GENERAL PRIVACY STATEMENT CENTRAL EUROPEAN UNIVERSITY
- Residence and Conference Center -

We place great emphasis on the protection of your personal information and compliance with the applicable data privacy requirements, including specifically the EU General Data Protection Regulation ("GDPR")1. This Privacy Notice relates to the collection, use, transfer, and retention of personal data.

Contents
1 WHO ARE WE? ........................................................................................................................ 1
2 WHAT ARE OUR PURPOSES TO COLLECT YOUR PERSONAL DATA? .................... 2
3 WHAT IS OUR LEGAL BASIS FOR PROCESSING YOUR DATA? ................................. 2
4 WHAT KIND OF PERSONAL DATA DO WE COLLECT? ................................................ 3
5 WHO RECEIVES YOUR INFORMATION? .......................................................................... 3
6 HOW LONG WILL YOUR INFORMATION BE STORED? ............................................... 5
7 WHAT ARE YOUR RIGHTS? ................................................................................................. 5
8 SECURITY OF YOUR INFORMATION ................................................................................ 6
9 FUTURE CHANGES ................................................................................................................. 6

1 WHO ARE WE?
CEU Oktatási-Szolgáltató Nonprofit Kft. Nádor u. 9. 1051 Budapest, HUNGARY privacy@ceu.edu
CEU Center is a residence and conference center operated by CEU Oktatási-Szolgáltató Nonprofit Kft. (seat: 1051 Budapest, Nador u. 9.). CEU Center provides housing and event facilities, related services for students, alumni, faculty, staff, and external guests and partners of CEU Center, Central European University and Közép – _európai Egyetem.
In order to provide services and to comply with our legal obligations, CEU Center maintains and processes personal data collected during the course of our relationship with students, alumni, faculty, staff, and external guests and partners. The majority of the information we hold is obtained directly from you. We always aim to keep your details up to date and secure.
1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

2 WHAT ARE OUR PURPOSES TO COLLECT YOUR PERSONAL DATA?
Your data is used by CEU Center for the purpose of providing housing and event services for you. More specifically, we use your data to:
• Comply with a legal obligation to which we are a subject
• Processing your bookings and cancellations
• Delivering services requested by you
• Verifying your identity when required
• Communicating with you about the services you required
• Implement and enforce our general terms and conditions of business or other agreements concluded with you
• Enable our suppliers and service providers to carry out certain functions on our behalf
• Administering financial operations
• Keep internal records, including the management of feedback and other meaningful interactions
• Perform administrative processes (e.g. processing your requests, payments, or event registrations you have made).
• Compiling the room schedule of the students
• Publishing alumni/student testimonials about CEU Residence Center on its website

3 WHAT IS OUR LEGAL BASIS FOR PROCESSING YOUR DATA?
As part of our work, we process and store personal information relating to students, faculty, staff, alumni and external partners and we therefore adhere to the applicable data protection rules. We take our responsibilities under these rules seriously and ensure the personal information we obtain is held, used, transferred and processed in accordance with the applicable data privacy rules. CEU Center processes the information outlined in this Privacy Notice in pursuit of our legitimate interests in:
• Communicating with students, faculty, staff, alumni, external partners;
• Providing services to students, faculty, staff, alumni, external partners;
• Ensuring the security of our premises;
• Enabling CEU to achieve its strategic and operational goals.
We may pursue these legitimate interests by contacting you by telephone, email, post, or social media. Information about how you can manage the ways that we contact you, including how to opt out from some or all contact from CEU Center, is outlined in the ‘Your rights’ section below.
Although CEU Center relies on legitimate interest as the legal basis for processing where this is not overridden by the interests and rights or freedoms of the data subjects concerned, it recognizes that it is not the only lawful ground for processing data. As such, where appropriate, CEU Center will sometimes process your data on an alternative legal basis – for example, based on a legal obligation (when reporting may be required to the Hungarian or American authorities, for instance) or when you give your explicit consent to us to do so. (e.g. when we help you find a roommate)

4 WHAT KIND OF PERSONAL DATA DO WE COLLECT?
CEU Center maintains records of all students, faculty, staff, alumni and external partners who have used or are currently using its facilities. If we become aware that your personal data has changed we will update our records to reflect this. In subsequent instances where we provide for example your name (e.g. a report to the authorities) we will use your current name alongside any previous names (such as your maiden name) to ensure you can be identified correctly. The personal data we store and process, the majority of which is given to us by you but some of which we may obtain from other sources, may include:
• Name, title, gender, date of birth, nationality, visa/residence permit number, passport or ID number;
• Contact details including postal address, email address, phone number;
• Check in check out dates;
• Credit card details;
• Family and spouse/partner details;
• Medical/health status information;
• Records of communications sent to you by CEU or received from you;
• Personal data provided in the roommate matching questionnaire (personal habits, lifestyle, smoking etc.)

