Privacy Policy — Pioneer

Pioneer Stillking Films Kft.

The purpose of this Notice

The purpose of this Notice is to fully present the Data Processing Activities pursued by the Film Producer as Data Controller, in line with the General Data Protection Regulation (GDPR).

Definitions

The capitalized terms used in this Notice shall have the following meaning:

Data Processormeans a natural or legal person which processes Personal Data on behalf of the Data Controller;
Data Processing/Processingmeans any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, storage, alteration, use, transfer;
Data Controllermeans the natural or legal person which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data;
Subcontractors mean the legal persons providing services to the Film Producer under a contract of agency, contract for services or other legal relationship under civil law but only indirectly participating in the Film production process (e.g. suppliers, legal representatives, accountants, tax advisors, members of the payroll staff, auditors, travel agents, catering providers, insurance companies, financial institutions, location lessors, etc.);
Data Subject means a natural person who is identified or is identifiable based on the Data; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, location data, an online identifier; for the purposes of this Notice, this shall include the Contact Persons, Foreign Crew Members, Hungarian Crew Members and the Cast collectively;
Film Productionmeans the activity defined in Section 2 point 20 of the Act II of 2004 on Motion Picture;
GDPRmeans Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);
Contact Personsmean the natural persons identified in the contracts concluded with the Subcontractors;
Foreign Crew Membersmean the natural persons who are non-Hungarian citizens directly participating in the Film Production process under a contract of agency, contract for services or other legal relationship under civil law with the Film Producer or who do not have a direct legal relationship with the Film Producer and whose Personal Data are Processed by the Film Producer in connection with Film Production;
Hungarian Crew Membersmean the natural persons who are Hungarian citizens directly participating in the Film Production and employed by the Film Producer or providing services to the Film Producer under a contract of agency, contract for services or other legal relationship under civil law, as well as the natural persons who are the employees of a legal entity providing services to the Film Producer under a contract of agency, contract for services or other legal relationship under civil law or are employed by such legal entity under a different legal relationship under civil law;
NMHHmeans the National Media and Infocommunications Authority (Nemzeti Média- és Hírközlési Hatóság);
Personal Data/Datameans any information concerning the Data Subject;
Castmeans the natural persons directly participating in the Film Production process, provided to the Film Producer by any agency for the purposes of Film Production or contracted directly by the Film Producer (Hungarian Cast and Foreign Cast), thus in particular performers, cast with or without lines, stunt performers, extras;
Notice means this Privacy Notice;
Pioneermeans Pioneer Stillking Films Kft. (registered office: H-1056 Budapest, Molnár utca 53., company registration number: 01-09-202109, e-mail: ildiko@pioneer.hu) and its affiliates;
Producermeans the foreign producer who ordered Film Production from Pioneer or, in the case of a co-production agreement, foreign co-producer.
Data Controller

With regard to the Data Processing activities determined in this Privacy Notice, the Film Producer shall qualify as the Data Controller.

The purpose of Data Processing, the categories of Data Processed

During its Data Processing activities determined in this Privacy Notice, the Film Producer Processes the Personal Data for the purposes specified in Annex 1.

From among the Personal Data Processed, the Film Producer will only Process those pieces of Data that are justified, having regard to the activity of the Data Subject, and only to the extent to which it is absolutely necessary in order to attain the purpose of Data Processing, by respecting the fundamental rights and freedoms of the Data Subject concerned.

Legal basis for Data Processing

Hungarian Crew Members and Foreign Crew Members

The legal basis of Processing the Personal Data of the Hungarian Crew Members and Foreign Crew Members is the express consent of the Hungarian Crew Member or Foreign Crew Member concerned [Article 6(1)(a) of the GDPR], as well as compliance with the legal obligations applicable to the Film Producer [Article 6(1)(c) of the GDPR]. For Hungarian Crew Members who are natural persons and directly conclude contracts with the Film Producer, the legal bases of Data Processing may also include the conclusion and performance of the contracts with such Hungarian Crew Members [Article 6(1)(b) of the GDPR]. Furthermore, the legal bases of Processing the Personal Data of Foreign Crew Members include the Film Producer’s legitimate interest [Article 6(1)(f) of the GDPR].

