INFORMATION ABOUT THE DATA CONTROLLER
Council on Geopolitics Public Benefit Foundation (hereinafter: the “Data Controller”) issues this data protection notice for the purpose of ensuring the lawfulness of its internal data processing activities and the rights of data subjects.
Name of the Data Controller: Council on Geopolitics Public Benefit Foundation (Geopolitikai Tanács Közhasznú Alapítvány)
Registered office of the Data Controller: 1036 Budapest, Kiskorona street 14. VI./31. Hungary
E-mail address of the Data Controller: info@geotan.hu
The Data Controller processes personal data in accordance with all applicable legislation, in particular the following legal provisions:
– Act CXII of 2011 on Informational Self-Determination and Freedom of Information (hereinafter: the “Infotv.”);
– Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation; hereinafter: the “Regulation” or “GDPR”).
The Data Controller treats personal data confidentially and takes all technical and organisational measures related to data storage and data processing that are necessary to ensure secure processing and the protection of the data.
Whistleblowing is the act of reporting wrongdoing, illegal activities, unethical behavior, or safety risks within an organization to someone who can take action. Many countries have their own different whistleblowing laws.
A person who reports such misconduct is called a whistleblower.
Definitions
The terminology used in this data processing notice corresponds to the definitions set out in Article 4 of the Regulation and, in certain respects, is supplemented by the interpretative provisions of Section 3 of the Infotv.
Where this notice refers to data or data processing, this shall be understood as referring to personal data and the processing thereof.
II. PURPOSE OF DATA PROCESSING: OPERATION OF THE WHISTLEBLOWING REPORTING SYSTEM
In order to comply with Act XXV of 2023 on complaints, notifications of public interest and the rules relating to the reporting of abuses (hereinafter: the “Complaints Act”), and in view of the fact that the number of its employees exceeds 50, the Data Controller operates an internal whistleblowing reporting system. The operation of the reporting system, the procedure relating to reports and the protection of whistleblowers shall be carried out in accordance with the provisions of the Data Controller’s whistleblowing policy in force from time to time (hereinafter: the “Policy”).
Purpose of data processing
The purpose of data processing is to operate the whistleblowing reporting system pursuant to Section 18(1) of the Complaints Act, in accordance with the Data Controller’s Policy in force from time to time and applicable legislation, and thereby to investigate reports and remedy or terminate the abuse that is the subject of the report.
Personal data processed
Within the framework of the reporting system, the Data Controller processes the personal data of the whistleblower and of persons concerned in the report and the investigation, as well as other personal data that are strictly necessary for identifying the persons concerned and investigating the report.
Legal basis for data processing
The legal basis for data processing is Article 6(1)(c) of the Regulation, namely compliance with the legal obligation imposed on the Data Controller by Section 18(1) of the Complaints Act.
Source of personal data
The source of the data is the whistleblower and the persons involved in conducting the investigation.
Recipients of personal data
The personal data of the data subject may be accessed only by those employees of the Data Controller whose duties are connected with the processing of personal data.
For the purpose of investigating the report and remedying or terminating the conduct that is the subject of the report, the Data Controller may transmit the data to a whistleblower protection lawyer or another external organisation involved in the investigation of the report, subject to compliance with the conflict-of-interest rules of the Complaints Act.
If, based on the investigation, it is justified to initiate official proceedings due to the abuse described in the report, the Data Controller shall take the necessary steps to initiate such proceedings. The data necessary for filing a report of a criminal offence may be transmitted to the competent authority, which shall act as an independent data controller.
Reports may be submitted in writing via https://geotan.whisly.io. In this connection, the Data Controller uses the following data processor service:
Whisly Kft. – developer and operator of the Whisly whistleblowing reporting system used by the Data Controller.
The data processor may process the personal data of data subjects exclusively for the purpose specified by the Data Controller and set out in the relevant contract, and in accordance with the Data Controller’s instructions; it has no independent decision-making authority with regard to the processing. The data processor has undertaken confidentiality obligations and contractual guarantees concerning the protection of personal data obtained in the course of performing its tasks.
Brodments Kft. (6721 Szeged, Sajka utca 5. ground floor 1; tax number: 32258752-1-06; company registration number: 06-09-028752) participates as an external service provider in the operation of the Data Controller’s whistleblowing reporting system.
Transfer of personal data to a third country or international organisation
The Data Controller does not transfer personal data to any third country or international organisation.
