Privacy policy

1. GENERAL PROVISIONS

PIKNIKHÁZ CSOPAK (8229 Csopak, Fenyves utca 11/b.) always ensures the lawfulness and reasonability of data processing with regard to the personal data processed by it.

The purpose of this Policy is to offer guests who book a room and provide their personal data with adequate information on the conditions and guarantees subject to which their data will be processed, and the duration of data processing.

All PIKNIKHÁZ CSOPAK employees shall comply with the provisions of the Policy.

PIKNIKHÁZ CSOPAK reserves the right to change the content of this Policy, in which case it will inform the data subjects in advance.

The legal basis of data processing performed by PIKNIKHÁZ CSOPAK is the fulfilment of legal obligations and voluntary consent.

The data processing performed by PIKNIKHÁZ CSOPAK complies with the relevant laws and regulations, in particular with the following:

Regulation (EU) 2016/679 of the European Parliament and of the Council (of 27 April 2016) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: ‘GDPR’)
Act CXII of 2011 on the Right of Informational Self-determination and Freedom of Information (‘Info Act’).

Data and contact details of PIKNIKHÁZ CSOPAK:

Operator: Dr. Anna Kozma
Residential address: 1029 Budapest, József Attila útja 84/b.
Mailing address: 8220 Balatonalmádi, Harkály utca 3.
Tax number: 70993626-2-41
Phone number: +36203770860
E-mail: info@piknikhazcsopak.hu
Below, we provide information about our data processing operations.

2. DATA PROCESSING IN CONNECTION WITH CONTACTS AND REQUESTS FOR OFFER

PIKNIKHÁZ CSOPAK provides the possibility for the guest to enquire and request an offer electronically.

Purpose of data processing: to provide advance information on the availability and prices of PIKNIKHÁZ CSOPAK

The legal basis of data processing: prior consent of the guest

The scope of personal data processed: name prefix, surname and first name; birth name; place and date of birth; mother’s name; home address; identity card or passport number; telephone number; e-mail address; number of guests, planned length of stay.

Duration of data processing: two years after the last day of the booked stay.

Use of data processor: not applicable

Recipients of data processing: employees of PIKNIKHÁZ CSOPAK performing reservation tasks

Possible consequences of non-disclosure of data: PIKNIKHÁZ CSOPAK may be unable to make an offer.

3. DATA PROCESSING RELATED TO RESERVATIONS

Purpose of data processing: to identify the guest, fulfil legal obligations (data transmission to the National Tourism Data Supply Centre /NTAK/).

The legal basis of data processing: prior consent of the guest, fulfilling a legal obligation

The scope of personal data processed: name prefix, surname and first name; birth name; place and date of birth; mother’s name; home address; identity card or passport number; telephone number; e-mail address; number of guests, planned length of stay.

Duration of data processing: two years after the last day of the booked stay.

Use of data processor: Új Horváth és Társai Kft. 1065 Budapest Nagymező u. 3. accountant

Recipients of data processing: employees of PIKNIKHÁZ CSOPAK performing reservation tasks

Possible consequences of non-disclosure of data: PIKNIKHÁZ CSOPAK may be unable to provide the requested service.

4. DATA PROCESSING RELATING TO SUBSCRIPTION FOR NEWSLETTERS

PIKNIKHÁZ CSOPAK keeps in touch with its guests through newsletters in which it offers its services, informs them about news related to its operation and promotion campaigns.

Purpose of data processing: to keep contact with potential guests

The legal basis of data processing: consent of the data subject, the legitimate interest of PIKNIKHÁZ CSOPAK

Description of the legitimate interest: maintaining and developing business relationships with partners and guests

The scope of personal data processed: name, e-mail address

Duration of data processing: PIKNIKHÁZ CSOPAK processes the data until the user unsubscribes from the newsletter

Recipients of data processing: employees of PIKNIKHÁZ CSOPAK responsible for maintaining and developing business relations

Use of data processor: not applicable

Possible consequences of non-disclosure of data: the data subject will not receive newsletters from PIKNIKHÁZ CSOPAK.

