1. GENERAL PROVISIONS
The Shiraz Team Szállodaüzemeltető Kft. (Hotel Operator Ltd.), 1025 Budapest, Verecke u. 4. the operator of the Fabulous Shiraz Hotel****superior shall ensure that data processing is lawful and expedient in all cases where it processes personal data. The purpose of this data protection statement is to ensure that guests who make a reservation and give access to their personal data receive appropriate information already at the point of reservation or prior to giving access to their personal data with regards to the duration and under which conditions and guarantees our firm processes their data. Our company shall regard the contents of this data protection statement as mandatory and shall abide by its contents in each instance where it handles personal data.
We reserve the right, however, to change the terms of this unilateral declaration, in which case we will inform the persons concerned in advance. Should you have any questions with regards to the contents of this brochure please write us. Data processing related to our firm’s activities is based on voluntary contribution, or in some cases the data processing is necessary in order to take steps at the request of the data subject prior to entering into a contract;
Our data processing activities comply with applicable laws, in particular to the following:
The firm’s data and contact data are as follows:
Name: Shiraz Team Kft.
Head office:1122 Budapest, Ráth György utca 24. Fsz. 1 A.
Company registration number: 01-09-332868
Tax number:26573647-2-43
Phone number: +36 36 574 500
E-mail: info@shirazhotel.hu
1.2. DEFINITIONS
data subject: shall mean any natural person directly or indirectly identifiable by reference to specific personal data;
personal data: shall mean data relating to the data subject, in particular by reference to the name and identification number of the data subject or one or more factors specific to his physical, physiological, mental, economic, cultural or social identity as well as conclusions drawn from the data in regard to the data subject;
consent:shall mean any freely and expressly given specific and informed indication of the will of the data subject by which he signifies his agreement to personal data relating to him being processed fully or to the extent of specific operations;
data controller: shall mean the natural or legal person, or organisation without legal personality which alone or jointly with others determines the purposes and means of the processing of data; makes and executes decisions concerning data processing (including the means used) or have it executed by a data processor;
data management: shall mean any operation or the totality of operations performed on the data, irrespective of the procedure applied; in particular, collecting, recording, registering, classifying, storing, modifying, using, querying, transferring, disclosing, synchronising or connecting, blocking, deleting and destructing the data, as well as preventing their further use, taking photos, making audio or visual recordings, as well as registering physical characteristics suitable for personal identification (such as fingerprints or palm prints, DNA samples, iris scans);
data transfer: shall mean ensuring access to the data for a specified third party;
disclosure: shall mean ensuring open access to the data;
data deletion: shall mean making data unrecognisable in a way that it can never again be restored; data processing: shall mean performing technical tasks in connection with data processing operations, irrespective of the method and means used for executing the operations, as well as the place of execution, provided that the technical task is performed on the data;
data processor: shall mean any natural or legal person or organisation without legal personality processing the data on the grounds of a contract, including contracts concluded pursuant to legislative provisions;
privacy incident: unauthorized management or processing of personal data, including unauthorized access, alteration, transmission, disclosure, deletion or destruction, and any incidental destruction or damage.
We provide the following information regarding individual instances of data processing:
2. DATA PROCESSING IN RELATION TO ONLINE HOTEL BOOKING
Our company provides an opportunity for online lodging reservation in order that our customers may book a room free of charge in a quick, convenient way in Shiraz Hotel****superior.
Personal data processor: Shiraz Hotel Kft., 1122 Budapest, Ráth György utca 24. Fsz. 1 A..
The purpose of data processing: to render the reservation of lodgings easier, more efficient and free of charge, contacting the guest with hotel reservation.
Legal basis of data processing: the prior consent of the person who reserves lodging. By accepting this data protection statement, the data subject expressly consents to the processing of his/her personal data according to this section.
The scope of processed personal data: title; surname and given name; address (country, postcode, city, street, street number; phone number; e-mail address; in case of a company name of company and PBB; bank card number; SZÉP card number (identifier, name displayed on card). If filling in an online check-in form, the following information will also be managed by the accommodation: identity document number (identity card, passport or driving license), nationality, place and date of birth, vehicle registration number.
Duration of data processing: two years after the last day of stay as stated in the reservation.
Engagement of data controller: our company uses the services of an information service provider for the online lodging system as follows:
| Name of data controller | PPB | Description of data processing task |
| NetHotelBooking Kft. | 8200 Veszprém, Boksa tér 1/A Hungary | Providing an opportunity for online lodging reservation and operating a pre-arrival email module through RESnWEB system. By accepting this data protection statement, the data subject gives his express consent that the data controller shall engage further data controllers in order to render its services more convenient and customized as follows: |
| Name of additional data controller | PPB | Description of data processing task |
| Nevogate Payment Services Kft. | 1066 Budapest, Nyugati tér 1-2 Hungary | Providing data communications for payment transactions between the vendor’s and the payment provider’s systems, ensuring traceability for the transaction partners. The data protection statement of the service provider can be found on this link: https://www.nevogate.com/adatvedelem |
|
SimplePay Zrt. |
1138 Budapest, Váci út 135-139. B. ép. 5. em. Hungary |
Providing data communications for payment transactions between the vendor’s and the payment provider’s systems, providing customer service for users, confirming transactions and providing fraud-monitoring to protect the interests of the users. The data protection statement of the service provider can be found on this link: https://simplepay.hu/adatkezelesi-tajekoztatok/ |
| Barion Payment Zrt. | 1117 Budapest, Infopark sétány 1. I. épület Hungary | Providing data communications for payment transactions between the vendor’s and the payment provider’s systems, providing customer service for users, confirming transactions and providing fraud-monitoring to protect the interests of the users. The data protection statement of the service provider can be found on this link: https://www.barion.com/hu/adatvedelmi-tajekoztato/ |
| Amazon Web Services** | 410 Terry Avenue North, Seattle, WA 98109, United States | Performance of tasks related to server hosting. The data protection statement of the service provider can be found on this link: https://aws.amazon.com/privacy/ |
| Wildbit, LLC* | 225 Chestnut St, Philadelphia, PA 19106, USA | The owner of the software which is integrated into the booking system. This software is responsible for sending e-mail confirmations and notifications in the event of booking, requesting and providing proposals, customer satisfaction surveys, pre-arrival information and gift voucher selling. The data protection statement of the service provider can be found on this link: https://wildbit.com/eu-privacy |
| D-Edge SAS | 14/16 Boulevard Poissonnière, 75009 Paris, France | D-Edge Channel Manager to manage the rates and room availabilities on multiple distribution websites. The data protection statement of the service provider can be found on this link: https://www.d-edge.com/privacy-policy/ |
| ActiveCampaign, LLC | 1 North Dearborn St 5th Floor Chicago, IL 60602 | Performance of marketing automation tasks upon using ActiveCampaign. The data protection statement of the service provider can be found on this link: https://courses.activecampaign.com/pages/privacy |
| Stripe Inc. | 354 Oyster Point Boulevard, South San Francisco, California, 94080, USA | Providing payment infrastructure, storage of bank card data, charging bank cards, assuring online payment solution. Providing data communications for payment transactions between the vendor’s and the payment provider’s systems, providing customer service for users, confirming transactions and providing fraud-monitoring to protect the interests of the users. The data protection statement of the service provider can be found on this link: https://stripe.com/en-hu/privacy |
| Creative Management Kft. | 8200 Veszprém, Boksa tér 1. A ép. Hungary | Performing server hosting tasks |
| InstaCash Kft. | 1015 Budapest, Szabó Ilonka utca 22. fszt. 2. | Providing data communications for installment payment transactions between the vendor’s and the payment provider’s systems, providing customer service for users, confirming transactions and providing fraud-monitoring to protect the interests of the users. The data protection statement of the service provider can be found on this link: https://instacash.hu/media/2024/02/IC-Adatkezelesi-tajekoztato_BNPL_HU_01-03-2023.pdf |
*The Processor is based in the United States, so any transfer of data to the Processor is considered a transfer to a third country. However, Wildbit, LLC has incorporated the general data protection clauses proposed and approved by the European Commission into the data protection addendum to its general terms and conditions. In this regard, even without the permission of a supervisory authority, the transfer of data to Wildbit, LLC is considered to be adequately guaranteed and therefore not legally prevented.