Retention period of personal data
The Data Controller processes personal data for a maximum of 5 years, provided that, in order to comply with Section 26(1) of the Complaints Act, it promptly deletes all personal data that are not necessary for investigating the report and remedying or terminating the conduct that is the subject of the report.
Automated decision-making and profiling
Neither takes place in the course of data processing.
III. RIGHTS OF DATA SUBJECTS IN CONNECTION WITH DATA PROCESSING
Right to information
The data subject has the right to receive information concerning the processing of personal data; the Data Controller fulfils this obligation by making this notice available.
Right of access
Upon request, the Data Controller shall at any time inform the data subject whether personal data concerning the data subject are being processed and, if so, shall provide access to the personal data and the following information:
- a) the purposes of the processing;
- b) the categories of personal data concerned;
- c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
- d) the envisaged period for which the personal data will be stored, or, if this is not possible, the criteria used to determine that period;
- e) the data subject shall also be informed of the right to request from the Data Controller rectification or erasure of personal data or restriction of processing concerning the data subject, and to object to such processing;
- f) the right to lodge a complaint with a supervisory authority or to bring judicial proceedings;
- g) where the personal data are not collected from the data subject, any available information as to their source;
- h) where automated decision-making, including profiling, takes place, information about the existence of such decision-making, including meaningful information about the logic involved and the significance and envisaged consequences of such processing for the data subject.
Upon request by the data subject, the Data Controller shall also provide a copy of the personal data undergoing processing.
Right to rectification of personal data
The data subject shall have the right to obtain from the Data Controller without undue delay the rectification of inaccurate personal data concerning the data subject. Taking into account the purposes of the processing, the data subject shall also have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Where rectification (amendment) of data is requested, the data subject must substantiate the accuracy of the data requested to be amended and must also verify that the person requesting the amendment is entitled to do so. The Data Controller can assess whether the new data are accurate and, if so, whether the previous data may be amended only on this basis.
The Data Controller also draws attention to the fact that data subjects should report changes to their personal data as soon as possible, thereby facilitating lawful data processing and the exercise of their rights.
Right to erasure
Upon the request of the data subject, the Data Controller shall erase the personal data concerning the data subject without undue delay where one of the following grounds applies:
- a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- b) the data subject objects to the processing and there are no overriding legitimate grounds for the processing;
- c) the personal data have been unlawfully processed;
- d) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the Data Controller is subject.
Right to restriction of processing
The data subject shall have the right to obtain from the Data Controller restriction of processing where one of the following applies:
- a) the accuracy of the personal data is contested by the data subject; in this case, the restriction shall apply for the period enabling the Data Controller to verify the accuracy of the personal data;
- b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
- c) the Data Controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; or
- d) the data subject has objected to processing; in this case, the restriction shall apply for the period during which it is being verified whether the legitimate grounds of the Data Controller override those of the data subject.
PROCEDURE FOR EXERCISING THE RIGHTS OF DATA SUBJECTS
The data subject may exercise the above rights by sending an e-mail to info@geotan.hu, by post to the registered office of the Data Controller, or in person at the registered office of the Data Controller.
The Data Controller shall begin examining and processing the data subject’s request without undue delay after its receipt. The Data Controller shall inform the data subject of the measures taken in response to the request within one month of receipt. If the Data Controller is unable to comply with the request, it shall inform the data subject within one month of the reasons for refusal and of the available remedies.
Within five years following the death of the data subject, the rights specified in this notice that the data subject was entitled to exercise during their lifetime may be exercised by a person authorised by the data subject through an administrative instruction or by a declaration made before the Data Controller in a public deed or a private document having full probative force; if the data subject made more than one declaration to a data controller, the declaration made at the later date shall apply.
If the data subject did not make such a legal declaration, a close relative within the meaning of Act V of 2013 on the Civil Code may, even in the absence of such a declaration, exercise the rights under Articles 16 (right to rectification) and 21 (right to object) of the Regulation and, where the processing was already unlawful during the data subject’s lifetime or the purpose of processing ceased upon the data subject’s death, the rights under Articles 17 (right to erasure) and 18 (right to restriction of processing), within five years following the data subject’s death. The close relative entitled to exercise these rights under this paragraph is the person who exercises the right first.
