A Profiles International Hungary Kft. által végzett Felmérésekkel, valamint Tanácsadási, Coaching és Tréning szolgáltatásokkal összefüggő adatkezelési tájékoztatója

A Profiles International Hungary Kft. (továbbiakban: Társaság vagy Adatkezelő) a tevékenysége keretében, Profiles International LLC online felméréseit (Felmérések), valamint Tanácsadási, Coaching és Tréning szolgáltatásokat (Tanácsadás, Coaching és Tréning) nyújt.  Ezen szolgáltatások nyújtása személyes adatok kezelésével járhat együtt.

Kérjük, olvassa el figyelmesen a jelen Adatkezelési tájékoztatónkat, mely tartalmazza, hogy adatait milyen jogcímen, milyen célból, milyen módon kezeli az Adatkezelő, azokat kihez továbbítja, illetve tájékozódhat arról, hogy az adatkezeléssel összefüggésben Önt milyen jogok illetik meg, és hogy ezeket hogyan érvényesítheti. Amennyiben az adatkezeléssel összefüggésben bármilyen kérdése van, alábbi elérhetőségeinket szívesen állunk rendelkezésre.

A jelen rövid adatkezelési Tájékoztató azzal a céllal jött létre, hogy az Érintetteket tömören tájékoztassa az Adatkezelő által alkalmazott adatvédelemmel kapcsolatos főbb szabályairól. A Tájékoztatóban nem tárgyalt kérdéskörök, témák vonatkozásában a vonatkozó jogszabályok rendelkezései az irányadóak, és a jelen Tájékoztató ezekkel együtt értelmezendő. A jelen Tájékoztatóban használt fogalmak megegyeznek a GDPR-ban rögzített fogalmakkal.

Az Adatkezelő adatai és elérhetőségei:

Elnevezés: Profiles International Hungary Kft. 

Székhely: 1025 Budapest, Szilfa u. 6.

Levelezési cím: 1137 Budapest, Pozsonyi út 24. V. em. 1.

Adószám: 11883809-2-41

Cégjegyzékszáma: 01-09-681312

Nyilvántartó hatóság: Fővárosi Törvényszék Cégbírósága

Adatkezelő képviselője: Székely Gábor ügyvezető igazgató

Elektronikus elérhetőség: profiles@profiles.hu

Hatályos: 2025.03.13-tól

Profiles International Hungary Kft.

Data Processing Notice Related to Surveys, Consulting, Coaching, and Training Services

Profiles International Hungary Kft. (hereinafter referred to as „Company” or „Data Controller”) provides online surveys from Profiles International LLC („Surveys”) as well as consulting, coaching, and training services („Consulting, Coaching, and Training”). The provision of these services may involve the processing of personal data.

Please read this Data Processing Notice carefully, as it details the legal basis, purpose, and method of data processing by the Data Controller, the recipients of the data, and the rights available to you regarding data processing. It also explains how you can exercise these rights. If you have any questions regarding data processing, please feel free to contact us at the contact details provided below

This short Data Processing Notice is intended to provide a concise overview of the main principles applied by the Data Controller concerning data protection. Any matters not covered in this Notice shall be governed by the applicable laws, which should be interpreted together with this Notice. The terminology used in this Notice corresponds with the definitions established in the General Data Protection Regulation (GDPR).

Data Controller’s Details and Contact Information:

Name: Profiles International Hungary Kft.

Registered seat: 1025 Budapest, Szilfa u. 6.;

Mailing address: 1137 Budapest, Pozsonyi út 24., V. em. 1.

VAT Number: 11883809-2-41

Company registration number: 01-09-681312

Registration Authority: Metropolitan Court of Registration

Represented by: Székely Gábor Managing Director

Email: profiles@profiles.hu

Data Protection Officer’s Contact Information:

Name: Balázs Gyetvai (Regal 5 Kft.)Postal

Address: Profiles International Hungary Kft, 1137 Budapest, Pozsonyi út 24. V. em. 1.

Email: adatkezeles@profiles.hu

Types of Data Processing Conducted by the Data Controller:

1. Non-Anonymous Surveys for Corporate Clients – Data Processor Role

The Company distributes Profiles International LLC’s online surveys in Hungary. These surveys are primarily intended for corporate clients but may also be used by individuals. In such cases, Section 3 of this Notice applies.

