Privacy Notice

General

Data Controller details: SKOLL Learning Technologies Zrt. (short name: SKOLL Learning Technologies Zrt., registered office: 1114 Budapest, Eszék utca 13-15, ground floor 2), skoll.hu, iroda@skoll.hu

Data Protection Officer: we do not carry out any activity that would require the appointment of a Data Protection Officer.

Preamble

SKOLL Learning Technologies Zrt. (hereinafter: the “Data Controller”; registered office: 1114 Budapest, Eszék utca 13-15, ground floor 2), as data controller, processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter: GDPR) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as well as with the applicable laws.

SKOLL Learning Technologies Zrt. respects your rights concerning the protection of your personal data (hereinafter: the “Data Subject”). This notice provides a concise and straightforward summary of what personal data concerning the Data Subject we collect, for what purposes, how we may use such data, and also describes the tools we use as well as the Data Subject’s data protection and legal remedy options.

Definitions

processor – a natural or legal person, public authority, agency, or any other body that processes personal data on behalf of or under the instruction of the data controller

processing – any operation or set of operations performed on personal data or data sets, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction

controller – the company, as well as any natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may also be provided for by Union or Member State law

personal data breach – a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored, or otherwise processed

biometric data – personal data resulting from specific technical processing relating to the physical, physiological, or behavioral characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or fingerprint data

recipient – a natural or legal person, public authority, agency, or any other body to whom or to which personal data are disclosed, whether or not a third party. Public authorities that may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of such data by those public authorities must comply with the applicable data protection rules according to the purposes of the processing

data concerning health – personal data related to the physical or mental health of a natural person, including data concerning the provision of healthcare services to that person that reveal information about their health status

data subject – the natural person whose personal data are processed

consent of the data subject – any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which the data subject, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to them

supervisory authority – an independent public authority established by a Member State of the European Union pursuant to Article 51 of the GDPR

GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

third party – a natural or legal person, public authority, agency, or any other body other than the data subject, the controller, the processor, or persons who, under the direct authority of the controller or processor, are authorized to process personal data

special categories of personal data – personal data falling within the special categories of personal data

international organization – an organization and its subordinate bodies governed by public international law, or any other body established by or on the basis of an agreement between two or more countries

profiling – any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements

personal data – any information relating to an identified or identifiable natural person (“data subject”);
an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person

special categories of personal data – personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic and biometric data processed for the purpose of uniquely identifying a natural person, data concerning health, and data concerning a natural person’s sex life or sexual orientation

Company – SKOLL as Data Controller

1. Identification and contact details of the Data Controller (service provider)

Name of the Data Controller: SKOLL Learning Technologies Zrt.

Representative of the Data Controller: Dr. Vitéz Nagy

Contact details of the Data Controller’s representative: iroda@skoll.hu

Registered office: 1114 Budapest, Eszék utca 13-15, ground floor 2

Postal address: 1114 Budapest, Eszék utca 13-15, ground floor 2

Company registration number: 01-10-‍142893

Data Protection Officer: we do not carry out any activity that would require the appointment of a Data Protection Officer.

Customer service e-mail address: iroda@skoll.hu

Place and contact details for complaint handling: 1114 Budapest, Eszék utca 13-15, ground floor 2

2. Data Processing

General rules of data processing

Personal data may only be processed for a specific purpose, to the extent necessary, and for the exercise of rights and fulfillment of obligations. At every stage, processing must comply with its purpose, and the collection and processing of data must be fair and lawful. Personal data may be processed only to the extent and for the duration necessary to achieve the purpose. The Data Controller regulates through internal instructions that only recipients involved in and necessary for achieving the processing purpose may process the data. Accordingly, the Data Controller strives to limit its personal data processing activities to what is strictly necessary; however, the processing of certain personal data is unavoidable. The Data Controller processes personal data provided to it by the Data Subject, as well as personal data generated during the provision of the service.