If Data Processing is based on the consent of a Hungarian Crew Member or Foreign Crew Member, then consenting to the Data Processing shall be voluntary. Hungarian Crew Members or Foreign Crew Members shall be entitled to withdraw their consent by way of a written statement addressed to the Data Controller any time, on the proviso that this shall not affect the lawfulness of Data Processing based on consent before its withdrawal. If, however, a Hungarian Crew Member or Foreign Crew Member does not grant his or her consent to Data Processing or withdraw the consent given earlier, this may have the consequence that the Film Producer will not be able to conclude the contract with such Hungarian Crew Member or Foreign Crew Member (or the legal entities employing them under an employment, agency, services or other agreement under civil law) or to perform an already concluded contract.

If Data Processing is necessary for the conclusion or performance of a contract or for compliance with a legal obligation applicable to the Film Producer, data provision shall be mandatory for Hungarian Crew Members or Foreign Crew Members. In such case, the consent of Hungarian Crew Members or Foreign Crew Members is not necessary. If a Hungarian Crew Member or Foreign Crew Member fails to provide his or her Personal Data Processed for these purposes, this may have the consequence that the Film Producer will not be able to conclude the contract with such Hungarian Crew Member or Foreign Crew Member (or the legal entities employing them under an employment, agency, services or other agreement under civil law) or to perform an already concluded contract.

In connection with the Processing of Personal Data of Foreign Crew Members, the Film Producer has a legitimate interest in Data Processing to properly allow for the performance of the Film Production contract concluded with the Producer, along with proper communication between the parties.

Cast and Contact Persons

The legal basis for Processing the Personal Data of the Cast and Contact Persons is the express consent of the Cast and Contact Persons concerned [Article 6(1)(a) of the GDPR], as well as compliance with the legal obligations applicable to the Film Producer [Article 6(1)(c) of the GDPR] to fulfil the registration, book-keeping and other obligations in connection with them.

The legal bases of Processing the Personal Data of Cast and Contact Persons include the Film Producer’s legitimate interest [Article 6(1)(f) of the GDPR].

In connection with Processing the Personal Data of the Cast, the Film Producer has a legitimate interest in being able to properly keep contact with the Cast during the Film Production process and to obtain the necessary copyright declarations from them.

In connection with the Processing of Personal Data of Contact Persons, the Film Producer has a legitimate interest in the Data Processing to properly allow for the performance of the relevant contract, along with proper communication between the contracting parties.

Furthermore, the legitimate interests of the Film Producer in Processing the Personal Data of Foreign Crew Members, Cast and Contact Persons may include but not be limited to the case where Data Processing is necessary to certify compliance with statutory obligations applicable to the Film Producer in an ongoing process before an authority, litigation or other official procedure, or for the establishment, exercise or defense of legal claims.

If Data Processing is based on legitimate interest and a Foreign Crew Member, Cast or Contact Person fails to provide his or her Personal Data to the Film Producer, this may have the consequence that the Film Producer will not be able to conclude a contract with such Foreign Crew Member, Cast or Contact Person (or the legal entities employing them under an employment, agency, services or other agreement under civil law) or to perform an already concluded contract.

Data controllers/Data Processors used

In certain cases, Subcontractors may Process Personal Data for the purposes of performing the contract concluded with or in the name and on behalf of the Film Producer. In addition, certain Hungarian Crew Members and/or Foreign Crew Members participating in the Film Production process may also Process Personal Data to facilitate the Film Production process, for the purposes of performing the contract concluded with or in the name and on behalf of the Film Producer.

