Privacy policy
Contents
1. Introduction
1.1. Purpose of this Privacy Policy
1.2. Details and contact information of the Data Controller and of the Data Processors it uses
1.3. General rules of data processing
2. Data processing carried out during use of the website
2.1. Contacting us through the website
2.2. Data processing relating to profiles created on social media sites
2.3. Use of cookies
2.4. Electronic surveillance system
2.5. Other data processing
3. How personal data is stored
3.1. Security of data processing
4. Rights of Users
1. INTRODUCTION
This Privacy Policy provides information on the data processing carried out by INEX-TRADE Kft., as data controller (hereinafter: the Data Controller), through the website https://kosborpanzio.hu which it operates (hereinafter: the website).
Please read the following information carefully.
1.1. Purpose of this Privacy Policy
In the course of operating the website it maintains, the Data Controller processes the personal data of visitors to the website and of data subjects using certain services available on the website (hereinafter: Data Subject, Visitor, User) in accordance with Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (hereinafter: Infotv.) and with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: the Regulation, GDPR).
The Data Controller hereby informs Visitors to the website about registration, contact and the sending of newsletters through the website, and about other data processing necessarily associated with use of the website: the personal data it processes, the purpose of the processing, the retention period of the data, the way in which data are stored and transferred, the principles and practice it follows in processing personal data, and the ways and means by which Users can exercise their rights. The Data Controller acknowledges the legal content of this policy as binding upon itself. Amendments to this Privacy Policy take effect upon publication on the above website.
The Data Controller's data processing principles are in line with the data protection legislation in force, in particular the following:
− Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (hereinafter: Infotv.)
− Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services (in particular Section 13/A) (hereinafter: Eker. tv.)
− Act XLVII of 2008 on the Prohibition of Unfair Commercial Practices against Consumers;
− Act XLVIII of 2008 on the Basic Conditions and Certain Restrictions of Commercial Advertising Activities (in particular Section 6) (hereinafter: Grt.)
− Act C of 2000 on Accounting (hereinafter: Számv. tv.)
− Act CLV of 1997 on Consumer Protection (hereinafter: Fgytv.)
− Act XC of 2005 on Electronic Freedom of Information
− Act C of 2003 on Electronic Communications (specifically Section 155) (hereinafter: Eht.)
− Opinion 16/2011 on the EASA/IAB Best Practice Recommendation on Online Behavioural Advertising
1.2. Details and contact information of the Data Controller and of the Data Processors it uses
Company name:
INEX-TRADE Kft.
Registered office:
9946 Magyarszombatfa, Fő u. 6.
E-mail address:
info@kosborpanzio.hu
Telephone:
+36 30-9522478
Name of representative:
Molnár-Mersitz Ágnes, managing director
Company registration number:
18 09 109707
Tax number:
11551878-2-18
Privacy policy:
https://kosborpanzio.hu
If you have any questions or comments regarding the content or application of this Privacy Policy, or otherwise regarding the Data Controller's data processing, please let us know through any of the following contact details:
Dedicated data protection e-mail:
info@kosborpanzio.hu
Certain data processing operations involving personal data are carried out on behalf of the Data Controller, on the basis of a separate written contract, by the Data Processors listed below. The Data Controller ensures that every Data Processor it engages provides the guarantees necessary for the enforcement of the data protection rules in force and of measures protecting the rights of data subjects.
The Data Controller informs Users that the Data Processors may not take any substantive decision concerning the data processing, may process the personal data transferred to them, and thus coming to their knowledge, solely in accordance with the instructions of the Data Controller, and may not carry out data processing or data management on such data for their own purposes. Below, the Data Controller sets out the Data Processor undertakings related to the website with which it has a contractual relationship, indicating the personal data transferred to or coming to the knowledge of each Data Processor and the Data Processors' activities related to the data processing.
Name and contact details of the Data Processor:
Ininet Internet Kft.
Address: 1063 Budapest, Szinyei Merse u. 10.
Personal data:
personal data and contact data provided by Users through the website
Activity:
system development, optimisation, support and maintenance tasks related to the operation of the Data Controller's website
1.3. General rules of data processing
Data processing must at all times comply with the principle of purpose limitation. Accordingly, the Data Controller collects personal data only for specified, explicit and legitimate purposes and does not process them in a manner incompatible with those purposes; in line with the principle of data minimisation, it also endeavours to ensure that the collection and processing of data through the website it operates is limited to the data actually necessary to achieve the intended purpose.
