Data Processing

Types and processing of the personal data processed by Marketing & E-commerce

Website(s), online software, data processing

In short
We collect and process personal data exclusively in accordance with the law.
We send newsletters exclusively on the basis of a specific consent. We may send system messages without a consent.
We store data as safely as possible.
We disclose personal data to third parties exclusively on the basis of a consent.
We provide information to data subjects on the data stored in connection with him or her, and they may request the erasure of the data at any time.

Introduction
Pursuant to Section 20 (1) of Act CXII of 2011 on Informational Self-Determination and Freedom of Information, data subjects (in this case website users, hereinafter: users) shall be informed prior to the commencement of data processing whether the data processing is based on a consent or is mandatory.
Before processing operations are carried out the data subject shall be clearly and elaborately informed of all aspects concerning the processing of his or her personal data, such as the purpose for which his or her data is required and the legal ground, the person entitled to become data controller or data processor, the duration of data processing.

Pursuant to Section 6 (1) of Infotv., data subjects shall be informed that if obtaining the consent is impossible or entails excessive costs, the processing of personal data is allowed if

  • processing is necessary for compliance with a legal obligation to which the controller is subject;
  • it is necessary for the enforcement of the controller’s or a third party’s legitimate interest, and the enforcement of such interest is proportionate to the restriction of the data subject’s right to the protection of personal data.

The information provided to the data subject shall cover his or her rights and remedy options related to data processing.
If providing information to data subjects is impossible or entails excessive costs (in this case on a website, for example), information may be provided by the publication of the following information:

a) the fact that data are collected,
b) data subjects involved,
c) the purpose of the collection of personal data,
d) duration of data processing,
e) possible controllers entitled to become aware of the personal data,
f) provision of information to data subjects on their rights and remedies available to them related to data processing, and
g) if there is a location for the data protection registration of data processing, the registration number of data processing.

This privacy policy regulates data processing activities carried out on the following websites: https://www.parkinnzalakaros.hu, https://parkinnzalakaros.hu and is based on the following criteria. The policy is available on the following website: https://www.parkinnzalakaros.hu/adatvedelmi-nyilatkozat.html
Amendments to the policy enter into effect upon their publication on the above website. We indicate the relevant legal reference for each chapter.

Definitions (Section 3)

  1. ‘data subject’ /’User’ shall mean any natural person directly or indirectly identifiable by reference to specific personal data;
  2. ‘personal data’ shall mean data relating to the data subject, in particular by reference to the name and identification number of the data subject or one or more factors specific to his physical, physiological, mental, economic, cultural or social identity as well as conclusions drawn from the data in regard to the data subject;
  3. ‘special data’ shall mean:
    a) personal data revealing racial origin or nationality, political opinions and any affiliation with political parties, religious or philosophical beliefs or trade-union membership, and personal data concerning sex life,
    b) personal data concerning health, pathological addictions, or criminal record;
  4. the data subject’s consent’ shall mean any freely and expressly given specific and informed indication of the will of the data subject by which he signifies his agreement to personal data relating to him being processed fully or to the extent of specific operations;
  5. ‘the data subject’s objection’ shall mean a declaration made by the data subject objecting to the processing of his/her personal data and requesting the termination of data processing, as well as the deletion of the data processed;
  6. ‘controller’ shall mean natural or legal person, or organisation without legal personality which alone or jointly with others determines the purposes and means of the processing of data; makes and executes decisions concerning data processing (including the means used) or have it executed by a data processor;

