General Data Processing Terms
The European Minifootball Federation (hereinafter referred to as EMF), as data processor, consents to be bound by the regulations of this information package. The federation undertakes that all data processing in relation to its activity complies with regulations set out in this information package and the effective legislation.
EMF reserves the right to amend this information package at any time. EMF will announce any possible further changes and consents to be bound by them.
In case you have any questions regarding the present information package, please send them to us and our colleague will provide you with an answer to your question.
EMF is committed to protect the personal data of its partners, and considers it highly important to respect the right of informational self-determination of its clients.
EMF keeps personal data confidential and takes all security, technical and organizational measures that guarantee the security of data.
EMF hereby introduces its data processing practices:
Scope of personal data, aim, legal basis and duration of data processing
EMF hereby introduces its data processing principles: Its data processing principles are in line with the effective legislation on data protection especially with the followings:
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);
- Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.);
- Act V of 2013 on the Civil Code (Ptk.);
- Act C of 2000 on Accounting (Számv. tv.);
- Act XLVIII of 2008 on on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities (Grt.).
- Act CXXXIII of 2005 on persons and property protection and on the activity of private detectives (SzVMt.)
Data processing in relation to sales
Data of partners
EMF stores the partners’ data in its own system, electronically. Paper based documents containing personal data will be kept along with the electronic system’s data by the time the dates indicated in the relevant parts of this information package.
Purpose of data processing: issuance of invoices, registering partners, differentiating partners from each other, documenting buying and payment, compliance with accounting obligations, contacting partners.
Legal basis of data processing: data processing necessary for the performance of the contract [Article 6, Section (1) (b) of GDPR], Article 196 Section (2) of Számv. tv.
Types of processed personal data: bank account number, date and time, invoicing name, address and VAT number, name of the purchased products, quantity, purchase price, mode of payment, contact data
Period of data processing: eight years, in line with Article 169 (2) of Számv. tv.
Acceptance of presents
Partners taking part in promotions organised by the companies of OMFSZ group may become entitled to take over presents.
Purpose of data processing: certifying the takeover of presents.
Legal basis of data processing: data processing necessary for the performance of the contract [Article 6, Section (1) (b) of GDPR].
Types of processed personal data: number, period of the promotion, name, date of handing over of the present, name of the present, quantity, name of the buyer, buyer’s address and signature.
Period of data processing: eight years, in line with Article 169 (2) of Számv. tv.
Possible consequences of failing to provide data: the partner shall not be able to take over the present.
Data processing of external service providers regarding log data:
The html code of the portal is independent from EMF, it contains references loaded and embedded from external servers. The server of the external service provider is directly linked to the computer of the user. Please note that in order to have a direct communication with the browser of the user, the providers of the present references are able to collect users’ data (e.g. IP address, browser and operation system data, address of visited page and date of visit).
Contents personalised for the user is provided by the server of the external provider.
The below listed data controllers can provide further information on processing data by external servers.
Independent measure and auditing of the website monitoring and other web analytical data of eurominifootball.com are aided by the server of Google Analytics as an external service provider. Data controller provides further information on the processing of measurement data at http://www.google.com/intl/hu/policies/
Service provider available at maps.google.com places a map on the website.
EMF deletes records of all e-mails received containing the name, e-mail address of the sender, date and time along with other personal data provided in the message maximum ten years after communicating the data.
Newsletter, direct marketing
In an electronic newsletter, EMF sends direct marketing messages to those who expressly gave their consents.
Purpose of data processing: sending e-mail newsletters containing economic advertisements to interested parties, personalizing newsletters, notifying about current information, sales, direct marketing, tracking activities in the sent messages (e.g. opening, clicking), providing personalized offers by using the data of tracking, keeping contact, transferring the own business data of the data processor and that of its partners and presentation of personalised advertisements containing ads of third parties on the own page or on the page of a partner.
Legal basis of data processing: voluntary consent of the data subject.
Types of processed personal data: identification number, date, time, e-mail address, name, consent given to direct marketing contact, and stored analytical data in relation to subscription and unsubscription, sending messages, delivering and opening them (e.g. data and time of the events, IP address of the PC).
Possible consequences of failure to provide data: the data subject shall not be informed about the offers of data controller and offers of its partners.
Recall of consent given to transfer direct marketing and deletion or amendment of personal data may be required at the following contact details:
- by sending an e-mail to and
- by post sent to the address of
Other data processing
Other data processing not mentioned in the present information package are disclosed at the time of data recording.
Hereby we notify our clients that the following authorities may request the data processor to inform, to provide data, to hand over data and documents: court, prosecutor, investigation authority, authority of administrative offences, administrative authority, National Authority for Data Protection and Freedom of Information and on the basis of legal empowerment other authorities as well.
EMF discloses personal data to authorities only if the authority has specified the exact aim and data and personal data are disclosed only to an extent that is necessary for the purpose of the request.
Means of storing personal data, safety of data processing
Taking its technology into account, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, EMF and its contractual data controllers shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.
EMF chooses and operates computer tools by the means of which personal data are processed and which are applied in the course of providing service that
- the data processed are available for the entitled persons (availability);
- credibility and validation of the data are assured (credibility of data control);
- the fact that data are unchanged is justifiable (integrity of data);
- they are secured against unauthorized access (confidentiality of data).
EMF protects data with sufficient measures in particular against illegitimate access, alteration, transfer, disclosure, deletion or destruction as well as accidental destruction or damage and also against becoming inaccessible due to the change of the applied technics.