**Amazon Web Services has voluntarily joined the EU-U.S. Data Privacy Framework program, ensuring that data transfers comply with the GDPR requirements.
The possible negative consequences of not providing personal data: Providing data is voluntary. It is important to note that filling in the fields marked with * is mandatory, and in case of non-completion, no reservation can be made. Leaving the remaining fields blank does not have such a consequence.
The rights of the data subject: the data subject (the person whose data our company processes)
Other information related to data processing:
3. DATA PROCESSING IN RELATION TO REQUESTING PROPOSALS
Our company provides an opportunity for our guests to request a proposal in an electronic way. The proposal is provided by our company while taking account of actual room availability through an automated system.
Personal data processor: Shiraz Hotel Kft., 1122 Budapest, Ráth György utca 24. Fsz. 1 A..
Purpose of data processing: to receive information prior to booking about hotel prices
Legal basis of data processing: the prior consent of person who reserves lodging, Article 6 Section 1 Point a) of the GDPR, or necessary in order to take the steps requested by the data subject prior to the conclusion of a data processing contract – Article 6 Section 1 Point b of the GDPR
Scope of processed personal data: title; surname and given name; phone number; e-mail address; number of guests.
Duration of data processing: two years after the last day of stay as stated in the reservation.
Engagement of data controller: our company uses the services of an information service provider for the online proposal system in accordance with the following:
| Name of data controller | PPB | Description of data processing task |
| NetHotelBooking Kft. | 8200 Veszprém, Boksa tér 1/A Hungary | Operating the proposal requesting and sending module |
By accepting this data protection statement, the data subject gives his express consent that the data controller shall engage further data controllers in order to render its services more convenient and customized as follows:
| Name of data controller | PPB | Description of data processing task |
| Amazon Web Services** | 410 Terry Avenue North, Seattle, WA 98109, United States | Performance of tasks related to server hosting. The data protection statement of the service provider can be found on this link: https://aws.amazon.com/privacy/ |
| Wildbit, LLC* | 225 Chestnut St, Philadelphia, PA 19106, USA | The owner of the software which is integrated into the booking system. This software is responsible for sending e-mail confirmations and notifications in the event of booking, requesting and providing proposals, customer satisfaction surveys, pre-arrival information and gift voucher selling. The data protection statement of the service provider can be found on this link: https://wildbit.com/eu-privacy |
| Creative Management Kft. | 8200 Veszprém, Boksa tér 1. A ép. Hungary | Performing server hosting tasks |
*The Processor is based in the United States, so any transfer of data to the Processor is considered a transfer to a third country. However, Wildbit, LLC has incorporated the general data protection clauses proposed and approved by the European Commission into the data protection addendum to its general terms and conditions. In this regard, even without the permission of a supervisory authority, the transfer of data to Wildbit, LLC is considered to be adequately guaranteed and therefore not legally prevented.
**Amazon Web Services has voluntarily joined the EU-U.S. Data Privacy Framework program, ensuring that data transfers comply with the GDPR requirements.
Possible negative consequences of not providing personal data: Providing data is voluntary. It is important to note that filling in the fields marked with * is mandatory, and in case of non-completion, no request for proposal can be made and the hotel cannot provide a proposal. Leaving the remaining fields blank does not have such a consequence.
The rights of the data subject: the data subject (the person whose data our company processes)
Other information related to data processing: our company takes every technological and organisational measure to avoid an eventual personal data breach (for instance, if the files containing personal data are damaged, disappear, or become accessible to unauthorised persons). Should a personal data breach nevertheless take place, we shall keep records in order to supervise the necessary measures as well as to inform the affected data subjects. This record shall contain the scope of affected personal data, the circle and number of data subjects affected by the privacy incident, the date, circumstances, effects of the personal data breach as well as the measures taken to deal with it, as well as other data as defined by the laws regulating data processing.
Our company concluded a data processing agreement for the scope of data processing tasks, in which the NetHotelBooking Kft. undertakes that in the event of the engagement of another data controller it shall apply on a mandatory basis the same data protection and data processing guarantees included in data processing contract with us, thus we ensure the lawful management of personal data in case of data controllers.
4. DATA PROCESSING RELATED TO NEWSLETTERS SUBSCRIPTION
Our company maintains contact with its guests via a newsletter, in which it informs its guests about its services, news relating to its operation as well as available discounts.
Personal data processor: Shiraz Hotel Kft., 1122 Budapest, Ráth György utca 24. Fsz. 1 A..
Purpose of data processing: maintaining contact with potential guests
Legal basis of data processing: consent of the data subject – Article 6 Section 1 Point a of GDPR.
Scope of processed personal data: name; e-mail address
Duration of data processing: our company processes e-mail addresses until such date that unsubscription occurs.
