data controller/recipient; processing bank card transactions. | 1138 Budapest, Váci út 135–139. B. ép. 5th floor; https://simplepay.hu/adatkezelesi-tajekoztatok/ |
| Debora Stark is a self-employed person | Developing, operating and maintaining the website, managing the server and backups. On behalf of and on the instructions of the Foundation, a data processor in accordance with Article 28 of the GDPR. | 2700 Cegléd, Hattyú utca 21.; https://starkerszoft.hu |
| Rackhost Zrt. | Hosting and e-mail service provider; data processor in accordance with Article 28 GDPR for operations performed on behalf of the Foundation. | 6722 Szeged, Tisza Lajos körút 41.; info@rackhost.hu; https://www.rackhost.hu/ |
| Cloudflare, Inc. (R2 Hosting) | Off-server storage of daily backups of the website's database and uploaded files. The backups also contain donor and contact information; they are encrypted before uploading so that Cloudflare cannot access their contents. Other data processors of Stark Debora e.v. | 101 Townsend Street, San Francisco, CA 94107, USA; the rescues are stored in the European Union; https://www.cloudflare.com/privacypolicy/ |
| Microsoft Ireland Operations Limited (Azure Translator) | Machine translation of the texts of the website into English and German. The texts may also contain the name and health data of the supported child; these are not stored by the service provider and are used only for the preparation of the translation. Debora Stark e.v. is an additional data processor under Microsoft's Data Processing Terms. | One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; processing takes place at an endpoint within the European Union; https://privacy.microsoft.com/ |
| Google Ireland Limited (YouTube) | Addressed/independent data controller with regard to the video loaded after consent and the provider's own data processing. | https://policies.google.com/privacy |
| TikTok Technology Limited | Addressed/independent data controller with regard to the video loaded after consent and the service provider's own data processing. | https://www.tiktok.com/legal/privacy-policy |
Data transfers outside the European Economic Area may only take place under the guarantees of Chapter V of the GDPR. Information about service providers is provided below.
Cloudflare, Inc. is a US-based company that participates in the EU-US Data Privacy Framework, and its data processing terms include the European Commission's Standard Contractual Clauses (SCC). Backups are placed in a storage that Cloudflare has committed to storing data exclusively in the European Union, and the backups are already encrypted to the service provider.
Microsoft processes texts sent for translation at an endpoint within the European Union. Its parent company, Microsoft Corporation (USA), participates in the EU-US Data Privacy Framework.
6. Data security and internal data protection rules
6.1. Access and confidentiality
The Foundation shall apply role-based access. Each user shall use a unique, strong password and, where permitted, multi-factor authentication. Access shall be granted only to the extent and for the duration necessary to perform the task. Access shall be reviewed at least annually and in the event of a change in role or personnel, and the terminated privilege shall be revoked immediately.
Officials, employees and contributors handling personal data on behalf of the Foundation are subject to a duty of confidentiality. Data relating to children, health status, grant applications and donors must be handled separately with limited access.
6.2. Technical and organisational measures
- Encrypted data transfer (HTTPS) and, where available, encrypted data storage.
- Regular security updates, vulnerability management, and auditing of administrative access.
- Daily backup of the database and uploaded files: 7 days on the server, 90 days on external, encrypted storage (Cloudflare R2, European Union); periodic restorability check and restriction of access to backups.
- Remove embedded metadata, especially location data, from uploaded images as supported by the system.
- Separate, limited, and documented processing of sensitive data; no unnecessary medical records may be collected.
- Keeping records of data processing contracts, instructions, access lists and data processing activities.
6.3. Manage data breaches
A personal data breach is any security breach that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed. The person who detects the incident is obliged to report it immediately to the designated person responsible for the Foundation.
- Identify, immediately delineate the incident and prevent further damage.
- Recording the facts, the relevant data, systems, data subjects and the expected consequences.
- Risk assessment and deciding whether it is necessary to notify the NAIH. If the incident entails a risk to the rights and freedoms of natural persons, the notification must be made to the supervisory authority without undue delay, preferably within 72 hours, in accordance with Article 33 of the GDPR.
- If the incident involves a high risk, the data subjects shall be informed without undue delay in accordance with Article 34 of the GDPR.
- Record of the incident, risk assessment, actions taken and notifications.
6.4. Record of data processing activities
The Foundation shall keep a register of data processing activities pursuant to Article 30 of the GDPR or ensure that it is kept in a documented manner. The register shall contain at least the purposes, categories of data subjects and data, recipients, deletion deadlines, technical and organisational measures, and data transfers.
7. Retention, deletion and anonymisation
The Foundation shall retain the data for the period specified in this Policy or for a longer period prescribed by the applicable law. At the end of the retention period, the data shall be deleted, anonymised or archived in such a way that the identification of the data subject is not possible, unless the law or an ongoing legal dispute justifies further retention.
As a general rule, the retention period of the donation documents, transaction data and certificates supporting the accounting settlement is 8 years following the current year, pursuant to Section 169 of Act C of 2000 on Accounting. In the case of a longer statutory retention obligation, the longer period is applicable. The shorter period specified in the data processing tables is applicable to technical and contact data.
Data deleted from the production system can remain in backups until the end of the backup retention period, up to 90 days. Backups can only be accessed for the purpose of restoring after data loss; in the event of a restore, the data deleted in the process must be deleted again.
8. Rights of data subjects and remedies
Pursuant to Articles 15 to 22 of the GDPR, the data subject may request access to the data concerning him/her, their rectification, deletion, restriction of data processing, exercise the right to data portability, object to data processing based on legitimate interest, and request the enforcement of his/her rights related to automated decision-making. Consent to data processing based on consent may be withdrawn at any time.
The Foundation will respond to requests without undue delay, but no later than one month from the receipt of the request. In the case of complex or large applications, the deadline may be extended by a maximum of two months; the Foundation will provide information about this within the first month. The Foundation may request additional information for the purpose of verifying identity only to the extent necessary.
Requests can be submitted at the mknalapitvany@gmail.com address or by postal mail sent to the headquarters. The Foundation may refuse to delete the data processed on the basis of a legal obligation before the expiry of the mandatory retention period, but it will examine the restriction of data processing or access in accordance with the rules of the GDPR.
The data subject may file a complaint with the National Authority for Data Protection and Freedom of Information (NAIH) or seek judicial remedy pursuant to Articles 77 and 79 of the GDPR and the Infotv. . The official contact details of the NAIH in force at all times must be checked on the https://naih.hu website; the Policy does not specify a variable postal address.
9. Interest of minor donors and children
The Foundation offers a non-targeted donation service to minors. Therefore, Article 8 of the GDPR cannot be automatically applied to all donation situations; its applicability depends on whether an information society service is offered directly to a child and whether the processing is based on consent. In the case of a minor donor, the rules on civil legal capacity, the age of the data subject and the need to involve a legal representative must be examined on a case-by-case basis.
When processing the data of supported children, the child's best interests, age, maturity and opinion must be taken into account. The child's history or state of health cannot be used as a condition for the support, and the lack of consent required for publication must not result in a disadvantage in the assessment of the grant application.
10. Policy Review and Modification
The Foundation reviews the Policy at least annually and in the event of new data management, changes in service provider or system settings, changes in legislation or significant incidents. Any modification of the information published on the website shall be applicable from the date of publication; in the event of a material change, the data subjects shall be informed in a clearly visible manner.