PRIVACY AND DATA PROTECTION NOTICE
The purpose of this Privacy and Data Protection Notice (hereinafter referred to as the "Notice") is to fully regulate the data protection and data management principles and the data protection and data management policy of the Service Provider in relation to the accommodation provided by Huszár-Egry Ágota (hereinafter referred to as the "Service Provider" or the "Controller") in its Aquaflat apartment accommodation (hereinafter referred to as the "Accommodation/Service") and other related services provided by the Service Provider.
The Service Provider operates the www.aquaflat.hu website (hereinafter: Website), where the booking system and webshop operated by the Service Provider are available.
The purpose of this Notice is also to provide information on all aspects of the services provided by the Service Provider, in particular www.aquaflat.hu in the operation of the website, all natural persons concerned (hereinafter referred to as "Data Subjects") should have access at all times to information that allows them to establish with certainty and clarity how their data is processed by the Service Provider, and to be assured that their fundamental freedoms and their rights to the processing, protection and privacy of their personal data are respected by the Service Provider at all times during the processing of their personal data, regardless of their nationality, place of residence or domicile.
This Notice applies to all processing carried out by the Service Provider.
The Service Provider is the data controller for the data processing activities listed in this notice.
If you have any questions or comments in connection with the processing of your personal data, you can contact the Data Controller using the following contact details.
Company name: Ágota Huszár-Egry
Registered office: 15 Tamás Tanító u., 8630 Balatonboglár, 8630 Balatonboglár.
Tax number: 54945661-1-34
Website: www.aquaflat.hu
E-mail address: aquaflat@aquaflat.hu
Phone: +36309384850
The Data Controller provides its services from Hungary. Accordingly, the provision of the service and the processing of personal data in the course of the use of the service are subject to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as the "GDPR"): GDPR), and Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (hereinafter: Infotv.) shall apply.
In preparing the information, the Service Provider has also taken into account the provisions of Act V of 2013 on the Civil Code (hereinafter: Ptk.), Act CLV of 1997 on Consumer Protection (hereinafter: Fgytv.), Government Decree 45/2014 (26.II.) on the detailed rules of contracts between consumers and businesses, and Act C of 2000 on accounting (hereinafter: Számvtv.)
Brief explanations of terms used in this Privacy Notice:
Personal Data: any information relating to a natural person who is identified, directly or indirectly, or who can be identified on the basis of one or more factors or attributes which identifies or identifies that natural person.
Data processing: any operation or set of operations which is performed upon personal data, regardless of the means by which it is carried out; in particular, the collection, recording, recording, organisation, storage, alteration, use, consultation, disclosure, transmission, alignment or combination, blocking, erasure and destruction of data, as well as the prevention of their further use, the taking of photographs, audio or video recordings, and the physical characteristics which can be used to identify a person (e.g. fingerprints, palm prints, DNA samples, iris scans).
Joint processing: a type of processing of personal data where the purposes and means of processing are determined jointly by two or more controllers and the obligations and responsibilities for compliance are set out in an agreement between them.
Data Controller/Service Provider: Ágota Huszár-Egry, who determines the purposes and means of the processing of personal data.
Processing: the performance of technical tasks on personal data related to processing operations, regardless of the method and means used and the place of application.
Data processor: a natural or legal person who processes personal data on behalf of or under the authority of the controller.
Consent: a voluntary, explicit and properly informed indication of the data subject's wishes, by which the data subject unambiguously signifies, by means of a statement or other conduct, that he or she agrees to the processing of his or her personal data.
GDPR: the General Data Protection Regulation 2016/679 of the European Parliament and of the Council, which contains binding rules on the processing of personal data and on the exercise of data subjects' rights in relation to the processing of their personal data.
Restriction of processing: marking of personal data stored in order to restrict their processing in the future.
Recipient: a natural or legal person, public authority or other body to whom or to which personal data are disclosed by the controller or processor.
Anonymisation: operations which, once carried out, no longer make it possible to identify the specific individual to whom the personal data relate, i.e. the data lose their personal character and no longer allow the identification of any natural person identifiable, and the link between the data subject and the data can no longer be established.