5. PERSONAL DATA PROCESSING RELATED TO SATISFACTION MEASUREMENT

PIKNIKHÁZ CSOPAK aims to provide its guests with high-quality services; therefore, it constantly asks for feedback from its guests about their experiences and suggestions for improvement during their stay at PIKNIKHÁZ CSOPAK.

Purpose of data processing: to request feedback from hotel guests in order to further develop and improve services.

The legal basis of data processing: consent of the data subject, the legitimate interest of PIKNIKHÁZ CSOPAK

Description of the legitimate interest: PIKNIKHÁZ CSOPAK has a legitimate interest in collecting information to improve its services based on feedback

The scope of personal data processed: name, guest’s gender, e-mail address.

Duration of data processing: two years after the last day of the booked stay.

Recipients of data processing: employees of PIKNIKHÁZ CSOPAK responsible for maintaining and developing business relations

Use of data processor: not applicable

Possible consequences of non-disclosure of data: The data subject will not receive satisfaction surveys from PIKNIKHÁZ CSOPAK.

6. MANAGING COOKIES

In order to provide custom-tailored services, PIKNIKHÁZ CSOPAK places cookies, that is, small data packages on the computer of the guest/user which are retrieved in case of a subsequent visit to the website. If the browser returns a previously saved cookie, the cookie manager may link the user’s current visit with previous ones but only with respect to its own content.

Purpose of data processing: to identify, track and differentiate users, identify the user’s current browsing session, store data provided during the session, prevent data loss, perform web analytics measurements, provide personalised service.

The legal basis of data processing: consent of the data subject

Scope of the data processed: ID number, date, time, and the previously visited page

Duration of data processing: up to 90 days

Other information relating to data processing: the user may delete the cookie from their own computer or block cookies in their browser. Normally, users can manage cookies by opening the Tools/Settings menu of the browser, then opening the Data Protection/History/Custom Settings menu and choosing the ‘cookies’ or ‘tracking’ option.

Possible consequences of non-disclosure of data: using the service becomes impossible with respect to the services described in Sections 2 to 5 above.

7. WEBSITE SERVER LOGGING

Whenever the website www.piknikhazcsopak.hu is visited, the web server automatically logs the user’s activity.

Purpose of data processing: whenever the website is visited, the service provider records visitor data in order to check the operation of the services and prevent abuse

The legal basis of data processing: legitimate interest of PIKNIKHÁZ CSOPAK

Type of personal data processed: ID number, date, time, address of the page visited

Duration of data processing: up to 90 days.

Details of the data processor: Mentha Hosting Kft. 1092 Budapest, Hőgyes Endre u. 3.

Additional information: PIKNIKHÁZ CSOPAK does not link the data generated during the analysis of the log files with other information, and does not attempt to identify the user. The address of the pages visited, and the date and time data are not suitable for the identification of the data subject by themselves; however, when combined with other data (e.g. data provided during registration), they are suitable for drawing conclusions about the user.

IP addresses can be used to locate geographically the visitor using a given computer. The address of the pages visited, and the date and time data are not suitable for the identification of the data subject by themselves; however, when combined with other data (e.g. data provided during registration), they are suitable for drawing conclusions about the user.

8. COMPULSORY DATA REPORTING

Pursuant to Act CLVI of 2016 on State Tasks for the Development of Tourist Areas, PIKNIKHÁZ CSOPAK, as the accommodation provider shall provide the data of the Guest specified in the Act to the designated hosting provider (Hungarian Tourism Agency) through the Guest Information Closed Database (VIZA) system.

9. OTHER DATA PROCESSING OPERATIONS

PIKNIKHÁZ CSOPAK will give you information about any data processing not covered by this policy upon recording the relevant data.

Authorities, public bodies and courts may request PIKNIKHÁZ CSOPAK to disclose personal data. In these cases, PIKNIKHÁZ CSOPAK may disclose personal data to the authorities only to the extent absolutely necessary for achieving the purpose of the data request, provided that the relevant authority has specified the exact purpose and the scope of data requested, and that the request must be satisfied due to the law.

10. METHOD OF STORING PERSONAL DATA, SECURITY OF DATA PROCESSING

The computer systems and other data storage facilities of PIKNIKHÁZ CSOPAK are located at the headquarters and on the servers rented by the data processor.

