Chalet Apartment Hotel Ltd. Data Processing Information

1. Introduction
2. Definitions
3. Principles of data processing at Chalet Apartment Hotel Ltd
4. Scope of personal data, purpose, legal basis, and duration of data processing
4.1. Data of website visitors
4.2. Data related to guest nights
4.2.1. Offer and confirmation of guest nights
4.2.2. Record of guest nights
4.3. Newsletter
4.4. Sweepstakes
4.5. A. Data of website visitors
4.5. B Management of website "cookies"
4.6. Found items
4.7. Correspondence of Chalet Apartment Hotel Ltd. with customers
5. 5. Method of storing personal data, data security
6. Data controller details, contact information
7. Rights of the data subject, enforcement options
7.1 Right to information
7.2 Right of access by the data subject
7.3 Right to rectification
7.4 Right to erasure
7.5 Right to restriction of processing
7.6 Right to data portability
7.7 Right to object
7.8 Automated individual decision-making, profiling
7.9 Right to withdraw consent
7.10 Right to lodge a complaint with a supervisory authority
7.11 Data protection authority proceedings
8. Other provisions

Chalet Apartment Hotel Ltd.:

1. Chalet Apartment Hotel Limited Liability Company
Chalet Apartment Hotel Ltd. (short name of the company: Chalet Apartment Hotel Ltd., registered office: 1149 Budapest, Bíbor utca 14-16. ground floor, door 25., tax number: 32480140-2-42, company registration number: 01-09-426383) Chalet Apartment Hotel Ltd. is committed to protecting the personal data of its customers and partners, considering it vitally important to respect the informational self-determination rights of its customers. Personal data is handled confidentially, and all necessary security, technical, and organizational measures are taken to ensure the security of the data. Chalet Apartment Hotel Ltd. sets out its data processing principles below, presenting the expectations it formulates for itself as a data controller. Its data processing principles are in line with the current data protection laws, including in particular:
- Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Info Act);
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016;
- Act V of 2013 of the Civil Code (Ptk.);
- Act C of 2000 on Accounting (Accounting Act);
- Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services (Eker. tv.);
- Act CL of 2017 on the Rules of Taxation (Art.);
- Act C of 1990 on Local Taxes;
- Act CXXXIII of 2005 on the Rules of Personal and Property Protection, as well as on Private Investigation Activities (SzVMt.);
- Act XLVIII of 2008 on the Fundamental Conditions and Restrictions of Economic Advertising Activities (Grt.)

If you would like to contact our company, you can reach our data protection officer at the following contact details: Email: director@petnehazy-aparthotel.com Mailing address: "Petneházy Aparthotel" Address: 1029 Budapest, Feketefej utca 2-4.

2.1. Data subject: any identified or identifiable natural person based on specific personal data, directly or indirectly.
2.2. Personal data: any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
2.3. Consent: any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her
2.4. Objection: a statement by the data subject objecting to the processing of personal data and requesting the cessation of processing or the erasure of processed data.
2.5. Data controller: a natural or legal person, or an organization without legal personality, which determines the purposes and means of the processing of personal data, makes decisions regarding the processing (including the means used), and carries out or has the processing carried out by the data processor it has engaged.
2.6. Data processing: any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction, as well as photographing, sound or image recording, and recording of physical characteristics suitable for the identification of a person (e.g., fingerprint, DNA sample, iris scan).
2.7. Data transmission: making data accessible to a specified third party.;
2.8. Disclosure: making data accessible to anyone.
2.9. Data erasure: rendering data unrecognizable in a way that their restoration is no longer possible.;
2.10. Data marking: labeling data for the purpose of distinguishing them
2.11. Data blocking: labeling data for further processing in a definitive or specified period.
2.12. Data destruction: complete physical destruction of the data carrier containing the data;
2.13.Data processing: performing technical tasks related to data processing, regardless of the method and tool used for execution, and the location of the application, provided that the technical task is performed on the data;
2.14. Data processor: a natural or legal person, or an organization without legal personality, which, under a contract concluded with the data controller, including contracts concluded pursuant to legal provisions, carries out the processing of data;
2.15. Third party: any natural or legal person, or an organization without legal personality, who or which is not the data subject, the data controller, or the data processor;
2.16. Third country: any state that is not a member of the European Economic Area.