The purpose of the surveys is to assess the competencies of job applicants and employees in various roles. The survey results provide insights into an individual’s suitability for a specific role and highlight areas for potential professional development.

To complete a survey, the participant („Data Subject”) must provide their name and email address, which are registered on platforms operated by Profiles International LLC (510 N. Valley Mills Drive, Waco, TX 76710, USA website: : www.profilesinternational.com; e-mail: databasegroup@wiley.com ) via the websites www.profilesac.com, www.profilesgac.com, or www.profilessc.com. The participant will then receive an automated email with a link to access the survey questionnaire. If the survey is conducted at the request of a corporate client, the participant’s name and email address are provided by the ordering company.

Voluntary Participation: Completing the survey is entirely voluntary. Clicking the survey link and accessing the questionnaire implies the participant’s consent to complete it.

The surveys strictly assess competencies relevant to professional environments. No sensitive personal data (e.g., health-related or criminal records) are collected. Responses do not lead to complex psychological conclusions. If you wish to review the survey questions in advance, please contact Profiles International Hungary Kft. before completing the questionnaire.

The competencies assessed in the Profiles surveys are considered personal data. These competencies may include:

– General behavioral traits (e.g., work pace preferences)

– Work-related interests

– Cognitive and problem-solving characteristics (e.g., learning preferences)

– Attributes relevant to leadership, sales, or customer service roles

When completing a Profiles survey questionnaire (upon finalizing the questionnaire), your responses are automatically evaluated by software operating on the websites www.profilesac.com, www.profilesgac.com, or www.profilessc.com. As a result, no further analysis of your responses is required. However, the automatic evaluation never leads to an automated decision-making process affecting you directly; it merely provides information that may contribute to decision-making when combined with other data.

Following the completion of the questionnaire, your responses undergo automated processing—i.e., automatic evaluation—outside the European Union, on the servers of Profiles International LLC (510 N. Valley Mills Drive, Waco, TX 76710, USA; website: www.profilesinternational.com).

We inform you that certain technical (IT-related) operations concerning the data are carried out by Profiles International LLC as a data processor. Since the company’s headquarters and servers are located in the USA, your personal data will be transferred outside the European Union. The data protection regulations in the USA may not necessarily provide the same level of protection as those within the EU.

Profiles International LLC is part of the Wiley group of companies, and its sole owner is John Wiley & Sons, Inc. (111 River Street, Hoboken, NJ 07030-5774, USA). The company has been registered under the EU-U.S. Data Privacy Framework and holds an EU adequacy decision for data protection compliance. More details can be found here: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en.

Profiles International LLC’s hosting services are provided by Amazon Web Services Inc. (410 Terry Avenue North, Seattle, WA 98109, USA). The data processing agreement between Profiles International Hungary Kft. and Profiles International LLC fully complies with the Standard Contractual Clauses (SCC) issued by the European Commission, ensuring the lawful and secure transfer of data.

According to Profiles International LLC’s official statement, the software evaluating the survey questionnaires is not classified as an artificial intelligence system.

The survey results will be sent to your email address, and you are free to use them as you see fit. If you wish to review a sample report before completing the survey, please contact Profiles International Hungary Kft. in advance.

Additionally, the automatically evaluated results will be shared with the company that ordered the survey, as well as with the trained consultants and administrative staff of the Data Controller. The ordering company may also request a consultation regarding the survey results.

By accessing the questionnaire and clicking the “Complete Survey” button at the end, you voluntarily consent to the survey results being accessed by the ordering company and by the appropriately trained consultants, administrative staff, HR personnel, or authorized company representatives of Profiles International Hungary Kft.

If you do not agree with this, please do not start the survey. If you have already begun, you may exit the questionnaire at any time (e.g., by closing your browser).

If you did not personally order the survey and are unsure who requested it on your behalf, we can provide information about the ordering company and its designated contact person. To request this information, please email profiles@profiles.hu or send a letter to Profiles International Hungary Kft., 1025 Budapest, Szilfa u. 6.

If the survey was ordered by an employer and the respondent is an employee or job applicant of that employer, Profiles International Hungary Kft. acts as a data processor on behalf of the employer. This means that the employer, as the independent data controller, determines the conditions of data processing. In such cases, our company follows the instructions agreed upon with the employer, and the employer is responsible for informing employees and applicants about the details of data processing.

