Privacy policy

The Table below summarizes the types of data processed by the Data Controller not directly in relation to the fulfilment of a public service mission but in association with the provision of other services (e.g.: laboratory services, water pipe fitting service, watertight protection, detection of pipe bursts, measurement of the water yield of fire hydrants, lease of properties) or other financial transactions (e.g.: issuance of bills), as well as the relevant legal bases and retention periods related to them: 

 

Other data processing activities not related to public service contract

	Scope of processed data	Legal basis	Purpose of the data processing	Retention time period
6.1.	Applicant’s data (name, address, mother’s name, place and date of birth)	Legal basis based on contract (Article 6 (1) b) of the Regulation)	The Data Controller processes such data for the purpose of identifying the Customer properly and preparing an offer for him/her.	For six months from the date of placement of the order, if the contract fails to be established.
6.2.	Customer’s data (name, address, mother’s name, place and date of birth)	Legal basis based on contract (Article 6 (1) b) of the Regulation)	The Data Controller processes such data for the purpose of identifying the Customer properly and making out bills for him/her.	For 8 years following the year when the last accounting document was issued under the relevant contract (Article 169 of the Sztv.)
6.3.	Phone number and e-mail address necessary for keeping contact with the Data Subject	Consent as legal basis (Article 6 (1) a) of the Regulation)	If the Data Subject or the representative of the community – thus especially the house representative – grants his/her consent, the Data Controller will process his/her phone number and e-mail address for keeping contact.	Until withdrawal of the consent/for 6 months following the termination of the established contractual legal relationship.
6.4.	Data of natural persons involved in acting on the basis of a power of attorney or as representative	Legal basis based on contract (Article 6 (1) b) of the Regulation)	The data of the person authorised by power of attorney will be primarily processed for the purpose of arranging/administering the service requested.	During the validity term of the power of attorney and the authorisation for acting as representative/ for 5 years, as provided for in Section 6:16 of the Civil Code.
6.5.	Data concerning the provision and usage of the service concerned	Legal basis based on contract (Article 6 (1) b) of the Regulation)	The processing of such data is closely interrelated with the performance of the contract. The Data Controller manages and processes the data generated during the performance of the contract, thus especially the form in which the the service request has been submitted, the order form, the job card and the performance certificate.	For 8 years following the termination of the contractual legal relationship.
6.6.	Data Subject’s complaint in relation to service provision and usage	Statutory obligation as legal basis (Article 6 (1) c) of the Regulation)  (Article 17/A. (6) of the Fogytv.)	Processing of such data is closely interrelated with consumer protection legal regulations and with the performance of the contract, therefore, the Data Controller processes the complaints raised in order to comply with its statutory obligations.	For 5 years pursuant to Section 6:22 (1) of the Civil Code.
6.7.	Data concerning fees and costs payable and paid by the Data Subjects, data on receivables	Legal basis based on contract (Article 6 (1) b) of the Regulation)	The Data Controller manages and processes all the data that are related to the Data Subject’s payment liability and based on which it can be determined whether the Data Subject has met or failed to meet his/her payment liability.	For 5 years pursuant to Section 6:22 (1) of the Civil Code.
6.8.	Data generated in the course of entry into contact with the Customer Service	Statutory obligation as legal basis (Article 6 (1) c) of the Regulation) (Article 89/C. (1) of the Vhr.)	The Customer Service processes the data generated in the course of the relation between the Data Subjects and the Customer Service for the purposes of arranging/administering the matters that have arisen.	For 5 years pursuant to Section 6:22 (1) of the Civil Code.
6.9.	Phone conversation with the Call Centre	Statutory obligation as legal basis (Article 6 (1) c) of the Regulation) (Article 17/B. of the Fogytv.)	The Data Controller records and processes the voice recording made of the phone conversation between the Data Subject and the Call Centre in compliance with the requirements prescribed by the relevant statutes – primarily by the Act on consumer protection.	For 5 years from the date of the voice recording (Article 17/B. (3) of the Fogytv.).
6.10.	Voice recording on a conversation and administration at a personal customer care point	Consent as legal basis (Article 6 (1) a) of the Regulation)	Voice recording is necessary for our Company for the purpose of capturing the precise content of the arrangement/administration, quality assurance, improving the efficiency of quality control and preventing misuse of powers and rights.	Withdrawal of the consent or for 5 years from the date of the voice recording.