IV. RIGHT TO REMEDIES IN CONNECTION WITH DATA PROCESSING
For the purpose of exercising the right to judicial remedy, the data subject may bring an action against the Data Controller if the data subject considers that the Data Controller, or a data processor acting on its behalf or under its instructions, processes personal data in breach of the requirements laid down in legislation governing the processing of personal data or in binding legal acts of the European Union. The court shall deal with the case as a matter of priority. The action falls within the jurisdiction of the regional court (törvényszék). At the data subject’s choice, the action may be brought before the regional court of the data subject’s domicile or residence, or before the regional court having jurisdiction over the registered office of the Data Controller.
Court locator: https://birosag.hu/birosag-kereso
Anyone may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) against the Data Controller and request an investigation on the grounds that a violation of rights has occurred or is at imminent risk of occurring in connection with the processing of personal data, or that the exercise of data protection rights has been restricted by the Data Controller or a request to exercise such rights has been refused. A complaint may be submitted using one of the following contact details:
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Postal address: 1363 Budapest, Pf. 9.
Address: 1055 Budapest, Falk Miksa street 9–11.
E-mail: ugyfelszolgalat@naih.hu
URL: http://naih.hu
Budapest, 1 January 2026
V. Rules governing the storage, verification and confidentialhandling of submitted stories and documents
1. Receipt and registration
Stories, reports, statements and supporting documents submitted to the Data Controller shall be received and registered in a secure and traceable manner. Only information necessary for receiving, registering, verifying and investigating the submission shall be recorded and processed.
2. Secure storage
Submitted stories and documents, including electronic files and any copies or extracts made for verification or investigation, shall be stored securely. Appropriate technical and organisational measures shall protect them against unauthorised access, alteration, disclosure, loss or destruction.
3. Restricted access
Access to submitted materials and personal data shall be limited to employees whose duties are connected with their receipt, storage, verification, investigation or lawful processing, and only to the extent necessary for those duties.
4. Verification
The Data Controller may verify the internal consistency, authenticity, relevance and reliability of submitted stories and documents to the extent necessary for assessing and investigating the matter reported. Verification may include comparison with documents, records or other sources that may lawfully be accessed. It shall be proportionate and shall not involve unnecessary processing of personal data.
5. Preservation of integrity
Original documents and submitted electronic materials shall, where practicable and relevant, be preserved in a manner that maintains their integrity and evidential value. Copies, extracts, transcriptions or working versions created during verification shall be identified and protected against unauthorised alteration.
6. Confidential handling
Submitted stories, documents and related information shall be treated confidentially. The identity of a whistleblower and of persons concerned in a report or investigation shall be protected in accordance with applicable law. Information may be disclosed only where necessary for the investigation, for remedying or terminating the conduct concerned, or where disclosure is required or permitted by law.
7. External experts and authorities
For investigating a report, the Data Controller may transmit necessary information to a whistleblower protection lawyer or another external organisation involved in the investigation, subject to applicable conflict-of-interest and confidentiality requirements. Where official proceedings are justified, information necessary for reporting a criminal offence may be transmitted to the competent authority, which shall act as an independent data controller.
8. Personal data
Where stories or documents contain personal data, such data shall be processed in accordance with this Notice, the GDPR, the Infotv., the Complaints Act and other applicable legislation. Only personal data strictly necessary for identifying persons concerned and for receiving, verifying and investigating the submission shall be processed.
9. Retention and deletion
Submitted stories and documents and the personal data contained in them shall be retained only for as long as necessary for the purposes for which they were submitted and processed, subject to applicable legal retention requirements. In the whistleblowing reporting system, personal data not necessary for investigating the report and remedying or terminating the conduct concerned shall be deleted promptly. Personal data processed within the reporting system shall be retained for a maximum of five years, as stated in this Notice.
10. Data subject rights
Persons whose personal data are processed in connection with submitted stories or documents may exercise the rights described in Section III of this Notice, subject to restrictions provided by applicable law. Requests may be submitted to info@geotan.hu, by post to the registered office of the Data Controller, or in person.
11. No unauthorised use
Submitted stories and documents shall not be used for purposes incompatible with the purpose for which they were submitted. They shall not be copied, disclosed, published, altered or transferred except where necessary for lawful receipt, verification, investigation, protection of rights or fulfilment of legal obligations.
12. Applicable framework
These rules form an integral part of the Data Controller’s arrangements for handling submitted stories and documents and shall be interpreted together with this Data Protection and Data Processing Notice and the Data Controller’s whistleblowing policy in force from time to time.
September 18, 2026