Privacy Policy

The official, legally binding version of this Privacy Policy is the Hungarian one, available on the Hungarian site. The English translation below is provided for convenience only.

Várvédőház Apartments (hereinafter: Service Provider) handles the data of visitors to, and persons requesting offers via, the www.varvedohaz.hu website (hereinafter: Website, and collectively the Data Subjects).

In connection with data handling, the Service Provider hereby informs Data Subjects of the personal data handled on the Website, the principles and practices followed in handling personal data, and the methods and possibilities of exercising the rights of Data Subjects.

By using the Website, the Data Subject accepts the contents of this Privacy Notice and consents to the data processing defined below.

Purpose of data handling

The Service Provider stores and handles data provided by the Data Subject for specific purposes: fulfilment of the order, enabling invoicing, recording bookings, handling complaints, contact, and subsequent proof of the contract terms.

The purpose of automatically recorded data is statistics and the technical development of the IT system.

The Service Provider does not, and may not, use the provided personal data for purposes other than those defined above. The disclosure of personal data to third parties or authorities — unless otherwise required by law — is possible only with the express prior consent of the Data Subject.

In all cases where the Service Provider wishes to use the provided data for a purpose different from the original collection, it will inform the Data Subject and obtain prior express consent, or provide the opportunity to prohibit such use.

Legal basis of data handling

Data is handled based on the Website users' voluntary statement based on appropriate information, which statement contains the Data Subjects' express consent to the use of their personal data provided while using the Website.

Data processing by the Service Provider takes place under point a) of paragraph (1) of section 5 of Act CXII of 2011 on the right to informational self-determination and freedom of information (hereinafter: Info.tv.), based on the Data Subject's voluntary consent, and also under Act CVIII of 2001 on certain issues of electronic commercial services and services related to the information society.

The Service Provider does not verify the personal data provided to it or their authenticity. Only the person providing the data, the Data Subject, the contracting party, is responsible for the suitability of the data provided. Each Data Subject, by providing an e-mail address, also assumes responsibility for using the service from that e-mail address exclusively. In view of this assumption of responsibility, any liability related to logins and orders made from a given e-mail address rests solely with the Data Subject who registered the e-mail address.

Identification of the Service Provider as Data Controllers

Handling of personal data provided during a request for an offer or contact begins with the sending of the offer/message. Provided personal data can be deleted at any time, following the submission of a deletion request. Following receipt of the request, the Service Provider deletes the personal data from its system within 5 business days.

Duration of data handling

Logged data is stored by the system — except for the date of the last visit, which is automatically overwritten — for a maximum of 12 months from the time of logging.

The above provisions do not affect the fulfilment of retention obligations specified in legislation (e.g. accounting law) or data handling based on further consent given in other ways.

Scope of personal data handled

Data provided during a request for an offer or contact

For an offer request, a form must be completed providing the following data to allow the Service Provider to respond: name, address, phone number (not mandatory), e-mail address, message (optional), as well as the type of service requested, arrival and departure dates, number of guests, and payment method.

For a contact request, another form must be completed providing the following data to allow the Service Provider to respond: name, e-mail address, message (optional).

Data provided when subscribing to the newsletter

Subscribing to the newsletter is voluntary and is based on the e-mail address provided on the Website. Subscription is confirmed (double opt-in): a confirmation e-mail is sent to the address given, and the Data Subject is added to the newsletter list only after opening the link it contains. The data handled are: e-mail address, the language of the subscription, and the date and IP address of the subscription and of its confirmation.

The legal basis of this data handling is the Data Subject's voluntary, explicit consent pursuant to Section 6 of Act XLVIII of 2008 on the Basic Conditions and Certain Limitations of Business Advertising Activity; its purpose is sending newsletters that may also contain commercial advertising. Consent may be withdrawn at any time, without justification and free of charge: every newsletter contains an unsubscribe link at the bottom, and unsubscription may also be requested via the contacts given below. The Service Provider handles the subscriber's data until consent is withdrawn.

Technical data

Data from the Data Subject's logged-in computer that are generated during the use of the service and that the Service Provider's system records as an automatic result of technical processes. In particular, the date and time of the visit, the Data Subject's computer IP address, browser type, the address of the web page viewed and the previously visited page.

Automatically recorded data is logged by the system automatically upon login and logout, without a separate declaration or action by the Data Subject. This data cannot be linked to other personal user data — except in cases required by law. Only the Service Provider has access to this data.

The HTML code of the Website may contain links coming from and pointing to external servers independent of the Service Provider. The providers of these links may collect user data through direct connections to their servers.

Cookies

The Service Provider and the indicated external service providers place and read small data packets — so-called cookies — on the Data Subject's computer for the purpose of customised service. If the browser sends back a previously saved cookie, the cookie's service provider can link the data saved during the Data Subject's current visit with previous data, but only with regard to its own content.

The Service Provider uses the following cookies:

• Session cookie: session cookies are automatically deleted after the Data Subject's visit. These cookies serve to make the Service Provider's Website operate more efficiently and securely, and are therefore essential for certain functions or applications of the Website to work properly.
• Persistent cookie: the Service Provider also uses persistent cookies for a better user experience (e.g. providing optimised navigation). These cookies are stored for longer in the browser's cookie file. Their duration depends on the Data Subject's browser settings.
• Security cookie.

