Data Processing Policy
Budapest, 9 April 2018
We inform you Deloitte Central Europe (hereinafter referred to as: Deloitte CE ) uses a common system for marketing purposes (ELOQUA) and all marketing activities will be realized through this system. Deloitte CE entities’ marketing departments and the regional marketing department has access to this system and to the contact data uploaded into the system. With regard to the before mentioned, Deloitte Hungary entities would like to upload your contact data into this system. Please be informed that ELOQUA is operated by Oracle East Central Europe Services BV, Cyprus Branch, carrying on business under its business name Oracle Cyprus Solutions, Acropoleos Avenue 58, 2012 Nicosia, Cyprus.
With regard also to the data privacy changes after 25 May 2018, when the General Data Protection Regulation of the European Union becomes applicable to all data processing activities carried out in the territory of the European Union, processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest, which means that no consent would be required from the data subject. Notwithstanding Deloitte would like to follow the safest practice and would like to obtain consent for data management for marketing purposes.
The voluntary consent to the business related communication covers the following activities:
- Email marketing (contacting and managing preferences)
- Profiling – analysing personal preferences, interests in order to be able to get the targeted offers for the entity
- Conducting business activities of Deloitte CE
- Managing sales opportunities for Deloitte CE
- Building the profile of the data subject by analysing the personal preferences, behaviours and interests in order to be able to get the targeted content or offer for the entity
Data controller(s) of personal data:
The below entities - as joint controllers - forming Deloitte in Hungary.
- Deloitte Advisory and Management Consulting Private Limited Company, Dozsa Gyorgy ut 84/C, 1068 Budapest, Hungary (authorized to process data on behalf of all Deloitte in Hungary entities and to provide information about the data management to the contact persons and to reply all queries related to data management)
- Deloitte Auditing and Consulting Ltd., Dozsa Gyorgy ut 84/C, 1068 Budapest, Hungary
- Deloitte CRS Limited Liability Company, Dozsa Gyorgy ut 84/C, 1068 Budapest, Hungary
- Deloitte Legal Erdős and Partners Law Firm, Dozsa Gyorgy ut 84/C, 1068 Budapest, Hungary
Processors of personal data under the ELOQUA system:
- Deloitte Advisory and Management Consulting Private Limited Company, Dózsa Gy út 84.C., 1068 Budapest, Hungary
- Deloitte CE Business Service Sp. z o.o., Al. Jana Pawla II 22, 00-133 Warsaw, Poland
- Deloitte Central Europe Service Centre s.r.o., Karolinská 654/2, 186 00, Prague 8, Czech Republic
- Deloitte CZ Services s.r.o., Karolinská 654/2, 186 00, Prague 8, Czech Republic
- con4PAS, s.r.o., Novodvorská 1010/14, 142 01 Prague 4 – Lhotka, Czech Republic
- SI-Consulting Sp. z o.o., Slezna Str. 118, 53-111 Wroclaw, Poland
- Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA
- Oracle East Central Europe Services BV, Cyprus Branch, carrying on business under its business name Oracle Cyprus Solutions, Acropoleos Avenue 58, 2012 Nicosia, Cyprus.
In case where the data processing include the transfer outside of the European Union (EU) the transfer is based on EU approved standard contractual clauses, thus ensuring an adequate level of personal data protection as required by the applicable data protection laws. The personal data controllers and data processors shall establish technological, physical, administrative and procedural safeguards all in line with the industry accepted standards in order to protect and ensure the confidentiality, integrity or accessibility of the personal data processed; prevent the unauthorized use of or unauthorized access to the personal data or prevent a personal data breach (security incident) in accordance with Deloitte CE instructions, policies and applicable laws.
Recipients of personal data under the ELOQUA system: The personal data will be made accessible to the following categories of recipients: the authorized employees and representatives of the above listed controllers and processors and to Deloitte CE group of companies.
The personal data might be made available to other service providers, as data processors, in case Deloitte Hungary decides to change its direct marketing platform. In this case the data subject will be informed about the new eventual data processor(s), and data of data subject might be transferred to this new platform and its provider, subject to the purpose, scope of personal data and other conditions stay the same.
The personal data may be also disclosed to the competent authorities as authorized by the applicable laws.
The period for which the personal data will be processed: The data will be processed until the consent is revoked or in case of lack of such withdrawal as long as it is necessary in relation to the purposes described above, but no longer than 10 (ten) years from the collection of the data, as well as granting the consent. After the indicated period expires or the data subject request so, or the data controllers become aware of the inaccuracy of the personal data and the data subject refuses or misses to provide accurate data, the personal data will be permanently deleted. The controller may retain limited scope of personal data in order to prove compliance with the applicable laws.
The consent is given voluntarily but the processing of the personal data is necessary to fulfil the purposes described here-above. If consent is not granted or the data subject later sends a request for rectification or erasure of data, and withdraw the consent, this will mean that the data subject will have no possibility to participate in marketing or promotional activities or receive any newsletters or offers from Deloitte CE.
The data subject has right to refuse to grant consent, and withdraw the granted consent at any time, in sucha a case the data controller will delete the data. The data subject also has right to ask for information about the data processing, request for access to the personal data and obtain a copy of personal data. The data subject also has right to data portability and rectification of personal data. All rights described in this paragraph can be enforced by the data subject, by sending an e-mail request to the authorized data controller, Deloitte Advisory and Management Consulting Private Limited Company to firstname.lastname@example.org.
Personal data collected in relation to the above described purposes (preferences, behaviours and choice of marketing content) may be used as a basis for automated decisions leading to the identification of sales opportunities within Deloitte in Hungary under the ELOQUA system. Deloitte in Hungary – under the ELOQUA system – continuously monitors and records whether the online newsletters are deleted unread or are opened, how many times the data subject clicked on the links included and decides accordingly what other topics may be of interest to the organisation contacted through the email address.
In case the data subject considers that the processing of personal data infringes the applicable laws the data subject has the right to initiate a court proceeding against the data controller for indemnification at the court competent based on permanent or temporary residence of the data subject, or lodge a complaint with a Hungarian National Authority for Data Protection and Freedom of Information (address: 1125 Budapest, Szilágyi Erzsébet fasor 22/c, postal address: 1530 Budapest, Pf. 5., e-mail: email@example.com, website: https://naih.hu/). The court acts out of turn.
1. “Deloitte in Hungary” is the collective denomination of the following entities: Deloitte Advisory and Management Consulting Private Limited Company, Dozsa Gyorgy ut 84/C, 1068 Budapest, Hungary (company registration number: 01-10-044100); Deloitte Auditing and Consulting Ltd., Dozsa Gyorgy ut 84/C, 1068 Budapest, Hungary (vompany registration number: 01-09-071057); Deloitte CRS Limited Liability Company, Dozsa Gyorgy ut 84/C, 1068 Budapest, Hungary (company registration number: 01-09-975176); Deloitte Legal Erdős and Partners Law Firm, Dozsa Gyorgy ut 84/C, 1068 Budapest, Hungary.
2. Deloitte Central Europe is a regional organization of entities organized under the umbrella of Deloitte Central Europe Holdings Limited, the member firm in Central Europe of Deloitte Touche Tohmatsu Limited. Services are provided by the subsidiaries and affiliates of Deloitte Central Europe Holdings Limited, which are separate and independent legal entities.