2. Anonymous Surveys for Corporate Clients – Data Processor Role

In certain cases, a corporate client may request that the survey be conducted anonymously. In such instances, the ordering company pseudonymizes participant data by assigning unique codes instead of personally identifiable information. These unique codes can only be linked to individuals by the ordering company, which acts as the independent data controller. The Data Controller does not have access to the information necessary to reverse this pseudonymization. The Data Controller sends the survey access link associated with the unique codes to the ordering company, which then distributes them to the participants.

In the case of an anonymous survey, Profiles International Hungary Kft. and its data processors do not have access to any personal data, nor can they associate the responses with a specific individual. The survey results are sent exclusively to the ordering company, which alone possesses the information required to identify individual respondents.

Under these conditions, Profiles International Hungary Kft. does not process or store personal data, and no personal data is transferred outside the EU.

3. Non-Anonymous Surveys for Individual Clients – Data Controller Role

If a survey is ordered by a private individual for personal use, the process differs from the corporate procedure outlined in Section 1. In such cases, the individual submits an order via email to the Data Controller before completing the survey. Additionally, the individual pays a fee for the service, which is invoiced in compliance with applicable legal regulations. The survey results are shared exclusively with the individual ordering the survey and with the appropriately trained consultants (employees or data processors) of Profiles International Hungary Kft., who may provide consultation based on the survey results.

By accessing the questionnaire and clicking the „Complete Survey” button at the end, you voluntarily consent to the survey results being accessed by the trained consultants, authorized employees, and data processors of Profiles International Hungary Kft.  If you do not agree with this, please do not start the survey. If you have already begun, you may exit the questionnaire at any time (e.g., by closing your browser).

For non-anonymous surveys ordered by individual clients, the Company acts as an independent data controller. To ensure transparency, the key aspects of data processing are summarized in the following tables:

4. Consulting, Coaching, and Training Services – Independent Data Controller Role

Profiles International Hungary Kft. provides consulting, coaching, and training services to employees and candidates of corporate clients. As part of these activities, the processing of personal data necessary for service delivery is carried out. In the provision of consulting, coaching, and training services, both our Company and the corporate client ordering the service act as independent data controllers.

Participation in consulting, coaching, and training services is entirely voluntary, and no one can compel you to take part.

For the organization of these services (e.g., scheduling appointments), your name and, if applicable, your job title may be obtained either directly from you (if you initiate the scheduling) or from the corporate client that ordered the service (if the client requests that we initiate the scheduling with you).

If you have previously completed a Profiles survey, and this serves as the basis for consulting, coaching, or training, the results of the survey may also be used for this purpose. Please note that if the survey was originally completed anonymously, the ordering company may need to lift the pseudonymization (i.e., disclose that the results pertain to you) to enable service delivery. However, even in such cases, your personal data will not be recorded on www.profilesac.com, www.profilesgac.com, or www.profilessc.com.

Regarding coaching services, no information about the coaching process will be disclosed to any third party without your explicit consent. No records or audio recordings will be made, meaning that only the consultant or partner providing the service will have access to any personal information shared during the session.

For training services, a verbal summary may be provided at the end of the session to a designated representative of the ordering company. However, no written records containing personal data or audio recordings will be created.

If you previously completed a Profiles survey anonymously, but the ordering company later requested consulting, coaching, or training services based on the survey results and lifted the pseudonymization, the corresponding survey results will be retained in paper format for one week following the completion of the consulting, coaching, or training session.

If the pseudonymization is not lifted, the results of the anonymous survey remain entirely independent of the consulting, coaching, or training service. In such cases, only the company that originally ordered the survey will have access to the results and may provide them to you upon request.

Your Rights Regarding the Processing of Your Personal Data:

Right of Access

You have the right to obtain confirmation from the Data Controller as to whether your personal data is being processed. If such processing is taking place, you are entitled to access your personal data and the following information:

• The purposes of the data processing;
• The categories of personal data concerned;
• The recipients or categories of recipients to whom personal data has been or will be disclosed, including recipients in third countries or international organizations;
• Where applicable, the planned retention period of the personal data or, if this is not possible, the criteria used to determine that period;
• Your right to request rectification, erasure, or restriction of processing of your personal data, as well as your right to object to such processing;
• Your right to lodge a complaint with a supervisory authority;
• If the data was not collected from you directly, any available information regarding its source;
• Whether automated decision-making, including profiling, takes place;
• If personal data is transferred to a third country or an international organization, your right to be informed about the appropriate safeguards relating to the transfer.