Regarding the current technological development, EMF takes care about the protection of the safety of data control by the means of such organizing and organisational measures that provide proper protection against risks arising in connection with data control.
In the course of data control EMF preserves
- confidentiality: protects the information i.e. only authorised persons have access;
- integrity: protects accuracy and totality of the information and the method of processing;
- availability: ensures that when the authorised user needs it, the person really has access to the information required and the related tools are really available.
The computer system and network of EMF and its contractual data processors are protected against computer-aided fraud, spying, sabotage, vandalism, fire and also against computer viruses, computer hacking and attacks leading to refusing service. Operator takes care about the security by server-level and application-level protection methods.
Users are informed that electronic messages forwarded on the internet regardless of protocol (e-mail, web, ftp, etc…) are vulnerable against such online threats which lead to fraudulent activity, disputable contracts or disclosure and amendment of information. To protect from such threats, the data processor takes all necessary precautions. It monitors the systems in order to be able to record each safety derivation, to have proof in case of each security event. Apart from this, monitoring the system makes it possible to check the effectiveness of the applied precautions.
EMF as data processor shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken.
In case of a personal data breach, EMF shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the National Authority for Data Protection and Freedom of Information, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.
Data and contact information of data processor
|Registered seat:||Szepvolgyi ut. 52
Rights of data subjects, remedies
Data subject may request information concerning the processing of data relating to him and (except the mandatory data control) data subject may require the rectification, deletion or blocking of his data and may exercise his data portability right in a way indicated at the registration of the data or through the customer service of the data controller.
Right to information:
Upon request of the data subject, EMF shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language.
Right to access of the data subject:
The data subject shall have the right to obtain confirmation from the data controller as to whether or not personal data concerning him or her are being processed, and – where that is the case – access to the personal data and the following information shall be granted:
- the purposes of the processing; the categories of personal data concerned;
- the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; the envisaged period for which the personal data will be stored;
- the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data and the right to protest; the right to lodge a complaint with a supervisory authority;
- information on data sources; the existence of automated decision-making, including profiling, information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards on transfer.
EMF shall provide the data subject with a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Upon request of the data subject, EMF shall provide the data electronically.
Right to information may be exercised in writing, via contacts provided in the Introduction and in Section 8.
When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means.
Right to rectification:
The data subject shall have the right to require the rectification of inaccurate personal data concerning him or her processed by EMF and shall have the right to have incomplete personal data completed.
Right to deletion:
The data subject shall have the right to obtain from EMF the erasure of personal data concerning him or her without undue delay:
- the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- the data subject withdraws consent on which the processing is based and where there is no other legal ground for the processing;
- the data subject objects to the processing and there are no overriding legitimate grounds for the processing;
- the personal data have been unlawfully processed;
- the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
- the personal data have been collected in relation to the offer of information society services.
If processing is necessary, deletion of the data shall not be initiated:
- for exercising the right of freedom of expression and information;
- for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
- for reasons of public interest in the area of public health, archiving purposes or historical research purposes in the public interest; or
- for the establishment, exercise or defence of legal claims.
Right to restriction of processing:
Upon request of the data subject, EMF shall restrict processing if one of the following applies:
- the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
- the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
- the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; or
- the data subject has objected to processing; in this case restriction is valid for that time period until it is verified whether the legitimate grounds of the controller override those of the data subject.
Where processing has been restricted, personal data shall – with the exception of storage – only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
EMF shall inform data subject before the restriction of processing is lifted.
Right to data portability:
The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller.
Right to object:
The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her if processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or if processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party – including profiling based on those provisions.
Objection arises, the controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for direct marketing, which includes profiling to the extent that it is related to such direct marketing.
Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes by EMF.
Automated individual decision-making, including profiling
The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
The above shall not apply if data processing:
- is necessary for entering into, or performance of a contract between the data subject and a data controller;
- is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or
- is based on the data subject’s explicit consent.
Right to withdraw
The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
The controller shall provide information on action taken on a request under Articles 15 to 22 of GDPR to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, considering the complexity and number of the requests.
The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request electronically, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.
If the controller does not act on the request of the data subject, the controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not acting and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
EMF provides the requested information free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may charge a reasonable fee considering the administrative costs of providing the information or communication or taking the action requested or may refuse to act on the request.
The controller shall communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.
The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request electronically, the information shall be provided by electronic means, unless otherwise requested by the data subject.
Compensation and restitution:
Any person who has suffered material or non-material damage as a result of an infringement of the data protection regulation shall have the right to receive compensation from the controller or processor for the damage suffered. A processor shall be liable for the damage caused by processing only where it has not complied with obligations of legislation specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller.
Where more than one controller or processor, or both a controller and a processor, are involved in the same processing and where they are, responsible for any damage caused by processing, each controller or processor shall be held liable for the entire damage.
A controller or processor shall be exempt from liability if it proves that it is not in any way responsible for the event giving rise to the damage.
Complaint at data protection officer
In case you have any problems with the data control of EMF, please turn to our data protection officer:
Right to be heard by a court
If the rights of the data subject are infringed, data subjects might bring a legal action (competent according to where the defendant or the data subject is domiciled – as per the discretion of the data subject) against the data controller. The court shall hear such cases in priority proceedings. A lawsuit filed in relation to protection of personal data is free of duty.
Administrative proceedings for data protection
Complaint can be made at the Hungarian National Authority for Data Protection and Freedom of Information:
Name: Hungarian National Authority for Data Protection and Freedom of Information
Registered seat: 1125 Budapest, 22/C Szilágyi Erzsébet fasor
Mailing address: 1530 Budapest, P.O. Box: 5.