Data processing may take place on a specific legal basis (consent or another lawful basis). Personal data must be processed fairly and in a manner transparent to the User. Information relating to data processing must be provided in an accurate, transparent, intelligible and easily accessible form, using clear and plain language.
Before recording any personal data, the Data Controller always informs the User of the purpose and the legal basis of the processing, the categories of data concerned and the duration of data storage (the period of processing). Employees carrying out data processing in the Data Controller's organisational units, and employees of organisations participating in the data processing or performing any operation thereof on behalf of the Data Controller, are obliged to keep the personal data they become aware of confidential as business secrets. The Data Controller ensures that persons who process personal data or have access to them sign a confidentiality declaration.
Data protection obligations applying to natural or legal persons, or organisations without legal personality, carrying out data processing activities on behalf of the Data Controller must be enforced in the data processing contract / data protection agreement concluded with the Data Processor. Personal data may be transferred to a data controller or Data Processor carrying out processing in a third country if the User has expressly consented to this, or if the conditions for data processing set out above are met and an adequate level of protection of personal data is ensured in the third country during the handling and processing of the transferred data. Data transfers to EEA states shall be regarded as if the data were being transferred within the territory of Hungary.
In the course of their work, the Data Controller's staff ensure that unauthorised persons cannot access personal data, and that personal data are stored and kept in such a way that they cannot be accessed, viewed, altered or destroyed by unauthorised persons.
The Data Controller does not verify the personal data provided to it. The person providing the personal data is solely responsible for their accuracy. When providing an e-mail address, every User accepts responsibility for ensuring that only they use services from the e-mail address provided. In view of this acceptance of responsibility, all liability in connection with logins using a given e-mail address lies solely with the User who registered that e-mail address. If a User provides personal data other than their own, they are obliged to obtain the consent of the person concerned.
2. DATA PROCESSING CARRIED OUT DURING USE OF THE WEBSITE
2.1. Contacting us through the website
Using the website's “Contact” form, Users may request information about the Data Controller and the services/products it provides, make suggestions, submit complaints or send messages with other content. The Data Controller uses the personal data provided by the User on the “Contact” form solely for the purpose of replying to the request for information, suggestion or other message sent by the User, and, in the case of a complaint, for recording, investigating and replying to the complaint, and for the communication necessary for this.
The User may give their consent by ticking the relevant box on the “Contact” form. The personal data provided by the User on the “Contact” form are not used for marketing purposes, nor are they passed on to any other external company for such purposes.
Name of data processing
Contacting us through the website
Purpose
Replying to a request for information, suggestion or other message sent by the User; in the case of a complaint, recording, investigating and replying to the complaint
Legal basis
In the case of a request for information, a suggestion or another message, the legal basis for the processing is the User's voluntary consent based on this information (GDPR Article 6(1)(a))
In the case of a complaint, the legal basis for the processing is the User's voluntary consent based on this information and Section 17/A(7) of Act CLV of 1997 on Consumer Protection (Fgytv.)
Data subjects
Users who complete the website's “Contact” form
Personal data
name, e-mail address, telephone number, content of the message, any other personal data disclosed in the message
Source of data
Personal data collected directly from the User
Duration of data processing
The personal data processed are deleted without delay once the purpose of processing ceases, i.e. after the request or message has been answered.
Where a complaint is made, the record taken of the complaint and a copy of the reply to the complaint are retained for 5 (five) years in accordance with Section 17/A(7) of the Fgytv.
Actual place of data processing
IT equipment located at the Data Controller's premises; for paper-based documents, the Data Controller's archive
Name and address of the data processor
Ininet Internet Kft.
Address: 1063 Budapest, Szinyei Merse u. 10.
Data processor's activity related to the data processing
Web hosting
2.2. Data processing relating to profiles created on social media sites
The Data Controller has its own profile on the Facebook content service and social networking site, on which it presents content about the Data Controller's services, products and news. The Data Controller does not compile statistics or analyse visitor traffic, either in general or in any way that would allow any natural person to be identified.