Supervisory Authority: an independent authority established to protect the rights and freedoms of natural persons with regard to the processing of personal data and to facilitate the free flow of personal data within the EU; in Hungary, the National Authority for Data Protection and Freedom of Information.
Data breach: a breach of data security resulting in the accidental or unlawful destruction, loss, alteration, disclosure to unauthorised persons or access by unauthorised persons of personal data transmitted, stored or otherwise processed.
Cookie: also known as a "cookie", a so-called anonymous visit identifier, which is used by the www.aquaflat.hu on the computers of data subjects who visit the website or access their profiles that may have been created on the website. A cookie is a unique piece of data that can be used to store the settings used on the website and to track how the visitor has accessed the website and what actions they have performed.
Website: www.aquflat.hu an online platform available at the address which the data subjects visit in order to view the site and to use the services offered by our Company through it.
Consumer: a natural person acting outside the scope of his or her profession, self-employment or business activity.
The Service Provider shall process, store and use personal data for the purposes of achieving the data management objectives set out in this notice, which are directly provided by the data subjects or to which the data subjects give access or authorize the Service Provider to access. The Service Provider also handles data of data subjects which are not provided to the Service Provider by the data subject, but by third parties who have a contractual relationship with the Service Provider. The Service Provider does not collect personal data from public databases and, apart from the above, no third parties transmit personal data to the Service Provider.
In any case, the Service Provider shall pay particular attention to ensuring that the personal data it processes are only accessible to authorised persons - both within its organisation and in the case of its partners - and that they are processed only to the extent and for the duration strictly necessary for the performance of their tasks or activities.
Please note that your data will also be processed by data processors as described in this notice, subject to the binding provisions of the relevant data processing contracts, within limited scope. This notice sets out when, beyond the scope of the processing, personal data may be accessed by third parties, including in particular when the Service Provider is approached by public authorities and fulfils its legal obligation to provide the data. The personal data of the data subjects shall be processed by the Service Provider solely in accordance with the applicable legal requirements and for the specific purposes of the processing as determined by the Service Provider.
The Service Provider shall process all personal data of which it becomes aware in a lawful and fair manner and in such a way that the processing is transparent to the natural persons concerned throughout the entire period of processing. The Service Provider shall collect personal data only for the lawful purposes clearly set out in this Notice and shall pay particular attention to ensure that no personal data are processed in a way incompatible with the purposes set out in this Notice. The Service Provider's data processing is not intended to track data subjects, nor to monitor their activities and behaviour, nor to profile them.
In determining the method of data processing and throughout the entire data processing process, the Service Provider shall implement all technical and organisational measures to ensure that data protection principles and data subjects' rights are respected and protected. The measures implemented by the Service Provider as the data controller have been determined after taking into account and evaluating the state of the art, the costs of implementation and the risks to the rights of natural persons.
In any case, the Service Provider will only process personal data that are appropriate and relevant for the purposes of the processing and strictly necessary for the purposes of the processing, and will endeavour to ensure that the personal data stored and processed by it are always accurate and up-to-date and will take reasonable steps to ensure that inaccurate or incorrect data are corrected or deleted as soon as possible.
The Service Provider shall store the data of the data subjects only for as long as it is strictly necessary for the achievement of the specific purpose of data processing and the availability of the data shall be adapted accordingly, and shall take all technical and organisational measures necessary to ensure the security of personal data, including, but not limited to, protection against unlawful processing, accidental loss, destruction or damage. In any case where it intends to use the personal data of the data subjects for a purpose other than the one originally envisaged in this notice, it shall give prior written notice to the data subjects, indicating the new purpose of the processing and additional information on the processing, and shall ensure that it has a legal basis for processing the personal data in that case.
Personal data in respect of which the purpose of the processing has been fulfilled, the period of processing has expired, or if the data subject requests the Service Provider to do so, shall be deleted without undue delay, or, if deletion is not possible for any reason, the data shall be anonymised in order to ensure that the link between the processed data and the data subject can no longer be established.
