on the handling of personal data of whistleblowers in the company’s internal whistleblowing system (hereinafter referred to as the “Data Handling Notice” or “Notice”)

Strike Price Ltd. operates an internal abuse reporting system in accordance with Act XXV of 2023 on Complaints, Notifications of Public Interest and Rules for Reporting Abuse (hereinafter referred to as the Complaints Act) . This Privacy Notice applies to the processing of personal data of natural persons (hereinafter referred to as the “whistleblower or data subject“) who have made a complaint through the company’s internal whistleblowing system. For the purposes of this Privacy Notice, the main definitions that apply are set out in Annex 1 to this Notice.

The processing of data under the Prospectus is governed by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: GDPR) and the relevant provisions of Act CXII of 2011 on the right to information and freedom of information.

1. THE MANAGER 

Name: Strike Price Ltd

Registered office/postal address: 3067 Garáb, Petőfi utca 44.

E-mail: [email protected]

Website:  https://strike-price.com/

hereinafter referred to as: the Data Controller

2. THE WHISTLEBLOWER PROTECTION LAWYER INSTRUCTED BY THE CONTROLLER

The Data Controller is the data controller of the Complaint tv. 50 (1)-(2), has entrusted the following whistleblower protection lawyer with the tasks of receiving and forwarding notifications, assisting in their investigation, maintaining contact with the notifier and informing the notifier:

• −name: Dr. Bernadett Csige, lawyer
• −office address/postal address: 4024 Debrecen, Vár u. 2. 1. floor. 3.
• −e-mail address: [email protected]

The whistleblower protection lawyer processes the personal data of the data subjects necessary for the performance of the above tasks.

3. THE PURPOSE OF THE PROCESSING

The purpose of the processing of personal data is to investigate the notifications and to remedy or terminate the conduct that is the subject of the notifications, in accordance with the provisions of the Complaints Act.

4. RELATED DATA

The personal data contained in the notification or an extract from it, and the personal data necessary for the investigation of the notification and for remedying or stopping the conduct which is the subject of the notification.

The whistleblower protection lawyer shall send to the Data Controller an extract of the notification that does not contain any data that would allow the identification of the notifier, unless the notifier has given his or her prior written consent to the transfer of his or her personal data.

5. LEGAL BASIS FOR PROCESSING

The legal basis for the processing is the fulfilment of the Data Controller’s legal obligations under the Complaints Act (Article 6(1)(c) GDPR).

6. THE SOURCE OF THE DATA 

An extract of the notification of the data subject or, in the absence of the data subject’s consent, of the notification without any data that would allow the data subject to be identified, shall be forwarded to the Data Controller by the Data Controller’s whistleblower protection lawyer.

7. THE ENVISAGED DURATION OF THE PROCESSING

Personal data not necessary for the purposes of the purposes of the data management set out in point 3 will be deleted from the abuse reporting system without delay.

The data relating to the notification, the investigation carried out and the action taken on the basis of the notification will be kept for 60 days from the date of closure of the investigation or, if further action is taken on the basis of the results of the investigation, from the date of the last action taken.

If, based on the results of the investigation carried out on the basis of the notification, further proceedings are initiated in relation to the notification, the Data Controller shall process the data necessary for the conduct of such proceedings until the proceedings are finally terminated.

8. THOSE WITHIN THE CONTROLLER’S ORGANISATION WHO HAVE ACCESS TO THE DATA 

The personal data of the data subjects may be known within the organisation of the Data Controller by those persons who are involved in the investigation of the notification, the remedying and the cessation of the conduct that is the subject of the notification, primarily by the investigator(s) entrusted by the Data Controller with the investigation of the notification, as well as by the officials and departments of the Data Controller with the right to take decisions and measures in the given matter.

Until the investigation is completed, the person(s) investigating the notification may only share information about the content of the notification with other departments or employees of the Data Controller to the extent strictly necessary for the investigation.

9. THE RECIPIENTS OF EXTERNAL TRANSFERS

Personal data may be transferred outside the Controller’s organisation to:

• Whistleblower Protection Lawyer: the Data Controller may, pursuant to the Complaints Act. Based on Article 50 (1)-(2) of the Act, the Controller has appointed a whistleblower protection lawyer to receive and forward notifications, to maintain contact with the notifier, to assist in the investigation of the notification, to inform the notifier and to maintain contact with the notifier. The whistleblower protection lawyer shall process the personal data of the data subject necessary for the performance of the aforementioned tasks. The name and contact details of the whistleblower protection lawyer appointed by the Data Controller are set out in point 2 of this Notice.

• Courts and other authorities: the data of a whistleblower may be disclosed to bodies or persons competent to conduct proceedings initiated on the basis of a notification, except in cases of bad faith as described in the following paragraph, if such bodies are entitled to process the data by law or if the whistleblower has consented to the disclosure of his or her data.