A separate Privacy Policy Information has been drawn up concerning the management of cookies used on our Websites, which is accessible from the following site: https://www.vizmuvek.hu/en/data-protection The Data Controller operates an on-line customer service as an electronic service for its Customers. The purpose of the on-line customer service is to ensure reception of electronic inquiries from the Customers and display contract-related data for the registered Customers. Our existing and future Customers can use the services provided by the on-line customer service even without registration, but certain categories of arrangement/administration (e.g. service request submission, ordering services) are subject to registration. In case of inquiries initiated with or without registration the personal data provided will be assigned in the Company’s central database to the Data Subject being in a public service or other contractual legal relationship with the Company and later on the legal bases, data processing purposes and retention time periods specified in Chapters 5 and 6 will be governing for such personal data.   There are four ways available for the Data Subjects for initiating registration for the purpose of using the on-line administration services.

In case of registration with the data of the Ügyfélkapu (Client Gateway) the Data Subjects can use the Data Controller's on-line administration services by using their username and password registered for their own Ügyfélkapu. As far as the identification process subject to providing the data of the Ügyfélkapu is concerned, the governmental body responsible for the central state electronic services (Central Client Registration Records), i.e. the minister responsible for e-government is considered as Data Controller. Information concerning data processing related to identification by using the Ügyfélkapu data are provided and for the data subjects’ exercising their rights is ensured by the Ministry of the Interior (as Data Controller). In order that the registration be successful, the Data Subject has to provide at the occasion of the registration, in addition to identifying the natural person, data requested on the registration data sheet (e-mail address, phone number, device point ID number).

In case of registration other than by using Ügyfélkapu data the Data Subject is to provide the data requested in the registration data sheet (Data Subject’s name, e-mail address, phone number, device point ID number, current account ID number, business partner number, manufacturing number of the device). The Data Controller reserves the right to prescribe the provision of certain data in the registration data sheet as a condition for the registration (E.g.: e-mail address for the confirmation of the registration), and to change the data content of the registration data sheet, delete certain data field or to create new ones, especially if it is made necessary or justified by the users’ needs or changes in relevant legislation. The Data Controller will inform the Data Subjects of the changes in each case.  

In case of pre-registration, if the Data Subject has an e-mail address and consent for it associated with a service legal relationship, or he/she launches an administration process at the On-line Customer Service, in that case the Company will pre-register the Data Subject at its On-line Customer Service. The Data Subject will be informed of the pre-registration in a confirmation e-mail. The confirmation e-mail will contain a “Confirm registration and provide a new password” link. If the Data Subject wants to use the registration opportunity, he/she can continue the registration process by clicking on the link. Failing confirmation, the Data Subject’s pre-registration will be automatically deleted after 30 days have lapsed. The Company’s aim with the pre-registration is to ensure the provision of the services offered by the On-line Customer Service, by simplifying the registration process.

In case of registration combined with arrangement/administration of a matter, in submitting his/her request, the Data Subject is to provide the data necessary for the registration, in addition to those needed for the arrangement/administration of the matter (e-mail address, phone number). After having admitted the request, the Data Controller performs the registration of the Data Subject to the on-line customer service.

Scope of processed data: Name, e-mail address, phone number, device point ID number, manufacturing number of the device of the Data Subject. If the registration is made by using Ügyfélkapu data, the scope of the processed data will extend to the mother’s name of the Data Subject and the place and date of his/her birth.

Purposes for which the data stored in the On-Line Customer Service system are used:

The data controller stores the e-mail address, name, password and profile data belonging to the registration also in its on-line customer service system and uses them for log into the on-line customer service, generating password reminders and sending validating e-mails. 

Purposes for which the data stored in the Data Controller’s system and related to a registration are used:

• log into the on-line customer service, identification of the Data Subject, provision of services offered by the on-line portal;
• provision of services subject to registration to the on-line customer service, such as, among others: sending e-mail notifications about the reading reporting periods, issuing bills, notifications about the date and time of on-the-spot work accomplishment, confirmation on the launching of an administration process;
• sending notifications about changes made to and opportunities offered by the on-line customer service.