Engagement of data controller: our company uses the services of an information service provider for the online lodging system as follows:
| Name of data controller | PPB | Description of data processing task |
| NetHotelBooking Kft. | 8200 Veszprém, Boksa tér 1/A Hungary | Storage of e-mail marketing database. |
By accepting this data protection statement, the data subject gives his express consent that the data controller shall engage further data controllers in order to render its services more convenient and customized as follows:
| Name of additional data controller | PPB | Description of data processing task |
| ActiveCampaign, LLC | 1 North Dearborn St 5th Floor Chicago, IL 60602 | Performance of marketing automation tasks upon using ActiveCampaign. The data protection statement of the service provider can be found on this link: https://courses.activecampaign.com/pages/privacy |
Possible negative consequences of not providing personal data: The data subject will not be able to receive the company’s newsletter.
The rights of the data subject: the data subject (the person whose data our company processes)
You are able to unsubscribe from our company’s newsletter by sending an e-mail to this e-mail address info@shirazhotel.hu or by clicking the icon “Unsubscribe” found in this newsletter. In this case we will immediately delete your e-mail address from our database.
Other information related to data processing: our company takes every technological and organisational measure to avoid an eventual personal data breach (for instance, if the files containing personal data are damaged, disappear, or become accessible to unauthorised persons). Should a personal data breach nevertheless take place, we shall keep records in order to supervise the necessary measures as well as to inform the affected data subjects. This record shall contain the scope of affected personal data, the circle and number of data subjects affected by the privacy incident, the date, circumstances, effects of the personal data breach as well as the measures taken to deal with it, as well as other data as defined by the laws regulating data processing.
Our company concluded a data processing agreement for the scope of data processing tasks, in which the NetHotelBooking Kft. undertakes that in the event of the engagement of another data controller it shall apply on a mandatory basis the same data protection and data processing guarantees included in data processing contract with us, thus we ensure the lawful management of personal data in case of data controllers.
5. PROCESSING OF PERSONAL DATA RELATED TO CUSTOMER SATISFACTION SURVEYS
As a hotel it is our goal to provide high-quality services to our guests, therefore we continually request feedback from our guests about their experiences while staying at our hotel.
Personal data processor: Shiraz Hotel Kft., 1122 Budapest, Ráth György utca 24. Fsz. 1 A.
Purpose of data processing: requesting feedback from our guests in order to further develop and improve our services.
Legal basis of data processing: consent of the data subject – Article 6 Section 1 Point a of GDPR. Scope of processed personal data: name, gender, e-mail address
Duration of data processing: two years after the last day of stay as stated in the reservation.
Engagement of data controller: our company uses the services of an information service provider for the online lodging system as follows:
| Name of data controller | PPB | Description of data processing task |
| NetHotelBooking Kft. | 8200 Veszprém, Boksa tér 1/A Hungary | Operating the customer satisfaction module |
By accepting this data protection statement, the data subject gives his express consent that the data controller shall engage further data controllers in order to render its services more convenient and customized as follows:
| Name of additional data controller | PPB | Description of data processing task |
| Amazon Web Services** | 410 Terry Avenue North, Seattle, WA 98109, United States | Performance of tasks related to server hosting. The data protection statement of the service provider can be found on this link: https://aws.amazon.com/privacy/ |
| Wildbit, LLC* | 225 Chestnut St, Philadelphia, PA 19106, USA | The owner of the software which is integrated into the booking system. This software is responsible for sending e-mail confirmations and notifications in the event of booking, requesting and providing proposals, customer satisfaction surveys, pre-arrival information and gift voucher selling. The data protection statement of the service provider can be found on this link: https://wildbit.com/eu-privacy |
*The Processor is based in the United States, so any transfer of data to the Processor is considered a transfer to a third country. However, Wildbit, LLC has incorporated the general data protection clauses proposed and approved by the European Commission into the data protection addendum to its general terms and conditions. In this regard, even without the permission of a supervisory authority, the transfer of data to Wildbit, LLC is considered to be adequately guaranteed and therefore not legally prevented.
**Amazon Web Services has voluntarily joined the EU-U.S. Data Privacy Framework program, ensuring that data transfers comply with the GDPR requirements.
Possible negative consequences of not providing personal data: The affected data subject will not receive our company’s customer satisfaction survey.
The rights of the data subject: the data subject (the person whose data our company processes)
Other information related to data processing: our company takes every technological and organisational measure to avoid an eventual personal data breach (for instance, if the files containing personal data are damaged, disappear, or become accessible to unauthorised persons). Should a personal data breach nevertheless take place, we shall keep records in order to supervise the necessary measures as well as to inform the affected data subjects. This record shall contain the scope of affected personal data, the circle and number of data subjects affected by the privacy incident, the date, circumstances, effects of the personal data breach as well as the measures taken to deal with it, as well as other data as defined by the laws regulating data processing.
Our company concluded a data processing agreement for the scope of data processing tasks, in which the NetHotelBooking Kft. undertakes that in the event of the engagement of another data controller it shall apply on a mandatory basis the same data protection and data processing guarantees included in data processing contract with us, thus we ensure the lawful management of personal data in case of data controllers.
6. PROCESSING OF PERSONAL DATA RELATED TO GIFT VOUCHER PURCHASE
The hotel sells gift vouchers, and stores the details of the customer and the gift’s receiver during the sale.
The data controller of the personal data: Shiraz Hotel Kft., 1122 Budapest, Ráth György utca 24. Fsz. 1 A.
The purpose of data management: maintaining contact with the customer, sending the gift voucher to the customer.
Indication of a legitimate interest: purchase of a gift voucher
The scope of the managed personal data: name, e-mail address, phone number, home address, name of the gift’s recipient, gift voucher’s number,
The duration of data management: two years from the last date of validity of the gift voucher.
Use of data processor: Stored on the hotel’s own server.
| Data processor’s name | Registered office | Description of the data processor’s tasks |
| Átme-net Kft. | 3300 Eger Baktai u. 8. | Maintaining our own server |
The possible consequences of the failure to provide data: The data subject is unable buy the gift voucher.
The rights of the data subject: the data subject (the person whose personal information is managed by our company)
1. may request access to the personal data relating to him;
2. may request their correction;
3. may request their erasure;
4. may request the restriction of the handling of the personal data under the conditions of Article 18 of the GDPR (i.e. that our company does not delete the data or destroy them until a court or authority may request them, but for a maximum of thirty days, and not to handle the data for other purposes);
5. may object to the handling of personal data;
6. may exercise his right to the portability of data. Under the latter right, the data subject is entitled to receive the personal data relating to him in word or excel format, and he is entitled to request our company to forward this information to another data controller.