SPECIFIC DATA PROCESSING ACTIVITIES CARRIED OUT BY THE DATA CONTROLLER

2.1. Personal data mandatorily provided by you when applying for training courses

2.1.1 Scope of personal data processed:

Name, e-mail address, telephone number, name of the training course selected by you.
Birth name, country of birth, place of birth, date of birth, mother’s name, postal code of residence, city/town of residence.
Tax identification number

2.1.2 Purpose of processing:

With regard to the name and the data specified in section 2.1.1 B) above, the purpose is the conclusion and performance of the adult education contract between the Data Controller and the Data Subject, and the fulfillment of statutory mandatory data reporting obligations incumbent upon the Data Controller.
Name and e-mail address: promotion of services provided by the Data Controller as a company, sending newsletters and advertising messages, and maintaining contact during the contract.
Telephone number: providing assistance with registration, acceptance of contractual terms, and maintaining contact.
The purpose of processing the data specified in section 2.1.1 C) is to administratively facilitate compliance with data reporting obligations related to any training funded by the European Union that the Data Subject may later receive from the Data Controller.

2.1.3 Legal basis of processing:

Please note that the Data Controller is entitled to continue processing the Data Subject’s personal data even after the Data Subject has withdrawn their consent to processing, if the further processing is necessary

for compliance with a legal obligation to which the Data Controller is subject,
for the protection of the vital interests of the Data Subject or another natural person,
for the purposes of the legitimate interests pursued by the Data Controller or by a third party, or
for the performance of a contract to which the Data Subject is party, or in order to take steps at the request of the Data Subject prior to entering into a contract.
Please also note that the withdrawal of the Data Subject’s consent to processing does not affect the lawfulness of processing carried out before the withdrawal.

2.1.4 Duration of processing:

With regard to data processed for the purpose set out in section 2.1.2 a), if an adult education contract is concluded between the Data Subject and the Data Controller, the Data Controller processes (stores) such personal data until the end of the eighth year following the provision of the data, as specified by law. If, after the Data Subject has provided the data, no adult education contract is concluded between the Parties, the Data Controller processes such data no later than until the last day of the calendar month following the completion of the training course for which the Data Subject applied.
The Data Controller processes the data processed for the purpose set out in section 2.1.2 b) until consent is withdrawn. The Data Subject is entitled to withdraw the consent given to the Data Controller for this purpose via the link included in every newsletter or advertising message sent by the Data Controller. Independently of this, the Data Subject is entitled at any time to withdraw their consent for marketing purposes by sending an e-mail to the Data Controller.
The Data Controller processes the data processed for the purposes set out in sections 2.1.2 c) and d) until consent is withdrawn. The provisions set out in section 2.1.4 b) apply to the withdrawal of consent.

2.1.5 Place of processing: Hungary

2.1.6 Data transfer: The Data Controller may transfer personal data to the processors specified in section 3. In addition, the Data Controller transfers personal data only in mandatory cases prescribed by law and to bodies specified by law.

2.2 Personal data generated when applying for a job or other partnership cooperation

2.2.1 Scope of personal data processed:

Name, e-mail address, telephone number, and the position applied for
data provided in the CV or e-mail sent to us, including in particular, but not exclusively: name, educational qualifications, previous work experience, previous employers and the positions held with them, the existence and level of language skills, professional competencies, and personal competencies.

2.2.2 Purpose of processing:

With regard to the data specified in section 2.2.1 A):
1. maintaining contact in connection with the job application
2. after the rejection of the application, contacting the Data Subject regarding subsequently advertised positions for the purpose of establishing an employment relationship.
With regard to the data specified in section 2.2.1 B): assessment of the job application announced by the Data Controller as employer
With regard to the data specified in section 2.2.1 B), after the job application has been rejected in relation to the Data Subject: compliance with the employer’s burden of proof in a potential legal dispute

