facilitate mutual legal assistance between authorities and the avoidance of double taxation for the purpose, in accordance with the conditions and scope of data defined in the international agreement, even if conditions set out in subsection (2) do not prevail. (4) Data transfer to an EEA State shall be considered data transfer performed within the territory of Hungary. 8. Restrictions to Data Control Section 9 (1) Should pursuant to provisions governing relevant legislation, international treaties or EU standard contractual clauses, the controller receive personal data in a manner that the data transferring controller concurrently to the transferral of the data indicates a. b. c. d. e. the possible objective of the control, possible duration of the control, possible recipients of the data transferred, restriction to rights ensured for the data subject within the scope of present Act, or other restrictions regarding control in connection with the personal data (hereinafter jointly referred to as control restrictions), the controller receiving the personal data (hereinafter data recipient) controls the personal data in accordance with the extent and mode of restrictions applicable to control and guarantees the rights of the data subject in accordance with restrictions applicable to control. (2) The data recipient is also entitled to control the personal data irrespective of control restrictions and to guarantee the rights of the data subject should the data transfer controller have been provided their preliminary consent to do so. (3) Pursuant to provisions governing relevant legislation, international treaties or EU standard contractual clauses, the controller shall notify the recipient of the control restrictions to be applied concurrently to transferring the personal data. (4) The controller is entitled to provide the consent specified in subsection (2), should this not conflict with legal provisions to be applied in respect of legal subjects under the scope of the jurisdiction of Hungary. (5) Pursuant to their request, the data recipient notifies the data transferring controller of the use of the personal data received. 9. Data Processing Section 10 (1) The controller defines the rights and obligations of the data processor in regard to the processing of personal data within the framework of the present Act, as well as relevant special legislation adopted in connection with the control of data. The controller is responsible for the legitimacy of the instructions they issue. (2) The data processor is not permitted to collaborate with other data processors during the course of the provision of their respective activities. (3) The data processor is not authorised to make any decision effectively affecting the control of the data; is exclusively authorised to process the personal data they acquired knowledge of in accordance with the instructions issued by the controller; is not authorised to process data for their own personal purposes and shall store and safeguard the personal data in compliance with the instructions issued by the controller. (4) The contract concerning data processing must be concluded in writing. Any organisation with vested interests in the use of the personal data to be processed for business purposes cannot be