Other information related to data management: our company takes all the necessary technical and organizational measures to avoid any possible privacy incidents (e.g. damage or loss of files containing personal data, their becoming available to unauthorized persons). For any potential incident, we keep a record to check the necessary measures and inform the data subject, which includes the scope of the personal data of the data subject, the circle and number of the persons affected by the data protection incident, the date, the circumstances, and the effects of the data protection incident, and the measures taken to remedy it, and other data specified in the law that orders data management.
Our company provides the opportunity to purchase gift vouchers electronically. The gift voucher is provided by our company via an automated system on our website.
Personal data processor: Shiraz Hotel Kft., 1122 Budapest, Ráth György utca 24. Fsz. 1 A.
Purpose of data processing: gift voucher purchase and delivery
Legal basis of data processing: the prior consent of the person who purchases the gift voucher: by accepting this data protection statement, the data subject consents to the data processing under this clause.
Scope of personal data handled: title; surname and first name; address (country, zip code, city, street, house number); telephone number; email address (both purchaser and beneficiary), ; in case of a company name of company and PBB; bank card number; SZÉP card number (identifier, name displayed on card).
Duration of data processing: two years after the two years after the expiration date of the gift voucher.
Engagement of data controller: our company uses the services of an information service provider for the online gift voucher system as follows:
| Name of data controller | PPB | Description of data processing task |
| NetHotelBooking Kft. | 8200 Veszprém, Boksa tér 1/A Hungary | Operating the gift voucher selling module |
By accepting this data protection statement, the data subject gives his express consent that the data controller shall engage further data controllers in order to render its services more convenient and customized as follows:
| Name of additional data controller | PPB | Description of data processing task |
| Amazon Web Services** | 410 Terry Avenue North, Seattle, WA 98109, United States | Performance of tasks related to server hosting. The data protection statement of the service provider can be found on this link: https://aws.amazon.com/privacy/ |
| Nevogate Payment Services Kft. | 1066 Budapest, Nyugati tér 1-2 Hungary | Providing data communications for payment transactions between the vendor’s and the payment provider’s systems, ensuring traceability for the transaction partners. The data protection statement of the service provider can be found on this link: https://www.nevogate.com/adatvedelem |
|
SimplePay Zrt. |
1138 Budapest, Váci út 135-139. B. ép. 5. em. |
Providing data communications for payment transactions between the vendor’s and the payment provider’s systems, providing customer service for users, confirming transactions and providing fraud-monitoring to protect the interests of the users. The data protection statement of the service provider can be found on this link: https://simplepay.hu/adatkezelesi-tajekoztatok/ |
| Barion Payment Zrt. | 1117 Budapest, Infopark sétány 1. I. épület Hungary | Providing data communications for payment transactions between the vendor’s and the payment provider’s systems, providing customer service for users, confirming transactions and providing fraud-monitoring to protect the interests of the users. The data protection statement of the service provider can be found on this link: https://www.barion.com/hu/adatvedelmi-tajekoztato/ |
| Wildbit, LLC* | 225 Chestnut St, Philadelphia, PA 19106, USA | The owner of the software which is integrated into the booking system. This software is responsible for sending e-mail confirmations and notifications in the event of booking, requesting and providing proposals, customer satisfaction surveys, pre-arrival information and gift voucher selling. The data protection statement of the service provider can be found on this link: https://wildbit.com/eu-privacy |
| KBOSS.hu Kft. | 1031 Budapest, Záhony utca 7. | Automatic online invoicing with Automatic online invoicing with számlázz.hu. The data protection statement of the service provider can be found on this link: https://www.szamlazz.hu/adatvedelem/ |
| Stripe Inc. | 354 Oyster Point Boulevard, South San Francisco, California, 94080, USA | Providing payment infrastructure, storage of bank card data, charging bank cards, assuring online payment solution. Providing data communications for payment transactions between the vendor’s and the payment provider’s systems, providing customer service for users, confirming transactions and providing fraud-monitoring to protect the interests of the users. The data protection statement of the service provider can be found on this link: https://stripe.com/en-hu/privacy |
| InstaCash Kft. | 1015 Budapest, Szabó Ilonka utca 22. fszt. 2. | Providing data communications for installment payment transactions between the vendor’s and the payment provider’s systems, providing customer service for users, confirming transactions and providing fraud-monitoring to protect the interests of the users. The data protection statement of the service provider can be found on this link: https://instacash.hu/media/2024/02/IC-Adatkezelesi-tajekoztato_BNPL_HU_01-03-2023.pdf |
*The Processor is based in the United States, so any transfer of data to the Processor is considered a transfer to a third country. However, Wildbit, LLC has incorporated the general data protection clauses proposed and approved by the European Commission into the data protection addendum to its general terms and conditions. In this regard, even without the permission of a supervisory authority, the transfer of data to Wildbit, LLC is considered to be adequately guaranteed and therefore not legally prevented.
**Amazon Web Services has voluntarily joined the EU-U.S. Data Privacy Framework program, ensuring that data transfers comply with the GDPR requirements.
Possible negative consequences of not providing personal data: Providing data is voluntary. It is important to note that filling in the fields marked with * is mandatory, and in case of non-completion, the affected data subject will not be able to purchase gift vouchers. Leaving the remaining fields blank does not have such a consequence.
The rights of the data subject: the data subject (the person whose data our company processes)
Other information related to data processing: our company takes every technological and organisational measure to avoid an eventual personal data breach (for instance, if the files containing personal data are damaged, disappear, or become accessible to unauthorised persons). Should a personal data breach nevertheless take place, we shall keep records in order to supervise the necessary measures as well as to inform the affected data subjects. This record shall contain the scope of affected personal data, the circle and number of data subjects affected by the privacy incident, the date, circumstances, effects of the personal data breach as well as the measures taken to deal with it, as well as other data as defined by the laws regulating data processing.
Our company concluded a data processing agreement for the scope of data processing tasks, in which the NetHotelBooking Kft. undertakes that in the event of the engagement of another data controller it shall apply on a mandatory basis the same data protection and data processing guarantees included in data processing contract with us, thus we ensure the lawful management of personal data in case of data controllers.
7. DATA PROCESSING IN CONNECTION WITH REGULAR GUEST DATABASE
For its regular guests, the Data Controller offers reduced room rates, provides discounts on room prices for reservations, if the regular guest creates a user account and makes room reservations by logging into such account. This procedure involves the processing of personal data, on the following conditions:
Data controller with respect to personal data: Shiraz Hotel Kft., 1122 Budapest, Ráth György utca 24. Fsz. 1 A.
Purpose of processing personal data: providing discounts for returning and regular guests, providing other convenience services.