The Service Provider operates the www.aquaflat.hu a website through which it provides accommodation services to natural and legal persons for a specified fee. The detailed conditions for the use of the service are set out in the General Terms and Conditions published on the Service Provider's website.
6.1. Data processing related to the request for tenders
The persons concerned by the data processing are those persons who use the www.aquaflat.hu send a written request for a quote to the Service Provider via the website, in accordance with the Service Provider's General Terms and Conditions.
In their case, the legal basis for processing is the contractual legal basis, i.e. processing necessary for the performance of a contract to which the data subject is a party or necessary for taking steps at the request of the data subject prior to entering into a contract where the data subject is a party. When sending the request for a quote, the data subject will be informed that the personal data provided will be processed by the Service Provider solely for the purpose of making the quote.
The personal data processed include: name, telephone number, e-mail address, and data concerning the data subject's needs: the accommodation chosen, the offer chosen (board, type of accommodation), the planned arrival and departure dates, the planned number of nights spent, the number of adults staying, the number of children staying, and any other data provided by the data subject.
With regard to any additional data provided by the data subject in the request for an offer, which are not necessary for the offer, the Service Provider shall only process the data when receiving the message sent, but the Service Provider may not request the data subject to provide any personal data provided therein, which are not necessary for the offer. When such unexpected personal data are communicated, the Service Provider shall not store the unexpected personal data which are not necessary for the offer and shall delete them from its IT system without delay.
The purpose of the processing is solely to enable the Service Provider to request an offer and to make an offer to the data subject. The purpose of the processing of the data subject's personal data is to identify the data subject, while his/her telephone number is used by the Service Provider in case of a possible need to contact him/her in order to make an offer, while the Service Provider sends the offer, compiled according to the data subject's requests, to the e-mail address of the data subject.
Duration of data processing The Service Provider shall process the data contained in the offer until the date indicated in the request for an offer, but no later than the validity of the offer. If the accommodation service provided by the Service Provider is not ordered or used, the Service Provider shall delete the data without delay after this has been established.
If the accommodation service provided by the Service Provider is ordered or used and the data subject accepts the Service Provider's offer, the legal basis, purpose and duration of the data processing shall be the data processing related to the booking/order.
6.2. Processing of data related to the booking/order
The persons concerned by the data processing are those persons who use the www.aquaflat.hu forward a reservation/order to the Service Provider via the website, in accordance with the Service Provider's General Terms and Conditions.
In their case, the legal basis for processing is the contractual legal basis, i.e. processing necessary for the performance of a contract to which the data subject is a party or necessary for taking steps at the request of the data subject prior to entering into a contract where the data subject is a party. When sending the reservation/booking, the data subject is informed that the personal data provided will be processed by the Service Provider solely for the purposes of the performance of the contract for the accommodation service resulting from the reservation/booking.
The personal data processed are: name, telephone number, e-mail address, and data concerning the data subject's request: the accommodation chosen, the offer chosen (board, type of accommodation), the planned arrival and departure dates, the planned number of nights spent, the number of adults concerned by the stay, the number and age of children concerned by the stay, the method of payment and the amount to be paid, and any other data provided by the data subject.
During online payment by credit card, the Service Provider does not know the data of the credit card used for the payment, does not process them, the data subject provides them directly to the payment service provider.
In addition, the Service Provider receives the following data provided by the data subject to the payment service provider during the payment transaction: name, address. The source of this data is therefore the payment service provider.
The purpose of the processing is the conclusion and performance of the contract resulting from the booking/order. The services related to the performance of the contract include, as purposes, the provision of the booked accommodation service, the provision of the requested care. The purpose of the processing of the personal data of the data subject is to identify the data subject, his/her telephone number is used by the Service Provider in case of possible need to contact him/her in connection with the reservation/order, while the Service Provider, in addition to providing the accommodation service and the appropriate care according to the needs of the data subject, sends the confirmation of the reservation/order to the e-mail address of the data subject.