2.2.3 Legal basis of processing:

With regard to the purpose set out in section 2.2.2 a) i): intention to conclude a contract (employment contract, service contract, or any other legal relationship aimed at work performance or partnership cooperation) [Article 6(1)(b) GDPR],
With regard to the purpose set out in section 2.2.2 a) ii): the consent given by the Data Subject through the job application [Article 6(1)(a) GDPR]
With regard to the purpose set out in section 2.2.2 b): intention to conclude a contract (employment contract, service contract, or any other legal relationship aimed at work performance or partnership cooperation) [Article 6(1)(b) GDPR]
With regard to the purpose set out in section 2.2.2 b): the legitimate interest of the Data Controller as employer [Article 6(1)(f) GDPR]. The Data Controller has a legitimate interest in selecting the most suitable candidate for the advertised position, the role to be filled, or the planned cooperation. This is carried out by conducting one or more interviews, personal meetings, or consultations with the Data Subject and, where necessary, assessing the Data Subject’s professional knowledge through professional tasks. This legitimate interest has been weighed in a legitimate interest assessment against any rights of yours that may potentially be affected. Since the interviews, tasks, and selection process are carried out with respect for the Data Subject’s personality rights, and since these tools are suitable for selecting the appropriate applicant or the person most suitable for performing the given task, we apply these methods. The Data Controller has a legitimate interest in being able to prove, if the Data Subject’s job application is unsuccessful or no cooperation is established as a result of the selection process and the Data Subject initiates a legal dispute in this regard, that the application process and the selection procedure were lawful and transparent. It is in the interest of both the Data Subject and the Data Controller that any potential legal dispute be avoided or resolved satisfactorily; therefore, we consider this processing based on legitimate interest to be necessary.

2.2.4 Duration of processing:

With regard to data processed for the purpose set out in section 2.2.2 a) i), until the last calendar day of the third year following the final assessment of the job application.
With regard to data processed for the purposes set out in sections 2.2.2 a) ii) and 2.2.2 b), the Data Subject is entitled at any time to withdraw their consent for such purpose by sending an e-mail to the Data Controller. In the absence of withdrawal, after the last calendar day of the third year following consent to the processing of data for this purpose, the Data Controller requests the Data Subject’s confirmatory consent for the further processing of their data. If the Data Subject does not confirm their consent to processing within 30 days following the Data Controller’s second request, the Data Controller will no longer process the Data Subject’s data for the purpose set out in section 2.2.2 a) ii) from the last day of the month following the expiry of this deadline.
With regard to data processed for the purpose set out in section 2.2.2 c), in the absence of consent for further contact, the Data Controller processes the data until the last day of the calendar year following the limitation period for asserting claims (3 years).

2.2.5 Place of processing: Hungary

Data transfer: The Data Controller may transfer personal data to the processors specified in section 3. In addition, the Data Controller transfers personal data only in mandatory cases prescribed by law and to bodies specified by law.

2.3 Personal data generated when subscribing to a newsletter offered in connection with professional articles

2.3.1 Scope of personal data processed: e-mail address

2.3.2 Purpose of processing: Informing the Data Subject about training courses launched by the Data Controller. Promoting services provided by the Data Controller as a company, sending newsletters and advertising messages.

2.3.3 Legal basis of processing: The Data Subject’s consent given during registration (Article 6(1)(a) GDPR). Withdrawal of consent to processing does not affect the lawfulness of processing carried out before the withdrawal.

2.3.4 Duration of processing: The Data Controller processes the data processed for the purpose set out in section 2.3.3 until consent is withdrawn. The Data Subject is entitled to withdraw consent given to the Data Controller for this purpose via the link included in every newsletter or advertising message sent by the Data Controller. Independently of this, the Data Subject is also entitled at any time to withdraw their marketing consent by sending an e-mail to the Data Controller.

2.3.5 Place of processing: Hungary

2.3.6 Data transfer: The Data Controller may transfer personal data to the processors specified in section 3. In addition, the Data Controller transfers personal data only in mandatory cases prescribed by law and to bodies specified by law.

2.4 Personal data generated when requesting a quotation from the Data Controller

2.4.1 Scope of personal data processed: Personal data that may be provided during the quotation request by the Data Subject either in their own name or as a person acting on behalf of the business association or other organization requesting the quotation (e.g. name, e-mail address, telephone number, name of the represented company, professional requirements related to the quotation request).

2.4.2 Purpose of processing: Answering the questions of the Data Subject or the organization represented by them as a potential client, providing a quotation, and maintaining contact.

2.4.3 Legal basis of processing: The second limb of Article 6(1)(b) GDPR: “taking steps at the request of the Data Subject prior to entering into a contract.”

2.4.4 Duration of processing: If no contract is concluded between the Data Controller and the Data Subject or the organization represented by the Data Subject on the basis of the quotation provided by the Data Controller, the Data Subject’s data specified in section 2.4.1 will be processed until the end of the fifth year following the quotation request. If a contract is concluded, the data specified in section 2.4.1 provided during the quotation request will be processed until the conclusion of the contract.