PIKNIKHÁZ CSOPAK chooses and operates the information technology equipment used for providing our services related to the processing of personal data so as to make sure that the data being processed is available to those authorised thereto (availability); is authentic and its authentication is ensured (authenticity of processing); its integrity is verifiable (data integrity); it is protected against unauthorised access (data confidentiality).

PIKNIKHÁZ CSOPAK pays particular attention to data security, takes appropriate technical and organisational measures and develops internal procedures that are necessary to enforce the guarantees required in the GDPR. It takes appropriate measures to protect data against unauthorised access, modification, transmission, publication, deletion or destruction, and incidental loss or corruption, or becoming inaccessible due to a change in the applied technology.

The information systems and networks of PIKNIKHÁZ CSOPAK are protected against computer fraud, computer viruses, hacking and denial-of-service attacks. The operator ensures security through server-level and application-level protection procedures. Data backups are created on a daily basis. In order to avoid any data breaches, PIKNIKHÁZ CSOPAK takes all possible measures and, in the event of a breach, it takes immediate action to minimise the risks and eliminate any damage.

PIKNIKHÁZ CSOPAK takes all necessary technical and organisational measures to avoid a possible data breach (e.g. damage, loss of files containing personal data, unauthorised persons getting access). In case a data breach should still occur, in order to control the measures taken in response to a data breach and to notify the data subject, PIKNIKHÁZ CSOPAK keeps a register containing the scope of personal data affected, the scope and number of data subjects affected by the data breach, the date, circumstances and effects of the data breach, the measures taken, as well as any other information prescribed by the laws applicable to the data processing.

11. RIGHTS AND REMEDIES OF DATA SUBJECTS

The data subject may request access to the personal data concerning them, may request its correction, may request its erasure, may request restriction of the processing of personal data if the conditions set out in Article 18 of the GDPR apply, may object to the processing of personal data, may exercise their right to data portability. Based on the last of the above rights, data subjects are entitled to receive the personal data related to them in Word or Excel format and to request PIKNIKHÁZ CSOPAK to transfer such data to another controller.

The data subject may request information on the processing of their personal data, and may request the rectification of their personal data or, with the exception of mandatory data processing, may request its erasure or withdrawal, and may exercise their rights to data portability and objection in the way indicated at the time the data was collected, at the above contact details of the data controller.

At the request of the data subject, PIKNIKHÁZ CSOPAK provides the information in electronic form without delay but within 30 days at the latest. PIKNIKHÁZ CSOPAK shall satisfy the data subject’s request to exercise the rights below free of charge.

Right to information:

PIKNIKHÁZ CSOPAK takes appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 of the GDPR relating to the processing of personal data to the data subjects in a concise, transparent, intelligible and easily accessible form, using clear and plain language but still in a precise manner.

The right to information can be exercised in writing, via the contact details given in Section 1. At the request of the data subject, information can also be provided orally after proof of identity. If an employee of PIKNIKHÁZ CSOPAK has doubts about the identity of the data subject, they may request the provision of the information necessary to confirm the identity of the data subject.

The data subject’s right of access:

The data subject has the right to get confirmation from the controller as to whether or not personal data concerning them is being processed. If processing of personal data is in progress, the data subject has the right to access to the personal data and to the information listed below:

  • the purpose of data processing;
  • the categories of personal data concerned;
  • the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular recipients in third (non-EU) countries or international organisations;
  • the planned period for which the personal data will be stored;
  • the right to rectification and erasure, the right to restricting data processing, the right to objection;
  • the right to file a complaint with a supervisory authority;
  • information on data sources; the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

In addition to the above, where personal data is transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards relating to the transfer.

Right to rectification:

The data subject may request PIKNIKHÁZ CSOPAK to rectify any inaccurate personal data of the data subject, or to supplement any missing data.

Right to erasure:

The data subject has the right to obtain from PIKNIKHÁZ CSOPAK the erasure of their personal data without undue delay, in case any of the following reasons exist:

  • the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
  • the data subject withdraws their consent on which the processing is based, and there is no other legal ground for the processing;
  • the data subject objects to the processing and there are no overriding legitimate grounds for the processing;
  • it has been established that the personal data has been unlawfully processed;
  • the personal data has to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
  • the personal data has been collected in relation to the offer of information society services.

