Privacy notice
Vulkán Hotel Kft. data protection policy
1. Purpose of the regulations
The purpose of the regulations is to ensure that, in accordance with the legal requirements, CXII of 2011 on the right to self-determination of information and freedom of information. Act (hereinafter: Infotv.) and with regard to the provisions of Regulation (EU) 2016/679 [GDPR] of the European Parliament and of the Council, inform the data subjects about the scope of their personal data managed by the data controller contained in point 2, the purpose and method of data management, as well as all other facts related to data management, especially, but not exclusively, their rights related to data management and the legal remedies available to them.
2. The name of the data controller, representative of its registered office
- Name: Vulkán Hotel Kft.
- Headquarters: 9500 Celldömölk, Sport utca 10.
- Legal representative: Managing Director András Gachályi
- Contact for data protection matters: Managing Director András Gachályi
3. Name and contact details, legal status and duties of the data protection officer
- Dr. Morvay Boldizsár – dr.morvay@balintfy.hu
Legal status of the data protection officer
The data controller must ensure that the data protection officer is involved in all matters related to the protection of personal data in an appropriate manner and in a timely manner. It must be ensured that the resources necessary to maintain the expert level knowledge of the data protection officer are available.
The data protection officer may not accept instructions from anyone regarding the performance of his duties. The data controller or the data processor may not dismiss or impose sanctions on the data protection officer in connection with the performance of his duties. The data protection officer is directly responsible to the top management of the data controller or data processor.
The data subjects can contact the data protection officer in all questions related to the management of their personal data and the exercise of their rights.
The data protection officer is bound by an obligation of confidentiality or an obligation to treat data confidentially in connection with the performance of his duties.
Duties of the data protection officer
- Provides information and professional advice to the data manager or data processor, as well as to the employees performing data management;
- checks compliance with the internal rules of the data manager or data processor regarding the protection of personal data;
- upon request, provides professional advice regarding the data protection impact assessment, as well as monitors the completion of the impact assessment;
- cooperates with the supervisory authority.
The data protection officer may perform other tasks, but there should be no conflict of interest in relation to the tasks.
4. Laws on data management
- Basic Law of Hungary, VI. article;
- CXII of 2011 on the right to information self-determination and freedom of information. law (hereinafter: "Infotv.");
- EU Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and the free flow of such data, as well as the repeal of Regulation 95/46/EC (GDPR).
5. Concepts used by these regulations
data processor: the natural or legal person, public authority, agency or any other body that processes personal data on behalf of the data controller
data management: any operation or set of operations performed on personal data or data files in an automated or non-automated manner, such as collection, recording, systematization, segmentation, storage, transformation or change, query, insight, use, communication, transmission, distribution or making accessible in any other way by item, coordination or connection, restriction, deletion or destruction
data manager (service provider): the enterprise, as well as the natural or legal person, public authority, agency or any other body that determines the purposes and means of processing personal data independently or together with others; if the purposes and means of data management are determined by EU or member state law, the data controller or the special aspects regarding the designation of the data controller may also be defined by EU or member state law
data protection incident: a breach of security that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure or unauthorized access to personal data transmitted, stored or otherwise handled
biometric data: any personal data relating to the physical, physiological or behavioral characteristics of a natural person obtained through specific technical procedures that enable or confirm the unique identification of a natural person, such as facial image or dactyloscopic data
Recipient: the natural or legal person, public authority, agency or any other body to whom the personal data is communicated, regardless of whether it is a third party. Public authorities that have access to personal data in accordance with EU or Member State law in the context of an individual investigation are not considered recipients; the processing of said data by these public authorities must comply with the applicable data protection rules in accordance with the purposes of data processing
data subject: the natural person whose personal data is processed
consent of the data subject: the voluntary, specific and clear declaration of the will of the data subject based on adequate information, with which the data subject indicates by means of a statement or an unmistakable act of confirmation that he gives his consent to the processing of personal data concerning him
GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free flow of such data, and on the repeal of Regulation 95/46/EC (General Data Protection Regulation)
third party Info tv. employee: the natural or legal person, public authority, agency or any other body that is not the same as the data subject, the data controller, the data processor or the persons who have been authorized to process personal data under the direct control of the data controller or data processor CXII of 2011 on the right to self-determination and freedom of information. law In any other legal relationship with the Service Provider or related to work - in particular: service contract, commission contract, permanent person, contractual contractor(s) and their representatives.