Legal basis of data processing: consent of the data subject – Article 6 paragraph (1) point a) of the GDPR
Scope of personal data processed (provision of information marked with an asterisk is mandatory):
| Personal data processed | Reason for data processing |
| email address* | required for logging into the user account, and the Data Controller sends the confirmation code to the e-mail address. Subject to a separate consent, the Data Controller sends promotional offers to the data subject by e-mail |
| password* | required for logging into the user account |
| title, surname, first name* | required for identifying and contacting the data subject |
| personal identification document issuer country | required to simplify the check-in process to the accommodation |
| language | required to facilitate communication with the guest |
| date of birth | required to simplify the check-in process to the accommodation |
| address (country, postal code, town, street and number)* | required for the preparation of the invoice to be issued to the guest |
| phone number | required for contacting the guest |
| name, nickname, date of birth, gender of travel companion | required to simplify the check-in process to the accommodation |
Duration of data processing: our company processes the personal data until withdrawal of consent.
Involvement of data processor: our company uses the services of an IT service provider in the operation of the regular guest module, as follows.
Additional information: the accommodation processes the data subject’s personal data for the purposes of providing convenience services to the data subject, such as, in particular: to facilitate checking-in to the accommodation in the possession of the processed personal data or to provide personalized offers to the data subject. The latter may involve so-called profiling, which applies the logic that, by analysing the booking habits of the guest concerned, the Data Controller can send personalized offers which are likely to be of interest to the guest concerned, with a view to offering discounts. Profiling has no further consequences to the guest concerned, does not entail any contractual obligation, but provides only the possibility of booking accommodation at a discount.
8. COOKIE PROCESSING
In order to provide tailor-made service, the data controller places on the computer of the user a small data pack, so called cookie, that is read back upon a later visit. If the browser sends back a previously saved cookie, the service provider handling the cookie has the possibility to connect the user’s current visit to the previous ones, but only for its own content.
9. SERVER LOG FILES
When visiting the webpage nethotelbooking.net, the server automatically stores information on the user’s activities in log files.
The purpose of data processing: when a webpage is visited, the service provider supervises the operation of its services, and in order to prevent abuse it records the visitors’ data.
Legal basis of data processing: Article 6 Section 1 Point f) of GDPR. Our company has a legitimate interest in the webpage’s safe operation.
Type of processed personal data: identification number, date, time, the address of the visited page.
Duration of data processing: maximum 90 days
| Name of data controller | PPB | Description of data processing task |
| NetHotelBooking Kft. | 8200 Veszprém, Boksa tér 1/A Hungary | Recording of visitors’ data and information necessary for server operation |
Further information: our company does not connect the data that emerges in the course of the protocol analysis with other data, it makes no effort to identify the user. The address of the visited pages, as well as the data relating to date and time are insufficient to identify the affected data subject, however, they may be sufficient in conjunction with other data (for instance, data provided in the course of registration) to reach conclusions about to the user.
Data processing of external service providers in relation to protocols:
The portal’s html code contains links independent from our company that are received from external servers and refer to external servers. The server of the external service provider is connected directly to the user’s computer. We would like to call our visitors’ attention to the fact that the service providers of these links are able to collect user data (for instance, IP address, browser, operating system data, movement of the mouse pointer, address of the website visited and date of visit) during direct connection to their servers on account of the direct communication with the user’s browser. An IP address is a series of numbers with which the computers and mobile devices of users can be identified unambiguously.
Through IP addresses it is even possible to identify the geographical location of the visitor using a given computer. The address of the visited pages, as well as the data relating to date and time are insufficient to identify the affected data subject, however, they may be sufficient in conjunction with other data (for instance, data provided in the course of registration) to reach conclusions about to the user.
10. HANDLING THE DATA ON THE REGISTRATION FORM
The hotel asks the guests to fill in a registration form when they arrive, which contains the guest’s personal information. The information on the registration form is stored on the hotel’s software and on paper.
The data controller of the personal data: Shiraz Hotel Kft., 1122 Budapest, Ráth György utca 24. Fsz. 1 A.
The purpose of data management: maintaining contact with the guest during his stay, maintaining contact after departure, sending birthday greetings, distinguishing the guests, helping the declaration of the tourist tax, managing the regular guest (loyalty) program, ordered obligation.
Legal basis for data management: the consent of the data subject – Article 6 (1) point a) GDPR.
The scope of the managed personal data: name, e-mail address, phone number, date of birth, address, car registration number, room number, date of arrival and departure, details of accompanying guests, subscription to newsletter, payment method.
The duration of data management: The guest declares on the registration form that he consents to the storage of personal data and the hotel stores such data for 8 years after the approval.
Use of data processor: Fidelio V8 hotel software
|
Data processor’s name |
Registered office |
Description of the data processor’s tasks |
|
HRS Magyarország | Hospitality and Retail Systems |
1138 Budapest, Madarász Viktor u. 47-49. |
Storing the guests’ details |
The possible consequences of the failure to provide data: The data subject cannot take his hotel room.
The rights of the data subject: the data subject (the person whose personal information is managed by our company)
1. may request access to the personal data relating to him;
2. may request their correction;
3. may request their erasure;
4. may request the restriction of the handling of the personal data under the conditions of Article 18 of the GDPR (i.e. that our company does not delete the data or destroy them until a court or authority may request them, but for a maximum of thirty days, and not to handle the data for other purposes);
5. may object to the handling of personal data;
6. may exercise his right to the portability of data. Under the latter right, the data subject is entitled to receive the personal data relating to him in word or excel format, and he is entitled to request our company to forward this information to another data controller.
Other information related to data management: our company takes all the necessary technical and organizational measures to avoid any possible privacy incidents (e.g. damage or loss of files containing personal data, their becoming available to unauthorized persons). For any potential incident, we keep a record to check the necessary measures and inform the data subject, which includes the scope of the personal data of the data subject, the circle and number of the persons affected by the data protection incident, the date, the circumstances, and the effects of the data protection incident, and the measures taken to remedy it, and other data specified in the law that orders data management.
Our company has concluded a data processing contract for data processing tasks, in which HRS Magyarország Kft. undertakes to obligatorily provide the data protection and data management guarantees required by the data processing contract even if further data processor is employed, therefore, we guarantee the lawful management of the personal data even by the data processor.
11. MANAGEMENT OF DATA CONNECTED TO ROOM RESERVATION BY PHONE
The hotel accepts room reservations by phone, but asks the guests to send a written order, as well. The hotel records the rooms booked through the phone in the hotel’s software, along with the booking person’s details.
The data controller of the personal data: Shiraz Hotel Kft., 1122 Budapest, Ráth György utca 24. Fsz. 1 A.
