In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as "**GDPR**"), as well as Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (hereinafter referred to as "**Infotv.**"), and based on Section 28 of Act CIX of 2011 on the Hungarian Academy of Arts (hereinafter referred to as "**MMA Act**"), the Secretariat of the Hungarian Academy of Arts (hereinafter referred to as "**MMA**"), as controller (hereinafter referred to as "**Controller**"), hereby publishes this notice to protect the personal data it processes.
**1\. Details of the controller and of the processors**
Controller: **Secretariat of the Hungarian Academy of Arts**
Address: 1062 Budapest, Andrássy út 101.
Tax number: 15795506-2-42
Contact: [titkarsag@mma.hu](file:///\192.168.1.111\villam\V2025\V56263\customer\titkarsag@mma.hu)
Represented by: the Secretary General of the MMA
Contact details of the Data Protection Officer: [dpo@jaczkovics.hu](file:///\192.168.1.111\villam\V2025\V56263\customer\dpo@jaczkovics.hu)
The Data Protection Officer provides assistance with any questions or comments regarding data processing.
**2\. Processors engaged by the controller in the course of processing activities**
| For populating and updating the A-Z OPUS artistic creators' database with data, performing data-structuring tasks, and providing IT services (support, development): | MMA Kiadó Nonprofit Korlátolt Felelősségű Társaság (company registration number: 01-09-305115;
registered office: H-1051 Budapest, Vörösmarty tér 1.
4th floor; tax number: 26159575-2-41; represented by: János Szentmártoni, Managing Director) |
| -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| For the provision of IT services (server hosting): | **Master ITC Információ Technológia és Consulting Korlátolt Felelősségű Társaság** (company registration number: 01-09-467131; registered office: H-1145 Budapest, Mexikói út 42/B.; tax number: 12127786-2-42; represented by: Gábor Ujvári, Managing Director) |
**3\. About the processing carried out**
| **Purpose of processing** | Operation of the A-Z OPUS artistic creators' database and web interface - available at [https://azopus.hu/](https://azopus.hu/%20) (hereinafter together referred to as A-Z OPUS) - which presents the career paths and work of the members of the public body of the MMA. Within this framework, documentation is prepared on members, including, inter alia, the collection of their works for the purposes of research and preservation, thereby contributing to the enforcement of the values of Hungarian and universal culture, the care and public availability of the Hungarian artistic heritage, and thus to supporting the public disclosure of creative works. |
| ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Legal basis of processing** | Processing is necessary for the performance of tasks carried out in the public interest pursuant to Point (e) of Paragraph (1) of Article 6 of the GDPR, having regard to Point (i) of Paragraph (2) of Section 4 of the MMA Act and, accordingly, Subsection (14) of Section 4 of the Statutes of the MMA (hereinafter referred to as "**Statutes**"), as well as Points (a), (c), and (g) of Subsection (2) of Section 4, Point (a) of Subsection (1) of Section 28, and Subsection (7) of Section 27 of the MMA Act, which set out the public-interest tasks.
Under Point (i) of Subsection (2) of Section 4 of the MMA Act, in the performance of its public tasks, the MMA operates a documentation centre as defined in its Statutes. Under subsection (14) of Section 4 of the Statutes, the MMA prepares documentation on its members and ensures the collection, research and preservation of original and/or digitised versions of their works. Under Point (a) of Subsection (2) of Section 4 of the MMA Act, the MMA promotes the enforcement and protection of the values of Hungarian and universal culture; under Point (c), it contributes to the care and public availability of the Hungarian artistic heritage; and under Point (g), it supports the public disclosure of creative works. Under Point (a) of Subsection (1) of Section 28, the Controller organises the MMA's public tasks. |
| **Categories of personal data processed** | Personal data of the members of the MMA's public body published within A-Z OPUS on the website , as well as personal data processed in the A-Z OPUS artistic creators' database, including biographical data (studies, awards, information relating to memberships in arts organisations), personal data appearing in the description of their career, in publications by them or about them, and the contact details (email address, telephone number) of the members of the MMA's public body. |
| **Sources of the data** | The data subject; the Controller; the person(s) commissioned to prepare the documentation of the data subject's oeuvre; experts in the relevant field; as well as publicly available information sources. |
| **Period of storage** | In accordance with Point (e) of Paragraph (1) of Article 5 and Paragraph (1) of Article 89 of the GDPR, personal data are retained for archiving in the public interest and for scientific and historical research. |
| **Recipients** | The list of processors engaged by the controller is set out in Section 2 of this notice; beyond this, there are no further categories of recipients. |
**4\. Key rights of the data subject related to the processing**
The data subject may exercise their rights by contacting the controller. In this context, the data subject may do so using any of the contact details provided in Section 1 of this notice.
