Hunguest Zrt. - DATA PROCESSING INFORMATION NOTE

1. Identification of the Data Controller

The website available at https://www.hunguesthotels.hu/ (hereinafter referred to as the "Website" or "Webpage") is operated by Hunguest Szálláshelyszolgáltató Zártkörűen Működő Részvénytársaság.

Short name: Hunguest Zrt.
Company registration number: 01-10-142591 – Company Registry Court of the Budapest Surrounding Regional Court
Tax number: 32431081-2-44
Registered office: 38 Váci Street, H-1056 Budapest, Hungary
Postal address: P.O. Box 3, H-1426 Budapest, Hungary
Represented by: dr. Ádám Détári-Szabó, Member of the Board of Directors and Chief Executive Officer
Website: https://www.hunguesthotels.hu/
E-mail: info@hunguesthotels.hu

(hereinafter referred to as the "Data Controller")

Contact details of the Data Protection Officer

Name: Kertész és Társai Law Firm
E-mail: adatvedelem@hunguesthotels.hu

Table of Contents
Identification of the Data Controller 1
Applicable Legislation and Scope of this Privacy Notice 3
Definitions 3
Processing of Personal Data Related to Accommodation Services 3
Cookie Management 4
Processing of Personal Data Related to Enquiries and Requests for Offers 4
Accommodation Reservations 6
Accommodation Reservations Based on Cooperation Agreements 9
Sending of Newsletters 12
Processing of Personal Data Related to the Hunguest Hotels Loyalty Programme 14
Processing of Personal Data Related to the Business Card Programme 16
Processing of Personal Data Related to Gift Card Purchases 18
Processing of Contact Person Data and Data Processing Related to the Performance of Contracts 19
Processing of Personal Data Related to the Issuance and Retention of Invoices 21
Processing of Personal Data Related to Deferred Payment Services 22
Complaint Handling 25
Processing of Personal Data Related to Claims Handling in Connection with Accidents and Damage Events 26
Processing of Personal Data Related to the Creation of User Accounts 29
Satisfaction Surveys and Collection of Guest Feedback 30
Processing of Personal Data Related to Event Organisation 32
Processing of Personal Data Related to Partner Cooperation Concerning Catering Unit Products 34
Processing of Personal Data Related to Restaurant Reservations 36
Processing of Personal Data Related to Job Applications and Recruitment Procedures 38
Processing of Personal Data Related to the Job Applicant Database 40
Identification of Processors 41
Data Protection and Data Security 42
Rights of Data Subjects Regarding the Processing of Personal Data 43
Fulfilment of Data Subjects’ Requests 45
Legal Remedies 46

2. Applicable Data Protection Legislation and Scope of this Privacy Notice

2.1 Applicable legislation

The Data Controller's processing of personal data is governed primarily by the following legislation:

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the "GDPR" or the "Regulation");
Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (hereinafter: "Info Act");
Act CLV of 1997 on Consumer Protection;
Act CXXVII of 2007 on Value Added Tax;
Act C of 2000 on Accounting.
2.2 Scope of this Privacy Notice

This Privacy Notice applies to all processing of personal data carried out by the Data Controller in connection with the services provided through or in relation to the Website.

The Data Controller provides separate privacy notices regarding the processing of personal data by each hotel it operates, including data processing related to reservations made for the respective hotel through the Website.

This Privacy Notice applies to visitors of the Website, persons contacting the Data Controller, subscribers to the Data Controller's newsletter, purchasers of gift cards, and participants in the loyalty card and business card programmes (including, where applicable, the contact persons designated by such participants), as natural persons whose personal data are processed (hereinafter referred to as "You" or the "Data Subject").

3. Definitions

3.1 The terminology used in this Privacy Notice corresponds to the definitions contained in the legislation listed in Section 2, in particular the definitions set out in Article 4 of the GDPR and, where applicable, the interpretative provisions contained in Section 3 of the Hungarian Info Act.

3.2 Whenever this Privacy Notice refers to data or data processing, such references shall be understood to mean personal data and the processing of personal data, respectively.

4. Data Processing Related to Accommodation Services

4.1 The Data Controller provides information on the services offered by each hotel it operates separately for the respective hotel, as the range of services and the related processing of personal data may differ from one hotel to another, and certain details of the processing may also vary.

Accordingly, information regarding the processing of personal data in connection with accommodation services—including, in particular, guest check-in—and any ancillary services is available in the separate privacy notice applicable to the relevant hotel.

If the hotel has its own website, you are kindly requested to review the privacy notice published there as well in order to obtain information on any hotel-specific data processing activities.

5. Cookie Management

The Data Controller uses cookies to operate the Website and to collect technical information relating to visitors of the Website.

The Data Controller provides a separate Cookie Notice regarding the processing of personal data through cookies, available at:

https://www.hunguesthotels.hu/hu/tajekoztato_sutik_alkalmazasarol/

6. Data Processing Related to Enquiries and Requests for Quotations

6.1 Description of the data processing

Data Subjects have the opportunity to contact the Data Controller via one of the contact details provided on the Website or by sending a Messenger message to the Data Controller’s Facebook page (https://www.facebook.com/hunguesthotels/; hereinafter referred to as the "Facebook Page") in order to request information or further details regarding the services provided by the Data Controller and the hotels operated by it, request a quotation in relation to any hotel operated by the Data Controller, or contact the Data Controller for any other purpose.

By storing the data provided, the Data Controller is able to identify the person making the enquiry and provide a response or deliver the information required by the Data Subject.

With regard to the individual hotels, information on data processing activities related to enquiries and requests for quotations is also provided in the respective hotel-specific privacy notices.

6.2 Purpose of the data processing

The purpose of the data processing is to respond to enquiries submitted by the Data Subject, including, in particular, providing information about the services of the Data Controller and sending a quotation to the Data Subject in relation to the hotel concerned by the Data Subject’s request for quotation.

6.3 Personal data processed

During the processing of personal data, the Data Controller processes the information necessary to respond to the Data Subject’s enquiry, including primarily the following:

the Data Subject’s name;
depending on the method of contact, the Data Subject’s e-mail address, telephone number and postal address;
in the case of a request for quotation, additionally:
information regarding the planned number of guests (children and adults);
the type of quotation requested (personalised offer, senior offer, best available rate, etc.);
the planned date of arrival and departure;
information relating to the room type, special requests, and any other information provided at the discretion of the Data Subject – for example, in the "Comments" section when requesting an offer via the Website;
any additional personal data provided by the Data Subject during the communication.

In order to use the Messenger application connected to the Facebook Page, the Data Subject must log in to the Messenger application using their own user account. The personal data contained in and provided through private messages is accessed only by the Data Controller. The Data Controller does not process Messenger user credentials (in particular, passwords); these are processed solely by the service provider, Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; hereinafter referred to as "Meta Ireland"), which, as an independent data controller, collects data relating to persons using its services in accordance with its own privacy policy.

Meta Ireland’s general privacy policy is available at:

https://www.facebook.com/privacy/policy/

6.4 Categories of Data Subjects

Data Subjects who contact the Data Controller, express interest in its services, or request a quotation in relation to any hotel operated by the Data Controller.

6.5 Legal basis for the data processing

In the case of responding to enquiries submitted by the Data Subject prior to entering into a contract, the legal basis for the processing is the legitimate interest of the Data Controller, pursuant to Article 6(1)(f) of the GDPR.

The Data Controller has a legitimate interest in being able to provide appropriate information to interested Data Subjects regarding its services, answer their questions, and, where a quotation is requested, provide a personalised offer.

6.6 Duration of processing of personal data

If no contract or other agreement is concluded between the Data Controller and the Data Subject as a result of the communication, the Data Controller deletes the message(s) after the communication has been finally concluded.

If a contract is concluded between the parties, the Data Controller processes the personal data together with the contractual data.

6.7 Source of personal data

The source of the personal data is the Data Subject.

6.8 Access to personal data

The list of data processors engaged by the Data Controller is set out in Section 25 of this Privacy Notice.

6.9 Information regarding joint controllership

The processing activities related to the Facebook and Messenger services constitute joint controllership between Meta Ireland and the Data Controller. Joint controllership is provided for under Article 26 of the GDPR. Where two or more controllers jointly determine the purposes and means of processing, they are considered joint controllers.

For data protection matters, Meta Ireland’s Data Protection Officer may be contacted through the following interface:

https://www.facebook.com/help/contact/540977946302970

The joint controllers determine, in a transparent manner, in their agreement concluded between them, their respective responsibilities for compliance with obligations under the GDPR, particularly those relating to the exercise of Data Subjects’ rights and the provision of information to Data Subjects, as well as the allocation of responsibilities between them.

The agreement on joint controllership is available at:

https://hu-hu.facebook.com/legal/terms/page_controller_addendum

Regardless of the terms of the agreement, the Data Subject may exercise their rights under the GDPR against and in relation to each of the controllers.

During joint controllership, all controllers comply with the applicable rules regarding data protection and the processing of personal data.

6.10 Consequences of failure to provide personal data

The provision of personal data by the Data Subject is not mandatory. However, in many cases the Data Controller can only provide a meaningful response to enquiries or issue a quotation if the necessary information is provided.

6.11 Automated decision-making and profiling

No automated decision-making or profiling takes place during the processing of personal data.

7. Accommodation Booking

7.1. Description of data processing

In order to facilitate and make the accommodation booking process more efficient, the Controller enables Data Subjects to book rooms through its website, by telephone, by e-mail, as well as through online accommodation intermediary companies and travel agencies having a contractual relationship with the Controller (hereinafter collectively referred to as the “Intermediary Service Providers”), which qualify as independent data controllers.

The Controller assumes no responsibility for the data processing carried out by the Intermediary Service Providers’ websites. Information regarding the data processing activities performed by the Intermediary Service Providers is available on the websites of the respective Intermediary Service Providers.

Please note that in the case of accommodation bookings made by telephone, telephone conversations between the Data Subject and the Controller are not recorded.

The Controller also provides information regarding accommodation bookings made at individual hotels in the separate privacy notices applicable to the respective hotels.