‘data processing’ shall mean any operation or the totality of operations performed on the data, irrespective of the procedure applied; in particular, collecting, recording, registering, classifying, storing, modifying, using, querying, transferring, disclosing, synchronising or connecting, blocking, deleting and destructing the data, as well as preventing their further use, taking photos, making audio or visual recordings, as well as registering physical characteristics suitable for personal identification (such as fingerprints or palm prints, DNA samples, iris scans);
‘data transfer’ shall mean ensuring access to the data for a third party;
‘disclosure’ shall mean ensuring open access to the data;
‘data deletion’ shall mean making data unrecognisable in a way that it can never again be restored;
‘tagging data’ shall mean marking data with a special ID tag to differentiate it;
‘blocking of data’ shall mean marking data with a special ID tag to indefinitely or definitely restrict its further processing;
data destruction’ shall mean complete physical destruction of the data carrier recording the data;
‘data process’ shall mean performing technical tasks in connection with data processing operations, irrespective of the method and means used for executing the operations, as well as the place of execution, provided that the technical task is performed on the data;
‘data processor’ shall mean any natural or legal person or organisation without legal personality processing the data on the grounds of a contract concluded with the controller, including contracts concluded pursuant to legislative provisions;
‘data source’ shall mean the body responsible for undertaking the public responsibility which generated the data of public interest that must be disclosed through electronic means, or during the course of operation in which this data was generated;
‘data disseminator’ shall mean the body responsible for undertaking the public responsibility which uploads the data sent by the data source which has not published the data;
‘data set’ shall mean all data processed in a single file;
‘third party’ shall mean any natural or legal person, or organisation without legal personality other than the data subject, the data controller or the data processor;
Data processing related to the operation of website(s)

Pursuant to Section 20 (1) of Act CXII of 2011 on Informational Self-Determination and Freedom of Information, the following shall be defined with respect to data processing carried out in relation to the operation/functioning of the web shop:

a) the fact that data are collected,
b) data subjects involved,
c) the purpose of the collection of personal data,
d) duration of data processing,
e) possible controllers entitled to become aware of the personal data,
f) provision of information to data subjects on their rights available to them related to data processing.

The fact that data are collected, personal data involved and the purpose of data processing:

In the case of an email address, it shall not necessarily contain personal data.

Data subjects involved: All data subjects requesting quotation/booking on the website.

Data of the data processor (hosting provider) employed during data processing:

Maxer Kft.
Registered office: H-9024 Győr, Répce u. 24
Mailing address: H-1132 Budapest, Victor Hugo u. 18-22.
Phone number: (+36) 1 257 9913

Legal ground of data processing: User’s consent, Section 5 (1) of Infotv., as well as Section 13/A (3) of Act CVIII of 2001 on certain issues of electronic commerce services and information society services (hereinafter referred to as Elker tv.):

The service provider may – for the purpose of providing the service – process personal data indispensable for providing the service for technical reasons. Should other conditions be identical, the service provider shall select and operate the means applied in the course of providing information society service at all times, so that personal data be processed only if it is absolutely indispensable for providing the service or achieving other objectives stipulated in this Act, and only to the required extent and duration.

Processing of cookies

Pursuant to Section 20 (1) of Act CXII of 2011 on Informational Self-Determination and Freedom of Information, the following shall be defined with respect to the cookie processing of the web shop:

a) the fact that data are collected,
b) data subjects involved,
c) the purpose of the collection of personal data,
d) duration of data processing,
e) possible controllers entitled to become aware of the personal data,
f) provision of information to data subjects on their rights available to them related to data processing.

Cookies characteristic to the websites are so called “cookies used for sessions protected by password”, “cookies necessary for the basket” and “safety cookies” for the use of which the data subjects’ consent shall be requested.

The fact that data are collected, personal data involved: unique identification number, dates and times.

Data subjects involved: All data subjects visiting the website.

Purposes of data processing: identification of users, preparation of statistics, registration of ‘requests for quotation/bookings’ and monitoring of visitors.

Duration of data processing, deadline for the deletion of data:

c_i session: for identification when logging in, (encrypted: user name, email address): It is deleted every 2 hours, and is updated every 5 minutes,
last visited page: it is deleted after 10 years,
php session id: it is deleted after closing the browser.
(may change until 25 May? )

Possible controllers entitled to become aware of the personal data: Employees of the data controller may process personal data in accordance with the above principles.