profiling: any form of automated processing of personal data in which personal data is used to evaluate certain personal characteristics of a natural person, in particular characteristics related to work performance, economic situation, health, personal preferences, interests, reliability, behavior, location or movement used to analyze or predict
personal data: any information relating to an identified or identifiable natural person ("data subject"); a natural person who can be identified directly or indirectly, in particular on the basis of an identifier such as a name, number, location data, online identifier or one or more factors relating to the physical, physiological, genetic, mental, economic, cultural or social identity of the natural person can be identified
special categories of personal data: personal data referring to racial or ethnic origin, political opinion, religious or worldview beliefs or trade union membership, as well as genetic and biometric data aimed at the unique identification of natural persons, health data and data relating to the sex life or sexual orientation of natural persons personal data
6. Data protection impact assessment
With regard to the rights and freedoms of natural persons, the data controller is responsible for conducting a data protection impact assessment assessing the source, nature, uniqueness and severity of this risk. The findings of the impact assessment must be taken into account when determining which measures are appropriate to demonstrate that the processing of personal data complies with the GDPR. If, according to the data protection impact assessment, the data management operations entail such a high risk that the data controller is unable to mitigate with appropriate measures in terms of available technology and implementation costs, the National Data Protection and Freedom of Information Authority (NAIH) must be consulted before data management. If it becomes necessary to carry out a data protection impact assessment in connection with high-risk data management later on, the open source software (originally named : "PIA software", hereinafter: impact assessment software).
In connection with the data protection impact assessment, the data controller prepares a separate policy.
7. Interest weighing test - in the case of data management based on legitimate interests
In the case of data management based on legitimate interest (GDPR § 6 (1) f) point, the interest assessment test is carried out on the basis of the NAIH/2015/3731/2/V resolution. Based on this, the interest weighing test is a multi-step process, during which the legitimate interest of the data controller must be identified, as well as the data subject's interest, which is the counterpoint of the weighting, the affected fundamental right, and finally, based on the weighting, it must be determined whether the personal data can be processed.
The steps used in the balancing of interests test:
1. step - examination of whether data management is necessary or can be solved in another way
2. step - defining the legitimate interest as precisely as possible
3. step - determining the purpose of the data management, what personal data the data management requires and for how long
4. step - defining the aspects of the stakeholders
5. step - carrying out the assessment
The data controller prepares a separate policy on the consideration of interests test.
8. Management and protection of personal data
8.1. Tasks, powers and responsibilities of the data controller
The data controller performing the primary data management is obliged to compensate the damage caused to others by the illegal processing of the data subject or by violating the requirements of technical data protection. The data controller is also liable to the data subject for the damage caused by the data processor. The data manager is released from liability if it proves that the damage was caused by an unavoidable cause outside the scope of data management. It is not necessary to compensate the damage if it resulted from the intentional or grossly negligent behavior of the injured party.
8.2. Data processing tasks and powers and responsibilities
The rights and obligations of the data processor related to the processing of personal data are determined by the data controller within the framework of these regulations and the relevant legislation. The data processor is responsible for processing, changing, deleting, transmitting and disclosing personal data within the scope of its activities and within the framework defined by the data controller. In the contract concluded with the data processor, it must be stated that the data processor may use another data processor in the performance of its activities in accordance with the instructions of the data controller, and that violation of the rules on data management may serve as a basis for the immediate termination of the contract.
9. Basic principles and basic provisions
- The basic principle of legality, fair procedure and transparency (The collection and processing of data must be fair and legal, as well as transparent for the data subject. )
- Purpose-bound principle (According to Infotv., personal data may only be processed for a specific purpose, in order to exercise a right and fulfill an obligation. At all stages of data processing, the purpose of data processing must be met. Only such personal data can be processed that is essential for the realization of the purpose of data processing, to achieve the goal personal data can only be processed to the extent and for the time necessary to achieve the purpose.)
- Principle of data conservation (Based on the principle of data conservation, the data controller may only process personal data that is absolutely necessary for the realization of the purpose of data management)
- Principle of accuracy (The data managed by the data controller must be accurate and, if necessary, up-to-date; all reasonable measures must be taken to ensure that inaccurate personal data for the purposes of data management are immediately deleted or corrected.)
- Principle of limited storage (Personal data must be stored in a form that allows the identification of the data subjects only for the time necessary to achieve the goals of personal data management.)
- Principle of integrity and confidentiality (Personal data must be handled in such a way that adequate security of personal data is ensured by applying appropriate technical or organizational measures, including protection against unauthorized or illegal processing, accidental loss, destruction or damage of data.)
- Basic principle of accountability (The data controller is responsible for compliance with data management principles and rules, and must also be able to prove this compliance.)