The Controller refuses to fulfil an accommodation booking request from any person who, during a previous stay at any of the hotels operated by the Controller, has engaged in conduct incompatible with the standards of behaviour expected by the Controller, in particular behaviour that is seriously inappropriate or contrary to the Controller’s values.

If such a person wishes to make an accommodation booking, the Controller may refuse to fulfil the booking request by referring to its general terms and conditions and the previous incident. The Data Subject will also be informed of such refusal by e-mail.

7.2. Purpose of data processing

The purpose of data processing is to process the room booking request, to link the selected hotel room with the Data Subject as a guest, to manage the booking of the relevant room, and to contact the Data Subject.

In cases involving food intolerance, allergies, special requests or religious beliefs, the purpose of data processing is to preserve and protect the Data Subject’s health and to satisfy the Data Subject’s personal dietary preferences.

The Controller processes information relating to conduct displayed by a Guest during a previous stay at hotels operated by the Controller where such conduct was incompatible with expected standards of behaviour or contrary to the Controller’s values, in order to identify persons in respect of whom the Controller intends to refuse the fulfilment of an accommodation booking.

7.3. Personal data processed

The Controller processes data relating to the booking, including in particular:

the Data Subject’s name;
the Data Subject’s telephone number and e-mail address;
the Data Subject’s residential address for invoicing purposes (in connection with advance payments);
the date of arrival and departure and the length of stay;
the number of adults and children wishing to use the service, and the age of children;
information relating to the selected room, offer and payment method (including any discount applicable based on such payment method);
information relating to special requests and any other information provided voluntarily by the Data Subject, for example in the “Other comments and requests” field during the booking process on the website.

Information provided in relation to special requests may qualify as special categories of personal data, including in particular data concerning health status or religious beliefs, where the special dietary requirements are based on a health condition (for example food intolerance or food allergy) or religious belief.

If the Data Subject makes a booking at one of the hotels operated by the Controller through the Intermediary Service Providers listed above or through another intermediary service provider, the Controller receives from such intermediary service provider the Data Subject’s name, e-mail address, in certain cases the residential address or part thereof (country and postal code), the planned arrival and departure dates, as well as any additional information provided by the Data Subject (special requests or health-related information).

In connection with refusing to fulfil a booking, the Controller processes – in addition to the data required to identify the Data Subject – the information forming the basis of such refusal, namely information relating to conduct displayed by the Data Subject during a previous stay at hotels operated by the Controller that was incompatible with expected standards of behaviour or contrary to the Controller’s values, including in particular:

- violation of the provisions of the Controller’s house rules or conduct contrary to such rules;
- improper use of the room, apartment or any other facility provided to the Data Subject;
- objectionable, offensive, threatening or otherwise socially unacceptable behaviour towards the Controller’s employees or other Guests, or being under the influence of alcohol or narcotics;
- failure to pay any advance payment or service fee specified in the contract within the required deadline.

7.4. Categories of Data Subjects

The Data Subjects concerned are persons booking accommodation at any of the hotels operated by the Controller.

7.5. Legal basis for data processing

Since the processing of personal data is necessary for taking steps at the request of the Data Subject prior to entering into a contract, as well as for the performance of the contract, the legal basis for processing is Article 6(1)(b) of the GDPR.

In the event of refusal to fulfil a booking, the legal basis for processing is the legitimate interest of the Controller, pursuant to Article 6(1)(f) of the GDPR.

The Controller has a legitimate interest in ensuring the uninterrupted provision of accommodation services, the proper use of hotels operated by the Controller and their facilities by Guests, as well as preventing offensive or threatening behaviour towards employees and other Guests.

For this purpose, the Controller maintains records of persons who have previously stayed at hotels operated by the Controller and whose conduct did not comply with the standards of behaviour expected by the Controller or with the Controller’s values.

Where the Data Subject voluntarily provides special categories of personal data (for example health data or information concerning religious beliefs), the processing of such data is necessary pursuant to Article 6(1)(b) of the GDPR for the performance of the accommodation service contract. The applicable exception allowing the processing of special categories of personal data is the Data Subject’s explicit consent pursuant to Article 9(2)(a) of the GDPR.

7.6. Retention period of personal data

In the event of cancellation of the booking without legal consequences (failure of the contract to be concluded), the personal data will be deleted without undue delay.

Data relating to conduct displayed by the Data Subject during a previous stay at hotels operated by the Controller, which is incompatible with the standards of behaviour expected by the Controller, will be processed for the period during which refusal of future bookings may be based on such conduct (the “ban period”).

Personal data relating specifically to a refusal to fulfil a booking will be retained for the applicable limitation period following such refusal.

Where a contract is concluded based on the booking, i.e. the Data Subject uses the services provided by hotels operated by the Controller, the Controller processes the personal data for the duration of the applicable limitation period.

7.7. Source of personal data

The source of personal data is the Data Subject. However, where the Data Subject books accommodation through Intermediary Service Providers, the data is provided to the Controller by such Intermediary Service Providers.

7.8. Access to personal data

A list of processors engaged by the Controller is provided in Section 25 of this privacy notice.

If the Data Subject wishes to fulfil payment obligations related to the order through the SimplePay application, SimplePay Zrt. (registered office: 1138 Budapest, Váci út 135–139., Building B, 5th floor), which operates the SimplePay application, will have access to the data necessary for processing the payment.

According to the privacy notice available at https://simplepay.hu/adatkezelesi-tajekoztatok/ relating to the SimplePay Service User Terms and Conditions, SimplePay Zrt. qualifies as a data processor.

7.9. Consequences of failure to provide personal data

If the Data Subject fails to provide the data necessary for recording the booking, the accommodation service cannot be booked. Consequently, the Controller cannot fulfil the Data Subject’s room reservation and no related data processing will take place.

7.10. Automated decision-making and profiling

No automated decision-making or profiling takes place during the processing of personal data.

8. Accommodation Booking Based on Cooperation Agreements

8.1. Description of data processing

The Controller enters into cooperation agreements and framework agreements with other legal entities (hereinafter referred to as “Partners”), under which persons designated by the Partner – in particular employees of the Partner – may use the services provided by the Controller under individual terms and conditions.

The Controller is entitled and obliged to verify whether a person designated by the Partner is entitled to use the services under the individual terms and conditions.

Based on the cooperation agreement concluded with the Partner, the Controller may verify such entitlement in several ways, as follows:

the Partner provides the Controller with the data necessary to identify the person(s) using the service, as well as general information relating to the booking;
no transfer of personal data takes place between the parties; instead, the Controller and the Partner agree in the cooperation agreement on another method for verifying entitlement to use the Controller’s services under the individual terms and conditions.

This may take place, for example, where the Controller generates a promotional code for the Partner, which may be used by persons designated by the Partner to access the Controller’s services under the individual terms and conditions.

Eligible persons may initiate an accommodation booking by using this code and subsequently verify their entitlement to use the code directly with the Controller.

Verification of entitlement – regardless of whether the Controller provides a promotional code to the Partner or not – shall take place in accordance with the cooperation agreement and may be performed by the Guest, for example, through:

making a booking from a company (workplace) e-mail address;
presenting employer or other supporting documentation; or
presenting a company access card to the Controller.

The cooperation agreement may also provide that, if the Controller has a legal dispute with a person designated by the Partner (including, in particular, disputes relating to settlement or payment), the Partner shall provide assistance to the Controller in resolving such dispute.

If the Partner undertakes such assistance obligation, the Controller shall transfer to the Partner the data relating to the dispute.

8.2. Purpose of data processing

The purpose of processing is to ensure that, in the case of bookings made under a cooperation agreement, the Controller is able to:

• identify employees of the Partner and any other persons designated by the Partner who are entitled to use the services;
• provide services to such persons under the individual terms and conditions specified in the cooperation agreement; and
• verify, where necessary, entitlement to discounts or other benefits.

Where the Partner undertakes in the cooperation agreement to assist the Controller in resolving a dispute with a person designated by the Partner, the purpose of transferring personal data is to facilitate such assistance.

8.3. Personal data processed

In order to provide benefits available under the cooperation agreement, the Controller processes:

• data necessary to identify the Guest(s) (typically the Guest’s name and information regarding which Partner the Guest is associated with); and
• general information relating to the booking.

In relation to verification of entitlement to use benefits provided under the cooperation agreement, the parties proceed as follows:

Where the Partner transfers personal data to the Controller, the Partner, as an independent data controller, is responsible for providing the Data Subjects with detailed information regarding such processing and the exact scope of the data transferred.
Where no transfer of personal data takes place under the cooperation agreement, the Controller processes personal data only to the extent necessary to verify entitlement.

Verification of entitlement takes place in accordance with the cooperation agreement, including, but not limited to, the following methods:

• booking made from a company (Partner) e-mail address;
• presentation of employer or other supporting documentation; or
• presentation of a company access card upon check-in at the accommodation.

In the latter cases, the Controller does not record or store the document presented as proof; it only requests presentation of such document.

Where the Partner undertakes in the cooperation agreement to assist the Controller in resolving a dispute with a person designated by the Partner, the Controller transfers to the Partner personal data relating to the dispute, including in particular data necessary to identify the person designated by the Partner and data relating to the use of accommodation services.

8.4. Categories of Data Subjects

The Data Subjects concerned are employees of Partners who have concluded cooperation agreements with the Controller, as well as any other persons designated by the Partner who are entitled to use the services.

8.5. Legal basis for data processing

The legal basis for processing personal data is the legitimate interest of the Controller and the Partner as a third party pursuant to Article 6(1)(f) of the GDPR.

The Controller and the Partner have a legitimate interest in ensuring that the Controller is able to identify Guests referred by its contractual Partners and provide services to them in accordance with the cooperation agreement concluded with the Partner.

Where the Partner undertakes in the cooperation agreement to assist the Controller in resolving a dispute with a person designated by the Partner, the legal basis for transferring personal data to the Partner is also the legitimate interest of the Controller and the Partner as a third party pursuant to Article 6(1)(f) of the GDPR.

Such legitimate interest is to ensure that the dispute is resolved as efficiently as possible, thereby strengthening the business relationship and trust between the Partner and the Controller.

8.6. Retention period of personal data

Processing for the purposes described in this section continues only until the Guest checks in, as thereafter processing relating to the accommodation service and related services takes place, for which the privacy notice of the hotel providing the accommodation service and the retention periods specified therein shall apply.