Duration of data management The Service Provider shall keep the vouchers containing the data required to fulfil the obligation to keep the voucher (name, address, data on the invoice of the service used, consideration) arising from Act C of 2000 on Accounting (hereinafter: Accounting Act) for 8 (eight) years from the date of issue of the voucher, i.e. the data shall be processed until the expiry of which the data carriers shall be deleted within 1 (one) year. Further data processed in connection with the reservation/order, including messages with relevant content related to the reservation, shall be kept by the Service Provider until 5 (five) years from the date of confirmation of the reservation/order, i.e. from the conclusion of the contract, which is the general limitation period applicable to civil law claims.
6.3. Data processing for orders from individuals
The Service Provider does not require registration to use the website, however, in order to order / book the accommodation service or to use the closed webshop also operated by the Service Provider on the website - which can be used in connection with the accommodation service - and to provide the services requested, the Service Provider requests the following personal data from the data subject: name, e-mail address, address, billing address, telephone number, passport or ID number, gender, nationality
In any case, the provision of data is voluntary and this information is indispensable for the Service Provider to provide the accommodation service requested by the data subject. The legal basis for the processing of the personal data provided is the contract between the Service Provider and the data subject, whereby the data subject transmits an order/reservation to the Service Provider via the website for the use of the accommodation service provided by the Service Provider and the Service Provider confirms it. The purpose of the processing of the data subject's data is to enable the parties to conclude the accommodation service contract, to enable the Service Provider to make the necessary declarations in the performance of the contract, to contact the data subject if necessary and to issue an invoice for the service provided.
The Service Provider will also process the e-mail address provided during the order/reservation process in order to provide the data subject with information of public interest related to the use of the service, including, inter alia, to inform the data subject that his/her reservation has been successfully completed. The information e-mails do not constitute a newsletter or any other marketing or advertising request and may be sent by the Service Provider without the need for the specific consent of the data subject.
The Service Provider draws the attention of the data subjects to the fact that failure to provide, or incomplete provision of, data concerning themselves, the contracting party and/or the guest, in the absence of data indispensable for the performance of the contract, may result in the refusal of the Service Provider to conclude the accommodation contract.
The Service Provider shall process the customer's data until the performance of the given accommodation service, except for the data contained in the invoice issued for the consideration for the accommodation service, since pursuant to Act C of 2000 on Accounting (hereinafter: Act on Accounting) No. § (2) of the Act on Accounting (C.C. No. 169 of the Act on Accounting), the Service Provider shall keep the data contained in the invoice for the consideration for the provision of accommodation services and the data related to the provision of the service (billing name and billing address) for 8 (eight) years from the date of issue of the invoice or the date of the customer register.
In the event of a difference between the identity of the Contracting Party and the Guest, the Service Provider shall process the Guest's data on the basis of the legitimate interests of the Service Provider and the Contracting Party and the Guest. Without this data, the Service Provider would not be able to fulfil its obligations under the accommodation service contract, i.e. it would not be able to identify the order/reservation and the Guest entitled to use it. For the processing of the Guest's data provided by the Contracting Party on the basis of legitimate interest, the Service Provider has carried out an interest test in accordance with the mandatory data protection requirements.
The balancing of interests test weighed the legitimate interests and fundamental rights of the controller against those of the third party and the data subjects, and concluded that the legitimate interest of the controller or third party to process the Guest's data is stronger and more important than the interest of the data subject not to have access to or to process the data, as the lack of processing would prevent the performance of the accommodation contract. In fulfilment of its legal obligation, the Service Provider shall provide all data subjects with the possibility to be informed of the detailed balancing of interests test, if they make such a request to the Service Provider.
Considering that the Service Provider processes the data of the data subjects on the basis of its own legitimate interests and the legitimate interests of the Contracting Party and the Customer, the data subjects have the right to object to the processing of their data, the detailed rules and conditions for exercising this right are set out in this information notice.
The purpose of processing the data related to the order for the provision of a specific accommodation service is to enable the Service Provider to fulfil the accommodation service contract with the Contracting Party - if the Contracting Party and the Guest are different - and to provide the Guest with the accommodation service. The processing of the data is also necessary to enable the Service Provider to contact the Guest directly in the course of the provision of the service. In any case, the processing of the data shall last until the termination of the contract for the accommodation service in question.