If you wish to verify whether the Company processes your personal data, and if so, under what circumstances, you may request this information.

The Data Controller will provide you with a copy of the personal data undergoing processing upon request. Any additional copies requested by you may be subject to an administrative fee. If the request is submitted electronically, the information will be provided in a commonly used electronic format, unless you request otherwise.

Right to Rectification

You have the right to request that the Data Controller correct any inaccurate personal data concerning you without undue delay. Taking into account the purpose of the data processing, you also have the right to request the completion of incomplete personal data, including by means of a supplementary statement.

If any of your personal data changes, please notify us immediately so that we can update our records accordingly.

The Data Controller will inform all recipients with whom the personal data has been shared about the rectification, unless this proves impossible or requires disproportionate effort. Upon request, the Data Controller will provide you with a list of these recipients.

Right to Erasure („Right to be Forgotten”)

ou have the right to request that the Data Controller delete your personal data without undue delay, and the Data Controller is obliged to erase your personal data without undue delay if any of the following grounds apply:

• The personal data is no longer necessary for the purposes for which it was collected or otherwise processed (i.e., the purpose of data processing has been fulfilled);
• You withdraw your consent on which the processing is based, and there is no other legal ground for the processing;
• The legal basis for data processing is the legitimate interest of the Data Controller, and you object to the processing, and there is no overriding legitimate reason for the processing, or you object specifically to the processing of data for direct marketing purposes;
• The personal data has been processed unlawfully;
• The personal data must be erased to comply with a legal obligation under EU or Member State law applicable to the Data Controller (e.g., if required by an authority).

If the Data Controller has made the personal data public and is obliged to delete it, the Data Controller will take reasonable steps, including technical measures, considering available technology and the cost of implementation, to inform other data controllers processing the data that you have requested the deletion of any links to, or copies or replications of, this personal data.

The Data Controller is not required to delete personal data if processing is necessary for:

• Exercising the right to freedom of expression and information;
• Compliance with a legal obligation requiring processing under EU or Member State law applicable to the Data Controller;
• Public interest in the area of public health;
• Archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, where erasure is likely to render the achievement of these objectives impossible or seriously impair them;
• The establishment, exercise, or defense of legal claims.

The Data Controller will inform all recipients with whom the personal data has been shared about the deletion, unless this proves impossible or requires disproportionate effort. Upon request, the Data Controller will provide you with a list of these recipients.

Right to Restriction of Processing

You have the right to request that the Data Controller restrict the processing of your personal data if any of the following conditions apply:

• You contest the accuracy of your personal data, in which case the restriction applies for the period necessary for the Data Controller to verify the accuracy of the data;
• The processing is unlawful, but instead of erasure, you request the restriction of its use (for example, if the data processing may later be deemed lawful, so the data does not have to be collected again);
• The Data Controller no longer needs the personal data for processing purposes, but you require it for the establishment, exercise, or defense of legal claims;
• You have objected to processing based on legitimate interest; in this case, the restriction applies until it is determined whether the Data Controller’s legitimate grounds override yours.

If processing is restricted under the above conditions, the personal data (except for storage) may only be processed with your consent, for the establishment, exercise, or defense of legal claims, for the protection of the rights of another natural or legal person, or for important public interest reasons. You will be informed in advance if the restriction on processing is lifted.

The Data Controller will inform all recipients with whom the personal data has been shared about the restriction, unless this proves impossible or requires disproportionate effort. Upon request, the Data Controller will provide you with a list of these recipients.

Right to Data Portability

You have the right to receive the personal data concerning you, which you have provided to the Data Controller, in a structured, commonly used, and machine-readable format. You also have the right to transmit this data to another data controller without hindrance from the Data Controller to whom the data was provided, where the legal basis for processing is your consent or the performance of a contract; and the processing is carried out by automated means.

In exercising your right to data portability, you also have the right, where technically feasible, to request the direct transfer of your personal data from one data controller to another.

 Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on public interest or the Data Controller’s legitimate interest, including profiling based on these grounds. In such cases, the Data Controller may no longer process your personal data unless it can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing is necessary for the establishment, exercise, or defense of legal claims.

If your personal data is processed for direct marketing purposes, you have the right to object at any time to such processing, including profiling related to direct marketing. If you object to the processing of your personal data for direct marketing purposes, your data will no longer be processed for this purpose.

Automated Decision-Making in Individual Cases, Including Profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or significantly affects you in a similar manner.

This right does not apply if the decision:

• Is necessary for entering into or performing a contract between you and the Data Controller;
• Is authorized by EU or Member State law applicable to the Data Controller, which also provides for measures safeguarding your rights and freedoms and legitimate interests; or
• Is based on your explicit consent

Right to Lodge a Complaint with a Supervisory Authority and Legal Proceedings

Without prejudice to other administrative or judicial remedies, you have the right to lodge a complaint with a supervisory authority—particularly in the Member State of your habitual residence, place of work, or the place of the alleged infringement—if you believe that the processing of your personal data violates applicable legal provisions.

The supervisory authority will investigate the subject of the complaint and, within a reasonable timeframe, inform the complainant about the progress and outcome of the investigation, particularly if further inquiries or cooperation with another supervisory authority is required. Based on the complaint, the supervisory authority has the authority to initiate proceedings against the Data Controller.

You also have the right to initiate legal proceedings if you believe that the Data Controller or a data processor acting on its behalf has processed your personal data in violation of data protection regulations.

Legal disputes related to data processing fall under the jurisdiction of the competent Regional Court. The court with jurisdiction based on the Data Controller’s registered office is:

• Name: Budapest Regional Court (Fővárosi Törvényszék)
• Address: 1055 Budapest, Markó u. 27.

Alternatively, legal proceedings may be initiated before the competent court based on your place of residence or habitual residence.

Supervisory Authority Contact Information

Name: National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság – NAIH)

Registered Office: 1055 Budapest, Falk Miksa utca 9-11.

Postal Address: 1363 Budapest, Pf.: 9.

Phone: +36-1-391-1400

Fax: +36-1-391-1410

Email: ugyfelszolgalat@naih.hu

Right to Withdraw Consent

If data processing is based on your consent, you have the right to withdraw your consent at any time. However, withdrawing consent does not affect the lawfulness of processing conducted before the withdrawal.

General Rules

To exercise your rights, you may contact the Data Controller or the Data Protection Officer at the following addresses:

• By email: profiles@profiles.hu or adatkezeles@profiles.hu
• By post: Profiles International Hungary Kft., 1137 Budapest, Pozsonyi út 24. V. em. 1.

Please note that the Data Controller can only provide information about your personal data after verifying your identity. This requires the provision of at least two pieces of personal data that are recorded in the Data Controller’s system.

The Data Controller is required to inform you about any actions taken in response to your request without undue delay, but no later than one month from receipt of the request. If necessary, this deadline may be extended by two additional months, in which case the Data Controller will notify you of the extension within one month.

Your rights and the Data Controller’s procedures are governed by Articles 12, 13-22, 77, 79, and 82 of the General Data Protection Regulation (GDPR).

If the Data Controller does not take action on your request, you will be informed without undue delay, but no later than one month from the receipt of your request, about the reasons for the inaction and your right to lodge a complaint with the supervisory authority or seek judicial remedy.

Data Security

The Data Controller ensures the security of personal data. To this end, it has implemented the necessary technical and organizational measures and established the procedural rules required to enforce applicable legal, data protection, and confidentiality regulations. The Data Controller protects personal data with appropriate measures against unauthorized access, alteration, transmission, disclosure, deletion, or destruction, as well as accidental loss or damage and inaccessibility resulting from changes in applied technology.

The Data Controller ensures compliance with data security regulations through internal policies, instructions, and procedural rules that are separate in content and form from the Data Processing Policy and this Privacy Notice. When defining and applying security measures, the Data Controller considers the current state of technology and selects the data processing solution that provides the highest level of personal data protection, unless doing so would pose a disproportionate burden.

For any questions regarding the processing of your personal data, please contact us using the contact details provided above.

Data Processors Engaged by the Data Controller:

The Data Controller engages the following Data Processors in connection with data processing activities:

Effective as of 03.13.2025