If the booking is cancelled, the related data will also be deleted.

Where the Partner undertakes in the cooperation agreement to assist the Controller in resolving a dispute with a person designated by the Partner, the processing continues until the dispute has been resolved.

8.7. Source of personal data

The source of personal data is the Partner or directly the Guest.

8.8. Access to personal data

The personal data provided may be accessed by those employees of the Controller whose employment duties include processing such personal data.

The Controller does not transfer the data to any third party, except in the case where the Partner undertakes in the cooperation agreement to assist the Controller in resolving a dispute with a person designated by the Partner.

In such case, the Controller transfers the personal data relating to the dispute to the Partner, which qualifies as an independent data controller in relation to such transfer.

A list of processors engaged by the Controller is provided in Section 25 of this privacy notice.

8.9. Consequences of failure to provide personal data

Providing personal data is necessary, as without such data the Controller cannot identify employees of the Partner or any other persons designated by the Partner, and cannot provide services to them under the terms and conditions of the cooperation agreement.

8.10. Automated decision-making and profiling

No automated decision-making or profiling takes place during the processing of personal data.

9. Data Processing Related to Newsletter Sending

9.1. Description of data processing

Visitors to the website have the opportunity to subscribe to the Controller’s newsletter service by completing the newsletter subscription fields on the website, clicking the “Subscribe” button, and then clicking the confirmation link provided in the confirmation e-mail sent to their e-mail address.

Through its newsletters, the Controller provides information on the services it offers, news and updates concerning the Controller and the hotels operated by it, special offers, and other relevant information. In addition to providing useful information, the newsletter service also serves the purpose of direct marketing activities carried out by the Controller.

The Data Subject may subscribe to this service independently from the use of any other services. Subscription to the newsletter is voluntary; if the visitor does not use the newsletter service, this shall not result in any disadvantage for the visitor with regard to the use of the Controller’s other services. The Controller does not make the use of its direct marketing service a condition for using any other service.

9.2. Purpose of data processing

The purpose of data processing is sending newsletters by the Controller to persons who have subscribed to the newsletter service via e-mail. Newsletter communications include information regarding the Controller’s services, new developments and current news, promotional offers, and advertising content.

9.3. Personal data processed

The Data Subject’s name and e-mail address.

The Controller also processes information relating to the time of subscription and the provision of consent, as well as data relating to the opening of newsletters and the opening of links contained therein.

9.4. Scope of Data Subjects

Persons who have subscribed to the Controller’s newsletter service.

9.5. Legal basis of data processing

The legal basis for processing is the consent of the Data Subject pursuant to Article 6(1)(a) of the GDPR, provided by the Data Subject when subscribing to the newsletter.

The Data Subject is entitled to withdraw their previously given consent at any time. Withdrawal of consent shall not affect the lawfulness of processing carried out before such withdrawal.

9.6. Retention period of personal data

The Controller processes the data collected for the purpose of sending newsletters until the withdrawal of the Data Subject’s consent for this purpose (unsubscribe), or until the deletion of the data requested by the Data Subject.

9.7. Source of personal data

The source of the personal data is the Data Subject.

9.8. Access to personal data

The list of processors engaged by the Controller is included in Section 25 of this Privacy Notice.

9.9. Consequences of failure to provide personal data

Providing personal data is voluntary; however, without such data the Controller cannot send newsletters to the Data Subject.

9.10. Automated decision-making and profiling

No automated decision-making or profiling takes place during the processing of personal data.

10. Data Processing Related to the Hunguest Hotels Loyalty Programme

10.1. Description of data processing

The Controller operates a loyalty programme under the name “Hunguest Hotels Loyalty Programme” (hereinafter: the “Loyalty Programme”), the purpose of which is to provide discounts to returning and loyal guests. Joining the Loyalty Programme may be initiated either online via the website or in paper form at the hotels operated by the Controller. The Data Subject may personally collect the completed loyalty card at the reception of the hotels operated by the Controller.

From the date of joining the Loyalty Programme, the Data Subject may collect and redeem points after using the services of the hotels operated by the Controller.

10.2. Purpose of data processing

The purpose of data processing is participation in the Loyalty Programme and providing the related benefits, in particular:

• preparation and delivery of the loyalty card;
• replacement of the loyalty card in case of loss;
• ensuring the Data Subject’s participation in the Loyalty Programme;
• crediting points and enabling their redemption;
• providing discounts in the form of percentage-based price reductions;
• enabling the Data Subject to check the balance of the loyalty card.

The purpose of processing the Data Subject’s identification data is to identify the Data Subject and determine their eligibility for discounts, as well as to ensure faster registration during check-in at hotels operated by the Controller (one of the functions of the loyalty card is enabling check-in using the loyalty card).

The purpose of processing the Data Subject’s contact details is maintaining communication.

The processing of the unique serial number and barcode assigned to the loyalty card is also necessary when using the loyalty card in order to verify the Data Subject’s eligibility and prevent misuse.

The data generated through the use of the loyalty card does not contain detailed information regarding the Data Subject’s habits related to the use of hotel services; therefore, such data is not suitable for profiling or for assessing or predicting personal characteristics.

10.3. Personal data processed

The Controller processes the data provided when applying to join the Loyalty Programme:

• name (identification);
• date of birth (identification and required for checking the card balance);
• residential address (billing purposes);
• mailing address (communication);
• e-mail address (communication);
• telephone number (communication);
• unique serial number of the loyalty card (registration of the loyalty card and linking it to the Data Subject);
• barcode of the loyalty card (required for applying discounts).

In addition, the Controller processes data related to the use of the loyalty card. Such data generated during use includes:

points related to the use of hotel services (10% of the gross amount of invoices issued for services used is credited in the form of points);
the amount of discount applicable when using hotel services.

Previously issued chip-based cards by the Controller remain valid and may still be used. In connection with these loyalty cards, the Controller processes the name displayed on the loyalty card and the PIN code of the loyalty card (in encrypted form). The Data Subject may replace their previous card with the new barcode-based card at any time.

10.4. Scope of Data Subjects

Participants of the Controller’s Loyalty Programme.

10.5. Legal basis of data processing

The legal basis for processing personal data related to requesting a loyalty card is the consent of the Data Subject pursuant to Article 6(1)(a) of the GDPR.

The Data Subject is entitled to withdraw their consent regarding the processing of personal data at any time by notifying the Controller through any of the contact details specified in this Privacy Notice.

10.6. Retention period of personal data

The Controller processes the data until the withdrawal of the Data Subject’s consent or until deletion of the data requested by the Data Subject. In the absence of such withdrawal or deletion request, the Controller processes the data for 3 years from the last activity related to the Loyalty Programme (e.g. the last change in the points balance).

Data processing related to checking the loyalty card balance lasts only for the duration of the balance inquiry. The displayed points balance becomes temporarily visible and cannot be accessed again after leaving the page used for checking the balance, unless a new inquiry is made.

10.7. Source of personal data

The source of the personal data is the Data Subject.

10.8. Access to personal data

The list of processors engaged by the Controller is included in Section 25 of this Privacy Notice.

10.9. Consequences of failure to provide personal data

Providing personal data is voluntary; however, it is a condition for participation in the Loyalty Programme.

10.10. Automated decision-making and profiling

No automated decision-making or profiling takes place during the processing of personal data.

11. Data Processing Related to the Business Card Programme

11.1. Description of data processing

The Controller has established its so-called Business Card Programme for participants of the business sector, which – similarly to the Hunguest Hotels Loyalty Programme – is a discount scheme available for services provided at hotels operated by the Controller. In the case of direct hotel bookings and use of services, a specified percentage of the amount of the invoice generated shall be credited to the Business Card in the form of points, and the accumulated points may be used as a monetary discount for subsequent direct hotel bookings and use of services.

The Business Card may be applied for via the website.

For the purposes of data processing related to the Business Card, the Data Subject shall be the natural person whose personal data is provided by the applicant organisation as a contact person on the Business Card application form available at https://hunguesthotels.hu/uzletikartya/jelentkezesi_lap/, and with whom the Controller maintains communication in connection with the Business Card.

11.2. Purpose of data processing

The purpose of data processing is to ensure the participation of the organisation represented by the contact person in the Business Card Programme and to provide the related benefits resulting in cost savings, including the identification of the organisation and maintaining records of eligibility for discounts.

The purpose of processing the contact person’s name is identification and verification of eligibility for the use of the programme.

The purpose of processing the contact person’s contact details is communication necessary for providing and using the discounts.

11.3. Personal data processed

The Controller processes the data provided in connection with the application to the Business Card Programme concerning the contact person:

• name of the contact person (identification, communication);
• e-mail address of the contact person (communication);
• telephone number and mobile phone number of the contact person (communication, voluntary);
• data relating to the represented organisation.

11.4. Scope of Data Subjects

Contact persons of applicants requesting a Business Card.

11.5. Legal basis of data processing

The legal basis for processing personal data is the legitimate interest of the Controller and the organisation represented by the contact person as a third party pursuant to Article 6(1)(f) of the GDPR.

The legitimate interest of the organisation applying for the Business Card is the utilisation of discounts resulting in cost savings through participation in the Business Card Programme.

The legitimate interest of the Controller is to ensure quick and efficient administration in relation to the organisation represented by the contact person and, through this, to provide the benefits offered by the Business Card.

Obtaining and using the discount, as well as the exchange of information required for these purposes, cannot be carried out without processing the personal data of the contact person; therefore, processing is essential for ensuring participation in the Business Card Programme.

Due to the legal basis of the processing, Data Subjects have the right to object to the processing of their personal data.

11.6. Retention period of personal data

Data processing shall continue after the end of the participation of the organisation represented by the contact person in the Business Card Programme for the duration of the applicable limitation period.

If the contact person’s authorisation to act as a contact person terminates before this time, the represented organisation shall notify the Controller thereof. In such case, the Controller shall delete the contact person’s data without delay.

If the application for the Business Card is rejected, the data shall be deleted immediately following the rejection decision.