For customers who are legal persons or entities without legal personality (hereinafter: Business customers) use the Service Provider's services, the Service Provider processes the data of the persons who request an offer from the Service Provider as a contact person for Business Customers, or with whom the Service Provider maintains contact in the course of the performance of the contract in case of acceptance of the offer and order for accommodation services. The following data of the Business Customer's contact person are processed by the Service Provider: name, telephone number, e-mail address.
The legal basis for the processing of personal data provided by Business Customer's contact persons is the Service Provider and the legitimate interest of the Business Customer to whom the contact person belongs. For the processing of contact data on the basis of legitimate interest, the Service Provider has carried out an interest balancing test, which has resulted in the conclusion that the legitimate interest of the Service Provider or its Business Customer to process the data is genuine and stronger than the interest of the data subjects not to have their data processed by the Service Provider. The knowledge and processing of the data is indispensable for the Service Provider to be able to provide the Business Partner with the accommodation service based on the information provided by the Business Partner and, if the Business Partner accepts the Service Provider's offer and the accommodation service contract is concluded between them, to contact and consult directly with the Business Partner on issues arising in the course of the performance of the contract. In compliance with its legal obligation, the Service Provider shall provide all data subjects with the opportunity to be informed of the detailed balancing of interests test, if they so request.
Given that the data subjects' data are processed by the Service Provider and the Service Provider on the basis of the legitimate interests of the Business Customers, the data subjects have the right to object to the processing of their data, the detailed rules and conditions for exercising this right are set out in this notice.
The purpose of processing the data of the contact persons is therefore to provide the interested Business Partner with an offer for the service and, in the event of a contractual relationship, to ensure direct contact and smooth communication with the Business Partner. The Service Provider shall process the contact persons' data until the contract for the accommodation service in question is terminated. In the event that the identity of the contact person of the Business Partner changes in the meantime, the processing of the data of the Business Partner concerned shall continue until the Business Partner notifies the Service Provider in writing of such change.
If the identity of the Business Customer and the Guest is different, the Service Provider shall process the Guest's data on the basis of the legitimate interests of the Service Provider and the Business Customer and the Guest. Without this data, the Service Provider would not be able to fulfil its obligations under the accommodation service contract, i.e. it would not be able to identify the order/reservation and the Guest entitled to use it. For the processing of the Guest data provided by the Business Customer on the basis of legitimate interest, the Service Provider has carried out a merits test in accordance with the mandatory data protection requirements.
The balancing of interests test weighed the legitimate interests and fundamental rights of the controller against those of the third party and the data subjects, and concluded that the legitimate interest of the controller or third party to process the Guest's data is stronger and more important than the interest of the data subject not to have access to or to process the data, as the lack of processing would prevent the performance of the accommodation contract. In fulfilment of its legal obligation, the Service Provider shall provide all data subjects with the possibility to be informed of the detailed balancing of interests test, if they make such a request to the Service Provider.
Given that the Service Provider processes the data of the data subjects on the basis of its own legitimate interests and the legitimate interests of the Business Customer and the Customer's customer, the data subjects have the right to object to data processing, the detailed rules and conditions for exercising this right are set out in this information notice.
The purpose of processing the data related to the order for the provision of a specific accommodation service is to enable the Service Provider to fulfil the accommodation service contract with the Business Customer - if the Business Customer and the Guest are different - and to provide the Guest with the accommodation service. The processing of the data is also necessary to enable the Service Provider to contact the Guest directly in the course of the provision of the service. In any case, the processing of the data shall continue until the termination of the contract for the accommodation service in question.
The persons concerned by the data processing are those persons who use the www.aquaflat.hu through a website or other accommodation intermediary, in accordance with the Service Provider's General Terms and Conditions, an order is transmitted to the Service Provider, which is confirmed by the Service Provider and the accommodation service provided by the Service Provider is used by the data subject on the basis of the contract concluded between the parties.