If it has become apparent that the complainant or whistleblower has communicated false data or information in bad faith and

(a) where there are indications that a criminal offence or irregularity has been committed, the personal data must be handed over to the authority or person responsible for the procedure,

(b) there are reasonable grounds for believing that he or she has caused unlawful damage or other legal harm to another person, his or her personal data must be disclosed to the body or person entitled to initiate or conduct the proceedings, at the request of that person.

 The provider of the electronic mail system: The Data Controller uses the electronic mail system of Strike Price Kft (registered office/postal address: 3067 Garáb, Petőfi utca 44., e-mail: [email protected], website: https://strike-price.com/) for electronic communication and communication in connection with the fulfilment of its obligations under the Complaints Act. The service provider shall ensure the technically correct and uninterrupted operation of the electronic mail system used by the Data Controller, as well as the provision of storage space for the data stored in the e-mail accounts of the Data Controller.

10. DATA SECURITY MEASURES

The Controller shall, when determining the methods and means of processing and in the course of processing, take such appropriate technical and organisational measures as are necessary having regard to the state of science and technology and the costs of implementation, the nature, scope, context and purposes of the processing and the varying degrees of probability and severity of the risk to the rights and freedoms of natural persons, suitable to ensure the effective implementation of the principles of data protection, to meet the requirements of the law, to safeguard the rights of data subjects and to ensure that personal data are processed only for the purposes for which they are necessary for the specific processing operation.

As a general rule, data relating to the notification may only be accessed by employees of the Data Controller who are involved in the investigation of the notification, the cessation or remedying of the conduct on which the notification is based, the taking of decisions and the implementation of measures required on the basis of the notification, and by the whistleblower protection lawyer appointed by the Data Controller The data subject shall have the right, without prejudice to the rights of other persons, to access the statements made by him or her in the course of the procedure and to request information about the data relating to him or her.

The Data Controller stores personal data in electronic form on servers located at its headquarters t , and paper documents in lockable cabinets in its offices located at its headquarters. When processing personal data, the Controller shall apply risk-based administrative and technical security measures to prevent unauthorised and unauthorised access to and alteration of personal data and to ensure the controllability of both manual and automated data processing processes.

11. THE RIGHTS OF NOTIFIERS IN RELATION TO DATA MANAGEMENT

The following rights are granted to data subjects in relation to the processing of their personal data:

     11.1.Right of access

The data subject shall have the right to obtain from the Controller feedback as to whether or not his or her personal data are being processed and, if such processing is taking place, the right to be informed of the personal data and the following information

a) the purposes of the processing;

(b) the categories of personal data concerned by the processing;

(c) the recipients or categories of recipients to whom or which the personal data have been or will be disclosed, including in particular recipients in third countries or international organisations;

(d) where applicable, the envisaged storage period of the personal data or, where this is not possible, the criteria for determining that period;

(e) the right to obtain from the Controller the rectification, erasure or restriction of the processing of personal data concerning him or her and to object to the processing of such personal data;

(f) the right to lodge a complaint with a supervisory authority;

(g) where the data have not been collected from the data subject, any available information about their source;

(h) the fact of automated decision-making, including profiling, and, at least in those cases, the logic used and clear information on the significance of such processing and its likely consequences for the data subject.

The data subject shall also have the right to obtain from the Controller, upon request, a copy of the personal data that are the subject of the processing. For any additional copies requested by the data subject, the Controller shall be entitled to charge a reasonable fee based on administrative costs.

In order to meet data security requirements and to protect the rights of the data subject, the Data Controller is obliged to verify the identity of the data subject and of the person who wishes to exercise his or her right of access, for which purpose the provision of information and the disclosure of copies of personal data are also subject to the identification of the data subject.

     11.2.Right to rectification

The data subject may request the Controller to amend or rectify any of his or her personal data, provided that he or she justifies the inaccuracy of the data concerned by the rectification.

     11.3.Right to restriction (blocking) of processing

The data subject may request that the Controller restricts the processing of his or her personal data (by clearly indicating the limited nature of the processing and ensuring that it is kept separate from other data) if one of the following conditions is met:

1. the data subject contests the accuracy of his or her personal data (in this case, the Controller will limit the processing for the period of time necessary to verify the accuracy of the personal data),
2. the processing is unlawful, but the data subject opposes the erasure of the data and instead requests the restriction of their use,
3. the data controller no longer needs the personal data for the purposes of processing, but the data subject requires them for the establishment, exercise or defence of legal claims, or
4. the data subject has objected to the processing (in which case the restriction applies for the period until it is established whether the legitimate grounds of the Controller prevail over the legitimate grounds of the data subject).

     4.4.Right to object 

Under this right, the data subject has the right to object at any time, on grounds relating to his or her particular situation, to the processing of his or her personal data where the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.

     4.1.Right to erasure (“right to be forgotten”)

The data subject shall have the right to obtain, at his or her request, the erasure of personal data relating to him or her by the Controller if one of the following grounds applies:

1. the personal data are no longer necessary for the purposes for which they were collected or otherwise processed by the Controller;
2. the data were unlawfully processed;
3. the data subject withdraws the consent on which the processing is based and there is no other legal basis for the processing;
4. the data subject has objected to the processing on the basis of Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing;
5. the personal data must be erased in order to comply with a legal obligation under Union or Member State law applicable to the Data Controller.