Principle of data security (The data controller plans and executes the data management operations in such a way as to ensure the protection of the privacy of the data subjects during the application of Infotv. and other rules regarding data management. The data controller ensures the security of the data, also takes the technical and organizational measures and develops the procedural rules that are necessary for the enforcement of Infotv., as well as other data and confidentiality rules in particular against unauthorized access, alteration, transmission, disclosure, deletion or destruction, as well as against accidental destruction and damage, as well as against becoming inaccessible due to changes in the technology used data stored in registers - unless permitted by law - cannot be directly linked and assigned to the data subject.
In order to maintain security and prevent data processing that violates the GDPR, the data controller evaluates the risks arising from the nature of data processing and applies measures to reduce these risks, such as encryption. These measures ensure an adequate level of security, including confidentiality, taking into account the state of science and technology and the costs of implementation related to the risks and the nature of the personal data requiring protection. During the data security risk assessment, the risks posed by the handling of personal data - such as the accidental or unlawful destruction, loss, alteration, unauthorized disclosure or unauthorized access to personal data transmitted, stored or handled in another way - must be considered, which are physical, financial or may lead to non-property damage.
10. Rights of data subjects
Right of access
(The data subject has the right to receive information from the data controller as to whether his personal data is being processed, and if such data processing is in progress, he is entitled to receive access to the personal data, as well as to receive information about the circumstances related to their processing. The data controller without undue delay, but no later than one month from the date of receipt of the request, inform the person concerned of the measures taken following the request, if necessary, taking into account the complexity of the request and the requests number, this deadline can be extended by another two months. The data controller will inform the data subject of the extension of the deadline by indicating the reasons for the delay. If the data subject submitted the request electronically, the information must be provided electronically, except , if the person concerned requests it otherwise.
Right to rectification
(The data subject has the right to request that the data controller correct inaccurate personal data relating to him without undue delay, as well as to request the addition of incomplete personal data.)
The right to erasure
(The data subject has the right to request that the data controller delete his personal data without undue delay if one of the following reasons exists:
a) the personal data are no longer needed for the purpose for which they were collected or otherwise processed;
b) the data subject withdraws the consent that forms the basis of the data processing pursuant to point a) of Article 6 (1) or point a) of Article 9 (2) of the GDPR, and there is no other legal basis for the data processing;
c) the data subject objects to the data processing based on Article 21 (1) of the GDPR, and there is no overriding legal reason for the data processing, or the data subject is the GDPR. objects to data processing on the basis of Article 21 (2);
d) if the personal data was handled unlawfully by the data controller;
e) if personal data must be deleted based on legislation;
f) the collection of personal data took place in connection with the offer of information society-related services referred to in Article 8 (1) of the GDPR (conditions for the consent of children).
The data controller will not delete the data if data management is necessary for one of the following reasons:
a) for the purpose of exercising the right to freedom of expression and information;
b) for the purpose of fulfilling the legal obligation requiring the processing of personal data;
c) or necessary for the submission, enforcement or defense of legal claims.
The right to restrict data processing
(The data subject has the right to have the data controller restrict data processing at his request, if one of the following is met:
a) the data subject disputes the accuracy of the personal data, in which case the limitation applies to the period that allows the data controller to check the accuracy of the personal data;
b) the data management is illegal and the Data Subject opposes the deletion of the data and instead requests the limitation of their use;
c) the data controller no longer needs the personal data for the purpose of data management, but the data subject requires them to present, enforce or defend legal claims; or
d) the data subject objected to data processing; in this case, the restriction applies to the period until it is established whether the legitimate reasons of the data controller take precedence over the legitimate reasons of the data subject. With the exception of storage, personal data affected by the limitation of data processing may only be processed with the consent of the data subject, or for the presentation, enforcement or defense of legal claims, or for the protection of the rights of another natural or legal person, or for the important public interest of the Union or a member state. The data controller will inform the data subject in advance about the lifting of the restriction.
The right to object (The data subject has the right to object at any time for reasons related to his own situation against the processing of his personal data based on points e) or f) of Article 6 (1) of the GDPR, including profiling based on the aforementioned provisions. In this case, the data controller may no longer process the personal data, unless it proves that the data processing is justified by compelling legitimate reasons that take precedence over the interests, rights and freedoms of the data subject, or that are related to the submission, enforcement or defense of legal claims. )
The right to data portability (The data subject has the right to receive his/her personal data in a segmented, widely used, machine-readable format, and is also entitled to transfer this data to another data controller without being hindered by the data controller whose provided personal data to you if: a) the data management is GDPR. It is based on consent according to Article 6 (1) point a) or Article 9 (2) point a) or on a contract according to Article 6 (1) point b) of the GDPR; and b) data management is performed in an automated manner.