In their case, the legal basis for processing is the contractual legal basis, i.e. processing necessary for the performance of a contract to which the data subject is a party, or necessary to take steps at the request of the data subject prior to entering into a contract where the data subject is a party, or necessary for the performance of a legal obligation to which the Service Provider is subject.
Pursuant to Act CLVI of 2016 on State Tasks for the Development of Tourist Areas (hereinafter: Tourism Act), the Service Provider is obliged to provide data to the National Tourism Data Service Centre (hereinafter: NTAK). The NTAK shall contain the data collected and prepared in accordance with the data reporting procedure specified in the legislation, which do not contain personal data and which are provided by the accommodation provider using the accommodation management software. The purpose of the NTAK is to provide anonymous, real-time statistical data on the turnover of all accommodation establishments in Hungary, and statistical analyses are produced from the data received directly through the accommodation management software.
In order to protect the rights, safety and property of the data subject and others, and to verify compliance with the provisions on the stay of third-country nationals and persons enjoying the right of free movement and residence, the Service Provider shall record the surname and first name of the data subject at the time of check-in on the storage space provided by the hosting provider via the accommodation management software, in compliance with its legal obligations, surname and given name at birth, place and date of birth, sex, nationality and mother's surname and given name at birth, identification data of his/her identity document or travel document, visa or residence permit number in the case of third-country nationals, date and place of entry and address of the accommodation service, start and expected date of use of the accommodation and actual date of termination.
The Service Provider shall refuse to provide the accommodation service in the absence of the presentation of an identification document or travel document for the purpose of recording the data.
Only statistical data are transmitted by the Service Provider through the accommodation management software, i.e. the NTAK system does not receive, record or store any personal data. Based on the data received - the guest's gender, nationality, date of birth, permanent address, municipality and postal code - individual guests cannot be identified in NTAK, and therefore no personal data is transmitted or processed, NTAK is used for the collection of cumulative statistical data for tourism purposes only.
The Service Provider shall process the data provided in this way - not including the address of the accommodation service, the starting and expected date of use of the accommodation and the actual date of termination - for the purpose of fulfilling its statutory data reporting obligations until the last day of the first year following the date on which the data were made available to the Service Provider.
The purpose of data processing is to fulfil the data reporting obligations of the accommodation provider as defined by law. The duration of the processing of data which are not processed by the Service Provider for other purposes and/or for other purposes than those set out in this information notice and which are processed for the purpose of fulfilling its statutory data reporting obligations, shall be until the last day of the first year following the date on which the data are made available to the Service Provider. Any further data processed in connection with the reservation/order or the use of the accommodation service, including messages with relevant content related to the reservation, shall be kept by the Service Provider until 5 (five) years from the date of the reservation/order or the date of its disclosure, which is the general limitation period applicable to civil law claims.
The hosting service provider - which is the Hungarian Tourism Agency Ltd (abbreviated company name: Hungarian Tourism Agency, registered office: 1027 Budapest, Kacsa utca 15-23., company registration number: 01-10-041364, tax number: 10356113-4-41), whose activities are limited to the storage of the data of the data service provided by the accommodation provider in encrypted form on a storage place, which is provided by the accommodation provider in accordance with the encryption procedure designated by law, and to the provision of access to the data for the accommodation provider and the person or body authorised by the accommodation provider. The data stored in the hosting provider shall not be disclosed or processed by the hosting provider.
The data stored by the hosting provider may be searched by the police by means of an IT tool for the purposes of law enforcement, crime prevention, protection of public order, public security, public order, the order of the state border, the protection of the rights, safety and property of the data subject and others, and the conduct of wanted persons proceedings, and the information may be obtained as a result of the search, which accommodation provider is a customer of the person who has provided the search criteria, and may further request the transmission of data processed by the accommodation provider, indicating the purpose of the request, which the accommodation provider shall provide free of charge.
In other respects, the Hungarian Tourism Agency Zrt., local governments, the National Tax and Customs Administration and the Hungarian Central Statistical Office have access to the data of the NTAK that are not suitable for individual identification for statistical purposes.
1087 Budapest, Ciprus u. 8.
1087 Budapest, Hungária krt.32-34.
English 
Hungarian