The Data Controller is not required to erase the data if the processing is necessary for the establishment, exercise or defence of legal claims or for compliance with a legal obligation to which the Data Controller is subject.

     5.6.Right to data portability

The data subject shall have the right to receive the personal data concerning him or her which he or she has provided to the Controller in a structured, commonly used, machine-readable format and the right to transmit such data to another controller where the processing is based on the data subject’s consent or on a contract concluded with him or her and the processing is carried out by automated means. Given that the processing under this Notice is not based on the data subject’s consent or on a contract concluded with him or her, the data subject does not have the right to object to such processing.

12. NOTIFICATION OF REQUESTS FOR DATA PROCESSING 

The data subject may send his or her request for data processing to the Data Controller via the postal or electronic contact details (e-mail address) indicated in point 1. The Data Controller shall examine the data subject’s request without undue delay and at the latest within 30 days of receipt of the request and shall inform the data subject of the decision taken in the matter and of the measures taken or envisaged to be taken by the Data Controller. If necessary, taking into account the number of requests and their complexity, this time limit may be extended by a further 60 days. The Data Controller shall inform the data subject of the extension of the time limit within 30 days of receipt of the request, stating the reasons for the delay. Where the data subject has made the request by electronic means, the information shall also be provided by electronic means, unless the data subject explicitly requests otherwise. Where the request is unfounded, the Controller shall inform the data subject of the refusal of the request, the reasons for the refusal and the remedies available to the data subject, as set out in point 13 of this Notice.

13. RIGHT OF REDRESS

If the data subject considers that the Data Controller has infringed the applicable data protection rules in the processing of his or her personal data, he or she has the following remedies:

• may lodge a complaint with the National Authority for Data Protection and Freedom of Information (registered office: 1125 Budapest, 1055 Budapest, Falk Miksa utca 9-11., postal address: 1363 Budapest, PO Box 9., e-mail: [email protected], telephone: +36-1-391-1400, website: www.naih.hu)
• have the right to apply to the courts, which will rule on the matter out of turn, to protect your data. In this case, the data subject is free to decide whether to initiate the proceedings before the competent court of the seat of the Data Controller (Balassagyarmat District Court) or the competent court of the place of residence or stay of the data subject. The contact details of the courts are available on the website https://birosag.hu/birosag-kereso.

1. Annex 1: Definitions of terms

Main terms used in the direction of this Guide:

Processing: any operation or set of operations which is performed upon personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

restriction of processing: the marking of stored personal data for the purpose of restricting their future processing.

transfer: making data available to a specified third party.

data protection: the set of principles, rules, procedures, instruments and methods of data management that ensure the lawful processing of personal data and the protection of the individuals concerned.

whistleblowing system: an internal system established and operated by the Data Controller under which information concerning an unlawful or suspected unlawful act or omission or other misuse of the Data Controller may be reported by persons authorised to report it.

whistleblowing: means any communication made by a whistleblower to the Data Controller’s abuse reporting system, in which the whistleblower reports information about an unlawful or suspected unlawful act or omission or other misuse of the Data Controller. If the Data Controller lays down rules of conduct for its employees that protect the public interest or overriding private interests under the conditions set out in Article 9(2) of Act I of 2012 on the Labour Code (hereinafter referred to as “Labour Code”), any breach of such rules may also be reported in the internal abuse reporting system.

whistleblower: the following persons who make a report through the Data Controller’s internal abuse reporting system:

1. a)employed by the Data Controller,
2. b)an employee whose employment relationship with the Data Controller has been terminated,
3. c)a person who wishes to establish an employment relationship with the Data Controller and for whom the procedure for the establishment of such a relationship has started,
4. d)the individual entrepreneur, the individual company, if it has a contractual relationship with the Data Controller,
5. e)a person who has an ownership interest in the Data Controller, and a person who is a member of the administrative, management or supervisory body of the Data Controller, including a non-executive director,
6. f)a contractor, subcontractor, supplier or person under the supervision and control of a contractor, subcontractor, supplier or person who has entered into a contractual relationship with the Data Controller, or who is or has been in a contractual relationship with the Data Controller,
7. g)trainees and volunteers working for the Data Controller,
8. h)a person who wishes to establish a legal or contractual relationship with the Data Controller pursuant to paragraphs (d)(e) or (g) and in respect of whom the procedure for the establishment of such a legal or contractual relationship has been initiated, and
9. i)a person who has ceased to have a legal or contractual relationship with the Data Controller pursuant to paragraph (d)(e) or (g).

data subject: a natural person identified or identifiable on the basis of any information. For the purposes of this Notice, data subject means the notifying parties.

personal data: any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the natural person.

recipient means the person or body to whom or with which the personal data are disclosed, whether or not a third party.