Privacy statement
Of data requested by Deloitte companies operating in Hungary for customer due diligence and client acceptance procedures
1. Customer due diligence
Act LIII of 2017 on the Prevention and Combating of Money Laundering and the Financing of Terrorism (hereinafter referred to as "Anti-Money Laundering Act") requires entities providing particular services — including also Deloitte entities operating in Hungary, i.e. Deloitte Advisory and Management Consulting Private Limited Company, Deloitte Auditing and Consulting Ltd., Deloitte CRS Ltd., Deloitte Legal Göndöcz and Partners Law Firm (hereinafter together referred to as "Deloitte") — to perform a background check of future clients in the manner set out by the Anti-Money Laundering Act (hereinafter referred to as "customer due diligence") prior to the execution of the respective contract.
Although data supply is voluntary for such customer due diligence, Deloitte is required by the Anti-Money Laundering Act to refuse cooperation with the prospective client if such data supply fails to take place (should the customer due diligence fail). The data processing is prescribed by law (GDPR 6.§ 1. (c)).
Client data are processed by Deloitte as data controller according to the provisions of the Anti-Money Laundering Act and shall be regularly updated and retained for 8 (eight) years from the termination of the business relationship.
As part of the customer due diligence process, ownership structures are identified and documented, risk assessment activities are performed, and identification forms and supporting information are collected from clients. In carrying out these activities, data and information obtained from publicly available sources, as well as information provided by the client, are used. In the frame of the customer due diligence the client, the natural person acting on behalf or in the name of the client (proxy, person authorized to proceed or representative), the owners identified in the ownership structure and the beneficial owners of the client shall be identified. Deloitte’s identification forms used in the customer due diligence procedure are in line with the relevant legal requirements, and they only contain the obligatory data scope, thus the obtaining of those data may not be omitted, if required.
The following personal data may be collected and processed (not all categories of data are relevant or applicable to every type of data subject):
- First and last name
- Permanent residence address
- Temporary residence address (if different form the above address)
- Date and place of birth
- Mother’s maiden name
- Citizen personal identity number, ID number assigned upon birth, national register number or other similar identity number
- Nationality or citizenship
- Type of ID document (identity card or passport) and number of the document
- Document issuance and expiry dates
- Document issuing state and authority
- Nature and extent of the ownership
- Politically Exposed Person status
- Information relating to funds and assets
Please be informed that according to Section 7 (8) of the Anti-Money Laundering Act Deloitte is obliged to prepare copies of the documents presented for the purposes of identification and verification of identity (except for the back of the official address card proving personal identification).
2. Client acceptance
In addition to the customer due diligence obligation imposed in respect of certain services under the Anti-Money Laundering Act, Deloitte is required to carry out client acceptance procedure in respect of each client in accordance with Deloitte group’s internal policies . Such client acceptance procedure is designed to identify and prevent money-laundering, also to perform an internal client acceptance in the case of services outside the scope of the Anti-Money Laundering Act (hereinafter referred to as "client acceptance").
Regarding client acceptance, steps required by internal policies, such as screenings, ownership structure preparation, tasks related to risk assessment are carried out. The client acceptance is based exclusively on data and information extracted from publicly available databases. Should personal data be involved during the client acceptance (such as first and last name, nationality or citizenship, nature and extent of the ownership, other publicly available information) the legal basis of the data processing is Deloitte's legitimate interest in completing the client acceptance and be in compliance with internal policies. Data subjects may be the owners identified in the ownership structure, ultimate beneficial owners, executives and statutory representatives of the client. Otherwise, the provisions of this privacy statement shall be applicable for the processing of such personal data (data controller, retention period, data security, data subject rights).
3. Data Recipients / categories of persons or entities having access to personal data processed
- Deloitte's designated personnel involved in providing services to the client concerned, Deloitte CE[1] staff responsible for Deloitte CE AML policy implementation and Deloitte CE AML compliance program.
- Deloitte CE approved Data Processors providing administrative and IT support auxiliary services to Deloitte CE as agreed in a written authorisation/contract. (for detailed information please see Deloitte Central Europe Privacy Statement | Deloitte CE)
- Other entities within Deloitte CE, where applicable.