11.7. Source of personal data

If the contact person indicated in the application is not the person who provides their own data, but another person from the applicant organisation provides such data, the source of the personal data is the applicant organisation. The applicant organisation is responsible for having lawful authorisation to provide the contact person’s data.

11.8. Access to personal data

The list of processors engaged by the Controller is included in Section 25 of this Privacy Notice.

11.9. Consequences of failure to provide personal data

Providing personal data is voluntary; however, it is a condition for participation in the Business Card Programme.

11.10. Automated decision-making and profiling

No automated decision-making or profiling takes place during the processing of personal data.

12. Data Processing Related to the Purchase of Gift Cards

12.1. Description of data processing

Hunguest Hotels Gift Cards (hereinafter: the “Gift Card”) may be purchased at hotels designated as sales points by the Controller, as well as online via the website. The Gift Card may be used within the validity period for services provided by hotels operated by the Controller up to the value limit specified on the card.

The Gift Card is not issued to a specific named person; it may be used by its holder.

12.2. Purpose of data processing

The purpose of data processing is the conclusion and performance of the contract for the purchase of the Gift Card resulting from the order, including receiving and processing the order and sending the ordered card to the Data Subject.

Within this scope, the purpose of processing the Data Subject’s identification data is to identify the Data Subject during the conclusion of the contract resulting from the order. The purpose of processing the Data Subject’s contact details is to enable the Controller to contact the Data Subject if necessary. The purpose of processing the postal address is to send the ordered product to the Data Subject.

12.3. Personal data processed

The Controller processes the following data of the purchaser, i.e. the Data Subject:

• name (identification and mailing of the ordered card);
• postal address (mailing of the ordered card);
• telephone number (communication, voluntary);
• e-mail address (communication);
• data relating to the ordered card (identification of the card and purchase price);
• date and time of ordering and payment.

12.4. Scope of Data Subjects

Natural persons purchasing the Gift Card.

12.5. Legal basis of data processing

The legal basis for processing is Article 6(1)(b) of the GDPR, according to which processing is necessary for the performance of a contract to which the Data Subject is a party.

When placing the order, the Data Subject is informed that the Controller processes the provided personal data for the purpose of performing the contract concluded based on the order.

12.6. Retention period of personal data

The Controller processes data related to the purchase of the Gift Card – including messages of material content exchanged between the Data Subject and the Controller concerning the order – for the duration of the applicable limitation period following the conclusion of the contract (placing of the order).

12.7. Source of personal data

The source of the personal data is the Data Subject.

12.8. Access to personal data

The list of processors engaged by the Controller is included in Section 25 of this Privacy Notice.

12.9. Consequences of failure to provide personal data

Providing personal data is voluntary; however, without such data the Data Subject cannot order the Gift Card.

12.10. Automated decision-making and profiling

No automated decision-making or profiling takes place during the processing of personal data.

13. Processing of Contact Person Data and Data Processing Related to the Performance of Contracts

13.1. Description of Data Processing

In the course of its activities, the Controller enters into contracts with other legal entities, which may include natural persons as well as legal persons.

Where the Controller enters into a contract with a natural person, sole proprietor or private agricultural producer, it processes the personal data necessary for identifying such person, maintaining contact with them, as well as other personal data related to the performance of the contract.

Where the Controller enters into contracts with legal persons, it is necessary to process the data of the partner’s contact person in order to enable the parties to maintain contact during their cooperation and to ensure the continuous maintenance and development of their business relationship.

13.2. Purpose of Data Processing

The purpose of data processing is the conclusion and performance of contracts between the Controller and the contracting partner, including communication related to the contract, and through this, the establishment and maintenance of a business relationship.

13.3. Personal Data Processed

Considering that sole proprietors and private agricultural producers qualify as natural persons, in the case of contracting with them and with private individuals, the source of personal data is the Data Subject. Therefore, the Controller provides final information on the exact scope of processed personal data at the time of concluding the contract.

In general, the following data may be processed:

a) name (identification)
b) mother’s name (identification)
c) place and date of birth (identification)
d) residential address (contact purposes)
e) registered office in the case of sole proprietors and private agricultural producers (contact purposes)
f) telephone number (contact purposes)
g) e-mail address (contact purposes)
h) in the case of payment by bank transfer: bank account number and name of the account-holding bank
i) where the service fee is paid after deduction of public charges, the TAJ number (Hungarian social security identification number) required for this purpose
j) tax identification number in the case of taxable transactions, and tax number in the case of sole proprietors
k) registration number in the case of sole proprietors
l) other data strictly necessary for the performance of the contract.

In the case of legal persons, the Controller processes the name of the representative, as well as the name, telephone number, e-mail address and position of the contact person.

In the case of contracts concluded with legal persons, the source of the contact person’s data is the contracting party.

13.4. Scope of Data Subjects

Natural persons contracting with the Controller, as well as, in the case of legal person contracting parties, the representative and contact person of the legal person.

13.5. Legal Basis of Data Processing

In the case of natural persons, the legal basis for processing is Article 6(1)(b) of the GDPR, i.e. processing is necessary for the performance of the contract concluded with the Data Subject.

Where the contact person does not have a direct contractual relationship with the Controller, i.e. where the Data Subject is an employee or another contributor of the contracting partner, the legal basis for processing is the legitimate interest of the Controller pursuant to Article 6(1)(f) of the GDPR.

This legitimate interest – which is also the legitimate interest of the contracting party as a third party – is the establishment and maintenance of a business relationship with the organisation represented by the Data Subject, as well as ensuring the most efficient performance of the concluded contract(s).

Communication with the contact person is therefore necessary for establishing economic cooperation and fulfilling the contract(s) concluded between the organisations.

The Controller does not process the Data Subject’s personal data for any other purpose without an appropriate legal basis.

13.6. Retention Period of Personal Data

The Controller processes the Data Subjects’ personal data until the expiry of the general limitation period specified in the Hungarian Civil Code following the performance of the contract.

However, accounting documents directly or indirectly supporting accounting records shall be retained by the Controller for at least 8 years in a readable format and in a manner allowing retrieval based on references in accounting records, pursuant to Section 169(2) of the Hungarian Accounting Act.

The Controller shall no longer process contact person data for the communication purposes specified in this section if it receives information that the contact person’s employment relationship with the contracting partner has terminated.

13.7. Access to Personal Data

The list of processors engaged by the Controller is provided in Section 25 of this Privacy Notice.

13.8. Consequences of Failure to Provide Personal Data

The provision of personal data is essential for the conclusion and performance of the contract.

13.9. Automated Decision-Making and Profiling

No automated decision-making or profiling takes place during the processing of personal data

14. Processing of Data Related to the Issuance and Retention of Invoices

14.1. Description of Data Processing

The Controller issues invoices for services used through the website, including invoices related to the purchase of gift cards.

Information regarding services provided by hotels operated by the Controller and invoices issued in connection with such services is also provided in the privacy notices applicable to the individual hotels.

14.2. Purpose of Data Processing

The purpose of data processing by the Controller is the issuance and retention of invoices.

The processing is carried out in accordance with:

Section 159(1) and Section 169 of the Hungarian VAT Act; and
Section 169(2) of the Hungarian Accounting Act.
14.3. Personal Data Processed

The data specified in Section 169 of the Hungarian VAT Act, including at least:

• name;
• billing address;
• tax identification number (where the invoice is requested as a sole proprietor).

14.4. Scope of Data Subjects

Natural persons using the services provided by the Controller for consideration.

14.5. Legal Basis of Data Processing

The legal basis for processing personal data during the issuance of invoices is Article 6(1)(c) of the GDPR, i.e. compliance with a legal obligation, based on Section 169 of the Hungarian Accounting Act and Section 159(1) of the Hungarian VAT Act.

14.6. Retention Period of Personal Data

The Controller retains invoices for at least 8 years in accordance with Section 169 of the Hungarian Accounting Act.

14.7. Source of Personal Data

The source of personal data is the Data Subject.

14.8. Access to Personal Data

The list of processors engaged by the Controller is provided in Section 25 of this Privacy Notice.

14.9. Consequences of Failure to Provide Personal Data

The provision of personal data is required by law; therefore, the Data Subject is obliged to provide the required personal data.

14.10. Automated Decision-Making and Profiling

No automated decision-making or profiling takes place during the processing of personal data.

15. Processing of Data Related to the Use of Deferred Payment

15.1. Description of Data Processing

In connection with accommodation bookings, the Controller provides the option to settle the price of the order through deferred payment. For this purpose, the Controller uses the services of its payment service provider partner, InstaCash Korlátolt Felelősségű Társaság (registered seat: 1015 Budapest, Szabó Ilonka utca 22. Ground floor 2; hereinafter: “InstaCash”).

During the processing of personal data related to the deferred payment service, the Controller and InstaCash act as joint controllers (hereinafter jointly referred to as the “Joint Controllers” in this section), with the exception that the financial assessment required for using the deferred payment service is carried out by InstaCash as an independent controller.

InstaCash provides information on its own data processing activities through its website.

The deferred payment service may be used by the Data Subject if they qualify as an “Eligible Customer for Deferred Payment”. The Data Subject may initiate qualification as an “Eligible Customer for Deferred Payment” on the website during the booking process by selecting the deferred payment option among the available payment methods.

Following submission of the order, InstaCash performs a financial assessment of the Data Subject based on the identification and contact information provided by the Data Subject, as well as invoice information and other financial data. The latter information is shared by the Data Subject with InstaCash by connecting their bank account provider’s online banking system.

If the financial assessment is successful, the Data Subject will be classified as an “Eligible Customer for Deferred Payment” and will become entitled to use deferred payment. A separate agreement regarding deferred payment is concluded between the Data Subject and the Controller.

The Controller provides detailed information on the deferred payment service and its conditions in its General Terms and Conditions available at:
https://www.hunguesthotels.hu/hu/hunguest_hotels_altalanos_szerzodesi_feltetelek/

15.2. Purpose of Data Processing

The purpose of data processing is to provide the Data Subject with a deferred payment service in connection with accommodation services, including the identification of the Data Subject, verification of their eligibility to use deferred payment (classification as an “Eligible Customer for Deferred Payment”), monitoring deferred payments and settlement related thereto.