3. Principles of data processing at Chalet Apartment Hotel Ltd.

Personal data may be processed if:
a)the data subject has given consent, or
b) it is ordered by law or by a local government decree based on the law, for a purpose based on public interest (mandatory data processing).
Personal data may also be processed if obtaining the data subject's consent is impossible or would involve disproportionate cost, and the processing of personal data is necessary for the data controller to fulfill a legal obligation, or for the legitimate interests pursued by the data controller or a third party, provided that the enforcement of such interest is proportionate to the restriction of the data subject's right to the protection of personal data.
The declaration of a minor under the age of 16, who is incapacitated or partially incapacitated, requires the consent of their legal representative, except for services where the declaration concerns data processing that occurs frequently in everyday life and does not require special consideration. If the data subject is unable to give consent due to incapacity or other unavoidable reasons, the personal data of the data subject may be processed to the extent necessary to protect their or another person's vital interests, as well as to avert or prevent immediate danger to the life, physical integrity, or property of individuals, during the existence of obstacles to obtaining consent.
If personal data are collected with the consent of the data subject, the collected data may be processed by the data controller without further separate consent:
a) for the fulfillment of legal obligations concerning them, or
b) for the enforcement of the legitimate interest of the data controller or a third party, without further separate consent, even after the withdrawal of consent by the data subject.
Personal data may only be processed for specific purposes, in order to exercise rights and fulfill obligations. At every stage of data processing, it must comply with this purpose, and the collection and processing of data must be fair.
Only personal data that are essential for the realization of the purpose of data processing may be processed, to the extent and duration necessary for achieving the purpose.
Personal data may only be processed with the consent based on appropriate information.
Before commencing data processing, the data subject must be informed whether the processing of data is based on consent or is mandatory.The data subject must be informed - clearly, understandably, and in detail - of all facts related to the processing of their data, especially the purpose and legal basis of data processing, the person or entity authorized to process and process the data, the duration of data processing, whether the personal data of the data subject are processed by the data controller based on the data subject's consent and the fulfillment of legal obligations by the data controller or a third party's legitimate interest, and who may access the data.
The information must also cover the data subject's rights related to data processing and the options for legal remedies.During data processing, it is necessary to ensure the accuracy, completeness, and timeliness of the data, and that the data subject can only be identified for the time necessary for the purpose of data processing.
Personal data may be transmitted to a data controller or data processor processing data in a third country if the data subject has expressly consented to it, or if the conditions prescribed above for data processing are met, and if the data transferred to a third country are adequately protected during the processing and processing of the data. Transmission to EEA countries shall be considered as data transmission within the territory of Hungary.

The data processing activities of Chalet Apartment Hotel Ltd. are based on voluntary consent. However, in certain cases, the processing, storage, and transmission of specified data are mandatory due to contracts and regulations, of which our partners are separately notified.
We would like to draw the attention of data providers to Chalet Apartment Hotel Ltd. that if they provide personal data of others, it is their obligation to obtain the consent of the data subject.

www.petnehazy-aparthotel.com Purpose of processing: During website visits, the service provider records visitor data to monitor service operation, provide personalized service, and prevent abuses. Legal basis of processing: Consent of the data subject, as well as Section 13/A (3) of Act CVIII of 2001 on certain issues of electronic commerce services and information society services. Processed data: Date, time, IP address, visited page URL, previously visited page URL, data related to the user's operating system and browser. Duration of processing: 30 days from the website visit.During analysis of log files, Chalet Apartment Hotel Ltd. does not link the data obtained to other information and does not attempt to identify the user. (An IP address is a numerical sequence used to identify computers accessing the Internet. IP addresses can be used to geographically locate the visitor's computer. However, visited page URLs and date/time data alone are not sufficient for identifying the user, although they may become identifiable when combined with other data, such as those provided during registration.)Processing by External Service Providers: The portal's HTML code includes links from and to external servers independent of Chalet Apartment Hotel Ltd. These links enable direct interaction between the user's computer and the external service provider's server. Visitors are advised that these providers can collect user data due to direct connection and communication with the user's browser. The external service provider's server may deliver personalized content to the user. The connection between Chalet Apartment Hotel Ltd. and the external service provider's server is limited to embedding the latter's code, with no transfer of personal data.The independent measurement and auditing of www.petnehazy-aparthotel.com website traffic and other web analytics data are facilitated by the server of www.google.com as an external service provider. Detailed information about data management can be obtained from the data controller at http://www.google.com/analytics/. To enhance user experience and usability, the code of the service provider available at www.chat4support.hu  is embedded in the website. To facilitate the use of social services, the code of the service provider available at www.facebook.com  is embedded in the website.