Provision of information to data subjects on their rights available to them related to data processing: Data subjects may delete cookies under menu item usually called ‘Data Protection’ in the Tools/Settings menu of their browser.

Legal ground of data processing: It is not necessary to obtain the data subject’s consent, if the exclusive purpose of the use of cookies is transmission of communication via the electronic telecommunications network, or if it is necessary for the provision of services explicitly requested by the subscriber or user related to information society.

What kind of cookies do I use? If you wish to know more about cookies used by your browser, please visit one of the following websites corresponding to your browser:
Google Chrome: https://support.google.com/chrome/answer/95647?hl=en
Mozilla Firefox: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences
Safari: http://support.apple.com/kb/PH5042
Mozilla Firefox: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences
If you use a mobile device, you may refer to the following websites:
Android: http://developer.android.com/reference/android/webkit/CookieManager.html
Blackberry:http://docs.blackberry.com/en/smartphone_users/deliverables/3200 /Turn_off_cookies_in_the_browser_60_1072866_11.jsp
Mozilla Firefox: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences
Safari iOS: http://support.apple.com/kb/PH5042

Use of Google Adwords conversion tracking

The controller uses the online ad programme called “Google Adwords”, and within its framework it uses Google’s conversion tracking service. Google conversion tracking is the analysing service of Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, ‘Google’).

When a User reaches a website via a Google ad, a cookie necessary for conversion tracking is stored on his or her computer. The validity of these cookies is limited, therefore, they do not contain any personal data, and Users cannot be identified by them.

When the User browses on certain pages of the website, and the cookie has not expired, Google and the data controller may see that the User has clicked on the ad.

All Google AdWords clients receive different cookies, therefore, they cannot be tracked via the websites of the clients of AdWords.

Information which have been obtained with the use of conversion tracking cookies aim to prepare conversion statistics for the clients of AdWords who opt for conversion tracking. This is how clients receive information on the number of users clicking on their ad and directed to the website having a conversion tracking label. However, they cannot receive information based on which any of the users may be identified.

If you do not wish to participate in conversion tracking, then you may refuse it by blocking the option to install cookies in your browser. After this, you will not figure in statistics related to conversion tracking.

Further information and the privacy policy of Google may be found at the following website: www.google.de/policies/privacy

Data process for the provision of Google Adwords services
Data of the data processor:
Criteo SA
32 Rue Blanche
PARIS     75009
FRANCE
email: cil@criteo.com

The fact that data are processed, personal data involved: Email address which is encrypted, pseudonymized, therefore, they loose their personal nature. Further information: https://support.google.com/adwords/answer/6334160

Data subjects involved: All data subjects registered on the website.

Purposes of data process: Publication of targeted Google ads for users.

Duration of data process, deadline for the deletion of data: Data process lasts until the withdrawal of the data subject’s consent.

Possible processors entitled to become aware of the personal data: Employees of the data processor may process data already not qualified as personal data in accordance with the above principles.

The data subject may request his or her personal data not to be transferred to the data processor:
by post
by email
by phone
(different for each hotel)

Legal ground of data process: voluntary consent of the data subject, Section 5 (1) of Infotv.
Application of Google Analytics

This website uses the application of Google Analytics which is the web analysing service of Google Inc. (“Google”). Google Analytics uses ‘cookies’, text files which are saved on your computer, thus helping analysis of the use of the webpage visited by the User.

Information created with cookies related to the website used by the User are generally stored on a Google server located in the US. By website activation of IP-anonymization, Google shortens the IP-address of Users in advance in the Member States of the EU or EEA.

The transfer of the full IP-address is only transferred to a Google server located in the US in special cases. On behalf of the operator of this website, Google will use such information to evaluate how the User used the website, to prepare reports for the operator of the website related to the activity of the website, and to perform further services related to the use of the website and the internet.