11. Detailed rules of data management
11.1. Information on data management
The data subjects have the right to receive information about the handling of their personal data in a concise, transparent and easily accessible form, in a clear and comprehensible manner. If the personal data is collected from the data subject, the data subject must also be informed whether he is obliged to disclose the personal data, as well as the consequences of not providing the data. Information related to the processing of personal data concerning the data subject must be provided to the data subject at the time of data collection, and if the data was not collected from the data subject but from another source, it must be made available within a reasonable time frame, taking into account the circumstances of the case. If the personal data can be legally communicated to another recipient, the data subject must be informed of this upon first communication with the recipient.
If the data controller wishes to process the personal data for a purpose other than the original purpose of their collection, the data subject must be informed of this different purpose and all other necessary information before further data processing.
The information must be about the following:
- about the identity and availability of the data controller
- the contact details of the data protection officer
- on the purpose of processing personal data, as well as the legal basis of data processing
- in the case of data processing based on "legitimate interest", about these legitimate interests
- about recipients of personal data
- on the planned duration of data management
- about the rights of the data subject
- about whether the provision of data is a prerequisite for entering into a contract, and what possible consequences the failure to provide data may have
- about possible automated decision-making, including profiling.
- on the legal remedies available to those concerned
11.2 Lawfulness of data management
The processing of personal data is legal if the data controller has one of the following legal bases for data processing:
- the data subject has given his consent to the processing of his personal data
- data management is necessary for the performance of a contract to which the data subject is a party
- data management is necessary to fulfill the legal obligation of the data controller
- data processing is necessary to protect the vital interests of the data subject
- data management is necessary to perform a public interest task
- data processing is necessary to enforce the legitimate interests of the data controller or a third party, unless these interests are overridden by interests or fundamental rights and freedoms of the Data Subject that require the protection of personal data, especially if the Data Subject is a child.
11.3 The range of personal data managed by the data controller, the purpose of the data management, and the duration of its legal basis are contained in the register of data management activities forming Annex 1 of these regulations, which register is published by the data controller on its website.
The data management register contains:
- the purpose of data management,
- type of data,
- the legal basis of its treatment,
- range of stakeholders,
- source of data,
- the type, recipient and legal basis of any data transmission,
- the deadline for deleting the given type of data,
- if data processing takes place in relation to the data, the data of the data processor, the place of data processing, the data processor's activities related to data management.
In connection with the data management mentioned in the data management register, separate data management information sheets have been prepared, which form an appendix to the register.
11.4. Duration of data management
The data can only be stored for the shortest possible time. When determining this period, it is necessary to take into account the reasons for which the data controller conducts data management, as well as the legal obligations to preserve the data for a specified period of time.
11.5. Internal data transfer
Within the organization of the data controller, personal data may only be transmitted in accordance with the principle of purpose limitation, and the right to access the data may only be granted in the case of a suitable purpose.
11.6. Data transfer to third parties
Personal data may be forwarded to a third party only on the basis of law or with the consent of the data subject, if the conditions for data management are met for each individual piece of personal data. Prior to data transmission, the data controller is obliged to check whether the legal requirements are met, and whether the conditions for data management are met for each personal data after transmission. Before transferring data to the same data controllers, concerning the same data subject and for the same purpose, the data protection officer must also be involved in the investigation of the legality of the data transfer. There is no need to conduct a separate investigation during subsequent data transmissions. The data protection officer is obliged to keep a data transfer register and store it in accordance with the rules. The data transfer register must be kept until the end of the fifth year following the year of data transfer or data transfer (twenty years in the case of special data).
The data transfer register contains:
- the date of transmission of the personal data managed by the data transmitter,
- scope of transmitted data,
- the legal basis of the data transmission and the recipient (name, address, seat),
- the name and telephone number of the person responsible for data transmission.
11.7 Transfer of data abroad or to a third country
Prior to data transfer, the data controller is obliged to check, with the involvement of the data protection officer, whether the legal conditions are met, and whether the conditions for data management are met for each individual piece of personal data after the transfer.
11.8 The data controller does not process special data, including biometric data.
12. Data protection incident
Under the GDPR, a data protection incident is defined as a breach of security that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure or unauthorized access to personal data transmitted, stored or otherwise handled.