15.3. Personal Data Processed

The Joint Controllers process the following data in order to provide the deferred payment service:

• data included in the order as described in Section 7 of this Privacy Notice, including billing data, identification data of the Data Subject, as well as the e-mail address and telephone number, which are also required for the financial assessment carried out by InstaCash (for example, the Data Subject may download and verify the deferred payment agreement using a code sent to their mobile phone via SMS or e-mail);
• additional identification data not recorded during the order process but required for concluding the deferred payment agreement (mother’s name, place and date of birth);
• the result of the financial assessment performed by InstaCash, based on which the possibility of deferred payment may be provided to the Data Subject.

15.4. Scope of Data Subjects

Data Subjects who select deferred payment as a payment method during the accommodation booking process.

15.5. Legal Basis of Data Processing

Since processing is necessary for the conclusion and performance of the agreement regarding deferred payment, the legal basis for processing by the Controller is Article 6(1)(b) of the GDPR.

15.6. Retention Period of Personal Data

The Joint Controllers process the Data Subjects’ personal data following the performance of the deferred payment agreement until the expiry of the general limitation period specified in the Hungarian Civil Code.

Accounting documents directly or indirectly supporting accounting records shall be retained by the Controllers for at least 8 years in a readable format and in a manner allowing retrieval based on references in accounting records, pursuant to Section 169(2) of the Hungarian Accounting Act.

15.7. Source of Personal Data

The source of personal data is the Data Subject, and, with regard to classification as an “Eligible Customer for Deferred Payment”, InstaCash.

15.8. Access to Personal Data

The list of processors engaged by the Controller is provided in Section 25 of this Privacy Notice.

In connection with deferred payment, online card payments – including both the initial contribution and subsequent payments – are processed through the Barion system. The service is provided to the Joint Controllers by Barion Payment Zrt. (registered seat: 1117 Budapest, Irinyi József utca 4–20., 2nd floor) as an independent controller.

The Controller does not have access to the bank card details used for completing deferred payments.

15.9. Information on Joint Controllership

As described above, the processing of personal data related to the deferred payment service constitutes joint controllership between InstaCash and the Controller, except for the financial assessment, which is performed by InstaCash as an independent controller.

Joint controllership is permitted under Article 26 of the GDPR. Where two or more controllers jointly determine the purposes and means of processing, they are considered joint controllers.

The Joint Controllers determine, in a transparent manner and in an agreement concluded between them, their respective responsibilities for compliance with obligations under the GDPR, in particular regarding the exercise of Data Subjects’ rights and the provision of information to Data Subjects.

Regardless of the terms of the agreement, the Data Subject may exercise their rights under the GDPR against and with respect to each controller.

During joint controllership, all controllers comply with applicable data protection rules and regulations concerning the processing of personal data.

All controllers involved in the processing are jointly and severally liable for any damage caused by processing that infringes the GDPR; therefore, the Data Subject may enforce their full claim against any of them.

The Joint Controllers make every effort to ensure appropriate protection of Data Subjects’ personal data.

In matters relating to deferred payment, the Data Subject may contact InstaCash at the following e-mail address:
bnpl@instacash.hu

In connection with exercising Data Subject rights, the Joint Controllers cooperate with each other, and in accordance with Article 26(3) of the GDPR, the Data Subject may submit requests to any party participating in the joint controllership and may exercise their rights under the GDPR against any of them.

15.10. Consequences of Failure to Provide Personal Data

The provision of personal data is voluntary; however, it is a condition for using the deferred payment service.

15.11. Automated Decision-Making and Profiling

No automated decision-making or profiling takes place during the joint processing of personal data.

16. Complaint Handling

16.1. Description of Data Processing

In compliance with consumer protection regulations, the Controller provides consumers with the opportunity to submit complaints regarding its services. Complaint handling is carried out in accordance with the provisions of the Consumer Protection Act (Fgytv.).

In the case of an oral complaint, if the consumer does not agree with the immediate handling of the complaint, or if the immediate investigation of the complaint is not possible, the Controller shall promptly prepare minutes regarding the complaint and its position in relation to the complaint, in accordance with Section 17/A (3) of the Fgytv.

16.2. Purpose of Data Processing

The purpose of data processing is to handle complaints submitted by users of the services, taking into account the provisions of the Fgytv.

16.3. Personal Data Processed

Pursuant to Section 17/A (5) of the Fgytv., the minutes prepared regarding complaint handling shall contain the following data:

the Data Subject’s name, residential address or electronic mail address;
the place, date and method of submitting the complaint;
a detailed description of the Data Subject’s complaint, as well as a list of documents, records and other evidence presented by the consumer;
the Controller’s statement regarding its position on the consumer’s complaint, where immediate investigation of the complaint is possible;
the signature of the person preparing the minutes and – except in the case of oral complaints submitted by telephone or electronically – the consumer’s signature;
the place and date of preparing the minutes;
in the case of complaints submitted by telephone or electronically, the unique identification number of the complaint;
the information required under Section 17/A (5a) of the Fgytv.

During complaint handling, depending on the method of submission, the Controller may also process the Data Subject’s contact details, in particular their telephone number, in addition to the above data.

16.4. Scope of Data Subjects

Persons submitting complaints to the Controller.

16.5. Legal Basis of Data Processing

The legal basis for processing is compliance with a legal obligation pursuant to Article 6(1)(c) of the GDPR, namely compliance with the obligations set out in Section 17/A of the Fgytv.

16.6. Retention Period of Personal Data

The Controller is required to retain the minutes prepared regarding the complaint and a copy of the response for three years.

16.7. Source of Personal Data

The source of personal data is the Data Subject.

16.8. Access to Personal Data

The list of processors engaged by the Controller is included in Section 25 of this privacy notice.

16.9. Consequences of Failure to Provide Personal Data

The provision of personal data is required by law. If the data is not provided, the Data Subject cannot exercise their consumer rights.

16.10. Automated Decision-Making and Profiling

No automated decision-making or profiling takes place during the processing.

17. Data Processing Related to Damage Claims Arising from Accidents and Incidents

17.1. Description of Data Processing

If the Controller becomes aware of accidents or incidents occurring on the premises of hotels operated by it, it shall prepare a report at the location, which necessarily involves processing the personal data of persons affected by the accident or incident.

If the person affected by the accident or incident also wishes to assert a claim for damages against the Controller, the Controller shall process additional data included in the submitted claim for the purpose of investigating the case.

The personal data included in the report, the claim for damages submitted to the Controller, and any other personal data obtained during the claims handling process shall be processed by the Controller solely for the purpose of clarifying liability issues related to the accident or incident, in accordance with this section.

The Controller shall be liable for damages caused by it in accordance with applicable laws.

17.2. Purpose of Data Processing

The purpose of processing data contained in the accident or incident report is to ensure that the Controller has accurate and subsequently retrievable information regarding the circumstances of accidents and incidents affecting guests on the premises of hotels operated by it, as well as statements made by persons involved.

In the event that an injured or affected person submits a claim for damages to the Controller, the purpose of processing is also to examine the submitted claim, investigate the accident or incident forming its basis, and determine whether the claim is justified or should be rejected.

17.3. Personal Data Processed

In connection with accidents and incidents occurring in hotels operated by the Controller, the Controller generally processes the following personal data:

data necessary for identifying and contacting the person who suffered personal injury or damage as a result of an accident occurring on hotel premises;
in the case of a minor injured or affected person, data necessary for identifying and contacting their legal representative;
data necessary for identifying and contacting witnesses of the accident or incident, persons providing first aid, and the person completing the report;
data relating to the circumstances of the accident or incident and statements made in connection with it.

In the event of an accident or incident involving personal injury, the scope of processed personal data may also include health data relating to the injuries suffered by the affected person.

Since the claim for damages is submitted by the Data Subject, the Data Subject determines the scope of information provided (for example, what supporting documents are submitted). The Controller also processes such data voluntarily provided by the Data Subject during claims handling.

Pursuant to Section 2.2 of Annex 1 to Government Decree No. 510/2023 (XI. 20.) on the establishment and operation of public-use baths, a register must be maintained regarding accidents and incidents of illness. Therefore, in the event of accidents occurring in the baths or wellness areas of individual hotels, processing also covers the data recorded in such registers that are necessary to identify the injured person and the circumstances of the accident.

17.4. Scope of Data Subjects

Guests who suffer an accident or damage in hotels operated by the Controller, persons completing the report, and other persons involved in claims handling (e.g. witnesses).

17.5. Legal Basis of Data Processing

The legal basis for processing personal data is the legitimate interest of the Controller pursuant to Article 6(1)(f) of the GDPR.

The Controller may have legal liability in connection with accidents and incidents occurring in hotels operated by it; therefore, it has a legitimate interest in maintaining accurate and subsequently retrievable information regarding the circumstances and consequences of accidents or incidents related to the accommodation services provided, as well as retaining the data of injured or affected guests for subsequent claims handling.

If an injured or affected person submits a claim for damages, the Controller also has a legitimate interest in examining the claim and its legal basis, comparing it with the available information, and investigating the accident or incident underlying the claim.

Where health data is processed, the applicable exception allowing the processing of such special categories of personal data is Article 9(2)(f) of the GDPR, meaning that processing is necessary for the establishment, exercise or defence of legal claims.

17.6. Retention Period of Personal Data

The Controller processes personal data until the expiry of the general five-year limitation period specified in the Civil Code.

17.7. Source of Personal Data

The source of personal data is the Data Subject, or, in the case of a minor Data Subject, their legal representative.

17.8. Access to Personal Data

The Controller shall provide personal data to authorities or courts conducting proceedings where required in connection with such proceedings.

If the Data Subject enforces a claim against the Controller through legal proceedings, the Controller may engage a lawyer in the proceedings, to whom the data necessary for conducting the proceedings may be transferred. The lawyer acts as an independent data controller in the course of their activities. The identity of the lawyer will be provided by the Controller on a case-by-case basis during the relevant proceedings.

The Controller may transfer relevant data necessary for insurance claim handling to its own insurance company. The insurance company acts as an independent data controller separate from the Controller.

The list of processors engaged by the Controller is included in Section 25 of this privacy notice.