4.2.1. Offering and Confirmation of Guest Nights

Purpose of processing: Recordkeeping of guest bookings for accommodation services, differentiation between them, and necessary communication for bookings. Legal basis of processing: Voluntary consent of the data subject, Section 169 (2) of Act C of 2000 on accounting, and Section 6 (5) of Act XLVIII of 2008 on the basic conditions and certain limitations of economic advertising activities. Processed data: Identification number, name, phone number, email address, booking date, bank card details. Duration of processing:

- Billing data: 5 years.
- Bank card data until the end of the booking period.
- For direct marketing inquiries, as specified in section 4.7 of this notice. Data Transmission: For card payments, the payer's identifier, transaction amount, date, and time are transmitted to OTP Bank. The legal basis for data transmission is the consent of the data subject.

Purpose of processing: Providing accommodation services, guest record keeping, differentiation between guests, service provision, communication, behavior analysis, targeted service, ensuring and fulfilling bookings, payments, accounting obligations, and direct marketing inquiries. Legal basis of processing: Voluntary consent of the data subject, Section 169 (2) of Act C of 2000 on accounting, and Section 6 (5) of Act XLVIII of 2008 on the basic conditions and certain limitations of economic advertising activities. Processed data: Identification number, name, address, email address, phone number, date, time, guest's car license plate, nationality, ID card or passport number, date of birth, service-related data (e.g., arrival, departure dates, consumption, sports habits), payment data (date, time, itemized bill details, amount), voucher/coupon/check/voucher number, data on the health status associated with healthcare services, consent to the processing of special data, data on opening and closing times managed by the card access system, and related date and time data, as well as consent to direct marketing inquiries. Duration of processing:
- For direct marketing inquiries, as specified in section 4.7 of this notice, or until the withdrawal of consent for postal direct marketing.
- For accommodation service usage, 5 years from the last guest night.
- For billing data, 5 years. Data Transmission:
- For determining and collecting tourist tax, the guest's serial number, name, address, date of birth, and the number of nights spent are transmitted to the local municipal tax authority.
- For card payments, the payer's identifier, transaction amount, date, and time are transmitted to ERSTE Bank. The legal basis for data transmission is the Tourist Tax Act of 1990 and the Tax Procedure Act of 2017, and in other cases, the consent of the data subject. In case of consent to direct marketing inquiries, the necessary data (name, email address, date, time) will be recorded in the newsletter database and the postal direct marketing database according to section

Purpose of data processing: Sending email newsletters containing commercial advertisements to interested parties, providing information about current updates. Legal basis of processing: Voluntary consent of the data subject and Section 6 (5) of Act XLVIII of 2008 on the basic conditions and certain limitations of economic advertising activities. Scope of processed data: Identification number, name, email address, IP address, date, time, consent given for direct marketing inquiries. Duration of data processing: 2 years from the user's last activity or data update, 24 hours in the case of unconfirmed subscriptions. To prohibit the transmission of direct marketing messages and to request the deletion or modification of personal data, please use the following contact details:

www.petnehazy-aparthotel.com
Purpose of data processing: During website visits, the provider records visitor data to monitor service operation, provide personalized service, and prevent abuse. Legal basis of processing: Consent of the data subject, as well as Section 13/A (3) of Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Eker. tv.). Scope of processed data: Identification number, date, time, visited page address, previously visited page address, data related to the user's operating system and browser, user's computer IP address, and geographic location of the user. Duration of data processing: The user's computer IP address is deleted upon the completion of the visit, while other data is retained for one month. Chalet Apartment Hotel Ltd. does not link the data obtained from log files with any other information and does not seek to identify the user. An IP address is a numerical sequence used to uniquely identify computers accessing the internet. With IP addresses, the geographical location of the visiting computer can be determined. Visited page addresses, along with date and time data, are not suitable for identifying individuals on their own; however, when combined with other data (e.g., provided during form submission), they can be used to draw conclusions about the user. Data Processing by External Providers: The HTML code of the portal contains links to external servers independent of Chalet Apartment Hotel Ltd. These external servers establish direct connections with the user's computer. Visitors are advised that these links allow service providers to collect user data due to direct connection to their servers and direct communication with the user's browser. Potentially personalized content for users is served by the servers of external providers. The connection between Chalet Apartment Hotel Ltd. and the servers of external providers is limited to the inclusion of the latter's codes, and therefore no transfer of personal data occurs. The independent measurement and auditing of website traffic and other web analytics data are supported by Google Analytics servers as an external service provider. Detailed information about data management can be obtained from the data controller at www.google-analytics.com.
To provide their services, external servers place and read small data packets, cookies, on the user's computer, which are available at the following addresses: google.com, facebook.com, chat4support.hu, gpe.cz. Detailed information about data processing can be requested at the provided addresses.
External service providers place and read cookies on the user's computer for personalized service. If the browser sends a previously saved cookie, service providers have the option to associate the user's current visit with previous ones, but only regarding their own content. More information about cookies is available at http://www.adatvedelmiszakerto.hu/cookie. 
Users can delete cookies from their computers or disable cookie usage in their browsers. Generally, cookie management options are available in the Privacy settings under Tools/Settings in browsers, labeled as "cookie" or "suti".