Legal basis for the data processing: as a general rule, the Data Subject’s consent (Article 6 (1) a) of the Regulation), and in case of pre-registration, the Company’s legitimate interest (Article 6 (1) f) of the Regulation). In case of registration by using Ügyfélkapu data, the legal basis for the data processing for the data regarding the mother’s name, place and date of birth of the Data Subject is a statutory provision as provided for in Article 6 (1) c) of the Regulation.

Duration of the data processing: the Data Controller will process the data until the consent is withdrawn or the registration is deleted.

Storage and access to the processed data:

The Data Controller assigns the data provided in the course of the registration to the data of the Data Subject being in an identified public service legal relationship with it, or managed under other, non-public service legal relationship and will manage and process them as defined in Chapters 5 and 6.

The data provided under the registration process will be processed by the Data Controller and will not be transmitted to any data processor or other data controllers. Such persons – especially agents and employees – acting on behalf of the Data Controller will have access to the data, who need to know them in order to fulfil their duties, and who are aware of their obligations with regard to managing such data. The data provided in the course of inquiries launched without and not resulting in registration will be captured in the Company's central database. If the report in question can be assigned to an existing or a newly contracting Data Subject as far as its subject-matter is concerned, in that case, the report will be assigned in the central database to the Data Subject being in the corresponding public service legal relationship or in other, non-public service contractual relationship with the Data Controller and will be further managed and processed as defined in Sections 5 and 6. If the report in question cannot be assigned, as far as its subject-matter is concerned, to any contracted Data Subject, in that case it will be further managed and processed according to the provisions of Section 6. A confirmation e-mail will be sent about the successful report to the e-mail address provided at the occasion of making the report, but the e-mail address provided will not be used further in the future by the Data Controller. 

In case of inquiries launched without and not resulting in registration, the Data Controller manages and processes the following data, by groups of matters of administration:

In case of meter index reporting: the Data Subject will be identified on the basis of the device point ID number and manufacturing number of his/her meter, the reported data will be processed meter index number, photo, any remark).

In case of launching an administration process – by providing the data of the meter: the Data Subject will be identified on the basis of the device point ID and manufacturing number of his/her meter. The e-mail address and phone number provided in making the report will be captured as data for contact keeping for the concerned inquiry.

In case of launching an administration process – without providing the data of the meter: The e-mail address and phone number provided in making the report will be captured as data for contact keeping for the concerned inquiry. They will be used for sending notifications on the successful report and about information related to the report and its arrangement/administration.

Making an appointment for a personal customer care point (coordination of date and time): the Data Subject has to provide his/her e-mail address. The Data Controller will use the e-mail address provided exclusively for the following purpose and then it will delete it: sending a confirmation e-mail about the date and time of the appointment, confirmation on success of cancellation of the appointment if made so, notification of the Data Subject about the closing hours of the customer care point and on the deletion of the appointment reserved. The Data Controller will manage and process the data provided at the on-line customer service for reporting a request or for launching and administration process, as defined in Chapters 5 and 6. The on-line customer service does not store these data, it only ensures an electronic interface for launching and displaying administration processes, replacing thereby the paper-based administration.

7.2. Data processing in relation to surveys and questionnaires concerning the Data Controller

The Data Controller determines the scope of personal data processed and managed during the surveys and in the questionnaires, by respecting the principle of “purpose limitation”.

Purpose of the data processing: Surveying Customer (the Data Subjects’) satisfaction and adapting the services offered by the Data Controller to the needs and expectations on the basis of the result of the survey. 

Legal basis for the data processing: the Data Subject’s consent, in each case (Article 6 (1) a) of the Regulation).

Duration of the data processing: the Data Controller manages and processes the data provided until the consent is withdrawn, except if a statute prescribes the obligation of data processing.
 

Data processing in relation to surveys and questionnaires concerning the Data Controller

		Scope of processed data		Legal basis	Purpose of the data processing	Retention time period
		The Data Subject's e-mail address, phone number and postal address		Consent as legal basis (Article 6 (1) a) of the Regulation)	Surveying Customer (the Data Subjects’) satisfaction and adapting the services offered by the Data Controller to the needs and expectations on the basis of the result of the survey.	Until withdrawal of the Data Subject’s consent.