17.9. Consequences of Failure to Provide Personal Data

Providing personal data is voluntary; however, without such data the Controller cannot maintain accurate and subsequently retrievable information regarding accidents or incidents occurring in hotels operated by it. Consequently, claims submitted by the Data Subject cannot be assessed without the provision of data.

17.10. Automated Decision-Making and Profiling

No automated decision-making or profiling takes place during the processing.

18. Data Processing Related to Creating a User Account

18.1. Description of Data Processing

Data Subjects have the opportunity to create and subsequently use a user account on the Controller’s website (https://www.hunguesthotels.hu).

Through the user account, the Data Subject may manage bookings, view booking history, personalise settings, receive benefits and request a loyalty card.

By storing the personal data provided during registration and login, the Controller is able to identify the Data Subject, provide the functions associated with the user account, and deliver the related services.

18.2. Purpose of Data Processing

The purpose of processing is the creation, operation and maintenance of the user account, providing functions connected to the account (managing bookings, applying discounts, sending personalised offers), and identifying the Data Subject for the purpose of providing services.

18.3. Personal Data Processed

During registration, the Controller processes only the Data Subject’s name, e-mail address and password provided by the Data Subject.

Providing additional information in the created user account is not mandatory. The Data Subject may provide further information at their own discretion.

Optional data that may be provided:

residential address;
telephone number;
date of birth.

If the Data Subject requests a loyalty card or manages accommodation bookings while logged into their user account, the related information will also be available in the user account and will be processed by the Controller in accordance with the relevant sections of this privacy notice.

18.4. Scope of Data Subjects

Natural persons creating a user account on the website.

18.5. Legal Basis of Data Processing

The legal basis for processing during registration and use of the user account is the prior consent of the Data Subject, pursuant to Article 6(1)(a) of the GDPR.

18.6. Retention Period of Personal Data

The Controller processes the data until the withdrawal of the Data Subject’s consent or until the user account ceases to exist.

In the event of deletion of the account, personal data shall be deleted.

The Data Subject may withdraw their previously provided consent at any time and may also request deletion of their user account at any time.

18.7. Source of Personal Data

The source of personal data is the Data Subject.

18.8. Access to Personal Data

The list of processors engaged by the Controller is included in Section 25 of this privacy notice.

18.9. Consequences of Failure to Provide Personal Data

Providing the data required for registration of the user account is necessary; without such data, the account cannot be created.

However, neither requesting a loyalty card nor making an accommodation booking requires the existence of a user account.

18.10. Automated Decision-Making and Profiling

No automated decision-making or profiling takes place during the processing.

19. Data processing related to satisfaction surveys and receiving guest feedback

19.1. Description of data processing

As a Data Controller, our objective is to provide high-quality services to the guests of our hotels; therefore, we provide and encourage guests to evaluate our services upon departure from the hotels and to share their opinions regarding the experiences gained during their stay. Based on the feedback and evaluations provided by Data Subjects, the Data Controller continuously reviews the quality of its services, thereby ensuring the maintenance of an appropriate standard and introducing improvements where necessary.

Individual hotels may also conduct additional satisfaction surveys, for which detailed information is provided in the respective hotel’s privacy notice relating to accommodation services.

19.2. Purpose of data processing

The purpose of data processing is to receive and retain feedback regarding hotel services.

If the Data Subject booked accommodation through the website, following departure from the relevant hotel, the Data Controller sends guests an automated e-mail requesting them to evaluate and review hotel services both on the website and on external platforms (e.g. Google).

In the case of bookings made through intermediary service providers, guests may voluntarily share their feedback on the relevant intermediary service provider’s platform designated for this purpose. In relation to such reviews, the respective intermediary service provider acts as an independent Data Controller.

19.3. Personal data processed

The Data Controller processes the personal data provided by the Data Subject in connection with the satisfaction survey and guest feedback, as well as, in the case of bookings made through the website, the Data Subject’s e-mail address required for sending the automated satisfaction survey e-mail.

19.4. Categories of Data Subjects

Guests using hotel services who provide feedback regarding accommodation services.

19.5. Legal basis for data processing

The legal basis for data processing is the legitimate interest of the Data Controller pursuant to Article 6(1)(f) of the GDPR, namely the interest of obtaining up-to-date information regarding guests’ satisfaction with hotel services.

The Data Controller’s legitimate interest also includes receiving feedback on various aspects of its services and developing such services based on feedback in order to improve guest satisfaction. In this way, the Data Controller can continuously ensure the maintenance of high-quality services, which is an essential condition for the successful operation of its business.

19.6. Retention period of personal data

The Data Controller processes data relating to electronically submitted reviews and evaluations for a period of up to 1 year following their submission.

19.7. Source of personal data

The source of personal data is the Data Subject.

19.8. Access to personal data

The list of data processors engaged by the Data Controller is included in Section 25 of this Privacy Notice.

19.9. Consequences of failure to provide personal data

Providing personal data is voluntary. Failure to provide such data has no consequences; however, feedback provided by guests significantly supports the activities of the Data Controller.

19.10. No automated decision-making or profiling takes place during the data processing.

20. Data processing related to event organisation

20.1. Description of data processing

A third party, which may be a legal entity (e.g. a business organisation) or a private individual, may wish to hold an event (hereinafter jointly referred to as the “Event”) at one of the hotels operated by the Data Controller. The Data Controller provides the opportunity to organise such Events.

If participants of the Event do not use the accommodation services provided by the Data Controller, data processing is carried out solely in relation to the Event organiser (or, in the case of a legal entity organiser, the organiser’s contact person) for the purposes of concluding and performing the contract and issuing invoices.

If participants of the Event also use the accommodation services provided by the Data Controller, the Data Controller also processes personal data relating to those participants.

20.2. Purpose of data processing

The purpose of data processing is to provide programmes and events, including cases where the Data Controller only provides the venue for an event while participants do not request accommodation.

The purpose of processing health-related or other special categories of personal data voluntarily provided by the Data Subject is to ensure the provision of services appropriate to the Data Subject’s needs, health condition and requirements.

20.3. Personal data processed

If participants of the Event do not use the accommodation services of the Data Controller, the Data Controller processes the following data regarding the Event organiser:

the name of the organiser or its contact person;
the contact details of the organiser or its contact person; and
the data required for issuing an invoice, where the invoice is issued in the name of a private individual.

In this case, the Data Controller does not process the names or other personal data of participants. In the event of food intolerance or food allergy, the Data Controller only becomes aware of the existence of such condition and the number of affected persons.

If participants of the Event use accommodation services provided by the Data Controller, in addition to the data relating to the organiser (and its contact person), the Data Controller processes the participants’ data as guests in accordance with the privacy notice applicable to the accommodation services of the relevant hotel.

The Data Controller provides the opportunity for Data Subjects to provide information regarding food intolerances, allergies or other special requirements, which may involve the processing of special categories of personal data.

20.4. Categories of Data Subjects

Persons participating in the Event.

20.5. Legal basis for data processing

With regard to the organiser, the legal basis for data processing is Article 6(1)(b) of the GDPR, i.e. the performance of the contract relating to the organisation and execution of the Event.

With regard to Event participants and the organiser’s contact person, the legal basis is Article 6(1)(f) of the GDPR, namely the legitimate interest of the Data Controller and the organiser as a third party in ensuring that the Event is organised in accordance with the organiser’s and participants’ requirements and that all authorised persons are able to participate.

The legal basis permitting the processing of special categories of personal data is the explicit consent of the Data Subject pursuant to Article 9(2)(a) of the GDPR.

20.6. Retention period of personal data

The Data Controller processes data relating to the performance of the contract for 5 years, until the expiry of the general limitation period applicable to civil law claims.

Special categories of personal data are deleted following the use of the services by the Data Subject.

20.7. Source of personal data

The source of personal data is the Data Subject.

20.8. Access to personal data

The personal data of Data Subjects may be accessed by those employees of the Data Controller whose job responsibilities require the processing of such data.

The list of data processors engaged by the Data Controller is included in Section 25 of this Privacy Notice.

20.9. Consequences of failure to provide personal data

Providing personal data is necessary for contractual performance, except for special categories of personal data relating to the Data Subject.

Without such data, the Data Subject cannot participate in the Event, and the Data Controller cannot organise the Event in accordance with the organiser’s requirements.

20.10. No automated decision-making or profiling takes place during the data processing.

21. Cooperation with partners regarding products of catering establishments

21.1. Description of data processing

In connection with catering establishments operated by the hotels and/or baths operated by the Data Controller, cooperation agreements may be concluded with partners regarding services such as food delivery services (for example, Foodora or Wolt), under which the Data Controller offers products of the relevant hotel’s catering establishment for ordering through the partner’s platform.

Where such cooperation exists, the Data Controller processes personal data in relation to persons ordering products from the Data Controller through the partner platform.

In such cases, the Data Subject orders the selected product through the partner platform, and the partner transfers the data necessary for fulfilling the order to the Data Controller through the channel provided by the partner.

In principle, complaints relating to orders are handled by the partner. However, if the complaint concerns a product provided by the Data Controller, the partner transfers the data necessary for handling the complaint to the Data Controller, which proceeds in accordance with Section 16 of this Privacy Notice.

During data processing related to orders, both the Data Controller and the partner act as independent Data Controllers.

21.2. Purpose of data processing

The purpose of data processing is to fulfil orders placed through the partner’s platform for products offered by catering establishments operated by hotels and/or baths operated by the Data Controller.

21.3. Personal data processed

From the order data initiated through the partner platform, the Data Controller processes the data necessary for fulfilling the order and issuing simplified invoices, in particular:

the name of the Data Subject;
information relating to the ordered product and any special requirements indicated by the Data Subject;
the selected payment method.

If the Data Subject requests the issuance of a full-content invoice instead of a simplified invoice, the Data Controller also processes the data necessary for this purpose in accordance with Section 14 of this Privacy Notice.

21.4. Categories of Data Subjects

Data Subjects who place orders through the partner platform for products offered by catering establishments operated by hotels and/or baths operated by the Data Controller.

21.5. Legal basis for data processing

Data processing is necessary for the performance of the contract relating to the order; therefore, its legal basis is Article 6(1)(b) of the GDPR.