The "Help" function in most browser menus provides information on how the Data Subject can, in their own browser:

• disable cookies,
• accept new cookies,
• instruct the browser to set a new cookie, or
• disable other cookies.

External servers help the independent measurement and audit of the Website's traffic and other web analytics data (Google Analytics). Detailed information about these data processing operations is provided by the data controllers to the Data Subject. Their contact: www.google.com/analytics/

If the Data Subject does not wish Google Analytics to measure the above data in the manner described, please install the blocking extension in your browser.

Persons accessing data, data transfer, data processing

Primarily the Service Provider and its internal staff are entitled to access the data; however, they do not publish it nor disclose it to third parties.

The Service Provider may use a data processor (e.g. system operator, accountant) for the fulfilment of orders and settlement.

The technical operation of the newsletter service is carried out as data processor by Intuit Mailchimp (The Rocket Science Group LLC, 405 N Angier Ave NE, Atlanta, GA 30308, United States of America), which stores subscribers' e-mail addresses and the related subscription data in the United States of America. The legal basis of this transfer is the European Commission's adequacy decision on the EU–US Data Privacy Framework, together with the standard contractual clauses concluded with the data processor. The data processor's privacy statement is available at intuit.com/privacy/statement .

Personal data concerning the Data Subject may only be transferred in cases required by law or based on the Data Subject's consent.

Rights and remedies of Data Subjects

Right to information

The Data Subject is entitled at any time to request information about personal data concerning them handled by the Service Provider, and may modify them at any time on the Website in their own account — except for the e-mail address provided during registration.

Upon the Data Subject's request, the Service Provider provides information about the data concerning them, the purpose, legal basis, and duration of data handling, as well as who receives or has received their data and for what purpose. The Service Provider provides the requested information in writing within 30 days of receipt of the request.

The Data Subject may turn to the Service Provider's staff with any questions or comments regarding data handling, via the contact details specified below.

The Data Subject may request the deletion, correction, or blocking of their data

The Data Subject is entitled at any time to request the correction or deletion of incorrectly recorded data at one of the contact addresses specified below. The Service Provider deletes the data within 5 business days of receipt of the request, in which case the data cannot be restored. The deletion does not apply to data processing required by law (e.g. accounting regulations), which the Service Provider retains for the necessary period.

The Data Subject may also request that their data be blocked. The Service Provider blocks personal data if the Data Subject so requests, or if, based on the available information, it is presumed that deletion would harm the legitimate interests of the Data Subject. Personal data thus blocked may only be handled for as long as the data handling purpose that excluded deletion of the personal data persists.

Notification of correction, blocking, or deletion is required of the Data Subject and all those to whom the data was previously transferred for data handling purposes. Notification may be omitted if, considering the purpose of data handling, it does not harm the legitimate interest of the Data Subject.

If the data controller does not fulfil the Data Subject's request for correction, blocking or deletion, it shall communicate in writing the factual and legal reasons for rejecting the request within 30 days of receipt of the request.

The Data Subject may object to the handling of their personal data

The Data Subject may object to the handling of their personal data. The Service Provider examines the objection within the shortest time, but no later than 15 days from receipt of the request, makes a decision on its merits, and informs the applicant of the decision in writing.

The Data Subject may exercise their rights via the contacts in point 3

Under Info.tv. and the Civil Code (Act V of 2013), the Data Subject may:

• turn to the National Authority for Data Protection and Freedom of Information (1125 Budapest, Szilágyi Erzsébet fasor 22/c.; www.naih.hu), or
• enforce their rights in court.

If during the use of the service the Data Subject provided third-party data during registration or ordering, or caused damage in any way during the use of the Website, the Service Provider is entitled to claim damages from the Data Subject. The Service Provider will in such cases provide all possible assistance to the authorities involved in establishing the identity of the offender.

Use of e-mail addresses

The Service Provider pays special attention to the lawfulness of the use of the electronic e-mail addresses it handles, and therefore uses them only as defined below (offer or response message) for sending e-mails.

The handling of e-mail addresses primarily serves the identification of the Data Subject and contact during the fulfilment of orders and use of services, and therefore e-mails are sent primarily for these purposes.

The Service Provider sends newsletters only to those who have voluntarily subscribed on the Website and have confirmed their subscription in the confirmation e-mail. The newsletter may also contain commercial advertising; every message contains an unsubscribe link at the bottom.

Data security

The Service Provider undertakes to ensure data security, and to take such technical measures that ensure the recorded, stored, or handled data are protected, and to do everything possible to prevent their destruction, unauthorised use, and unauthorised modification. It also undertakes to call on any third party to whom the data is possibly transferred or handed over to fulfil obligations in this regard.

Miscellaneous provisions

The Service Provider reserves the right to unilaterally modify this Privacy Notice with prior notification to Data Subjects. After the entry into force of the modification, by using the Website with implied conduct, the Data Subject accepts the provisions of the modified Privacy Notice.