 
7.3. Data processing activities on the Recruitment portal

Purpose of data processing on the Recruitment portal: search for future employees for the Data Controller, keeping records about the job-seekers, providing tailored services for the applicants, storing CVs, sending notifications to the applicants. The Data Subjects provides the data for the Data Controller for the purpose of establishing an employment relationship.

Scope of processed data: The Data Subject’s name, date of birth, e-mail address, phone number, postal address, CV, photo, motivation letter, and the document(s) certifying his/her qualification. 

Legal basis for the data processing: the Data Subject’s consent, in each case (Article 6 (1) a) of the Regulation).

Duration of the data processing: as a general rule, until withdrawal of the consent by the Data Subject. The Data Controller manages and processes the data provided on the Recruitment portal for 12 months from the last log-in to the portal, the time period of processing non-confirmed registration requests is 30 days. The Data Subject is entitled to have his/her CV deleted, and cancellation of the registration made on the Recruitment portal is also ensured by the Data Controller.
 

Data processing activities on the Recruitment portal

		Scope of processed data		Legal basis	Purpose of the data processing	Retention time period
		The Data Subject’s name of birth, e-mail address, phone number, postal address, CV, photo, motivation letter, and the document(s) certifying his/her qualification.		Consent as legal basis (Article 6 (1) a) of the Regulation)	The Data Controller has set up a Recruitment portal for the purposes of searching for potential employees, keeping records about the job-seekers, providing tailored services for the applicants, storing CVs,  sending notifications to the applicants.	Until withdrawal of the Data Subject’s consent/for 30 days/12 months.

  
7.4. Entry into contact by way of an on-line form

There is an opportunity for the Data Subject to enter into contact with the Data Controller via its Website and to initiate the ordering of various services, enrol for participation at certain events, and for using that opportunity he/she has to fill in an on-line form in order to enter into contact with the Data Controller.  

Purpose of the data processing: enter into contact with the Data Subject and identify the Data Subject.
 
Scope of processed data: Name, e-mail address and phone number of the Data Subject. 

Legal basis for the data processing: the Data Subject’s consent, in each case (Article 6 (1) a) of the Regulation).

Duration of the data processing: the Data Controller will manage and process the data until withdrawal of the consent, or if an order is placed for a service, for 8 years following the performance of the service, or if no service is used, in that case for 6 months.
 

Entry into contact by way of an on-line form

		Scope of processed data		Legal basis	Purpose of the data processing	Retention time period
		Name, e-mail address and phone number of the Data Subject		Consent as legal basis (Article 6 (1) a) of the Regulation)	The Data Subject is to provide the data requested on the on-line form serving for entry into contact with the Data Controller.	Until withdrawal of the Data Subject’s consent/for 8 years/6 months.

8.1. Data processing for marketing purposes

Purpose of the data processing: forwarding of information leaflets, offers and information about campaigns related to the Data Controller’s services to the Data Subject. 

Scope of processed data: The Data Subject’s e-mail address, phone number, postal address and consent granted for being contacted for direct marketing purposes.

Legal basis for the data processing: the Data Subject’s consent, in each case (Article 6 (1) a) of the Regulation).

Duration of the data processing: as a general rule, until withdrawal of the consent by the Data Subject.
 

Data processing for marketing purposes

		Scope of processed data		Legal basis	Purpose of the data processing	Retention time period
		The Data Subject's e-mail address, phone number and postal address		Consent as legal basis (Article 6 (1) a) of the Regulation)	Forwarding of information leaflets, offers and information about campaigns related to the Data Controller’s services to the Data Subject.	Until withdrawal of the Data Subject’s consent.

  
8.2. Data processing for market research and opinion poll purposes

Purpose of the data processing: if the Data Subject has granted his/her consent to the processing of his/her data for opinion poll and market research purposes, the Data Controller will contact the Data Subject by using his/her provided data (name, e-mail address, phone number and mailing address) in order to set up an anonymous research sample that does not include personal data. The Data Controller will use the data used for the above-defined purposes for making statistics in a manner unsuitable for identifying the person who has provided the data. 