You can read more about Facebook's data policy here:
https://de-de.facebook.com/policy.php
Name of data processing
Data processing relating to profiles created on social media sites
Purpose
Sharing and promoting certain content elements, products and promotions of the Data Controller, or the website itself, on facebook.com.
Legal basis
The User's prior consent under GDPR Article 6(1)(a).
Data subjects
All Users who have registered on the above social media site and/or have liked the Data Controller's page.
Personal data
The name registered on the social media site concerned and the User's public profile picture.
Duration of data processing
The data processing takes place on the social media site concerned; the duration and method of processing, and the options for deleting and modifying data, are governed by the rules of the social media site concerned. (http://www.facebook.com/legal/terms?ref=pf), (http://www.facebook.com/about/privacy/)
Source of data
Personal data collected directly from the User.
2.3. Use of cookies
The Data Controller uses several types of cookies to ensure the smooth operation of the website and to improve the user experience. Cookies are small data files that are placed on the User's computer when visiting websites; they are created, saved and stored by the websites visited. The most commonly used browsers (Mozilla, Firefox, Google Chrome, etc.) accept and allow the downloading and use of cookies by default; however, the User can refuse or block them by changing the browser settings, and cookies stored on the computer can also be deleted. Further information on the use of cookies is available in the following menu items of the individual browsers:
Google Chrome: Tools - More settings - Security - Cookies
Internet Explorer: Tools - Internet options - Security - Advanced
Safari: Preferences - Security
Firefox: Tools - Settings - Security - Cookies
Opera: Settings - Options - Advanced - Cookies
On the website, the Data Controller typically uses “session cookies”, which are deleted automatically when the browser is closed. In some cases it also uses “persistent cookies”, which remain on the User's device until they expire or are deleted manually. Persistent cookies allow the Data Controller to recognise the User's browser on their next visit. For information on “third-party cookies”, i.e. cookies of third-party service providers such as Google Inc., please refer to the privacy rules of the provider concerned.
Accepting cookies is not mandatory; however, if they are not allowed, the website, or certain content or services available on the website, may not be available or may be available only in a limited form. The Data Controller does not use the cookies on the website to collect or store personally identifiable data, so these cookies cannot identify the User personally.
Type
Name
Consent
Description
Purpose
Validity
Session cookies
Cookies essential for the operation of the website
Not required
These cookies are necessary to enable Users to use the website
Ensuring the operation of the website
End of the browsing session
Tracking cookie for visit analysis (third-party)
Google Analytics
(_gat and _ga)
Required
They collect information on the use of the site and on the User's activity
Linked to the services of third parties (e.g. Google) during the visit to the website
2 years
Detailed information on third-party cookies is available at the following links:
Google Analytics - https://policies.google.com/technologies/types?hl=hu
2.4. Electronic surveillance system
An electronic surveillance and recording system operates at the Data Controller's premises (9946 Magyarszombatfa, Fő u. 6.), as part of which cameras have been installed in the outdoor areas of the guesthouse. During camera surveillance, the Data Controller records the facial images of data subjects. The cameras installed are capable of making and recording footage of a quality that allows the individual identification of those present. Where the recordings are used, the behaviour of the data subject may also be regarded as personal data, as a conclusion relating to the data subject.
Name of data processing
Electronic surveillance system
Purpose
For the protection of human life, physical integrity and property: the prevention and detection of infringements, catching offenders in the act and proving infringements, identifying persons entering the premises without permission, recording the fact of entry, documenting the activities of persons present without authorisation, and investigating the circumstances of any workplace or other accidents.
Legal basis
For visitors, guests and customers, the data subject's consent under GDPR Article 6(1)(a), given by entering the premises; for employees, Section 11 of Act I of 2012 on the Labour Code (Mt.) and GDPR Article 6(1)(f), as the Data Controller has a legitimate interest in the protection of property.
Data subjects
Visitors, customers and employees entering the premises.
Personal data
The facial images, visible in the recordings, of persons entering the premises and other personal data recorded by the surveillance system.
Source of data
Personal data collected directly from the User
Duration of data processing
72 hours after recording. After this period the recordings are deleted automatically, unless the police request the Data Controller to retain them for up to 30 days.
Actual place of data processing
IT equipment located at the Data Controller's premises.
