Employee questionnaire data protection notice

DATA PROTECTION NOTICE

for the Employee Questionnaire of the “Leadership Practices and Organisational Relationships” Research Study

jovezeto.hu

1. Introduction

1.1. Purpose of this Data Protection Notice

This Data Protection Notice (hereinafter: “Notice”) provides transparent and detailed information about the processing of data in connection with completion of the employee questionnaire used in the research study entitled “Leadership Practices and Organisational Relationships”, including the purposes and legal basis of processing, the retention period, measures designed to ensure anonymity and data security, and the rights of data subjects.

1.2. Legal framework

Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, GDPR).

Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Hungary) (Infotv.).

The legal basis for processing is the data subject’s freely given, specific, informed and unambiguous consent pursuant to Article 6(1)(a) of the GDPR.

2. Data Controller

Data Controller

Kollár László János

Capacity

PhD student

Organisation

University of Debrecen, Faculty of Economics and Social Sciences

Address

4032 Debrecen, Böszörményi út 138., Hungary

E-mail

kollar.laszlo@econ.unideb.hu

Research platform

jovezeto.hu

3. Definitions

Personal data: any information relating to an identified or identifiable natural person.

Data subject: for the purposes of this Notice, the employee completing the questionnaire.

Processing: any operation or set of operations performed on personal data.

Data Controller: the person who determines the purposes and means of processing personal data.

Data Processor: a person or organisation that processes personal data on behalf of the Data Controller.

Consent: any freely given, specific, informed and unambiguous indication of the data subject’s wishes.

Anonymisation: a process after which data can no longer be related to an identified or identifiable natural person.

Personal data breach: an event leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

4. Description of the Research

The research examines how authentic and servant leadership characteristics are related to employees’ job satisfaction, organisational commitment and longer-term retention in Hungarian small and medium-sized enterprises.

The research is based on Hungarian adaptations of the Authentic Leadership Integrated Questionnaire (AL-IQ) and the Servant Leadership Survey (SLS-18). It uses a 360-degree assessment framework: in addition to the leader’s self-assessment, at least two direct employees anonymously evaluate the leader’s practices. Data collection and processing of results take place through the jovezeto.hu online platform.

5. Principles of Data Processing

Lawfulness, fairness and transparency.

Purpose limitation: data are processed only for predefined research purposes.

Data minimisation: only data necessary for carrying out the research are processed.

Accuracy: reasonable efforts are made to ensure the accuracy of processed data.

Storage limitation: any technical data capable of identifying a person are retained only for as long as necessary.

Integrity and confidentiality: appropriate technical and organisational measures are used to protect the data.

6. Purposes and Legal Basis of Processing

6.1. Completion of the employee questionnaire

The purposes of processing are to conduct the research, enable questionnaire-based data collection, aggregate anonymous employee feedback, examine relationships between leadership practices and employee experiences, and prepare scientific analyses, a doctoral dissertation, studies, publications and conference presentations.

Legal basis: consent of the data subject pursuant to Article 6(1)(a) of the GDPR.

6.2. Participation by employees

The employee accesses the questionnaire through an anonymous invitation link generated by their direct leader. The researchers do not directly process the employee’s personal contact details. Participation is voluntary; choosing not to complete the questionnaire does not result in any disadvantage within the research.

7. Categories of Data Processed

Questionnaire responses.

Assessments concerning the leader’s practices.

Responses concerning the employee’s workplace experiences and job satisfaction.

Anonymous organisational background information.

Technical identifiers related to operation of the system.

No directly identifying personal data are requested in the employee questionnaire. The purpose of the research is not to identify individual employees, but to obtain anonymous evaluations of leadership practices and to conduct aggregated research analyses.

8. Anonymity and Data Minimisation

Protecting employee anonymity is a key design principle of the research. Employee responses are shown in the leader’s feedback report only in aggregated form. The leader cannot access the responses of individual employees.

The system produces a leadership report containing employee feedback only after at least two employee questionnaires have been completed. This reduces the possibility of tracing an individual evaluation back to a particular employee. Only the minimum amount of data required for the research purpose is processed.

Anonymity does not necessarily mean absolute technical anonymity at every stage of system operation: technical identifiers may be generated for operational purposes, but their processing is not intended to reveal the identity of the employee.

9. Source of Data and Method of Invitation

The research system generates an anonymous invitation link to the questionnaire, which is forwarded to the employee by their direct leader. The researchers do not process the employee’s name, e-mail address or other direct contact details for the purpose of sending the invitation.

10. Storage, Access and Retention

10.1. Storage and access

Data are stored electronically in password-protected digital systems. Processing takes place partly in the LimeSurvey questionnaire system and partly in the back-end system of the jovezeto.hu platform. Data are transmitted through an encrypted connection.