Scope of processed data: The Data Subject’s e-mail address, phone number, postal address, consent granted for being contacted for market research and opinion poll purposes, market research and contact lists.

Legal basis for the data processing: the Data Subject’s consent, in each case (Article 6 (1) a) of the Regulation).

Duration of the data processing: until withdrawal of the consent by the Data Subject.
 

Data processing for market research and opinion poll purposes

		Scope of processed data		Legal basis	Purpose of the data processing	Retention time period
		The Data Subject's e-mail address, phone number and postal address		Consent as legal basis (Article 6 (1) a) of the Regulation)	If the Data Subject has granted his/her consent to the processing of his/her data for opinion poll and market research purposes, the Data Controller will use the Data Subject's provided data (name, e-mail address, phone number and mailing address) for setting up an anonymous research sample that does not include personal data.	Until withdrawal of the Data Subject’s consent.

  
8.3. Extraordinary events – Damage incidents

Purpose of the data processing: administration/arrangement of damage claims. 

Scope of processed data: Name, mother’s name, postal address, bank account number of the Data Subject, name of the insurance company, insurance policy number, name, badge number, phone number of the person proceeding on behalf of the authority, invoice, tortfeasor’s declaration, protocol drawn up on the damage, damage incident file, and, eventually expert(s’) opinion. 

Legal basis for the data processing: The Data Controller’s or a third party’s legitimate interest (Article 6 (1) f) of the Regulation). 

Duration of the data processing: 5 years in case of documents used for the arrangement/administration of damage claims, and 8 years in case of the issued invoices and transaction certificates.

Data transfer: documentations generated in the course of the arrangement/administration of damage claims are necessarily sent to the competent insurance companies and insurance brokers for assessment of the damage claim. If the complexity of the case justifies, an expert or an official body might also be involved.
 

Extraordinary events – Damage incidents

		Scope of processed data		Legal basis	Purpose of the data processing	Retention time period
		Name, mother’s name, postal address, bank account number of the Data Subject, name of the insurance company, insurance policy number, name and address of the witness(es), name, badge number, phone number of the person proceeding on behalf of the authority, invoice, tortfeasor’s declaration, protocol drawn up on the damage, damage incident file, and, eventually expert(s’) opinion		Legitimate interest as legal basis (Article 6 (1) f) of the Regulation)	It is inevitable that the Data Controller manages and processes, either as injured party or tortfeasor, personal data relating to third parties for the purpose of arranging/administering damage claims.	For 5 years pursuant to Section 6:22 (1) of the Civil Code.
		Invoices and transaction certificates issued		Legitimate interest as legal basis (Article 6 (1) f) of the Regulation)	It is inevitable that the Data Controller manages and processes, either as injured party or tortfeasor, personal data relating to third parties for the purpose of arranging/administering damage claims.	For 8 years following the year when the last accounting document was issued (Article 169 of the Sztv.)

 
8.4. Profiling in a system that supports bulk mailing

The purpose of data processing: to record and maintain the contact details (name, email address) necessary for communication with the Data Subject, for providing information by electronic means related to the use of public services, and for sending marketing messages and offers.  To collect and monitor data on the delivery result and readership of emails, statistically analyze clicks on links in mailings using a heat map, identify the most cost-effective way to deliver mail, and identify and develop transparent, understandable, and user-friendly information. The heat map (profile) is only processed and analyzed in an aggregated and anonymous way.

Scope of data processed: Name and email address of the Data Subject as recipient, the fact of successful/unsuccessful delivery of the email, the time of delivery, the time of opening the letter, whether the link embedded in the letter was clicked (heat map). 

Legal basis for processing: Legitimate interest of the controller or a third party (Article 6(1)(f) of the Regulation). 

Time of data processing: Based on the validity of the consent to the processing of the e-mail addresses of the Data Subjects, with the data automatically deleted upon the expiry of consent (e.g. revocation). The general retention period for correspondence stored in the electronic information system which is not part of the master data is 5 years.
 