The operator of the website places and reads small data packets, cookies, on the user's computer for personalized service. If the browser sends a previously saved cookie, the service provider can associate the user's current visit with previous ones, but only regarding their own content. Purpose of data processing: Identification of users, differentiation between users, identification of the user's current session, storage of data provided during the session, prevention of data loss, user identification and tracking, display of personalized offers using data recorded during website visits (__utma, __utmb, __utmc, __utmt, __utmz, PHPSESSID, _C4vId). Legal basis of processing: Consent of the data subject. Scope of processed data: Identification number, date, time. Duration of data processing:
- until the session is closed (__utmc, PHPSESSID),
- ten minutes (__utmt),
- thirty minutes (__utmb),
- six months (__utmz),
- one year (_C4vID),
- two years (__utma). More information about cookies is available at http://www.adatvedelmiszakerto.hu/cookie.
Users can delete cookies from their computers or disable cookie usage in their browsers. Generally, cookie management options are available in the Privacy settings under Tools/Settings in browsers, labeled as "cookie" or "suti".
The website uses graphical measuring points, the results of which are recorded by the website server. Based on graphical measuring points, website visitors cannot be identified in the future.

Purpose of data processing: Keeping records of items found on the premises of Petneházy Aparthotel and notifying the owner or finder. Legal basis of processing: Act V of 2013 on the Civil Code, Sections 5:54, 5:59, and 5:61. Scope of processed data: Date and location of finding, name of the finder, contact information, details of the found item. Duration of data processing: One year.

If you have any questions or issues during the use of our services, you can contact the data controller as indicated on the website. Chalet Apartment Hotel Ltd. deletes letters received by post or fax, as well as incoming emails, along with the sender's name, address, fax number or email address, and any other voluntarily provided personal data, after a maximum of five years from the communication.

The IT systems and other data storage locations of Chalet Apartment Hotel Ltd. are located at its headquarters, branches, offices, data processors, and in the server room of ATW Internet Ltd. Address: 11-15 Victor Hugo Street, 1132 Budapest. Chalet Apartment Hotel Ltd. selects and operates information technology tools used for personal data processing in such a way that the processed data:
a) is accessible to authorized persons (availability);
b) its authenticity and authentication are ensured (data authenticity);
c) its immutability can be verified (data integrity);
d) it is protected against unauthorized access (data confidentiality).
Chalet Apartment Hotel Ltd. protects the data with appropriate measures against unauthorized access, alteration, transmission, disclosure, deletion, or destruction, as well as against accidental loss, damage, and becoming inaccessible due to changes in technology. To protect electronically processed data stored in various registries, Chalet Apartment Hotel Ltd. uses appropriate technical solutions to ensure that stored data - unless permitted by law - cannot be directly linked or attributed to the data subject. Depending on the current state of technology, Chalet Apartment Hotel Ltd. takes technical, organizational, and organizational measures to ensure the security of data processing, providing a level of protection appropriate to the risks associated with data processing. The Company maintains:
a) confidentiality: protects information so that only those authorized to access it can do so;
b) integrity: protects the accuracy and completeness of information and processing methods;
c) availability: ensures that when authorized users need it, they can access the desired information and have the necessary tools available.
The IT systems and networks of Chalet Apartment Hotel Ltd. and its partners are protected against computer-supported fraud, espionage, sabotage, vandalism, fire and flood, as well as against computer viruses, intrusions, and denial-of-service attacks. The operator ensures security with server-level and application-level protection procedures.
Users are informed that electronic messages transmitted over the Internet, regardless of protocol (email, web, ftp, etc.), are vulnerable to network threats that lead to unfair activity, dispute of contracts, or disclosure and modification of information. To protect against such threats, the data controller takes all reasonable precautions. The systems are monitored to record any security deviations and provide evidence in the event of any security incidents. System monitoring also allows for the effectiveness of applied precautions to be checked.