The purpose of data management: recording the room booking
Legal basis for data management: the consent of the data subject – Article 6 (1) point a) GDPR.
The scope of the managed personal data: name, phone number, email address.
The duration of data management: The hotel stores such data for 8 years after the approval.
Use of data processor:
|
Data processor’s name |
Registered office |
Description of the data processor’s tasks |
|
HRS Magyarország | Hospitality and Retail Systems |
1138 Budapest, Madarász Viktor u. 47-49. |
Storing the guests’ details |
The possible consequences of the failure to provide data: The room is not booked.
The rights of the data subject: the data subject (the person whose personal information is managed by our company)
1. may request access to the personal data relating to him;
2. may request their correction;
3. may request their erasure;
4. may request the restriction of the handling of the personal data under the conditions of Article 18 of the GDPR (i.e. that our company does not delete the data or destroy them until a court or authority may request them, but for a maximum of thirty days, and not to handle the data for other purposes);
5. may object to the handling of personal data;
6. may exercise his right to the portability of data. Under the latter right, the data subject is entitled to receive the personal data relating to him in word or excel format, and he is entitled to request our company to forward this information to another data controller.
Other information related to data management: our company takes all the necessary technical and organizational measures to avoid any possible privacy incidents (e.g. damage or loss of files containing personal data, their becoming available to unauthorized persons). For any potential incident, we keep a record to check the necessary measures and inform the data subject, which includes the scope of the personal data of the data subject, the circle and number of the persons affected by the data protection incident, the date, the circumstances, and the effects of the data protection incident, and the measures taken to remedy it, and other data specified in the law that orders data management.
Our company has concluded a data processing contract for data processing tasks, in which HRS Magyarország Kft. . undertakes to obligatorily provide the data protection and data management guarantees required by the data processing contract even if further data processor is employed, therefore, we guarantee the lawful management of the personal data even by the data processor.
12. MANAGEMENT OF DATA CONNECTED TO FOUND OBJECTS
The hotel keeps a register of the items found in the room and in the community spaces after the guests depart.
The data controller of the personal data: Shiraz Hotel Kft., 1122 Budapest, Ráth György utca 24. Fsz. 1 A.
The purpose of data management: recording the found objects, notifying the guests, returning the found objects
Legal basis for data management: the consent of the data subject – Article 6 (1) point a) GDPR.
The scope of the managed personal data: room number, name, description of the found object, date
The duration of data management: the found objects are stored by the hotel for 6 months, so the data connected to them are stored for 6 months from the date they are added to the list. If the object found is received by the owner, the data will be deleted.
Use of data processor: Stored on the hotel’s own server.
|
Data processor’s name |
Registered office |
Description of the data processor’s tasks |
|
Átme-net Kft. |
3300 Eger Baktai u. 8. |
Maintaining our own server |
The rights of the data subject: the data subject (the person whose personal information is managed by our company)
1. may request access to the personal data relating to him;
2. may request their correction;
3. may request their erasure;
4. may request the restriction of the handling of the personal data under the conditions of Article 18 of the GDPR (i.e. that our company does not delete the data or destroy them until a court or authority may request them, but for a maximum of thirty days, and not to handle the data for other purposes);
5. may object to the handling of personal data;
6. may exercise his right to the portability of data. Under the latter right, the data subject is entitled to receive the personal data relating to him in word or excel format, and he is entitled to request our company to forward this information to another data controller.
Other information related to data management: our company takes all the necessary technical and organizational measures to avoid any possible privacy incidents (e.g. damage or loss of files containing personal data, their becoming available to unauthorized persons). For any potential incident, we keep a record to check the necessary measures and inform the data subject, which includes the scope of the personal data of the data subject, the circle and number of the persons affected by the data protection incident, the date, the circumstances, and the effects of the data protection incident, and the measures taken to remedy it, and other data specified in the law that orders data management.
13. MANAGEMENT OF DATA CONNECTED TO CORRESPONDENCE
Keeps in touch with the guests and the inquiring persons through the email addresses used by the data controller.
The data controller of the personal data: Shiraz Hotel Kft., 1122 Budapest, Ráth György utca 24. Fsz. 1 A.
The purpose of data management: maintaining contact with the guests
Legal basis for data management: the consent of the data subject – Article 6 (1) point a) GDPR.
The purpose of data management: maintaining contact with the guests
The duration of data management: 5 years
Use of data processor:
|
Data processor’s name |
Registered office |
Description of the data processor’s tasks |
|
Creative Management Kft. |
8200 Veszprém, Boksa Square 1/A |
Providing online storage space |
|
Átme-net Kft. |
3300 Eger Baktai u. 8. |
Maintenance of the email software on the workstations |
The rights of the data subject: the data subject (the person whose personal information is managed by our company)
1. may request access to the personal data relating to him;
2. may request their correction;
3. may request their erasure;
4. may request the restriction of the handling of the personal data under the conditions of Article 18 of the GDPR (i.e. that our company does not delete the data or destroy them until a court or authority may request them, but for a maximum of thirty days, and not to handle the data for other purposes);
5. may object to the handling of personal data;
6. may exercise his right to the portability of data. Under the latter right, the data subject is entitled to receive the personal data relating to him in word or excel format, and he is entitled to request our company to forward this information to another data controller.
Other information related to data management: our company takes all the necessary technical and organizational measures to avoid any possible privacy incidents (e.g. damage or loss of files containing personal data, their becoming available to unauthorized persons). For any potential incident, we keep a record to check the necessary measures and inform the data subject, which includes the scope of the personal data of the data subject, the circle and number of the persons affected by the data protection incident, the date, the circumstances, and the effects of the data protection incident, and the measures taken to remedy it, and other data specified in the law that orders data management.
Our company has concluded a data processing contract for data processing tasks, in which Átme-net Kft. + Creative Management Kft. . undertakes to obligatorily provide the data protection and data management guarantees required by the data processing contract even if further data processor is employed, therefore, we guarantee the lawful management of the personal data even by the data processor.
14. DATA MANAGEMENT DURING PAYMENT:
Our guests can pay in cash, by gift vouchers, SZÉP cards, Erzsébet vouchers or by bank cards.
The data controller of the personal data: Shiraz Hotel Kft., 1122 Budapest, Ráth György utca 24. Fsz. 1 A.