In the above cases, the Subcontractors, Hungarian Crew Members and Foreign Crew Members act as Data Controllers or Data Processors in respect of the Data Subjects’ Data.

If they act as Data Processors, the Subcontractors, Hungarian Crew Members and Foreign Crew Members shall only Process the Data based on the Film Producer’s instructions and for the period and in the manner determined by the Film Producer.

Persons authorized to access the Data

The Data shall only be accessed by those persons within the organization of the Film Producer or the Subcontractors, and those Hungarian Crew Members and Foreign Crew Members and/or the persons within their organizations who have the proper authorization thereto, and for whom it is absolutely necessary and indispensable for performing their obligations under contract or law.

Duration of Data Processing

The Film Producer shall retain the Personal Data concerning the Data Subjects for 8 years from the date of their recording.

Following expiry of the above data retention period, the Film Producer will erase the Data Processed.

The Film Producer shall not be obliged to erase the Data as above if the Film Producer has a legitimate interest in retaining the Data for longer than the above data retention period. Such legitimate interests shall include — but not be limited to — using the Data as evidence in procedures before courts or other authorities, or to certify compliance with the statutory obligations applicable to the Film Producer in an ongoing process before an authority, litigation or other official procedure.

In case of a relevant request from a court or authority, the Data Controller shall send the recorded Data to the court or authority without delay.

Data transfer

As necessary, the Film Producer may transmit the Personal Data to authorities or courts acting in their official capacity, if transmission of such Data is necessary on suspicion of a crime or offense, or upon request of the authority or court in order to investigate a suspicion of a crime or offense, or to certify compliance with the statutory obligations applicable to the Film Producer, or for the establishment, exercise or defense of legal claims.

The Film Producer may also transmit the Personal Data to the Producer in connection with the Film Production.

If the Producer is a company based in Canada, the following provisions shall apply to data transfer: In its Decision 2002/2/EC of 20 December 2001, the European Commission determined with regard to Canada that Canada ensures the adequate level of protection of Personal Data in the case of data transfers to the organizations subject to the Personal Information Protection and Electronic Documents Act, and so, pursuant to Article 45(1) of the GDPR, the transfers to such recipients shall not require any specific authorization. Given that the above-named Act applies to the Producer, the adequate level of protection of Personal Data transferred to it is ensured.

If the Producer is a company based in the USA, China or other third country outside of the EEA that is not subject to any effective adequacy decision made by the European Commission, the following provisions shall apply to data transfer: Given that in these countries the adequate level of protection of Personal Data is not ensured, the Film Producer provides appropriate and suitable safeguards for the Data Subjects [Article 46(2)(c) of the GDPR] necessary for the transfer of Data to the Producer through the application of standard contractual clauses approved by the European Commission. The Data Subject may request of copy of the data transfer agreement and the standard contractual clauses at the e-mail address indicated in Section 2(o).

Apart from the above, the Film Producer shall not transfer any Personal Data to any other party, for any purpose whatsoever.

The Data Subjects’ rights related to Data Processing

In accordance with the applicable data protection regulations, Data Subjects shall have the right to: (i) request access to the Personal Data concerning them; (ii) request the rectification of their Personal Data; (iii) request the erasure of their Personal Data; (iv) request the restriction of Processing of their Personal Data; (v) exercise their right of data portability regarding their Personal Data; and (vi) object to the Processing of their Personal Data.