Profiling in a system that supports bulk mailing

		Data Processed		Legal basis	Purpose of the data processing	Retention period
		Name and email address of the Data Subject as recipient, the fact of successful/unsuccessful delivery of the email, the time of delivery, the time of opening the letter, whether the link embedded in the letter was clicked (heat map).		Legitimate interest as a legal basis (Article 6 (1) f) of the Regulation)	Communication to the Data Subject, electronic information related to the use of public services, and the registration and maintenance of contact details (name, email address) for sending marketing messages and offers. To collect and monitor data on the delivery result and readership of emails, statistically analyze clicks on links in mailings using a heat map, identify the most cost-effective way to deliver mail, and identify and develop transparent, understandable, and user-friendly information.	Until the withdrawal of the Data Subject's consent to the processing of his/her email address / the general retention period for mail qualifying as non-personal data stored in the mail system is 5 years.

 
8.5. Property and asset protection
The Data Controller is considered a body fulfilling a public service mission and it operates, in compliance with its statutory obligations, an electronic surveillance and recording system (hereinafter: camera system) in its premises, central office building and customer service offices for the purpose of protecting property and assets, the critical infrastructure, preventing, detecting and proving any breach of law, catching those who breach the law in the act and protecting human life and preventing bodily injury. The Data Controller meets its obligation to inform those concerned by warning pictograms indicating the locations of the cameras and by a summarizing information leaflet. A separate Privacy Policy Information has been drawn up concerning the camera system, which is accessible from the following site: https://www.vizmuvek.hu/hu/adatkezeles.
 
Purpose of the data processing: to ensure protection of property and assets in the Data Controller's premises. 

Scope of processed data: Name, residential address, number of ID document and phone number (in case of a partner card) of the Data Subject.

Legal basis for the data processing: it is necessary for the performance of a task by the Data Controller carried out in the public interest (Article 6 (1) e) of the Regulation). In the case of partner cards, the Data Controller processes the Data Subject’s phone number on the basis of his/her consent (Article 6 (1) a) of the Regulation).

Duration of the data processing: The validity of a visitor’s card expiries upon it has been returned to the receptionist and the corresponding data will be erased from the access control system within 24 hours. Data relevant to partner cards will be deleted from the access control system after 6 months have lapsed from the date of their return to the receptionist or withdrawal. 
 

Access control system

		Scope of processed data		Legal basis	Purpose of the data processing	Retention time period
		Name, residential address and personal identity document number of the Data Subjects		Performance of a task carried out in the public interest as legal basis  (Article 6 (1) e) of the Regulation)	The Data Controller processes the Data Subjects’ data for the purpose of protecting property, assets and key infrastructure.	For 24 hours in case of visitors/while in case of partners, for 6 months following the termination of the contractual partnership relationship.
		Data Subject’s phone number, in case of partner cards		Consent as legal basis (Article 6 (1) a) of the Regulation)	The Data Controller manages and processes the Data Subject’s phone number for the purpose of contact keeping.	Until withdrawal of the Data Subject’s consent/for 6 months.

 
Purpose of the data processing: providing the opportunity for the Data Subject for staying in certain parts of the protected areas. 

Scope of processed data: Name, e-mail address, personal identity document number and signature of the Data Subject.

Legal basis for the data processing: it is necessary for compliance with a legal obligation to which the Data Controller is subject (Article 6 (1) c) of the Regulation).

Duration of the data processing: The data will be processed in the year the permission is applied for. If a given permission expires and its validity is not extended, in that case the Data Controller will erase the data from its system after 6 months have lapsed from the date of expiry of the permission. If the Data Subject requests erasure of his/her data prior to the expiry of such 6 months, in that case the Data Controller will take measures without delay in order to erase them. If the data have been erased, the permission will be withdrawn and there will not be opportunity any more for using it.
 

Permission for entry to a protected area

		Scope of processed data		Legal basis	Purpose of the data processing	Retention time period
		Data generated in the course of applying for a permission for entry to a protected area		Statutory obligation as legal basis (Article 6 (1) c) of the Regulation) (Article 9/B. of Fbőtv.)	Ensuring the opportunity for staying in certain parts of protected areas for the Data Subject, compliance with a statutory obligation.	For 18 months from receipt of the form.