On behalf of Petneházy Aparthotel: Chalet Apartment Hotel Ltd
Registered office: 1149 Budapest, Bíbor utca 14-16. Fsz. 25. door
Company registration number: 01-09-426383
Tax identification number: 32480140-2-42
Email: director@petnehazy-aparthotel.com 

The data subject may request information about the processing of their personal data, request correction of their personal data, and, except for mandatory data processing, request deletion or restriction of data in the manner indicated at the time of data collection or through the contact details provided by the data controller.

Chalet Apartment Hotel Ltd., as the data controller, takes appropriate measures to provide data subjects with all the information regarding the processing of personal data mentioned in Articles 13 and 14 of the GDPR, as well as all the information according to Articles 15-22 and 34, in a concise, transparent, understandable, and easily accessible form, clearly and comprehensibly formulated.

The data subject is entitled to receive feedback from the data controller regarding whether their personal data is being processed, and if such processing is underway, to obtain access to personal data and the following information: the categories of personal data processed, the categories of recipients to whom or to which the personal data have been or will be disclosed, including recipients in third countries or international organizations; the envisaged period for which the personal data will be stored; the right to rectification, erasure, or restriction of processing, and the right to object; the right to lodge a complaint with a supervisory authority; information on the source of data; the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject. The data controller shall provide the information within one month from the submission of the request.
This information is free of charge if the data subject has not previously submitted a request for information on the same data scope to the data controller within the current year. Otherwise, Chalet Apartment Hotel Ltd. may charge a fee, which will be communicated to the data subject before fulfilling the request.

The data subject is entitled to request Chalet Apartment Hotel Ltd. to erase their personal data without undue delay if one of the following reasons applies:
- The personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
- The data subject withdraws consent on which the processing is based, and there is no other legal ground for the processing.
- The data subject objects to the processing, and there are no overriding legitimate grounds for the processing.
- The personal data has been unlawfully processed.
- The personal data must be erased to comply with a legal obligation under Union or Member State law to which the data controller is subject.
- The personal data has been collected in relation to the offer of information society services.
Erasure of data cannot be initiated if the processing is necessary:
- for exercising the right of freedom of expression and information;
- for compliance with a legal obligation which requires processing by the data controller for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller;
- for reasons of public interest in the area of public health or for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes;
- for the establishment, exercise, or defense of legal claims.

Upon request of the data subject, Chalet Apartment Hotel Ltd. shall restrict processing if one of the following conditions is met:
- The data subject contests the accuracy of the personal data. In this case, the restriction shall apply for a period enabling the verification of the accuracy of the personal data.
- The processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of their use instead.
- The data controller no longer needs the personal data for the purposes of the processing, but the data subject requires them for the establishment, exercise, or defense of legal claims.
- The data subject has objected to processing. In this case, the restriction shall apply for the period until it is verified whether the legitimate grounds of the data controller override those of the data subject.
If processing is restricted, aside from storage, personal data may only be processed with the data subject's consent or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.

The data subject has the right to receive the personal data concerning them, which they have provided to a data controller, in a structured, commonly used, and machine-readable format and have the right to transmit those data to another data controller.

The data subject has the right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them which is based on public interest or the exercise of official authority vested in the data controller, or on legitimate interests pursued by the data controller or a third party, including profiling based on those provisions.
Upon objection, the data controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject or for the establishment, exercise, or defense of legal claims.

The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

Chalet Apartment Hotel Ltd. shall indemnify any damage caused to others by the unlawful processing of the data subject's data or by a breach of data security. The data controller shall be exempt from liability if the damage was caused by an unavoidable external circumstance beyond the scope of data processing. Compensation shall not be paid if the damage resulted from the intentional or grossly negligent behavior of the injured party.
Remedies and complaints can be addressed to the National Authority for Data Protection and Freedom of Information:
- Name: Nemzeti Adatvédelmi és Információszabadság Hatóság
- Headquarters: 1125 Budapest, Szilágyi Erzsébet fasor 22/C
- Mailing address: 1530 Budapest, Pf 5.
- Phone: +36 1 3911400
- Fax: +36 1 3911410
- Email: ugyfelszolgalat@naih.hu
- Website: http://www.naih.hu

Information about data processing not listed in this notice will be provided at the time of data collection.
We inform our customers that the court, public prosecutor, investigative authority, administrative authority, National Authority for Data Protection and Freedom of Information, and other authorized bodies may contact the data controller to provide information, disclose data, transfer data, or make documents available based on legal authorization. Chalet Apartment Hotel Ltd. shall only provide personal data to authorities to the extent necessary to achieve the purpose of the request, provided that the authority has specified the exact purpose and scope of the data.