The purpose of data management: issuing an invoice for the used service
The legal basis for data handling: voluntary consent of the data subject
The scope of the managed personal data: name on the invoice, address, list of services, total amount, method of payment, invoice date, invoice’s payment date
The duration of data management: 8 years
Use of data processor:
|
Data processor’s name |
Registered office |
Description of the data processor’s tasks |
|
K@H Bank Zrt. |
1055 Budapest, Lechner Ödön fasor 9. |
In case of payment by bank card, identification number, amount, date |
Other information related to data management: our company takes all the necessary technical and organizational measures to avoid any possible privacy incidents (e.g. damage or loss of files containing personal data, their becoming available to unauthorized persons). For any potential incident, we keep a record to check the necessary measures and inform the data subject, which includes the scope of the personal data of the data subject, the circle and number of the persons affected by the data protection incident, the date, the circumstances, and the effects of the data protection incident, and the measures taken to remedy it, and other data specified in the law that orders data management.
15. ELECTRONIC SURVEILLANCE SYSTEM
Surveillance camera recordings are made in the area of the Shiraz Hotel.
In the hotel’s park, car park, indoor communal areas and commercial spaces, camera recordings are made. Only the properly authorized people are allowed to view and have access to the camera recordings.
The data controller of the personal data: Shiraz Hotel Kft., 1122 Budapest, Ráth György utca 24. Fsz. 1 A.
The purpose of data management: promoting the safety of the guests and staff, to preserve the values, to prove violations, and to clarify any disputed issues.
The legal basis for data handling: voluntary consent of the data subject by entering the area.
The duration of data management: 30 days at the reception and in the business areas, and 3 days outside the above areas.
|
Data processor’s name |
Registered office |
Description of the data processor’s tasks |
|
Átme-net Kft. |
3300 Eger Baktai u. 8. |
Maintaining the camera system |
Other information related to data management: our company takes all the necessary technical and organizational measures to avoid any possible privacy incidents (e.g. damage or loss of files containing personal data, their becoming available to unauthorized persons). For any potential incident, we keep a record to check the necessary measures and inform the data subject, which includes the scope of the personal data of the data subject, the circle and number of the persons affected by the data protection incident, the date, the circumstances, and the effects of the data protection incident, and the measures taken to remedy it, and other data specified in the law that orders data management.
Our company has concluded a data processing contract for data processing tasks, in which Átme-net Kft. undertakes to obligatorily provide the data protection and data management guarantees required by the data processing contract even if further data processor is employed, therefore, we guarantee the lawful management of the personal data even by the data processor.
16. MANAGEMENT OF DATA CONNECTED TO GROUP BOOKINGS AND CORPORATE EVENTS
Shiraz Hotel also provides group booking and event organization, and stores the personal data connected to them.
The data controller of the personal data: Shiraz Hotel Kft., 1122 Budapest, Ráth György utca 24. Fsz. 1 A.
The purpose of data management: booking for groups and/or organization of events, identifying the guests, holding events
The legal basis for data handling: the prior consent of the person who makes the group booking and/ or reserves the event
The scope of the managed personal data: For companies: company name, tax number and registered office, name, phone number, email address of the booking person, name and date of birth of the participants, registration numbers of their cars, the list of the services in the confirmation and in the offer
The duration of data management: 5 years of the last day of the stay as booked
Use of data processor: Stored on the hotel’s own server.
|
Data processor’s name |
Registered office |
Description of the data processor’s tasks |
|
Átme-net Kft. |
3300 Eger Baktai u. 8. |
Maintaining our own server |
The possible consequences of the failure to provide data: no contract is concluded for the event and/or group booking.
The rights of the data subject: the data subject (the person whose personal information is managed by our company)
1. may request access to the personal data relating to him;
2. may request their correction;
3. may request their erasure;
4. may request the restriction of the handling of the personal data under the conditions of Article 18 of the GDPR (i.e. that our company does not delete the data or destroy them until a court or authority may request them, but for a maximum of thirty days, and not to handle the data for other purposes);
5. may object to the handling of personal data;
6. may exercise his right to the portability of data. Under the latter right, the data subject is entitled to receive the personal data relating to him in word or excel format, and he is entitled to request our company to forward this information to another data controller.
Other information related to data management: our company takes all the necessary technical and organizational measures to avoid any possible privacy incidents (e.g. damage or loss of files containing personal data, their becoming available to unauthorized persons). For any potential incident, we keep a record to check the necessary measures and inform the data subject, which includes the scope of the personal data of the data subject, the circle and number of the persons affected by the data protection incident, the date, the circumstances, and the effects of the data protection incident, and the measures taken to remedy it, and other data specified in the law that orders data management.
17. MANAGEMENT OF DATA CONNECTED TO PICTURES AND VIDEOS
Shiraz Hotel takes photos and makes videos for marketing purposes.
The data controller of the personal data: Shiraz Hotel Kft.,1122 Budapest, Ráth György utca 24. Fsz. 1 A.
The purpose of data management: assisting in the sales of the hotel, increasing the potential guests’ desire to stay in the hotel.
The legal basis for data handling: the prior consent of the data subject.
The scope of the managed personal data: photos, videos and sound recordings made of the guests, staff and models.
The duration of data management: 100 years
Use of data processor: Stored on the hotel’s own server.
|
Data processor’s name |
Registered office |
Description of the data processor’s tasks |
|
Átme-net Kft. |
3300 Eger Baktai u. 8. |
Maintaining our own server |
The possible consequences of the failure to provide data: the recordings cannot be made.
The rights of the data subject: the data subject (the person whose personal information is managed by our company)
1. may request access to the personal data relating to him;
2. may request their correction;
3. may request their erasure;
4. may request the restriction of the handling of the personal data under the conditions of Article 18 of the GDPR (i.e. that our company does not delete the data or destroy them until a court or authority may request them, but for a maximum of thirty days, and not to handle the data for other purposes);
5. may object to the handling of personal data;
6. may exercise his right to the portability of data. Under the latter right, the data subject is entitled to receive the personal data relating to him in word or excel format, and he is entitled to request our company to forward this information to another data controller.
Other information related to data management: our company takes all the necessary technical and organizational measures to avoid any possible privacy incidents (e.g. damage or loss of files containing personal data, their becoming available to unauthorized persons). For any potential incident, we keep a record to check the necessary measures and inform the data subject, which includes the scope of the personal data of the data subject, the circle and number of the persons affected by the data protection incident, the date, the circumstances, and the effects of the data protection incident, and the measures taken to remedy it, and other data specified in the law that orders data management.
18. OTHER DATA PROCESSING
We provide information in relation to data processing activities not included in this data protection statement when we request such data. We inform our customers that certain authorities, bodies with a public service missions and courts may contact our company for the purpose of disclosing private data. If the body affected designated the precise purpose and scope of data to be turned over, our company provides personal data only to the extent and to the degree which is indispensable for the purpose of the request and if the fulfilment of the request is prescribed by law.