- Public authorities, Financial Intelligence Units, supervisory bodies, courts/law enforcement bodies, where legally required.
4. Data handover
According to Section 22 of the Anti-Money Laundering Act the service provider obliged by such Act shall be entitled to accept the result of the client due diligence of another service provider shall the conditions determined in the Act fulfil. If – in the course of a Deloitte's customer due diligence performed pursuant to the Anti-Money Laundering Act – the client has provided consent Deloitte may provide copies of the data and documents required to perform the customer due diligence to another Deloitte company contracting with the client in the future. If such handover is carried out based on the client's consent, Deloitte receiving the copies of the data and documents, will use them solely for client due diligence purposes as described in this notice
5. Data security
Deloitte ensures data protection, i.e. protects data from unauthorised access, modification, transfer, publication, deletion or destruction, incidental destruction or damage, as well as from becoming inaccessible pursuant to the provisions of the Regulation no 2016/679 of the European Parliament and the Council on General Data Protection Regulation (hereinafter referred to as “GDPR”). Deloitte CE is a holder of ISO 27001 certification – widely recognized global information standard.
6. Data subjects’ rights
Requests related to the exercise of data subjects’ rights shall be addressed to the respective Deloitte company (registered office: 1068 Budapest, Dózsa György út 84/C).
Rights of the data subjects concerning processing:
- Right to information (access): the data subject may request information about the processing of his/her personal data at any time. When requested by the data subject in writing, the controller provides information about the categories of personal data concerned, the purpose and duration of processing, the recipients, the rights of the data subject and the possibility to file complaints to the authority.
- Right to rectification: the data subject has the right to request the clarification or supplementation of their processed data at any time. The data subject must submit facts and evidence supporting the need for rectification to any request for the rectification of data.
- Right to object: the data subject may object to the processing of his or her data at any time on grounds relating to his or her particular situation.
- Right to erasure: a data subject may request their data to be erased when processing is no longer required in line with the AML Act the data subject’s data are processed unlawfully, or
- Right to restriction: the data subject has the right to request the restriction of the processing of their data by the controller
- if the accuracy of the data is disputed (the restriction applies until it is established whether it is indeed or it is not necessary to clarify the data),
- if the data processing is unlawful, and the data subject objects to their deletion and requests their restriction instead,
- if the data controller has no longer any use of the data for the defined purpose, but the data subject needs them for filing, asserting or protecting legal claims,
- the data subject has objected to data processing; in this case, the restriction applies for the period until it is established whether the legitimate reasons of the controller override those of the data subject.
The data controller shall inform the data subject in writing of the execution of the data subject's request within 30 (thirty) days of its receipt. Data subjects may submit their requests, statements, comments or questions related to the processing of their data by post in a letter sent to the attention of the respective Deloitte to the address 1068 Budapest, Dózsa György út 84/C or by sending an e-mail message to the dataprivacyHU@deloittece.com e-mail address.
- Right to legal remedy: In case their rights are violated, data subjects have the right to turn to the competent court according to their place of permanent or temporary residence, and anyone may request the National Authority for Data Protection and Freedom of Information (address: 1055 Budapest, Falk Miksa utca 9-11., postal address: 1363 Budapest, Pf., e-mail: ugyfelszolgalat@naih.hu, telephone number: +36 (1) 391 1400, website: https://naih.hu/) to conduct an investigation due to the fact that an infringement of right occurred or there is an imminent threat thereof. The court shall proceed in relation to the subject of the request immediately.
7. Application of data privacy provisions
The provisions of the Data Privacy Act apply only to (personal) data of natural persons; and thus are not applicable for the processing of corporate information. Corporate information and documentation recorded in and deleted from the commercial register are publicly available according to Act V of 2006 on Public Company Information, Company Registration and Winding-up Proceedings.
[1] Deloitte Central Europe (“Deloitte CE”) refers to the regional organization of entities organized under the umbrella of Deloitte Central Europe Holdings Limited, the member firm of DTTL. DTTL and each of its member firms are legally separate and independent entities.