5 WHO RECEIVES YOUR INFORMATION?
CEU Center and CEU offices work closely together to provide a coordinated approach. Any transmission of data between CEU Center and CEU units is managed through agreed processes which comply with relevant data protection legislation.
Unless we have a legal obligation to do so, we will not disclose your data to individuals, organizations, or other entities outside CEU Center other than those who are acting as agents and data processors working on our behalf.
For the purposes set out in section 4, we may need to pass your information to our third-party service providers, agents, subcontractors, CEU Center’s related organizations for the purposes of completing tasks and providing services to you on our behalf. However, with all external entities with whom data is shared, we share only those data needed to perform the specific service and require a contract and/or confidentiality and non-disclosure agreement to be signed before any data transfer—requiring them to keep your information secure and not to use it for their own purposes. We will not sell or rent your information to third parties.
When you are using our secure online reservation system your reservation is processed by a third-party reservation processor specializing in the secure processing of hotel room reservations worldwide and credit/debit card transactions. We do not retain credit card information for future use.
Specific third parties we work with include:
• Microsoft 365: Based in the US, with CEU’s data stored within EU in datacenters located in Amsterdam and Dublin. Software As A Service which provides CEU’s email and document management.
• Booking.com: Based in the Netherlands, Booking.com provides an online reservation platform on our website www.ceucenter.hu
• Hostware: Based in Hungary, this company provides the hotel software and support for our daily operation
• C3: Based in Hungary, C3 provides domain registration for our website www.ceucenter.hu
• SmartMe building technologies: Based in Hungary, this company provides the maintenance of security cameras.
• Assa Abloy Tesa: Based in Hungary and in Sweden this company provides the hotel access system
• In-Kal Zrt: Based in Hungary this company provides security services
• Regulators and other authorities acting as processors based in the US and Hungary who require reporting of processing activities in certain circumstances.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law.

6 HOW LONG WILL YOUR INFORMATION BE STORED?
The personal data included in the roommate matching questionnaire will be managed until CEU Center compiles the room schedule of the students.

7 WHAT ARE YOUR RIGHTS?
−
Access your personal information – you can obtain a confirmation that we are processing your data and information how we process it. We suggest that you make a request in writing.
−
Object to the processing of your personal information – this allows you to ask us to stop processing your data at any time. Where we rely on legitimate interest, you must give specific reasons why you are objecting the processing of your data. In this case this is not an absolute right, we can demonstrate compelling legitimate grounds for processing, which override your interests, rights and freedoms. Where we are processing personal data for scientific or historical research, or statistical purposes, you only have a right to object if our lawful basis for processing is legitimate interest.
−
Rectify – you have a right to have your personal information corrected if it is inaccurate and to have incomplete personal information completed
−
Erase (also known as the right to be forgotten) – in certain circumstances you can ask for the data we hold about you to be erased from our records. Your personal data will be erased where the data are no longer needed for their original processing purpose, or you have withdrawn your consent and there is no other legal ground for processing, or you have objected and there are no overriding legitimate grounds for the processing, or erasure is required to fulfill a statutory obligation under the EU law or the right of the national law.
−
Request data portability – you can ask to have the data we hold about you transferred to another organization.
−
Restrict processing your personal information – where certain conditions apply you have a right to restrict the processing of your personal information
−
Withdraw consent at any time – without affecting the lawfulness of processing based on consent before its withdrawal.
If you wish to exercise any of these rights, please email privacy@ceu.edu or write to us at Quellenstraße 51, 1100 Vienna.
We will make every effort to fulfill your request to the extent allowed by law and will respond within 1 month of receiving your request.
You also have the right to lodge a complaint with the relevant national authority, the contact details are as follows:
AT HUN
Austrian Data Protection Authority Barichgasse 40-42 1030 Vienna, AUSTRIA Phone: +43 1 52 152-0 E-Mail: dsb@dsb.gv.at Web: www.dsb.gv.at
Hungarian Data Protection Authority
Falk Miksa utca 9-11
1055 Budapest, HUNGARY Phone: +36 (30) 683-5969 E-Mail: ugyfelszolgalat@naih.hu Web: https://naih.hu/
In addition to the legal remedy, you have the right to apply to the court against the activities of the Joint Data Controllers.

8 SECURITY OF YOUR INFORMATION
We are committed to holding your data securely and treating it confidential. All data are held securely and in accordance with the relevant data privacy laws and our internal policies. We do not sell to or trade your data with any other organizations.

9 FUTURE CHANGES
If our information policies or practices change at some time in the future, we will post the changes on Privacy Website.
April, 2025