Below is the privacy policy to which all BSME participants must consent in order to comply with the European Union General Data Protection Regulation.

Declaration: Provision of Information and Consent

I hereby declare that I am providing my personal data for purposes, herewith defined in association with fulfilling the student contract and meeting legal obligations, in a manner and for a period of time stated in the following data processing declaration provided to me by Pro Mathematica Arte and COLLEGE INTERNATIONAL as joint data processors and on the basis of the Regulation of European Parliament and Council (EU) 679/2016 (General Data Protection Regulation (GDPR)).

I acknowledge that if I choose not to provide my data, I am not able to take part in the Budapest Semesters in Mathematics/ Budapest Semesters in Mathematics Education training provided by the data processors.

Processed data: name, gender, place of birth, date of birth, citizenship, country, address, residential address in Hungary, social insurance number, telephone number, email address, passport number, personal identification number, residence permit number, driver’s license number, letter of recommendation, data of curriculum vitae, former learning outcomes, language knowledge, former educational institutes, chosen program, course, amount of tuition (discount), learning outcomes, profile photograph and signature.

Name and contacts of the data processor: Pro Mathematica Arte (12152 Cabot Avenue, Dundas Minnesota, U.S.A.), COLLEGE INTERNATIONAL (1071 Budapest, Bethlen Gábor tér 2. Tax identification number: 10404364-2-42)

Hungarian representative of the data processors: COLLEGE INTERNATIONAL (1071 Budapest, Bethlen Gábor tér 2.)

Legal basis of the data processing: conclusion and fulfillment of the student contract between the data processor and the data subject, meeting the legal obligations required by the legislation on higher education and foreign citizens (investigation of admission criteria, decision on admission, registration of students and their learning outcomes, control of meeting the learning obligations, certification of data necessary to apply for a visa and a residence permit, data reporting on foreign citizens, certification of data requested by the student).

Purpose of the data processing: practice and fulfillment of contractual rights and obligations, communication, meeting the educational and data reporting obligations required in legislation.

Period of data processing: 80 years at the latest as determined in sub-item 3 of item I/B of Annex no. 3 of Act 204 of 2011.

Receipts, to whom the data are transferred: authority on foreign citizens (Immigration and Asylum Office of Hungary, 1117 Budapest, Budafoki út 60.)

Essence of the agreement on joint data processing is: The educational programs implemented by Pro Mathematica Arte under the name of Budapest Semesters in Mathematics and Budapest Semesters in Mathematics Education, usually for students from the United States of America (U.S.), are implemented in cooperation with COLLEGE INTERNATIONAL. The activity of Pro Mathematica Arte is performed under U.S. law, and the data are collected on the basis of U.S. laws and their own internal rules. The data are processed by COLLEGE INTERNATIONAL as a cooperative partner of Pro Mathematica Arte, an organization providing the personal and institutional background for the training services, the data required by related Hungarian laws. By the Adequacy Decision of European Commission and Privacy Shield between European Union and U.S., data processing in the U.S. is guaranteed.

Furthermore, I declare that on the basis of the following declaration of data processing, I give my consent to process my personal data for the purposes defined herewith and in the manner and time period declared herewith.

I acknowledge that I may choose not to provide my data. I also acknowledge that I should have the right to withdraw my consent any time, but said withdrawal does not affect the legality of data processing prior to the withdrawal. I am aware that I have the right to request my data be erased at any time. If the data is also processed on a legal basis other than this consent, the data processor shall not do so. In this case I should have the right to object to data processing.

The data processed on the basis of the consent may include: profile photograph, data regarding health conditions, smoking habits, preferences on residence, parent/custodian, name, telephone number and email address of emergency contact, recordings of online meetings.

Name and contacts of the data processor: Pro Mathematica Arte (12152 Cabot Avenue, Dundas Minnnesota, U.S.A.), COLLEGE INTERNATIONAL (1071 Budapest, Bethlen Gábor tér 2. Tax identification number: 10404364-2-42)

Hungarian representative of the data processors: COLLEGE INTERNATIONAL (1071 Budapest, Bethlen Gábor tér 2.)

Purpose of the data processing: regarding the profile photograph, the identification of the student; regarding the healthcare data, general information on the health conditions of the students to conduct a health insurance; preferences regarding residence aid in finding appropriate accommodation; in case of the parental/custodian data, the notification on educational outcomes of the student; and contacting the person to be notified in case of emergency. In case of recordings of online meetings: online class meetings may be recorded and shared privately with students in the class for educational purposes, students may download these recordings if needed, but they need to erase them at the end of the course.

Period of data processing: up to five years from the termination of legal student status.