2.4.5 Place of processing: Hungary

2.4.6 Data transfer: The Data Controller may transfer personal data to the processors specified in section 3. In addition, the Data Controller transfers personal data only in mandatory cases prescribed by law and to bodies specified by law.

3. Processors

For the processing of personal data, the Data Controller generally uses the following processor(s) for the activities indicated. Information on additional ad hoc processors will be provided upon request. The data processing guidelines related to the activities of processors are determined by the Data Controller.

Processor

Company registration number

Activity

Magyar Posta Zrt.

01-10-‍042463

postal correspondence, parcel delivery

4. Data Security

4.1 The Data Controller treats personal data confidentially and, taking into account the state of technology, the nature of the personal data, and the risks, takes all measures that ensure data security and protect against unauthorized access, alteration, transfer, disclosure, deletion, or destruction, as well as accidental destruction, damage, or unavailability, whether caused by human activity or by physical or environmental impacts. The Data Controller selects and operates the IT tools used during the provision of its service for the processing of personal data in such a way that the processed data:

are accessible to authorized persons (availability);
are authentic and authenticated (authenticity of processing);
have verifiable integrity (data integrity);
are protected against unauthorized access (confidentiality of data).

5. Rights of the Data Subject in relation to data processing

Request for information, access

The Data Subject is entitled to obtain confirmation from the Data Controller as to whether or not personal data concerning them are being processed and, where such processing is taking place, is entitled to access the personal data and the following information:

the purposes of processing;
the categories of personal data concerned;
the recipients or categories of recipients to whom or to which the personal data have been or will be disclosed.
the envisaged period for which the personal data will be stored,
information on the right to request rectification or erasure of personal data or restriction of processing, and on the right to object to the processing of such personal data
the right to lodge a complaint,
the existence of automated decision-making based on your personal data, including profiling, the logic involved, the significance of such processing, and the expected consequences for you (our company does not apply profiling or automated decision-making).

The Data Controller is obliged to provide the information without undue delay and no later than within one month of receiving the request. The Data Controller primarily sends its response in the same form in which the request for information was received; therefore, in the case of an oral request, please indicate separately if you request a written response from the Data Controller. The first information provided in a given calendar year is free of charge. For repeated information requests concerning the same data set, the Data Controller is entitled to charge an administration fee, provided that no infringement was established during the repeated information provision and no rectification of data was carried out. The fee for a repeated request is HUF 12,000.

Modification, rectification

The Data Subject is entitled to have inaccurate personal data concerning them rectified by the Data Controller without undue delay upon request. Taking into account the purposes of processing, the Data Subject is entitled to request the completion of incomplete personal data, including by means of a supplementary statement.

Portability

The Data Subject is entitled to receive the personal data concerning them, which they have provided to a Data Controller, in a structured, commonly used, and machine-readable format, and is also entitled to transmit those data to another Data Controller without hindrance from the Data Controller to which the personal data were provided, where:

the processing is based on voluntary consent or on a contract to which the Data Subject is party; and
the processing is carried out by automated means.

6. Erasure and restriction of personal data, right to object

Erasure

(1) The Data Subject is entitled to have the personal data concerning them erased by the Data Controller without undue delay upon request, and the Data Controller is obliged to erase personal data concerning the Data Subject without undue delay where one of the following grounds applies:

the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
the Data Subject withdraws the voluntary consent on which the processing is based through the contact option provided by the Data Controller, and there is no other legal basis for the processing;
the Data Subject objects to the processing on grounds relating to their particular situation or due to processing for direct marketing purposes, and there are no overriding legitimate grounds for the processing;
the personal data have been unlawfully processed;
the personal data must be erased for compliance with a legal obligation under Union or Member State law to which the Data Controller is subject;
the personal data have been collected in relation to the offer of information society services directly to children.

(2) Where the Data Controller has made the personal data public and is obliged pursuant to paragraph (1) to erase the personal data, the Data Controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers processing the data that the Data Subject has requested the erasure of any links to, or copies or replications of, those personal data.