(i) Right of access:	Data Subjects shall have the right to obtain confirmation as to whether or not Personal Data concerning them are being Processed, and, where that is the case, access to the Personal Data and certain information relating to Data Processing. The right of access shall extend to, inter alia, the following information: the purpose of Data Processing, the categories of Data Processed, the recipients to whom the personal data have been transferred. Data Subjects shall also be entitled to request a copy of their Personal Data Processed by the Data Controller.
(ii) Right to rectification:	In certain cases, Data Subjects shall have the right to obtain the rectification of inaccurate Personal Data concerning them, upon their request, and/or to have incomplete Personal Data completed.
(iii) Right to erasure (‘right to be forgotten’):	In certain cases, Data Subjects shall have the right to obtain the erasure of the Personal Data concerning them, upon their request, and the Data Controller may be obliged to erase such data.
(iv) Right to restriction of processing:	In certain cases, Data Subjects shall have the right to obtain the restriction of Processing of the Personal Data concerning them, upon their request. In such cases the affected Personal Data may only be Processed for specified purposes.
(v) Data portability:	In certain cases, Data Subjects shall have the right to receive the personal data concerning them in a structured, commonly used and machine-readable format and to transmit those data to another controller. Furthermore, Data Subjects may have the right to have the Personal Data transmitted directly from one data controller to another, where technically feasible.
(vi) Right to object:	In certain cases, Data Subjects shall be entitled to object to the Processing of their Personal Data, and in such cases the Data Controller shall not continue to Process such Data.

Please consider in connection with the above rights that, in certain cases, the request may only be completed to a limited extent or not at all, due to the nature of the Data, and that the above rights are not unlimited and, under the governing privacy laws, exercising them may be subject to certain conditions.

The Data Subject may exercise the above rights by a postal letter sent to the Film Producer to its address or by electronic mail sent to the Film Producer’s e-mail address, both specified in Section 2(o) of this Notice. The Data Controller shall reply to the requests within the shortest time possible, and no later than within 1 (one) month.

Furthermore, Data Subjects shall have the right to file a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, registered office: H-1125 Budapest, Szilágyi Erzsébet fasor 22/c, telephone: +36 (1) 391-1400, e-mail: ugyfelszolgalat@naih.hu, web: www.naih.hu) and/or turn to the regional court of their permanent or temporary residence, at their choice, on grounds of unlawful Data Processing.

Amendment of this Notice

The Film Producer is entitled to amend this Notice in the event of any change in the legislative environment or the Film Producer’s Data Processing activities. The date of last revision is indicated at the end of this Notice. Please make sure to check this Notice from time to time, so that you have up to date information regarding the processing of your Personal Data.

Date of last amendment: November 8, 2021

The Data Controller shall process the personal data for the purpose, on the legal basis and for the duration specified below