As a general rule, processing of special categories of personal data under Article 9(1) of the GDPR does not take place in connection with orders, except where the Data Subject voluntarily provides information regarding food intolerance or food allergy among their special requirements relating to the order.

In such cases, the legal basis permitting the processing of special categories of personal data is the explicit consent of the Data Subject pursuant to Article 9(2)(a) of the GDPR.

21.6. Retention period of personal data

The Data Controller deletes order-related data at the end of the day following delivery.

Receipts and simplified invoices are retained for at least 8 years in accordance with Section 169 of the Accounting Act.

21.7. Source of personal data

The source of personal data is the partner, which in the case of the Foodora platform is Delivery Hero Hungary Kft. (registered office: 1095 Budapest, Soroksári út 30-34. Building D, 2nd floor), and in the case of the Wolt platform is Wolt Magyarország Kft. (registered office: 1085 Budapest, Salétrom utca 4. ground floor).

21.8. Access to personal data

The personal data of Data Subjects may be accessed by those employees of the Data Controller whose job responsibilities require the processing of such data.

The list of data processors engaged by the Data Controller is included in Section 25 of this Privacy Notice.

21.9. Consequences of failure to provide personal data

Providing personal data is necessary for contractual performance, except for special categories of personal data relating to the Data Subject. Without such data, the Data Controller cannot fulfil the Data Subject’s order.

21.10. No automated decision-making or profiling takes place during the data processing.

22. Data processing related to restaurant reservations

22.1. Description of data processing

Restaurants are often operated in the hotels managed by the Data Controller. In connection with providing restaurant services and ensuring that restaurant capacity can be planned efficiently, the Data Controller enables Data Subjects to make advance table reservations through various channels. Depending on the practice of the relevant hotel, reservations may be made by telephone, e-mail, in person at the hotel reception, or directly at the restaurant.

In certain cases, the Data Subject is required to place their chosen food order already at the time of advance reservation and to pay for it before using the service. In such cases, the Data Controller issues an identification card to be used at the restaurant operating within the hotel managed by the Data Controller. The Data Subject is entitled to receive the pre-ordered and prepaid meal upon presenting this card.

Based on cooperation agreements concluded with certain partners, the Data Controller may also provide discounted dining opportunities in the hotels it operates to persons designated by the partner, in particular the partner’s employees. The Data Controller is entitled to verify whether a person designated by the partner is eligible for the discounted dining opportunity.

The management of restaurant reservations necessarily involves the processing of personal data.

22.2. Purpose of data processing

In the case of restaurant reservations, the purpose of data processing is to process requests for table reservations at restaurants operating in hotels managed by the Data Controller, to secure the reservation of the relevant table, and to maintain related communication with the Data Subject.

In the case of food intolerances, allergies or special requirements, the purpose of data processing is to preserve and protect the health of the Data Subject and to provide meals in accordance with the Data Subject’s personal dietary preferences.

In the case of cards issued for meals ordered and paid for in advance, the purpose of data processing is to identify the Data Subject, provide the ordered and paid meal, and verify the Data Subject’s entitlement thereto.

In the case of discounted dining provided under a cooperation agreement, the purpose of data processing is also to ensure that the Data Controller can identify persons designated by the partner as eligible for discounted dining, provide them with discounted meals under the individual terms agreed in the cooperation agreement, and, where necessary, verify their eligibility to use the discounts.

22.3. Personal data processed

For the purpose of providing restaurant reservations, including discounted dining provided under cooperation agreements, the Data Controller processes:

the name of the Data Subject;
the telephone number of the Data Subject;
the e-mail address of the Data Subject;
the duration of stay;
information relating to special requirements and any other data provided at the discretion of the Data Subject.

For invoicing purposes, the Data Controller also processes the data specified in Section 14 of this Privacy Notice.

In the case of meals ordered and paid for in advance, the Data Subject receives an identification card used at the restaurant operating within the hotel managed by the Data Controller. The card contains information regarding the ordered meal (breakfast, lunch, dinner or half board), the number of the service invoice issued, the location where the meal was paid for, and the period of entitlement.

Information provided in relation to special requirements qualifies as special categories of personal data, in particular data concerning health status or religious beliefs, where the special diet is justified by a health condition (e.g. food intolerance or food allergy) or religious belief.

22.4. Categories of Data Subjects

Persons making table reservations at restaurants operated in hotels managed by the Data Controller, who may be hotel guests as well as persons who do not use the accommodation services of the Data Controller (for example, persons designated by partners who have concluded cooperation agreements with the Data Controller and who are entitled to use the service).

22.5. Legal basis for data processing

The legal basis for processing personal data carried out for the purpose of providing meals based on restaurant reservations, as well as discounted dining provided under cooperation agreements, is the legitimate interest of the Data Controller pursuant to Article 6(1)(f) of the GDPR, namely the interest of ensuring that meals can be provided to the Data Subject in accordance with their reservation and that the Data Subject can be identified for this purpose.

In the case of discounted dining, the legitimate interest of the Data Controller and the partner as a third party can also be identified, namely that the Data Controller is able to identify the person sent by the contractual partner and provide the ordered discounted meal in accordance with the cooperation agreement concluded with the partner.

Where the Data Subject voluntarily provides special categories of personal data (e.g. health data or religious beliefs) during the reservation process, the legal basis permitting the processing of such data is the explicit consent of the Data Subject pursuant to Article 9(2)(a) of the GDPR.

22.6. Retention period of personal data

If the restaurant reservation is cancelled, the related data will also be deleted without delay.

In the case of discounted dining actually provided under a cooperation agreement, as well as dining provided in restaurants operating within hotels managed by the Data Controller based on a reservation, the Data Controller processes personal data during the period of use of the service and, with regard to invoices, retains such data for at least 8 years in accordance with Section 169 of the Accounting Act.

22.7. Source of personal data

The source of personal data is the Data Subject. In the case of discounted dining provided under a cooperation agreement, the source may also be the partner or directly the Data Subject.

22.8. Access to personal data

The personal data provided may be accessed by employees of the Data Controller whose job responsibilities include the processing of such data.

The Data Controller does not transfer the data to third parties.

The list of data processors engaged by the Data Controller is included in Section 25 of this Privacy Notice.

22.9. Consequences of failure to provide personal data

Without providing the data essential for recording the reservation, the restaurant reservation cannot be completed; therefore, the Data Controller cannot secure a table reservation for the Data Subject and no related data processing will take place.

In the case of cooperation agreements concluded with partners, providing personal data is also necessary, as without such data the Data Controller cannot identify persons designated by the partner as eligible persons and cannot provide them with discounted dining in accordance with the terms of the cooperation agreement.

22.10. No automated decision-making or profiling takes place during the data processing.

23. Data processing related to job advertisements and recruitment procedures

23.1. Description of data processing

The Data Controller publishes its current job advertisements on the website available at https://hunguesthotels.hu/hu/karrier/. Anyone who meets the requirements specified in the relevant job advertisement may apply by e-mail.

23.2. Purpose of data processing

The purpose of data processing is to conduct the selection process required to fill the advertised position and, during the selection process, to obtain information about applicants’ professional and personal characteristics, educational qualifications and previous work experience in order to enable the Data Controller to identify the person most suitable for the vacant position.

23.3. Personal data processed

The Data Controller processes the data provided by the Data Subject in the curriculum vitae and, where applicable, in the cover letter submitted by the Data Subject.

If the Data Subject provides additional personal data to the Data Controller, such data will also be processed in accordance with this section.

If certain documents are not required by the Data Controller for assessing the Data Subject’s job application, such documents will be deleted or destroyed immediately.

If the Data Subject applies for a position for which obtaining a specific qualification, driving licence or educational qualification is a prerequisite, the Data Controller will examine the relevant information.

If the job application process includes the completion of a test or questionnaire for the purpose of assessing the applicant’s professional competencies, the Data Controller also processes the information contained therein.

23.4. Categories of Data Subjects

Applicants for positions advertised by the Data Controller.

23.5. Legal basis for data processing

The processing of personal data is necessary for taking steps at the request of the Data Subject prior to entering into an employment contract; therefore, the legal basis for processing is Article 6(1)(b) of the GDPR.

By submitting an application for an advertised position to the Data Controller, the Data Subject clearly expresses their intention to apply for the position and participate in the necessary selection process.

An essential part of the selection process is that the employer assesses the professional and personal characteristics of applicants in advance in order to determine whether the applicant is suitable for the position.

23.6. Retention period of personal data

The Data Controller processes personal data only until the position has been finally filled (until the completion of the selected candidate’s probationary period), but for no longer than 6 months.

23.7. Source of personal data

The source of personal data is the Data Subject.

23.8. Access to personal data

The list of data processors engaged by the Data Controller is included in Section 25 of this Privacy Notice.

23.9. Consequences of failure to provide personal data

Providing personal data is not mandatory; however, it is an essential condition for assessing the application and participating in the selection process.

23.10. No automated decision-making or profiling takes place during the data processing.

24. Processing of Personal Data in Connection with the Job Applicant Database

24.1. Description of Data Processing

The Controller publishes its current job vacancies on the subpage available at https://hunguesthotels.hu/hu/karrier/. However, regardless of these published vacancies, any person may send their CV to the Controller or request that the Controller retain their CV even if they were not selected for the position they applied for, provided that the Controller considers their CV promising.

24.2. Purpose of Data Processing

The purpose of data processing is the establishment of a job applicant database. The purpose of processing the CVs of data subjects who voluntarily join the database is to enable the Controller to find suitable employees for its vacant positions as quickly as possible.

24.3. Personal Data Processed

The Controller processes the data provided by the Data Subject in the CV submitted by them.

24.4. Scope of Data Subjects

Persons included in the Controller’s job applicant database.

24.5. Legal Basis of Data Processing

The legal basis for processing personal data is the Data Subject’s consent pursuant to Article 6(1)(a) of the GDPR.

The Data Subject is entitled to withdraw their consent to data processing at any time by notifying the Controller through any of the contact details specified in this Privacy Notice.

24.6. Retention Period of Personal Data

The processing of personal data shall continue until the withdrawal of the Data Subject’s consent, but for no longer than 6 months from the date of joining the database.