19. MODE OF PERSONAL DATA STORAGE, SECURITY OF DATA PROCESSING
Our company’s computer systems and other data storage devices can be found in the seat of the company and on the servers rented by the data processor. Our company selects and operates the information technology devices used to process personal data in the course of providing its services that
a) the data processed are available to the authorised persons (availability);
b) its authenticity and authentication are guaranteed (the authenticity of data processing);
c) its integrity can be verified (data integrity);
d) the data are protected against unauthorised access (data confidentiality).
We take special care of data security, furthermore we also take the technical and organisational measures and develop the procedural rules necessary to enforce the GDPR guarantees. We protect the data with appropriate measures against, in particular, unauthorised access, alteration, transmission, public disclosure, erasure or destruction, as well as unavailability due to accidental destruction, damage, and furthermore unavailability on grounds of alteration in the technologies used to access the data.
The computer system and network of our company and its partners are protected against computer fraud, computer viruses, theft via computers, and computer attacks whose purpose is service denial. The operator ensures a high level of safety through taking security measures both on the level of server and application. The daily backup of the data has been resolved. Our company takes every possible measure in order to avoid a personal data breach, and in the event that such personal data breach should take place we shall immediately take action – in accordance with our incident management rules – in order to minimize risk and to control damage.
20. RIGHTS OF DATA SUBJECTS, REMEDIES
The data subject has the right to request information about the processing of his/her personal data, and request the rectification of his/her personal data, or – with exception of the mandatory data processing – request the erasure of his/her data or withdraw consent, or make use of his/her right to data portability and contest in the manner specified at the time of data collection, or through the contact details of the data processor mentioned above.
Upon request of the data subject we shall provide the data in electronic format without delay, but latest within 30 days, in accordance with our relevant rules. We shall fulfil the requests of the data subjects with regards to the rights below free of charge.
Right of information:
Our company shall take appropriate measures to provide any information referred to in Articles 13 and 14 of the GDPR and any communication under Articles 15 to 22 and 34 of the GDPR relating to processing to the data subjects in a concise, transparent, intelligible and easily accessible form, using clear and plain language while remaining precise at the same time.
The right to information can be exercised in written form, through the contact details provided under Point 1. Upon request of the data subject – following the verification of his/her identity – information may be provided in oral form. We would like to inform our customers that if our company’s employees have doubts with regards to the identity of the data subject, we may request further information necessary to confirm the personal identity of the data subject.
The data subject’s right of access to data:
The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed. Should his/her personal data be processed, the data subject shall have the right to get access to the personal data, and the following information included in the list below:
In addition to the above, in the event that personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards relating to the transfer.
The right to rectification:
According to this right anyone shall have the right to obtain from our company the rectification of inaccurate personal data or the completion of incomplete data concerning him or her.
The right of erasure:
The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay:
The erasure of personal data cannot be initiated, if the data processing is necessary for any of the following purposes:
Right to restrict data processing:
We shall restrict data processing on the basis of Article 18 of GDPR, that is, where one of the following applies:
Where processing has been restricted, the personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State. The data subject shall be informed by the controller before the restriction of processing is lifted.
Right to data portability:
The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and to transmit those data to another controller. Our company is able to fulfil such a request by the data subject in Word or Excel format.
The right to object:
Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
Automated individual decision-making, including profiling
The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. The above right cannot be applied, if the data processing
The right to withdraw consent:
The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
Procedural rules:
The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay.
Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.
If the controller does not take action on the request of the data subject, the controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.
Damages and compensation:
Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered. A processor shall be liable for the damage caused by processing only where it has not complied with obligations of this Regulation specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller. Where more than one controller or processor, or both a controller and a processor, are involved in the same processing and where they are, responsible for any damage caused by processing, each controller or processor shall be held liable for the entire damage.
A controller or processor shall be exempt from liability if it proves that it is not in any way responsible for the event giving rise to the damage.
The right to apply to Court and the data protection authority procedure:
The data subject may apply to the court in the event that his/her rights have been infringed upon. The court gives the case priority.
Complaints are to be lodged with the Nemzeti Adatvédelmi és Információszabadság Hatóság (National Data Protection and Freedom of Information Authority).
The authority’s address: Hungary 1055 Budapest, Falk Miksa u. 9-11., postal address: 1374 Budapest, Pf.: 603., Telephone: +36 1 391 1400, E-mail: ugyfelszolgalat@naih.hu
21. DATA PROCESSING IN CONNECTION WITH REGULAR GUEST DATABASE
For its regular guests, the Data Controller offers reduced room rates, provides discounts on room prices for reservations, if the regular guest creates a user account and makes room reservations by logging into such account. This procedure involves the processing of personal data, on the following conditions:
Data controller with respect to personal data: {company name, registered seat}
Purpose of processing personal data: providing discounts for returning and regular guests, providing other convenience services.
Legal basis of data processing: consent of the data subject – Article 6 paragraph (1) point a) of the GDPR
Scope of personal data processed (provision of information marked with an asterisk is mandatory):
| Personal data processed | Reason for data processing |
| email address* | required for logging into the user account, and the Data Controller sends the confirmation code to the e-mail address. Subject to a separate consent, the Data Controller sends promotional offers to the data subject by e-mail |
| password* | required for logging into the user account |
| title, surname, first name* | required for identifying and contacting the data subject |
| personal identification document issuer country | required to simplify the check-in process to the accommodation |
| language | required to facilitate communication with the guest |
| date of birth | required to simplify the check-in process to the accommodation |
| address (country, postal code, town, street and number)* | required for the preparation of the invoice to be issued to the guest |
| phone number | required for contacting the guest |
| name, nickname, date of birth, gender of travel companion | required to simplify the check-in process to the accommodation |
Duration of data processing: our company processes the personal data until withdrawal of consent.
Involvement of data processor: our company uses the services of an IT service provider in the operation of the regular guest module, as follows.
Additional information: the accommodation processes the data subject’s personal data for the purposes of providing convenience services to the data subject, such as, in particular: to facilitate checking-in to the accommodation in the possession of the processed personal data or to provide personalized offers to the data subject. The latter may involve so-called profiling, which applies the logic that, by analysing the booking habits of the guest concerned, the Data Controller can send personalized offers which are likely to be of interest to the guest concerned, with a view to offering discounts. Profiling has no further consequences to the guest concerned, does not entail any contractual obligation, but provides only the possibility of booking accommodation at a discount.
Address: H-3394 Egerszalók, Széchenyi út 31.
E-mail: info@shirazhotel.hu
Phone: +36 36 574 500