No.	Name and purpose of data processing	Categories of personal data processed	Legal basis of data processing	Retention period
1.	Hungarian crew members (company) Contracting, liaising, bookkeeping, statistical purposes Health data in case of injury or illness for insurance or health care providing purposes	Identification data: surname, forename, date and place of birth, address, mobile phone number, mother’s maiden name, type of identification document, ID card number and copy, citizenship, passport number and date of expiry and copy, social security number or copy of EU health care insurance card, e-mail address Data related to the commission: position, department, date of join and leave, activities, name of the person to be notified in case of an accident, his/her telephone number, licenses, school reports Invoiced services, Payment and reimbursement details In case of minors: copy of the work permit issued by the child welfare authority, that includes educational data, and the name(s) and addresses of the parents/custodians Company public information (Company name and type, address, tax number, representative, registry number), specimen signature, small tax payer status declaration (start date of registration), articles of association, master file of private entrepreneur an copy (private entrepreneurship registration number), copy of private entrepreneur’s license, or certification of registration, confirmation of study in case of students Data indicated in the statements and on the forms requested by the Data Controller on a case-by-case basis in connection with specific Projects and for compliance purposes associated with such Project Health data, allergy information T-shirt size	Data Subject’s consent [GDPR Article 6 (1) a)] Legal obligation [GDPR Article 6 (1) c)] Legitimate interest of the Data Controller or third party [GDPR Article 6 (1) f)] Data Subject’s consent [GDPR Article 9. (2) a)]	Until withdrawal of consent or 8 years
2.	Hungarian and foreign cast & crew members (private individuals) Contracting, liaising, bookkeeping, statistical purposes	Identification data: surname, forename, date and place of birth, address, mother’s maiden name, type of identification document, ID card number and copy, citizenship, passport number and date of expiry, copy of address card, social security number or EU health care insurance card, tax number, mobile phone number, e-mail address, bank account number, bank name, copy of certification of graduation, health care book, exit papers from previous employer. Data related to the commission: position, department, date of join and leave, activities, name of the person to be notified in case of an accident, his/her telephone number, licenses, school reports Payment and reimbursement details In case of minors: copy of the work permit issued by the child welfare authority, that includes educational data, and the name(s) and addresses of the parents/custodians Data indicated in the statements and on the forms requested by the Data Controller on a case-by-case basis in connection with specific Projects and for compliance purposes associated with such Project Health data, allergy information T-shirt size	Data Subject’s consent [GDPR Article 6 (1) a)] Performance of a contract with the Data Subject [GDPR Article 6 (1) b)] Legal obligation [GDPR Article 6 (1) c)] Legitimate interest of the Data Controller or third party [GDPR Article 6 (1) f)] Data Subject’s consent [GDPR Article 9. (2) a)]	Until withdrawal of consent or 8 years
3.	Extras Liaising, copyright statement, statistical purposes	Data necessary for the notification of the natural person: surname and forename, date of birth, address of domicile, ID number, signature, name of parent/custodian Data indicated in the statements and on the forms requested by the Data Controller on a case-by-case basis in connection with specific Projects and for compliance purposes associated with such Project Health data T-shirt size	Data Subject’s consent [GDPR Article 6 (1) a)] Legitimate interest of the Data Controller or third party [GDPR Article 6 (1) f)] Data Subject’s consent [GDPR Article 9. (2) a)]	Until withdrawal of consent or 8 years
4.	Contact persons specified in contracts with contractors, agents, current or potential suppliers providing services for the Data Controller.	Name, e-mail address, telephone number, position Data indicated in the statements and on the forms requested by the Data Controller on a case-by-case basis in connection with specific Projects and for compliance purposes associated with such Project (	Legitimate interest of the Data Controller or third party [GDPR Article 6 (1) f)]	8 years
5.	For the protection of the safety and health of the Hungarian and foreign crew members and cast (“Data Subjects,”) in order to prevent the spread of the COVID-19 coronavirus (“COVID-19”) and to reduce the risk of disease by way of compliance with the applicable protocols, including: · COVID-19 health and safety protocol; · COVID-19 information; · Information on high risk factors; · social distancing, facial covering, hygiene protocol; · self-screening questionnaire in relation to COVID-19 and the information thereon; · COVID-19 testing consent form · COVID-19 test results, vaccination information, data of protection card.	Identification data: name, position Questionnaire data (if applicable): log-in data (name, e-mail address, phone number; ID. if applicable); Data relating to body temperature; Data relating to whether the Data Subject experiences COVID-19 symptoms; replacement of individuals with positive COVID-19 test results, measures necessary to replace the services of individuals with COVID-19 positive test results or of those in quarantine; Contact persons data (name, position) Whether they experience COVID-19 symptoms; Data relating to travels: in relation to the Data Subject, anyone in the Data Subject’s household and/or contact persons (name of the country, if applicable); COVID-19 testing: test results. Data required for the procedures for granting entry into Hungary, release of home quarantine and / or termination of epidemiological surveillance (personal data – name, place and date of birth, mother’s name, travel document number, place and date of entry, countries of entry and transit, place of residence, COVID-19 test results). Copy of COVID-19 vaccination card, data of vaccinations as far as COVID vaccination card or protection card is necessary for travelling to or using shooting locations.	Data Subject’s consent [GDPR Article 6 (1) a)] Data Subject’s explicit consent [GDPR Article 9. (2) a)]	Until withdrawal of the consent or 14 days or as long as it is necessary for the purposes of the production.

Date of last amendment: November 8th, 2021

Pioneer Stillking Privacy Policy in Hungarian