12.1 Notification of a data protection incident
The data protection incident shall be reported by the data controller to the competent supervisory authority (NAIH) without undue delay and, if possible, no later than 72 hours after becoming aware of the data protection incident, unless the data protection incident is likely to pose no risk to the rights of natural persons and for his freedoms. If the notification is not made within 72 hours, the reasons justifying the delay must also be attached.
12.2 Investigation and handling of a data protection incident
The data protection officer examines the notification and requests data from the notifier, which the notifier is obliged to provide immediately, but within 2 working days at the latest.
The data provision must include
- the time and place of the incident
- the description, circumstances and effects of the incident
- the scope and number of data affected during the incident
- the range of persons affected by the data
- a description of the measures taken to prevent the incident,
- a description of the measures taken to prevent, eliminate and reduce the damage.
The data protection officer makes a proposal for the necessary action. The person in charge of the data management or processing process must inform the data protection officer of the individual measures implemented in order to prevent the data protection incident within 2 working days after the implementation of the given measures.
12.3 Registration of data protection incidents
The data controller is obliged to register data protection incidents. Pursuant to the GDPR, the data controller is obliged to implement appropriate technical and organizational measures in order to be able to detect and evaluate vulnerabilities and security incidents. Thus, in addition to documenting data protection incidents, the data controller is obliged to apply appropriate processes and measures in order to detect and manage security incidents in a timely manner.
13. Scope and amendment of these regulations
These regulations will enter into force on October 30, 2023. The data manager has the right to independently amend the policy at any time - as long as the amendment does not conflict with the applicable legislation. The regulations can be viewed at the headquarters of the data controller.
Celldömölk, October 30, 2023.
Vulkán Hotel Kft.
Managing Director János Gábor Jakab
Some essential data management
| Management of website visitor data | |
|---|---|
| Scope of managed data: | start and end time of the user's visit to the website, IP address and other recorded browsing data (cookie) |
| The purpose of data management | The purpose of data management is to identify website visitors, learn about browsing habits, and improve the user experience |
| The legal basis for data management | the consent of the data subject /GDPR Article 6 (1) point a) |
| Source of data | from the data subject |
| Data transfer | |
| The deadline for data deletion | until the consent of the data subject is revoked |
| Data management according to Section 9/H of the Tourism Act NTAK | |
|---|---|
| Scope of processed data | 1. the user of the accommodation service - surname and first name, - surname and surname at birth, - place and time of birth, gender, nationality - his mother's family name and surname at birth, - the identification data of your personal identification document or travel document, in the case of a third-country national, the visa or residence permit number, the date and place of entry, 2. the address of the accommodation service, the start and expected end date of the use of the accommodation, |
| The purpose of data management | to protect the rights, safety and property of the data subject and others, as well as to check compliance with the provisions on the residence of third-country nationals and persons with the right to free movement and residence. |
| Legal basis for data management | Pursuant to § 9/H of the 2016 CLVI Act on the State Tasks for the Development of Tourist Areas /GDPR Article 6 (1) point c) |
| Source of data | from the data subject |
| Data transfer | to the Hungarian Tourism Agency |
| Data deletion deadline | The last day of the first year after becoming aware of it |
| Invoicing | |
|---|---|
| Scope of processed data | name, address, bank card data |
| The purpose of data management | to account for the value of services used in exchange for consideration, and to fulfill invoicing obligations |
| Legal basis for data management | Fulfillment of the legal obligation contained in § 169 of Act C of 2000 on accounting /GDPR Article 6 (1) point c) |
| Source of data | from the data subject |
| Data transmission | to the bank managing the account, for the purpose of processing the payment transaction. |
| The deadline for data | deletion is 8 years based on § 169 of Act C of 2000 on accounting |
| Direct booking | |
|---|---|
| Scope of processed data | name, e-mail address, telephone number, address, number of persons wishing to use the service (number of children, age) |
| The purpose of data management | to process room reservations |
| The legal basis for data processing | the performance of a contract /GDPR Article 6 (1) point b)/, data processing based on legislation (§§ 30-31 of the 1990 Act C) regarding the date of birth /GDPR Article 6 (1) point c) point/ |
| Source of data | from the data subject |
| Data transfer | 1. for the purpose of operating the online booking system 2. Operation of the payment system related to the online payment transaction for the account managing bank |
| Data deletion deadline | - personal data received during the reservation will be processed for the duration of the contractual relationship with the data subject Expect: - name home address: for 8 years based on § 169 of Act C of 2000 on accounting - name and age of the guests: 2017 I7th CL on the taxation system. on the basis of § 78 (3) and § 202 (1) of the Act until the last day of the 5th year following the relevant year |