Pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, as well as Act CXII of 2011 on the right to informational self-determination and freedom of information, the following Data Subject Privacy Notice provides information on the processing of personal data by the Correctional Review.

Data Subject Privacy Notice

Registration No.:	30500-13/53/2026.anyvt.
Name of the data processing activity:	Preparation and editing of publications
Purpose of data processing:	To facilitate communication with the Editorial Board and authors during the preparation and editing of the publications of the Hungarian Prison Service Headquarters
Legal basis for data processing:	Article 6(1)(e) of the GDPR; Section 5(g) of Act CVII of 1995
Categories of personal data processed:	Names and contact details of Editorial Board members and authors
Categories of data subjects:	Editorial Board members and authors
Source of the data:	The data subjects
Categories of personal data disclosed:	–
Recipients of personal data:	–
Legal basis of data disclosure:	–
Retention period for the different categories of personal data:	Until the expiry of the retention period specified in the Uniform Records Management Policy of the Hungarian Prison Service, in accordance with Section 9 of Act LXVI of 1995 on Public records, Public Archives and the Protection of Private Archival Records
Name and registered office (address) of the Data Controller, and the name and contact details of the Data Protection Officer:	Hungarian Prison Service Headquarters 1054 Budapest, Steindl Imre utca 8. Colonel Dr. Kornélia Csató (+36 (1) 301 8414, bvophivatal@bv.gov.hu)
Location where the data processing and where applicable, data processing operations are carried out:	–
General description of the technical and organizational security measures:	The measures set out in the Data protection and Data Security Policy, Uniform Records Management Policy, and Information Security Policy of the Hungarian Prison Service

The Data Controller shall not use the personal data of data subjects for any purpose other than that for which they were collected.

Rights of data subjects and available remedies

In accordance with Articles 15-18 of the GDPR, data subjects are entitled to exercise the following rights in relation to the processing of their personal data through the Data Protection Officer of the Data Controller:

• to exercise the right of access: by requesting information about the processing of their personal data and by requesting the provision of the processed personal data,
• to exercise the right to rectification: by requesting correction of inaccurate data or the completion of incomplete data,
• to exercise the right to erasure (right to be forgotten): by requesting the erasure of the processed data,
• to exercise the right to object: by objecting to the processing of their data where such processing is necessary for the performance of task carried out in the exercise of official authority vested in the Data Controller, or where the processing is based in the legitimate interests pursued by the Data Controller,
• to exercise the right to restriction of data processing: by requesting the restriction of the processing of their data.

Where processing is based on the consent of the data subject, the data subject has the right to withdraw that consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Upon request, the data subject may obtain information as to whether the Data Controller is processing their personal data and is entitled to receive information concerning the data processed in relation to them, including:

• the purpose of the processing,
• the legal basis for the processing,
• the period for which the data will be processed,
• the categories of personal data processed, copies of which shall be made available to the data subject upon request,
• the recipients or categories of recipients of the data,
• any transfer of data to a third country or an international organization,
• the source of the data, where the data have not been collected from the data subject,
• the characteristics of any automated decision-making, where such processing is carried out by the Data Controller,
• the rights of the data subject in relation to the processing of data,
• the available legal remedies.

The processing time limit for requests for information and for measures is one month, which may be extended by two months in justified cases. The provision of information and the measures taken on the basis of the request are free of charge. However, in the case of a clearly unfounded or excessive request, a reasonable fee may be charged to cover the administrative costs associated with providing the information or taking the requested measure, or the measures taken on the basis of the request may be refused.

In certain cases, the Data Controller may refuse to provide information on the basis of statutory provisions. In such cases, the response shall always specify on which statutory provision the information was refused and what legal remedy the data subject may avail of.

Where rectification (amendment) of data is requested, the data subject shall substantiate the accuracy of the data requested to be amended and shall also demonstrate that they are entitled to request the rectification of those data.

Where the erasure of personal data is requested, the personal data relating to the data subject shall be erased without undue delay if:

• the personal data are no longer necessary in relation to the purposes for which they were processed,
• the processing of the personal data was based on the consent of the data subject, the data subject has withdrawn that consent, and there is no other legal basis for the further processing of the personal data,
• the data subject objects to the processing of the personal data,
• the personal data have been processed unlawfully,
• the personal data must be erased in order to comply with a legal obligation laid down by law applicable to the data processing,
• the personal data were collected in relation to the offer of information society services.

Where personal data have been made public and are required to be erased, taking account of available technology and the cost of implementation, reasonable steps, including technical measures, shall be taken to inform those processing the personal data that the data subject has requested the erasure of any links to, or copies or replications of, those personal data.

The erasure of personal data shall not be carried out where processing is necessary for the exercise of the right to freedom of expression and information, for the exercise of official authority, for compliance with a legal obligation, for reasons of public interest in the area of public health, for archiving purposes in the public interest, for scientific or historical research purposes or statistical purposes, or for the establishment, exercise or defense of legal claims.

Restriction of processing may be requested where:

• the data subject contests the accuracy of the personal data; in this case, the restriction shall apply for the period enabling the verification of the accuracy of the personal data,
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead,
• the personal data are no longer needed for the purposes of the processing, but the data subject requires them for the establishment, exercise or defense of legal claims,
• the data subject has objected to the processing; in this case, the restriction shall apply for the period pending verification of whether the legitimate grounds of the Data Controller override those of the data subject.

Where processing has been restricted, such personal data may, with the exception of storage, be processed only with the consent of the data subject, or for the establishment, exercise or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a member state.

In exercising the right to object, the data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to the processing of personal data necessary for the performance of a task carried out in the exercise of official authority vested in the Data Controller, as well as to processing based on legitimate interests. In such a case, the personal data may no longer be processed unless it is demonstrated that the processing is justified by compelling legitimate grounds which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defense of legal claims.

In case of restriction on the exercise of rights relating to the processing of personal data, the rejection of a request, or a breach of the legislation governing the processing of personal data, the data subject may contact the National Authority for Data Protection and Freedom of Information (headquarters: 1055 Budapest, Falk Miksa utca 9-11., phone: +36 (30) 683-5969, +36 (30) 549-6838, +36 (1) 391 1400, mailing address: 1363 Budapest, Pf.: 9., email: ugyfelszolgalat@naih.hu).

In the event of a breach of the legislation governing the processing of personal data, the data subject shall also have the right to bring the matter before court. Jurisdiction lies with the Regional Court. Proceedings may, at the choice of the data subject, be initiated before the Regional Court having jurisdiction according to either the seat of the Data Controller or the place of residence of the data subject. A list of the regional Courts and their contact details is available at the following website: birosag.hu/torvenyszekek.