Name and address of the data processor
INEX-TRADE Kft. 9946 Magyarszombatfa, Fő u. 6.
Data processor's activity related to the data processing
Maintenance of the electronic surveillance and recording system; exporting recordings.
Data transfer
In the event of infringement (petty offence) or criminal proceedings, to the authorities and courts conducting them.
Purpose of data transfer
The prevention and detection of infringements, catching offenders in the act and proving infringements.
Data transferred
Recordings made by the camera system containing relevant information.
Legal basis for data transfer
Section 71(1), Section 151(2)(a) and Section 171(2) of the Be. (Hungarian Act on Criminal Proceedings), and Section 75(1)(a) and Section 78(3) of the Sztv. (Hungarian Act on Petty Offences).
2.5. Other data processing
The Data Controller provides information on data processing not listed in this Policy at the time the data are collected.
Courts, prosecutors, investigating authorities, petty offence authorities, public administration authorities, the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság), and other bodies authorised by law may contact the Data Controller in order to obtain information, the disclosure or transfer of data, or the provision of documents.
The Data Controller discloses personal data to the authorities named above, which are not listed exhaustively, only where the authority has indicated the precise purpose, the scope of the data and the legal reference, and only to the extent strictly necessary to fulfil the purpose of the request.
3. HOW PERSONAL DATA IS STORED
3.1. Security of data processing
The Data Controller's computer systems and other data storage locations are located at its registered office and at the Data Processor(s) named in Section 1.2. The Data Controller selects and operates the IT equipment used to process personal data in the course of providing its services in such a way that the personal data processed:
− are accessible to those authorised to access them (availability);
− have assured authenticity and authentication (authenticity of processing);
− can be verified as unchanged (data integrity);
− are protected against unauthorised access (data confidentiality).
The Data Controller protects the data with appropriate measures, in particular against unauthorised access, alteration, transfer, disclosure, deletion or destruction, as well as against accidental destruction, damage, and loss of accessibility resulting from changes in the technology used.
To protect the data files managed electronically in its various records, the Data Controller ensures, by means of an appropriate technical solution, that the stored data cannot be directly linked to one another or attributed to Users, unless permitted by law. Taking into account the current state of the art, the Data Controller protects the security of data processing through technical and organisational measures that provide a level of protection appropriate to the risks arising in connection with the processing. In the course of data processing, the Data Controller maintains:
− confidentiality: it protects information so that only those authorised to do so can access it;
− integrity: it protects the accuracy and completeness of information and of the processing method;
− availability: it ensures that, when an authorised user needs it, they can actually access the desired information and the related tools are available.
The IT systems and networks of the Data Controller and its partners are protected against computer-assisted fraud, espionage, sabotage, vandalism, fire and flood, as well as against computer viruses, computer intrusions and denial-of-service attacks. The operator ensures security through server-level and application-level protection procedures.
We hereby inform Users that electronic messages transmitted over the internet, irrespective of protocol (e-mail, web, ftp, etc.), are vulnerable to network threats that may lead to dishonest activity, contract disputes, or the disclosure or modification of information. To protect against such threats, the Data Controller takes all precautions that can reasonably be expected of it. It monitors its systems in order to record any security deviation and to provide evidence in the event of any security incident. System monitoring also makes it possible to check the effectiveness of the precautions applied.
4. RIGHTS OF USERS
Under Article 15 of the GDPR, the User may request information from the Data Controller about the processing of their personal data, and may request the rectification of their personal data or – with the exception of mandatory data processing – their erasure or withdrawal, and may exercise their right to data portability and their right to object, in the manner indicated when the data were collected, or via the Data Controller's contact details set out in Section 1.2.
Right to information: At the User's request, the Data Controller provides information on the data it processes, or which are processed by a Data Processor engaged by it, their source, the purpose, legal basis and duration of the processing, the name and address of the data processor and its activities related to the processing, the circumstances and effects of any personal data breach and the measures taken to remedy it, and, in the case of a data transfer, its legal basis and recipient.
Procedural rules: The Data Controller provides the information in writing, in an intelligible form, at the User's request, within the shortest possible time from the submission of the request, but no later than within 25 days. This information is free of charge if the person requesting it has not yet submitted a request for information concerning the same set of data to the data controller in the current year. In other cases, the Data Controller determines a reimbursement of costs.
