Data Protection Statement

Dear Data Subject, please read this data protection notice carefully. It summarizes the key information about how your personal data is processed and what rights you have. As controller we fully respect your rights and are committed to protecting your personal data. In our operations we always follow these principles: lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; limited storage; integrity and confidentiality; accountability.

1. Controller’s details and contact information
Tóth István
3300 Eger, Móricz Zsigmond u. 7.  tax number: 90173947-1-30
e-mail: chilloutafrika@gmail.com

Data Protection Officer’s details and contact information
The controller is not required to appoint a data protection officer, but your personal data and related rights are still fully protected.
Scope and purpose of data processing:
Data are processed so we can conclude accommodation contracts with guests, issue invoices as required by law, and record guest data in the mandatory ‘VENDÉGEM’ system.
We process the following personal data for all staying and booking guests:
Full name
Nationality
Gender
Place and Date of birth
Address
E-mail adress

Due to online use, IP addresses and browsing data (operating system, browser) are also processed. Only data strictly necessary for providing the service, using the NTAK system and invoicing are handled. These are required by law for invoices and the National Tourism Data Supply Centre. The IP, OS and browser data are processed based on your consent, which you may withdraw at any time.

4. Legal basis for processing personal data
The legal basis for processing the data is the performance of a contract and compliance with legal obligations. Performance of a contract: When you conclude a contract with us, you purchase an accommodation service from us, which we can only provide if you give us the above data; this is already true when you first contact us with the intention of concluding a contract, since we can only give you appropriate information about the service based on the data you provide. Furthermore, under Section 13/A of Act CVIII of 2001 on certain issues of electronic commerce services and information society services, the service provider – in this case our company – may process those personal data that are technically essential for providing the service. The data listed in point 3 are such data.
Use of the NTAK system: By mandatory legal provision we are required to record the data of guests staying with us in the NTAK system, therefore your data as well. These data are entered into the National Tourism Data Supply Centre. In both cases, another legal basis for processing the data is Act C of 2000 on Accounting, under which we must issue invoices for the services we provide and keep the documents that directly or indirectly support our bookkeeping records. Please note that for market‑acquisition (marketing) purposes we may process personal data on the basis of legitimate interest under the GDPR, naturally while respecting your rights.

5. Recipients and data processors
Personal data are handled by the controller and administrative staff. Invoice data are recorded via the tax authority’s online invoicing system www.onlineszamla.nav.gov.hu and transmitted online to fulfil tax reporting obligations. The website www.noszvaj-chilloutafrika.hu is operated by the controller.

6. International data transfers
The controller does not transfer personal data abroad.

7. Data retention
Invoice data (name, address, invoice number and amount) are kept for 8 years under accounting law. Other data listed in point 3 are kept for 1 year after the contractual relationship ends.

8. Rights of data subjects in relation to data processing
You have the right to request information about the data processing, for example what data we process about you and to whom we transfer it, and you have the right of access to know whether we process data about you, and if so, what data, for what purpose, for what period, what rights you have in relation to this, and where you can lodge a complaint.
You also have the right to request that your processed personal data be corrected or rectified if they are not fully accurate.
You may request the deletion or blocking of your personal data – where processing is not mandatory – if the processing is unlawful, its purpose has ceased, you withdraw your consent to the processing, the processed data are incorrect or incomplete and this cannot be remedied, or if deletion has been ordered by a court or the data protection authority (NAIH). You may also request the ‘erasure’ (right to be forgotten) of your personal data, meaning that, given the current state of technology, we will do everything possible to ensure that all data whose deletion you have lawfully requested are removed everywhere.
Please note that where the legal basis for processing is your consent, you may withdraw this consent; however, this does not affect data processed lawfully before the withdrawal, nor data that must be processed under legal obligations, and we may still process your personal data for the performance of the contract, for example in procedures to enforce unpaid invoices, to fulfil our tax reporting obligations, or in simplified entrepreneurial tax procedures.
You may also object to the processing of your personal data if you believe we are processing data in a way you do not agree with. If the processing or transfer of personal data is carried out solely to fulfil our legal obligations, or to enforce our or a third party’s legitimate interests, or if the data are used or transferred for direct marketing, opinion polling or scientific research, and your objection is justified, we will delete the personal data, unless you request not deletion but, for example, the blocking or restriction of processing. Processing will also be restricted if you contest the accuracy of the data (for the period during which we verify them), or if we no longer need the data but you require them, for example, for the establishment, exercise or defence of legal claims.


9. Complaints and legal remedies
If you feel your data have been mishandled, please contact us immediately; we will act within 30 days to remedy the situation. If our response is not satisfactory, you may turn to the competent court or the Hungarian National Authority for Data Protection and Freedom of Information (NAIH; 1125 Budapest, Szilágyi Erzsébet fasor 22/c., 06-1-391-1400, ugyfelszolgalat@naih.hu, www.naih.hu). You generally have 30 days from our decision or from when we fail to respond in time to seek judicial or authority review.

10. Definitions
‘Personal data’ means any information relating to an identified or identifiable natural person. ‘Special categories of personal data’ include data on racial or ethnic origin, nationality, political opinions, religion or beliefs, trade union membership, sexual life, health, addictions, and criminal data. ‘Controller’ is the person or body determining the purposes and means of processing. ‘Processor’ is the person or body processing personal data on behalf of the controller (technical operations). ‘Processing’ covers any operation on personal data, such as collection, storage, use, transmission. ‘Data processing’ refers to performing the technical tasks related to those operations.

11. Security and protection of data
Both we and the partners listed in point 5 do everything we can to protect your personal data. To this end, our computers are password‑protected, we make backup copies, and we will inform you without delay if any data protection incident occurs, for example if we detect any unusual login attempt.

12. Cookie management
A cookie is a text file placed by the web server on the end‑device of the website visitor (typically a computer or mobile phone) which stores information about the user, the operation of the website, or even about the relationship between the user and the web server. When loading the page, the web server often ‘works’ from this information, thereby improving the user experience or providing services.
Cookies that are necessary for the operation of the site are considered data processing based on legitimate interest and do not require your consent. Cookies that do not fall into this category only operate if you approve them. Most browsers accept cookies automatically. In your browser settings you can manage cookies: you can block or delete them.
On our website we store two types of cookies: performance cookies (Google Analytics), which are placed on the visitor’s device only if the visitor gives consent at the first visit, and usage‑supporting so‑called functional cookies, which do not require your consent.

Eger, 2021. 06.01