Research data may be accessed only by authorised researchers involved in the study, in particular Kollár László János and Dr. Pierog Anita. The leader may see only anonymous, aggregated employee results and cannot access individual employee responses.

10.2. Retention period

Data are processed for five years following completion of the research. Any technical data capable of identifying a person will then be deleted or anonymised. The anonymous research dataset may continue to be retained for scientific purposes.

11. Data Processors and Technical Service Providers

Technical service providers may participate in carrying out the research, in particular in hosting and operating the jovezeto.hu platform and its back-end systems and in providing the LimeSurvey questionnaire system. Such providers may process data only to the extent necessary to provide their services and in accordance with applicable data protection rules.

The exact names and contact details of the hosting provider and any other data processors should be specified in the current data protection notice published on jovezeto.hu. This document does not add service-provider details that are not substantiated by the available source documents.

12. Data Security

Electronic datasets are stored in password-protected systems.

Access is restricted to authorised persons.

Data are transmitted through an encrypted connection.

Anonymous report generation and separate handling of identifiers reduce the risk of re-identifying individual responses.

The Data Controller applies technical and organisational measures proportionate to the risks in order to protect data against unauthorised access, alteration, loss or disclosure.

13. Use and Publication of Research Results

Research results are used and published only in anonymous, aggregated form in scientific studies, a doctoral dissertation, professional or academic presentations and conference materials. No individual employee response or personally identifying information will appear in publications.

Employee assessments appear in the feedback report prepared for the leader only in aggregated form and only if at least two employee questionnaires have been completed.

14. Rights of Data Subjects

14.1. Right to information and access

The data subject has the right to request information about the processing of personal data concerning them and, where the data can be linked to them, to request access to such data and to the essential circumstances of processing.

14.2. Right to rectification

The data subject may request correction of inaccurate personal data concerning them where the data can be linked to them.

14.3. Right to erasure

Where the conditions set out in the GDPR are met, the data subject may request erasure of personal data that can be linked to them, in particular where the purpose of processing has ceased, consent has been withdrawn and there is no other legal basis for processing, or processing is unlawful.

Data that have been irreversibly anonymised and can no longer be linked to the data subject are no longer personal data; consequently, data-subject rights cannot be exercised in relation to such data.

14.4. Right to restriction of processing

In the cases specified by the GDPR, the data subject may request restriction of the processing of personal data that can be linked to them.

14.5. Right to data portability

Where the conditions under the GDPR are met and the data subject can be identified, they have the right to receive personal data they have provided to the Data Controller in a structured, commonly used and machine-readable format.

14.6. Withdrawal of consent

Participation in the research is voluntary. The data subject may withdraw consent at any time without giving reasons. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. If data have already been anonymised and can no longer be linked to the data subject, subsequent identification and deletion of those data is not possible.

14.7. Exercising data-subject rights

Requests concerning data-subject rights may be sent to kollar.laszlo@econ.unideb.hu. The Data Controller will respond within the time limit prescribed by the GDPR, as a general rule within one month. Due to the anonymous nature of data collection, certain rights can be exercised only for as long as, and to the extent that, the relevant data can actually be linked to the data subject.

15. Personal Data Breaches

The Data Controller handles personal data breaches in accordance with the GDPR. Where a breach is likely to result in a risk to the rights and freedoms of natural persons, it will be reported to the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. Where the risk is high, affected data subjects will also be informed in accordance with the GDPR.

16. Remedies

If the data subject considers that the processing of their personal data infringes applicable data protection law, they may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)

Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary

Postal address: 1363 Budapest, P.O. Box 9., Hungary

Telephone: +36 (1) 391-1400

E-mail: ugyfelszolgalat@naih.hu

Website: www.naih.hu

The data subject may also bring proceedings before a court in the event of unlawful processing of personal data. At the data subject’s choice, proceedings may also be brought before the competent court of their place of residence or stay.

17. Cookies and Technical Processing on jovezeto.hu

Technical cookies and other technical identifiers necessary for the operation of jovezeto.hu may be used. If the website uses cookies or similar technologies that are not strictly necessary for its operation, their use must have an appropriate legal basis under applicable law. The cookies actually used and the detailed rules governing them should be set out in the current cookie and data protection notices published on jovezeto.hu.

18. Final Provisions

This Notice applies to research-related data processing connected with the employee questionnaire. The Data Controller may amend the Notice where necessary, in particular following changes in law, the research process or the technical solutions used. The current version may be published on jovezeto.hu.

Issued in Debrecen, 9th September 2026

Kollár László János
PhD student
University of Debrecen, Faculty of Economics and Social Sciences