Right to rectification: The Data Controller rectifies personal data if they do not correspond to reality and the correct personal data are available to it.
Blocking and marking: The Data Controller blocks personal data if the User so requests, or if, on the basis of the information available to it, it can be assumed that erasure would harm the User's legitimate interests. Blocked personal data may be processed only for as long as the purpose of processing that precluded the erasure of the personal data continues to exist. The Data Controller marks personal data it processes if the User disputes their correctness or accuracy but the incorrectness or inaccuracy of the disputed personal data cannot be clearly established.
Right to erasure: The User is entitled to have the Data Controller erase personal data concerning them without undue delay at their request where one of the following grounds applies:
− the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
− the User withdraws the consent on which the processing is based and there is no other legal basis for the processing;
− the User objects to the processing and there are no overriding legitimate grounds for the processing;
− the personal data have been processed unlawfully;
− the personal data must be erased for compliance with a legal obligation under Union or Member State law to which the Data Controller is subject;
− the personal data have been collected in relation to the offer of information society services.
Erasure of data cannot be requested where the processing is necessary: for exercising the right of freedom of expression and information; for compliance with a legal obligation under Union or Member State law to which the Data Controller is subject that requires the processing of personal data, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller; for reasons of public interest in the area of public health, or for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes; or for the establishment, exercise or defence of legal claims.
Procedural rules: The Data Controller has 25 days to erase, block or rectify personal data. If the Data Controller does not comply with the User's request for rectification, blocking or erasure, it shall communicate the reasons for the refusal within 25 days in writing or, with the User's consent, by electronic means. The Data Controller notifies the User, and all those to whom it previously transferred the data for processing purposes, of the rectification, blocking, marking and erasure. Notification may be omitted if, having regard to the purpose of the processing, this does not harm the legitimate interests of the User.
Right to object: The User may object to the processing of their personal data if
− the processing or transfer of personal data is necessary solely for compliance with a legal obligation to which the data controller is subject, or for the purposes of the legitimate interests pursued by the Data Controller, the data recipient or a third party, unless the processing is required by law;
− the personal data are used or transferred for direct marketing, opinion polling or scientific research purposes;
− in other cases specified by law.
Procedural rules: The Data Controller examines the objection within the shortest possible time from the submission of the request, but no later than within 15 days, takes a decision on whether it is well founded, and informs the applicant of its decision in writing. If the Data Controller establishes that the User's objection is well founded, it terminates the processing – including any further data collection and data transfer – and blocks the data, and notifies the objection and the measures taken on the basis of it to all those to whom it previously transferred the personal data affected by the objection and who are obliged to take action to enforce the right to object. If the User does not agree with the Data Controller's decision, they may bring the matter before a court within 30 days of its communication.
Compensation and restitution for grievance: The Data Controller compensates for damage caused to others by the unlawful processing of the User's data or by breach of data security requirements. In the event of a violation of the User's personality rights, the User may claim restitution for grievance (sérelemdíj) under Section 2:52 of the Ptk. (Hungarian Civil Code). The Data Controller is also liable to the User for damage caused by the Data Processor. The Data Controller is exempt from liability if the damage was caused by an unavoidable cause outside the scope of the data processing. The Data Controller does not compensate for the damage, and no restitution for grievance may be claimed, to the extent that the damage or the infringement caused by the violation of personality rights resulted from the intentional or grossly negligent conduct of the User.
Right to go to court: In the event of a violation of their rights, the User may take legal action against the Data Controller before the courts. The court deals with the case as a matter of priority. The case falls within the jurisdiction of the regional court (törvényszék). At the User's choice, proceedings may also be brought before the regional court competent for the User's place of residence or place of stay.
Data protection authority procedure: Complaints may be lodged with the Hungarian National Authority for Data Protection and Freedom of Information:
Name: Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian National Authority for Data Protection and Freedom of Information)
Registered office: 1125 Budapest, Szilágyi Erzsébet fasor 22/C.
Postal address: 1530 Budapest, Pf.: 5
Telephone: +36 (1) 391-1400 Fax: +36 (1) 391-1410
E-mail: ugyfelszolgalat@naih.hu Website: http://www.naih.hu