**4.1 Right of access**
The data subject shall have the right, via the contact details provided in Section 1 of this notice, to obtain from the controller confirmation as to whether or not personal data concerning them are being processed, and, where that is the case, to access the following information:
- which of their personal data the controller processes, on what legal basis, for what purpose, and for how long;
- to whom, when, based on which legal provision, and which personal data have been made accessible by the controller, or to whom the personal data have been transferred;
- from what source the personal data originates;
- whether the Controller applies automated decision‑making, as well as the logic involved, including profiling.
The controller shall provide a copy of the personal data being processed to the data subject free of charge upon the first request; thereafter, a reasonable fee based on administrative costs may be charged.
To ensure compliance with data‑security requirements and to protect the rights of the data subject, the controller must verify that the person seeking to exercise the right of access is, in fact, the data subject. Therefore, the provision of information, the enabling of inspection of the data, and the issuing of copies are conditional upon verification of the data subject's identity.
**4.2 Right to rectification**
The data subject may, via the contact details provided in Section 1 of this notice, request that the controller modify any of their personal data. If the data subject can credibly demonstrate the accuracy of the rectified data, the controller shall comply with the request within one month at the latest and notify the data subject at the provided contact.
**4.3 Right to restriction of processing**
By using the contact details provided in Section 1 of this notice, the data subject may request that the controller restrict the processing of their personal data (with a clear indication of the restricted nature of processing and ensuring separate storage from other data). The controller shall comply with the request if any of the following applies:
- the accuracy of the personal data is contested by the data subject; in this case, restriction shall apply for a period enabling the controller to verify the accuracy of the personal data;
- the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of its use instead;
- the controller no longer needs the personal data for the purposes of the processing, but the data subject requires it for the establishment, exercise or defence of legal claims;
- the data subject has objected to the processing; in this case, restriction shall apply for the period until it is established whether the controller's legitimate grounds override those of the data subject.
**4.4 Right to object**
On grounds relating to their particular situation, the data subject may, at any time and via any of the contact details provided in Section 1 of this notice, object to processing under Point (e) of Paragraph (1) of Article 6 of the GDPR if, in their view, the controller does not process the personal data appropriately for the purpose set out in this privacy notice. In such a case, it is for the controller to demonstrate compelling legitimate grounds for the processing that override the interests, rights and freedoms of the data subject, or that relate to the establishment, exercise or defence of legal claims.
**4.5 Right to erasure**
By using the contact details provided in Section 1 of this notice, the data subject may request that the controller erase their personal data, which means that the controller is obliged to erase personal data concerning the data subject without undue delay if:
- the data subject withdraws their consent to the processing;
- the personal data are no longer necessary in relation to the purposes for which the controller processed them;
- the personal data have been processed unlawfully;
- a legal obligation imposes on the controller a duty to erase the data, and this has not yet been complied with.
**4.6 Right to lodge a complaint and to an effective judicial remedy**
If the data subject considers that the processing infringes the GDPR or the provisions of Act CXII of 2011 on the Right of Informational Self‑Determination and on Freedom of Information, or considers the controller's processing of their personal data to be otherwise objectionable, we recommend first contacting the controller directly; all complaints will be investigated.
If, despite their complaint, the data subject continues to find the controller's processing objectionable or wishes to contact the authority directly, they may file a report with the National Authority for Data Protection and Freedom of Information (address: H-1055 Budapest, Falk Miksa utca 9-11.; postal address: H-1363 Budapest, Pf. 9.; email: [ugyfelszolgalat@naih.hu](file:///\192.168.1.111\villam\V2025\V56263\customer\ugyfelszolgalat@naih.hu); [website: www.naih.hu](website:%20www.naih.hu)).
The data subject may bring an action before a court to protect their data; the court shall proceed without delay. In this case, the data subject may bring the action before the tribunal with jurisdiction over their place of residence (permanent address) or place of stay (temporary address) ().
The tribunal competent by place of residence or place of stay can be found at .
This notice takes effect on 17 December 2025 and remains in force until withdrawn.