Within the framework of Google Analytics, IP-address transferred by the User’s browser is not linked to other data of Google. You may prevent the storage of cookies by choosing the appropriate setting on your browser, however, please note that in this case, it may occur that not all the functions of the website will be fully available to you. You may also prevent Google from collecting and processing the User’s data related to the use of the website (including IP-address), if you download and install the following browser plug-in. https://tools.google.com/dlpage/gaoptout?hl=hu

Newsletter activities
In accordance with Section 6 of Act XLVIII of 2008 on Essential Conditions of and Certain Limitations to Business Advertising, the User may grant his or her explicit and prior consent to that the Service Provider contact him or her with its promotions and other messages at the email address provided at registration.

Taking into account the provisions of this policy, the Client may also grant his or her consent to the processing of his or her personal data necessary for sending promotions by the Service Provider.

The Service Provider may not send unsolicited promotions, and the User may unsubscribe from such promotions free of charge, without indicating his or her reasons, at any time. In this case, the Service Provider shall delete all personal data of the User necessary for the sending of promotions from its data base, and may not continue to send its promotions to the User. The User may unsubscribe from promotions by clicking on the link in the message.

Pursuant to Section 20 (1) of Act CXII of 2011 on Informational Self-Determination and Freedom of Information, the following shall be defined with respect to the data processing related to newsletters:

a) the fact that data are collected,
b) data subjects involved,
c) the purpose of the collection of personal data,
d) duration of data processing,
e) possible controllers entitled to become aware of the personal data,
f) provision of information to data subjects on their rights available to them related to data processing.

The fact that data are collected, personal data involved: name, email address, date and time.

Data subjects involved: All data subjects subscribing for the newsletter.

Purposes of data processing: sending of electronic messages which do not contain any promotions to the data subjects, provision of information on news, products, discounts, new functions, etc.

Duration of data processing, deadline for the deletion of data: data processing lasts until withdrawal of the data subject’s consent, that is until unsubscription.

Possible controllers entitled to become aware of the personal data: Employees of the data controller may process personal data in accordance with the above principles.

Provision of information to data subjects on their rights available to them related to data processing: Data subjects may unsubscribe from newsletters at any time, free of charge.

Data processors employed during data processing:
Maileon Kft.
H-1112 Budapest, Budaörsi út 153.
TAX NUMBER: 25352768-2-43
TRADE REGISTRATION NUMBER: 01 09 270195
(it will be selected next week for each hotel)
Social networking websites

Pursuant to Section 20 (1) of Act CXII of 2011 on Informational Self-Determination and Freedom of Information, the following shall be defined with respect to the data processing of social networking websites:

a) the fact that data are collected,
b) data subjects involved,
c) the purpose of the collection of personal data,
d) duration of data processing,
e) possible controllers entitled to become aware of the personal data,
f) provision of information to data subjects on their rights available to them related to data processing.

The fact that data are collected, personal data involved: Name of the person registered on Facebook/Google+/Twitter/Pinterest/Youtube/Instagram etc. and the public profile picture of the user.

Data subjects involved: All data subjects who have registered on Facebook/Google+/Twitter/Pinterest/Youtube/Instagram etc, and have liked the website.

Purposes of data collection: Sharing or liking, promoting certain contents, products, discounts of the website or the website itself on the social networking websites.

Duration of data processing, deadline for the deletion of data, possible controllers entitled to become aware of the personal data, and rights related to data processing available to data subjects: Data subjects may refer to the social networking website in question for information on the source of data, their processing, and the manner of transfer and its legal ground. Data processing is carried out on the social networking websites, therefore, the provisions of the social networking website in question shall cover the duration, manner of data processing, as well as options to delete or modify data.

Legal ground of data processing: the data subject’s voluntary consent to data processing on the social networking websites.

When would you like to stay at our hotel?