(3) Paragraphs (1) and (2) shall not apply to the extent that processing is necessary:

for exercising the right of freedom of expression and information;
for compliance with a legal obligation under Union or Member State law to which the Data Controller is subject and which requires the processing of personal data, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller;
on grounds of public interest in the area of occupational health or public health;
for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, insofar as the right referred to in paragraph (1) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
for the establishment, exercise, or defense of legal claims.

Restriction

(1) The Data Subject is entitled to request that the Data Controller restrict the processing where one of the following applies:

the Data Subject contests the accuracy of the personal data, in which case the restriction applies for a period enabling the Data Controller to verify the accuracy of the personal data;
the processing is unlawful and the Data Subject opposes the erasure of the data and requests the restriction of their use instead;
the Data Controller no longer needs the personal data for the purposes of processing, but the Data Subject requires them for the establishment, exercise, or defense of legal claims; or
the Data Subject has objected to processing on grounds relating to their particular situation; in this case, the restriction applies for the period until it is determined whether the legitimate grounds of the Data Controller override the legitimate grounds of the Data Subject.

(2) Where processing has been restricted pursuant to paragraph (1), such personal data shall, with the exception of storage, be processed only with the Data Subject’s consent, or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.

(3) The Data Controller shall inform the Data Subject, at whose request processing has been restricted pursuant to paragraph (1), before the restriction of processing is lifted.

Objection

The Data Subject is entitled, on grounds relating to their particular situation, to object at any time to the processing of their personal data where processing is carried out for the performance of a task in the exercise of official authority vested in the Data Controller or where processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party, including profiling based on those provisions. In such a case, the Data Controller may no longer process the personal data unless the Data Controller demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the Data Subject, or which are related to the establishment, exercise, or defense of legal claims.

Where personal data are processed for direct marketing purposes, the Data Subject is entitled to object at any time to the processing of personal data concerning them for such purposes, including profiling to the extent that it is related to such direct marketing.

Where the Data Subject objects to the processing of personal data for direct marketing purposes, the personal data may no longer be processed for such purposes.

Please send your objection in writing to one of the Data Controller’s contact details specified in this notice in such a way that your identity can be established beyond doubt from your letter. Please state the reason for your objection in your letter. We will examine your objection as soon as possible, but no later than within 15 days of its receipt, and inform you of the result in writing. Please also specify in your letter the postal address or e-mail address to which we may send our response. In the absence of this, we will send the response to one of the contact details previously provided by you.

If you do not agree with the decision communicated in our response, or if you do not receive a response within the deadline, you are entitled to bring the matter before a court within 30 days of the communication of the decision or from the last day of the deadline.

7. Special Categories of Data

Automated decision-making based on personal data

Our company does not carry out data collection activities for automated decision-making.

Processing of special categories of data

SKOLL Learning Technologies Zrt. does not process special categories of personal data.

Profiling

SKOLL Learning Technologies Zrt. does not carry out automated profiling.

8. Legal remedy options available to the Data Subject

1. Contacting the Data Controller

If the Data Subject considers that the Data Controller has not acted lawfully in the processing of their personal data, we ask that they first communicate their observation or claim to us, as Data Controller, through one of the contact details specified in this notice, so that we can process and handle the matter as quickly and efficiently as possible.

2. Contacting the data protection authority

In the event of unlawful data processing, the Data Subject is entitled to lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).
Contact details of NAIH:
Postal address: 1530 Budapest, P.O. Box 5.
Address: 1055 Budapest, Falk Miksa u. 9-11.
Telephone: +36 (1) 391-1400
Fax: +36 (1) 391-‍1410
Website: naih.hu
E-mail: ugyfelszolgalat@naih.hu

3. Court proceedings
Please be informed that the Data Subject is also entitled to enforce their claim before a court. The regional court has jurisdiction over such proceedings. The Data Subject may also initiate proceedings before the regional court competent for the registered office of the Data Controller or for the Data Subject’s place of residence or habitual residence.

9. Changes to this Notice

The Data Controller reserves the right to amend or update this “Notice” at any time without prior notice and to publish the updated version on its websites. Any amendment applies only to personal data collected after the publication of the amended version.

This version of the notice is effective as of 10 March 2026.