Rights of the data subject are:

The data subject should have the right to receive access to their personal data processed by the data processor. They should have the right to request data rectification and erasure, and to object to data processing. In certain cases they have the right to seek data portability and to request the restriction of data processing (as long as the future of the data is decided). The data processor must respond to the requests of the data subject within one month. Requests may be submitted to the contacts listed in the previous section. The data subject has the right to lodge a complaint to the authority concerned (Hungarian National Authority for Data Protection and Freedom of Information – http://www.naih.hu, address: 1125 Budapest, Szilágyi Erzsébet fasor 22/C, telephone number: +36-1-391-1400, email address: ugyfelszolgalat@naih.hu).

1. Detailed description of each right:

1.1. Right to access

You shall have the right to obtain from the controller confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, access to the personal data and the following information.

You have the right to request information from us including whether we process your personal data.

If that is the case, you have the right to be provided information on and access to the following:

• purpose of the data processing
• categories of the personal data of the data subject
• those recipients to whom to the personal data was provided or will be provided
• planned period over which personal data will be stored
• rights to rectification, erasure, restriction, objection and lodging of complaints
• if the data are not collected from you, information regarding the source of the data

1.2. Right to rectification

You have the right to request that inaccurate personal data regarding you be rectified and — taking the purpose of data processing into account — you can request that incomplete data be completed through a complementary declaration.

1.3. Right to erasure

In the event that:

• personal data are no longer needed for the purpose for which they have been collected and processed, or
• data processing was based on your consent only and you have withdrawn it, or
• you legitimately object the data processing, or
• personal data were processed in an unauthorized manner, or
• personal data must be erased due to legal requirements, or
• data was collected for marketing purposes, then

you have the right to request erasure of the personal data.

If the personal data was made public, in case of an erasing obligation (considering the available technology and costs of the implementation), we will take reasonable steps to provide information to other data processors that you have asked to erase any links to the personal data, or the copy or replication of the data.

The right to erase may not be enforced if the data processing is necessary to practice the right to freedom of expression and right to information; meeting a legal obligation from a public interest regarding public health; archiving for public interest, scientific and historical research and statistics; and to establishment, exercise or defense of legal claims.

1.4. Right to restriction of data processing

You have the right to request that we restrict data processing in the following cases:

• to the period, as long as the accuracy of the personal data is supervised, because you debate them;
• in case of an unauthorized data processing, if you request restriction of use instead of erasure;
• processing of the given personal data is no longer necessary, but you require the data to establish, exercise or defend legal claims;
• you objected to the data processing, as long as the request of objection is examined.

If the data processing is a subject of restriction, the personal data may be processed with your consent only except storing or to establishment, exercise or defense of legal claims or for defending the rights of other persons and for important public interests only. You are preliminary provided information on the removal of the restriction.

1.5. Right to data portability

If you provided your personal data by a voluntary consent or for the purpose of entering into a contract, you have the right to request to receive them in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance from the controller to which the personal data have been provided.

1.6. Right to object

If the data processing took place for direct marketing purposes, you have the right to object the data processing. In this case, the personal data are no longer allowed to be processed for this purpose.

If the data are processed on the basis of the legitimate interest of the controller or another person, you have the right to object data processing. In this case, the personal data shall be no longer processed, and the controller or other party shall erase them unless there is demonstrated compelling, legitimate grounds for the processing that override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.

2. Enforcing the rights of the data subject:

Both during the provision of information and enforcement of the rights of the data subject, appropriate measures are taken so the data subjects shall be provided information in a concise, transparent, intelligible and easily accessible form using clear and plain language, and we shall promote exercising other rights of the data subjects.

The information is provided first of all in writing (including the electronic form) and, at the request of the data subject, also in a spoken form. We reply to electronically submitted requests in an electronic form (unless the data subject requests otherwise).

We will reply to requests regarding the exercising of rights by data subjects — if the identity of the applicant is identifiable — in the shortest possible time period, but at least within one month of receipt of the request, and providing the data subject information on measures taken. Depending on the complexity of the request and number of requests, this period may be extended by two months at the latest. In this case, we will provide information on the reason for extension within one month of receipt of the request.

If no measures are taken to address the request, we inform the data subject of this circumstance and reasons for it within one month of receipt of the request, and then provide the opportunity to lodge a complaint and seek out a judicial remedy.

The data processing information and the reply to the requests in relation to exercise of the rights listed above are provided free of charge. Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may charge a reasonable fee based on administrative costs, or refuse to act on the request.

All those receipts are notified on the rectification, erasure and restriction measures taken by the requests of the data subject about whom the personal data were provided, unless this is impossible or involves a disproportionately great effort.

In case of a data protection breach, if it is likely to bear a high risk to the rights of the data subjects, they are provided information on the breach immediately, either personally or through a public statement.