Erasure of data may not be requested if data processing is necessary for the following purposes:

  • for exercising the right of freedom of expression and information;
  • for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
  • for reasons of public interest in the area of public health, archiving, scientific or historical research purposes or statistical purposes;
    or for the establishment, exercise or defence of legal claims.

Right to restrict processing:

At the request of the data subject, PIKNIKHÁZ CSOPAK restricts data processing if the conditions set forth in Article 18 of the GDPR are met, i.e. if:

  • the accuracy of the personal data is contested by the data subject, in which case the restriction shall last for a period enabling verification of the accuracy of the personal data;
  • the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of its use instead;
  • the controller no longer needs the personal data for the purposes of the processing, but the data subject requests the same for the assertion, exercise or defence of legal claims; or
  • the data subject has objected to processing; in this case such restriction shall be valid until it is determined whether the legitimate grounds of the controller override those of the data subject.

Where processing has been restricted, personal data shall, with the exception of storage, only be processed with the consent of the data subject or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State. The data subject shall be informed before the restriction of processing is lifted.

Right to data portability:

The data subject is entitled to receive the personal data related to them that was provided by them to the data controller, in a structured, commonly used and machine-readable format, and also has the right to have such data transferred to another data controller. PIKNIKHÁZ CSOPAK fulfils such requests by the data subject in Word or Excel format.

Right to object:

Where personal data is processed for direct marketing purposes, the data subject has the right to object at any time to processing of personal data concerning them for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where the data subject objects to the processing of their personal data for direct marketing purposes, the personal data shall not be processed for such purposes.

Automated decision-making:

No such data processing is performed

Right of withdrawal:

The data subject has the right to withdraw their consent at any time. The withdrawal of consent shall not affect the lawfulness of processing that was carried out based on consent before its withdrawal.

Rules of procedure:

The controller shall provide information on action taken at a request submitted by the data subject pursuant to Articles 15 to 22 of the GDPR without undue delay and in any event within one month of receipt of the request. That period may be extended by two months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay.

Where the data subject makes the request by electronic means, the information will be provided by electronic means, unless otherwise requested by the data subject.

If the controller does not take action at the request of the data subject, the controller shall inform the data subject without delay, but within one month of receipt of the request at the latest, of the reasons for not taking action and that the data subject may file a complaint with the supervisory authority and seek a judicial remedy.

The controller shall communicate any rectification or erasure of personal data or restriction of processing implemented by it to each recipient to whom the personal data has been disclosed, unless this proves impossible or requires a disproportionate effort. The controller shall inform the Data Subject about those recipients if the data subject requests so.

Indemnification and grievance fee:

Any person who has suffered financial or non-financial loss as a result of a breach of the data protection regulation is entitled to compensation from the controller or the data processor for the damage suffered. The data processor shall be liable for the damage caused by the processing only where it has not complied with its obligations specifically imposed on data processors in the relevant laws or where it has acted neglecting or contrary to the lawful instructions of the controller. Where more than one controller or processor, or both a controller and a processor, are involved in the same processing and where they are liable for damage caused by processing, such controllers or processors shall be jointly and severally liable for the whole damage.

The controller or the processor shall be exempt from liability for damage if it proves that it is not liable in any way for the event giving rise to the damage.

Right to turn to court and data protection authority proceedings:

In the event of any infringement of their rights, the data subject may file an action with a court against the controller. The court shall hear the case with priority.
Complaints may be submitted to the National Authority for Data Protection and Freedom of Information:
Address of the authority: 1125 Budapest, Szilágyi Erzsébet fasor 22/C., mailing address: 1530 Budapest, Pf.: 5.
Phone: +36-1-391 1400
E-mail: ugyfelszolgalat@naih.hu

12. MISCELLANEOUS

For further questions or comments, please contact the data controller at info@piknikhazcsopak.hu.

By requesting an offer, the Guest accepts the provisions of the policy to be binding on themselves.

Published on 11th March 2024, on the website of PIKNIKHÁZ CSOPAK.