24.7. Source of Personal Data

The source of personal data is the Data Subject.

24.8. Access to Personal Data

The list of processors engaged by the Controller is included in Section 25 of this Privacy Notice.

24.9. Consequences of Failure to Provide Personal Data

Providing personal data is not mandatory; however, it is an essential condition for joining the Controller’s job applicant database.

24.10. Automated Decision-Making and Profiling

No automated decision-making or profiling takes place during the processing of personal data.

25. Identification of Data Processors

25.1. A processor may process the personal data of Data Subjects exclusively for the purposes determined by the Controller and specified in the relevant agreement, and in accordance with the Controller’s instructions. The processor has no independent decision-making authority regarding the processing of personal data.

The processor has undertaken confidentiality obligations and contractual guarantees regarding the protection and preservation of personal data accessed during the performance of its tasks.

25.2.

During its data processing activities, the Controller uses the following processors:

1. Organisation responsible for the maintenance, development and troubleshooting of the website:

KMAK Kelet-Magyarországi Adatközpont Szolgáltató Korlátolt Felelősségű Társaság

Registered seat: 5000 Szolnok, Szapáry utca 20. A. ép. 3. em. 6. ajtó
E-mail: info@kmak.hu
Website: https://www.kmak.hu/

2. Organisation responsible for operating and maintaining the IT infrastructure (primarily the e-mail system), providing HelpDesk services, and providing hosting services for the website:

mBIT Technológiai Szolgáltató Zrt.

Registered seat: 3000 Hatvan, Borház út 3.
Telephone: +36 30 977 4535
Website: https://mbitech.hu

3. Developer of the hotel service management software used during the provision of accommodation services, which has access to reservation-related data:

MT-HostWare Számítástechnikai Korlátolt Felelősségű Társaság

Registered seat: 1149 Budapest, Róna utca 120–122.
Telephone: +36 1 469 9000
Website: https://hostware.hu/

4. Developer of the management software connecting reservation systems, which has access to reservation-related data:

D-EDGE SAS

Registered seat: 14/16, boulevard Poissonnière, 75009 Paris, FRANCE
Telephone: +33 1 44 71 05 05
Website: https://www.d-edge.com/

5. Provider of the software and hardware system used for operating the loyalty card system and manufacturer of the cards:

CARDNET Kártyarendszerek és -szolgáltatások Zártkörűen Működő Részvénytársaság

Registered seat: 1135 Budapest, Reitter Ferenc utca 46–48.
E-mail: info@cardnet.hu
Telephone: +36 1 346-0500
Website: http://www.cardnet.hu/

6. Provider of the software used for generating invoices issued for payment of Gift Card prices:

KONZORCIA Kereskedelmi, Szolgáltató és Szoftverfejlesztő Korlátolt Felelősségű Társaság

Registered seat: 1012 Budapest, Pálya utca 9. 3rd floor
E-mail: info@konzorcia.hu
Telephone: +36 1 487 3015
Website: http://konzorcia.hu/

7. Provider of the software used for measuring guest satisfaction and sending automated e-mails requesting guest feedback:

CA Customer Alliance GmbH

Registered seat: Hausvogteiplatz 12, 10117 Berlin, GERMANY
E-mail: data-protection@customer-alliance.com
Website: https://www.customer-alliance.com/en/

26. Data Protection and Data Security

26.1. In the course of its data processing activities, the Controller ensures the security of personal data through technical and organisational measures, as well as internal procedural rules, in order to enforce applicable legislation and other data protection and confidentiality requirements.

The Controller protects the processed data through appropriate measures, in particular against unauthorised access, alteration, transfer, disclosure, deletion or destruction, as well as against accidental destruction, damage, and becoming inaccessible due to changes in the applied technology.

26.2. The processing of personal data is carried out solely for the lawful purposes described in this Privacy Notice, to the extent necessary and proportionate for achieving such purposes, in accordance with applicable laws and recommendations, and with appropriate security measures in place.

26.3. In the agreements concluded with the processors engaged by the Controller, the Controller requires the processors to ensure an appropriate level of data security in accordance with applicable laws and to carry out lawful data processing activities during the processing of personal data.

27. Rights of the Data Subject in Relation to Data Processing

27.1. Right to Information

27.1.1. You may obtain information about the processing of your personal data at any time by reading this Privacy Notice. Upon your request, oral information may also be provided, provided that your identity has been verified by other means.

You may request information both during and after the period in which your personal data is being processed. The information provided shall cover all essential details of the processing, as well as the manner in which you may exercise your rights.

Upon your request, the Controller shall also inform you of the measures taken in response to your requests, or the reasons for not taking action, including information on the available means of submitting a complaint.

27.1.2. Providing information is free of charge. If your request is clearly unfounded or excessive, in particular due to its repetitive nature, the Controller may, taking into account the administrative costs involved in providing the requested information or taking the requested action:

• charge a reasonable fee; or
• refuse to act on the request.

27.1.3. The Controller shall provide the information within the shortest possible period following submission of the request, without undue delay and no later than one month from receipt of the request.

27.2. Data Processing Based on Consent
27.2.1. Where the legal basis for processing is the consent of the Data Subject, the Data Subject shall have the right to withdraw their previously given consent at any time.

However, it is important to note that withdrawal of consent may only apply to personal data for which there is no other legal basis for processing.

Where there is no other legal basis for processing the personal data concerned, the Controller shall permanently and irreversibly delete such personal data following withdrawal of consent.

Withdrawal of consent shall not affect the lawfulness of processing carried out on the basis of consent before its withdrawal, in accordance with the GDPR.

27.3. Right of Access
27.3.1. You have the right to access the personal data processed about you. Upon your request, the Controller shall inform you whether your personal data are being processed and shall provide information on all relevant circumstances relating to the specific processing activity.

27.3.2. Under the right of access, you may request a copy of the personal data processed by the Controller. The Controller shall provide the first copy free of charge.

For any additional copies requested by you, the Controller may charge a reasonable fee based on administrative costs.

27.4. Right to Rectification
27.4.1. You have the right to request that the Controller correct inaccurate personal data concerning you without undue delay.

Taking into account the purpose of processing, you also have the right to request that incomplete personal data be completed, including by means of providing a supplementary statement.

27.4.2. When requesting correction (modification) of personal data, you must substantiate the accuracy of the requested amendment and demonstrate that you are the person entitled to request such modification.

The Controller can only assess whether the new information is accurate and whether the previous data may be amended based on such verification.

27.4.3. The Controller also draws your attention to the importance of notifying the Controller of any changes to your personal data as soon as possible, thereby facilitating lawful data processing and the effective exercise of your rights.

27.5. Right to Erasure
27.5.1. You have the right to request that the Controller erase personal data concerning you without undue delay, and the Controller shall erase such personal data without undue delay where one of the following grounds applies:

a) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;

b) you withdraw your consent on which the processing is based and there is no other legal ground for processing;

c) you object to the processing and there are no overriding legitimate grounds for the processing;

d) the personal data have been unlawfully processed by the Controller;

e) the personal data must be erased in order to comply with a legal obligation under European Union or Member State law applicable to the Controller;

f) the personal data were collected in relation to the offering of information society services.

27.6. Right to Restriction of Processing
27.6.1. Upon your request, the Controller shall restrict processing where one of the following applies:

you contest the accuracy of the personal data, in which case the restriction shall apply for the period necessary for the Controller to verify the accuracy of the personal data;
the processing is unlawful and you oppose the erasure of the personal data and request restriction of their use instead;
the Controller no longer needs the personal data for processing purposes, but you require them for the establishment, exercise or defence of legal claims;
you have objected to processing; in this case, the restriction shall apply for the period necessary to determine whether the legitimate grounds of the Controller override your interests, rights and freedoms (among the processing activities described in this Privacy Notice, this applies only to processing activities based on legitimate interest).

27.7. Right to Data Portability
27.7.1. You have the right to receive the personal data concerning you, which you have provided to the Controller, in a structured, commonly used and machine-readable format.

You also have the right to request that the Controller transmit such personal data directly to another controller, where technically feasible, without hindrance from the Controller to which the personal data were provided, provided that:

a) the processing is based on your consent or on a contract concluded with you; and

b) the processing is carried out by automated means.

27.8. Right to Object
27.8.1. Where the processing of your personal data is based on the legitimate interest of the Controller (Article 6(1)(f) of the GDPR), or where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller (Article 6(1)(e) of the GDPR), you shall have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data, including profiling based on those provisions.

27.8.2. In such a case, the Controller may no longer process the personal data unless the Controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or which relate to the establishment, exercise or defence of legal claims.

28. Fulfilment of Data Subjects’ Requests

28.1.1. Data Subjects may exercise the above-mentioned rights by sending an electronic message to the e-mail address adatvedelem@hunguesthotels.hu, by sending a postal letter to the postal address of the Controller, or in person at the registered office or premises of the Controller.

The Controller shall commence the examination and fulfilment of the request without undue delay following its receipt. The Controller shall inform the Data Subject about the measures taken in response to the request within one month from the date of receipt of the request.

If the Controller is unable to comply with the request, it shall inform the Data Subject of the reasons for the refusal and of the available legal remedies.

29. Legal Remedies

29.1. If you consider that the processing of your personal data infringes the provisions of the GDPR or the Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information (the “Infotv.”), or if you consider the manner in which the Controller processes your personal data to be prejudicial, we recommend that you first contact the Controller with your complaint. All complaints shall be investigated.

29.2. If, despite your complaint, you continue to object to the way in which the Controller or the processor engaged by the Controller processes your personal data, or if you wish to contact the competent authority directly, you may submit a complaint to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).

Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary
Postal address: 1363 Budapest, Pf.: 9., Hungary
E-mail: ugyfelszolgalat@naih.hu
Website: www.naih.hu

29.3. You also have the right to bring proceedings before a court for the protection of your personal data if, in your opinion, the processor engaged by the Controller, the Controller, or a joint controller processes your personal data in breach of applicable laws.

The court shall proceed with the case as a matter of priority. In such proceedings, you may freely decide whether to submit your claim to the court having jurisdiction according to your permanent residence (registered address) or your temporary residence address.

Budapest, 6 August 2026

Hunguest Zrt.